A multi-level signature method with anonymity for consortium blockchain

Abstract

The present invention discloses an anonymous multi-level signature method for alliance blockchain, which can limit transactions in the alliance blockchain to only clients approved by alliance members; through the combination of PKI system, multi-level signature and blockchain technology, the transaction source channel can be traced, and the special feature is that the privacy protection involved in the process can be completed, and only the corresponding node has the channel source information, which will not be synchronized to other nodes in the blockchain.

Description

[0001] This application is a divisional application filed for a Chinese patent application with an application date of "September 3, 2019", application number "201910827936.4", and name "A multi-level signature method with anonymity for consortium blockchain". Technical Field

[0002] The present invention relates to the field of blockchain transaction traceability, and in particular to a method for tracing and controlling access to transaction links in a consortium blockchain. Background Art

[0003] Blockchain technology, blockchain is a new decentralized protocol that can securely store digital currency transactions or other data. The information cannot be forged or tampered with. Transaction confirmation on the blockchain is completed by all nodes on the blockchain, and its consistency is guaranteed by the consensus algorithm. A public ledger is maintained on the blockchain. The public ledger is visible to any node on the storage block, thereby ensuring that it cannot be forged or tampered with.

[0004] Traditional consortium blockchain mainly uses the Public Key Infrastructure (PKI) PKI system for access control. The traditional PKI system generally uses certificates to control access and use certificates to represent user identities. For example, Hyperleger Fabric uses a centralized CA server to be responsible for identity authentication and certificate issuance and control, and uses the corresponding certificate to represent the client's identity and control client connections. Certificates are used to identify individuals, which makes it impossible to trace the source channel of the signature. For example, if there are existing institutions A and B, A institution user a, and B institution user b, if A institution obtains the public and private keys of B institution user b to initiate a transaction, it cannot be well traced back to the fact that the transaction was actually issued by institution A. It is necessary to strengthen the security of the entire transaction link and improve the transaction traceability mechanism. Blockchain technology itself has the characteristics of trusted evidence storage, which can ensure that the evidence is not tampered with, safe and reliable. Combining the traditional PKI system with this feature of blockchain can better solve the pain point that the source of the above-mentioned transaction channel cannot be stored. How to better combine the traditional PKI with the consortium blockchain system and apply it to actual production is a challenge currently faced. Summary of the invention

[0005] In view of the shortcomings of the prior art, the present invention proposes an anonymous multi-level signature method for alliance blockchain, which inherits the security of the traditional PKI system, and can not only complete the evidence storage of transaction source channels, but also ensure a certain anonymity.

[0006] The objective of the present invention is achieved through the following technical solutions:

[0007] A multi-level signature method with anonymity for a consortium blockchain comprises the following steps:

[0008] S1: The client user requests to obtain the client certificate: The client user sends a request to the blockchain node owner to obtain the client certificate. The request content includes the public key generated by the client user himself and the signature of the corresponding private key on the public key;

[0009] S2: The blockchain node owner verifies the client certificate request: First, the legitimacy of the signature is verified to ensure that the request comes from the owner of the public-private key pair. Second, the private key type is verified to be ECC. After the verification is passed, the blockchain node owner generates a client certificate and private key for the public key and returns them to the requesting client user.

[0010] S3: Requesting a transaction certificate: Before each transaction, the client user first requests a transaction certificate by first generating a temporary public-private key pair and sending a transaction certificate request to the blockchain node owner. The transaction certificate request includes the request body for the transaction certificate, the signature of the client certificate private key on the request body, and the client certificate.

[0011] S4: The blockchain node owner verifies the transaction certificate request: specifically, it verifies the legitimacy of the signature and verifies the client certificate. It needs to ensure that the transaction certificate is issued by this node. After the verification is passed, the node parses the temporary public key in the transaction certificate request, generates a corresponding transaction certificate for the public key, and returns it to the requesting client;

[0012] S5: Initiate a transaction: After the client user obtains the transaction certificate, the transaction is initiated. Specifically, a transaction is first generated, and then the client user uses the private key generated by himself to sign the transaction to obtain the signed transaction, and then constructs a request with the transaction, and then signs the request with the transaction certificate, and then sends the corresponding request body to the blockchain node with the transaction certificate. The blockchain node stores the transaction information and verifies the transaction, and then synchronizes other transaction information except the signature of the client transaction certificate to all nodes. Add an extended field to the transaction to store the signature representing the channel, that is, the signature of the client transaction certificate. The extended field will be saved in the node's ledger as part of the transaction, but without the consensus mechanism, so that the channel information of the transaction can be stored for future traceability.

[0013] Furthermore, in step S1, the public key and private key generated by the user are generated by the elliptic curve digital signature algorithm; wherein the hash value of the public key is used as the account address.

[0014] The beneficial effects of the present invention are as follows:

[0015] The present invention is applied to the blockchain network under the background of alliance chain. It is an anonymous multi-level signature method for alliance blockchain. It inherits the security of the traditional PKI system and can not only complete the storage of transaction source channels because it uses a new transaction certificate each time, but also can ensure a certain anonymity. It is an innovation of alliance blockchain technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 is a schematic diagram of the application and use of a transaction certificate in the method of the present invention;

[0017] Figure 2 It is a schematic diagram of generating a user account; DETAILED DESCRIPTION

[0018] The present invention will be described in detail below according to the accompanying drawings and preferred embodiments, and the purpose and effect of the present invention will become more clear. The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0019] like Figure 1 As shown, a multi-level signature method with anonymity for a consortium blockchain comprises the following steps:

[0020] S1: The client user requests to obtain the client certificate: The client user sends a request to the blockchain node owner to obtain the client certificate. The request content includes the public key generated by the client user himself and the signature of the corresponding private key on the public key; the private key is only kept properly by the user;

[0021] S2: The blockchain node owner verifies the client certificate request: first, the legitimacy of the signature is verified, and then the private key type is verified to be ECC. After the verification is passed, the blockchain node owner generates a client certificate and private key for the public key and returns them to the requesting client user;

[0022] S3: Requesting a transaction certificate: Before each transaction, the client user first requests a transaction certificate by first generating a temporary public-private key pair and sending a transaction certificate request to the blockchain node owner. The content of the transaction certificate request includes the request body for the transaction certificate, the signature of the client certificate private key on the request body, and the client certificate. The request body is the main content of the transaction, and other accompanying information is used to complete the corresponding identity proof based on the cryptographic algorithm;

[0023] S4: The blockchain node owner verifies the transaction certificate request: specifically, it verifies the legitimacy of the signature and verifies the client certificate. After the verification is passed, the blockchain node parses the temporary public key in the transaction certificate request, generates a corresponding transaction certificate for the public key and returns it to the requesting client;

[0024] S5: Initiate a transaction: After the client user obtains the transaction certificate, the transaction is initiated. Specifically, a transaction is first generated, and then the client user uses the private key generated by himself to sign the transaction to obtain the signed transaction, and constructs a request with the transaction, and then uses the transaction certificate to sign the request, and then sends the corresponding request body to the blockchain node with the transaction certificate. The blockchain node stores the transaction information and verifies the transaction, and then synchronizes other transaction information except the signature of the client transaction certificate to all nodes. The blockchain node feeds back the verification result to the user. If the verification is successful, it indicates that the transaction is successful; if the verification fails, it indicates that the transaction fails. The signature method of the present invention adds an extended field to store the signature representing the channel in the transaction, that is, the signature of the client transaction certificate. The extended field will be saved in the node's account book as part of the transaction, but without the consensus mechanism, so that the channel information of the transaction can be stored for future traceability. The extended field only exists in this node and will not be synchronized to other nodes of the alliance chain. Therefore, it can ensure that the corresponding privacy information is not leaked, but when necessary, the source of the transaction can be traced from this node.

[0025] As a preferred solution, Figure 2 As shown, in step S1, the public key and private key generated by the user are generated by the elliptic curve digital signature algorithm; the hash value of the public key is used as the account address. This ensures that each user can generate a non-repeated account address offline. When sending a transaction, the transaction is signed with the private key, indicating that the transaction is indeed issued by the owner of the account.

[0026] Those skilled in the art can understand that the above are only preferred examples of the invention and are not intended to limit the invention. Although the invention is described in detail with reference to the above examples, those skilled in the art can still modify the technical solutions recorded in the above examples or replace some of the technical features therein with equivalents. Any modification, equivalent replacement, etc. made within the spirit and principle of the invention shall be included in the protection scope of the invention.

Claims

1. A multi-level signature method with anonymity for alliance blockchain, characterized in that: Applied to a client, the method comprises: Before each transaction, a transaction certificate request is sent to a blockchain node, wherein the transaction certificate request includes a request body of the transaction certificate request, a first signature of a client certificate private key on the request body of the transaction certificate request, and a client certificate; The first signature and the client certificate are used by the blockchain node to verify the transaction certificate request; The client certificate and the client certificate private key are sent by the blockchain node to the client; Receiving the transaction certificate returned by the blockchain node in response to the transaction certificate request; Generate a transaction, sign the transaction using the private key generated by the client, and construct a transaction request based on the signed transaction; Signing the transaction request according to the transaction certificate to obtain a second signature of the transaction request, where the second signature is used by the blockchain node to verify the transaction certificate request; The second signature, the request body of the transaction request and the transaction certificate are sent to the blockchain node to initiate a transaction to the blockchain node.

2. The multi-level signature method according to claim 1, before sending the transaction certificate request to the blockchain node, the method further comprises: Sending a client certificate request to the blockchain node; The client certificate request includes the public key of the client and a third signature of the public key by a private key corresponding to the public key; The third signature and the public key are used by the blockchain node to verify the client certificate request; Receive a client certificate returned by the blockchain node in response to the client certificate request.

3. The multi-level signature method as claimed in claim 2, characterized in that: The sending of a transaction certificate request to a blockchain node includes: Generate a temporary key pair based on a cryptographic algorithm, wherein the temporary key pair includes a temporary public key and a temporary private key; Determining a request body of the transaction certificate request according to the temporary public key and the transaction content; Signing the request body of the transaction certificate request according to the private key corresponding to the client certificate to obtain the first signature; Determining the transaction certificate request according to the request body of the transaction certificate request, the first signature and the client certificate; The transaction certificate request is sent to the blockchain node.

4. The multi-level signature method as claimed in claim 3, characterized in that: The step of signing the transaction request according to the transaction certificate to obtain a second signature of the transaction request includes: The transaction request is signed using the private key generated by the client to obtain a second signature of the transaction request.

5. A multi-level signature method with anonymity for a consortium blockchain, characterized in that: Applied to a blockchain node, the method comprises: Receive a transaction certificate request sent by a client, wherein the transaction certificate request includes a request body of the transaction certificate request, a first signature of the client certificate private key on the request body of the transaction certificate request, and a client certificate, wherein the client certificate and the client certificate private key are sent by the blockchain node to the client; verifying the transaction certificate request based on the first signature and the client certificate; If the transaction certificate request is verified, the transaction certificate is returned to the client, and the client is used to sign the transaction using the private key generated by the client, and construct a transaction request based on the signed transaction; and signing the transaction request according to the transaction certificate to obtain a second signature of the transaction request, where the second signature is used by the blockchain node to verify the transaction certificate request; The client is used to send the second signature, the request body of the transaction request and the transaction certificate to the blockchain node to initiate a transaction to the blockchain node; receiving a transaction request sent by the client based on the transaction certificate; Verifying the transaction request according to the signature of the transaction request; If the transaction request is verified successfully, other transaction information except the signature obtained using the client transaction certificate will be synchronized to other nodes in the alliance chain where the blockchain node is located.

6. The multi-level signature method as claimed in claim 5, characterized in that: Before receiving the transaction certificate request sent by the client, the method further includes: Receiving a client certificate request sent by the client, wherein the client certificate request includes a public key of the client and a third signature of the public key by a private key corresponding to the public key; verifying the client certificate request according to the third signature and the public key; If the client certificate request is verified successfully, the client certificate is returned to the client.

7. The multi-level signature method as claimed in claim 6, characterized in that: The verifying the client certificate request according to the third signature and the public key includes: Determining whether the third signature is legitimate; Determine whether the generation algorithm of the private key corresponding to the public key is an elliptic curve algorithm; If the transaction certificate request is verified successfully, and the generation algorithm of the private key corresponding to the public key is the elliptic curve algorithm, it is determined that the client certificate request is verified successfully.

8. The multi-level signature method according to any one of claims 5 to 7, characterized in that: If the transaction certificate request is verified successfully, returning the transaction certificate to the client includes: Parsing the transaction certificate request to obtain a temporary public key, where the temporary public key is generated by the client based on a cryptographic algorithm and has a corresponding temporary private key; Generate a transaction certificate corresponding to the temporary public key; The transaction certificate is sent to the client.

9. The multi-level signature method as claimed in claim 8, characterized in that: The method further comprises: Transaction information corresponding to the transaction request is stored, wherein the transaction information includes a signature obtained using the client transaction certificate.

Images