A method and system for receiver identity privacy protection and tracking

Abstract

The application discloses a kind of receiver identity privacy protection and tracking method and system, it is related to privacy protection technical field, comprising: sender obtains receiver long-term public key;Sender or receiver uses receiver long-term public key to calculate one-time public key;Sender uses encryption algorithm, uses one-time public key to encrypt the data to be sent, generates ciphertext;Sender sends one-time public key and ciphertext to public system;Receiver obtains one-time public key and ciphertext from public system, calculates corresponding one-time private key according to one-time public key, and verifies whether the one-time private key generated is correct;Receiver uses decryption algorithm, uses one-time private key to decrypt ciphertext, generates decryption data;Supervisor uses supervisor long-term private key and one-time public key to calculate receiver long-term public key, and tracks receiver identity information.The application can calculate the long-term public key of receiver based on one-time public key, and track the identity of receiver based on this, realize supervision function.

Description

Technical Field

[0001] This invention relates to the field of privacy protection technology, and in particular to a method and system for protecting and tracking the identity privacy of a recipient. Background Technology

[0002] Ring signature technology is used to protect the privacy of the sender's identity. In ring signature technology, the verifier uses multiple public keys to verify the correctness of a ring signature without knowing which public key corresponds to the signature. Patent CN 113935065A discloses a method for protecting and monitoring the identity privacy of a consortium blockchain based on ring signatures. While using ring signatures to protect user identity privacy in the consortium blockchain, it solves the problem of difficulty in monitoring and accountability caused by the complete anonymity of ring signatures by recording ring members, ring signature actions, and data on the blockchain, thus enabling subsequent auditing and monitoring measures. In a monitorable blockchain system environment, because regulators need to trace the identity of the sender, ring signature technology is insufficient to meet the needs of monitorable applications. Therefore, traceable ring signature technology has emerged, enabling regulators to trace the identity of the signer (sender).

[0003] CryptoNote V2.0 introduces one-time address technology to protect the recipient's identity privacy. This technology comprises four steps: (1) the sender calculates a one-time address using the recipient's long-term public key and uses this address to encrypt data; (2) the sender sends the ciphertext data and the one-time address to the recipient; (3) the recipient calculates the private key corresponding to the one-time address; and (4) the recipient can decrypt the ciphertext based on the one-time private key. Since the one-time address appears only once in each transaction, attackers cannot know which user the one-time address belongs to, thus ensuring the recipient's anonymity.

[0004] The invention patent with publication number CN113111386A discloses a method for protecting the privacy of blockchain transaction data. This method verifies node information, adds detected malicious nodes to a blacklist, and uses encryption to transmit transaction data, thus protecting user transaction data privacy. While protecting the privacy of the recipient's identity is a significant application requirement in a regulated blockchain system environment, it also necessitates the supervision of the recipient's identity. Summary of the Invention

[0005] Therefore, it is necessary to provide a method and system for protecting and tracking the identity privacy of recipients, addressing the problems of traditional technologies, so as to not only protect the identity privacy of recipients, but also to implement recipient identity tracking technology.

[0006] In a first aspect, embodiments of the present invention provide a method for protecting and tracking the identity privacy of a recipient, including:

[0007] The sender obtains the receiver's long-term public key;

[0008] The sender or receiver uses the receiver's long-term public key to calculate the one-time public key;

[0009] The sender uses an encryption algorithm and the one-time public key to encrypt the data to be sent, generating ciphertext;

[0010] The sender sends the one-time public key and the ciphertext to the public system;

[0011] The recipient obtains the one-time public key and the ciphertext from the public system;

[0012] The receiver calculates the corresponding one-time private key based on the one-time public key and verifies whether the generated one-time private key is correct;

[0013] The receiver uses a decryption algorithm and the one-time private key to decrypt the received ciphertext and generate decrypted data.

[0014] The regulator uses its long-term private key and the one-time public key to calculate the recipient's long-term public key, and tracks the recipient's identity information based on the binding relationship between the recipient's long-term public key and identity information.

[0015] Preferably, obtaining the recipient's long-term public key includes:

[0016] Set elliptic curve y 2 = x 3 + axe + b ,in, O Let be the origin of the elliptic curve. G Let it be a base point on the elliptic curve group. n Base point of elliptic curve G The rank, n It is a prime number; a and b These are the coefficients of the elliptic curve;

[0017] use Denotes the elliptic curve group, where the annulus Z / nZ The elements in Z / are multiplicative invertible, Z / nZ This constitutes a domain; in which, Z It is a natural number, Z / nZ Describes a set, the elements of which include: belonging to Z And divided by n All numbers with a remainder of 0, belonging to Z And divided by n All numbers with a remainder of 1, belonging to Z And divided by nAll numbers with a remainder of 2, ..., belonging to Z And divided by n Remain n All numbers -1;

[0018] Using two hash functions Hash 1. Hash 2. Take any length of 0 or 1 bit data or group respectively The elements in the map are mapped to 0 to 1. n Natural numbers in the range of -1, i.e. Hash 1:{1,0} * → Z n , Hash 2: → Z n ;

[0019] Among them, hash function Hash The input for function 1 is any length of 0 or 1, and the output is a natural number between 0 and n-1; hash function Hash The input of 2 is a group The elements in the array are natural numbers between 0 and n-1; the asterisk (*) represents any length of 0 / 1 bits; {0,1} * Represents 0 / 1 bit data of arbitrary length; Z n It is from 0 to n Natural numbers between -1 and 1; → indicates a mapping.

[0020] The system parameters are expressed as follows:

[0021] SP =( a , b , , G , n , Hash 1, Hash 2),

[0022] The sender selects two random numbers. a 1, b 1∈ Z n * And calculate as follows:

[0023] A 1← a 1• G

[0024] B 1← b 1• G ;

[0025] The sender's long-term private key is sk 1=( a 1, b 1) The sender's long-term public key is PK 1=( A 1, B 1);

[0026] The receiver selects two random numbers. a 2, b 2∈ Z n * And calculate as follows:

[0027] A 2← a 2• G

[0028] B 2← b 2• G ;

[0029] The recipient's long-term private key is sk 2=( a 2, b 2) The recipient's long-term public key is PK 2=( A 2, B 2);

[0030] The regulators selected two random numbers. a 3, b 3∈ Z n * And calculate as follows:

[0031] A 3← a 3• G

[0032] B 3← b 3• G ;

[0033] The regulator's long-term private key is sk 3=( a 3, b 3) The regulator's long-term public key is PK 3=( A 3, B 3);

[0034] in, Z n * From 1 to n Natural numbers in the range of -1;

[0035] The left arrow (←) indicates that the function value calculated to the right of the symbol is assigned to the parameter to the left of the symbol.

[0036] Preferably, calculating the one-time public key using the recipient's long-term public key includes:

[0037] The sender selects a random number r 1∈ Z n * Input the sender's local private key a 1. Recipient's long-term public key PK 2=( A 2, B 2) Local public key of the regulator A 3. Perform the following calculations:

[0038] r 2← Hash 1( r 1, a 1• A 2),

[0039] r 3← Hash 2 ( r 2• A 3),

[0040] R ← r 2• G ,

[0041] PK 2 OneTime ← r 3• G+R+B 2,

[0042] A one-time public key is represented as: Addr =( PK 2 OneTime , R , r 1);

[0043] or,

[0044] The receiver selects a random number. r 1′∈ Z n * Input the recipient's long-term private key sk 2=( a 2, b 2) Sender's local public key A 1. Local public key of the regulator A 3. Perform the following calculations:

[0045] r 2′← Hash 1( r 1′, a 2• A 1),

[0046] r 3′← Hash 2 ( r 2′• A 3),

[0047] R '← r 2′• G ,

[0048] PK 2 OneTime '← r 3′• G+ R ′ + B 2,

[0049] A one-time public key is represented as: Addr ′=( PK 2 OneTime ′, R ′, r 1′);

[0050] The left arrow (←) indicates that the function value calculated to the right of the symbol is assigned to the parameter to the left of the symbol.

[0051] Preferably, the recipient calculates the corresponding one-time private key based on the one-time public key, including:

[0052] The recipient enters their long-term private key. sk 2=( a 2, b 2) One-time public keys obtained from public systems Addr =( PK 2 OneTime , R , r 1) Sender's local public key A 1 and the regulator's local public key A 3. Perform the following calculations:

[0053] r 2← Hash 1( r 1, a 2• A 1),

[0054] r 3← Hash 2 ( r 2• A 3),

[0055] sk 2 OneTime ← r 3 + r 2 + b 2,

[0056] If the following check equation holds:

[0057] R= r 2• G

[0058] PK 2 OneTime = sk 2 OneTime • G ;

[0059] The one-time private key calculation is correct.

[0060] Preferably, the regulator uses its private key and the one-time public key to determine the recipient's long-term public key, including:

[0061] The regulator inputs its local private key. a 3. and a one-time public key obtained from a public system. Addr =( PK 2 OneTime , R , r 1) Perform the following calculations:

[0062] r 3← Hash 2 ( a 3• R ),

[0063] B 2← PK 2 OneTime – R – r 3• G

[0064] The regulator calculates the recipient's long-term public key. B 2. Based on the binding relationship between the recipient's long-term public key and identity information, the recipient's identity information can be tracked to achieve supervision.

[0065] Preferably, obtaining the recipient's long-term public key includes:

[0066] set up G ′ is the prime group, and its generator is g ;

[0067] Using two hash functions Hash 1. Hash 2. Take any length of 0 or 1 bit data or group respectively GThe elements in ' are mapped to 0 to 1. n Natural numbers in the range of -1, i.e. Hash 1:{1,0} * → Z n , Hash 2: G ′→ Z n ;

[0068] Among them, hash function Hash The input for 1 is any length of 0 or 1, and the output range is 0 to 1. n Natural numbers between -1; hash function Hash The input of 2 is a group G The elements in '' will be output in the range of 0 to 1. n Natural numbers between -1 and 1; * represents any length of 0 / 1 bits; {0,1} * Represents 0 / 1 bit data of arbitrary length; Z n It is a natural number between 0 and n-1; → represents a mapping;

[0069] The system parameters are expressed as follows:

[0070] SP =( G ′, g , n , Hash 1, Hash 2);

[0071] The sender selects two random numbers. a 1, b 1∈ Z n * And calculate as follows:

[0072] g 1← g a1

[0073] h 1← g b1

[0074] The sender's long-term private key is sk 1=( a 1, b 1) The sender's long-term public key is PK 1=( g 1, h 1);

[0075] The receiver selects two random numbers. a 2, b 2∈Z n * And calculate as follows:

[0076] g 2← g a2

[0077] h 2← g b2

[0078] The recipient's long-term private key is sk 2=( a 2, b 2) The recipient's long-term public key is PK 2=( g 2, h 2);

[0079] The regulators selected two random numbers. a 3, b 3∈ Z n * And calculate as follows:

[0080] g 3← g a3

[0081] h 3← g b3

[0082] The regulator's long-term private key is sk 3=( a 3, b 3) The regulator's long-term public key is PK 3=( g 3, h 3);

[0083] in, Z n * From 1 to n Natural numbers in the range of -1;

[0084] The left arrow (←) indicates that the function value calculated to the right of the symbol is assigned to the parameter to the left of the symbol.

[0085] Preferably, calculating the one-time public key using the recipient's long-term public key includes:

[0086] The sender selects a random number r 1∈ Z n * Input the sender's local private keya 1. Recipient's long-term public key PK 2=( g 2, h 2) Local public key of the regulator A 3. Perform the following calculations:

[0087] r 2← Hash 1( r 1, g 2 a1 ),

[0088] r 3← Hash 2 ( g 3 r2 ),

[0089] r ← g r2 ,

[0090] PK 2 OneTime ← g r3 • r • h 2,

[0091] A one-time public key is represented as: Addr =( PK 2 OneTime , r , r 1);

[0092] or,

[0093] The receiver selects a random number. r 1′∈ Z n * Input the recipient's long-term private key sk 2=( a 2, b 2) Sender's local public key A 1. Local public key of the regulator A 3. Perform the following calculations:

[0094] r 2′← Hash 1( r 1′, g 1 a2 ),

[0095] r 3′← Hash 2 ( g 3 r2′),

[0096] r '← g r2′ ,

[0097] PK 2 OneTime '← g r3′ • r • h 2

[0098] A one-time public key is represented as: Addr ′=( PK 2 OneTime ′, r ′, r 1′).

[0099] Preferably, the recipient calculates the corresponding one-time private key based on the one-time public key, including:

[0100] The recipient enters their long-term private key. sk 2=( a 2, b 2) One-time public keys obtained from public systems Addr =( PK 2 OneTime , r , r 1) Sender's local public key A 1 and the regulator's local public key A 3. Perform the following calculations:

[0101] r 2← Hash 1( r 1, g 1 a2 ),

[0102] r 3← Hash 2 ( g 3 r2 )

[0103] sk 2 OneTime ← r 3• r 2• b 2

[0104] If the following check equation holds:

[0105] r = g r2

[0106] ;

[0107] The one-time private key calculation is correct.

[0108] Preferably, the regulator uses its private key and the one-time public key to determine the recipient's long-term public key, including:

[0109] The regulator inputs its local private key. a 3 and a one-time public key obtained from a public system Addr =( PK 2 OneTime , r , r 1) Perform the following calculations:

[0110] r 3← Hash 2 ( a 3• r ),

[0111] h 2← PK 2 OneTime / ( r • g r3 )

[0112] The regulator calculates the recipient's long-term public key. h 2. Based on the binding relationship between the recipient's long-term public key and identity information, the recipient's identity information can be tracked to achieve supervision.

[0113] Furthermore, this application also provides a recipient identity privacy protection and tracking system, including: a sender, a recipient, and a regulator;

[0114] The sender obtains the receiver's long-term public key;

[0115] The sender or receiver uses the receiver's long-term public key to calculate the one-time public key;

[0116] The sender uses an encryption algorithm and the one-time public key to encrypt the data to be sent, generating ciphertext;

[0117] The sender sends the one-time public key and the ciphertext to the public system;

[0118] The recipient obtains the one-time public key and the ciphertext from the public system;

[0119] The receiver calculates the corresponding one-time private key based on the one-time public key and verifies whether the generated one-time private key is correct;

[0120] The receiver uses a decryption algorithm and the one-time private key to decrypt the received ciphertext and generate decrypted data.

[0121] The regulator uses its long-term private key and the one-time public key to calculate the recipient's long-term public key, and tracks the recipient's identity information based on the binding relationship between the recipient's long-term public key and identity information.

[0122] This invention provides a method and system for recipient identity privacy protection and tracking. The sender uses the recipient's long-term public key to generate a one-time public key and uses it to encrypt information. Once the ciphertext is stored in a public system, the corresponding recipient can calculate the one-time private key corresponding to the one-time public key and use it to decrypt the ciphertext. Therefore, the one-time public key protects user identity privacy. Furthermore, regulators can calculate the recipient's long-term public key based on the one-time public key and track the recipient's identity based on the long-term public key, thus achieving regulatory functionality. Attached Figure Description

[0123] Figure 1 This is a flowchart illustrating a recipient identity privacy protection and tracking method according to one embodiment of the present invention. Detailed Implementation

[0124] Embodiments of the present invention are described in detail below. Examples of these embodiments are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0125] like Figure 1 The diagram shown is a flowchart illustrating a method for protecting and tracking the identity privacy of a recipient, as described in one embodiment. Specifically, it includes the following steps:

[0126] Step S101: The sender obtains the receiver's long-term public key;

[0127] Step S102: The sender or receiver uses the receiver's long-term public key to calculate the one-time public key;

[0128] Step S103: The sender uses an encryption algorithm and the one-time public key to encrypt the data to be sent, generating ciphertext;

[0129] Step S104: The sender sends the one-time public key and the ciphertext to the public system;

[0130] Step S105: The receiver obtains the one-time public key and the ciphertext from the public system;

[0131] Step S106: The receiver calculates the corresponding one-time private key based on the one-time public key and verifies whether the generated one-time private key is correct;

[0132] Step S107: The receiver uses a decryption algorithm and the one-time private key to decrypt the received ciphertext and generate decrypted data.

[0133] Step S108: The regulator calculates the receiver's long-term public key using the regulator's long-term private key and the one-time public key, and tracks the receiver's identity information based on the binding relationship between the receiver's long-term public key and identity information.

[0134] Because the long-term public key is bound to user identity information, obtaining the user's long-term public key allows access to that user's identity information. Therefore, in this embodiment of the invention, the sender uses the receiver's long-term public key to generate a one-time public key and uses it to encrypt information. When the ciphertext is stored on a public system (such as a blockchain), the corresponding receiver can calculate the one-time private key corresponding to the one-time public key and use it to decrypt the ciphertext. Thus, the one-time public key protects user identity privacy. Furthermore, regulators can calculate the receiver's long-term public key based on the one-time public key, and use the long-term public key to track the receiver's identity, thereby achieving regulatory functions.

[0135] In this embodiment of the invention, step S101, obtaining the recipient's long-term public key, includes:

[0136] Set elliptic curve y 2 = x 3 + axe + b ,in, O Let be the origin of the elliptic curve. G Let it be a base point on the elliptic curve group. n Base point of elliptic curve G The rank, n It is a prime number; a and b These are the coefficients of the elliptic curve;

[0137] use Denotes the elliptic curve group, where the annulus Z / nZ The elements in Z / are multiplicative invertible, Z / nZ This constitutes a domain; in which, Z It is a natural number, Z / nZ Describes a set, the elements of which include: belonging to Z And divided by n All numbers with a remainder of 0, belonging to Z And divided by n All numbers with a remainder of 1, belonging to Z And divided by n All numbers with a remainder of 2, ..., belonging to Z And divided by n Remain n All numbers -1;

[0138] Using two hash functions Hash 1. Hash 2. Take any length of 0 or 1 bit data or group respectively The elements in the map are mapped to 0 to 1. n Natural numbers in the range of -1, i.e. Hash 1:{1,0} * → Z n , Hash 2: → Z n ;

[0139] Among them, hash function Hash The input for function 1 is any length of 0 or 1, and the output is a natural number between 0 and n-1; hash function Hash The input of 2 is a group The elements in the array are natural numbers between 0 and n-1; the asterisk (*) represents any length of 0 / 1 bits; {0,1} * Represents 0 / 1 bit data of arbitrary length; Z n It is from 0 to n Natural numbers between -1;

[0140] The system parameters are expressed as follows:

[0141] SP =( a , b , , G , n , Hash 1, Hash 2),

[0142] The sender selects two random numbers. a 1, b 1∈ Z n * And calculate as follows:

[0143] A 1← a 1• G

[0144] B 1← b 1• G ;

[0145] The sender's long-term private key is sk 1=( a 1, b 1) The sender's long-term public key is PK1=( A 1, B 1);

[0146] The receiver selects two random numbers. a 2, b 2∈ Z n * And calculate as follows:

[0147] A 2← a 2• G

[0148] B 2← b 2• G ;

[0149] The recipient's long-term private key is sk 2=( a 2, b 2) The recipient's long-term public key is PK 2=( A 2, B 2);

[0150] The regulators selected two random numbers. a 3, b 3∈ Z n * And calculate as follows:

[0151] A 3← a 3• G

[0152] B 3← b 3• G ;

[0153] The regulator's long-term private key is sk 3=( a 3, b 3) The regulator's long-term public key is PK 3=( A 3, B 3);

[0154] in, Z n * From 1 to n Natural numbers in the range of -1.

[0155] Z n It is from 0 to n Natural numbers between -1 and 1; the subscript * indicates that the value cannot be 0. Zn * Expressed as 1 to n Natural numbers in the range of -1.

[0156] In this embodiment of the invention, step S102, which uses the receiver's long-term public key to calculate the one-time public key, includes:

[0157] The sender selects a random number r 1∈ Z n * Input the sender's local private key a 1. Recipient's long-term public key PK 2=( A 2, B 2) Local public key of the regulator A 3. Perform the following calculations:

[0158] r 2← Hash 1( r 1, a 1• A 2),

[0159] r 3← Hash 2 ( r 2• A 3),

[0160] R ← r 2• G ,

[0161] PK 2 OneTime ← r 3• G+R+B 2,

[0162] A one-time public key is represented as: Addr =( PK 2 OneTime , R , r 1);

[0163] or,

[0164] The receiver selects a random number. r 1′∈ Z n * Input the recipient's long-term private key sk 2=( a 2, b 2) Sender's local public key A 1. Local public key of the regulator A3. Perform the following calculations:

[0165] r 2′← Hash 1( r 1′, a 2• A 1),

[0166] r 3′← Hash 2 ( r 2′• A 3),

[0167] R '← r 2′• G ,

[0168] PK 2 OneTime '← r 3′• G+ R ′ + B 2,

[0169] A one-time public key is represented as: Addr ′=( PK 2 OneTime ′, R ′, r 1′);

[0170] The left arrow (←) indicates that the function value calculated to the right of the symbol is assigned to the parameter to the left of the symbol.

[0171] In this embodiment of the invention, Addr =( PK 2 OneTime , R , r 1) A one-time address generated by the sender. Wherein, ( R , r 1) is auxiliary information. PK 2 OneTime This is the recipient's one-time public key. The sender uses the one-time public key in the one-time address to encrypt data and also uses the sender's local public key. A 1. To the recipient. If the recipient uses a new one-time address for each transaction. Addr Therefore, an attacker using arbitrary polynomial-time methods cannot trace the long-term public key. In this embodiment of the invention, the receiver can also independently generate a one-time address. Addr ′=( PK 2 OneTime ′, R ′, r 1′). For these two cases respectively:

[0172] (1) Method for the sender to generate the receiver's one-time public key: The receiver's long-term public key is public. The sender and receiver transmit and obtain the receiver's long-term public key through the network. In this embodiment of the invention, the sender obtains the receiver's long-term public key and then generates a one-time public key. Addr =( PK 2 OneTime , R , r 1). (2) If the receiver generates the one-time public key: The sender and receiver transmit the one-time public key over the network and the sender obtains the receiver's one-time public key. Then the sender uses the one-time public key. Addr ′=( PK 2 OneTime ′, R ′, r 1') Encrypt the data to be sent. The calculation process for generating these two one-time public keys is the same, so it will not affect the subsequent steps of generating one-time private keys and the tracking calculation principle of the regulator.

[0173] With a one-time public key, the sender can use an encryption algorithm to encrypt the data to be sent and send it to a public system. The receiver can then obtain the ciphertext and the one-time public key from the public system. In this embodiment of the invention, no restriction is placed on the encryption algorithm; any public key encryption algorithm can be used.

[0174] In this embodiment of the invention, step S106, in which the receiver calculates the corresponding one-time private key based on the one-time public key, includes:

[0175] The recipient enters their long-term private key. sk 2=( a 2, b 2) One-time public keys obtained from public systems Addr =( PK 2 OneTime , R , r 1) Sender's local public key A 1 and the regulator's local public key A 3. Perform the following calculations:

[0176] r 2← Hash 1( r 1, a 2• A 1),

[0177] r 3← Hash 2 ( r 2• A 3),

[0178] sk 2 OneTime ←r 3 + r 2 + b 2,

[0179] If the following check equation holds:

[0180] R= r 2• G

[0181] PK 2 OneTime = sk 2 OneTime • G ;

[0182] The one-time private key calculation is correct.

[0183] In this embodiment of the invention, consistency verification ensures one-time address accuracy. Addr Auxiliary information R and one-time public key PK 2 OneTime That's correct. If the verification equation holds, the receiver will calculate the one-time private key. sk 2 OneTime Corresponding to one-time public key PK 2 OneTime The recipient can use this one-time private key to decrypt ciphertext obtained from a public system to obtain plaintext data, thus enabling anonymous data reception.

[0184] In this embodiment of the invention, step S108, in which the regulator uses its private key and the one-time public key to determine the recipient's long-term public key, includes:

[0185] The regulator inputs its local private key. a 3. and a one-time public key obtained from a public system. Addr =( PK 2 OneTime , R , r 1) Perform the following calculations:

[0186] r 3← Hash 2 ( a 3• R ),

[0187] B 2← PK 2 OneTime – R – r 3• G

[0188] The regulator calculates the recipient's long-term public key. B2. Based on the binding relationship between the recipient's long-term public key and identity information, the recipient's identity information can be tracked to achieve supervision.

[0189] In some application scenarios, prime number groups are used as parameters for cryptographic systems.

[0190] In this embodiment of the invention, step S101, obtaining the recipient's long-term public key, includes:

[0191] set up G ′ is the prime group, and its generator is g ;

[0192] Using two hash functions Hash 1. Hash 2. Take any length of 0 or 1 bit data or group respectively G The elements in ' are mapped to 0 to 1. n Natural numbers in the range of -1, i.e. Hash 1:{1,0} * → Z n , Hash 2: G ′→ Z n ;

[0193] Among them, hash function Hash The input for 1 is any length of 0 or 1, and the output range is 0 to 1. n Natural numbers between -1; hash function Hash The input of 2 is a group G The elements in '' will be output in the range of 0 to 1. n Natural numbers between -1 and 1; * represents any length of 0 / 1 bits; {0,1} * Represents 0 / 1 bit data of arbitrary length; Z n It is a natural number between 0 and n-1;

[0194] The system parameters are expressed as follows:

[0195] SP =( G ′, g , n , Hash 1, Hash 2);

[0196] The sender selects two random numbers. a 1, b 1∈ Z n * And calculate as follows:

[0197] g 1←g a1

[0198] h 1← g b1

[0199] The sender's long-term private key is sk 1=( a 1, b 1) The sender's long-term public key is PK 1=( g 1, h 1);

[0200] The receiver selects two random numbers. a 2, b 2∈ Z n * And calculate as follows:

[0201] g 2← g a2

[0202] h 2← g b2

[0203] The recipient's long-term private key is sk 2=( a 2, b 2) The recipient's long-term public key is PK 2=( g 2, h 2);

[0204] The regulators selected two random numbers. a 3, b 3∈ Z n * And calculate as follows:

[0205] g 3← g a3

[0206] h 3← g b3

[0207] The regulator's long-term private key is sk 3=( a 3, b 3) The regulator's long-term public key is PK 3=( g 3, h 3);

[0208] in, Z n * From 1 to n Natural numbers in the range of -1.

[0209] In this embodiment of the invention, step S102, calculating the one-time public key using the receiver's long-term public key, includes:

[0210] The sender selects a random number r 1∈ Z n * Input the sender's local private key a 1. Recipient's long-term public key PK 2=( g 2, h 2) Local public key of the regulator A 3. Perform the following calculations:

[0211] r 2← Hash 1( r 1, g 2 a1 ),

[0212] r 3← Hash 2 ( g 3 r2 ),

[0213] r ← g r2 ,

[0214] PK 2 OneTime ← g r3 • r • h 2,

[0215] A one-time public key is represented as: Addr =( PK 2 OneTime , r , r 1);

[0216] or,

[0217] The receiver selects a random number. r 1′∈ Z n * Input the recipient's long-term private key sk 2=( a 2, b2) Sender's local public key A 1. Local public key of the regulator A 3. Perform the following calculations:

[0218] r 2′← Hash 1( r 1′, g 1 a2 ),

[0219] r 3′← Hash 2 ( g 3 r2′ ),

[0220] r '← g r2′ ,

[0221] PK 2 OneTime '← g r3′ • r • h 2

[0222] A one-time public key is represented as: Addr ′=( PK 2 OneTime ′, r ′, r 1′).

[0223] In this embodiment of the invention, step S106, where the receiver calculates the corresponding one-time private key based on the one-time public key, includes:

[0224] The recipient enters their long-term private key. sk 2=( a 2, b 2) One-time public keys obtained from public systems Addr =( PK 2 OneTime , r , r 1) Sender's local public key A 1 and the regulator's local public key A 3. Perform the following calculations:

[0225] r 2← Hash 1( r 1, g 1 a2 ),

[0226] r 3← Hash 2 ( g 3r2 )

[0227] sk 2 OneTime ← r 3• r 2• b 2

[0228] If the following check equation holds:

[0229] r = g r2

[0230] ;

[0231] The one-time private key calculation is correct.

[0232] In this embodiment of the invention, step S108, in which the regulator uses its private key and the one-time public key to determine the recipient's long-term public key, includes:

[0233] The regulator inputs its local private key. a 3 and a one-time public key obtained from a public system Addr =( PK 2 OneTime , r , r 1) Perform the following calculations:

[0234] r 3← Hash 2 ( a 3• r ),

[0235] h 2← PK 2 OneTime / ( r • g r3 )

[0236] The regulator calculates the recipient's long-term public key. h 2. Based on the binding relationship between the recipient's long-term public key and identity information, the recipient's identity information can be tracked to achieve supervision.

[0237] This invention also provides a receiver identity privacy protection and tracking system, including: a sender, a receiver, and a supervisor;

[0238] The sender obtains the receiver's long-term public key;

[0239] The sender or receiver uses the receiver's long-term public key to calculate the one-time public key;

[0240] The sender uses an encryption algorithm and the one-time public key to encrypt the data to be sent, generating ciphertext;

[0241] The sender sends the one-time public key and the ciphertext to the public system;

[0242] The recipient obtains the one-time public key and the ciphertext from the public system;

[0243] The receiver calculates the corresponding one-time private key based on the one-time public key and verifies whether the generated one-time private key is correct;

[0244] The receiver uses a decryption algorithm and the one-time private key to decrypt the received ciphertext and generate decrypted data.

[0245] The regulator uses its long-term private key and the one-time public key to calculate the recipient's long-term public key, and tracks the recipient's identity information based on the binding relationship between the recipient's long-term public key and identity information.

[0246] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0247] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

Claims

1. A method for protecting and tracing receiver identity privacy, comprising: a sender obtaining a receiver long-term public key; the sender or the receiver calculating a one-time public key using the receiver long-term public key; the sender encrypting data to be sent using an encryption algorithm and the one-time public key to generate ciphertext; the sender sending the one-time public key and the ciphertext to a public system; the receiver obtaining the one-time public key and the ciphertext from the public system; the receiver calculating a corresponding one-time private key according to the one-time public key and verifying whether the generated one-time private key is correct; the receiver decrypting the received ciphertext using a decryption algorithm and the one-time private key to generate decrypted data; a supervisor calculating a receiver long-term public key using a supervisor long-term private key and the one-time public key and tracing receiver identity information according to a binding relationship between the receiver long-term public key and identity information. obtaining a receiver long-term public key comprises: Set elliptic curve ,in, Let be the origin of the elliptic curve. Let it be a base point on the elliptic curve group. n Base point of elliptic curve The rank, n is a prime number; a and b are the coefficients of the elliptic curve; By using denotes an elliptic curve group, wherein the elements in the ring are multiplication invertible, constitute a field; wherein Z is a natural number, denotes a set, the elements of the set including: all numbers belonging to Z and divided by n with a remainder of 0, all numbers belonging to Z and divided by n with a remainder of 1, all numbers belonging to Z and divided by n with a remainder of 2, …, all numbers belonging to Z and divided by n with a remainder of n-1; Using two hash functions Map arbitrary long 0 or 1 bit data or elements in group G to natural numbers in the range of 0 to n-1 respectively, i.e. ; wherein the input of the hash function is an arbitrary length of 0 or 1 bit data, and the output range is a natural number between 0 and n-1; the input of the hash function is an element in a group , and the output range is a natural number between 0 and n-1; the symbol * represents an arbitrary length of 0 / 1 bit; {0, 1} * represents an arbitrary length of 0 / 1 bit data; is a natural number between 0 and n-1. a system parameter is represented as: ， The sender selects two random numbers and computes as follows: ， The sender long-term private key is , and the sender long-term public key is ; The receiver selects 2 random numbers and computes as follows: ， The receiver long-term private key is , and the receiver long-term public key is ; The regulator selects 2 random numbers and computes as follows: ， The regulator long-term private key is , and the regulator long-term public key is ; wherein is a natural number in the range of 1 to n-1.

2. The method of claim 1, wherein calculating a one-time public key using a receiver long-term public key comprises: The sender selects a random number , inputs the sender local private key , the receiver long-term public key , and the supervisor local public key , and performs the following calculation: ， The one-time public key is expressed as: ​ or The receiver selects a random number , input the receiver long-term private key , sender local public key , supervisor local public key , and performs the following calculation: ， The one-time public key is expressed as: ; wherein denotes that the function value on the right side of the symbol is calculated and assigned to the parameter on the left side of the symbol.

3. The method of claim 2, wherein the receiver calculates a corresponding one-time private key according to the one-time public key comprises: Recipient inputs recipient long-term private key , one-time public key obtained from the public system , sender local public key , and regulator local public key , computes as follows: ， if the following verification equation is true: ； then the one-time private key is calculated correctly.

4. The method of claim 3, wherein the supervisor determines a receiver long-term public key using a supervisor private key and the one-time public key comprises: Regulator inputs regulator local private key and a one-time public key obtained from the public system and performs the following calculation: ， The supervisory party calculates the receiver long-term public key According to the binding relationship between the receiver long-term public key and the identity information, the receiver identity information is tracked, and supervision is realized.

Images