A cross-chain transaction method, device and medium that can be randomized and traceable audit

Abstract

The present application relates to the field of blockchain, in particular to a cross-chain transaction method, device and medium capable of randomization and traceability audit, the method comprising: an audit agency generating a public parameter and a trapdoor key, and a data consumer generating a public-private key pair; the data consumer constructing a riddle through the public key and generating a corresponding zero-knowledge proof; when a data provider receives the riddle and the corresponding zero-knowledge proof, the validity of the riddle is verified; the received riddle is randomized, and the randomized riddle is sent to an intermediary; the audit agency runs a Link algorithm, finds the correlation between the riddles in the entire transaction process through the trapdoor key, reconstructs the transaction chain, and locks the dishonest party in the transaction and the malicious behavior deviating from the protocol. The present application can realize traceability audit of the audit party without infringing on the privacy of the user identity, provide a means of supervision and accountability, reduce the occurrence of malicious attacks, and the randomizable nature of the riddle also retains anonymity.

Description

Technical Field

[0001] This invention relates to the field of blockchain, and more specifically to a cross-chain transaction method, device, and medium that is randomizable and traceable. Background Technology

[0002] With the rapid development of blockchain technology, "interoperability" between chains has become a pressing issue that needs to be addressed to expand the application areas of blockchain in the future. This involves scenarios including, but not limited to, cross-chain transactions, cross-chain information exchange, and cross-chain computing. Simultaneously, ensuring the auditability of cross-chain operations while maintaining reasonable anonymity is also a crucial problem that needs to be solved.

[0003] To address the aforementioned issues, existing cross-chain solutions allow users to first convert some assets with the cross-chain platform to obtain the platform's digital currency, and then use this digital currency to exchange for assets on other blockchains. Tairi et al. [Tairi E, Moreno-Sanchez P, Maffei MA 2l: Anonymous atomiclocks for scalability in payment channel hubs[C] / / 2021IEEE Symposium on Security and Privacy(SP).IEEE,2021:1834-1851.] proposed a payment channel protocol based on anonymous atomic locks that guarantees user privacy and security; however, this solution does not support traceability auditing. These cross-chain platforms profit by charging a certain percentage of transaction fees, but most existing solutions only satisfy the atomicity and anonymity of cross-chain transactions, failing to meet the need for traceability auditing of malicious and dishonest transactions. Furthermore, they have specific requirements for the underlying blockchain implementation and are incompatible with most blockchain systems. Therefore, there is an urgent need in the industry to develop a cross-chain transaction solution that is based on the script functionality design common to most blockchains, which can satisfy both a certain degree of anonymity and traceability auditing, so as to be compatible with most heterogeneous blockchains and meet the needs of audit supervision. Summary of the Invention

[0004] To address the technical problems existing in the prior art, this invention provides a cross-chain transaction method, device, and medium that enables randomization and traceability auditing. Traceability auditing is achieved by embedding a trapdoor key. Through the linkable nature of puzzles based on the trapdoor key, the auditor can conduct traceability auditing without infringing on user identity privacy, providing a means of supervision and accountability, thereby reducing the occurrence of malicious attacks. At the same time, the randomization property of the puzzles also preserves anonymity.

[0005] The first objective of this invention is to provide a cross-chain transaction method that is randomizable and traceable.

[0006] A second objective of this invention is to provide a computer device.

[0007] A third objective of this invention is to provide a storage medium.

[0008] The first objective of this invention can be achieved by adopting the following technical solution:

[0009] A cross-chain transaction method that is randomizable and traceable, the method comprising:

[0010] S1. The auditing firm generates public parameters and a trapdoor key, which is used for traceability auditing.

[0011] S2. The data consumer generates a public-private key pair, which is used to construct and solve the puzzle.

[0012] S3. The data consumer sets up a transaction script on the blockchain to lock the transaction funds. The data consumer constructs a puzzle using a public key and generates a corresponding zero-knowledge proof. The puzzle and the zero-knowledge proof are then sent to the data provider.

[0013] S4. When the data provider receives the puzzle and its corresponding zero-knowledge proof, it verifies the validity of the puzzle. If the puzzle is valid, it accepts the puzzle and the transaction continues; if the puzzle is invalid, it discards the puzzle and the transaction terminates.

[0014] S5. After the data provider trades the data to the data consumer, the received puzzle is randomized and sent to the intermediary.

[0015] S6. After receiving the randomized puzzle, the intermediary forwards the randomized puzzle to the data consumer and requests the puzzle answer from the data consumer.

[0016] S7. The data consumer solves the randomized puzzle using their private key to obtain the corresponding blinded answer, and then sends the blinded answer to the intermediary.

[0017] S8. After receiving the blinded answers, the intermediary forwards the blinded answers to the data provider;

[0018] S9. After obtaining the blinded answer, the data provider uses a private blinding factor to remove the blinding factor and obtain the real answer. The real answer is then used to unlock the transaction script and obtain the transaction amount.

[0019] S10. The auditing firm uses trapdoor keys to find the connections between various puzzles in the entire transaction process, reconstruct the transaction chain, and identify dishonest parties in the transaction and their malicious behaviors that deviate from the agreement.

[0020] The second objective of this invention can be achieved by adopting the following technical solution:

[0021] A computer device includes a processor and a memory for storing a processor-executable program, wherein when the processor executes the program stored in the memory, it implements the aforementioned method for randomized and traceable cross-chain transactions.

[0022] The third objective of this invention can be achieved by adopting the following technical solution:

[0023] A storage medium storing a program that, when executed by a processor, implements the aforementioned randomizable and traceable cross-chain transaction method.

[0024] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0025] Compared with existing technologies, this invention provides a cross-chain transaction method, device, and medium that enables randomization and traceability auditing. By embedding a trapdoor key, traceability auditing is achieved, avoiding the problems of lack of supervision and rampant malicious attacks that may result from complete anonymity. Through the linkable characteristics between puzzles based on the trapdoor key, the auditor can conduct traceability auditing without infringing on user identity privacy, providing a means of supervision and accountability, thereby reducing the occurrence of malicious attacks. At the same time, the randomization property of the puzzles also preserves anonymity. Attached Figure Description

[0026] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the structures shown in these drawings without creative effort.

[0027] Figure 1 This is a schematic diagram of the first part of a cross-chain transaction method that is randomizable and traceable in an embodiment of the present invention;

[0028] Figure 2 This is a schematic diagram of the latter part of a cross-chain transaction method that is randomizable and traceable in an embodiment of the present invention. Detailed Implementation

[0029] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments, and the implementation of the present invention is not limited thereto. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0030] Example 1:

[0031] The cross-chain transaction method described in this invention, which enables randomization and traceability auditing, includes an auditing institution, a data consumer, a data provider, and an intermediary. The auditing institution generates public parameters and a trapdoor key for traceability auditing; the data consumer uses the public parameters to generate a public-private key pair required to construct a puzzle; when a data transaction is needed, the data consumer sets a transaction script on the blockchain to lock the transaction amount, and uses its own public key to construct a puzzle whose answer only it knows and generates a corresponding zero-knowledge proof, then sends the puzzle and zero-knowledge proof to the data provider. The answer to the puzzle can be used to unlock the script, and zero-knowledge proofs guarantee the puzzle's validity—that is, the data consumer knows the answer and can use it to unlock the transaction script. When the data provider receives the puzzle and its corresponding zero-knowledge proof, it must verify the puzzle's validity. If valid, the puzzle is accepted and the transaction continues; if invalid, the puzzle is discarded and the transaction terminates. After the data provider trades data to the data consumer, to obtain the puzzle answer and the locked transaction amount, it needs to randomize the received puzzle and send the randomized puzzle to an intermediary. The intermediary, upon receiving the randomized puzzle, forwards it to the data consumer. The data consumer requests the answer to the puzzle from the intermediary. Upon receiving the puzzle, the data consumer uses their private key to solve it, obtaining a blinded answer, which they then send to the intermediary. The intermediary forwards the answer to the data provider. The data provider, upon receiving the blinded answer, uses a private blinding factor to unblind the answer, obtaining the true answer, and uses it to unlock the transaction script and obtain the transaction amount. If any party engages in dishonest behavior during the transaction, the auditing agency can use the trapdoor key to find the connections between the puzzles throughout the transaction, thereby reconstructing the transaction chain to identify dishonest parties and their malicious actions that deviate from the protocol.

[0032] like Figure 1-2 The diagram illustrates a randomized and traceable cross-chain transaction method. The present invention describes a randomized and traceable cross-chain transaction method, which includes the following steps:

[0033] S1. The auditing firm generates public parameters and a trapdoor key, which is used for traceability auditing.

[0034] The auditing firm uses the CPCrs (Conditional Puzzle Crs) algorithm to generate common parameters and trapdoor keys. The trapdoor keys are used for traceability auditing. The CPCrs algorithm is a parameter initialization algorithm used to generate common parameters and trapdoor keys in this scheme. The trapdoor keys allow the auditing firm to link the randomized puzzles back to the original puzzles, thereby achieving the linkability property between puzzles.

[0035] Specifically, step S1 includes:

[0036] S101. The auditing agency selects a security parameter λ as the input to the CPCrs algorithm;

[0037] The S102 and CPCrs algorithms use the security parameter λ to call the common reference string initialization algorithm CRSSetup(λ) in the extensible zero-knowledge proof protocol based on Groth-Sahai to generate the common reference string crs.

[0038] The S103 and CPCres algorithms, through the input security parameter λ, call the initialization algorithm Setup(λ) in the A2L (anonymous atomic lock) protocol's randomized puzzle construction protocol to obtain the elliptic curve group parameters pp. rp , i.e., pp rp = (G, g, q); where q is a large prime number, is the order of the elliptic curve group G, and g is a generator of the group G;

[0039] The S104 and CPCrs algorithms, through the input security parameter λ, call the key generation algorithm Gen(λ)(Generate) in the ELGamal encryption protocol based on the dlin hypothesis to generate a public-private key pair (pk). dlin ,sk dlin ), where pk dlin For public key, sk dlin For private key;

[0040] S105, the CPCres algorithm combines the outputs of the three algorithms in steps S102 to S104, i.e., the common parameter pp = (pp rp , pk dlin ) = (G, g, q, pk) dlin ), public reference string crs, trapdoor key td=sk dlin As the final output, after obtaining the final output, the auditing agency will publish the public parameter pp, the public reference string crs, and the security parameter λ as public parameters, while keeping the trapdoor key td secret.

[0041] S2. The data consumer generates a public-private key pair, which is used to construct and solve the puzzle.

[0042] The data consumer runs the CPSetup (Conditional Puzzle Setup) algorithm to generate the public-private key pair required to construct and solve the puzzle; the CPSetup algorithm is a puzzle key initialization algorithm used to generate the public-private key pair required to construct and solve the puzzle.

[0043] Specifically, the data consumer inputs the security parameter λ from the public parameters, runs the CPSetup algorithm, and calls the Psetup(λ) (Puzzle setup) algorithm in the randomized puzzle construction protocol of the A2L (Anonymous Atomic Lock) protocol to generate a public-private key pair (pp, sk). Specifically, the Psetup(λ) algorithm flows as follows: (pk, sk) ← KGen(λ), where KGen(λ) (KeyGenerate) is the key generation algorithm in the Castagnos-Laguillaumie encryption protocol, pk is the public key, and sk is the private key.

[0044] S3. The data consumer sets up a transaction script on the blockchain to lock the transaction funds. The data consumer constructs a puzzle using a public key and generates a corresponding zero-knowledge proof. The puzzle and the zero-knowledge proof are then sent to the data provider.

[0045] When data transactions are required, the data consumer sets up a transaction script on the blockchain to lock the transaction amount and runs the CPGen (Conditional Puzzle Generate) algorithm. Using its own public key, it constructs a puzzle whose answer only it knows and generates the corresponding zero-knowledge proof. The consumer then sends the puzzle and the zero-knowledge proof to the data provider. The CPGen algorithm is a puzzle construction algorithm used to generate puzzles and corresponding zero-knowledge proofs.

[0046] Specifically, step S3 includes:

[0047] S301, Data consumers from set Z q (Z q This refers to a random number obtained by randomly sampling from the set {0, 1, ..., q-1} (where q is a large prime number). This random number is the answer to the puzzle α. It is used as input along with the common parameter pp, the common reference string crs, and the public key pk in the Castagnos-Laguillaumie encryption protocol to run the CPGen algorithm.

[0048] S302. Based on the input public parameter pp, puzzle answer α, and public key pk, call the puzzle construction algorithm PGen(pk, pp) in the randomized puzzle construction protocol of the anonymous atomic lock A2L protocol. rp ,α)(Puzzle Generate), to obtain the message Z=(A,c). Specifically, PGen(pk,pprp The algorithm flow is as follows: c←Enc(pk, α). Where g1 is any generator of group G, group element A is the result of generator g1 after α operations defined on group G, and is an element of group G. Enc(pk, α)(Encrypt) refers to the encryption algorithm in the Castagnos-Laguillaumie (CL) encryption protocol, and c is the ciphertext of α.

[0049] S303. Using the message Z output in step S302 and the input puzzle answer α, the proof algorithm Prove(α, Z) in the SNARK zero-knowledge proof protocol is invoked to generate the zero-knowledge proof π. zk ;

[0050] S304. Randomly select another generator g2 from group G, and calculate the group elements of group G. Similarly, group elements It is also the result obtained by the generator g2 through the operation defined on the α-th degree group G, through the group elements And the public key pk in the ELGamal encryption protocol based on the dlin hypothesis dlin Invoke the encryption algorithm in the ELGamal encryption protocol based on the dlin hypothesis. (Encrypt) to obtain group elements The ciphertext enc;

[0051] The S305 and CPGen algorithms invoke a scalable zero-knowledge proof protocol based on the Groth-Sahai framework using the public key pk, public reference string crs, message Z, and ciphertext enc. The algorithm generates the corresponding zero-knowledge proof π.

[0052] S306, Message Z, Group Element The ciphertext enc and the zero-knowledge proof π are encapsulated to obtain the puzzle pz = (Z, enc, π), and the data consumer then sends the puzzle pz and the zero-knowledge proof π to the data consumer. zk Send to the data provider.

[0053] S4. When the data provider receives the puzzle and its corresponding zero-knowledge proof, it verifies the validity of the puzzle. If the puzzle is valid, it accepts the puzzle and the transaction continues; if the puzzle is invalid, it discards the puzzle and the transaction terminates.

[0054] When the data provider receives the puzzle and its corresponding zero-knowledge proof, it must run the CPVerify (Conditional Puzzle Verify) algorithm to verify the puzzle's validity. If the puzzle is valid, it is accepted and the transaction continues; if invalid, the puzzle is discarded and the transaction terminates. The CPVerify algorithm is a puzzle verification algorithm used to verify the validity of puzzles.

[0055] Specifically, step S4 includes:

[0056] S401, The data provider will receive the puzzle pz and the zero-knowledge proof π. zk Using the public key pk and the public reference string crs as input, the CPVerify algorithm is run to prove π using zero knowledge. zk And the message Z in puzzle pz (i.e. ), calling the verification algorithm Vry(π) in the SNARK zero-knowledge proof protocol. zk ,Z)(Verify). If its output is 0, then the zero-knowledge proof of π is obtained. zk If invalid, the data provider discards the puzzle and terminates the transaction; if its output is 1, then proceed to step S402.

[0057] S402. Invoke the verification algorithm Verify((enc, A), π) in the scalable zero-knowledge proof protocol based on Groth-Sahai using the ciphertext enc, message Z, and zero-knowledge proof π. If the Verify algorithm outputs 0, the zero-knowledge proof π is invalid, the data provider discards the puzzle, and terminates the transaction; if the Verify algorithm outputs 1, the puzzle is accepted as valid. The Verify((enc, A), π) algorithm is used to verify the validity of the zero-knowledge proof π.

[0058] S5. After the data provider trades the data to the data consumer, the received puzzle is randomized and sent to the intermediary.

[0059] After a data provider trades data to a data consumer, in order to obtain the answer to the puzzle and unlock the transaction amount, the consumer needs to run the CPRand (Conditional Puzzle Randomize) algorithm to randomize the received puzzle and then send the randomized puzzle to the intermediary. The CPRand algorithm is a puzzle randomization algorithm used to randomize puzzles.

[0060] Specifically, step S5 includes:

[0061] S501, The data provider will receive and verify valid puzzle pz, common parameter pp = (pp rp , pk dlin) = (G, g, q, pk) dlin Using the common reference string CRS as input, run the CPRand algorithm based on the message Z (i.e., ...) in puzzle pz. The algorithm calls the randomization algorithm PRand(Z(Puzzle Randomize)) in the A2L (Anonymous Atomic Lock) protocol to obtain (Z', r), where message Z' is the result of message Z randomized by random number r. Specifically, the PRand(Z) algorithm works as follows: from Z... q (Z q This refers to randomly sampling a random number r from the set {0, 1, ..., q-1} (where q is a large prime number); and using the random number r to randomize element A (i.e., group element) in puzzle pz. This yields the randomized result, i.e., A' = A. r A' is also a group element (i.e., a group element) ); Randomize element c in puzzle pz using a random number r (i.e., The ciphertext is used to obtain the randomized result c', i.e., c' = c r Output the message Z' = (A', c') and the random number r;

[0062] S502. Taking the message Z' = (A', c') and the random number r as input, perform randomization operations on the commitment value wit and commitment statement stmt in the commitment scheme used in the extensible zero-knowledge proof protocol based on Groth-Sahai, to obtain the randomized ciphertext enc'. Taking the ciphertext enc', the result A', the zero-knowledge proof π and the common reference string crs as input, call the randomization algorithm ZKEval (Zero Knowledge Evaluate) in the extensible zero-knowledge proof protocol based on Groth-Sahai to generate the randomized proof π'.

[0063] Specifically, based on the output (Z', r) = (A', c', r) from step S501, the following function is executed.

[0064]

[0065] Γ wit (α) = α + r,

[0066] Among them, Γ wit , Γ stmt These refer to the randomization operations of the commitment value wit and the commitment statement stmt in the commitment scheme used in the extensible zero-knowledge proof protocol constructed by Groth-Sahai, respectively, and the resulting ciphertext enc'( The result of randomizing the ciphertext enc, i.e. (ciphertext), A' ( The result after randomization, i.e. ), {Γ wit , Γ stmt The zero-knowledge proof π from puzzle pz and the common reference string crs are used as inputs. The randomization algorithm ZKEval in the scalable zero-knowledge proof protocol based on Groth-Sahai is called to generate the randomized proof π. ’ The randomized algorithm ZKEval is used for randomized zero-knowledge proofs.

[0067] S503. Encapsulate the message Z', ciphertext enc', and proof π' to obtain the randomized puzzle pz'. The data provider sends the randomized puzzle pz' to the intermediary.

[0068] S6. After receiving the randomized puzzle, the intermediary forwards the randomized puzzle to the data consumer and requests the puzzle answer from the data consumer.

[0069] S7. The data consumer solves the randomized puzzle using their private key to obtain the corresponding blinded answer, and then sends the blinded answer to the intermediary.

[0070] After receiving the puzzle, the data consumer runs the CPSlove (Conditional Puzzle Slove) algorithm, solves the puzzle using its private key to obtain the corresponding blinded answer, and then sends the answer to the intermediary. The CPSlove algorithm is a puzzle-solving algorithm used to solve puzzles and obtain the answer.

[0071] Specifically, step S7 includes:

[0072] The data consumer takes the received puzzle pz' and private key sk as input, runs the CPSlove algorithm, and solves the puzzle pz' by calling the PSlove (PuzzleSlove) algorithm in the A2L (Anonymous Atomic Lock) protocol's randomized puzzle construction protocol. This yields the answer α' = α + r. After obtaining the answer α', the data consumer sends it to the intermediary. Specifically, the PSlove algorithm's process is as follows: using the private key sk and... The randomized result c' of the ciphertext c is then decrypted using the decryption algorithm Dec(sk, c)(Decrypt) in the Castagnos-Laguillaumie (CL) encryption protocol to obtain the corresponding puzzle answer α'. After obtaining the puzzle answer α', the data consumer sends it to the intermediary.

[0073] S8. After receiving the blinded answers, the intermediary forwards the blinded answers to the data provider;

[0074] S9. After obtaining the blinded answer, the data provider uses a private blinding factor to unblind the blinded answer, obtains the real answer, and uses it to unlock the transaction script and obtain the transaction amount.

[0075] Specifically, the data provider uses a private random number r to unblind the received puzzle answer α' to obtain the true answer α, i.e., α = α' - r; the data provider uses the puzzle answer α to unlock the transaction script pre-arranged on the data blockchain by the data consumer and collect the transaction amount due.

[0076] S10. The auditing firm uses trapdoor keys to find the connections between various puzzles in the entire transaction process, reconstruct the transaction chain, and identify dishonest parties in the transaction and their malicious behaviors that deviate from the agreement.

[0077] When a party engages in dishonest behavior during a transaction, the auditing firm can run the Link algorithm. Using a trapdoor key, it searches for connections between puzzles throughout the transaction, thereby reconstructing the transaction chain and identifying the dishonest party and their malicious actions that deviate from the protocol. The Link algorithm is a puzzle-linking algorithm used to examine the connections between two different puzzles, linking randomized puzzles back to the original puzzles. This assists the auditing firm in reconstructing the transaction chain; the linkability between puzzles is provided by this algorithm.

[0078] Specifically, step S10 includes:

[0079] S1001. The auditing agency takes two different puzzles pz and pz' generated during the transaction, the public reference string crs, and the trapdoor key td as input, runs the Link algorithm, and uses the ciphertext enc' in the input puzzle pz' ( Given the ciphertext (td) and the trapdoor key td, the decryption algorithm Dec(td, enc')(Decrypt) in the ELGamal encryption protocol based on the dlin hypothesis is called to decrypt the ciphertext enc' to obtain the first plaintext. Similarly, use this decryption algorithm to decrypt element enc in pz. The ciphertext was used to obtain the second plaintext.

[0080] S1002. Pair the first plaintext with element A using bilinear mapping e to obtain the first pairing result; pair the second plaintext with element A' using bilinear mapping e to obtain the second pairing result; verify whether the first pairing result and the second pairing result are equal. If the first pairing result and the second pairing result are equal, the Link algorithm outputs 1; if the first pairing result and the second pairing result are not equal, the Link algorithm outputs 0.

[0081] S1003. The auditing agency judges based on the output of the Link algorithm. If the output is 1, it means that pz' is the result of randomizing pz. If the output is 0, it means that there is no connection between puzzle pz and puzzle pz'. This allows the transaction chain to be reconstructed, the dishonest parties in the transaction and their malicious behaviors that deviate from the agreement to complete the source audit.

[0082] In this embodiment, for simplicity, there is only one puzzle receiver and one intermediary. Therefore, the auditor only needs to run the Link algorithm once to reconstruct the transaction chain, reveal the identities of the buyer and seller in the transaction, and complete the audit. However, in complex transaction scenarios, there are usually multiple data providers, data consumers, and intermediaries who assist in the transaction and can obtain intermediary fees. In this case, the auditor will face a complex transaction chain, and correspondingly, it will be necessary to run the Link algorithm multiple times to reconstruct the transaction chain.

[0083] In summary, this invention can replace the hash lock mechanism in current cross-chain transactions, solving the compatibility problem of heterogeneous blockchains and enabling off-chain payments and cross-chain transactions even in blockchain systems that do not support hash locks. Furthermore, the linkability of the puzzle in this solution enables transaction traceability and auditing, and the randomization property of the puzzle also preserves anonymity, better meeting the needs of real-world applications. Therefore, the research of this invention will have significant economic benefits.

[0084] Example 2:

[0085] This embodiment provides a computer device, which may be a server, computer, etc., including a processor, memory, input device, display, and network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. When the processor executes the computer programs stored in the memory, it implements a cross-chain transaction method with randomization and traceability auditability as described in Embodiment 1 above, as follows:

[0086] S1. The auditing firm generates public parameters and a trapdoor key, which is used for traceability auditing.

[0087] S2. The data consumer generates a public-private key pair, which is used to construct and solve the puzzle.

[0088] S3. The data consumer sets up a transaction script on the blockchain to lock the transaction funds. The data consumer constructs a puzzle using a public key and generates a corresponding zero-knowledge proof. The puzzle and the zero-knowledge proof are then sent to the data provider.

[0089] S4. When the data provider receives the puzzle and its corresponding zero-knowledge proof, it verifies the validity of the puzzle. If the puzzle is valid, it accepts the puzzle and the transaction continues; if the puzzle is invalid, it discards the puzzle and the transaction terminates.

[0090] S5. After the data provider trades the data to the data consumer, the received puzzle is randomized and sent to the intermediary.

[0091] S6. After receiving the randomized puzzle, the intermediary forwards the randomized puzzle to the data consumer and requests the puzzle answer from the data consumer.

[0092] S7. The data consumer solves the randomized puzzle using their private key to obtain the corresponding blinded answer, and then sends the blinded answer to the intermediary.

[0093] S8. After receiving the blinded answers, the intermediary forwards the blinded answers to the data provider;

[0094] S9. After obtaining the blinded answer, the data provider uses a private blinding factor to remove the blinding factor and obtain the real answer. The real answer is then used to unlock the transaction script and obtain the transaction amount.

[0095] S10. The auditing firm uses trapdoor keys to find the connections between various puzzles in the entire transaction process, reconstruct the transaction chain, and identify dishonest parties in the transaction and their malicious behaviors that deviate from the agreement.

[0096] Example 3:

[0097] This embodiment provides a storage medium, which is a computer-readable storage medium storing a computer program. When the program is executed by a processor, the processor executes the computer program stored in the memory to implement the cross-chain transaction method of embodiment 1 described above, which is randomizable and traceable, as follows:

[0098] S1. The auditing firm generates public parameters and a trapdoor key, which is used for traceability auditing.

[0099] S2. The data consumer generates a public-private key pair, which is used to construct and solve the puzzle.

[0100] S3. The data consumer sets up a transaction script on the blockchain to lock the transaction funds. The data consumer constructs a puzzle using a public key and generates a corresponding zero-knowledge proof. The puzzle and the zero-knowledge proof are then sent to the data provider.

[0101] S4. When the data provider receives the puzzle and its corresponding zero-knowledge proof, it verifies the validity of the puzzle. If the puzzle is valid, it accepts the puzzle and the transaction continues; if the puzzle is invalid, it discards the puzzle and the transaction terminates.

[0102] S5. After the data provider trades the data to the data consumer, the received puzzle is randomized and sent to the intermediary.

[0103] S6. After receiving the randomized puzzle, the intermediary forwards the randomized puzzle to the data consumer and requests the puzzle answer from the data consumer.

[0104] S7. The data consumer solves the randomized puzzle using their private key to obtain the corresponding blinded answer, and then sends the blinded answer to the intermediary.

[0105] S8. After receiving the blinded answers, the intermediary forwards the blinded answers to the data provider;

[0106] S9. After obtaining the blinded answer, the data provider uses a private blinding factor to remove the blinding factor and obtain the real answer. The real answer is then used to unlock the transaction script and obtain the transaction amount.

[0107] S10. The auditing firm uses trapdoor keys to find the connections between various puzzles in the entire transaction process, reconstruct the transaction chain, and identify dishonest parties in the transaction and their malicious behaviors that deviate from the agreement.

[0108] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.

Claims

1. A cross-chain transaction method that is randomizable and traceable, characterized in that, Includes the following steps: S1. The auditing firm generates public parameters and a trapdoor key, which is used for traceability auditing. S2. The data consumer generates a public-private key pair, which is used to construct and solve the puzzle. S3. The data consumer sets up a transaction script on the blockchain to lock the transaction funds. The data consumer constructs a puzzle using a public key and generates a corresponding zero-knowledge proof. The puzzle and the zero-knowledge proof are then sent to the data provider. S4. When the data provider receives the puzzle and its corresponding zero-knowledge proof, it verifies the validity of the puzzle. If the puzzle is valid, it accepts the puzzle and the transaction continues; if the puzzle is invalid, it discards the puzzle and the transaction terminates. S5. After the data provider trades the data to the data consumer, the received puzzle is randomized and sent to the intermediary. S6. After receiving the randomized puzzle, the intermediary forwards the randomized puzzle to the data consumer and requests the puzzle answer from the data consumer. S7. The data consumer solves the randomized puzzle using their private key to obtain the corresponding blinded answer, and then sends the blinded answer to the intermediary. S8. After receiving the blinded answers, the intermediary forwards the blinded answers to the data provider; S9. After obtaining the blinded answer, the data provider uses a private blinding factor to remove the blinding factor and obtain the real answer. The real answer is then used to unlock the transaction script and obtain the transaction amount. S10. The auditing firm uses trapdoor keys to find the connections between various puzzles in the entire transaction process, reconstruct the transaction chain, and identify dishonest parties in the transaction and their malicious behaviors that deviate from the agreement.

2. The cross-chain transaction method with randomization and traceability auditability according to claim 1, characterized in that, Step S1 includes the following steps: S101. The auditing agency selects a security parameter λ as the input to the CPCrs algorithm; S102. Call the common reference string initialization algorithm CRSSetup according to the input security parameter λ to generate the common reference string crs; S103. Based on the input safety parameter λ, call the initialization algorithm Setup to obtain the elliptic curve group parameters pp. rp ;pp rp = (G, g, q), where q is a large prime number, g is the order of the elliptic curve group G, and g is the generator of the group G; S104. Based on the input security parameter λ, call the key generation algorithm Gen to generate a public-private key pair (pk). dlin ,sk dlin ), where pk dlin sk is the public key. dlin For private key; S105. Output the common parameter pp, common reference string crs, and trapdoor key td as the final result. The auditing agency will publish the common parameter pp, common reference string crs, and security parameter λ as common parameters, while keeping the trapdoor key td confidential; Common parameter pp = (G, g, q, pk) dlin The trapdoor key td = sk dlin .

3. The cross-chain transaction method with randomization and traceability auditability according to claim 2, characterized in that, Step S2 includes the following steps: The data consumer inputs the security parameter λ from the public parameters, runs the CPSetup algorithm, calls the Psetup(λ) algorithm in the randomized puzzle construction protocol, and generates a public-private key pair (pk, sk).

4. The cross-chain transaction method with randomization and traceability auditability according to claim 3, characterized in that, Step S3 includes the following steps: S301, Data consumers from set Z q A random number is obtained by random sampling and used as the puzzle answer α. The puzzle answer α, the common parameter pp, the common reference string crs, and the public key pk are used as inputs to the CPGen algorithm, and the CPGen algorithm is run. S302. Based on the public parameter pp, the puzzle answer α, and the public key pk, call the puzzle construction algorithm PGen to obtain message Z; S303. Based on message Z and puzzle answer α, invoke the Prove algorithm in the zero-knowledge proof protocol to generate zero-knowledge proof π. zk ; S304. Randomly select a generator g2 from group G, and calculate the group elements of group G. Through group elements PK with public key dlin Call the Enc encryption algorithm to obtain the group elements. The ciphertext enc; S305. Based on the public key pk, the public reference string crs, the message Z, and the ciphertext enc, the Prove algorithm in the zero-knowledge proof protocol is invoked to generate the corresponding zero-knowledge proof π. S306, Message Z, Group Element The encrypted text enc, the zero-knowledge proof π, is encapsulated to obtain the puzzle pz. The data consumer then uses the puzzle pz and the zero-knowledge proof π. zk Send to the data provider.

5. A cross-chain transaction method with randomization and traceability auditability according to claim 4, characterized in that, Step S4 includes the following steps: S401, The data provider will receive the puzzle pz and the zero-knowledge proof π. zk Using the public key pk and the public reference string crs as input, the CPVerify algorithm is run to prove π using zero knowledge. zk And message Z, invoke verification algorithm Vry; If its output is 0, then zero-knowledge proof of π is possible. zk If invalid, the data provider discards the puzzle and terminates the transaction; if its output is 1, then proceed to step S402. S402. Invoke the Verify algorithm based on the ciphertext enc, message Z, and zero-knowledge proof π. If the Verify algorithm outputs 0, the zero-knowledge proof π is invalid, the data provider discards the puzzle and terminates the transaction. If the Verify algorithm outputs 1, the puzzle is acknowledged as valid and the puzzle is accepted.

6. The cross-chain transaction method with randomization and traceability auditability according to claim 1, characterized in that, Step S5 includes the following steps: S501. The data provider receives and verifies the valid puzzle pz, common parameter pp, and common reference string crs as input to the CPRand algorithm, runs the CPRand algorithm, calls the puzzle randomization algorithm PRand according to the message Z in puzzle pz, and obtains (Z', r), where message Z' is the result of message Z randomized by random number r; randomize element A in puzzle pz using random number r to obtain randomized element A'; randomize element c in puzzle pz using random number r to obtain randomized result c'; S502. Taking the message Z' and the random number r as input, perform randomization operations on the commitment value wit and the commitment statement stmt to obtain the randomized ciphertext enc'; taking the ciphertext enc', element A', zero-knowledge proof π and common reference string crs as input, call the randomization algorithm ZKEval to generate the randomized proof π'; S503. Encapsulate the message Z', ciphertext enc', and proof π' to obtain the randomized puzzle pz'. The data provider sends the randomized puzzle pz' to the intermediary.

7. A cross-chain transaction method with randomization and traceability auditability according to claim 6, characterized in that, Step S7 includes the following steps: The data consumer takes the received puzzle pz' and private key sk as input to the CPSlove algorithm, runs the CPSlove algorithm, and solves the puzzle pz' using the puzzle-solving algorithm PSlove to obtain the corresponding puzzle answer α'. The data consumer then sends the puzzle answer α' to the intermediary.

8. A cross-chain transaction method with randomization and traceability auditability according to claim 7, characterized in that, Step S10 includes the following steps: S1001. The auditing agency takes the puzzle pz, puzzle pz', public reference string crs and trapdoor key td as input, runs the Link algorithm, and calls the decryption algorithm Dec to decrypt the ciphertext enc' and ciphertext enc respectively to obtain the first plaintext and the second plaintext based on the ciphertext enc' and the trapdoor key td. S1002. Pair the first plaintext with element A using bilinear mapping e to obtain the first pairing result; The second plaintext is paired with element A' using a bilinear mapping e to obtain the second pairing result; Verify whether the first pairing result is equal to the second pairing result. If the first pairing result is equal to the second pairing result, the Link algorithm outputs 1. If the first pairing result is not equal to the second pairing result, the Link algorithm outputs 0; S1003. If the output of the Link algorithm is 1, then puzzle pz' is the result of randomizing puzzle pz; If the Link algorithm outputs 0, then there is no association between puzzle pz and puzzle pz'.

9. A computer device comprising a processor and a memory for storing a processor-executable program, characterized in that, When the processor executes the program stored in the memory, it implements a cross-chain transaction method that is randomizable and traceable for auditing, as described in any one of claims 1-8.

10. A storage medium storing a program, characterized in that, When the program is executed by the processor, it implements a cross-chain transaction method that is randomizable and traceable for auditing, as described in any one of claims 1-8.

Images