A blockchain privacy transaction method

Abstract

This application relates to a blockchain confidential transaction method, which generates system parameters, commitment parameters, and public and private keys of the transaction sender and receiver based on a preset algorithm; calculates the encrypted transaction amount of the transaction sender and receiver based on the system parameters and public and private keys, combined with a preset Paillier encryption algorithm, and sends it to the blockchain node to calculate the encrypted account balance of the transaction sender and receiver after the transaction, and updates the encrypted account amount on the chain for the corresponding account; the transaction receiver reads the encrypted transaction amount from the chain, and performs the transaction when the decryption verification shows that the transaction amount is greater than 0; after the blockchain transaction system has been running for a preset time, all users who have participated in the transaction construct a commitment for the transaction amount based on the commitment parameters, and construct evidence that the account amount is within a specific range; the smart contract of the blockchain node verifies the legality of the account based on the encrypted account amount, evidence, and commitment, thereby simplifying the transaction process and reducing the amount of data on the chain.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a blockchain confidential transaction method. Background Technology

[0002] Blockchain is a distributed public ledger maintained by multiple nodes, characterized by decentralization, trustlessness, traceability, and transparency. All transactions in a blockchain are publicly transparent or only partially transparent, and each node in the chain can read transaction data to verify its correctness. This makes plaintext transaction amounts in current blockchain platforms, whether public or consortium blockchains, susceptible to privacy breaches. Against this backdrop, various schemes for hiding transaction amounts have emerged. However, to support privacy protection, ensure homomorphic encrypted transaction amounts across the network, and provide proof of transaction legitimacy, current schemes suffer from cumbersome transaction processes and excessively large amounts of data recorded on the blockchain for each transaction. Summary of the Invention

[0003] This application provides a blockchain-based confidential transaction method to address the problems of cumbersome transaction processes and excessively large amounts of data recorded on the blockchain for a single transaction in related technologies.

[0004] Firstly, a blockchain-based confidential transaction method is provided, including the following steps:

[0005] System parameters, commitment parameters, and public and private keys of the transaction sender and receiver are generated based on a preset algorithm.

[0006] Based on the generated system parameters and public and private keys, and combined with the preset Paillier encryption algorithm, the ciphertext of the transaction amount for the sender and the ciphertext of the transaction amount for the receiver are calculated.

[0007] The calculated transaction amount in ciphertext is sent to the blockchain node. The smart contract of the blockchain node calculates the ciphertext of the transaction sender's account balance after the transaction and the ciphertext of the transaction recipient's account balance after the transaction based on the preset ciphertext homomorphic algorithm, and updates the corresponding account amount in ciphertext on the blockchain.

[0008] The transaction recipient reads the encrypted transaction amount from the blockchain. When the decryption verifies that the transaction amount is greater than 0, the transaction is executed.

[0009] After the blockchain transaction system has been running for a preset period of time, all users who have participated in the transaction construct a commitment for the transaction amount based on the commitment parameters, and call the sigma protocol and bulletproof protocol to construct evidence that the account amount is within a specific range;

[0010] The constructed promise and constructed evidence are sent to the blockchain node, and the blockchain node's smart contract verifies the legitimacy of the account based on the encrypted account amount, evidence, and promise.

[0011] In some embodiments, before the step of verifying that the transaction amount is greater than 0 through decryption, the method further includes:

[0012] The transaction recipient has encrypted transaction amount C_tb = (E0, c b0 ,E1,c b1 Decrypt the data to obtain the plaintext transaction amount T and the random number r0.

[0013] The valid ciphertext corresponding to the plaintext transaction amount T and the random number r0 is calculated based on the preset Paillier algorithm.

[0014] Calculate the transaction amount corresponding to the valid ciphertext based on the ciphertext C_tb and the plaintext T of the transaction amount;

[0015] in, mod indicates the remainder calculation, k = g λ modn 2 n = pq, where p and q are two large prime numbers, and g represents a random number. For n 2 Coprime and less than n 2 The multiplication group of natural numbers, λ = lcm(p-1, q-1), where lcm represents the least common multiple, T represents the transaction amount, and h = g r modn 2 r, r0, and r1 are all random numbers, and r < n 2 r0 < n and r1 < n, y2 represents the public key of the transaction recipient.

[0016] In some embodiments, after the step of the transaction recipient reading the ciphertext of the transaction amount from the blockchain, the method further includes:

[0017] When the decryption verification shows that the transaction amount is not greater than 0, the transaction recipient calls the Sigma and Bulletproof protocols to construct evidence and initiate an appeal.

[0018] The smart contracts of blockchain nodes verify the veracity of claims based on the Sigma protocol verification algorithm and the Bulletproof protocol verification algorithm.

[0019] In some embodiments, the transaction recipient invokes the Sigma and Bulletproof protocols to construct evidence and initiate an appeal, including:

[0020] Invoke the Sigma protocol to encrypt the transaction amount C_tb = (E0, cb0 ,E1,c b1 Construct evidence of legality;

[0021] Construct a Pedersen commitment for the transaction amount, denoted as Pedersen1.

[0022] Invoke the Sigma protocol to construct evidence of the equality of transaction amounts for Pedersen1 and E0;

[0023] Invoke the bulletproof protocol to construct evidence that the transaction amount for Pedersen1 is within a specific range;

[0024] Send Pedersen1 and the evidence to the blockchain node to file an appeal;

[0025] Among them, g1 and h1 are two generators of a group G of order p.

[0026] In some embodiments, the evidence comprises:

[0027] Appeal_proof=TAEC((T,r0,y2,Pedersen1,2 l ):

[0028]

[0029]

[0030] Where TAEC represents the function that generates evidence for the appeal, 2 l Indicates the upper limit of the transaction amount.

[0031] In some embodiments, the smart contract of the blockchain node verifies the veracity of the claim based on the Sigma protocol verification algorithm and the Bulletproof protocol verification algorithm, including:

[0032] Obtain the system parameter sysPrm, commitment parameter pedPrm, transaction recipient's public key y2, commitment Pedersen1, and appeal evidence TAEC, and read E0 and c from the chain. b0 ;

[0033] Based on sysPrm, pedPrm, y2, Pedersen1, TAEC, E0 and c b0 It also invokes the Sigma protocol verification algorithm and the Bulletproof protocol verification algorithm to verify the appeal evidence;

[0034] If the verification is successful, the transaction will be rolled back.

[0035] If verification fails, the appeal will be rejected and the transaction will remain unchanged.

[0036] In some embodiments, all users who participated in the transaction construct a commitment for the transaction amount based on the commitment parameter, and invoke the Sigma and Bulletproof protocols to construct evidence that the account amount is within a specific range, including:

[0037] Users read the encrypted current account balance from the blockchain:

[0038]

[0039] The ciphertext of the current account amount is decrypted using the decryption algorithm in the preset Paillier encryption algorithm, resulting in the plaintext account amount U and a random number r. u0 ;

[0040] Based on the plaintext account amount U and the random number r u0 Construct a Pedersen commitment for the transaction amount, denoted as Pedersen_u, then

[0041] Invoking the Sigma protocol, for Pedersen_u and E u0 Construct evidence of equal transaction amounts;

[0042] Invoke the bulletproof protocol to construct evidence that the transaction amount is within a specific range for Pedersen_u;

[0043] Where mod represents the remainder calculation, k = g λ modn 2 n = pq, where p and q are two large prime numbers, and g represents a random number. For n 2 Coprime and less than n 2 The multiplication group of natural numbers, λ = lcm(p-1, q-1), where lcm denotes the least common multiple, and h = g r modn 2 ,r、r u0 and r u1 All numbers are random, and r < n 2 r u0 <n and r u1 <n, y u Let g1 and h1 represent the user's public key, and g1 and h1 be two generators of a group G of prime order p.

[0044] In some embodiments, the evidence comprises:

[0045] Legal_proof=TEOL((U,r u0 ,y u,Pedersen_u,2 l ):

[0046]

[0047]

[0048] Where TEOL represents the function that generates ciphertext evidence of the legitimacy of account funds, 2 l This indicates the upper bound of the account balance.

[0049] In some embodiments, the smart contract of the blockchain node verifies the legitimacy of the account based on the encrypted account amount, evidence, and commitment, including:

[0050] Obtain system parameter sysPrm, commitment parameter pedPrm, and user public key y. u The commitment is Pedersen_u and the evidence is TEOL, and E is read from the chain. u0 and c u0 ;

[0051] Based on sysPrm, pedPrm, y u 、Pedersen_u、TEOL、E u0 and c u0 It then invokes the Sigma and Bulletproof protocol verification algorithms to verify the legitimacy of the account.

[0052] If the verification is successful, all transactions within the preset time period are deemed valid.

[0053] If the verification fails, it is determined that there is an illegal transaction within a preset time period.

[0054] In some embodiments, the encrypted account balance of the transaction sender after the transaction is:

[0055]

[0056] The encrypted message of the transaction recipient's post-transaction account balance is:

[0057]

[0058] Where mod represents the remainder calculation, k = g λ modn 2 n = pq, where p and q are two large prime numbers, and g represents a random number. For n 2 Coprime and less than n 2 The multiplication group of natural numbers, λ = lcm(p-1, q-1), where lcm represents the least common multiple, T represents the transaction amount, and h = g rmodn 2 , r, r0, r s0 r r0 r1, r s1 and r r1 All numbers are random, and r < n 2 r0 < n, r s0 <n, r r0 <n, r1 <n, r s1 <n and r r1 <n, y1 represents the public key of the transaction sender, y2 represents the public key of the transaction receiver, A represents the original amount in the transaction sender's account, and B represents the original amount in the transaction receiver's account.

[0059] This application provides a blockchain-based confidential transaction method, comprising: generating system parameters, commitment parameters, and public and private keys of the transaction sender and receiver based on a preset algorithm; calculating the ciphertext of the transaction amount for the sender and receiver based on the generated system parameters and public / private keys, combined with a preset Paillier encryption algorithm; sending the calculated ciphertext of the transaction amount to a blockchain node, where the smart contract calculates the ciphertext of the sender's and receiver's post-transaction account balances based on a preset homomorphic algorithm, and updates the corresponding on-chain account amount ciphertext; the receiver reads the ciphertext of the transaction amount from the blockchain, and if the decryption verifies that the transaction amount is greater than 0, the transaction is executed; after a preset time of operation of the blockchain transaction system, all users who have participated in the transaction construct a commitment for the transaction amount based on the commitment parameters, and call the Sigma and Bulletproof protocols to construct evidence that the account amount is within a specific range; sending the constructed commitment and the constructed evidence to the blockchain node, where the smart contract verifies the legitimacy of the account based on the ciphertext of the account amount, the evidence, and the commitment. This application can effectively simplify the transaction process and reduce the amount of data uploaded to the blockchain. Attached Figure Description

[0060] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0061] Figure 1 This is a flowchart illustrating a blockchain confidential transaction method provided in an embodiment of this application. Detailed Implementation

[0062] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0063] This application provides a blockchain confidential transaction method that can solve the problems of cumbersome transaction process and excessive amount of data recorded on the blockchain for a single transaction in related technologies.

[0064] To enable the Paillier algorithm to be combined with the bulletproof protocol—a zero-knowledge-range proof based on Pedersen commitments—and to support oversight, this embodiment improves the Paillier algorithm as follows:

[0065] 1. System Parameter Generation

[0066] Let n = pq, where p and q are two large prime numbers; select random numbers. And satisfy L -1 (g λ modn 2 ) mod n exists, where, For n 2 Coprime and less than n 2 The multiplication group of natural numbers, mod represents the remainder calculation, L(g λ modn 2 )=(g λ modn 2 -1) / n, λ=lcm(p-1,q-1), lcm represents the least common multiple; randomly select a random number r and r<n 2 So that h = g r modn 2 And satisfy gcd=(L(g λ modn 2 (),n)==1, gcd represents the greatest common divisor, and let k=g λ modn 2 At this point, the system parameter sysPrm = (h,k,n,n) 2 )public.

[0067] 2. Generation of user public and private keys

[0068] Select a random number x, Calculate y = h 1 / xmodλn modn 2If the user's private key sk is x and the user's public key pk is y.

[0069] 3. Encryption process: Encrypt(m,y,sysPrm,r0)

[0070] For plaintext Choose random numbers r0 < n and r1 < n, and calculate... as well as The ciphertext is then (E0, c0, E1, c1).

[0071] 4. Plaintext decryption process: Decrypt((E0,c0,E1,c1),sysPrm,x)

[0072] For the ciphertext (E0, c0, E1, c1), calculate Then plain text calculate Then random number

[0073] 5. Additive Homomorphism

[0074] There is plaintext m a and m b Encrypt(m) is obtained by encrypting it. a )=(E 0a ,c 0a E 1a ,c 1a ) and Encrypt(m b )=(E 0b ,c 0b E 1b ,c 1b ).

[0075] Define (E0, c0, E1, c1), where: E0 = E 0a E 0b modn 2 c0 = c 0a c 0b modn 2 E1 = E 1a E 1b modn 2 c1 = c 1a c 1b modn 2 .

[0076] The decryption process is as follows:

[0077]

[0078]

[0079]

[0080]

[0081] The improved Paillier homomorphic encryption algorithm described above supports zero-knowledge scope proofs, as follows:

[0082] 1. Generation of commitment parameters

[0083] pedPrm=(G,p,g1,h1)

[0084] Among them, g1 and h1 are two generators of a group G of order p;

[0085] 2. Construct a commitment of the Pedersen form for plaintext m and random number r0.

[0086] 3. Proof using the Sigma protocol and (m,r0) are equal in the two cases;

[0087] 4. Use the bulletproof protocol to prove that m in the pedersem commitment is located in [0, 2]. l ]Inside.

[0088] The algorithm described above can be used not only for transaction amount encryption and range proof in the account model, but also for transaction amount encryption and range proof in the UTXO model (Unspent Transaction Output).

[0089] A valid transaction must prove that it meets the following three conditions: (1) the amount transferred out and the amount received are equal; (2) the transaction amount is greater than 0; and (3) the account balance is greater than 0 after the transaction.

[0090] Regarding the first condition, since E0 in the ciphertext is independent of the user and only related to the amount, and based on the discrete logarithm problem, it is difficult to find a condition where (m1,r1)≠(m2,r2) satisfies this condition. Therefore, as long as the ciphertext of the transferred amount is equal to the E0 part of the ciphertext of the received amount, it can be proven that condition (1) is satisfied.

[0091] Regarding the second condition, since the transaction recipient can decrypt the ciphertext, they can directly verify whether the transaction amount is greater than 0. If the transaction amount sent by the sender does not meet expectations, the transaction recipient can construct proof that the decryption is valid and the amount does not meet the condition, and then file an appeal. Therefore, if the sender sends an invalid transaction, it will be immediately detected and punished. From a game theory perspective, the transaction initiator should not actively and maliciously construct invalid ciphertext. Therefore, in this embodiment, when constructing transaction data, the transaction sender does not prove the ciphertext of the transaction amount or the validity of the transaction amount. Instead, the transaction recipient, after obtaining the ciphertext of the transaction amount, decrypts and verifies whether the transaction amount meets the condition of being greater than 0. If it does, no processing is performed; if it does not, evidence is generated and an appeal is filed, thereby significantly reducing the amount of on-chain data and computation.

[0092] Regarding the third condition, since the total amount of the entire blockchain transaction system is balanced (i.e., total amount before transfer = amount transferred + total amount after transfer), under the condition of mod n, when the account balance is less than 0 (e.g., m, m < 0), the decrypted account balance ciphertext is n + m, meaning the total amount of the system has an extra n (its size is 2048 bits). No matter how these amounts are distributed among the limited number of user accounts, there will inevitably be a user account balance that is far greater than 2. l (e.g., 64 bits). Therefore, it is only necessary to require all users who have participated in transactions within the blockchain transaction system to construct valid account amounts (i.e., located in [0, 2)) at regular intervals (e.g., monthly). l Evidence (within) can be submitted to the contract for verification. If an illegal account is found, the regulator will perform its regulatory duties, thereby further reducing the amount of on-chain data and computation.

[0093] In a consortium blockchain, once malicious behavior by a user is detected, the regulator can take appropriate disciplinary action against the perpetrator to prevent malicious attacks.

[0094] Figure 1 This application provides a blockchain-based confidential transaction method, which includes the following steps:

[0095] Step S10: Generate system parameters, commitment parameters, and public and private keys of the transaction sender and receiver based on a preset algorithm;

[0096] As an example, it is understood that the preset algorithm in this embodiment includes the improved Paillier algorithm system parameter generation algorithm, the improved Paillier algorithm user public and private key generation algorithm, and the cyclic group generator generation algorithm. The specific process of step S10 is as follows:

[0097] Generate system parameters: sysPrm = (h,k,n,n) 2The generation process is described in the aforementioned improved Paillier algorithm;

[0098] Generate commitment parameters: pedPrm=(G,p,g1,h1), where g1 and h1 are two generators of a group G of order p;

[0099] Generate the private key for the transaction sender: Select a random number x1 as the private key for the transaction sender, where Transaction sender's public key

[0100] Generate the transaction recipient's private key: Select a random number x2 as the transaction recipient's private key, where Transaction recipient's public key

[0101] Step S20: Based on the generated system parameters and public and private keys, and combined with the preset Paillier encryption algorithm, calculate the ciphertext of the transaction amount sent by the transaction sender and the ciphertext of the transaction amount received by the transaction receiver;

[0102] As an example, it should be understood that, based on the generated system parameters and public / private keys, and combined with the improved Paillier encryption algorithm, the ciphertext of the transaction amount for both the sender and receiver is calculated. When a user joins this application system, the minter initializes the user's balance in ciphertext form, writes it onto the blockchain, and allows the user to read it locally. The sender's pre-transaction account balance is stored locally or read from the blockchain, as detailed below:

[0103] Before a transaction, the sender can read the original encrypted amount from the blockchain:

[0104]

[0105] Before the transaction, the recipient can read the original encrypted amount from the blockchain:

[0106]

[0107] The calculated encrypted transaction amount from the sender:

[0108]

[0109] The encrypted transaction amount calculated for the recipient:

[0110]

[0111] Where T represents the transaction amount, A represents the original amount in the sender's account, B represents the original amount in the receiver's account, and r0 and r s0 r r0 r1, rs1 and r r1 All numbers are random, and r < n 2 r0 < n, r s0 <n, r r0 <n, r1 <n, r s1 <n and r r1 <n.

[0112] Step S30: Send the calculated transaction amount ciphertext to the blockchain node. The smart contract of the blockchain node calculates the ciphertext of the transaction sender's post-transaction account balance and the ciphertext of the transaction recipient's post-transaction account balance based on the preset ciphertext homomorphic algorithm, and updates the corresponding account on-chain ciphertext account amount.

[0113] In this embodiment, the encrypted account balance of the transaction sender after the transaction is:

[0114]

[0115] The encrypted message of the transaction recipient's post-transaction account balance is:

[0116]

[0117] Where mod represents the remainder calculation, k = g λ modn 2 n = pq, where p and q are two large prime numbers, and g represents a random number. For n 2 Coprime and less than n 2 The multiplication group of natural numbers, λ = lcm(p-1, q-1), where lcm represents the least common multiple, T represents the transaction amount, and h = g r modn 2 , r, r0, r s0 r r0 r1, r s1 and r r1 All numbers are random, and r < n 2 r0 < n, r s0 <n, r r0 <n, r1 <n, r s1 <n and r r1 <n, y1 represents the public key of the transaction sender, y2 represents the public key of the transaction receiver, A represents the original amount in the transaction sender's account, and B represents the original amount in the transaction receiver's account.

[0118] As an example, and understandably, the calculated ciphertext of the transaction amount is sent to the blockchain node. The blockchain node's smart contract calculates the ciphertext of the sender's and receiver's post-transaction account balances using a ciphertext homomorphic algorithm based on an improved Paillier algorithm, and updates the on-chain account balance ciphertext of each corresponding account. The specific process is as follows:

[0119] The encrypted account balance of the sender after the transaction is calculated:

[0120]

[0121] The encrypted account balance of the transaction recipient after the transaction is calculated:

[0122]

[0123] Update the encrypted account amount on the sender's blockchain to C_ts′;

[0124] Update the encrypted amount in the on-chain account of the transaction recipient to C_tr′.

[0125] Step S40: The transaction recipient reads the ciphertext of the transaction amount from the blockchain. When the decryption verifies that the transaction amount is greater than 0, the transaction is executed.

[0126] In this embodiment, before the step of decrypting and verifying that the transaction amount is greater than 0, the method further includes:

[0127] The transaction recipient has encrypted transaction amount C_tb = (E0, c b0 ,E1,c b1 Decrypt the data to obtain the plaintext transaction amount T and the random number r0.

[0128] The valid ciphertext corresponding to the plaintext transaction amount T and the random number r0 is calculated based on the preset Paillier algorithm.

[0129] Calculate the transaction amount corresponding to the valid ciphertext based on the ciphertext C_tb and the plaintext T of the transaction amount;

[0130] in, mod indicates the remainder calculation, k = g λ modn 2 n = pq, where p and q are two large prime numbers, and g represents a random number. For n 2 Coprime and less than n 2 The multiplication group of natural numbers, λ = lcm(p-1, q-1), where lcm represents the least common multiple, T represents the transaction amount, and h = g r modn 2 r, r0, and r1 are all random numbers, and r < n2 r0 < n and r1 < n, y2 represents the public key of the transaction recipient.

[0131] In this embodiment, after the step of the transaction recipient reading the encrypted transaction amount from the blockchain, the method further includes:

[0132] When the decryption verification shows that the transaction amount is not greater than 0, the transaction recipient calls the Sigma and Bulletproof protocols to construct evidence and initiate an appeal.

[0133] The smart contracts of blockchain nodes verify the veracity of claims based on the Sigma protocol verification algorithm and the Bulletproof protocol verification algorithm.

[0134] In this embodiment, the transaction recipient invokes the Sigma and Bulletproof protocols to construct evidence and initiate an appeal, including:

[0135] Invoke the Sigma protocol to encrypt the transaction amount C_tb = (E0, c b0 ,E1,c b1 Construct evidence of legality;

[0136] Construct a Pedersen commitment for the transaction amount, denoted as Pedersen1.

[0137] Invoke the Sigma protocol to construct evidence of the equality of transaction amounts for Pedersen1 and E0;

[0138] Invoke the bulletproof protocol to construct evidence that the transaction amount for Pedersen1 is within a specific range;

[0139] Send Pedersen1 and the evidence to the blockchain node to file an appeal;

[0140] Among them, g1 and h1 are two generators of a group G of order p.

[0141] In this embodiment, the evidence consists of:

[0142] Appeal_proof=TAEC((T,r0,y2,Pedersen1,2 l ):

[0143]

[0144]

[0145] Where TAEC represents the function that generates evidence for the appeal, 2 l Indicates the upper limit of the transaction amount.

[0146] In this embodiment, the smart contract of the blockchain node verifies the veracity of the claim based on the Sigma protocol verification algorithm and the Bulletproof protocol verification algorithm, including:

[0147] Obtain the system parameter sysPrm, commitment parameter pedPrm, transaction recipient's public key y2, commitment Pedersen1, and appeal evidence TAEC, and read E0 and c from the chain. b0 ;

[0148] Based on sysPrm, pedPrm, y2, Pedersen1, TAEC, E0 and c b0 It also invokes the Sigma protocol verification algorithm and the Bulletproof protocol verification algorithm to verify the appeal evidence;

[0149] If the verification is successful, the transaction will be rolled back.

[0150] If verification fails, the appeal will be rejected and the transaction will remain unchanged.

[0151] In an exemplary and understandable manner, the transaction recipient reads the encrypted transaction amount on the blockchain, decrypts and verifies the legality of the encrypted amount and the transaction amount. If legal (i.e., the transaction amount is greater than 0), the transaction proceeds directly; if illegal (i.e., the transaction amount is not greater than 0), the recipient invokes the Sigma and Bulletproof protocols to construct evidence and initiate an appeal. The blockchain node's smart contract verifies the appeal's veracity based on the Sigma and Bulletproof verification algorithms. The specific steps are as follows:

[0152] The recipient of the transaction uses their private key to decrypt the ciphertext of the transaction amount, C_tb = (E0, c b0 ,E1,c b1 ), obtain the plaintext of the transaction amount and a random number (T, r0);

[0153] The improved Paillier algorithm is used to correctly compute the legal ciphertext C_tb′ corresponding to (T,r0);

[0154] Verify whether it is satisfied If the conditions are met, the transaction will proceed directly; if not, an appeal will be filed.

[0155] The appeal process is as follows:

[0156] Invoke the Sigma protocol to encrypt the transaction amount C_tb = (E0, c b0 ,E1,c b1 Construct evidence of legality;

[0157] Construct a Pedersen commitment for the transaction amount, denoted as Pedersen1, then...

[0158] Invoke the Sigma protocol to construct evidence of the equality of transaction amounts for Pedersen1 and E0;

[0159] Invoke the bulletproof protocol to construct evidence that the transaction amount for Pedersen1 is within a specific range.

[0160] The evidence consists of the following components:

[0161] Appeal_proof=TAEC((T,r0,y2,Pedersen1,2 l ):

[0162]

[0163]

[0164] Where TAEC represents the function that generates evidence for the appeal, 2 l Indicates the upper bound of the transaction amount;

[0165] The commitment Pedersen1 and the appeal evidence TAEC will be sent to the blockchain node.

[0166] The smart contract of a blockchain node verifies the veracity of a claim based on the encrypted transaction amount, evidence, and commitment. The specific steps are as follows:

[0167] Obtain the system parameter sysPrm, commitment parameter pedPrm, transaction recipient's public key y2, commitment Pedersen1, and appeal evidence TAEC, and read E0 and c from the chain. b0 ;

[0168] Based on sysPrm, pedPrm, y2, Pedersen1, TAEC, E0 and c b0 The system calls the Sigma protocol verification algorithm and the Bulletproof protocol verification algorithm to verify the appeal evidence; if the verification is successful, the transaction is rolled back; if the verification fails, the appeal is rejected and the transaction remains unchanged.

[0169] Step S50: After the blockchain transaction system has been running for a preset time, all users who have participated in the transaction construct a commitment for the transaction amount based on the commitment parameters, and call the sigma protocol and bulletproof protocol to construct evidence that the account amount is within a specific range;

[0170] In this embodiment, all users who have participated in the transaction construct a commitment for the transaction amount based on the commitment parameters, and invoke the Sigma and Bulletproof protocols to construct evidence that the account amount is within a specific range, including:

[0171] Users read the encrypted current account balance from the blockchain:

[0172]

[0173] The ciphertext of the current account amount is decrypted using the decryption algorithm in the preset Paillier encryption algorithm, resulting in the plaintext account amount U and a random number r. u0 ;

[0174] Based on the plaintext account amount U and the random number r u0 Construct a Pedersen commitment for the transaction amount, denoted as Pedersen_u, then

[0175] Invoking the Sigma protocol, for Pedersen_u and E u0 Construct evidence of equal transaction amounts;

[0176] Invoke the bulletproof protocol to construct evidence that the transaction amount is within a specific range for Pedersen_u;

[0177] Where mod represents the remainder calculation, k = g λ modn 2 n = pq, where p and q are two large prime numbers, and g represents a random number. For n 2 Coprime and less than n 2 The multiplication group of natural numbers, λ = lcm(p-1, q-1), where lcm denotes the least common multiple, and h = g r modn 2 ,r、r u0 and r u1 All numbers are random, and r < n 2 r u0 <n and r u1 <n, y u Let g1 and h1 represent the user's public key, and g1 and h1 be two generators of a group G of prime order p.

[0178] In this embodiment, the evidence consists of:

[0179] Legal_proof=TEOL((U,r u0 ,y u ,Pedersen_u,2 l ):

[0180]

[0181]

[0182] Where TEOL represents the function that generates ciphertext evidence of the legitimacy of account funds, 2 l This indicates the upper bound of the account balance.

[0183] As an example, it should be understood that in this embodiment, after the blockchain transaction system has been running for time t (e.g., one month), all users who participated in transactions during that period decrypt their account balances, invoke the Sigma and Bulletproof protocols to construct evidence of account legitimacy, and send the evidence to the blockchain nodes. The specific process is as follows:

[0184] Users read the encrypted current account balance from the blockchain:

[0185]

[0186] A decryption algorithm based on the improved Paillier algorithm decrypts the plaintext account amount U and the random number r. u0 ;

[0187] Construct a Pedersen commitment for the transaction amount, denoted as Pedersen_u.

[0188] Invoking the Sigma protocol, for Pedersen_u and E u0 Construct evidence of equal transaction amounts;

[0189] Invoke the bulletproof protocol to construct evidence that the transaction amount is within a specific range for Pedersen_u;

[0190] The evidence consists of the following components:

[0191] Legal_proof=TEOL((U,r u0 ,y u ,Pedersen_u,2 l ):

[0192]

[0193]

[0194] TAEC represents the function that generates ciphertext evidence of the legitimacy of account balances. l Indicates the upper limit of the account balance;

[0195] Then the commitment Pedersen_u and the evidence TEOL are sent to the blockchain node.

[0196] Step S60: Send the constructed promise and constructed evidence to the blockchain node. The smart contract of the blockchain node verifies the legitimacy of the account based on the encrypted account amount, evidence, and promise.

[0197] In this embodiment, the smart contract of the blockchain node verifies the legitimacy of the account based on the encrypted account amount, evidence, and commitment, including:

[0198] Obtain system parameter sysPrm, commitment parameter pedPrm, and user public key y. u The commitment is Pedersen_u and the evidence is TEOL, and E is read from the chain. u0 and c u0 ;

[0199] Based on sysPrm, pedPrm, y u 、Pedersen_u、TEOL、E u0 and c u0 It then invokes the Sigma and Bulletproof protocol verification algorithms to verify the legitimacy of the account.

[0200] If the verification is successful, all transactions within the preset time period are deemed valid.

[0201] If the verification fails, it is determined that there is an illegal transaction within a preset time period.

[0202] As an example, it is understood that the smart contract of the blockchain node in this embodiment verifies the legitimacy of the account based on the Sigma protocol verification algorithm, the Bulletproof protocol verification algorithm, and the encrypted user account funds, evidence, and commitment. The specific process is as follows:

[0203] Obtain system parameter sysPrm, commitment parameter pedPrm, and user public key y. u Obtain the transaction amount commitment Pedersen_u and the evidence TEOL, and read the user account ciphertext E from the blockchain. u0 and c u0 ;

[0204] Based on sysPrm, pedPrm, y u 、Pedersen_u、TEOL、E u0 and c u0The system invokes the verification functions of the Sigma and Bulletproof protocols to verify the legitimacy of the evidence. If the verification fails, the regulatory body conducts individual oversight of all transactions within the current time period; otherwise, it proves that all transactions within that time period are legitimate. Therefore, this embodiment only requires account verification and proof once every certain period, thus simplifying the transaction process and reducing the amount of data recorded on the blockchain.

[0205] In summary, this application provides a confidential transaction method based on an improved Paillier algorithm. This method supports homomorphic encrypted data across the entire network, supports the verification of the legitimacy of transactions, and supports regulatory oversight, while reducing the amount of data recorded on the blockchain and simplifying the transaction process.

[0206] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0207] The above description is merely a specific embodiment of this application, enabling those skilled in the art to understand or implement this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A blockchain-based confidential transaction method, characterized in that, Includes the following steps: System parameters, commitment parameters, and public and private keys of the transaction sender and receiver are generated based on a preset algorithm. Based on the generated system parameters and public and private keys, and combined with the preset Paillier encryption algorithm, the ciphertext of the transaction amount for the sender and the ciphertext of the transaction amount for the receiver are calculated. The calculated transaction amount in ciphertext is sent to the blockchain node. The smart contract of the blockchain node calculates the ciphertext of the transaction sender's account balance after the transaction and the ciphertext of the transaction recipient's account balance after the transaction based on the preset ciphertext homomorphic algorithm, and updates the corresponding account amount in ciphertext on the blockchain. The transaction recipient reads the encrypted transaction amount from the blockchain. When the decryption verifies that the transaction amount is greater than 0, the transaction is executed. After the blockchain transaction system has been running for a preset period of time, all users who have participated in the transaction construct a commitment for the transaction amount based on the commitment parameters, and call the sigma protocol and bulletproof protocol to construct evidence that the account amount is within a specific range; The constructed promise and constructed evidence are sent to the blockchain node, and the blockchain node's smart contract verifies the legitimacy of the account based on the encrypted account amount, evidence, and promise.

2. The blockchain confidential transaction method as described in claim 1, characterized in that, Before the step of verifying that the transaction amount is greater than 0 through decryption, the following steps are also included: The transaction recipient has encrypted the transaction amount. Decryption yields the plaintext transaction amount. and random numbers ; Calculation of transaction amount based on the preset Paillier algorithm and plaintext. and random numbers The corresponding legitimate ciphertext; Based on the encrypted transaction amount and transaction amount in plain text Calculate the transaction amount corresponding to the valid ciphertext; in, , , , , This indicates calculation by taking the remainder. , , and Two large prime numbers, Represents random numbers and , To and Coprime and less than The multiplication group consisting of natural numbers, , Represents the least common multiple. Indicates the transaction amount. , , and All are random numbers, and , as well as , This represents the public key of the transaction recipient.

3. The blockchain confidential transaction method as described in claim 2, characterized in that, Following the step where the transaction recipient reads the encrypted transaction amount from the blockchain, the process also includes: When the decryption verification shows that the transaction amount is not greater than 0, the transaction recipient calls the Sigma and Bulletproof protocols to construct evidence and initiate an appeal. The smart contracts of blockchain nodes verify the veracity of claims based on the Sigma protocol verification algorithm and the Bulletproof protocol verification algorithm.

4. The blockchain confidential transaction method as described in claim 3, characterized in that, The transaction recipient invokes the Sigma and Bulletproof protocols to construct evidence and initiate an appeal, including: Invoke the Sigma protocol to encrypt the transaction amount. Constructing evidence of legality; Construct a Pedersen commitment for the transaction amount, denoted as , ; Call the Sigma protocol, for and Construct evidence of equal transaction amounts; Calling the bulletproof protocol, for Construct evidence that the transaction amount falls within a specific range; Will The evidence is sent to the blockchain node to file an appeal. in, and It is a prime number. Two generators of the group G.

5. The blockchain confidential transaction method as described in claim 4, characterized in that, The evidence consists of the following: in, This represents a function that generates evidence for an appeal. Indicates the upper limit of the transaction amount.

6. The blockchain confidential transaction method as described in claim 5, characterized in that, The smart contract of the blockchain node verifies the veracity of the claim based on the Sigma and Bulletproof protocols, including: Get system parameters Commitment parameters Transaction recipient's public key ,promise and evidence of appeal and read from the chain and ; based on , , , , , and It also invokes the Sigma protocol verification algorithm and the Bulletproof protocol verification algorithm to verify the appeal evidence; If the verification is successful, the transaction will be rolled back. If verification fails, the appeal will be rejected and the transaction will remain unchanged.

7. The blockchain confidential transaction method as described in claim 1, characterized in that, All users who participated in the transaction constructed a commitment for the transaction amount based on the commitment parameters, and invoked the Sigma and Bulletproof protocols to construct evidence that the account amount was within a specific range, including: Users read the encrypted current account balance from the blockchain: The ciphertext of the current account balance is decrypted using the decryption algorithm in the preset Paillier encryption algorithm to obtain the plaintext account balance. and random numbers ; Based on plaintext account balance and random numbers Construct a Pedersen commitment for the transaction amount, denoted as ,but ; Call the Sigma protocol, for and Construct evidence of equal transaction amounts; Calling the bulletproof protocol, for Construct evidence that the transaction amount falls within a specific range; in, This indicates calculation by taking the remainder. , , and Two large prime numbers, Represents random numbers and , To and Coprime and less than The multiplication group consisting of natural numbers, , Represents the least common multiple. , , and All are random numbers, and , as well as , This represents the user's public key. and It is a prime number. Two generators of the group G.

8. The blockchain confidential transaction method as described in claim 7, characterized in that, The evidence consists of the following: in, This function represents the function that generates encrypted evidence of the legitimacy of account balances. This indicates the upper bound of the account balance.

9. The blockchain confidential transaction method as described in claim 8, characterized in that, The smart contract of the blockchain node verifies the legitimacy of the account based on the encrypted account amount, evidence, and commitment, including: Get system parameters Commitment parameters User public key ,promise and evidence and read from the chain and ; based on , , , , , and It then calls the Sigma protocol verification algorithm and the Bulletproof protocol verification algorithm to verify the legitimacy of the account; If the verification is successful, all transactions within the preset time period are deemed valid. If the verification fails, it is determined that there is an illegal transaction within a preset time period.

10. The blockchain confidential transaction method as described in claim 1, characterized in that, The encrypted account balance of the transaction sender after the transaction is: The encrypted message of the transaction recipient's post-transaction account balance is: in, This indicates calculation by taking the remainder. , , and Two large prime numbers, Represents random numbers and , To and Coprime and less than The multiplication group consisting of natural numbers, , Represents the least common multiple. Indicates the transaction amount. , , , , , , and All are random numbers, and , , , , , as well as , This represents the public key of the transaction sender. This indicates the public key of the transaction recipient. This indicates the original amount in the sender's account. This indicates the original amount in the recipient's account.

Images