An auditable alliance chain privacy protection scheme based on DLIN encryption

Abstract

This paper designs an auditable alliance chain privacy protection scheme based on DLIN encryption, aiming to break the dilemma of difficult supervision of privacy protection schemes, balance the relationship between privacy and auditing, and ensure the healthy development of the alliance chain ecosystem. The main idea is to design an auditable alliance chain privacy protection scheme in combination with a linear decision encryption algorithm. We hide the transaction amount based on the Pedersen commitment, and combine it with a non-interactive zero-knowledge proof to ensure that the DLIN supervision ciphertext matches the committed amount. In addition, we implement verification and supervision of the public key of the transaction recipient based on the dual-key hidden address protocol combined with DLIN encryption.

Description

Technical field:

[0001] The present invention belongs to the field of blockchain and relates to a privacy protection mechanism. Background technology:

[0002] In the absence of auditing, blockchain privacy protection solutions fall into the dilemma of being untraceable. Currently, most blockchain solutions design privacy protection mechanisms for public chain ledger data storage that is open and transparent. However, only considering privacy protection without considering the audit of private transactions is not conducive to promoting the healthy development of the blockchain ecosystem. Therefore, there is an urgent need for an auditable blockchain privacy protection solution.

[0003] As a weakly centralized blockchain, the consortium chain is currently the optimal blockchain solution that balances auditability and privacy. Summary of the invention:

[0004] The purpose of the present invention is to provide an auditable alliance chain privacy protection scheme based on DLIN encryption. In order to break the dilemma that privacy-protected data cannot be audited, the DLIN encryption algorithm is adopted, and a new privacy protection mechanism is designed based on non-interactive zero-knowledge proof and Pedersen commitment. To achieve the above purpose, the present invention adopts the following technical solutions:

[0005] Step 1: System initialization: input security parameter λ, generate public parameter param, and generate corresponding public and private key pairs for verification nodes and regulatory centers;

[0006] Step 2: User registration: The user has the identities of both the transaction initiator and the transaction recipient. Before a specific transaction, the user submits an application to the regulatory center for registration. The regulatory center allocates a public and private key pair for transactions to users who have passed the review and joined the alliance chain;

[0007] Step 3: Generate the regulatory ciphertext of the transaction hidden address and amount: The two parties to the transaction interact through three rounds of communication to generate the information required for the transaction; the transaction sender generates the hidden address and amount commitment based on the interactive information, and then uses the public key of the regulatory center to generate the corresponding regulatory ciphertext;

[0008] Step 4: Generate audit information: The transaction sender generates a non-interactive zero-knowledge proof, and uses the zero-knowledge proof information to ensure that the Pedersen commitment is equal to the amount in the amount supervision ciphertext, ensuring the correctness of the decrypted suspicious transaction amount; combined with the verification node public key, generate identity audit information;

[0009] Step 5: Transaction Verification: The verification node verifies the transaction information submitted by the sender, decrypts the audit ciphertext, verifies the zero-knowledge proof information, determines the correctness of the transaction, and packages the correct transaction into the block;

[0010] Step 6: Receiver’s hidden address matching: The receiver traverses the transaction information of the current block and uses the sub-public key combined with the matching identifier to match the hidden address of the transaction;

[0011] Step 7: Transaction supervision: The supervision center interacts with the verification center to decrypt the obtained supervision ciphertext to obtain the identity information of the recipient of the suspicious transaction and the specific transaction amount. Description of the drawings:

[0012] Figure 1 The system model of the auditable privacy protection scheme of the present invention is described in detail

[0013] Figure 2 Information exchange stage between sender and receiver

[0014] Figure 3 Dual-key hidden address and corresponding verification ciphertext and supervision ciphertext generation stage Specific implementation method:

[0015] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0016] The present invention provides an auditable alliance chain privacy protection scheme based on DLIN encryption, and the specific steps are as follows:

[0017] Step 1: System initialization: Input security parameter λ, generate public parameter params=(F p ,E,G,H,q,H s ), generate corresponding public and private key pairs for verification nodes and regulatory centers (d AC ,P AC ) and (PriK VN ,PubK VN ). Among them, G and H are elliptic curves E / F respectively. p The upper order is a large prime number q∈Z q Two different generators of s A collision-resistant hash function.

[0018] P AC =d AC G

[0019] Pk VN ={d x ,d y ,d z}

[0020] PubK VN ={d z G,d yG,d x G,d z d y G,d z d x G,d x d y G}

[0021] In the above formula, AC stands for the regulatory center and VN stands for the verification node.

[0022] Step 2: User registration: The user has both the identity of the transaction initiator and the transaction receiver. Before the specific transaction, the user submits an application to the regulatory center for registration. The regulatory center allocates a public and private key pair for transactions to users who have passed the review and joined the alliance chain. AC passes the authentication of user i and then randomly selects a, b∈Z q As the user's scan private key scan-key and spending private key spent-key, the public key (A, B) = (aG, bG) is generated according to the public parameters params.

[0023] Step 3: Generate the regulatory ciphertext of the transaction hidden address and amount: The two parties to the transaction interact to generate the information required for the transaction through three rounds of communication; the transaction sender generates the hidden address and amount commitment based on the interactive information, and then uses the public key of the regulatory center to generate the corresponding regulatory ciphertext.

[0024] Step 3.1: TR determines the transaction amount v TR , generate a child public key (C k ,D k )=(aD k ,B+H s (a,k)) and send Params to TS through a secure channel TR1 =(v TR ,C k ,D k );TS selects a random number q∈Z q , generate hidden address P = H s (qC k )G+D k The one-time address of TR, the receiver of this transaction;

[0025] Step 3.2: TS passes parameters Params TR1 Confirm transaction amountv TR , randomly select r TS1 ,r TS2 As blinding factors for transaction amount commitment and change amount commitment, send Params to TR through secure channel TS =(r TR ,r TS2 G).

[0026] Step 3.3: TR receives Params TS , calculate the amount of this transaction commitment Com TR =r TR G+v TR H, select s TR ∈Z q , calculate the audit ciphertext of the amount (C1' TR ,C2' TR )=(s TR G,s TR P AC +v TR ), certification mark T = aP AC And communication mark e = H s (r TR G+r TS2 G|T).

[0027] Step 4: Generate audit information: The transaction sender generates a non-interactive zero-knowledge proof, and uses the zero-knowledge proof information to ensure that the Pedersen commitment is equal to the amount in the amount supervision ciphertext, ensuring the correctness of the decrypted suspicious transaction amount; combined with the verification node public key, generate identity audit information.

[0028] Step 4.1: The participants' zero-knowledge proofs ZKI for the amounts in their commitments are defined as .

[0029] ZKI{(R i ,ρ j ) i,j＝1,2,3 ,c':R 1 =s' TS G∧R 2 =v'H∧R 3

[0030] =s'P AC +v'∧ρ 1 =v'+c'v∧ρ 2 =s'+c's

[0031] ∧c'=H s (COM,C1 V ,C2 V ,R 1 ,R 2 ,R 3 )

[0032] Step 4.2: TS calculates the blinding factor difference Δr = r TS1 -r TR -r TS2 , then generates audit information Info and sends it to the verification node VN. Info is defined as.

[0033] Info{(COM,C1V ,C2 V ) i＝TS1,TS2,TR ,c',(R 1 ,R 2 ,R 3 ) j＝TS1,TS2,TR ,

[0034]

[0035] Step 5: Transaction Verification: The verification node verifies the transaction information submitted by the sender, decrypts the audit ciphertext, verifies the zero-knowledge proof information, determines the correctness of the transaction, and packages the correct transaction into the block.

[0036] Step 5.1: VN uses the private key (d x ,d y ,d z ) to decrypt the authentication ciphertext as shown below.

[0037] D k =E4-(E1d y +E2d Z )

[0038] C k =E5-(E1d x +E3d y )

[0039] q=E6-(E2d x +E3d z )

[0040] Step 5.2: VN uses the properties of the sub-public key generation protocol to determine the correctness of the authentication tag T.

[0041]

[0042] Step 5.3: Using the homomorphic property of Pedersen commitment, verify that the difference in amount commitment is provided by the blinding factor, as shown below.

[0043] COM TR +COM TS2 -COM TS1 =ΔrG

[0044] Step 6: Receiver hidden address matching: The receiver traverses the transaction information of the current block and uses the sub-public key combined with the matching identifier to match the hidden address of the transaction. TR checks the transaction items of the current block, uses the address matching mark Q combined with its own scan-key and the recipient address P of the transaction, and calculates D k =PH s (aQ) is true. If true, calculate the corresponding private key x k=H s (aQ)+b+H s (a|k) to control the one-time address, otherwise continue checking the block entry.

[0045] Step 7: Transaction supervision: The supervision center interacts with the verification center to decrypt the obtained supervision ciphertext to obtain the identity information of the recipient of the suspicious transaction and the specific transaction amount.

[0046] Step 7.1: Audit Center AC extracts identity supervision ciphertext Use private key d AC Decryption At the same time, to prevent the receiver from maliciously generating an incorrect identity supervision ciphertext, AC determines Ad AC Is it equal to the authentication tag T? If so, it proves that A is the intended recipient's transaction public key, and then checks the local identity list List AC To find the user identity information corresponding to public key A.

[0047] Step 7.2: In order to supervise the transaction amount v, RC extracts the amount supervision ciphertext calculate Thereby obtaining the specific transaction amount of the transaction.

Claims

1. An auditable alliance chain privacy protection scheme based on DLIN encryption. The specific steps are as follows: Step 1: System initialization: input security parameter λ, generate public parameter param, and generate corresponding public and private key pairs for verification nodes and regulatory centers; Step 2: User registration: The user has the identities of both the transaction initiator and the transaction recipient. Before a specific transaction, the user submits an application to the regulatory center for registration. The regulatory center allocates a public and private key pair for transactions to users who have passed the review and joined the alliance chain; Step 3: Generate the regulatory ciphertext of the transaction hidden address and amount: The two parties to the transaction interact through three rounds of communication to generate the information required for the transaction; the transaction sender generates the hidden address and amount commitment based on the interactive information, and then uses the public key of the regulatory center to generate the corresponding regulatory ciphertext; Step 3.1: TR determines the transaction amount v TR , generate a child public key (C k ,D k )=(aD k ,B+H s (a,k)) and send Params to TS through a secure channel TR1 =(v TR ,C k ,D k );TS selects a random number q∈Z q , generate hidden address P = H s (qC k )G+D k The one-time address of TR, the receiver of this transaction; Step 3.2: TS passes parameters Params TR1 Confirm transaction amountv TR , randomly select r TS1 ,r TS2 As blinding factors for transaction amount commitment and change amount commitment, send Params to TR through secure channel TS =(r TR ,r TS2 G); Step 3.3: TR receives Params TS , calculate the amount of this transaction commitment Com TR =r TR G+v TR H, select s TR ∈Z q , calculate the amount audit ciphertext (C1' TR ,C2' TR )=(s TR G,s TR P AC +v TR ), certification mark T = aP AC And communication mark e = H s (r TR G+r TS2 G|T); Step 4: Generate audit information: The transaction sender generates a non-interactive zero-knowledge proof, and uses the zero-knowledge proof information to ensure that the Pedersen commitment is equal to the amount in the amount supervision ciphertext, ensuring the correctness of the decrypted suspicious transaction amount; combined with the verification node public key, generate identity audit information; Step 4.1: The zero-knowledge proof ZKI of the amount committed by the participants is defined as: ZKI{(R i ,ρ j ) i,j＝1,2,3 ,c':R 1 =s' TS G∧R 2 =v'H∧R 3 =s'P AC +v'∧ρ 1 =v'+c'v∧ρ 2 =s'+c's ∧c'=H s (COM,C1 V ,C2 V ,R 1 ,R 2 ,R 3 ) Step 4.2: TS calculates the blinding factor difference Δr = r TS1 -r TR -r TS2 , then generates audit information Info and sends it to the verification node VN; Info is defined as: Step 5: Transaction Verification: The verification node verifies the transaction information submitted by the sender, decrypts the audit ciphertext, verifies the zero-knowledge proof information, determines the correctness of the transaction, and packages the correct transaction into the block; Step 5.1: VN uses the private key (d x ,d y ,d z ) to decrypt the authentication ciphertext as follows: D k =E4-(E1d y +E2d Z ) C k =E5-(E1d x +E3d y ) q=E6-(E2d x +E3d z ) Step 5.2: VN uses the properties of the sub-public key generation protocol to determine the correctness of the authentication tag T; Step 5.3: Using the homomorphic property of Pedersen commitment, verify whether the difference in amount commitment is provided by the blinding factor, as shown below: WITH TR +COM TS2 -WITH TS1 =ΔrG; Step 6: Receiver hidden address matching: The receiver traverses the transaction information of the current block and uses the sub-public key combined with the matching identifier to match the hidden address of the transaction; TR checks the transaction items of the current block, uses the address matching mark Q combined with its own scan-key and the recipient address P of the transaction, and calculates D k =PH s (aQ) is true; if true, calculate the corresponding private key x k =H s (aQ)+b+H s (a|k) to control the one-time address, otherwise continue to check the block entry; Step 7: Transaction supervision: The supervision center interacts with the verification center to decrypt the obtained supervision ciphertext and obtain the identity information of the recipient of the suspicious transaction and the specific transaction amount; Step 7.1: Audit Center AC extracts identity supervision ciphertext Use private key d AC Decryption At the same time, to prevent the receiver from maliciously generating an incorrect identity supervision ciphertext, AC determines Ad AC Is it equal to the authentication tag T? If so, it proves that A is the intended recipient's transaction public key, and then checks the local identity list List AC To find the user identity information corresponding to public key A; Step 7.2: In order to supervise the transaction amount v, AC extracts the amount supervision ciphertext calculate Thereby obtaining the specific transaction amount of the transaction.

Images