A supervisable privacy protection blockchain system and method based on zk-SNARK

Abstract

The application relates to a supervisable privacy protection blockchain system and method based on zk-SNARK, and belongs to the technical field of blockchain application.The application uses homomorphic encryption to perform data calculation in a communication process, uses zk-SNARK zero-knowledge proof technology to ensure the correctness of communication data, adds a virtual address to an address set in communication to realize the privacy protection of the identity of a communicator, and uses a supervisor key to supervise on-chain messages.The application is constructed by Substrate and privacy protection technology based on zk-SNARK, and can protect the privacy information of user messages and the identity of a communicator in a communication process.Supervisors can supervise on-chain messages by using their own private keys, and the privacy protection of user messages is not affected on the premise that the safety of the private keys is ensured; compared with other zero-knowledge proof schemes, the size of the zk-SNARK proof is constant and small enough, and the use of an account-based blockchain is also conducive to the optimization of zero-knowledge proof cost and on-chain storage cost.

Description

TECHNICAL FIELD

[0001] The application relates to a supervisable privacy protection blockchain system and method based on zk-SNARK, and belongs to the technical field of blockchain application. BACKGROUND

[0002] Zero-knowledge proof is a cryptographic method that allows the prover to prove to the verifier that a statement is true while avoiding conveying any additional information in the process of proof. In addition to the information that the given statement is true, the verifier cannot obtain other information. Zk-SNARK is a zero-knowledge protocol, which stands for Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge. Interactive zero-knowledge proof requires the verifier and the prover to interact to prove a statement, while as a non-interactive protocol, zk-SNARK only requires the prover to calculate the proof to convince any number of verifiers, and these verifiers do not need to interact with the prover multiple times.

[0003] Blockchain is a distributed ledger technology composed of a growing list of records, which are blocks, securely connected together using cryptographic techniques. Since each block contains a timestamp, data and the hash of the previous block, the data recorded in the blockchain cannot be modified. Once the data is recorded and distributed to each node that makes up the blockchain network, the data in any block cannot be changed without changing all subsequent blocks. Blockchain has the characteristics of decentralization, tamper resistance, traceability, etc., and can establish a trust relationship among nodes. It has played an important role in insurance, medical care, supply chain security and other fields.

[0004] Since the communication data on the blockchain is generally publicly visible, there are more and more privacy protection schemes to protect the communication privacy of blockchain users, such as using zero-knowledge proof technology. However, the existing privacy protection blockchain technology based on zero-knowledge proof has the following problems and conflicts:

[0005] 1. Privacy problem: without using zero-knowledge proof, the message and the identity of the communicator in the communication process of the on-chain user are in an open state, which is not conducive to privacy protection;

[0006] 2. Supervision problem: under the condition of using zero-knowledge proof, the message of the on-chain user is completely hidden, which is not conducive to the audit of the regulatory department;

[0007] 3. Computing cost problem: most zero-knowledge proof schemes consume a large amount of computing resources and storage space, and lack practicality. SUMMARY

[0008] The purpose of the present application is to creatively propose a supervisable privacy protection blockchain system and method based on zk-SNARK in view of the problems and deficiencies existing in the prior art privacy protection blockchain system based on zero-knowledge proof.

[0009] The innovation of the present application lies in: using homomorphic encryption for data calculation in the communication process, using zk-SNARK zero-knowledge proof technology to ensure the correctness of the communication data, adding virtual addresses to the address set in the communication to realize the privacy of the identity of the communicator, and using the supervisory party key to supervise the on-chain message.

[0010] Advantages

[0011] Compared with the prior art, the present application has the following advantages:

[0012] 1. More perfect privacy protection: the present blockchain system is constructed by Substrate and privacy protection technology based on zk-SNARK, which can protect the privacy information of user messages and the identity of the communicator in the communication process;

[0013] 2. Supervisable: the supervisory department can use its own private key to supervise the on-chain message, and the privacy protection of user communication is not hindered on the premise of ensuring the safety of the private key;

[0014] 3. Lower calculation cost: compared with other zero-knowledge proof schemes, the size of zk-SNARK proof is constant and small enough; using the account-based blockchain is also conducive to the optimization of zero-knowledge proof cost and on-chain storage cost. BRIEF DESCRIPTION OF DRAWINGS

[0015] Figure 1 is a schematic diagram of a blockchain system;

[0016] Figure 2 In the figure, (a) is a flowchart of the initialization process of the blockchain system, (b) is a flowchart of sending a message in the blockchain system, and (c) is a flowchart of supervisory audit in the blockchain system. DETAILED DESCRIPTION

[0017] The technical solutions of the present application will be further described below with reference to the drawings.

[0018] A supervisable privacy protection blockchain system based on zk-SNARK, comprising:

[0019] User: the user of the system. When communicating, it is divided into a sender and a receiver, both of which have certain existing information, and the sender updates the existing information of both parties by sending a message to the receiver.

[0020] Address: Each user has a unique address, which is a fixed-length string, and is the target of receiving messages. Only when the address of a user is known can messages be sent to the user. A virtual address is used to confuse the real address of the correspondent.

[0021] Proof: A statement made by a node in the blockchain to convince other nodes that a certain statement is valid. In this system, the proof is a non-interactive zero-knowledge proof, which does not disclose additional information beyond the statement. The node issuing the proof can convince any number of nodes, and these nodes do not need to interact with the node issuing the proof to verify the proof.

[0022] Key: The identity of the user, used for encryption and decryption and calculation of zero-knowledge proof. Each user has a user private key, which can be used to derive a proof generation public key for calculating zero-knowledge proof. The two keys are generated through a randomization process to generate a one-time signature private key and a one-time verification public key.

[0023] In addition, it also includes a decryption private key for viewing messages, an encryption public key for encrypting messages, and a supervisor public and private key for auditing.

[0024] Node: A module that packages several messages into a block, used to upload messages to the blockchain network and reach consensus with other nodes.

[0025] Client: A module that signs messages with its own private key and sends them to the node, providing an operating interface for users.

[0026] Certificate Authority: Issues digital certificates to clients and supervisors to distinguish different clients and identify the special identity of the supervisor.

[0027] As shown in Figure 1 , in this system, the nodes are connected to each other to form a blockchain network. Each node has a smart contract deployed and is connected to several clients. The certificate authority is connected to the blockchain network.

[0028] When the system is running, it includes initialization, message sending, and regulatory audit.

[0029] The implementation method of initialization is that each user in the system generates their own user private key, and at the same time derives the proof generation public key, decryption private key, encryption public key, and address in turn. The supervisor generates its own public and private key pair and keeps it properly. The certificate authority issues digital certificates to users and supervisors.

[0030] The process of initialization is shown in Figure 2 (a).

[0031] The message sending method is as follows: First, the sender connects to the client and generates a one-time signature private key using its own user private key through a randomization process. It then generates a one-time verification public key using the same randomization process using the proof generation public key; the two one-time keys are mutually corresponding. Next, the sender uses the decryption private key to decrypt the on-chain balance and generates a zero-knowledge proof off-chain using zk-SNARK. This proof includes constraints on message validity. Subsequently, the sender constructs the message off-chain using the encryption public key and signs it with the one-time signature private key. The message content includes the zero-knowledge proof, the sender's address, the receiver's address, the information to be conveyed, and the intermediate value obtained by homomorphically combining the existing information of both parties. Simultaneously, some virtual addresses are automatically added to the message by the client for obfuscation, making it indistinguishable from the virtual addresses of the actual sender and receiver. Afterward, the sender encrypts the message using the regulator's public key, uploads it to the blockchain, and sends the message. Nodes verify the message's legitimacy, package the message, and upload it to the blockchain. Finally, an off-chain smart contract verifies the validity of the zero-knowledge proof and updates the existing information of the sender and receiver.

[0032] The process of sending a message is as follows: Figure 2 As shown in (b).

[0033] Furthermore, key derivation can be performed using the following method. First, each user possesses a user private key SK. usr , by SK usr Able to derive proof to generate public key PK gen This is used to compute zero-knowledge proofs. Simultaneously, the user's private key and the proof-generating public key are used to generate a corresponding one-time signature private key SK′ through a randomization process. sig One-time verification public key PK′ vfy Two one-time keys are randomly generated for each communication to ensure anonymity during message signing. Then, the decryption private key SK is obtained by proving the generation of the public key. dec This further leads to the development of public-key cryptography (PK). enc The decryption private key is used to view the key owner's messages and existing information. The encryption public key is used to encrypt messages and existing information. The regulator possesses an independent public key PK. sv and private key SK sv For auditing purposes.

[0034] Furthermore, homomorphic encryption can be implemented using the following methods. During communication, the message and existing information are computed using additive homomorphic encryption to ensure communication privacy. During the homomorphic encryption operation, the message and the existing information of both parties remain encrypted, directly yielding the encrypted new information. To maximize encryption efficiency while maintaining homomorphic properties, the system can choose the Lifted-ElGamal asymmetric key encryption algorithm, which has good compatibility with zero-knowledge proofs.

[0035] The implementation method of regulatory audit is that the regulator uses the regulator private key owned by the regulator to decrypt the encrypted message on the chain and the existing information to obtain the plaintext message and the existing information, and then the audit can be performed.

[0036] The process of regulatory audit is as shown in Figure 2 (c).

[0037] Further, the zero-knowledge proof can adopt the following method: zk-SNARK is used to make other nodes in the blockchain network believe that the message is valid without disclosing the message and the existing information. The following statements are included in the proof:

[0038] The message Message is greater than zero:

[0039] Message>0

[0040] The sender's existing information Info s is greater than or equal to the message Message:

[0041] Info s >=Message

[0042] The sender uses the correct key to encrypt the correct message:

[0043]

[0044] The receiver uses the correct key to encrypt the correct message:

[0045]

[0046] The message sent by the sender is equal to the message received by the receiver:

[0047]

[0048]

[0049] The message is correctly signed by the signing key and can be correctly verified by the verification key:

[0050] Vfy(PK′ vfy ,Sig(SK′ sig ,Tx))=True

[0051] The message is correctly encrypted using the regulator public key:

[0052] Enc(PK sv ,{Message,Addr s ,Addr r ,Balance′ s ,Balance′r}) = True

[0053] where Message is the message, Info s is the sender's pre-communication existing information, Info r is the receiver's pre-communication existing information, Info' s is the sender's post-communication existing information, Info' r is the receiver's post-communication existing information, is the sender's encryption public key, is the receiver's encryption public key, Addr s is the sender's address, Addr r is the receiver's address, Enc is the encryption operation, Sig is the signature operation, Vfy is the verification operation, PK' vfy denotes the one-time verification public key, SK' sig denotes the one-time signature private key.

[0054] The above constraints are guaranteed by the zk-SNARK zero-knowledge proof, and are sent to the chain together with the encrypted message and verified on the chain.

[0055] Further, the on-chain operation and off-chain operation can adopt the following method. The encrypted message of the sender and the receiver is stored on the chain, when communication is needed, first use the decryption private key SH dec to decrypt the existing information on the chain, then generate a zero-knowledge proof off-chain, which contains the constraints of the validity of the message. Subsequently, the sender constructs a message off-chain and signs it using the one-time signature private key SKs' sig , the message content includes the zero-knowledge proof, the sender's address, the receiver's address, the encrypted information minus the sender's existing information, the encrypted message minus the receiver's existing information, and the message is sent after address obfuscation. At the same time, the message and the existing information are encrypted by the regulator's public key PK sv and uploaded to the chain. Finally, the validity of the zero-knowledge proof is verified by the smart contract off-chain, the existing information Info is obtained using the decryption private key, the existing information is added to the encrypted message minus the existing information Enc(PK enc , Message) - Info to obtain the encrypted message Enc(PK enc , Info), and the existing information of the sender and the receiver is updated using homomorphic encryption, the encrypted existing information of the sender is subtracted by the encrypted message, and the encrypted existing information of the receiver is added to the encrypted message.

[0056] Further, address obfuscation can employ the following method. When sending a message, the client automatically adds several random virtual addresses in the same format as the real address for obfuscation, and the specific number can be pre-configured. The purpose of the virtual address is to make the actual sender and receiver addresses indistinguishable from the virtual addresses, protecting the identity information of the correspondent.

[0057] Further, the following method can be employed for regulatory audits: when an audit is required, the regulator uses its own regulator private key SK sv After decrypting the encrypted messages and existing information on the chain to obtain the plaintext messages and existing information, the audit can be performed.

Claims

1. A zk-SNARK based monitorable privacy protection blockchain system, characterized in that, Comprise: User: the user of the system; when communicating, divided into sender and receiver, the sender updates the existing information of both parties by sending messages to the receiver; Address: each user has a unique address, which is a fixed-length string, and is the target of receiving messages. Only when the address of a user is known can messages be sent to it; a virtual address is used to confuse the real address of the communicator; Proof: a statement in the blockchain that convinces other nodes that a certain statement is valid; in this system, the proof is a non-interactive zero-knowledge proof that does not disclose additional information beyond the statement, and the node issuing the proof can convince any number of nodes, without the need for additional interactive communication between the nodes issuing the proof and the nodes verifying the proof; Key: the identity of the user, used for encryption and decryption and calculation of zero-knowledge proof; each user has a user private key, which can be used to derive a proof generation public key for calculating zero-knowledge proof; The above two keys generate a one-time signature private key and a one-time verification public key through a randomization process; also includes a decryption private key for viewing messages, an encryption public key for encrypting messages, and a supervisor public and private key for auditing; Node: a module that packages several transactions into a block, used to upload transactions to the blockchain network and reach consensus with other nodes; Client: a module that signs messages with its own private key and sends them to the node, providing an operating interface for users; Certificate authority: issues digital certificates to clients and supervisors to distinguish different clients and identify the special identity of supervisors; In this system, nodes are connected to each other to form a blockchain network; each node has a smart contract and is connected to several clients; the certificate authority is connected to the blockchain network.

2. The method of claim 1, wherein the system is implemented as a software application. System operation includes initialization, transfer transaction, and regulatory audit; The implementation method of initialization is that each user in the system generates their own user private key, and simultaneously derives a proof generation public key, a decryption private key, an encryption public key, and an address; the supervisor generates its own public and private key pair and keeps it safe; the certificate authority issues digital certificates to users and supervisors; The implementation method of sending messages is: First, the sender connects the client, uses its own user private key to generate a one-time signature private key through a randomization process, and uses the proof generation public key to generate a one-time verification public key through the same randomization process; the two one-time keys correspond to each other; Then, the sender uses the decryption private key to decrypt the balance on the chain, and uses zk-SNARK to generate a zero-knowledge proof off-chain, which contains constraints on the validity of the message; Subsequently, the sender constructs a message using the encryption public key off-chain and signs it using the one-time signature private key; the message content includes the zero-knowledge proof, the sender's address, the receiver's address, the information to be conveyed, and the intermediate value obtained by homomorphic operation on the existing information of both parties; at the same time, some virtual addresses are automatically added to the message by the client to confuse the actual sender and receiver addresses and virtual addresses, making them indistinguishable. After that, the sender encrypts the message with the regulator's public key and sends the message to the blockchain. The node verifies the legality of the message and packages the message and sends it to the blockchain. Finally, the off-chain smart contract verifies the validity of the zero-knowledge proof and updates the existing information of the sender and the receiver. The implementation method of regulatory audit is as follows: the regulator uses its own regulator private key to decrypt the encrypted message and existing information on the chain to obtain the plaintext message and existing information, and then performs audit.

3. The method of claim 2, wherein the system is implemented as a software application. The key derivation method is as follows: First, each user has a user private key SK usr , which is derived from SK usr , and a proof generation public key PK gen , which is used to compute zero-knowledge proofs; At the same time, the user private key and the proof generation public key generate a pair of corresponding one-time signature private key SK' and one-time verification public key PK' through a randomization process sig , both of which are randomly generated at each communication to ensure the anonymity of message signing; vfy , both of which are randomly generated at each communication to ensure the anonymity of message signing; Then, the decryption private key SK is derived by proving the generation of the public key dec Further, the encryption public key PK is derived enc ; the decryption private key is used to view the messages and existing information of the key owner; the encryption public key is used to encrypt the messages and existing information; the supervisor has independent public key PK and private key SK for auditing sv and sv .

4. The method of claim 2, wherein the system is implemented as a software application. The homomorphic encryption method is as follows: When communicating, the message and existing information are calculated by additive homomorphic encryption to ensure communication privacy. During the homomorphic encryption operation, the message and the existing information of both parties remain encrypted at all times, and the encrypted new information is obtained directly.

5. The method of claim 4, wherein the system is implemented as a software application. The system uses the Lifted-ElGamal asymmetric key encryption algorithm.

6. The method of claim 2, wherein the system is implemented as a software application. The zero-knowledge proof method is as follows: Zk-SNARK is used to convince other nodes in the blockchain network that the message is valid without revealing the message and existing information; the proof includes the following statements: The message Message is greater than zero: Message > 0 Sender existing information Info s Greater than or equal to message Message: Info s >= Message The sender uses the correct key to encrypt the correct message: The receiver uses the correct key to encrypt the correct message: The message sent by the sender is equal to the message received by the receiver: The message is correctly signed by the signing key and can be verified by the verification key: Vfy(PK', Sig(SK', Tx)) = True vfy Vfy(PK', Sig(SK', Tx)) = True sig Vfy(PK', Sig(SK', Tx)) = True The message is correctly encrypted using the regulator's public key: Enc(PK sv , {Message, Addr s , Addr r , Balance', Balance'} s , Balance' r}) = True wherein Message is a message, Info s is existing information before communication of a sender, r is existing information before communication of a receiver, s is existing information after communication of a sender, r is existing information after communication of a receiver, is an encryption public key of a sender, is an encryption public key of a receiver, s is an address of a sender, r is an address of a receiver, vfy denotes a one-time verification public key, sig denotes a one-time signature private key. The above constraints are guaranteed by the zk-SNARK zero-knowledge proof and are sent to the chain together with the encrypted message and verified on the chain.

7. The method of claim 2, wherein the system is implemented as a software application. The on-chain operation and off-chain operation method is as follows: ​ The encrypted messages of the sender and the receiver are stored on the chain, and when communication is needed, the decryption private key SK dec The existing information on the chain is decrypted, and then zero-knowledge proof is generated off-chain, and the proof contains the constraints of the validity of the message; Subsequently, the sender constructs a message off-chain and uses a one-time signature private key SK' sig Signatures, message content contains zero-knowledge proof, sender address, receiver address, encrypted information minus sender existing information, encrypted message minus receiver existing information, the message is sent after address confusion; at the same time, the message and existing information are linked on-chain through the regulator's public key PK sv After encryption Finally, the off-chain smart contract verifies the validity of the zero-knowledge proof, uses the decryption private key to obtain the existing information Info, adds the existing information to the encrypted message Enc(PK enc , Message)-Info to obtain the encrypted message Enc(PK enc , Info), and uses the homomorphic encryption to update the existing information of the sender and the receiver, subtracts the encrypted message from the encrypted existing information of the sender, and adds the encrypted message to the encrypted existing information of the receiver.

8. The method of claim 2, wherein the system is implemented as a software application. The address obfuscation method is as follows: ​ When sending a transaction, the client will automatically add a number of random virtual addresses that are the same as the real address format for obfuscation, and the specific number is pre-configured.

9. The method for implementing the system as described in claim 2, characterized in that, The regulator audit method is as follows: When an audit is required, the regulator uses its own regulator private key SKR sv The encrypted messages on the chain and the existing information are decrypted to obtain the plaintext messages and the existing information, and then the audit can be performed.

Images