Consortium chain privacy protection method and system

Abstract

The application provides a kind of alliance chain privacy protection method and system, it is related to blockchain privacy protection technical field, comprising: step S1: authority node generates multiplicative group using security parameter, and selects generator P and system key, calculates system public key, creates secure hash function, and discloses system public parameter;Step S2: user sends registered identity to authority node, and generates partial public and private key for it after identity verification by authority node;Step S3: assuming that the signer is user t, when signer ID_t signs message m, select the public key of ring member to form set L;Step S4: existing transaction initiator Alice and transaction receiver Bob carry out transfer transaction.The application can protect the identity privacy problem, and the real identity of signer can be tracked when transaction dispute occurs.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of blockchain privacy protection, in particular to a consortium chain privacy protection method and system. BACKGROUND

[0002] Blockchain is used in more and more fields, and its essence is a distributed chain-like data structure. Because blockchain has the characteristics of openness and transparency, traceability, decentralization and non-tamperability, it can complete the task of building a trust network at a lower cost, so it is used in many fields to realize safe and reliable transactions, such as energy transactions. At the same time, since the consortium chain is a partially decentralized blockchain, it is composed of an organization composed of multiple entities, only authorized nodes can join, and it completes the consensus of the ledger through a group of predetermined nodes, so it has a faster execution speed than public chains. Therefore, the consortium chain is more widely used.

[0003] However, due to the open and transparent nature of blockchain ledger information, the risk of privacy leakage is increased when using blockchain to solve problems.

[0004] In the prior art, the following problems exist:

[0005] [1] Blockchain privacy protection scheme based on ring signature. In document [1], this scheme enhances the anonymity of users, but users are completely anonymous, and once a dispute or malicious behavior occurs, the administrator cannot track the real identity of the signature.

[0006] [2] Public auditing scheme with identity privacy preserving based on certificateless ring signature for wireless body area networks. In document [2], this scheme uses an anonymous scheme based on elliptic curve certificateless ring signature, which is more efficient than traditional certificateless ring signature schemes, but this scheme only realizes unconditional anonymity of users.

[0007] [3] Privacy preserving scheme in block chain with provably securebased on sm9algorithm. In document [3], the privacy protection scheme adopts SM9 algorithm and group signature algorithm, which has high signature and verification efficiency, but the scheme only realizes identity anonymity, like the first two schemes, and cannot track the real identity of the signer.

[0008] [4] Full anonymous blockchain based on aggregate signature andconfidential transaction. In document [4], the scheme adopts conditional ring signature algorithm to protect the identity information of vehicles in vehicle self-organizing network, which realizes anonymity and traceability, but the efficiency of the scheme is low, and the above protection scheme only protects the identity privacy of the user, and does not protect the user data privacy.

[0009] [5] Pivacy-preserving communication for vanets with conditionallyanonymous ring signature. In document [5], the scheme realizes full anonymous privacy protection by using BGL03 aggregate signature and BGN06 homomorphic encryption scheme, but the verification of the aggregate signature in the scheme needs a large number of bilinear pairing operations, so the verification efficiency is low. SUMMARY

[0010] In view of the defects in the prior art, the present application provides a consortium chain privacy protection method and system.

[0011] According to the consortium chain privacy protection method and system provided by the present application, the scheme is as follows:

[0012] In a first aspect, a consortium chain privacy protection method is provided, which comprises: dividing nodes in a consortium chain into three categories, namely an authority node, a verification node and a common node;

[0013] Step S1: the authority node calculates the system master key by using the security parameter and the multiplicative group, generates the homomorphic encryption public and private keys, creates the secure hash function, and discloses the system public parameter;

[0014] Step S2: the user sends a registered identity to the authority node, the authority node verifies the identity and generates a partial public and private key for the user, and the user generates a complete public and private key by using the partial public and private key, that is, the registration is completed;

[0015] Step S3: assuming that the signer is user t, the signer ID_t signs the message m, selects a set L of public keys of ring members, and signs the transaction using the set of public keys;

[0016] Step S4: the existing transaction initiator Alice and the transaction receiver Bob perform a transfer transaction, the receiver calls homomorphic encryption to encrypt the transaction amount, and then the two parties use ring signature algorithm to sign the transaction.

[0017] Preferably, the step S1 specifically comprises:

[0018] The authority node generates a multiplicative group G of order q using a security parameter k, and selects a generator P; the authority node selects s∈Z * q as a system key, and calculates a system public key P_pub, and then creates five secure hash functions H1:{0,1} * ->Z * q ,H2:{0,1} * ×G->Z * q , H3:{0,1} * ×G×Z * q ->Z * q , H4:G->Z * q , H5:G×Z * q ->Z * q , and finally discloses the system public parameters {G, q, P_pub, P, H1, H2, H3, H4, H5}.

[0019] Preferably, the step S2 specifically comprises generating a partial public key y_i=sH1(ID_i) and a partial private key Y_i=y_i P.

[0020] Step S2.1: the authority node sends (Y_i, y_i) to the user through a secure channel, and the user verifies Y_i=P_pub*H1(ID_i) after receiving the message, and if the verification is passed, it indicates that the partial key generated by the administrator is valid;

[0021] Step S2.2: after receiving the partial public key and the partial private key generated by the authority node, the user selects a random number x_i∈Z * q as a user's partial private key, and calculates X_i=x_i P, so as to obtain a complete public key pk_i=(X_i, Y_i) and a complete private key sk_i=(x_i, y_i) of the user.

[0022] Step S2.3: the user selects a random number u_i∈Z * q , calculates U_i = u_i P, h2 = H2(ID_i, pk_i), and then generates a signature σ = u_i + (x_i + y_i)h2, and sends the message {ID_i, pk_i, Enc(σ, U_i)_p0} to the administrator;

[0023] Step S2.4: after receiving the message, the administrator decrypts it using the private key to obtain the signature message σ, and then verifies whether the equation σP = U_i + (x_i + y_i + p0h1)h2 is equal, and if it is equal, it indicates that the public key of the user is correct, and then the administrator generates the identity information {ID_i, pk_i} for the user.

[0024] Preferably, the step S3 comprises:

[0025] Step S3.1: the signer selects a random number a∈Z * q , calculates w = a + y_i, U = aP, R = wP, t = H4(R, X_s, Y_s, w, a), and the signer retains the secret w and a;

[0026] Step S3.2: the signer selects n-1 random numbers S_i∈Z*q, i≠t, and then calculates h_i = H3(m, S_i, pk_i), where 0≤i≤n-1, but i≠t;

[0027] Step S3.3: the signer selects a random number k∈Z * q , calculates S_t = H4(kP + ∑h_i(X_i+Y_i))-∑S_i, and then calculates h_t = H3(M, St, pkt) and T = k - h_t(x_t + y_t) after obtaining S_t;

[0028] Step S3.4: generate ring signature information σ = (S_0,..., S_n, M, T, t).

[0029] Preferably, the step S4 comprises a transaction protocol formulated by combining a certificateless ring signature and a homomorphic encryption:

[0030] Step S4.1: the receiver B encrypts the determined transaction amount m using homomorphic encryption and then signs it with a ring signature, and then combines it with the address of itself to form information Rsig_B(Encp(m))||sig_B(address_B), and finally encrypts the information with the public key of A and sends it to A, the content is:

[0031] EncA(Rsig_B(Enc_p(m))||sig_B(address_B));

[0032] Step S4.2: After A receives the message, it uses its own private key to decrypt, uses B's public key to verify the address to determine B's address, and then uses ring signature to sign its own identity information, with the form:

[0033] Rsig_A(Rsig_B(Enc_p(m)), Enc_pub(w, a, pk_A)

[0034] At the same time, in order to prove that its account balance can meet the execution of this transaction, A needs to verify the balance account' A after the execution of the transaction to the verification node is greater than or equal to 0, A needs to encrypt its own address, identity information, and account balance information after the transaction using the public key of the verification node, and then broadcast to the verification node, the information content is:

[0035] Enc_v(Rsig_A(Rsig_B(Enc_p(m)), Enc_pub(w, a, pk_A))||

[0036] Sig_B(address_B)||sig_A(address_A)||Enc_p(account'_A)||R||U);

[0037] Step S4.3: After the verification node receives the transaction information, it first verifies the identity information of A, that is, R = U + Y_A, and then verifies the legality of the transaction, specifically using interval range proof to verify; for the account balance, it needs to verify whether the balance after the transfer of the initiator is greater than or equal to 0, and whether the transfer amount is greater than 0, and after the verification is passed, it indicates that the transaction is legal, and the account balances of both parties are updated;

[0038] Step S4.4: Write Rsig_A(Rsig_B(Enc_p(m)), Enc_pub(w, a, pk_A))||Enc_pub(R) into the block, where Enc_pub(w, a, pk_A) is the identity information of the transaction initiator; when a transaction dispute occurs, the authority node uses its own private key to decrypt the identity information in the transaction in the block and calculates R' = wP; then the authority node verifies whether R' = R is true, and after it is true, the authority node calculates t' = H1(R, X_t, Y_t, w, a) through the identity information, and finally judges whether t' = t is true, if it is true, the real identity of the signer is confirmed.

[0039] In a second aspect, a consortium chain privacy protection system is provided, and the system comprises:

[0040] The nodes in the alliance chain are divided into three categories, namely, authoritative nodes, verification nodes and ordinary nodes;

[0041] Module M1: The authoritative node uses the security parameter and the multiplicative group to calculate the system master key, generate homomorphic encryption public and private keys, create a secure hash function, and disclose the system public parameters;

[0042] Module M2: The user sends the registration identity to the authoritative node, and the authoritative node generates a partial public and private key for the user after verifying the identity, and the user generates a complete public and private key using the partial public and private key, that is, completes the registration;

[0043] Module M3: Assuming that the signer is user t, the signer ID_t signs the message m, selects a set L of public keys of members in the ring, and signs the transaction using the public key set;

[0044] Module M4: The existing transaction initiator Alice and the transaction receiver Bob conduct a transfer transaction, the receiver calls homomorphic encryption to encrypt the transaction amount, and then both parties use ring signature algorithm to sign the transaction.

[0045] Preferably, the module M1 specifically comprises:

[0046] The authoritative node generates a multiplicative group G with order q using the security parameter k, and selects a generator P; the authoritative node selects s∈Z * q as the system key, and calculates the system public key P_pub, and then creates five secure hash functions H1:{0,1} * ->Z * q ,H2:{0,1} * ×G->Z * q , H3:{0,1} * ×G×Z * q ->Z * q , H4:G->Z * q , H5:G×Z * q ->Z * q , and finally discloses the system public parameters {G, q, P_pub, P, H1, H2, H3, H4, H5}.

[0047] Preferably, the module M2 generates a partial public and private key y_i=sH1(ID_i) and Y_i=y_i P; specifically comprising:

[0048] Module M2.1: the authority node sends (Y_i, y_i) to the user through a secure channel, and the user verifies Y_i = P_pub * H1(ID_i) after receiving the message, and if the verification is passed, it means that the partial key generated by the administrator is valid;

[0049] Module M2.2: after receiving the partial public and private keys generated by the authority node, the user selects a random number x_i ∈ Z * q as the user's partial private key, and calculates X_i = x_i P, so that the user's complete public key pk_i = (X_i, Y_i) and complete private key sk_i = (x_i, y_i) can be obtained;

[0050] Module M2.3: the user selects a random number u_i ∈ Z * q , calculates U_i = u_i P, h2 = H2(ID_i, pk_i), and then generates a signature σ = u_i + (x_i + y_i)h2, and sends the message {ID_i, pk_i, Enc(σ, U_i)_p0} to the administrator;

[0051] Module M2.4: after receiving the message, the administrator decrypts the signature message σ using the private key, and then verifies whether σP = U_i + (X_i + P0h1)h2 is equal, and if they are equal, it means that the public key of the user is correct, and then the administrator generates the identity information {ID_i, pk_i} for the user;

[0052] The module M3 comprises:

[0053] Module M3.1: the signer selects a random number a ∈ Z * q , calculates w = a + y_i, U = aP, R = wP, t = H4(R, X_s, Y_s, w, a), and the signer retains the secret w and a;

[0054] Module M3.2: the signer selects n-1 random numbers S_i ∈ Z*q, i ≠ t, and then calculates h_i = H3(m, S_i, pk_i), where 0 ≤ i ≤ n-1, but i ≠ t;

[0055] Module M3.3: the signer selects a random number k ∈ Z * q , calculates S_t = H4(kP + ∑h_i(X_i+Y_i))-∑S_i, and then calculates h_t = H3(M, St, pkt) and T = k-h_t(x_t+y_t) after obtaining S_t;

[0056] Module M3.4: generate ring signature information σ = (S_0,..., S_n, M, T, t).

[0057] The module M4 includes a formulated transaction protocol combining with certificateless ring signature and homomorphic encryption:

[0058] Module M4.1: The receiver B encrypts the determined transaction amount m using homomorphic encryption and then signs it with a ring signature, and then forms information Rsig_B(Enc_p(m))||sig_B(address_B) with its own address, and finally encrypts the information with the public key of A and sends it to A, the content is:

[0059] Enc_A(Rsig_B(Enc_p(m))||sig_B(address_B));

[0060] Module M4.2: After A receives the message, it uses its own private key to decrypt, verifies the address of B using the public key of B, and then A signs its own identity information using ring signature, with the form:

[0061] Rsig_A(Rsig_B(Enc_p(m)),Enc_pub(w,a,pk_A)

[0062] At the same time, in order to prove that its account balance can meet the execution of this transaction, A needs to verify the account balance account′_A after executing the transaction to the verification node is greater than or equal to 0, A needs to encrypt its own address, identity information, and account balance information after the transaction using the public key of the verification node, and then broadcast to the verification node, the information content is:

[0063] Enc_v(Rsig_A(Rsig_B(Enc_p(m)),Enc_pub(w,a,pk_A))||

[0064] Sig_B(address_B)||sig_A(address_A)||Enc_p(account′_A)||R||U);

[0065] Module M4.3: After the verification node receives the transaction information, it first verifies the identity information of A, i.e. R=U+Y_A, and then verifies the legality of the transaction, specifically using interval range proof to verify; for the account balance, it needs to verify whether the balance after the transfer of the initiator is greater than or equal to 0, and whether the transfer amount is greater than 0, and if the verification is passed, it indicates that the transaction is legal, and the account balances of both parties are updated;

[0066] Module M4.4: Write Rsig_A(Rsig_B(Enc_p(m)), Enc_pub(w, a, pk_A))||Enc_pub(R) into the block, wherein Enc_pub(w, a, pk_A) is the identity information of the transaction initiator; when a transaction dispute occurs, the authority node decrypts the identity information in the transaction in the block using its own private key and calculates R'=wP; then the authority node verifies whether R'=R is true, and after R'=R is true, the authority node calculates t'=H1(R, X_t, Y_t, w, a) through the identity information, and finally judges whether t'=t is true, and if t'=t is true, the real identity of the signer is confirmed.

[0067] In a third aspect, a computer readable storage medium storing a computer program is provided, wherein the computer program, when executed by a processor, implements the steps of the alliance chain privacy protection method.

[0068] In a fourth aspect, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the alliance chain privacy protection method.

[0069] Compared with the prior art, the present application has the following beneficial effects:

[0070] 1. By adopting the verifiable certificateless ring signature algorithm, the identity privacy problem of users in the block chain is protected, and the real identity of the signer can be tracked when a transaction dispute occurs;

[0071] 2. The Paillier algorithm with additive homomorphism is used to encrypt the transaction amount, so that the transaction amount is not stolen by malicious attackers;

[0072] 3. A transaction protocol is formulated in combination with the characteristics of the verifiable certificateless ring signature, the identity information of the signer in the ring and the transaction information are written into the block together. When tracking is needed, the administrator can know the real identity of the signer through the identity information in the block.

[0073] Other beneficial effects of the present application will be described in the specific embodiments through the introduction of specific technical features and technical solutions, and those skilled in the art should be able to understand the beneficial technical effects brought by the technical features and technical solutions through the introduction of the technical features and technical solutions. BRIEF DESCRIPTION OF DRAWINGS

[0074] Other features, objects and advantages of the present application will become more apparent through reading the detailed description of the non-limiting embodiments with reference to the following drawings:

[0075] Figure 1The whole process of the present application is shown in the schematic diagram.

[0076] Figure 2 The system public parameters are shown in the table.

[0077] Figure 3 The transaction protocol flow chart is shown in the figure. DETAILED DESCRIPTION

[0078] The present application will be described in detail below with specific embodiments. The following embodiments will help those skilled in the art to further understand the present application, but do not limit the present application in any form. It should be pointed out that those skilled in the art can make several changes and improvements without departing from the concept of the present application. These all belong to the protection scope of the present application.

[0079] The embodiment of the present application provides a consortium chain privacy protection method. There are identity privacy and transaction data privacy problems on the block chain. Ring signature is a special digital signature that can make the users in the ring anonymous, so the present application improves a certificateless ring signature scheme to increase the verifiability, and in the case of anonymous transaction between the two parties, the authority node can track the malicious transactor. Secondly, the transaction amount is encrypted using the data available invisible homomorphic encryption to protect the privacy of the transaction amount.

[0080] Referring to Figure 1 and Figure 2 , the method combines the characteristics of certificateless ring signature and consortium chain, and divides the nodes in the consortium chain into three categories, namely authority node, verification node and ordinary node.

[0081] Among them, the authority node: the administrator of the consortium chain, is responsible for the generation of the system master key and the Paillier algorithm key in the consortium chain. When a user wants to join the ring, generate part of the public and private key for the registered user, and add identity authentication for it. When there is a transaction dispute or malicious behavior, the authority node can track the signer of the transaction.

[0082] The verification node: maintains the global account book of the block chain. When the ordinary node makes a transaction, it needs to judge the legality of the transaction. If it is legal, then update the account balance of the two parties, otherwise reject the transaction.

[0083] The ordinary node: the transactor in the consortium chain, neither the authority node nor the verification node makes a transaction, only the ordinary nodes make a transaction. When the ordinary nodes make a transaction, they need to broadcast the transaction to the verification node to verify the legality of the transaction.

[0084] Step S1: the authority node generates a multiplicative group G with order q using the security parameter k, and selects a generator P. The authority node selects s∈Z *q As the system key, and calculate the system public key P_pub. Then create five secure hash functions H1: {0, 1} * -> Z * q , H2: {0, 1} * x G -> Z * q , H3: {0, 1} * x G x Z * q -> Z * q , H4: G -> Z * q , H5: G x Z * q -> Z * q Finally, the system public parameters {G, q, P_pub, P, H1, H2, H3, H4, H5} are disclosed.

[0085] Step S2: The user sends the registration identity to the authority node, and the authority node generates partial public and private keys y_i = sH1(ID_i) and Y_i = y_i P for the user after verifying the identity.

[0086] This step specifically includes:

[0087] Step S2.1: The authority node sends (Y_i, y_i) to the user through a secure channel, and the user verifies Y_i = P_pub * H1(ID_i) after receiving the message. If the verification is passed, it means that the partial key generated by the administrator is valid.

[0088] Step S2.2: After receiving the partial public and private keys generated by the authority node, the user selects a random number x_i ∈ Z * q as the user's partial private key, and calculates X_i = x_i P, which can obtain the complete public key pk_i = (X_i, Y_i) and the complete private key sk_i = (x_i, y_i).

[0089] Step S2.3: The user selects a random number u_i ∈ Z * q , calculates U_i = u_i P, h2 = H2(ID_i, pk_i), and then generates a signature σ = u_i + (x_i + y_i)h2, and sends the message {ID_i, pk_i, Enc(σ, U_i)_p0} to the administrator.

[0090] Step S2.4: After the administrator receives the message, the private key is used to decrypt the signed message σ, and then the σP = U_i + (X_i + P0h1)h2 equation is verified to see if they are equal, if they are equal, it means that the user's public key is correct, then the administrator generates the identity information {ID_i, pk_i} for the user.

[0091] Step S3: Assuming that the signer is user t, the signer ID_t signs the message m, and selects a set L of public keys of ring members. The steps to generate a ring signature are as follows:

[0092] Step S3.1: The signer selects a random number a∈Z * q , calculates w = a + y_i, U = aP, R = wP, t = H4(R, X_s, Y_s, w, a), and the signer retains the secrets w and a;

[0093] Step S3.2: The signer selects n-1 random numbers S_i∈Z*q, i≠t, and then calculates h_i = H3(m, S_i, pk_i), where 0≤i≤n-1, but i≠t;

[0094] Step S3.3: The signer selects a random number k∈Z * q , calculates S_t = H4(kP + ∑h_i(X_i + Y_i)) - ∑S_i, and then calculates h_t = H3(M, St, pkt) and T = k - h_t(x_t + y_t) after obtaining S_t;

[0095] Step S3.4: Generate ring signature information σ = (S_0,..., S_n, M, T, t).

[0096] Referring to Figure 3 , step S4: the existing transaction initiator Alice and the transaction recipient Bob conduct a transfer transaction, combining the transaction protocol developed by the certificateless ring signature and homomorphic encryption:

[0097] Step S4.1: The recipient B encrypts the determined transaction amount m using homomorphic encryption and then signs it with a ring signature, and then combines it with its own address to form information Rsig_B(Enc_p(m))||sig_B(address_B), and finally encrypts this information with the public key of A and sends it to A, the content is:

[0098] EncA(Rsig_B(Enc_p(m))||sig_B(address_B));

[0099] Step S4.2: After A receives the message, A decrypts it using its own private key, verifies the address of B using the public key of B, and then signs its own identity information and the address of B using a ring signature, with the form:

[0100] Rsig_A(Rsig_B(Enc_p(m)), Enc_pub(w, a, pk_A)

[0101] Meanwhile, to prove that its account balance can satisfy the execution of the transaction, A needs to prove to the verification node that the balance account’A after the execution of the transaction is greater than or equal to 0. A needs to encrypt its own address, identity information, and account balance information after the transaction using the public key of the verification node, and then broadcast it to the verification node, with the information content being:

[0102] Enc_v(Rsig_A(Rsig_B(Enc_p(m)), Enc_pub(w, a, pk_A)) ||

[0103] Sig_B(address_B) || sig_A(address_A) || Enc_p(account’_A) || R || U);

[0104] Step S4.3: After the verification node receives the transaction information, it first verifies the identity information of A, i.e., R = U + Y_A, and then verifies the legality of the transaction to prevent the initiator of the transaction from committing fraud. Since the transaction amount and the account balance are encrypted, the verification node cannot directly verify the amount, so it uses interval range proof to verify. For the account balance, it needs to verify whether the balance after the transfer of the initiator is greater than or equal to 0, and the transfer amount needs to be verified to be greater than 0. After the verification is passed, it indicates that the transaction is legal, and the account balances of both parties are updated.

[0105] Step S4.4: Write Rsig_A(Rsig_B(Enc_p(m)), Enc_pub(w, a, pk_A)) || Enc_pub(R) into the block, where Enc_pub(w, a, pk_A) is the identity information of the initiator of the transaction. When a transaction dispute occurs, the authority node decrypts the identity information in the transaction in the block using its own private key, and calculates R’ = wP. Then the authority node verifies whether R’ = R is true, and if it is true, the authority node calculates t’ = H1(R, X_t, Y_t, w, a) through the identity information, and finally judges whether t’ = t is true. If it is true, the real identity of the signer is confirmed.

[0106] The application also provides a consortium chain privacy protection system, which can be realized by performing the process steps of the consortium chain privacy protection method, that is, the consortium chain privacy protection method can be understood by those skilled in the art as the preferred implementation of the consortium chain privacy protection system. The system combines the characteristics of certificateless ring signature and consortium chain, and divides the nodes in the consortium chain into three categories, namely authority node, verification node and ordinary node.

[0107] Among them, the authority node: the consortium chain administrator, is responsible for the generation of the system master key and the Paillier algorithm key in the consortium chain. When a user wants to join the ring, generate part of the public and private key for the registered user, and add identity authentication for it. When a transaction dispute or malicious behavior occurs, the authority node can track the signer of the transaction.

[0108] The verification node: maintains the global ledger of the blockchain. When the ordinary node makes a transaction, it needs to judge the legality of the transaction, if it is legal, then update the account balance of both parties, otherwise reject the transaction.

[0109] The ordinary node: the transactor in the consortium chain, neither the authority node nor the verification node makes a transaction, only the ordinary nodes make a transaction. After the ordinary nodes make a transaction, the transaction needs to be broadcast to the verification node to verify the legality of the transaction.

[0110] Module M1: the authority node generates a multiplicative group G with order q using the security parameter k, and selects a generator P. The authority node selects s∈Z * q as the system key, and calculates the system public key P_pub. Then create five secure hash functions H1:{0,1} * ->Z * q ,H2:{0,1} * ×G->Z * q , H3:{0,1} * ×G×Z * q ->Z * q , H4:G->Z * q , H5:G×Z * q ->Z * q . Finally, the system public parameters {G, q, P_pub, P, H1, H2, H3, H4, H5} are disclosed.

[0111] Module M2: User sends the registration identity to the authority, the authority generates partial public key y_i = sH1(ID_i) and partial private key Y_i = y_i P after verifying the identity.

[0112] This module specifically includes:

[0113] Module M2.1: The authority sends (Y_i, y_i) to the user through a secure channel, the user verifies Y_i = P_pub * H1(ID_i) after receiving the message, and if the verification is passed, it means that the partial key generated by the administrator is valid.

[0114] Module M2.2: After receiving the partial public and private keys generated by the authority, the user selects a random number x_i ∈ Z * q as the user's partial private key, and calculates X_i = x_i P, which can obtain the user's complete public key pk_i = (X_i, Y_i) and complete private key sk_i = (x_i, y_i).

[0115] Module M2.3: The user selects a random number u_i ∈ Z * q , calculates U_i = u_i P, h2 = H2(ID_i, pk_i), and then generates a signature σ = u_i + (x_i + y_i)h2, and sends the message {ID_i, pk_i, Enc(σ, U_i)_p0} to the administrator.

[0116] Module M2.4: After receiving the message, the administrator decrypts it using the private key to obtain the signature message σ, and then verifies whether σP = U_i + (X_i + P0h1)h2 is equal, if it is equal, it means that the user's public key is correct, then the administrator generates the identity information {ID_i, pk_i} for the user.

[0117] Module M3: Assuming that the signer is user t, when the signer ID_t signs the message m, it selects a set L consisting of public keys of ring members. The steps to generate a ring signature are as follows:

[0118] Module M3.1: The signer selects a random number a ∈ Z * q , calculates w = a + y_i, U = aP, R = wP, t = H4(R, X_s, Y_s, w, a), and the signer retains the secret w and a;

[0119] Module M3.2: The signer selects n-1 random numbers S_i ∈ Z*q, i ≠ t, and then calculates h_i = H3(m, S_i, pk_i), where 0 ≤ i ≤ n-1, but i ≠ t;

[0120] Module M3.3: The signer selects a random number k∈Z * q , calculates S_t = H4(kP + ∑h_i(X_i+Y_i))-∑S_i, and then calculates h_t = H3(M, St, pkt), T = k-h_t(x_t+y_t) after obtaining S_t;

[0121] Module M3.4: Generate ring signature information σ = (S_0,..., S_n, M, T, t).

[0122] Referring to Figure 3 , module M4: The existing transaction initiator Alice and the transaction receiver Bob conduct a transfer transaction, combining the transaction protocol formulated by the certificateless ring signature and the homomorphic encryption:

[0123] Module M4.1: The receiver B encrypts the determined transaction amount m using homomorphic encryption and then signs it with a ring signature, and then composes information Rsig_B(Enc_p(m))||sig_B(address_B) with its own address, and finally encrypts the information with the public key of A and sends it to A, the content is:

[0124] EncA(Rsig_B(Enc_p(m))||sig_B(address_B));

[0125] Module M4.2: After A receives the message, it uses its own private key to decrypt, verifies the address of B after using the public key of B to verify the address, and then A uses the ring signature to sign its own identity information, which has the form:

[0126] Rsig_A(Rsig_B(Enc_p(m)), Enc_pub(w, a, pk_A)

[0127] At the same time, in order to prove that its account balance can meet the execution of this transaction, A needs to verify the balance account′A after executing the transaction to the verification node is greater than or equal to 0, A needs to encrypt its own address, identity information, and account balance information after the transaction using the public key of the verification node, and then broadcast to the verification node, the information content is:

[0128] Enc_v(Rsig_A(Rsig_B(Enc_p(m)), Enc_pub(w, a, pk_A))||

[0129] Sig_B(address_B)||sig_A(address_A)||Enc_p(account′_A)||R||U);

[0130] Module M4.3: After the verification node receives the transaction information, the identity information of A is verified first, that is, R=U+Y_A, and then the legality of the transaction is verified to prevent the initiator of the transaction from being malicious. Since the transaction amount and the account balance are encrypted, the verification node cannot directly verify the amount, so interval range proof is used for verification. For the account balance, it is necessary to verify whether the balance after the initiator transfers is greater than or equal to 0, and the transfer amount needs to be verified to be greater than 0, and after the verification is passed, it indicates that the transaction is legal, and the account balances of both parties are updated;

[0131] Module M4.4: Rsig_A(Rsig_B(Enc_p(m)), Enc_pub(w, a, pk_A))||Enc_pub(R) is written into the block, where Enc_pub(w, a, pk_A) is the identity information of the initiator of the transaction; when a transaction dispute occurs, the authority node uses its own private key to decrypt the identity information in the transaction in the block, and calculates R'=wP; then the authority node verifies whether R'=R is true, and after R'=R is true, the authority node calculates t'=H1(R, X_t, Y_t, w, a) through the identity information, and finally judges whether t'=t is true, and if t'=t is true, the real identity of the signer is confirmed.

[0132] The embodiment of the application provides a kind of alliance chain privacy protection method and system, by using verifiable certificateless ring signature algorithm, the user in block chain is anonymous, to protect identity privacy problem, and when transaction dispute occurs, the real identity of the signer can be tracked. Use Paillier algorithm with additive homomorphism to encrypt transaction amount, so as to ensure that transaction amount is not stolen by malicious attacker. A kind of transaction protocol is formulated in combination with the characteristics of verifiable certificateless ring signature, the identity information of the signer in ring and transaction information are written into block simultaneously. When tracking is needed, the real identity of the signer can be known by the administrator through the identity information in block.

[0133] Those skilled in the art know that, in addition to implementing the system provided by the application and each device, module and unit thereof in a pure computer-readable program code manner, the same functions can be achieved by logically programming the method steps to make the system provided by the application and each device, module and unit thereof in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers and embedded microcontrollers. Therefore, the system provided by the application and each device, module and unit thereof can be considered as a hardware component, and the devices, modules and units included therein for achieving various functions can also be considered as structures within the hardware component. The devices, modules and units for achieving various functions can also be considered as both software modules implementing the method and structures within the hardware component.

[0134] The specific embodiments of the present application are described above. It needs to be understood that the present application is not limited to the specific embodiments described above, and various changes or modifications can be made by those skilled in the art within the scope of the claims, which does not affect the essential content of the present application. The embodiments of the present application and the features in the embodiments can be combined with each other at will without conflict.

Claims

1. A consortium chain privacy protection method, characterized in that, The application relates to a method for realizing a ring signature and a transaction protocol based on homomorphic encryption and ring signature. The nodes in the alliance chain are divided into three categories, namely, authoritative nodes, verification nodes and common nodes; Step S1: the authoritative node calculates a system master key by using a security parameter and a multiplicative group, generates homomorphic encryption public and private keys, creates a secure hash function, and discloses system public parameters; Step S2: a user sends a registered identity to the authoritative node, the authoritative node generates partial public and private keys for the user after verifying the identity, and the user generates complete public and private keys by using the partial public and private keys, namely, completes registration; Step S3: assuming that a signer is a user t, the signer ID_t signs a message m, selects public keys of ring members to form a set L, and signs a transaction by using the public key set; Step S4: an existing transaction initiator Alice and a transaction receiver Bob perform a transfer transaction, the receiver calls homomorphic encryption to encrypt a transaction amount, and then the two parties sign the transaction by using a ring signature algorithm; The step S1 specifically comprises the following steps: The authority node generates a multiplication group G of order q using a security parameter k, and selects a generator P; the authority node selects s∈Z * q as a system key, and calculates a system public key P_pub, and then creates five secure hash functions H1:{0,1} * ->Z * q ,H2:{0,1} * ×G->Z * q , H3:{0,1} * ×G×Z * q ->Z * q , H4:G->Z * q , H5:G×Z * q ->Z * q , and finally discloses the system public parameters {G, q, P_pub, P, H1, H2, H3, H4, H5}. The step S2 specifically comprises the following steps: Step S2.1: the authoritative node sends (Y_i, y_i) to the user through a secure channel, the user verifies Yi = P_pub*H1(ID_i) after receiving the message, and if the verification is passed, it is proved that the partial key generated by the administrator is valid; Step S2.2: After receiving the partial public-private key generated by the authority node, the user selects a random number x_i∈Z * q as the user's partial private key, and calculates X_i = x_i P, to obtain the user's complete public key pk_i = (X_i, Y_i) and complete private key sk_i = (x_i, y_i); Step S2.3: the user selects a random number u_i∈Z * q , calculates U_i = u_i P, h2 = H2(ID_i, pk_i), and then generates a signature σ = u_i + (x_i + y_i)h2, and sends the message {ID_i, pk_i, Enc(σ, U_i)_p0} to the administrator; Step S2.4: the administrator receives the message, decrypts the signature message sigma by using the private key, and then verifies whether the equation sigmaP = U_i+ (X_i+ P_pubh1)h2 is equal, if the equation is equal, the public key of the user is correct, and then the administrator generates the identity information {ID_i, pk_i} of the user; The step S3 specifically comprises the following steps: Step S3.1: The signer selects a random number a ∈ Z * q , computes w = a + y_i, U = aP, R = wP, t = H1(R, X_s, Y_s, w, a), the signer keeps the secret w and a; Step S3.2: The signer chooses n-1 random numbers S1∈ Z q, i≠t, then computes h_i = H3(m, S_i, pk_i), where 0 ≤i≤ n 1, but i≠t; Step S3.3: The signer selects a random number k ∈ Z * q , compute S_t = H4(kP +∑h_i(X_i +Y_i)) ∑S_i, after obtaining S_t, compute h_t = H3(M, St, pkt), T = k – h_t(x_t + y_t); Step S3.4: ring signature information sigma=(S_0,…,S_n,M,T,t) is generated.

2. The alliance chain privacy protection method of claim 1, wherein, The step S4 specifically comprises the following steps: Step S4.1: the receiver B encrypts the determined transaction amount m by using homomorphic encryption and then signs the transaction amount by using a ring signature, and then the receiver B forms information Rsig_B(Enc_p(m))||sig_B(address_B) by combining the address of the receiver B, and finally, the receiver B encrypts the information by using the public key of A and sends the information to A, and the content is as follows: EncA(Rsig_B(Enc_p(m))||sig_B(address_B)); Step S4.2: after receiving the information, A decrypts the information by using the private key of A, verifies the address of B by using the public key of B, and then A signs the information and the identity information of A by using the ring signature, and the form is as follows: Rsig_A(Rsig_B(Enc_p(m)),Enc_pub(w,a,pk_A) Meanwhile, to prove that the account balance of A can meet the execution of the transaction, A needs to prove that the balance account' A after the execution of the transaction is greater than or equal to 0 to the verification node, and A needs to encrypt the address, identity information and account balance information after the transaction using the public key of the verification node, and then broadcast to the verification node, the information content is: Enc_v(Rsig_A(Rsig_B(Enc_p(m)), Enc_pub(w, a, pk_A)) || Sig_B (address_B) || sig_A(address_A) || Enc_p(account'_A) || R || U); Step S4.3: After receiving the transaction information, the verification node first verifies the identity information of A, that is, R = U + Y_A, and then verifies the legality of the transaction, specifically using interval range proof to verify; for the account balance, it needs to verify whether the balance after the transfer of the initiator is greater than or equal to 0, and whether the transfer amount is greater than 0, and after the verification, it is indicated that the transaction is legal, and the account balances of the two parties are updated; Step S4.4: write Rsig_A(Rsig_B(Enc_p(m)), Enc_pub(w, a, pk_A)) || Enc_pub(R) into the block, wherein Enc_pub(w, a, pk_A) is the identity information of the transaction initiator; when a transaction dispute occurs, the authority node uses its own private key to decrypt the identity information in the transaction in the block, and calculates R'=wP; then the authority node verifies whether R'=R is true, and after R'=R is true, the authority node calculates t'=H1(R, X_t, Y_t, w, a) through the identity information, and finally judges whether t'=t is true, if t'=t is true, the real identity of the signer is confirmed. Including:

3. A consortium chain privacy protection system, characterized in that, The nodes in the alliance chain are divided into three categories, namely the authority node, the verification node and the ordinary node; Module M1: the authority node uses the security parameters and the multiplicative group to calculate the system master key, generate the public and private keys of homomorphic encryption, create a secure hash function, and disclose the system public parameters; Module M2: the user sends the registered identity to the authority node, the authority node verifies the identity and generates partial public and private keys for the user, and the user generates complete public and private keys using the partial public and private keys, that is, the registration is completed; Module M3: assuming that the signer is user t, the signer ID_t signs the message m, selects the public keys of the ring members to form a set L, and signs the transaction using the public key set; Module M4: the existing transaction initiator Alice and the transaction receiver Bob perform a transfer transaction, the receiver calls homomorphic encryption to encrypt the transaction amount, and then both parties use ring signature algorithm to sign the transaction; The module M1 specifically comprises: The module M2 generates partial public and private keys y_i = sH1(ID_i) and Y_i = y_i P; specifically comprising: The authority node generates a multiplication group G of order q using a security parameter k, and selects a generator P; the authority node selects s∈Z * q As a system key, and calculates the system public key P_pub, and then creates five secure hash functions H1:{0,1} * ->Z * q ,H2:{0,1} * ×G->Z * q , H3:{0,1} * ×G×Z * q ->Z * q , H4:G->Z * q , H5:G×Z * q ->Z * q , and finally publishes the system public parameters {G, q, P_pub, P, H1, H2, H3, H4, H5}; ​ Module M2.1: the authority node sends (Y_i, y_i) to the user through a secure channel, and the user verifies Yi = P_pub*H1(ID_i) after receiving the message, and if the verification is passed, it means that the partial key generated by the administrator is valid; Module M2.2: After receiving the partial public-private key generated by the authority node, the user selects a random number x_i∈Z * q As the user's partial private key, and calculates X_i = x_i P, the user can obtain the complete public key pk_i = (X_i, Y_i) and the complete private key sk_i = (x_i, y_i); Module M2.3: The user selects a random number u_i ∈ Z * q , computes U_i = u_i P, h2 = H2(ID_i, pk_i), and then generates a signature σ = u_i + (x_i + y_i)h2, and sends the message {ID_i, pk_i, Enc(σ, U_i)_p0} to the administrator; Module M2.4: the administrator receives the message, decrypts it using the private key to obtain the signature message σ, and then verifies whether σP = U_i+ (X_i+P_pub h1)h2 is equal, and if they are equal, it means that the public key of the user is correct, and then the administrator generates the identity information {ID_i, pk_i} for the user; The module M3 comprises: Module M3.1 : The signer selects a random number a e Z * q , computes w = a + y_i, U = aP, R = wP, t = H1(R, X_s, Y_s, w, a), the signer keeps the secret w and a; Module M3.2: The signer selects n - 1 random numbers Sj e Z q, i ≠ t, then compute h_i = H3(m, S_i, pk_i), where 0 ≤ i ≤ n 1, but i ≠ t; Module M3.3: The signer selects a random number k e Z * q , computes S_t = H4(kP +∑h_i(X_i +Y_i)) ∑S_i, and after obtaining S_t computes h_t = H3(M, St, pkt), T = k - h_t(x_t + y_t); Module M3.4: generating ring signature information σ=(S_0,…,S_n,M,T,t).

4. The alliance chain privacy protection system according to claim 3, characterized in that, The module M4 comprises a transaction protocol developed by combining the certificateless ring signature and the homomorphic encryption: Module M4.1: the receiver B encrypts the determined transaction amount m using homomorphic encryption and then signs it using ring signature, and then combines the information Rsig_B(Enc_p(m))||sig_B(address_B) with the address of itself, and finally encrypts the information using the public key of A and sends it to A, and the content is: EncA(Rsig_B(Enc_p(m))||sig_B(address_B)); Module M4.2: after A receives the information, it uses its own private key to decrypt, verifies the address of B using the public key of B, and then signs the information and its own identity information using ring signature, which has the form: Rsig_A(Rsig_B(Enc_p(m)),Enc_pub(w,a,pk_A) At the same time, in order to prove that the account balance of A can meet the execution of the transaction, A needs to verify the balance account′A after the execution of the transaction to the verification node, which is greater than or equal to 0, and A needs to encrypt the address, identity information, and account balance information after the transaction using the public key of the verification node, and then broadcast it to the verification node, and the information content is: Enc_v(Rsig_A(Rsig_B(Enc_p(m)),Enc_pub(w,a,pk_A) || Sig_B(address_B)||sig_A(address_A)||Enc_p(account'_A)||R||U)); Module M4.3: the verification node receives the transaction information, first verifies the identity information of A, that is, R = U + Y_A, and then verifies the legality of the transaction, and specifically uses interval range proof to verify; for the account balance, it needs to verify whether the balance after the transfer of the initiator is greater than or equal to 0, and whether the transfer amount is greater than 0, and if the verification is passed, it means that the transaction is legal, and the account balances of both parties are updated. Module M4.4: Write Rsig_A(Rsig_B(Enc_p(m)), Enc_pub(w, a, pk_A)) || Enc_pub(R) into the block, wherein Enc_pub(w, a, pk_A) is the identity information of the transaction initiator; when a transaction dispute occurs, the authority node uses its own private key to decrypt the identity information in the transaction in the block, and calculates R' = wP; then the authority node verifies whether R' = R is true or not, and after the verification is true, the authority node calculates t' = H1(R, X_t, Y_t, w, a) through the identity information, and finally judges whether t' = t is true or not, and if true, the real identity of the signer is confirmed.

5. A computer readable storage medium storing a computer program, characterized in that, The computer program is executed by a processor to implement the steps of the alliance chain privacy protection method in any one of claims 1 to 2.

6. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The computer program is executed by a processor to implement the steps of the alliance chain privacy protection method in any one of claims 1 to 2.

Images