A data privacy protection method for smart grids that can expand blockchain

Abstract

The present invention discloses a data privacy protection method for a smart grid with an expandable blockchain, comprising the following steps: S1, in an initialization phase, a smart meter is registered through a unique serial number, and multiple sets of key pairs are generated for signature and verification, wherein the public key is used as a pseudonym and is also used to generate a cuckoo filter in the first-layer blockchain; S2, in a data reporting phase, the smart meter dynamically maps the electricity consumption data to pseudonyms through a random algorithm; the present invention protects the privacy of the user's electricity consumption data, and at the same time uses an expandable mapping with a lower computational cost than homomorphic encryption, and can be deployed in edge devices with limited computing power, and achieves scalability by offloading the calculation of a large number of transactions to the off-chain while greatly compressing the transactions and reducing the number of times the first-layer blockchain nodes need to participate in the consensus protocol, thereby ensuring that the system not only improves the blockchain throughput while reducing the storage pressure, but also relies on the decentralization and security of the first-layer blockchain.

Description

Technical Field

[0001] The present invention belongs to the field of privacy protection technology, and specifically relates to a data privacy protection method for a smart grid that can expand blockchain. Background Art

[0002] As the next generation of power network, smart grid integrates advanced information processing and communication technologies to provide efficient and intelligent power and information exchange to maximize energy efficiency and meet modern needs. For example, smart meters in users' homes can sense the power consumption information of household appliances in real time, so it is necessary to protect the privacy of users' power consumption data. The control center can collect and analyze this data and provide dynamic pricing and flexible power dispatch strategies.

[0003] Blockchain is a special distributed database, generally considered to be a technology for recording and storing transactions. All users participating in the network are responsible for distributing and storing data. It has the characteristics of decentralization, security, and tamper-proof. Homomorphic encryption is an encryption technology that allows calculations to be performed in an encrypted state and the results of encrypted data to be obtained without decryption. This makes it possible to perform calculations while maintaining data privacy. Digital signature is an encryption technology used to verify the authenticity and integrity of digital information. It allows the identity of the sender of the information to be verified. The signature is generated using a private key, and only the holder of the private key can generate a valid digital signature. It can be used to verify the integrity of the data, that is, to ensure that it has not been tampered with during transmission. It is usually used in conjunction with a timestamp to ensure the time of the signature and prevent the situation where the signature in the past was used for forgery.

[0004] However, in terms of the current situation of using blockchain to protect the privacy of smart grid users, in terms of blockchain, the existing technology only introduces the decentralization and security of blockchain in smart grids, and does not introduce the scalability of blockchain in the "triangle dilemma", which is also the difficulty of blockchain technology. If a blockchain system cannot handle a large number of transactions or data well over time, and cannot reduce the pressure caused by storing the entire blockchain data, it will face the problem of blockchain scalability. In terms of privacy protection, the existing technology mainly uses homomorphic encryption (paillier) and digital signature (EcDSA) to ensure data privacy. The problem that follows is that the complex operation of homomorphic encryption is difficult to implement for some edge devices with limited computing power. Summary of the invention

[0005] The purpose of the present invention is to provide a data privacy protection method for a smart grid that can expand blockchain to solve the problems raised in the above background technology.

[0006] To achieve the above-mentioned purpose, the present invention provides the following technical solution: a data privacy protection method for a smart grid capable of scalable blockchain, comprising the following steps:

[0007] S1, initialization phase, the smart meter is registered with a unique serial number and generates multiple sets of key pairs for signing and verification, where the public key is used as a pseudonym and also used to generate and process the cuckoo filter in the first layer of blockchain;

[0008] S2, data reporting stage, the smart meter will use a random algorithm to dynamically map the electricity consumption data to pseudonyms, and then send the desensitized data to the first layer through a digital signature algorithm based on the discrete logarithm problem;

[0009] S3, during the transaction unloading phase, the first layer stores the batches of verified transactions into the transaction pool. When the preset value is reached, all transactions are unloaded to the second layer for aggregation and summary processing;

[0010] S4: In the blockchain generation stage, the first layer verifies the corresponding data on the second layer. After the verification, each node generates blocks through the consensus protocol to form a chain.

[0011] During the initialization phase, the smart meter will use the serial number identifier ID SM The first layer is sent to the first layer for registration. The first layer is selected as a consortium chain in the permissioned blockchain. The legitimacy of the smart meter serial number is determined by the whitelist created by the administrator in the configuration file. The smart contract in the first layer generates the public parameters required by the digital signature algorithm based on the discrete logarithm problem: group G, prime order q, generator g, and hash function And distributed to the devices in the corresponding smart community.

[0012] The smart meter running algorithm randomly generates the required number of pseudonyms n, 2≤n≤3, generates n reasonable key pairs based on public parameters, and the private key is set to sk, satisfying The public key is set to pk=sk·g, satisfying pk∈G, where the public key is used as a pseudonym. The smart meter needs to upload n public keys to the first-layer blockchain through cuckoo hashing. The specific form is as follows:

[0013] fp = fingerprint (pk),

[0014] i1=hash(pk),

[0015]

[0016] Insert pk into the bucket to initialize the processing cuckoo filter.

[0017] In the data reporting stage, the smart meter runs an algorithm in a data collection cycle: generates n-1 random numbers m1…m n-1 , m i The value range is the average electricity consumption of community users in previous months The positive and negative intervals satisfy The smart meter collects the data m', which satisfies By equation:

[0018]

[0019] Calculate m n , then m1…m n Randomly bind to n pseudonyms {m i |pk i (i∈1,…,n)}, generate a reasonable signature based on the public parameters, such as:

[0020] R i =r i g,

[0021] e i =H(m i |t i |R i ),

[0022] s i =r i +e i ·sk i ;

[0023] where r i is a random number that satisfies t i is the timestamp, H is the hash function, (R i ,s i ) is the signature, satisfying R i ∈G, then the smart meter will send n matching data {t i ,pk i ,m i ,(R i ,s i )} is sent to the first-layer blockchain. After receiving the data, the first-layer blockchain quickly verifies pk by processing the cuckoo filter i Legality:

[0024] loopup(pk i )=(i1,i2)→{true,false},

[0025] The second step is to verify the timestamp and signature. For a single signature verification process, the hash challenge value is first calculated:

[0026] e i =H(m i |t i |R i ),

[0027] The second step is to calculate the hash challenge value e' i Verify by equation:

[0028]

[0029] The first-layer blockchain can verify signatures in batches to ensure efficiency. The batch verification process is as follows:

[0030]

[0031] Where ψ is the total number of signatures that need to be verified. Batch verification is converted into points through point multiplication to speed up the verification rate. After the first layer of blockchain verification is passed, the data will be packaged into transactions:

[0032] T i ={m i ,pk i ,A i},

[0033] Stored in the transaction pool, where A i For the community area where the device is located, different areas are handled by independent second-layer expansion technology. When the transaction pool capacity reaches the preset maximum value, the smart contract will offload the transaction to the second blockchain for compression and aggregation.

[0034] In the offload transaction phase, the second-layer expansion technology increases the throughput on the main network by moving the calculation and state storage off-chain. Finally, a series of data such as the validity proof of the changed state and the compressed transaction state are uploaded to the first-layer blockchain for verification. In the second layer, the second-layer expansion technology maintains a merkle tree state: including account index, power consumption and Nonce value information;

[0035] Before receiving the transaction, the validator verifies part of the merkle tree in the account and whether the nonce value is correct, such as:

[0036] check(pk i ,Nonce i )→{true,false},

[0037] where pk' i is the account index, and after receiving the transaction the validator will include the transaction in the next batch:

[0038]

[0039] The validator will process batch β j All transactions in T i ,like:

[0040]

[0041] Where: l The first state root of the Merkle tree for the lth transaction execution, (pk' l ,m' l ,Nonce' l ) is the leaf node state of the Merkle tree when the transaction is executed for the lth time, ε' l The state root after the Merkle tree of the lth transaction is executed, representing the index to T i The corresponding account index is located in the leaf node, and its power consumption m is updated i And Nonce value;

[0042] And check(pk' i ,Nonce i )→{true,false}, check is a function that accepts two parameters: pk' i and Nonce i , and returns a Boolean value {true or false};

[0043] and batch(T i ) This represents a function batch, T i An identifier for a data item, task, or entity;

[0044] This means that the set contains all natural numbers i and j;

[0045] and And exec is a function name;

[0046] ε l is an environmental parameter or a state parameter;

[0047] pk' l Represents the public key of the lth execution environment;

[0048] m' l A message or data representing the lth execution environment;

[0049] Nonce' l A random number or non-repeating value representing the lth execution environment;

[0050] Indicates a process of transformation or evolution;

[0051] T i Is an object operated on by a conversion function.

[0052] The Layer 2 extension technology verifier ensures the correctness of the entire batch state update by generating a validity proof zk-snark, which is a concise cryptographic commitment to verify the correctness of the batch transaction. The process is as follows:

[0053] Key generation: Input security parameter λ and algorithm circuit C, and use the key generation algorithm:

[0054] keyGen(λ,C)→(pk τ ,vk τ ),

[0055] Output proof key pk τ and verification key vk τ , vk τ Need to be uploaded to the first-layer on-chain contract;

[0056] Proof function: input proof key pk τ , message x and private input ω, ω is generated by R1CS converted by algorithmic circuit C under the zk-snark framework, through the proof function:

[0057] Prove(pk τ ,x,ω)→π,

[0058] Output non-interactive proof π;

[0059] Verification function:

[0060] Verify(vk τ ,π,x)→{true,false},

[0061] The second-layer expansion technology verifier needs to loop through the execution of β j Take each transaction in and compile the input of the proof circuit to generate a zk-snark proof:

[0062]

[0063] where θ is the batch β j The merkle root of the transaction in To prove that the transaction exists in batch β j The merkle proof of the transaction in , η is the account merkle proof that proves that the account index in the transaction exists in the rollups state tree, and μ is the intermediate state root, that is, the state root updated after executing each transaction;

[0064] The Merkle tree iterates to execute a batch of transactions, and the rollups transformation expression is:

[0065]

[0066] The second-layer blockchain maintains a merkle tree ζ containing valid account indexes. The state root that ζ initially has is called the pre-state root ε. When the verifier receives a batch of transactions β j After that, β j Each transaction T i , update the leaf node of ζ, and at the same time update the intermediate state root μ. After the transaction is executed, it is called the post-state root ε'. The merkle tree ζ' contains the summary of all transactions in the batch;

[0067] The verifier will first state root ε, then state root ε', zk-snark validity proof π', and the compressed transaction T i ' and batch root θ and other data are uploaded to the on-chain contract, such as:

[0068]

[0069] The first-layer blockchain will not receive the update results immediately and will need to wait for verification by the on-chain smart contract.

[0070] In the generated blockchain, the first-layer blockchain is a consortium chain in a permissioned blockchain, the consensus protocol is QBFT, and the verification contract in the on-chain contract of the first-layer blockchain that manages the second-layer extension technology needs to be verified and proved, such as:

[0071] Verify(vk τ ,π',x|ε,ε',θ)→{true,false},

[0072] When the validation result is true, the rollups will transition from the first state to the last state:

[0073]

[0074] If the state root ε" stored in the on-chain contract is equal to the submitted previous state root ε, the on-chain contract will obtain the subsequent state root ε' from the proof and update it;

[0075] Verify(vk τ ,π,x|ε,ε',θ)→{true,false}, Verify is a function name;

[0076] vk τ , is a verification key, where τ is a subscript or parameter;

[0077] x, is the parameter passed to the Verify function, and π, is a valid proof;

[0078] true,false, indicating that the Verify function returns a Boolean value, that is, true or false;

[0079] And trans is a function, method, or operation;

[0080] ε,ζ), are the input or parameters of the transformation;

[0081] Indicates that the conversion is valid when a certain condition is true;

[0082] (ε',ζ'), is the output or result of the transformation.

[0083] The fp=fingerprint(pk) code indicates that a certain amount of bits are taken through a hash function to generate a specific fingerprint;

[0084] And i1 = hash(pk), this line of code means that the public key pk is hashed to generate a hash value i1;

[0085] and Perform an XOR operation on i1, the hash value of the public key, and hash(fp), the hash value of the digital fingerprint, to obtain i2.

[0086] for: is an inequality, indicating that the variable m i The value of Between, including both endpoints; This means that m i is an integer, that is, m i The value of is a positive integer, a negative integer, or zero;

[0087] and m n is the nth element in the sequence to be found, m' is a given initial value or constant, and Indicates from m i The sum of all elements from n to n-1;

[0088] And {m i |pk i (i∈1,…,n)}, {} is usually used to represent a set;

[0089] m i This is the element in the set;

[0090] pk i is with m iThe associated public key, pk i i and m in i The i in the table corresponds to each m i Both are associated with a specific public key pk i associated;

[0091] i∈1,…,n means that the value of i ranges from 1 to n, that is, this is a set containing n elements;

[0092] R i =r i g,

[0093] e i =H(m i |t i |R i ),

[0094] s i =r i +e i ·sk i

[0095] Calculate R i It is done by i Multiplying by g, r i is a random number, and g is a fixed group element;

[0096] e i is the hash function H for m i ,t i and R i The concatenation or connection of the hash is obtained, m i It is a message, i is the timestamp or data, and R i is the value calculated previously;

[0097] s i By adding r i With e i ·sk i Added together, and sk i is with m i The associated private key;

[0098] And loopup(pk i )=(i1,i2)→{true,false},

[0099] loopup(pk i )This is the name and input parameters of the function. loopup is a function.

[0100] And i1, i2 are two elements of the function output;

[0101] →This symbol represents a mapping or functional relationship;

[0102] {true,false} is another output of the function, a set containing two Boolean values;

[0103] And e' i =H(m i |t i |R i ), e' i It is for m i ,t i and R i The hash calculation is performed by concatenating or connecting ;

[0104] and s i Multiply by a fixed group element g, g is a base point, and s i is a scalar, i.e. a number;

[0105] is an equal sign;

[0106] And R i +e' i ·pk i , R i is the value calculated previously, and the second value is e' i ·pk i , where e' i A hash value may be a hash of the message, and pk i , is the public key;

[0107] and g is a fixed group element;

[0108] This is a summation symbol, representing the sum from i=1 to ψ;

[0109] This means that all e' from i = 1 to ψ i ·pk i of and;

[0110] And T i ={m i ,pk i ,A i}, T i It contains three elements: i , pk i and A i ;

[0111] m iIndicates the content of the i-th message or data block, and m represents the message or content;

[0112] pk i This is the i-th public key, pk usually stands for public key;

[0113] A i Represents the community area where the device is located.

[0114] And keyGen(λ,C)→(pk τ ,vk τ );

[0115] keyGen is the function that performs the key generation process;

[0116] pk τ Represents the generated public key;

[0117] vk τ Represents a verification key or another key that is paired with a public key;

[0118] And Prove(pk τ ,x,ω)→π;

[0119] Prove is part of the interactive proof system;

[0120] pk τ This usually represents the public key;

[0121] x is used for a proven statement, message, secret, or data;

[0122] πThe output of a function or process;

[0123] And Verify(vk τ ,π,x)→{true,false}

[0124] The Verify function accepts three parameters: vk τ Verification key, π proof, and x data or statement to be verified;

[0125] and loop is a representation of a loop or iterative function, where θ, η,μ are the parameters passed to the function;

[0126] β j is an object operated by a conversion function;

[0127] → is an arrow symbol, usually used to indicate a conversion or mapping relationship;

[0128] π' is the result after conversion, π' is the proof or evidence after processing or conversion;

[0129] and iterates(ζ,ε) is an iteration or some form of processing of two parameters ζ and ε, where ζ and ε are initial conditions, parameters, and state variables;

[0130] and

[0131] upload is the upload function;

[0132] And ε,ε',π',T i ',θ|vk τ Includes raw data, processed data, proofs, timestamps, and additional parameters;

[0133] → is a conversion or mapping operator;

[0134] Layer 1 is the target or output of the conversion process.

[0135] Compared with the prior art, the present invention has the following beneficial effects: the present invention protects the privacy of the user's electricity consumption data, and uses a scalable mapping with a lower computational cost than homomorphic encryption, which can be deployed in edge devices with limited computing power. The method we proposed also introduces a scalable blockchain for aggregated transactions, which achieves scalability by offloading the calculation of a large number of transactions to the off-chain while greatly compressing transactions and reducing the number of times the first-layer blockchain nodes need to participate in the consensus protocol, thereby ensuring that the system not only improves the blockchain throughput, but also reduces the storage pressure and relies on the decentralization and security of the first-layer blockchain;

[0136] Zk-rollups expand the throughput of the first layer of the base layer through off-chain computing, but most of the expansion comes from compressing transaction data. The capacity of each block in Ethereum limits the number of transactions that can be processed. By compressing transactions through Zk-rollups, the number of transactions that can be processed per block can be significantly increased.

[0137] In zero-knowledge proof, one proof can verify another proof, which can significantly improve the throughput of Zk-rollups. Therefore, a batch of zk-snark proofs can verify another zk-snark. The verifier can recursively submit multiple zk-snark proofs as a final proof to the first-layer blockchain. If the on-chain contract receives this final proof, all related transaction batches will be confirmed.

[0138] Compared with the existing Paillier encryption combined with EcDSA signature, the selected dynamic data desensitization combined with Schnorr signature has shorter keys, more efficient signatures, faster batch verification, point multiplication operations with lower computational complexity than exponential operations, and no encryption and decryption operations with heavy computational costs. At the same time, digital signatures can also choose shorter keys, which are simpler than exponential operations, and signatures are more concise and efficient, and verification is faster. BRIEF DESCRIPTION OF THE DRAWINGS

[0139] Figure 1 It is a schematic diagram of the system model of the present invention;

[0140] Figure 2 Schematic diagram of the merkle tree of the present invention;

[0141] Figure 3 Schematic diagram of data uploading to the chain according to the present invention. DETAILED DESCRIPTION

[0142] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0143] See also Figure 1-3 The present invention provides a technical solution: a data privacy protection method for a smart grid that can expand blockchain, comprising the following steps:

[0144] S1, initialization phase, SM registers and generates multiple sets of key pairs for signing and verification through unique serial numbers, where the public key is used as a pseudonym and also used to generate cuckoo filters in the first layer of blockchain;

[0145] S2, data reporting stage, SM dynamically maps the electricity consumption data to pseudonyms through a random algorithm, and then sends the desensitized data to the first layer after Schnorr signature;

[0146] S3, during the transaction unloading phase, the first layer stores the batches of verified transactions into the transaction pool. When the preset value is reached, all transactions are unloaded to the second layer for aggregation and summary processing;

[0147] S4: In the blockchain generation stage, the first layer verifies the corresponding data on the second layer. After the verification, each node generates blocks through the consensus protocol to form a chain.

[0148] Phase (1): Initialization phase

[0149] SM will uniquely identify the serial number ID SM It is sent to the first layer for registration. The first layer is selected as a consortium chain in the permissioned blockchain, and the legitimacy of the SM serial number is judged by the whitelist created by the administrator in the configuration file.

[0150] The smart contract in the first layer generates the public parameters required for the Schnorr signature (group G, prime order q, generator g, and hash function Etc., and distribute them to the devices in the corresponding smart community. SM runs Algorithm 1: Randomly generate the required number of pseudonyms n, 2≤n≤3, generate reasonable n sets of key pairs based on public parameters, and set the private key to sk, satisfying The public key is set to pk = sk g, satisfying pk ∈ G, where the public key is used as a pseudonym. SM needs to upload n public keys to the first-layer blockchain through cuckoo hashing, the specific form is as follows:

[0151] fp=fingerprint(pk) (1)

[0152] i1=hash(pk) (2)

[0153]

[0154] Insert pk into the bucket to initialize the cuckoo filter. The function of the Cuckoo filter is to quickly verify the legitimacy of the pseudonym and support dynamic deletion of fingerprints in the bucket, so users can call Algorithm 1 to update the pseudonym within the specified time frequency. To improve space utilization and query efficiency, we set the bucket capacity of the filter to 4.

[0155] Phase (2): Data reporting phase

[0156] In one data collection cycle, SM runs Algorithm 2: generates n-1 random numbers m1…m n-1 , m i The value range is the average electricity consumption of community users in previous months The positive and negative range SM collects the data m', satisfying By equation:

[0157]

[0158] Calculate m n Then m1…m n Randomly bind to n pseudonyms {m i |pk i (i∈1,…,n)}. Generate a reasonable signature based on the public parameters, such as:

[0159] R i =r i ·g (5)

[0160] e i =H(m i |t i |R i ) (6)

[0161]

[0162] where r i is a random number that satisfies t i is the timestamp, and H is the hash function. (R i ,s i ) is the signature, satisfying R i ∈G. Then SM sends n matching data {t i ,pk i ,m i ,(R i ,s i )} is sent to the first layer blockchain. After receiving the data, the first layer blockchain will first quickly verify the pk through the cuckoo filter i Legality:

[0163] loopup(pk i )=(i1,i2)→{true,false} (8)

[0164] The next step is to verify the timestamp and signature. The single signature verification process first calculates the hash challenge value:

[0165] e i =H(m i |t i |R i ) (9)

[0166] The second step is to calculate the hash challenge value e' i Verify by equation:

[0167]

[0168] The first layer of blockchain can verify signatures in batches to ensure efficiency. The batch verification process is as follows:

[0169]

[0170] Where ψ is the total number of signatures that need to be verified. Batch verification speeds up the verification rate by converting point multiplication into points.

[0171] After the first layer of blockchain verification is passed, the data will be packaged into transactions:

[0172] T i ={m i ,pk i ,A i} (12)

[0173] Stored in the transaction pool, where A i The community area where the device is located is handled by independent zk-rollups in different areas. When the transaction pool capacity reaches the preset maximum value, the smart contract will unload all transactions to the secondary blockchain for compression and aggregation.

[0174] Phase (3): Unloading transaction phase

[0175] Zk-rollups is a second-layer expansion solution that increases the throughput on the mainnet by moving computation and state storage off-chain. It achieves scalability while playing an aggregation role. Finally, a series of data such as the validity proof of the changed state and the compressed state of all transactions are uploaded to the first-layer blockchain for verification to determine the correctness of the state change. The purpose of uploading to the chain is to rely on the security of the first-layer blockchain. In the second layer, Zk-rollups will maintain a merkle tree state (including account index, power consumption, Nonce value, etc.) Figure 2 , its state is maintained by the on-chain smart contract.

[0176] The validator in Zk-rollups can be a centralized entity, selected through POS (Proof of Stake), and has an incentive-penalty mechanism where if the validator behaves maliciously, their stake may be slashed, which incentivizes them to publish valid blocks.

[0177] Before receiving a transaction, the validator verifies whether the account is part of the merkle tree and whether the nonce value is correct, as follows:

[0178] check(pk i ,Nonce i )→{true,false}(13)

[0179] where pk' i Is the account index.

[0180] After receiving the transaction, the validator will include the transaction in the next batch.

[0181]

[0182] The validator will process batch β j All transactions in Ti , such as:

[0183]

[0184] Where: l The first state root of the Merkle tree for the lth transaction execution, (pk' l ,m' l ,Nonce' l ) is the leaf node state of the Merkle tree when the transaction is executed for the lth time. ε' l The state root after the Merkle tree of the lth transaction is executed, representing the index to T i The corresponding account index is located in the leaf node, and its power consumption m is updated i And the Nonce value.

[0185] Zk-rollups validators ensure the correctness of the entire batch state update by generating a validity proof zk-snark (a concise cryptographic commitment to verify the correctness of the batch transaction), the process is as follows:

[0186] Key generation: Input security parameter λ and algorithm circuit C, and use the key generation algorithm:

[0187] keyGen(λ,C)→(pk τ ,vk τ )(16)

[0188] Output proof key pk τ and verification key vk τ , vk τ Need to be uploaded to the first layer on-chain contract.

[0189] Proof function: input proof key pk τ , message x and private input ω (generated by R1CS converted by algorithmic circuit C under the zk-snark framework), through the proof function

[0190] Prove(pk τ ,x,ω)→π(17)

[0191] Output a non-interactive proof π.

[0192] Verification function:

[0193] Verify(vk τ ,π,x)→{true,false}(18)

[0194] Zk-rollups validators need to loop through the execution of β j Take each transaction in and compile the input of the proof circuit to generate a zk-snark proof:

[0195]

[0196] where θ is the batch β j The merkle root of all transactions in To prove that the transaction exists in batch β j The Merkle proof of the transaction in η is the account merkle proof that proves that the account index in the transaction exists in the rollups state tree, and μ is the intermediate state root (that is, the state root updated after each transaction is executed). The Merkle tree iterates to execute a batch of transactions, and the rollups transformation expression is:

[0197]

[0198] like Figure 3 The second-layer blockchain shown in the figure maintains a merkle tree ζ containing all valid account indexes. The state root that ζ initially has is called the pre-state root ε. When the validator receives a batch of transactions β j After that, β j Each transaction T i , update the leaf node of ζ, and at the same time update the intermediate state root μ. After all transactions are executed, it is called the post-state root ε'. At this time, the merkle tree ζ' contains the summary of all transactions in the batch.

[0199] The verifier will first state root ε, then state root ε', zk-snark validity proof π', and the compressed transaction T i ' and batch root θ and other data are uploaded to the on-chain contract, as follows:

[0200]

[0201] The first-layer blockchain will not receive the update results immediately, and will need to wait for verification by the smart contract on the chain. Figure 3 .

[0202] Phase (4): Generate blockchain

[0203] The first-layer blockchain in the solution model is a consortium chain in the permissioned blockchain, and the consensus protocol is QBFT. The verification contract in the on-chain contract of the first-layer blockchain that manages Zk-rollups needs to verify the proof, as follows:

[0204] Verify(vk τ ,π',x|ε,ε',θ)→{true,false}(22)

[0205] When the validation result is true, the rollups will transition from the first state to the last state:

[0206]

[0207] If the state root ε" stored in the on-chain contract is equal to the submitted previous state root ε, the on-chain contract will obtain the subsequent state root ε' from the proof and update it.

[0208] The nodes in the first-layer blockchain reshape the state of rollups by calling the data in calldata to verify themselves, because the validity proof has ensured the authenticity of the state transition. Zk-rollups stores the transaction batch summary in the on-chain smart contract in the first-layer blockchain, and the changes in the on-chain contract are stored in the blocks of the first-layer blockchain to form a blockchain. The control center can call the smart contract to obtain the total electricity consumption of a community to provide dynamic pricing, encourage electricity consumption behavior, and balance demand response, etc. The whole process protects the user's electricity consumption data, electricity consumption behavior and characteristics.

[0209] The solution we proposed can protect the privacy of users' electricity consumption data, and at the same time use dynamic mapping with lower computational cost than homomorphic encryption, which can be deployed in edge devices with limited computing power. The solution also introduces a scalable blockchain for aggregated transactions, offloading a large amount of computation to off-chain processing. The main chain only stores compressed transactions, which improves blockchain throughput while reducing storage pressure.

[0210] Scalability: Zk-rollups expand the throughput of the first layer of the base layer through off-chain computation, but most of the improvement in expansion comes from compressing transaction data, as shown in Table 1. The capacity of each block in Ethereum limits the number of transactions that can be processed. By compressing transactions through Zk-rollups, the number of transactions that can be processed per block can be significantly increased.

[0211]

[0212] Table 1

[0213] Recursive proof: One proof in zero-knowledge proof can verify another proof, which can significantly improve the throughput of Zk-rollups, so a batch of zk-snark proofs can verify another zk-snark. The verifier can recursively submit multiple zk-snark proofs to the first-layer blockchain as a final proof. If the on-chain contract receives this final proof, all related transaction batches will be confirmed.

[0214] Computational cost: Compared with the existing Ppaillier encryption combined with EcDSA signature, the dynamic data desensitization we chose with Schnorr signature has shorter keys, more efficient signatures, faster batch verification, point multiplication operations with lower computational complexity than exponential operations, and encryption and decryption operations that do not require heavy computational costs.

[0215] Specifically, when used, Zk-rollups expand the throughput of the first layer of the base layer through off-chain calculations, but most of the expansion comes from compressing transaction data. The capacity of each block in Ethereum limits the number of transactions that can be processed. By compressing transactions through Zk-rollups, the number of transactions that can be processed per block can be significantly increased;

[0216] In zero-knowledge proof, one proof can verify another proof, which can significantly improve the throughput of Zk-rollups. Therefore, a batch of zk-snark proofs can verify another zk-snark. The verifier can recursively submit multiple zk-snark proofs as a final proof to the first-layer blockchain. If the on-chain contract receives this final proof, all related transaction batches will be confirmed.

[0217] Compared with the existing Paillier encryption combined with EcDSA signature, the selected dynamic data desensitization combined with Schnorr signature has shorter keys, more efficient signatures, faster batch verification, point multiplication operations with lower computational complexity than exponential operations, and no encryption and decryption operations with heavy computational costs. At the same time, digital signatures can also choose shorter keys, which are simpler than exponential operations, and signatures are more concise and efficient, and verification is faster.

[0218] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A data privacy protection method for a smart grid that can expand blockchain, characterized in that: The following steps are involved: S1, initialization phase, the smart meter is registered with a unique serial number and generates multiple sets of key pairs for signing and verification, where the public key is used as a pseudonym and also used to generate and process the cuckoo filter in the first layer of blockchain; S2, data reporting stage, the smart meter will use a random algorithm to dynamically map the electricity consumption data to pseudonyms, and then send the desensitized data to the first layer through a digital signature algorithm based on the discrete logarithm problem; S3, during the transaction unloading phase, the first layer stores the batches of verified transactions into the transaction pool. When the preset value is reached, all transactions are unloaded to the second layer for aggregation and summary processing; S4, the blockchain generation stage, the first layer verifies the corresponding data on the second layer chain. After the verification is passed, each node generates blocks through the consensus protocol to form a chain; In the data reporting stage, the smart meter runs an algorithm in a data collection cycle: generates n-1 random numbers m1…m n-1 , m i The value range is the average electricity consumption of community users in previous months The positive and negative intervals satisfy The smart meter collects the data m′ to meet By equation: Calculate m n , then m1…m n Randomly bind to n pseudonyms {m i |pk i |i∈1,…,n}, generate a reasonable signature based on the public parameters: R i =r i ·g, e i =H(m i |t i |R i ), with i =r i +e i ·en i ; where r i is a random number that satisfies t i is the timestamp, H is the hash function, (R i ,s i ) is the signature, satisfying R i ∈G, then the smart meter will send n matching data {t i ,pk i ,m i ,(R i ,s i )} is sent to the first-layer blockchain. After receiving the data, the first-layer blockchain quickly verifies pk by processing the cuckoo filter i Legality: loopup(pk i )=(i1,i2)→{true,false}, The second step is to verify the timestamp and signature. For a single signature verification process, the hash challenge value is first calculated: e′ i =H(m i |t i |R i ), The second step is to calculate the hash challenge value e′ i Verify by equation: The first-layer blockchain batch verifies signatures to ensure efficiency. The batch verification process is as follows: Where ψ is the total number of signatures that need to be verified. Batch verification is converted into points through point multiplication to speed up the verification rate. After the first layer of blockchain verification is passed, the data will be packaged into transactions: T i ={m i ,pk i ,A i }, Stored in the transaction pool, where A i For the community area where the device is located, different areas are handled by independent second-layer expansion technology. When the transaction pool capacity reaches the preset maximum value, the smart contract will unload the transaction to the second blockchain for compression and aggregation; In the offload transaction phase, the second-layer expansion technology increases the throughput on the main network by moving the calculation and state storage off-chain. Finally, a series of data such as the validity proof of the changed state and the compressed transaction state are uploaded to the first-layer blockchain for verification. In the second layer, the second-layer expansion technology maintains a merkle tree state: including account index, power consumption and Nonce value information; Before receiving the transaction, the validator verifies part of the merkle tree in the account and whether the nonce value is correct: check(pk′ i ,Nonce i )→{true,false}, where pk′ i is the account index, and after receiving the transaction the validator will include the transaction in the next batch: The validator will process batch β j All transactions in T i : Where: l is the first state root of the Merkle tree for the lth transaction execution, (pk′ l ,m′ l ,Nonce′ l ) is the leaf node state of the Merkle tree when the transaction is executed for the lth time, ε′ l The state root after the Merkle tree of the lth transaction is executed, representing the index to T i The corresponding account index is located in the leaf node, and its power consumption m is updated i And Nonce value; And check(pk′ i ,Nonce i )→{true,false}, check is a function that accepts two parameters: pk′ i and Nonce i , and returns a Boolean value {true or false}; and batch(T i ) This represents a function batch, T i An identifier for a data item, task, or entity; This means that the set contains all natural numbers i and j; and exec is a function name; ε l is an environmental parameter or a state parameter; pk′ l Represents the public key of the lth execution environment; m′ l A message or data representing the lth execution environment; Nonce′ l A random number or non-repeating value representing the lth execution environment; It indicates a process of transformation or evolution; T i Is an object operated on by a conversion function.

2. According to the data privacy protection method of a smart grid capable of scalable blockchain according to claim 1, it is characterized by: During the initialization phase, the smart meter will use the serial number identifier ID SM Sent to the first layer for registration. The first layer is selected as a consortium chain in the permissioned blockchain. The legitimacy of the smart meter serial number is determined by the whitelist created by the administrator in the configuration file. The smart contract in the first layer generates the public parameters required by the digital signature algorithm based on the discrete logarithm problem: group G, prime order q, generator g, and hash function H: And distribute it to the devices in the corresponding smart community.

3. According to claim 2, a data privacy protection method for a smart grid capable of scalable blockchain is characterized in that: The smart meter running algorithm randomly generates the required number of pseudonyms n, 2≤n≤3, generates n reasonable key pairs based on public parameters, and the private key is set to sk, satisfying The public key is set to pk=sk·g, satisfying pk∈G, where the public key is used as a pseudonym. The smart meter needs to upload n public keys to the first-layer blockchain through cuckoo hashing. The specific form is as follows: fp = fingerprint (pk), i1=hash(pk), Insert pk into the bucket to initialize the processing cuckoo filter.

4. The data privacy protection method for a smart grid capable of scalable blockchain according to claim 1 is characterized in that: In the generated blockchain, the first-layer blockchain is a consortium chain in a permissioned blockchain, the consensus protocol is QBFT, and the verification contract in the on-chain contract of the first-layer blockchain that manages the second-layer extension technology needs to verify the proof: Verify(vk τ ,π′,x|ε,ε′,θ)→{true,false}, When the validation result is true, the rollups will transition from the first state to the last state: If the state root ε" stored in the on-chain contract is equal to the submitted previous state root ε, the on-chain contract will obtain the subsequent state root ε' from the proof and update it; Verify(vk τ ,π,x|ε,ε′,θ)→{true,false}, Verify is a function name; vk τ , is a verification key, where τ is a subscript or parameter; x, is the parameter passed to the Verify function, and π, is a valid proof; true,false, indicating that the Verify function returns a Boolean value, that is, true or false; And trans is a function, method, or operation; ε,ζ,are the inputs or parameters of the transformation; Indicates that the conversion is valid when a certain condition is true; ε′,ζ′, are the output or results of the transformation.

5. The data privacy protection method for a smart grid capable of scalable blockchain according to claim 3 is characterized in that: The fp=fingerprint(pk) code indicates that a specific fingerprint is generated by taking bits through a hash function; And i1 = hash(pk), this line of code means that the public key pk is hashed to generate a hash value i1; and Perform an XOR operation on i1, the hash value of the public key, and hash(fp), the hash value of the digital fingerprint, to obtain i2.

6. The data privacy protection method for a smart grid capable of scalable blockchain according to claim 1, characterized in that: for: is an inequality, indicating that the variable m i The value of Between, including both endpoints; This means that m i is an integer, that is, m i The value of is a positive integer, a negative integer, or zero; and m n is the nth element in the sequence to be found, m′ is a given initial value or constant, and Indicates from m i The sum of all elements from n to n-1; And {m i |pk i , i∈1,…,n}, {} is used to represent a set; m i This is the element in the set; pk i is with m i The associated public key, pk i i and m in i The i in the table corresponds to each m i Both are related to a public key pk i associated; i∈1,…,n means that the value of i ranges from 1 to n, that is, this is a set containing n elements; R i =r i ·g, e i =H(m i |t i |R i ), with i =r i +e i ·en i Calculate R i It is done by i Multiplying by g, r i is a random number, and g is a fixed group element; e i is the hash function H for m i ,t i and R i The concatenation or connection of the hash is obtained, m i It is news, i is the timestamp or data, and R i is the value calculated previously; s i By adding r i With e i ·sk i Added together, and sk i is with m i The associated private key; And loopup(pk i )=(i1,i2)→{true,false}, loopup(pk i )This is the name and input parameters of the function. loopup is a function. And i1, i2 are two elements of the function output; →This symbol represents a mapping or functional relationship; {true,false} is another output of the function, a set containing two Boolean values; And e′ i =H(m i |t i |R i ), e′ i It is for m i ,t i and R i The hash calculation is performed by concatenating or connecting ; and s i Multiply by a fixed group element g, g is a base point, and s i is a scalar, i.e. a number; is an equal sign; And R i +e′ i ·pk i， R i is the value calculated previously, and the second value is e′ i ·pk i， where e′ i is a hash value of the message, and pk i， is the public key; and g is a fixed group element; This is a summation symbol, representing the sum from i=1 to ψ; This means that for all e′ from i=1 to ψ i ·pk i of and; And T i ={m i ,pk i ,A i }, T i It contains three elements: i , pk i and A i ; m i Indicates the content of the i-th message or data block, and m represents the message or content; pk i This is the i-th public key, pk stands for public key; A i Represents the community area where the device is located.

7. The data privacy protection method for a smart grid capable of scalable blockchain according to claim 1 is characterized in that: And keyGen(λ,C)→(pk τ ,vk τ ); keyGen is the function that performs the key generation process; pk τ Represents the generated public key; vk τ Represents a verification key or another key that is paired with a public key; And Prove(pk τ ,x,ω)→π; Prove is part of the interactive proof system; pk τ Represents a public key; x is used for a proven statement, message, secret, or data; πThe output of a function or process; And Verify(vk τ ,π,x)→{true,false} The Verify function accepts three parameters: vk τ Verification key, π proof, and x data or statement to be verified; and loop is a representation of a loop or iterative function, where θ, η,μ are the parameters passed to the function; β j is an object operated by a conversion function; → is an arrow symbol used to indicate a conversion or mapping relationship; π' is the result after conversion, and π' is the proof or evidence after processing or conversion; and iterates(ζ,ε) is an iteration or some form of processing of two parameters ζ and ε, where ζ and ε are initial conditions, parameters, and state variables; and upload is the upload function; And ε,ε′,π′,T i ′,θ|vk τ Includes raw data, processed data, proofs, timestamps, and additional parameters; → is a conversion or mapping operator; Layer 1 is the target or output of the conversion process.

8. The data privacy protection method for a smart grid capable of scalable blockchain according to claim 1, characterized in that: The Layer 2 extension technology verifier ensures the correctness of the entire batch state update by generating a validity proof zk-snark, which is a concise cryptographic commitment to verify the correctness of the batch transaction. The process is as follows: Key generation: Input security parameter λ and algorithm circuit C, and use the key generation algorithm: keyGen(λ,C)→(pk τ ,week τ ), Output proof key pk τ and verification key vk τ , vk τ Need to be uploaded to the first-layer on-chain contract; Proof function: input proof key pk τ , message x and private input ω, ω is generated by R1CS converted by algorithmic circuit C under the zk-snark framework, through the proof function: Prove(pk τ ,x,ω)→π, Output non-interactive proof π; Verification function: Verify(vk τ ,π,x)→{true,false}, The second-layer expansion technology verifier needs to loop through the execution of β j Take each transaction in and compile the input of the proof circuit to generate a zk-snark proof: where θ is the batch β j The merkle root of the transaction in To prove that the transaction exists in batch β j The merkle proof of the transaction in , η is the account merkle proof that proves that the account index in the transaction exists in the rollups state tree, and μ is the intermediate state root, that is, the state root updated after executing each transaction; The Merkle tree iterates to execute a batch of transactions, and the rollups transformation expression is: The second-layer blockchain maintains a merkle tree ζ containing valid account indexes. The state root that ζ initially has is called the pre-state root ε. When the verifier receives a batch of transactions β j After that, β j Each transaction T i , update the leaf node of ζ, and at the same time update the intermediate state root μ. After the transaction is executed, it is called the post-state root ε'. The merkle tree ζ' contains the summary of all transactions in the batch; The verifier will first state root ε, then state root ε', zk-snark validity proof π', and the compressed transaction T i ′ and batch root θ and other data are uploaded to the on-chain contract: The first-layer blockchain will not receive the update results immediately and will need to wait for verification by the on-chain smart contract.

Images