A method for protecting identity privacy in digital scenarios

Abstract

The present invention discloses a method for protecting identity privacy in a digital scene. A key pair is generated through global parameters, a public key of a transaction recipient is obtained, a target hidden address is generated through a public key derivation function, a transaction initiator sends transaction information to the target hidden address, transactions on a blockchain are monitored, the target hidden address is identified, the transaction recipient obtains the target hidden address, ciphertext and a key pair, a private key corresponding to the target hidden address is calculated through a private key derivation function, and the target hidden address and the key pair are obtained. A transaction credential of the target hidden address is generated by executing a signature algorithm, other users in the blockchain obtain the target hidden address and the key pair, and the validity of the transaction process between the transaction initiator and the transaction recipient is verified by executing a verification algorithm.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to a method for protecting identity privacy in a digital scenario. Background Art

[0002] Modern blockchain technology is a distributed ledger that allows transactions between different users. Typically, this ledger exists in the form of a key-value store, where the key represents the user's address and the value represents the balance of that address. To simplify engineering implementation, these addresses are usually publicly and efficiently encoded as group elements on an elliptic curve, which also serve as public keys. To consume from a specific address, the user needs to provide a digital signature and publish the transaction to the blockchain. This mechanism has been adopted by mainstream cryptocurrency platforms, such as Bitcoin.

[0003] However, a major drawback of this design is the lack of privacy protection, as anyone can track the details of the transaction. To address this problem, a general encryption method, the Stealth Address Protocol (SAP), has emerged, which is adopted by Monero, Bytecoin, TokenPay, and Samourai Wallet. A stealth address can be regarded as a derived address of the user's public key. For an address of the form bG, where b is a field element and G is a generator of the group, its stealth address is in the form of (rb)G, where r is randomly selected by the sender and shared with the receiver through a key exchange scheme. In the initial design, the key exchange used the Diffie-Hellman method, which was also used in subsequent improvements. Liu et al. proposed a public key encryption scheme (PKE) that is also effective. The first work on the stealth address protocol came from CryptoNote, which is a key component of the Monero blockchain. Later, Courtois and Mercer analyzed the security of Monero-like SAP, and Yu proposed a Monero-like SAP solution that allows multiple addresses to be used in one wallet. The key exchange scheme in the stealth address protocol and the signature scheme for transactions are two related cryptographic systems in SAP. For security reasons, especially considering the principle of key separation (i.e., the independence of keys, which is crucial in cryptography), the current SAP adopts a dual-key scheme, that is: each participant uses a pair of scanning keys to share and check stealth addresses, and another pair of spending keys to sign and verify transactions. These protocols are only applicable to specially designed cryptocurrency systems, such as Monero. Although SAP has been deployed for 10 years, there is still a lack of a compact stealth address protocol (CSAP), which uses a single key pair for key exchange and signature.

[0004] As people study the privacy protection of transactions, researchers have proposed the concept of jointly secure signature and encryption scheme (CSE), which is a cryptographic system that includes a signature scheme and an encryption scheme with a shared key pair. Joint security means that the signature is unforgeable (EUF) and the encryption is indistinguishable (IND). However, in such applications, key privacy is crucial. So far, the key privacy of CSE has not been proposed and analyzed, which limits the application of CSE in privacy protection scenarios such as SAP. Summary of the invention

[0005] The purpose of the present invention is to provide a method for protecting identity privacy in a digital scene to solve the problems raised in the above background technology.

[0006] In order to solve the above technical problems, the present invention provides the following technical solution: a method for protecting identity privacy in a digital scene:

[0007] Step S100: In a certain blockchain, global parameters are set, and all users of the certain blockchain use a key generation algorithm to generate a key pair through the global parameters;

[0008] Step S200: The transaction initiator among the blockchain users obtains the public key of the transaction recipient, generates a target hidden address through a public key derivation function, and sends the transaction information to the target hidden address;

[0009] Step S300: The transaction recipient among the blockchain users monitors the transactions on the blockchain and identifies the target hidden address;

[0010] Step S400: The transaction recipient uses the certain blockchain to generate transaction information and keys during the transaction process, and generates a transaction credential for the transaction process by executing a signature algorithm;

[0011] Step S500: The transaction recipient obtains the target hidden address, ciphertext and key pair, and generates a transaction credential of the target hidden address by executing a signature algorithm;

[0012] Step S600: Any user in the blockchain obtains the target hidden address, transaction information and the transaction credential, and verifies the validity of the transaction process between the transaction initiator and the transaction recipient by executing a verification algorithm.

[0013] The present invention constructs a jointly secure and key-private CSE, which is based on two components. First, there is a standard identity authentication protocol (CID) with IMP-KOA security and HVZK properties, and a public key encryption scheme PKE1 with IND-CPA security and IK-CPA privacy. These two schemes should share the key generation algorithm KeyGen. First, we apply the Fiat-Shamir (FS) transformation to CID to obtain the signature SIG=FS[CID, H1], where H1 is a random oracle. Then, in the second step, we use the Fujisaki-Okamoto (FO) transformation to transform the PKE1 encryption scheme into a key encapsulation mechanism KEM=FO[PKE1, H2, H3], where H2 and H3 are also random oracles. Finally, we designed a hybrid encryption public key encryption scheme PKE2=(KEM, DEM) that combines KEM and DEM. At this time, the encryption and decryption algorithms (Enc / Dec) in KeyGen and PKE2 and the signature and verification (Sign / Verify) algorithms in SIG together constitute a jointly secure and key-private CSE.

[0014] Furthermore, step S100 includes:

[0015] Step S101: setting a global parameter GP of the blockchain, where the global parameters of all users in the blockchain are the same;

[0016] Step S102: Obtain the key generation algorithm set KEY, where the i-th user in the blockchain corresponds to the i-th key generation algorithm KeyGen in KEY. i ;

[0017] Step S103: The i-th user obtains the global parameter GP and generates a key through the key generation algorithm KeyGen i , get the public key pk of the i-th user i and private key sk i , the public key pk of the i-th user i and private key sk i Composed key pair (pk i ,sk i ).

[0018] Further, step S200 includes:

[0019] Step S201: The transaction recipient generates a key pair (pk B ,sk b ), where pkB represents the public key of the transaction recipient, and skb represents the private key of the transaction recipient;

[0020] Step S202: The transaction initiator obtains the public key pk of the transaction recipient B , randomly select a random number R from the cyclic group G;

[0021] Step S203: R and pk B After splicing, we get (R‖pk B ), where ‖ represents the sum of R and pk B The splicing operation of (R‖pk B ) performs hash operation to obtain h1, H(R‖pk B )=h1,where H(R||pk B ) represents the relationship between (R‖pk B ) performs hash operation;

[0022] Step S204: Through h1 and pk B Perform multiplication to get the target hidden address add B , add B =h1×pk B ;

[0023] Step S205: The transaction initiator sends a B Encrypt with R to obtain the ciphertext information group C.

[0024] Further, step S205 includes:

[0025] Step S2-1: Obtain the plaintext information M submitted by the transaction initiator to the plaintext space DM, obtain the second random oracle H2, calculate the second prediction information r of M, H2(M)=r, where H2(M) means bringing M into the second random oracle for calculation;

[0026] Step S2-2: The transaction initiator performs a transaction on R and pk B Encrypt with r to obtain the first ciphertext c1;

[0027] Step S2-3: Obtain a third random oracle H3, calculate the third prediction information K of M, H3(M)=K, where H3(M) means bringing M into the third random oracle for calculation;

[0028] Step S2-4: The transaction initiator encapsulates the third prophecy information K and the random number R to obtain the second ciphertext c2;

[0029] Step S2-5: The transaction initiator combines the first ciphertext c1 and the second ciphertext c2 to obtain a ciphertext information group C, where C = (c1, c2), (c1, c2) represents the combined information of c1 and c2.

[0030] Furthermore, step S300 includes:

[0031] Step S301: The transaction recipient obtains the ciphertext information group C and uses the transaction recipient's private key sk b , decrypt the ciphertext information group C to obtain R;

[0032] Step S302: The plaintext m and the public key pk of the transaction initiator B After splicing, we get (R‖pk B ), where ‖ represents the sum of R and pk B The splicing operation of (R‖pk B ) performs hash operation to obtain h2, H(R‖pk B )=h2,where H(R‖pk B ) represents the relationship between (R‖pk B ) performs hash operation;

[0033] Step S303: The transaction recipient uses h2 and the public key pk of the transaction initiator to B Perform calculations to obtain the comparison address add' B , add' B =h2×pk B ;

[0034] Step S304: When add' B =add B When the target hidden address is verified successfully, when add' B ≠add B The target stealth address verification failed.

[0035] Furthermore, step S301 includes:

[0036] Step S3-1: The transaction recipient obtains the first ciphertext c1 in the ciphertext information group C, and decrypts it to obtain the plaintext M' using the transaction recipient's private key;

[0037] Step S3-2: When M' exists in the plaintext space DM, the prediction information H3(M') of M' is calculated by the third random oracle H3, where H3(M') = K'. When M' does not exist in the plaintext space DM, the feedback does not meet the judgment condition.

[0038] Step S3-3: The transaction recipient obtains the second ciphertext c2 and K' in the ciphertext information group C, and calculates m through the decryption algorithm.

[0039] Furthermore, step S400 includes:

[0040] Step S401: When the transaction recipient requests to spend the cryptocurrency in the target stealth address, the steps in step S300 are executed to verify the target stealth address;

[0041] Step S402: After the target stealth address is successfully verified, h2 and private key sk are used to b Perform calculation to obtain the target private key b2 corresponding to the target hidden address;

[0042] This solution derives the target hidden address through the public key of the transaction recipient, and derives the key corresponding to the target hidden address through the private key of the transaction recipient. On the basis of ensuring transaction security, it reduces the logarithm of the key group and saves system overhead.

[0043] Furthermore, step S500 includes:

[0044] Step S501: The transaction recipient obtains the target private key b2 and generates the commitment com and state st through the prover's first-stage algorithm;

[0045] Step S502: Acquire the transaction information m generated in the transaction process between the transaction initiator and the transaction recipient in the certain blockchain, and the transaction recipient and the transaction initiator generate a challenge ch by using the first random oracle H1 with the commitment com and the transaction information m, where ch=H1(com, m), where (com, m) represents the concatenation of the commitment com and the transaction information m;

[0046] In the transaction process of blockchain, once a transaction is generated in the blockchain, the blockchain will inform all participants of the transaction information. The transaction recipient signs the transaction information, and any participant in the blockchain verifies the signed transaction information. After the verification is passed, it proves that the transaction in the blockchain is completed.

[0047] Step S503: Obtain the challenge ch and state st of the transaction initiator, and generate a reply rsp through the second-stage algorithm of the prover;

[0048] Step S504: Commitment com, challenge ch and reply rsp form authentication credential σ, where σ = (com, ch, rsp);

[0049] The identity authentication protocol includes the prover's one-phase algorithm, the prover's two-phase algorithm, the verifier's one-phase algorithm, and the verifier's two-phase algorithm;

[0050] The prover and the verifier refer to the identities in the identity authentication protocol. The identity authentication protocol is used to form the signature algorithm. The prover is the signatory of the signature algorithm. In this solution, it is the transaction initiator. The verifier is the verifier of the signature algorithm. It is not necessarily the transaction recipient. It can be any user of the blockchain to verify.

[0051] The prover's one-stage algorithm generates commitment com and state st through private key sk;

[0052] The prover's two-stage algorithm generates a reply rsp from the state st and the challenge ch;

[0053] The verifier's one-stage algorithm generates the challenge ch and state st through the public key pk;

[0054] The verifier's two-phase algorithm judges the public key pk, state st, commitment com, challenge ch and reply rsp;

[0055] The current stealth address protocols are all dual-key protocols. The present invention can implement a compact stealth address protocol by constructing a CSE solution, that is, only using a single key pair to complete the verification of encrypted information.

[0056] Furthermore, step S600 includes:

[0057] Step S601: Set any one of all users in the blockchain as a verifier, and the verifier obtains the target stealth address add of the transaction initiator B , authentication credentials σ and transaction information m;

[0058] The target stealth address is generated by the public key of the transaction recipient. The public key is a key that any user of the blockchain can obtain, so any user in the blockchain can get the target stealth address by executing the relevant algorithm. B ;

[0059] Step S602: Parse σ into commitment com, challenge ch and reply rsp;

[0060] Step S603: Calculate the challenge verification ch2 corresponding to the commitment com and the transaction information m through the first random oracle H1, ch2 = H1 (com, m), and add through the verifier's second-order algorithm B , com, ch and rsp are verified, when V2 (add B , com, ch, rsp) = 1, where V2 represents the verifier's second-order algorithm;

[0061] Step S604: When ch2=ch, and V2(add B , com, ch, rsp)=1, the transaction process is valid, otherwise the transaction process is invalid.

[0062] Compared with the prior art, the beneficial effects achieved by the present invention are: the present invention adopts a compact SAP approach, and the compact SAP can be deployed in most blockchains, such as Bitcoin, BCH, and Polkadot. In addition, since our stealth address protocol only needs to use a single key pair, it can be used to build a concise blockchain system that protects identity privacy, reducing the accompanying key and certificate management overhead.

[0063] The present invention constructs a CSE and provides a general construction framework, which, on the one hand, facilitates the application of the CSE system in various privacy protection fields, and on the other hand, improves the flexibility of CSE design. Designers can select components that meet security requirements to combine into their own CSE system. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0065] Figure 1 It is a flowchart of a method for protecting identity privacy in a digital scenario in the patent of the present invention. DETAILED DESCRIPTION

[0066] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0067] See also Figure 1 , the present invention provides a technical solution:

[0068] Step S100: In a certain blockchain, global parameters are set, and all users of the certain blockchain use a key generation algorithm to generate a key pair through the global parameters;

[0069] Wherein, step S100 includes:

[0070] Step S101: setting a global parameter GP of the blockchain, where the global parameters of all users in the blockchain are the same;

[0071] Step S102: Obtain the key generation algorithm set KEY, where the i-th user in the blockchain corresponds to the i-th key generation algorithm KeyGen in KEY. i ;

[0072] Step S103: The i-th user obtains the global parameter GP and generates a key through the key generation algorithm KeyGen i , get the public key pk of the i-th user i and private key sk i , the public key pk of the i-th user i and private key sk i Composed key pair (pk i ,sk i );

[0073] Step S200: The transaction initiator among the blockchain users obtains the public key of the transaction recipient, generates a target hidden address through a public key derivation function, and sends the transaction information to the target hidden address;

[0074] Wherein, step S200 includes:

[0075] Step S201: The transaction recipient generates a key pair (pk B ,sk b ), where pkB represents the public key of the transaction recipient, and skb represents the private key of the transaction recipient;

[0076] Step S202: The transaction initiator obtains the public key pk of the transaction recipient B , randomly select a random number R from the cyclic group G;

[0077] Step S203: R and pk B After splicing, we get (R‖pk B ), where ‖ represents the sum of R and pk B The splicing operation of (R‖pk B ) performs hash operation to obtain h1, H(R‖pk B )=h1,where H(R||pk B ) represents the relationship between (R‖pk B ) performs hash operation;

[0078] Step S204: Through h1 and pk B Perform multiplication to get the target hidden address add B , add B =h1×pk B ;

[0079] Step S205: The transaction initiator sends a B Encrypt with R to obtain the ciphertext information group C;

[0080] The encryption method, such as PKE.Enc, obtains the ciphertext c by inputting a plaintext m and a public key pk. The corresponding decryption method, PKE.Dec, obtains the plaintext m by inputting a private key sk and c. When the plaintext cannot be decrypted, the algorithm terminator is output and further operation is stopped.

[0081] A public key derivation function DpkDerive, which generates a derived public key dpk corresponding to the public key by inputting a public key into the public key derivation function, wherein the derived public key dpk is used as a hidden address in the present solution, and the public key derivation function DpkDerive includes the steps included in step S200 in the present solution;

[0082] Wherein, step S205 includes:

[0083] Step S2-1: Obtain the plaintext information M submitted by the transaction initiator to the plaintext space DM, obtain the second random oracle H2, calculate the second prediction information r of M, H2(M)=r, where H2(M) means bringing M into the second random oracle for calculation;

[0084] Step S2-2: The transaction initiator performs a transaction on R and pk B Encrypt with r to get the first ciphertext c1

[0085] Step S2-3: Obtain a third random oracle H3, calculate the third prediction information K of M, H3(M)=K, where H3(M) means bringing M into the third random oracle for calculation;

[0086] In this embodiment, random oracles H1, H2, and H3 are implemented using three different hash functions respectively;

[0087] Step S2-4: The transaction initiator encapsulates the third prophecy information K and the random number R to obtain the second ciphertext c2;

[0088] Step S2-5: The transaction initiator combines the first ciphertext c1 and the second ciphertext c2 to obtain a ciphertext information group C, where C = (c1, c2), (c1, c2) represents the combined information of c1 and c2;

[0089] Step S300: The transaction recipient among the blockchain users monitors the transactions on the blockchain and identifies the target hidden address;

[0090] Wherein, step S300 includes:

[0091] Step S301: The transaction recipient obtains the ciphertext information group C and uses the transaction recipient's private key sk b , decrypt the ciphertext information group C to obtain R;

[0092] Wherein, step S301 includes:

[0093] Step S3-1: The transaction recipient obtains the first ciphertext c1 in the ciphertext information group C, and decrypts it to obtain the plaintext M' using the transaction recipient's private key;

[0094] Step S3-2: When M' exists in the plaintext space DM, the prediction information H3(M') of M' is calculated by the third random oracle H3, where H3(M') = K'. When M' does not exist in the plaintext space DM, the feedback does not meet the judgment condition.

[0095] Step S3-3: The transaction recipient obtains the second ciphertext c2 and K' in the ciphertext information group C, and calculates m through the decryption algorithm;

[0096] Step S302: The plaintext m and the public key pk of the transaction initiator B After splicing, we get (R‖pk B ), where ‖ represents the sum of R and pk B The splicing operation of (R‖pk B ) performs hash operation to obtain h2, H(R‖pk B )=h2,where H(R‖pk B ) represents the relationship between (R‖pk B ) performs hash operation;

[0097] Step S303: The transaction recipient uses h2 and the public key pk of the transaction initiator to B Perform calculations to obtain the comparison address add' B , add' B =h2×pk B ;

[0098] Step S304: When add' B =add B When the target hidden address is verified successfully, when add' B ≠add B The target stealth address verification failed;

[0099] The derived public key check function DpkCheck inputs a derived public key and a key pair consisting of a common key pk and a private key sk, and outputs 1 or 0. It outputs 1 when the input derived public key is valid, and outputs 0 when the input derived public key is invalid. The derived public key check function DpkCheck includes the steps included in step S300 in this scheme.

[0100] Step S400: The transaction recipient obtains the target hidden address, ciphertext and key pair, and calculates the private key corresponding to the target hidden address through a private key derivation function;

[0101] Wherein, step S400 includes:

[0102] Step S401: When the transaction recipient requests to spend the cryptocurrency in the target stealth address, the steps in step S300 are executed to verify the target stealth address;

[0103] The private key derivation function DskDerive generates a derived key dsk by inputting a derived public key and a key pair consisting of a common key pk and a private key sk. The derived key dsk is used as a private key of a hidden address in this scheme. The private key derivation function DskDerive includes the steps included in step S400 in this scheme.

[0104] Step S402: After the target stealth address is successfully verified, h2 and private key sk are used to b Perform calculation to obtain the target private key b2 corresponding to the target hidden address;

[0105] Step S500: The transaction recipient uses the certain blockchain to generate transaction information and keys during the transaction process, and generates a transaction credential for the transaction process by executing a signature algorithm;

[0106] Wherein, step S500 includes:

[0107] Step S501: The transaction recipient obtains the target private key b2 and generates the commitment com and state st through the prover's first-stage algorithm;

[0108] The prover's first-stage algorithm CID.P1 function can be implemented through a Schnorr-based solution;

[0109] Step S502: Acquire the transaction information m generated in the transaction process between the transaction initiator and the transaction recipient in the certain blockchain, and the transaction recipient and the transaction initiator generate a challenge ch by using the first random oracle H1 with the commitment com and the transaction information m, where ch=H1(com, m), where (com, m) represents the concatenation of the commitment com and the transaction information m;

[0110] Step S503: Obtain the challenge ch and state st of the transaction initiator, and generate a reply rsp through the second-stage algorithm of the prover;

[0111] Step S504: Commitment com, challenge ch and reply rsp form authentication credential σ, where σ = (com, ch, rsp);

[0112] The prover's first-stage algorithm outputs commitment com and state st by inputting the private key. The prover's second-stage algorithm outputs reply rsp by inputting challenge ch and state st. This challenge is sent from the transaction initiator.

[0113] The identity authentication protocol defines a verifier, who has two steps, the verifier's first-stage algorithm and the verifier's second-stage algorithm. However, because the signature algorithm is non-interactive, the signer cannot interact with the verifier. The verifier in the signature scheme only calls the verifier's second-stage algorithm. The verifier's selection of a ch, which was originally required in the prover's first-stage algorithm, is now replaced by a public oracle H1;

[0114] Step S600: The remaining users of the blockchain user except the transaction initiator and the transaction recipient obtain the target hidden address, the plain code and the transaction credential, and verify the validity of the transaction process between the transaction initiator and the transaction recipient by executing a verification algorithm;

[0115] Wherein, step S600 includes:

[0116] Step S601: Set any one of all users in the blockchain as a verifier, and the verifier obtains the target stealth address add of the transaction initiator B , authentication credentials σ and transaction information m;

[0117] Step S602: Parse σ into commitment com, challenge ch and reply rsp;

[0118] Step S603: Calculate the challenge verification ch2 corresponding to the commitment com and the transaction information m through the first random oracle H1, ch2 = H1 (com, m), and add through the verifier's second-order algorithm B , com, ch and rsp are verified, when V2 (add B , com, ch, rsp) = 1, where V2 represents the verifier's second-order algorithm;

[0119] Input pk to V2 B , promise com, challenge ch and reply rsp, when V2 outputs 1, the authentication credential corresponding to the transaction process is received, when V2 outputs 0, the authentication credential corresponding to the transaction process is not received;

[0120] Step S604: When ch2=ch, and V2(add B , com, ch, rsp) = 1, the transaction process is valid, otherwise the transaction process is invalid;

[0121] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0122] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for protecting identity privacy in a digital scene, characterized in that: The method comprises the following steps: Step S100: In a certain blockchain, global parameters are set, and all users of the certain blockchain use a key generation algorithm to generate a key pair through the global parameters; Step S200: The transaction initiator in the blockchain obtains the public key of the transaction recipient, generates a target hidden address through a public key derivation function, and sends the transaction information to the target hidden address; Step S300: The transaction recipient in the blockchain monitors the transactions on the blockchain and identifies the target hidden address; Step S400: The transaction recipient obtains the target hidden address, ciphertext and key pair, and calculates the private key corresponding to the target hidden address through a private key derivation function; Step S500: The transaction recipient uses the certain blockchain to generate transaction information and keys during the transaction process, and generates a transaction credential for the transaction process by executing a signature algorithm; Step S600: any user in the blockchain obtains the target hidden address, transaction information and the transaction credential, and verifies the validity of the transaction process between the transaction initiator and the transaction recipient by executing a verification algorithm; Wherein, the step S100: in a certain blockchain, global parameters are set, and all users of the certain blockchain use a key generation algorithm to generate a key pair through the global parameters, including: Step S101: setting a global parameter GP of the blockchain, where the global parameters of all users in the blockchain are the same; Step S102: Obtain the key generation algorithm set KEY, where the i-th user in the blockchain corresponds to the i-th key generation algorithm KeyGen in KEY. i ; Step S103: The i-th user obtains the global parameter GP and generates a key through the key generation algorithm KeyGen i , get the public key pk of the i-th user i and private key sk i , the public key pk of the i-th user i and private key sk i Composed of key pairs (pk i ,sk i ); In step S200, the transaction initiator in the blockchain obtains the public key of the transaction recipient, generates a target hidden address through a public key derivation function, and sends the transaction information to the target hidden address, including: Step S201: The transaction recipient generates a key pair (pk B ,sk b ), where pkB represents the public key of the transaction recipient and skb represents the private key of the transaction recipient; Step S202: The transaction initiator obtains the public key pk of the transaction recipient B , randomly select a random number R from the cyclic group G; Step S203: R and pk B After splicing, we get (R‖pk B ), where ‖ represents the sum of R and pk B The splicing operation of (R‖pk B ) to perform hash operation and obtain h1, H (R ‖ pk B ) = h1, where H(R‖pk B ) represents the relationship between (R‖pk B ) performs hash operation; Step S204: Through h1 and pk B Perform multiplication to get the target hidden address add B , add B =h1×pk B ; Step S205: The transaction initiator sends a B Encrypt with R to obtain the ciphertext information group C; Among them, the step S205: the transaction initiator sends a B Encrypt with R to obtain the ciphertext information group C, including: Step S2-1: Obtain the plaintext information M submitted by the transaction initiator to the plaintext space DM, obtain the second random oracle H2, and calculate the second prediction information r of M, H2(M)=r, where H2(M) means bringing M into the second random oracle for calculation; Step S2-2: The transaction initiator performs a transaction on R and pk B Encrypt with r to obtain the first ciphertext c1; Step S2-3: Obtain a third random oracle H3, calculate the third prediction information K of M, H3(M)=K, where H3(M) means bringing M into the third random oracle for calculation; Step S2-4: The transaction initiator encapsulates the third prophecy information K and the random number R to obtain the second ciphertext c2; Step S2-5: The transaction initiator combines the first ciphertext c1 and the second ciphertext c2 to obtain a ciphertext information group C, where C=(c1, c2), and (c1, c2) represents the combined information of c1 and c2; Wherein, the step S300: the transaction recipient in the certain blockchain monitors the transactions on the certain blockchain and identifies the target hidden address, including: Step S301: The transaction recipient obtains the ciphertext information group C and uses the transaction recipient's private key sk b , decrypt the ciphertext information group C to obtain R; Step S302: The plaintext m and the public key pk of the transaction initiator B After splicing, we get (R‖pk B ), where ‖ represents the sum of R and pk B The splicing operation of (R‖pk B ) to perform hash operation and obtain h2, H (R ‖ pk B ) = h2, where H(R‖pk B ) represents the relationship between (R‖pk B ) performs hash operation; Step S303: The transaction recipient uses h2 and the public key pk of the transaction initiator to B Perform calculations to obtain the comparison address add' B , add' B =h2×pk B ; Step S304: When add' B =add B When the target hidden address is verified successfully, when add' B ≠add B The target stealth address verification failed.

2. The method for protecting identity privacy in a digital scene according to claim 1, characterized in that: Step S301 includes: Step S3-1: The transaction recipient obtains the first ciphertext c1 in the ciphertext information group C, and decrypts it to obtain the plaintext M' using the transaction recipient's private key; Step S3-2: When M' exists in the plaintext space DM, the prediction information H3(M') of M' is calculated by the third random oracle H3, where H3(M')=K'. When M' does not exist in the plaintext space DM, the feedback does not meet the judgment condition. Step S3-3: The transaction recipient obtains the second ciphertext c2 and K' in the ciphertext information group C, and calculates m through the decryption algorithm.

3. The method for protecting identity privacy in a digital scene according to claim 1, characterized in that: Step S400 includes: Step S401: When the transaction recipient requests to spend the cryptocurrency in the target stealth address, the steps in step S300 are executed to verify the target stealth address; Step S402: After the target stealth address is successfully verified, h2 and private key sk are used to b Perform multiplication to obtain the target private key b2 corresponding to the target hidden address, b2=h2×sk b .

4. The method for protecting identity privacy in a digital scene according to claim 3, characterized in that: Step S500 includes: Step S501: The transaction recipient obtains the target private key b2 and generates the commitment com and state st through the prover's first-stage algorithm; Step S502: In a certain blockchain, when any user in the blockchain verifies a transaction, the transaction information m is obtained, and the challenge ch is generated by the first random oracle H1 using the commitment com and the transaction information m, ch=H1(com, m), where (com, m) represents the concatenation of the commitment com and the transaction information m; Step S503: Obtain the challenge ch and state st of the transaction initiator, and generate a reply rsp through the second-stage algorithm of the prover; Step S504: Commitment com, challenge ch and reply rsp are combined to form authentication credential σ, where σ = (com, ch, rsp).

5. The method for protecting identity privacy in a digital scene according to claim 4, characterized in that: Step S600 includes: Step S601: Set any one of all users in the blockchain as a verifier, and the verifier obtains the target stealth address add of the transaction initiator B , authentication credentials σ and transaction information m; Step S602: Parse σ into commitment com, challenge ch and reply rsp; Step S603: Calculate the challenge verification ch2 corresponding to the commitment com and the transaction information m through the first random oracle H1, ch2=H1(com,m), and add through the verifier's second-order algorithm B , com, ch and rsp are verified, when V2 (add B ,com,ch,rsp)=1, where V2 represents the verifier’s second-order algorithm; Step S604: When ch2=ch, and V2 (add B , com, ch, rsp) = 1, the transaction process is valid, otherwise the transaction process is invalid.

Images