Efficient and supervisible anonymous block chain transaction method and system

Abstract

The invention discloses an efficient and supervisible anonymous block chain transaction method and system. The method comprises the following steps: generating public parameters and initializing a user; generating an anonymous transaction and a zero-knowledge proof, calculating a commitment, and packaging the anonymous transaction, the zero-knowledge proof and the commitment into a private transaction; the miner verifies the privacy transaction; constructing an anonymous transaction set, aggregating commitments by using a commitment algorithm based on Walsh codes, and packaging the anonymous transaction set and the aggregated commitments into blocks; and after the supervision period is ended, the user generates a range proof and calls a second smart contract for verification, a supervisor calls the first smart contract to calculate the aggregation commitment in the period and extracts the commitment of the total transaction amount of each user from the aggregation commitment in the period by using a commitment algorithm based on a Walsh code, and the supervisor checks a second call record to judge an abnormal transaction. According to the method, the supervisible attribute can be added to the transaction system on the premise that the original anonymity of the user is not changed, and the calculation and communication pressure of a supervisor is greatly reduced.

Description

Technical Field

[0001] The present invention belongs to the technical field of blockchain, and in particular relates to an efficient and controllable anonymous blockchain transaction method and system. Background Art

[0002] Blockchain is a distributed database technology used to record and store information about digital transactions. Taking Ethereum as an example, users use pseudonymous addresses to trade with other users. Although the pseudonym mechanism provides a certain degree of privacy protection, the transaction pool and block information of this type of blockchain are open in plain text, which means that attackers can establish the correlation between user addresses by analyzing the transaction information on the chain. Furthermore, if the attacker can obtain relevant information off the chain, he can even obtain the user's real identity, which brings huge risks to user privacy protection.

[0003] In order to better protect the privacy of traders, researchers have developed anonymous transaction blockchains, such as Monero and ZCash, which use cryptographic methods to protect the privacy of transaction senders and receivers, making transactions difficult to track on the blockchain, thereby greatly enhancing the user's privacy protection capabilities. However, the decentralized nature of anonymous transaction blockchains means that transactions are not easily traced, making financial activities difficult to monitor or review. This anonymity can also breed illegal activities.

[0004] In real life, regulators such as audit departments or banks can keep track of each user's spending records and directly monitor users with abnormal amounts. However, in a decentralized anonymous trading system, the size of the transaction amount cannot be distinguished, and the identities of the two parties cannot be associated, making it difficult for regulators to effectively combat illegal activities.

[0005] In order to deal with this problem, it is necessary to design an anonymous blockchain transaction system that can protect user privacy and be effectively supervised. One feasible method is to limit the transfer ability of users in the anonymous transaction blockchain. This requires the introduction of a regulatory agency to regularly confirm whether the total amount of user consumption is less than the preset upper limit. In this way, even if the transaction is anonymous, the user's transfer ability is still subject to certain restrictions, thereby reducing the risk of illegal activities. The current solution requires users to attach a pseudonym tag when trading, and the regulator uses its own extraction key to restore the user's true identity. This solution requires the regulator to be online in real time and synchronize blockchain information to process each transaction, which poses a great challenge to the regulator's computing power and communication capabilities.

[0006] Therefore, designing an efficient and controllable anonymous blockchain transaction method and system is of great significance for preventing illegal financial activities and expanding regulatory capabilities. Summary of the invention

[0007] In view of the above, the purpose of the present invention is to provide an efficient and controllable anonymous blockchain transaction method and system, which realizes the addition of a regulator to restrict the flow of amounts within a fixed period while ensuring the security of the original anonymous blockchain transaction system remains unchanged, thereby enhancing the regulatory ability to prevent illegal transactions.

[0008] In order to achieve the above-mentioned invention object, the technical solution provided by the present invention is as follows:

[0009] An efficient and controllable anonymous blockchain transaction method provided by an embodiment of the present invention comprises the following steps:

[0010] Generate public parameters and perform user initialization using the commitment algorithm based on Walsh codes;

[0011] Generate anonymous transactions and zero-knowledge proofs based on the native anonymous transaction blockchain, use the commitment algorithm based on Walsh codes and public parameters to calculate commitments, and package anonymous transactions, zero-knowledge proofs and commitments into private transactions;

[0012] Miners verify the anonymous transactions and zero-knowledge proofs in private transactions. After verification, they add the private transactions to the set of private transactions to be packaged.

[0013] Construct an anonymous transaction set for all anonymous transactions in the packaged privacy transaction set, aggregate all commitments in the packaged privacy transaction set using the commitment algorithm based on Walsh code to obtain an aggregate commitment, and package the anonymous transaction set and the aggregate commitment into a block;

[0014] After the supervision cycle ends, the user generates a range proof and calls the second smart contract for verification. The regulator calls the first smart contract for all blocks generated during the cycle to calculate the aggregate commitment within the cycle and uses the Walsh code-based commitment algorithm to extract and calculate the commitment of each user's total transaction amount from the aggregate commitment within the cycle. The regulator checks the second smart contract call records to determine abnormal transactions.

[0015] Preferably, the public parameters are generated using a commitment algorithm based on Walsh codes, including:

[0016] Using the algorithm initialization calculation step in the commitment algorithm based on Walsh codes, generate the n-order Hadmard matrix H, n = 2 d , d is an integer, generating Walsh code i =H i,: , i,: represents all elements in the i-th row of the matrix, generating elliptic curve parameters p is the modulus, is the elliptic curve group, from Randomly select two generators from and generate random numbers from the finite integer field modulo p denotes random selection, calculate Set the vector and obtain Set the supervision period Finally, output the public parameters Send the extraction key s to the supervisor using a private channel

[0017] Preferably, when performing user initialization, it includes:

[0018] The user generates a public-private key pair: randomly generate a private key Generate the public key pk = Hash(sk) and publish pk, where Hash(·) is a hash function;

[0019] Initialize the user set: for each user Allocate Walsh chips code i , and the supervisor sets the consumption limit according to the actual capabilities of the users Generate a Merkle tree mt = (mr, {Hash(pk i , code i ) | 0 ≤ i < n}), where mr is the root of the Merkle tree, and Hash(pk i , code i ) are the leaf nodes of the Merkle tree.

[0020] Preferably, calculating the commitment using the commitment algorithm based on Walsh codes and the public parameters includes:

[0021] Using the commitment calculation step in the commitment algorithm based on Walsh codes, select a random number Calculate where wcom is the commitment and v is the transaction amount.

[0022] Preferably, zero-knowledge proof is used to prove that the commitment satisfies the following conditions:

[0023] The commitment is calculated correctly;

[0024] The Walsh chips used are consistent with the user's identity and the user has the private key corresponding to the public key;

[0025] The amount of the commitment is the same as the amount sent in the anonymous transaction.

[0026] ​Preferably, constructing an anonymous transaction set for all anonymous transactions in the privacy transaction set to be packaged, aggregating all commitments in the privacy transaction set to be packaged using a commitment algorithm based on Walsh codes to obtain an aggregated commitment, and packaging the anonymous transaction set and the aggregated commitment into a block, including:

[0027] Denote the privacy transaction set to be packaged as {wtx j | 0 ≤ j < m}, where wtx j is the j-th privacy transaction among a total of m transactions. Denote the transaction wtx j = (atx j , wcom j , ∏ j ), where atx j , wcom j and ∏ j are the j-th anonymous transaction, commitment, and zero-knowledge proof respectively. The anonymous transaction set is represented as {atx j | 0 ≤ j < m};

[0028] Using the aggregation calculation step in the commitment algorithm based on Walsh codes, calculate the aggregated commitment as the product operation on wcom j ;

[0029] Pack the anonymous transaction set {atx j | 0 ≤ j < m} and the aggregated commitment accu into the block to generate the block block = (hedear, {atx j | 0 ≤ j < m}, accu), where hedear represents the block header.

[0030] Preferably, the user generates a range proof and invokes a second smart contract for verification, including:

[0031] Calculate the total amount of anonymous transactions sent by the user within the supervision period as the total sum of random numbers generated when generating commitments ;

[0032] Calculate the Pedersen commitment Generate a range proof π R for proving that the amount committed in pcom i is the consumption limit amount set by the supervisor according to the user's actual ability; ;

[0033] Combine the user's identity , the user-provided personal consumption limit max i , the Pedersen commitment pcom i and the range proof to form And use the second smart contract for verification.

[0034] Preferably, the regulator calls the first smart contract for all blocks generated in the cycle to calculate the aggregate commitment in the cycle and uses the commitment algorithm based on Walsh code to extract and calculate the commitment of the total transaction amount of each user from the aggregate commitment in the cycle, including:

[0035] The regulator enters the regulatory cycle by calling the first smart contract The set of all blocks generated in B = {block start ,...,block end}, record the tth block t The aggregate commitment accu field in is accu t , calculate the aggregate commitment within the output cycle

[0036] Using the extracted commitment calculation step in the commitment algorithm based on Walsh codes, the vector is constructed using the extracted key s Commit from aggregate within cycle Extract from the calculation k is the sequence number of the traversal extraction, For users The Pedersen commitment to the total amount of transactions made in the anonymous transaction set of all blocks in the period, that is, the commitment to the total amount of transactions per user.

[0037] Preferably, the regulator checks the second smart contract call record to determine abnormal transactions, including:

[0038] Regulators check users The second smart contract call record, if the call record does not exist or the second smart contract call record input has or The user will be marked and regulators will further investigate abnormal transactions in the real world.

[0039] To achieve the above-mentioned invention object, the embodiment of the present invention also provides an efficient and controllable anonymous blockchain transaction system, including: an initialization setting module, a user transaction generation module, a miner transaction verification module, a miner block packaging module and a regulator transaction supervision module;

[0040] The initialization setting module is used to generate public parameters and perform user initialization using a commitment algorithm based on Walsh codes;

[0041] The user transaction generation module is used to generate anonymous transactions and zero-knowledge proofs based on the native anonymous transaction blockchain, calculate commitments using a commitment algorithm based on Walsh codes and public parameters, and package anonymous transactions, zero-knowledge proofs and commitments into private transactions;

[0042] The miner transaction verification module is used by miners to verify anonymous transactions and zero-knowledge proofs in private transactions. After verification, the private transaction is added to the set of private transactions to be packaged;

[0043] The miner block packaging module is used to construct an anonymous transaction set from all anonymous transactions in the privacy transaction set to be packaged, aggregate all commitments in the privacy transaction set to be packaged using a commitment algorithm based on Walsh codes to obtain an aggregate commitment, and package the anonymous transaction set and the aggregate commitment into a block;

[0044] The regulator's transaction supervision module is used to generate a range proof and call the second smart contract for verification after the supervision cycle ends. The regulator calls the first smart contract for all blocks generated within the cycle to calculate the aggregate commitment within the cycle and uses the Walsh code-based commitment algorithm to extract and calculate the commitment of the total transaction amount of each user from the aggregate commitment within the cycle. The regulator checks the second smart contract call record to determine abnormal transactions.

[0045] Compared with the prior art, the present invention has the following beneficial effects:

[0046] The present invention adopts a commitment algorithm based on Walsh codes, which can add a regulatable attribute to the trading system while ensuring the original anonymity of users. Compared with other solutions, the present invention adopts a solution in which miners and smart contracts aggregate commitments in advance, and then regulators extract and restore data after aggregation, which greatly reduces the calculation and communication pressure of regulators. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0048] Figure 1 It is a schematic diagram of the framework of an efficient and controllable anonymous blockchain transaction method provided by an embodiment of the present invention;

[0049] Figure 2 It is a flowchart of an efficient and controllable anonymous blockchain transaction method provided by an embodiment of the present invention;

[0050] Figure 3is a schematic diagram of a privacy transaction structure provided by an embodiment of the present invention;

[0051] Figure 4 It is a block structure diagram of an anonymous blockchain provided by an embodiment of the present invention;

[0052] Figure 5 It is a structural diagram of an efficient and controllable anonymous blockchain transaction system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0053] To make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific implementation methods described herein are only used to explain the present invention and do not limit the scope of protection of the present invention.

[0054] The inventive concept of the present invention is: in response to the problem of insufficient controllability of anonymous blockchain transactions in the prior art, the embodiments of the present invention provide an efficient and controllable anonymous blockchain transaction method and system, aiming to add controllable functions to the existing privacy protection blockchain technology. The technical solution process of the present invention is divided into five stages: initialization settings, user transaction generation, miner transaction verification, miner block packaging and regulator transaction supervision. When a user generates and sends a transaction, it is accompanied by a Walsh commitment to the amount. Miners and blockchain smart contracts can aggregate commitments. The regulator can extract the commitment of the total amount spent by each user in a fixed time period from the aggregated results, and combine it with the range proof generated by the user to complete the supervision, which will help to further investigate according to the supervision results in the real world and enhance the supervision ability to prevent illegal transactions.

[0055] Explanation of terms and key technologies in the embodiments of the present invention:

[0056] Explanation of terms 1. Symbols: bold characters, for example, v = (v 0 ,…,v n；1 ) represents a vector, v[i] represents the i-th component of the vector, that is, v[i] = v i ,<a,b> represents the inner product of vectors, Represents the Hadamard product of vectors. The calculation rules are as follows:

[0057] a=(a 0 ,…,a n；1 ),b=(b 0 ,…,b n；1 ),

[0058]

[0059] k·a=(ka 0 ,…,kan；1 ),

[0060]

[0061] Uppercase bold letters, e.g., A represents a matrix. Use A i,: to represent all elements of the i-th row of matrix A, i.e., A i,: =(A i,0 ,..., A i,n；1 ). represents that s is randomly selected from the finite integer field modulo p among them.

[0062] Glossary Explanation 2. Commitment: A sender commits to a value in a certain way without disclosing the specific content of the value until the committed value is disclosed later. The role of commitment is to prevent the sender from denying their previous commitment later, even if they want to change the committed value, it is not easy to achieve.

[0063] Glossary Explanation 3. Pedersen Commitment: A commitment algorithm. Specifically, the commitment to value v is pcom = g v h r , where g, h are generators and r is a random number.

[0064] Glossary Explanation 4. Range Proof: Can generate a zero-knowledge proof for a Pedersen commitment to prove that the committed v < v'. This algorithm consists of two sub-algorithms (Prove, Verify): For a Pedersen commitment pcom = g v h r . The Prove algorithm generates a range proof to prove that the committed v < v'. The Verify algorithm verifies the range proof.

[0065] Glossary Explanation 5. Zero-Knowledge Proof: A non-interactive zero-knowledge proof scheme consists of the following 3 sub-algorithms:

[0066] ZKeyGen(1 λ ) → (zpk, zvk), The zero-knowledge proof key generation algorithm takes the security parameter λ as input and outputs the zero-knowledge proof public key zpk and the zero-knowledge proof verification key zvk;

[0067] Prove(zpk, x, a) → Π, The proof generation algorithm takes the zero-knowledge proof public key zpk, the public input x, and the secret input a as input and outputs the proof ∏;

[0068] Verify(zvk, x, ∏) → 0 / 1, The verification algorithm takes the zero-knowledge proof verification key zvk, the public input x, and the proof Π as input and outputs the judgment result.

[0069] Explanation of terms 6. Hash function: A function that converts an input of arbitrary length into an output of fixed length. The hash function used in the present invention is:

[0070] Glossary 7. Hadamard matrix and Walsh code: A Hadamard matrix is ​​composed of +1 and -1 elements and satisfies The n-order square matrix (here H n The transpose of , I is the unit matrix), the fourth-order Hadmard matrix is ​​listed below:

[0071]

[0072] Walsh code is the row vector of Hadmard matrix, and the i-th Walsh code is denoted as code i ,Right now

[0073]

[0074] The following is a list of fourth-order Walsh codes: 0 ,code 1 ,code 2 ,code 3

[0075] code 0 =(+1,+1,+1,+1)

[0076] code 1 =(+1,-1,+1,-1)

[0077] code 2 =(+1,+1,-1,-1)

[0078] code 3 =(+1,-1,-1,+1)

[0079] Walsh code has the following characteristics:

[0080] (1) The length of each chip is an integer power of 2, and the chip consists of elements of +1 or -1;

[0081] (2) All Walsh codes are orthogonal to each other, that is:

[0082]

[0083] Key technologies 1. Commitment algorithm based on Walsh codes: A commitment algorithm based on Walsh codes that achieves efficient aggregation and extraction, including the following calculation steps:

[0084] Computing step (1): Algorithm initialization. Generate an n - order Hadamard matrix H, where n = 2 d , d is an integer, and generate Walsh chips code i = H i,: . Generate Randomly select two independent as generators. Generate the extraction key Generate the set of elements on to obtain the vector g=(g 0 ,..., g n；1 ) and Output the public parameters pp=(ecc, g, g n , g, g n , {code i | 0 ≤ i < n});

[0085] Computing step (2): Commitment. Select a random number Use the chips code i to calculate the commitment,

[0086] Computing step (3): Aggregation. Input m wcom commitments {wcom j | 0 ≤ j < m}, and output their cumulative sum as the aggregation result:

[0087] Computing step (4): Extracting the commitment. Use the extraction key s to extract the Pedersen commitment of the total amount of the sent amount using the chips code i from accu. First, construct a vector using the extraction key s Calculate to obtain which is the Pedersen commitment of the sum of all the secret values committed using code i .

[0088] The roles involved in the embodiments of the present invention are as follows:

[0089] User Conducts privacy transactions using the blockchain and is supervised by the regulator;

[0090] Regulator A trusted institution that conducts periodic checks every relatively long review cycle to check whether the user's fund flow is abnormal;

[0091] Miner Is responsible for processing and verifying these privacy transactions, packing multiple transactions in the transaction pool into a block, and maintaining the ledger;

[0092] Blockchain That is, the native anonymous transaction blockchain is a permissioned chain that provides private transaction capabilities, such as Monero, ZCash, and Zether;

[0093] The first smart contract And the second smart contract Deployed on Smart contracts on the blockchain provide services for running programs on the blockchain.

[0094] Figure 1 Schematic diagram of the framework of the efficient and controllable anonymous blockchain transaction method provided by the embodiment of the present invention. Figure 2 Schematic diagram of the process of an efficient and controllable anonymous blockchain transaction method provided by an embodiment of the present invention. Figure 1 and Figure 2 As shown, the embodiment provides an efficient and controllable anonymous blockchain transaction method, comprising the following steps:

[0095] In the embodiment, the native anonymous transaction blockchain Using Zether, the following steps show how to add regulatory functionality to Zether. Assume that in the Zether system, each user Have their own public key address pk i , original transaction T i The private information hidden in is γ i =(S i ,R i ,v i ), where S i For the sender, R i For the receiver, v i is the transaction amount. There are 4 users in total.

[0096] S1, initialization settings.

[0097] S1.1, Generate public parameters. Use the algorithm initialization calculation steps in the commitment algorithm based on Walsh codes to generate the 4th-order Hadmard matrix H:

[0098]

[0099] Generate Walsh code i =H i,: , i,: represents all elements in the i-th row of the matrix, correspondingly, generates a set of 4-order Walsh codes {code 0 ,code 1 ,code 2 ,code 3}:

[0100] code 0 =(+1,+1,+1,+1)

[0101] code 1 =(+1,-1,+1,-1)

[0102] code 2 =(+1,+1,-1,-1)

[0103] code 3 =(+1,-1,-1,+1)

[0104] Generate elliptic curve parameters p is the modulus, is the elliptic curve group, from Randomly select two generators from And from the finite field of integers modulo p Generate random numbers in Indicates random selection and calculation

[0105] Get vector and get , set the supervision cycle Finally, output the public parameters Use a private channel to send the extraction key s to the supervisor

[0106] S1.2, user initialization.

[0107] S1.2.1, User generates a public-private key pair: Randomly generate a private key Generate a public key pk=Hash(sk) and publish pk, where Hash(·) is a hash function.

[0108] S1.2.2, Initialize the user set: for each user Allocate Walsh code i , regulators set consumption limits based on users’ actual capabilities Generate a Merkle tree mt = (mr, {Hash (pk i ,code i )|0≤i<4}), mr is the root of the Merkle tree, Hash(pk i ,code i ) is the leaf node of the Merkle tree.

[0109] The user set and the chips they own are as follows:

[0110]

[0111] S1.3, generate a zero-knowledge proof public key zpk and a zero-knowledge proof verification key zvk, and publish zpk and zvk.

[0112] S2, user transaction generation.

[0113] In the embodiment, the user Take the example of transferring 17 yuan to someone else.

[0114] S2.1, Use of private information as required by Zether, the native anonymous transaction blockchain γ i =(S i ,R i ,v i )Generate anonymous transaction atx.

[0115] S2.2, using code 1 =(+1,-1,+1,-1) Calculate the Walsh commitment for v=17: Pick a random number Using the commitment calculation steps in the commitment algorithm based on Walsh codes, calculate:

[0116]

[0117] Among them, wcom is the commitment and v is the transaction amount.

[0118] S2.3, generate zero-knowledge proof Π, and use zk-SNARK (Zero-Knowledge Succinct Non-Interactive Argument of Knowledge) to prove that wcom meets the following conditions: (1) wcom is calculated correctly; (2) the Walsh code used by wcom is consistent with the user's identity and the user has the private key corresponding to the public key; (3) the amount promised by wcom is consistent with the amount sent in the anonymous transaction atx.

[0119] Set the public input x = {mr, atx, wcom}, set the secret input a = {sk 1 ,pk 1 ,code 1 ,path}, where path is the path from the first leaf node to mr, and calculate the zero-knowledge proof Π=Prove(zpk,x,a).

[0120] S2.4, package and generate the private transaction wtx=(atx,wcom,Π). The format of the private transaction is as follows Figure 3 shown.

[0121] S3, miner transaction verification.

[0122] S3.1, Miners Verify the correctness of atx according to Zether's requirements.

[0123] S3.2, Miners Verify the zero-knowledge proof Π.

[0124] S4, miners pack blocks.

[0125] The set of private transactions to be packaged is {wtx j |0≤j<3},wtx j This is the jth private transaction among a total of 3 transactions, and the transaction is recorded as wtx j =(atx j ,wcom j ,Π j ), atx j 、wcom j and Π j are the jth anonymous transaction, commitment, and zero-knowledge proof respectively. The anonymous transaction set is represented as {atx j |0≤j <m}。

[0126] Using the aggregation calculation step in the commitment algorithm based on Walsh codes, we input three wcom commitments {wcom j |0≤j<3}, the three commitments are:

[0127] Use code 1 Commitments made to v=17:

[0128]

[0129] Use code 0 Commitments made for v=10:

[0130]

[0131] Use code 1 Commitments for v=90:

[0132]

[0133] Output aggregate commitment accu:

[0134]

[0135] The anonymous transaction set {atx j |0≤j<3} and the aggregate commitment accu are packaged into the block, generating block block=(hedear,{atx0 ,atx 1 ,atx 2},accu), hedear represents the block header, and the block structure is as follows Figure 4 shown.

[0136] S5, regulator transaction supervision.

[0137] After the supervision period is over, the user proves that the amount spent is less than the limit and is subject to review by the regulator.

[0138] S5.1, install smart contract and

[0139] The first smart contract For aggregate promises, input cycles The set of all blocks generated in B = {block start ,...,block end}, remember block t The accu field in is accu t . Calculate the output

[0140] Second smart contract Used to verify the correctness of the range proof, input the range proof, and output the verification result.

[0141] S5.2, User Generates a range proof.

[0142] S5.2.1, Calculate the number of users in the supervision cycle The total amount of anonymous transactions sent within The sum of the random numbers generated when generating the commitment is

[0143] S5.2.2, Calculation of Pedersen Commitment Generate range proof π R Used to prove pcom 1 The amount promised For regulators based on users The spending limit amount is set based on actual ability.

[0144] S5.2.3, the user will identify himself The maximum amount of consumption provided by the user 1 、Pedersen promises pcom 1 and range proof composition And use the second smart contract to verify.

[0145] S5.3, Supervisor review.

[0146] S5.3.1, initialize a vector b of length n with all 1s.

[0147] S5.3.2, the regulator invokes the first smart contract Enter the regulatory cycle The set of all blocks generated in B = {block start ,...,block end}, record the tth block t The aggregate commitment accu field in is accu t , calculate the aggregate commitment within the output cycle

[0148] Using the extraction commitment calculation step in the commitment algorithm based on Walsh codes, the extraction key s is used from Extract the code using code 1 The Pedersen commitment of the total amount of money sent. First, use the extraction key s to construct the vector s = (s n ,s n；1 ,...,s 1 )=(7 4 ,7 3 ,7 2 ,7 1 ), and then calculate:

[0149]

[0150] in, For users The total amount of transactions made in the anonymous transaction set of all blocks in the period Pedersen promises.

[0151] S5.3.3, Supervisor checks on users The second smart contract Call record, if the call record does not exist or the second smart contract In the call record input, there is or Then set b[1]=0, output vector b, and determine user There is a behavior of spending beyond the upper limit. If there are multiple users, then according to the output of the user set The consumption is judged to exceed the upper limit. The regulator will further investigate the user's abnormal transactions in the real world.

[0152] In summary, an efficient and controllable anonymous blockchain transaction method adopts a commitment algorithm based on Walsh code, which can be deployed in the form of a plug-in in the native anonymous transaction blockchain system, and adds controllable attributes to the transaction system under the premise of ensuring the original anonymity of users. Compared with other solutions, the present invention adopts a solution in which miners and smart contracts aggregate commitments in advance, and then regulators extract and restore data after aggregation, which greatly reduces the calculation and communication pressure of regulators.

[0153] Based on the same inventive concept, Figure 5 As shown, an embodiment of the present invention also provides an efficient and controllable anonymous blockchain transaction system 500, including: an initialization setting module 510, a user transaction generation module 520, a miner transaction verification module 530, a miner block packaging module 540 and a regulator transaction supervision module 550.

[0154] The initialization setting module 510 is used to generate public parameters and perform user initialization using a commitment algorithm based on Walsh codes.

[0155] The user transaction generation module 520 is used to generate anonymous transactions and zero-knowledge proofs based on the native anonymous transaction blockchain, calculate commitments using a commitment algorithm based on Walsh codes and public parameters, and package anonymous transactions, zero-knowledge proofs and commitments into private transactions.

[0156] The miner transaction verification module 530 is used by miners to verify anonymous transactions and zero-knowledge proofs in private transactions. After verification, the private transaction is added to the set of private transactions to be packaged.

[0157] The miner block packaging module 540 is used to construct an anonymous transaction set for all anonymous transactions in the privacy transaction set to be packaged, aggregate all commitments in the privacy transaction set to be packaged using a commitment algorithm based on Walsh codes to obtain an aggregated commitment, and package the anonymous transaction set and the aggregated commitment into a block.

[0158] The regulator's transaction supervision module 550 is used to generate a range proof and call the second smart contract for verification after the supervision cycle ends. The regulator calls the first smart contract for all blocks generated within the cycle to calculate the aggregate commitment within the cycle and uses the Walsh code-based commitment algorithm to extract and calculate the commitment of the total transaction amount of each user from the aggregate commitment within the cycle. The regulator checks the second smart contract call record to determine abnormal transactions.

[0159] It should be noted that the efficient and controllable anonymous blockchain transaction system and the efficient and controllable anonymous blockchain transaction method provided in the above embodiment belong to the same inventive concept. The specific implementation process is detailed in the embodiment of the efficient and controllable anonymous blockchain transaction method, which will not be repeated here.

[0160] The specific implementation methods described above provide a detailed description of the technical solutions and beneficial effects of the present invention. It should be understood that the above is only the most preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, supplements and equivalent substitutions made within the scope of the principles of the present invention should be included in the protection scope of the present invention.

Claims

1. An efficient and controllable anonymous blockchain transaction method, characterized in that: The following steps are involved: Generate public parameters and perform user initialization using the commitment algorithm based on Walsh codes; Generate anonymous transactions and zero-knowledge proofs based on the native anonymous transaction blockchain, use the commitment algorithm based on Walsh codes and public parameters to calculate commitments, and package anonymous transactions, zero-knowledge proofs and commitments into private transactions; Miners verify the anonymous transactions and zero-knowledge proofs in private transactions. After verification, they add the private transactions to the set of private transactions to be packaged. Construct an anonymous transaction set for all anonymous transactions in the packaged privacy transaction set, aggregate all commitments in the packaged privacy transaction set using the commitment algorithm based on Walsh code to obtain an aggregate commitment, and package the anonymous transaction set and the aggregate commitment into a block; After the supervision cycle ends, the user generates a range proof and calls the second smart contract for verification. The regulator calls the first smart contract for all blocks generated during the cycle to calculate the aggregate commitment within the cycle and uses the Walsh code-based commitment algorithm to extract and calculate the commitment of each user's total transaction amount from the aggregate commitment within the cycle. The regulator checks the second smart contract call records to determine abnormal transactions.

2. The efficient and controllable anonymous blockchain transaction method according to claim 1 is characterized in that: The public parameters are generated using a commitment algorithm based on Walsh codes, including: Using the algorithm initialization calculation step in the commitment algorithm based on Walsh codes, generate the n-order Hadmard matrix H, n = 2 d , d is an integer, generating Walsh code i =H i,: , i,: represents all elements in the i-th row of the matrix, generating elliptic curve parameters p is the modulus, is the elliptic curve group, from Randomly select two generators from And from the finite field of integers modulo p Generate random numbers in Indicates random selection and calculation Set the vector g = (g0,...,g n-1 ), and get Setting the monitoring cycle Finally, output the public parameters Use a private channel to send the extraction key s to the supervisor 3. The efficient and controllable anonymous blockchain transaction method according to claim 2 is characterized in that: When performing user initialization, it includes: User generates a public-private key pair: Randomly generate a private key Generate a public key pk = Hash (sk) and publish pk, where Hash (·) is a hash function; Initialize the user set: for each user Allocate Walsh chips code i , and the supervisor sets the consumption limit according to the actual capabilities of the users Generate a Merkle tree mt = (mr, {Hash(pk i , code i ) | 0 ≤ i < n}), where mr is the root of the Merkle tree, and Hash(pk i , code i ) are the leaf nodes of the Merkle tree.

4. The efficient and controllable anonymous blockchain transaction method according to claim 2 is characterized in that: The method of calculating the commitment using the Walsh code-based commitment algorithm and public parameters includes: Using the commitment calculation step in the commitment algorithm based on Walsh codes, a random number is selected calculate Where wcom is the commitment and v is the transaction amount.

5. The efficient and controllable anonymous blockchain transaction method according to claim 2 is characterized in that: Zero-knowledge proofs are used to prove that a commitment satisfies the following conditions: The commitment calculation is correct; The Walsh code used is consistent with the user's identity and the user has the private key corresponding to the public key; The amount committed is the same as the amount sent in the shielded transaction.

6. The efficient and controllable anonymous blockchain transaction method according to claim 1 is characterized in that: The method constructs an anonymous transaction set from all anonymous transactions in the privacy transaction set to be packaged, aggregates all commitments in the privacy transaction set to be packaged using a commitment algorithm based on Walsh codes to obtain an aggregate commitment, and packages the anonymous transaction set and the aggregate commitment into a block, including: The set of private transactions to be packaged is {wtx j |0≤j <m},wtx j This is the jth private transaction among a total of m transactions, and the transaction is recorded as wtx j =(atx j ,wcom j ,Π j ), atx j 、wcom j and Π j are the jth anonymous transaction, commitment, and zero-knowledge proof respectively. The anonymous transaction set is represented as {atx j |0≤j <m}; Calculate the aggregate commitment using the aggregate calculation step in the commitment algorithm based on Walsh codes For wcom j Perform continuous multiplication operations; Pack the set of anonymous transactions {atx j | 0 ≤ j < m} and the aggregated commitment accu into a block to generate the block block = (hedear, {atx j | 0 ≤ j < m}, accu), where hedear represents the block header.

7. The efficient and controllable anonymous blockchain transaction method according to claim 4 is characterized in that: The user generates a range proof and calls a second smart contract for verification, including: Calculate the number of users in the supervision cycle The total amount of anonymous transactions sent within The sum of the random numbers generated when generating the commitment is Computing Pedersen Commitments Generate range proof π R Used to prove pcom i The amount promised The upper limit of spending is set by the regulator based on the actual ability of the user; The user's identity The maximum amount of consumption provided by the user i 、Pedersen promises pcom i and range proof composition And use the second smart contract for verification.

8. The efficient and controllable anonymous blockchain transaction method according to claim 2 is characterized in that: The regulator calls the first smart contract for all blocks generated in the cycle to calculate the aggregate commitment in the cycle and uses the commitment algorithm based on Walsh code to extract and calculate the commitment of the total transaction amount of each user from the aggregate commitment in the cycle, including: The regulator enters the regulatory cycle by calling the first smart contract The set of all blocks generated in B = {block start ,...,block end }, record the tth block t The aggregate commitment accu field in is accu t , calculate the aggregate commitment within the output cycle Using the extracted commitment calculation step in the commitment algorithm based on Walsh codes, the vector is constructed using the extracted key s Commit from aggregate within cycle Extract from the calculation k is the sequence number of the traversal extraction, For users The Pedersen commitment of the total transaction amount made in the anonymous transaction set of all blocks in the period, that is, the commitment of the total transaction amount of each user.

9. The efficient and controllable anonymous blockchain transaction method according to claims 7 and 8, characterized in that: The regulator checks the second smart contract call record to determine abnormal transactions, including: Regulators check users The second smart contract call record, if the call record does not exist or the second smart contract call record input has or The user will be marked and regulators will further investigate abnormal transactions in the real world to determine whether there is money laundering.

10. An efficient and controllable anonymous blockchain transaction system, characterized in that: include: Initialization setting module, user transaction generation module, miner transaction verification module, miner block packaging module and regulator transaction supervision module; The initialization setting module is used to generate public parameters and perform user initialization using a commitment algorithm based on Walsh codes; The user transaction generation module is used to generate anonymous transactions and zero-knowledge proofs based on the native anonymous transaction blockchain, calculate commitments using a commitment algorithm based on Walsh codes and public parameters, and package anonymous transactions, zero-knowledge proofs and commitments into private transactions; The miner transaction verification module is used by miners to verify anonymous transactions and zero-knowledge proofs in private transactions. After verification, the private transaction is added to the set of private transactions to be packaged; The miner block packaging module is used to construct an anonymous transaction set from all anonymous transactions in the privacy transaction set to be packaged, aggregate all commitments in the privacy transaction set to be packaged using a commitment algorithm based on Walsh codes to obtain an aggregate commitment, and package the anonymous transaction set and the aggregate commitment into a block; The regulator's transaction supervision module is used to generate a range proof and call the second smart contract for verification after the supervision cycle ends. The regulator calls the first smart contract for all blocks generated within the cycle to calculate the aggregate commitment within the cycle and uses the Walsh code-based commitment algorithm to extract and calculate the commitment of the total transaction amount of each user from the aggregate commitment within the cycle. The regulator checks the second smart contract call record to determine abnormal transactions.

Images