Payment channel privacy protection method based on zero knowledge proof

Abstract

The invention relates to a payment channel privacy protection method based on zero knowledge proof, and belongs to the technical field of block chain privacy protection. Determining specific parameters in the payment channel transaction process through out-of-chain communication of the two transaction parties; the two transaction parties jointly open payment channels and deposit a certain amount of tokens into the payment channels respectively; redistributing the token money amount in the payment channel under the chain and confirming the token money amount in a multi-signature mode every time the two parties of the transaction carry out the transaction; and when the two transaction parties end the transaction, the latest off-chain transaction is sent to the chain, and the payment channel is closed. In the process, key information in the transaction process is verified and hidden through zero-knowledge proof. According to the method, the data privacy of the transaction amount is guaranteed, the incidence relation between the two transaction parties is hidden, and the transaction fairness is guaranteed.

Description

Technical Field

[0001] The present invention relates to a payment channel privacy protection method based on zero-knowledge proof, and belongs to the technical field of blockchain privacy protection. Background Art

[0002] The characteristic of digital tokens based on blockchain is that they change the traditional trust model of digital tokens that requires a third-party trusted center as a guarantee. In the trust model of digital tokens based on blockchain technology, the trust between users comes from trust in the entire system, without trusting a single node. It is precisely because of the decentralized nature of blockchain that more and more other cryptographic tokens based on blockchain have emerged.

[0003] However, it is precisely because of the decentralized nature of blockchain that it has become an obstacle to the further development of blockchain-based crypto tokens. Compared with traditional centralized solutions, decentralized crypto tokens have two weaknesses: first, their transaction rate is relatively low; second, the average confirmation time of transactions is long. Therefore, whether the scalability problem of the blockchain system is solved becomes a key step in whether it can be further promoted.

[0004] In order to solve the scalability problem of decentralized crypto tokens, many solutions have been proposed, including payment channels. Payment channel technology, also known as "off-chain" technology, has become one of the most promising solutions to address scalability challenges. In the payment channel solution, the transaction parties only need to record the initial and final states of the payment channel in the blockchain ledger. All intermediate transaction processes are carried out off-chain and do not need to interact with the blockchain. Therefore, large-scale offline transactions can be carried out safely, which makes the number of transactions that the blockchain can support theoretically expand to infinity.

[0005] Although payment channels provide a solution to the blockchain's scalability problem, the existing encrypted token payment channel transaction system still lacks protection for the following two types of privacy information: payment channel transaction amount and the relationship between the two parties. First, in the existing payment channel model, although the payment is made off-chain, any party can obtain the transaction amount through the transaction record that is ultimately exposed on the blockchain ledger, and the relationship between the two parties will also be exposed due to the establishment and closing of the payment channel. Therefore, the problem of privacy protection has severely limited the promotion and use of payment channels. Summary of the invention

[0006] The purpose of the present invention is to creatively propose a payment channel privacy protection method based on zero-knowledge proof in view of the problems and shortcomings of the prior art. The method verifies and hides key information in the transaction process through zero-knowledge proof, adopts Merkle tree for unified management, and realizes fair transactions in the payment channel through timed verifiable commitments.

[0007] First, the relevant concepts and contents involved in the present invention are explained.

[0008] zk-SNARK technology: As a type of zero-knowledge proof, zk-SNARKs non-interactive zero-knowledge proof scheme is the most widely used among existing zero-knowledge proofs. It can verify the validity of a transaction without the verification node knowing the specific transaction content, that is, it allows one party (the prover) to prove to the other party (the verifier) ​​that the statement is true.

[0009] Public key cryptography: keys are generally divided into public and private keys pk / sk. Public keys are used for encryption and signature verification, while private keys are used for decryption and signing. Typical public key cryptography algorithms include RSA and BLS signature.

[0010] Timed Verifiable Commitment: allows the operator to generate a time lock for the secret value y corresponding to the commitment value Y. In the time lock, on the one hand, the time lock guarantees that any party who obtains the time lock can obtain the secret value y corresponding to the commitment value Y after the calculation time T; on the other hand, the time lock ensures that without unlocking the time lock, anyone can publicly verify whether the time lock contains the secret value y corresponding to the commitment value Y.

[0011] Hash function: A one-way, collision-free function y = H(x) that can quickly calculate y from x, but cannot calculate x given y. Commonly used hash functions include MD5 and SHA256.

[0012] Zero-knowledge token: A hidden token represented by a hash value, which is composed of:

[0013] cm i =COMM(pk i ,v i ,sn i ,r i ), value v i The plaintext token value corresponding to the zero-knowledge token is in units of basic tokens, with the serial number sn i For cm i The unique string associated with the address pk i is the address of the user who owns the zero-knowledge token, and the private key sk i is the private key of the user who owns the zero-knowledge token, and the random number r iRandom numbers to obfuscate zero-knowledge tokens;

[0014] cm i =COMM(pk i ,pk j ,v i ,sn i ,sn j ), where the value v i The plaintext token value corresponding to the zero-knowledge token is in units of basic tokens, with the serial number sn i For c i The unique string associated with the address pk i The address of the user who receives the zero-knowledge token, address pk j is the sender's address, the random number r i To prevent duplication of random numbers, the serial number sn j is a string associated with the zero-knowledge token transferred by the sender;

[0015] cm i =COMM(pk i ,pk j ,v i ,sn i ,sn j ,Y), the second type of zero-knowledge token is basically the same, except that a commitment value Y is added to this category, which is a parameter for determining fair transactions.

[0016] In order to achieve the above object, the technical solution of the present invention is as follows.

[0017] A payment channel privacy protection method based on zero-knowledge proof includes the following steps:

[0018] Step 1: Transaction parties P i and P j Through off-chain communication, the specific parameters of the payment channel transaction process are determined, and it is determined whether the other party has sufficient funds.

[0019] Step 2: Transaction parties P i and P j First, a payment channel address jointly controlled by both parties is jointly generated, and then both parties transfer tokens to the payment channel address according to the negotiated amount.

[0020] In order to prevent one party from going offline after depositing funds into the payment channel address, causing the other party to be locked for a long time, the two parties should generate relevant unfreezing information before transferring funds to the payment channel address to ensure that both parties can unfreeze the deposited funds after the agreed time.

[0021] Step 3: Transaction parties P i and Pj Every time a transaction is made, the token amount in the payment channel address is redistributed off-chain and confirmed by multi-signature.

[0022] Step 4: To prevent one party from publishing an old transaction to the chain and causing damage to the other party's funds, each time after reallocating the funds in the payment channel address, the old allocation transaction must be revoked, so that the party that published the old transaction will lose all funds.

[0023] Step 5: When both parties P i and P j When concluding the transaction, they can each send the latest off-chain transaction to the chain to close the payment channel.

[0024] In steps 2 to 4, each step uses zero-knowledge proof to verify and hide relevant key information in the transaction process, thereby achieving privacy protection during the transaction process.

[0025] Further, step 1 comprises:

[0026] Transaction parties P i and P j The two parties negotiate the amount of funds they need to deposit in the payment channel, and determine the maximum time T1 for the two parties' funds to be locked in the payment channel and the warning time T2 to prevent the release of old transactions. Then, P i and P j Check whether the other party has enough funds on the blockchain.

[0027] Further, step 2 includes:

[0028] Step 2.1: Generate payment channel address pk 2-PC .

[0029] To establish a payment channel, the two parties P i and P j It is necessary to generate an address controlled by both parties. The specific method is as follows:

[0030] First, the two parties P i and P j Calculate new public and private key pairs respectively and Specifically, the BLS key generation algorithm can be used for calculation.

[0031] Then, user P i The newly generated public key Send to user P j , user P j The newly generated public key Send to user P i .

[0032] Finally, both parties use the BLS aggregation algorithm to aggregate the received public keys and generate a new address pk 2-PC .

[0033] Step 2.2: Transfer funds.

[0034] After the new payment channel address is generated, user P i and P j Need to address pk separately 2-PC Deposit amount (v i ,v j ).

[0035] Therefore, for user P i , which requires funds v i From your own zero-knowledge tokens Transfer to address pk 2-PC When the payment channel address is updated, it will have a new zero-knowledge token That is: the user will transfer the amount of money he owns v i Zero-knowledge token The amount converted into the payment channel is v i Zero-knowledge tokens

[0036] During this process, user P i Generate a zero-knowledge proof π Sen d. Prove the following:

[0037] The original zero-knowledge token Among them, pk i For user P i The address of v i for The corresponding plaintext amount, for The corresponding unique serial number, For serial number The associated random number.

[0038] old serial number Among them, sk i For user address pk i Corresponding private key; newly generated zero-knowledge token Among them, pk 2-PC is the payment channel address, pk i For user P i The address of v i for The corresponding plaintext amount, for The corresponding serial number, for The corresponding unique serial number.

[0039] New Serial Number in, is a random number selected at random;

[0040] Zero-knowledge tokens Exists in the Merkle tree with rt as the root; the public parameters are rt, The private parameters are

[0041] Then, user P i The public parameters are compared with π Send Sent to the blockchain, nodes on the blockchain verify π through public parameters Send If correct, the transaction is recorded on the blockchain.

[0042] For user P j The actions taken are related to P i Exactly the same;

[0043] Step 2.3: Unfreeze funds.

[0044] In user P i and P j Before successfully transferring funds to the payment channel, it is necessary to consider the possibility that one party may go offline after the payment channel is established. If this happens, the funds of the other party will be locked in the payment channel address pk forever. 2-PC Among.

[0045] To prevent this from happening, i and P j Before transferring funds, user P i and P j It is also necessary to ensure that the deposited funds can be retrieved after time T. i Deposit PK 2-PC Funds in user P j The zero-knowledge token belonging to the payment channel address Transfer to user P i Address pk i , so that user P i Owning a new zero-knowledge token That is: the original payment channel address pk 2-PC Zero-knowledge tokens Transformed into P i Zero-knowledge tokens The corresponding plaintext amount is vi ；

[0046] User P j A timed verifiable time commitment (C VTD ,π VTD ), in C VTD The secret value y hidden in the commitment value Y is stored in it, and it is ensured that anyone can obtain the secret value y after a long operation of time T1, through π VTD It can be proved that C VTD Preserve the correctness of the secret value y hidden by the commitment value Y;

[0047] User P j Generate a zero-knowledge proof π UnFreeze , prove the following:

[0048] The original zero-knowledge token Among them, pk 2-PC is the payment channel address, pk i For user P i The address of v i for The corresponding plaintext amount, is the old serial number, for The corresponding unique serial number.

[0049] old serial number in Is a random number.

[0050] Newly generated zero-knowledge tokens Among them, pk 2-PC is the payment channel address, pk i For user P i The address of v i for The corresponding plaintext amount, for The corresponding unique serial number, for The corresponding unique serial number;

[0051] New Serial Number Where Y is C VTD The commitment value corresponding to the secret value stored in;

[0052] The public parameters are

[0053] The secret parameters are

[0054] Then, user P j Using its pk 2-PC Part of the private key For the above public parameters and π UnFreeze Sign and generate signature

[0055] Afterwards, user P j The public parameter, π UnFreeze , and (C VTD ,π VTD )Sent to user P off-chain i ;

[0056] When user P i After time T1, the secret value y is obtained, and the secret value y, the public parameter, π UnFreeze and σ UnFreeze (It is user P i Use part of the private key For public parameters and π UnFreeze Sign, and The aggregated complete signature) is sent to the blockchain, and then the nodes on the blockchain verify π through the public parameters UnFreeze and σ UnFreeze The correctness of and whether y is the secret value promised in Y. If correct, the transaction is recorded on the blockchain.

[0057] For unfreezing user P j The funds in the payment channel address, the actions taken and P i Exactly the same, except that the original operations are swapped, that is, P is required j Change the operation to P i , requires P i Change the operation to P j ;

[0058] Further, step 3 includes:

[0059] Step 3.1: Update funding allocation.

[0060] User P i and P j Each off-chain transaction is a redistribution of the funds stored in the payment channel address, that is, 2-PC Zero-knowledge tokens and Convert to P i Zero-knowledge tokens and belongs to P j Zero-knowledge tokens

[0061] Each time for the allocation of funds on the payment channel address, user P i and P jEach user will perform an update of the fund allocation operation. In their updates, the division of funds in the payment channel address is the same, but the time when each user can obtain the corresponding funds is different. i The generated one belongs to P i Zero-knowledge tokens and belongs to P j Zero-knowledge tokens Belong to P i User P i Can be obtained immediately, but belongs to P j User P j It takes a while T2 to get it. j The generated one belongs to P i Zero-knowledge tokens and belongs to P j Zero-knowledge tokens Belong to P j User P j Can be obtained immediately, but belongs to P i User P i It also takes a while T2 to get it. The purpose of this is to give the other party enough time to block when one party releases an old transaction.

[0062] When user P j To redistribute funds in a payment channel address, the operation is as follows:

[0063] User P j Generate a timed verifiable time commitment (C VTD ,π VTD ), in C VTD The secret value y hidden in the commitment value Y is stored in it, and it is ensured that anyone can obtain the secret value y after a long operation of time T2, through π VTD It can be proved that C VTD Preserve the correctness of the secret value y hidden by the commitment value Y;

[0064] User P j Generate a zero-knowledge proof π Update , prove the following:

[0065] The original zero-knowledge token Among them, pk 2-PC is the payment channel address, pk j For user P j Address, for The corresponding plaintext amount, is the old serial number, for The corresponding unique serial number;

[0066] old serial number in is a random number;

[0067] The original zero-knowledge token Among them, pk 2-PC is the payment channel address, pk i For user P i Address, for The corresponding plaintext amount, is the old serial number, for The corresponding unique serial number;

[0068] old serial number in is a random number;

[0069] Newly generated zero-knowledge tokens Among them, pk 2-PC is the payment channel address, pk j For user P j Address, for The corresponding plaintext amount, for The corresponding unique serial number, for The corresponding unique serial number;

[0070] New Serial Number in is a newly generated random number;

[0071] Newly generated zero-knowledge tokens Among them, pk 2-PC is the payment channel address, pk i For user P i Address, for The corresponding plaintext amount, for The corresponding unique serial number, for The corresponding unique serial number, Y is C VTD The commitment value corresponding to the secret value stored in;

[0072] New Serial Number in is a newly generated random number;

[0073]

[0074] Zero-knowledge tokens Exists in the Merkle tree with rt as the root;

[0075] Zero-knowledge tokens Exists in the Merkle tree with rt as the root;

[0076] Among them, the public parameters are rt, pk 2-PC , The secret parameters are pk j ,pk i , Y;

[0077] Then, user P j Using its pk 2-PC Part of the private key For the above public parameters and π Update Sign and generate signature

[0078] Afterwards, user P j The public parameter, π Upda te, and (C VTD, π VTD )Sent to user P off-chain i ;

[0079] User P i The public parameters, π Update and σ Update (It is user P i Use part of the private key For public parameters and π Update Sign, and The aggregated complete signature) is sent to the blockchain system, and then the nodes on the blockchain verify π through the public parameters Update and σ Update The correctness of the transaction, if it is correct, the transaction will be recorded on the blockchain;

[0080] When user P i When redistributing funds in a payment channel address, the operations performed are similar to those of P j Exactly the same, except that the original operations are swapped, that is, P is required j Change the operation to P i , requires P i Change the operation to P j ;

[0081] Further, step 4 includes:

[0082] Step 4.1: Withdraw old allocation of funds.

[0083] In order to prevent one party from publishing an old fund allocation transaction, it is necessary to withdraw the old fund allocation after the new fund allocation transaction is generated, that is, to rescind the old version of the fund allocation. i Zero-knowledge tokens Transfer to P j Zero-knowledge tokens The old version belongs to P j Zero-knowledge tokens Transfer to P i Zero-knowledge tokens

[0084] When retrieving the old version of P j Zero-knowledge tokens When P j The operations performed are as follows:

[0085] User P j Generate a zero-knowledge proof π Rev , prove the following:

[0086] The original zero-knowledge token Among them, pk 2-PC is the payment channel address, pk j For user P j The address of v j for The corresponding plaintext amount, is the old serial number, for The corresponding unique serial number, Y is C VTD The commitment value corresponding to the secret value stored in;

[0087] old serial number in is the old random number;

[0088] Newly generated zero-knowledge tokens Among them, pk j For user P j Address, pk i For user P i The address of v j for The corresponding plaintext amount, for The corresponding unique serial number, for The corresponding unique serial number;

[0089] New Serial Number in is a newly generated random number;

[0090] The public parameters are pk j , Y;

[0091] The private parameter is pk 2-PC ,pk i ,v j ,

[0092] Then, user P j Use pk j The corresponding private key sk j For public information and π Rev Sign and generate signature σ Rev ;

[0093] Afterwards, user P j The public parameters, π Rev and σ Rev Sent to user P off-chain i ;

[0094] When user P j When publishing old transactions, P i The public parameters, π Rev and σ Rev Sent to the blockchain system, and then the nodes on the blockchain verify π through public parameters Rev and σ Rev The correctness of the transaction. If it is correct, the transaction will be recorded on the blockchain to protect its legal rights and interests.

[0095] When retrieving the old version of P i Zero-knowledge tokens When P i The operations performed are similar to P j Same:

[0096] Further, step 5 comprises:

[0097] When user P i and P j After the transaction is completed, both parties can publish the latest off-chain transaction to the chain. After being confirmed by the blockchain node, the payment channel will be completely closed.

[0098] Beneficial Effects

[0099] Compared with the prior art, the present invention has the following advantages:

[0100] 1. The data privacy of the transaction amount is guaranteed. By using zero-knowledge proof technology, the transaction amount information is hidden during the generation and verification process of the transaction, thereby realizing the data privacy protection of the payer;

[0101] 2. The relationship between the two parties of the transaction is hidden. The zero-knowledge tokens used in the transactions in the payment channel are uniformly managed through the Merkle tree, thereby ensuring the privacy and security of the relationship between the transaction sender and the transaction receiver;

[0102] 3. By utilizing timed verifiable commitments, on the one hand, it can ensure that when one party’s funds are frozen in the payment channel for a certain period of time, they can be unfrozen and the deposited funds can be obtained; on the other hand, it can ensure that when one party publishes an old transaction, the other party has enough time to counter, thereby ensuring the fairness of the transaction. BRIEF DESCRIPTION OF THE DRAWINGS

[0103] Figure 1 A flowchart of the method according to an embodiment of the present invention;

[0104] Figure 2 A diagram of the relationships demonstrated for the transfer of funds operations;

[0105] Figure 3 A relationship diagram to prove the operation of unfreezing funds;

[0106] Figure 4 A diagram of the relationships demonstrated for the update of the fund allocation operation;

[0107] Figure 5 A diagram showing the relationship for the withdrawal of old capital allocation operations. DETAILED DESCRIPTION

[0108] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0109] Example

[0110] like Figure 1 As shown, a payment channel privacy protection method based on zero-knowledge proof includes the following steps:

[0111] Step 1: The two parties to the transaction negotiate relevant parameters off-chain.

[0112] Transaction parties P i and P j The amount of funds that both parties in the off-chain negotiation need to deposit into the payment channel, P i is 100 zero-knowledge tokens, P j The maximum time for both parties to lock their funds in the payment channel is 1 hour, and the warning time to prevent old transactions from being released is 20 minutes. Then P i and Pj Check whether the other party has enough funds on the blockchain.

[0113] Step 2: Establish a payment channel.

[0114] Step 2.1: Generate payment channel address pk 2-PC .in:

[0115] User P i Use the BLS key generation algorithm to calculate a new public-private key pair User P j Use the BLS key generation algorithm to calculate a new public-private key pair

[0116] User P i The newly generated public key Send to user P j , user P j The newly generated public key Send to user P i ;

[0117] User P i The BLS aggregation algorithm aggregates the received public keys to generate a new address pk 2-PC , user P j The BLS aggregation algorithm aggregates the received public keys to generate a new address pk 2-PC ;

[0118] Step 2.2: Transfer funds.

[0119] User P i The funds are 100 zero-knowledge tokens owned by Transfer to address pk 2-PC When it is on, a new zero-knowledge token is generated for the payment channel address

[0120] During this process, user P i A zero-knowledge proof will be generated Prove that the following equation holds for Figure 2 The relationship diagram shown:

[0121] 1) The original zero-knowledge token

[0122] 2)Old serial number

[0123] 3) Newly generated zero-knowledge tokens

[0124] 4) New serial number

[0125] 5) Zero-knowledge tokens Exists in the Merkle tree with rt as the root;

[0126] Then, user P i The parameters will be exposed rt, and Sent to the blockchain system, and then the nodes on the blockchain verify it through public parameters The correctness of the transaction, if it is correct, the transaction will be recorded on the blockchain;

[0127] User P j The funds are 50 zero-knowledge tokens owned by Transfer to address pk 2-PC When it is on, a new zero-knowledge token is generated for the payment channel address

[0128] During this process, user P j A zero-knowledge proof will be generated Prove that the following equation holds for Figure 2 The relationship diagram shown:

[0129] 1) The original zero-knowledge token

[0130] 2)Old serial number

[0131] 3) Newly generated zero-knowledge tokens

[0132] 4) New serial number

[0133] 5) Zero-knowledge tokens Exists in the Merkle tree with rt as the root;

[0134] Then, user P j The parameters will be exposed rt, and Sent to the blockchain system, and then the nodes on the blockchain verify it through public parameters The correctness of the transaction, if it is correct, the transaction will be recorded on the blockchain;

[0135] Step 2.3: Unfreeze funds.

[0136] User P i Randomly select a secret value y1 and calculate the commitment value Y1, then call the timed verifiable commitment algorithm to generate a timed verifiable time commitment (C VTD ,π VTD ), in C VTDThe secret value y1 hidden in the commitment value Y1 is stored in it, and it is ensured that anyone can obtain the secret value y1 after a 1h operation. VTD It can be proved that C VTD Preserve the correctness of the secret value y1 hidden by the commitment value Y1;

[0137] User P i Generate a zero-knowledge proof Prove that the following equation holds for Figure 3 The relationship diagram shown:

[0138] 1) The original zero-knowledge token

[0139] 2)Old serial number

[0140] 3) Newly generated zero-knowledge tokens

[0141] 4) New serial number

[0142] User P j Using its pk 2-PC Part of the private key pk 2-PC , Y1 and Sign and generate signature

[0143] User P i will expose the parameters, and (C VTD ,π VTD )Sent to user P off-chain j ;

[0144] User P j Randomly select the secret value y2 and calculate the commitment value Y2, then call the timed verifiable commitment algorithm to generate a timed verifiable time commitment (C VTD ,π VTD ), in C VTD The secret value y2 hidden in the commitment value Y2 is stored in it, and it is ensured that anyone can obtain the secret value y2 after a 1h operation. VTD It can be proved that C VTD Preserve the correctness of the secret value y2 hidden by the commitment value Y2;

[0145] User P j Generate a zero-knowledge proof Prove that the following equation holds for Figure 3 The relationship diagram shown:

[0146] 1) The original zero-knowledge token

[0147] 2)Old serial number

[0148] 3) Newly generated zero-knowledge tokens

[0149] 4) New serial number

[0150] User P j Using its pk 2-PC Part of the private key right pk 2-PC , Y2 and Sign and generate signature

[0151] User P j will expose the parameters, and (C VTD ,π VTD )Sent to user P off-chain i ;

[0152] Step 3: Update funding allocations.

[0153] After the transaction between the two parties, the funds in the payment channel, 120 zero-knowledge tokens, are distributed to P i , 30 zero-knowledge tokens are allocated to P j ;

[0154] Among them, user P j The operations performed are as follows:

[0155] User P j Randomly select the secret value y3 and calculate the commitment value Y3, then call the timed verifiable commitment algorithm to generate a timed verifiable time commitment (C VTD ,π VTD ), in C VTD The secret value y3 hidden in the commitment value Y3 is stored in it, and it is ensured that anyone can obtain the secret value y3 after a 20-minute operation. VTD It can be proved that C VTD The correctness of the secret value y3 hidden by the commitment value Y3 is preserved;

[0156] User P j Generate a zero-knowledge proof Prove that the following equation holds for Figure 4 The relationship diagram shown:

[0157] 1) The original zero-knowledge token

[0158] 2)Old serial number

[0159] 3) The original zero-knowledge token

[0160] 4)Old serial number

[0161] 5) Newly generated zero-knowledge tokens

[0162] 6) New sequence number sn0 = PRF (pk j ,r0)

[0163] 7) Newly generated zero-knowledge tokens

[0164] 8) New sequence number sn1 = PRF (pk i ,r1)

[0165] 9) 100+50=120+30;

[0166] 10) Zero-knowledge tokens Exists in the Merkle tree with rt as the root;

[0167] 11) Zero-knowledge tokens Exists in the Merkle tree with rt as the root;

[0168] User P j Using its pk 2-PC Part of the private key For rt, pk 2-PC , and Sign and generate signature

[0169] User P j rt, pk 2-PC , and (C VTD ,π VTD )Sent to user P off-chain i ;

[0170] User P i The operations performed are as follows:

[0171] User P i Randomly select the secret value y4 and calculate the commitment value Y4, then call the timed verifiable commitment algorithm to generate a timed verifiable time commitment (C VTD ,πVTD ), in C VTD The secret value y4 hidden in the commitment value Y4 is stored in it, and it is ensured that anyone can obtain the secret value y4 after a 20-minute operation. VTD It can be proved that C VTD The correctness of the secret value y4 hidden by the commitment value Y4 is preserved;

[0172] User P j Generate a zero-knowledge proof Prove that the following equation holds for Figure 4 The relationship diagram shown:

[0173] 1) The original zero-knowledge token

[0174] 2)Old serial number

[0175] 3) The original zero-knowledge token

[0176] 4)Old serial number

[0177] 5) Newly generated zero-knowledge tokens

[0178] 6) New sequence number sn2 = PRF (pk j ,r2)

[0179] 7) Newly generated zero-knowledge tokens

[0180] 8) New serial number

[0181] 9) 100+50=120+30;

[0182] 10) Zero-knowledge tokens Exists in the Merkle tree with rt as the root;

[0183] 11) Zero-knowledge tokens Exists in the Merkle tree with rt as the root;

[0184] User P i Using its pk 2-PC Part of the private key For rt, pk 2-PC , and Sign and generate signature

[0185] User P i rt, pk 2-PC , and (C VTD ,π VTD )Sent to user P off-chain j .

[0186] Step 4: Roll back old trades.

[0187] Withdraw the old fund allocation. After the transaction between the two parties, withdraw the original allocation, that is, distribute the funds in the payment channel 110 zero-knowledge tokens to P i , 40 zero-knowledge tokens are allocated to P j ;

[0188] P j Retrieve the old version of P j Zero-knowledge tokens When P j The operations performed are as follows:

[0189] User P j Generate a zero-knowledge proof Prove that the following equation holds for Figure 5 The relationship diagram shown:

[0190] 1) The original zero-knowledge token

[0191] 2) Old sequence number sn2 = PRF (pk j ,r2)

[0192] 3) Newly generated zero-knowledge tokens

[0193] 4) New sequence number sn4 = PRF (pk i ,r4)

[0194] Then user P j Use pk j The corresponding private key pk j right pk j ,sn2,Y4 and Sign and generate signature

[0195] After that, user P j Will pk j ,sn2,Y4, and Sent to user P off-chain i ;

[0196] P i Retrieve the old version of P iZero-knowledge tokens When P i The operations performed are as follows:

[0197] User P j Generate a zero-knowledge proof Prove that the following equation holds for Figure 5 The relationship diagram shown:

[0198] 1) The original zero-knowledge token

[0199] 2) Old sequence number sn1 = PRF (pk i ,r1)

[0200] 3) Newly generated zero-knowledge tokens

[0201] 4) New sequence number sn5 = PRF (pk j ,r5)

[0202] User P i Use pk i The corresponding private key sk i right pk i ,sn1,Y3 and Sign and generate signature

[0203] After that, user P j Will pk i ,sn1,Y3, and Sent to user P off-chain j ;

[0204] Step 5: Close the payment channel.

[0205] User P i Use its private key For rt, pk 2-PC , π Update Generate signature Then and Aggregate to generate a new signature σ Update , then rt, pk 2-PC , π Update , σ Update is sent to the blockchain system, and then the nodes on the blockchain verify π through public parameters Update and σ UpdateThe correctness of the transaction will be checked. If it is correct, the transaction will be recorded on the blockchain and the payment channel will be closed.

Claims

1. A payment channel privacy protection method based on zero-knowledge proof, characterized in that: Zero-knowledge proofs are used to verify and hide key information in the transaction process, Merkle trees are used for unified management, and fair transactions in payment channels are achieved through timed verifiable commitments. The following steps are involved: Step 1: Transaction parties P i and P j Through off-chain communication, the specific parameters of the payment channel transaction process are determined, and the parties can determine whether the other party has sufficient funds. Step 2: Transaction parties P i and P j First, a payment channel address is jointly generated and controlled by both parties. Then, both parties transfer tokens to the payment channel address according to the negotiated amount. Before transferring funds to the payment channel address, both parties should generate relevant unfreezing information to ensure that both parties can unfreeze the deposited funds after the agreed time. Step 3: Transaction parties P i and P j Each time a transaction is made, the token amount in the payment channel address is redistributed off-chain and confirmed by multi-signature. Step 4: Each time after reallocating funds in the payment channel address, revoke the old allocation transaction; Step 5: When both parties P i and P j When the transaction is concluded, it can send the latest off-chain transaction to the chain to close the payment channel; In steps 2 to 4, each step verifies and hides relevant key information in the transaction process through zero-knowledge proof.

2. A payment channel privacy protection method based on zero-knowledge proof as claimed in claim 1, characterized in that: Step 1 includes: Transaction parties P i and P j Negotiate the amount of funds that both parties need to deposit in the payment channel off-chain, and determine the maximum time T1 for both parties’ funds to be locked in the payment channel and the warning time T2 to prevent the release of old transactions; then, P i and P j Check whether the other party has enough funds on the blockchain.

3. A payment channel privacy protection method based on zero-knowledge proof as claimed in claim 1, characterized in that: Step 2 includes: Step 2.1: Generate payment channel address pk 2-PC ; First, the two parties P i and P j Calculate new public and private key pairs respectively and Specifically, the BLS key generation algorithm can be used to calculate; Then, user P i The newly generated public key Send to user P j , user P j The newly generated public key Send to user P i ; Finally, both parties use the BLS aggregation algorithm to aggregate the received public keys and generate a new address pk 2-PC ; Step 2.2: Transfer funds; After the new payment channel address is generated, user P i and P j Need to address pk separately 2-PC Amount of deposited funds (v i , v j ); For user P i , which requires funds v i From your own zero-knowledge tokens Transfer to address pk 2-PC When the payment channel address is updated, it will have a new zero-knowledge token That is: the user will transfer the amount of money he owns to v i Zero-knowledge token The amount converted into the payment channel is v i Zero-knowledge tokens In this process, user Pi generates a zero-knowledge proof π Send , prove the following: The original zero-knowledge token Among them, pk i For user P i The address of v i for The corresponding plaintext amount, for The corresponding unique serial number, For serial number Related random numbers; old serial number Among them, sk i For user address pk i Corresponding private key; newly generated zero-knowledge token Among them, pk 2-PC is the payment channel address, pk i For user P i The address of v i for The corresponding plaintext amount, for The corresponding serial number, for The corresponding unique serial number; New Serial Number in, is a random number selected at random; Zero-knowledge tokens Exists in the Merkle tree with rt as the root; the public parameters are rt, The private parameters are pk 2-PC , pk i , v i , sk i ; Then, user P i The public parameters are compared with π Send Sent to the blockchain, nodes on the blockchain verify π through public parameters Send If it is correct, the transaction is recorded on the blockchain; For user P j The operations taken are exactly the same as for Pi; Step 2.3: Unfreeze funds; In user P i and P j Before transferring funds, user P i and P j It is necessary to ensure that the deposited funds can be retrieved after time T; deposit pk 2-PC Funds in user P j The zero-knowledge token belonging to the payment channel address Transfer to user P i Address pk i , allowing users to own new zero-knowledge tokens Pi That is: the original payment channel address pk 2-PC Zero-knowledge tokens Converted into Pi's zero-knowledge token The corresponding plaintext amount is v i ; User P j Generate a timed verifiable time commitment (C VTD , π VTD ), in C VTD The secret value y hidden in the commitment value Y is stored in it, and it is ensured that anyone can obtain the secret value y after a long operation of time T1, through π VTD Can prove C VTD Preserve the correctness of the secret value y hidden by the commitment value Y; User P j Generate a zero-knowledge proof π UnFreeze , prove the following: The original zero-knowledge token Among them, pk 2-PC is the payment channel address, pk i For user P i The address of v i for The corresponding plaintext amount, is the old serial number, for The corresponding unique serial number; old serial number in is a random number; Newly generated zero-knowledge tokens Among them, pk 2-PC is the payment channel address, pk i For user P i The address of v i for The corresponding plaintext amount, for The corresponding unique serial number, for The corresponding unique serial number; New Serial Number Where Y is C VTD The commitment value corresponding to the secret value stored in; The public parameters are The secret parameter is pk i , v i , Then, user P j Using its pk 2-PC Part of the private key For the above public parameters and π UnFreeze Sign and generate signature Afterwards, user P j The public parameter, π UnFreeze , and (C VTD , π VTD )Sent to user P off-chain i ; When user P i After time T1, the secret value y is obtained, and the secret value y, the public parameter, π UnFreeze and σ UnFreeze Sent to the blockchain, and then the nodes on the blockchain verify π through public parameters UnFreeze and σ UnFreeze The correctness of and whether y is the secret value promised in Y; if correct, the transaction is recorded on the blockchain; For unfreezing user P j The funds in the payment channel address, the actions taken and P i Exactly the same, except that the original operations are swapped, that is, P is required j Change the operation to P i , requires P i Change the operation to P j .

4. A payment channel privacy protection method based on zero-knowledge proof as claimed in claim 1, characterized in that: Step 3 includes: Step 3.1: Update funding allocation; User P i and P j Each off-chain transaction is a redistribution of funds stored in the payment channel address, which belongs to the payment channel address pk 2-PC Zero-knowledge tokens and Convert to P i Zero-knowledge tokens and belongs to P j Zero-knowledge tokens Each time for the allocation of funds on the payment channel address, user P i and P j Each update of fund allocation will be performed once; for user P i The generated one belongs to P i Zero-knowledge tokens and belongs to P j Zero-knowledge tokens Belong to P i The user Pi can immediately obtain the j User P j It takes a while T2 to get it; for user P j The generated zero-knowledge token belonging to Pi and belongs to P j Zero-knowledge tokens Belong to P j User P j Can be obtained immediately, but belongs to P i User P i You also need to wait for a while before you can get it after T2; When user P j To redistribute funds in a payment channel address, the operation is as follows: User P j Generate a timed verifiable time commitment (C VTD , π VTD ), in C VTD The secret value y hidden in the commitment value Y is stored in it, and it is ensured that anyone can obtain the secret value y after a long operation of time T2, through π VTD Can prove C VTD Preserve the correctness of the secret value y hidden by the commitment value Y; User P j Generate a zero-knowledge proof π Update , prove the following: The original zero-knowledge token Among them, pk 2-PC is the payment channel address, pk j For user P j Address, for The corresponding plaintext amount, is the old serial number, for The corresponding unique serial number; old serial number in is a random number; The original zero-knowledge token Among them, pk 2-PC is the payment channel address, pk i For user P i Address, for The corresponding plaintext amount, is the old serial number, for The corresponding unique serial number; old serial number in is a random number; Newly generated zero-knowledge tokens Among them, pk 2-PC is the payment channel address, pk j For user P j Address, for The corresponding plaintext amount, for The corresponding unique serial number, for The corresponding unique serial number; New Serial Number in A newly generated random number; Newly generated zero-knowledge tokens Among them, pk 2-PC is the payment channel address, pk i For user P i Address, for The corresponding plaintext amount, for The corresponding unique serial number, for The corresponding unique serial number, Y is C VTD The commitment value corresponding to the secret value stored in; New Serial Number in A newly generated random number; Zero-knowledge tokens Exists in the Merkle tree with rt as the root; Zero-knowledge tokens Exists in the Merkle tree with rt as the root; The public parameters are: The secret parameters are Then, user P j Using its pk 2-PC Part of the private key For the above public parameters and π Update Sign and generate signature Afterwards, user P j The public parameter, π Update , and (C VTD , π VTD )Sent to user P off-chain i ; User P i The public parameters, π Update and σ Update Sent to the blockchain system, and then the nodes on the blockchain verify π through public parameters Update and σ Update The correctness of the transaction, if it is correct, the transaction will be recorded on the blockchain; When user P i When redistributing funds in a payment channel address, the operations performed are similar to those of P j Exactly the same, except that the original operations are swapped, that is, P is required j Change the operation to P i , requires P i Change the operation to P j .

5. A payment channel privacy protection method based on zero-knowledge proof as claimed in claim 1, characterized in that: Step 4 includes: Step 4.1: Withdraw old fund allocation; To prevent one party from publishing an old fund allocation transaction, the old fund allocation should be withdrawn after the new fund allocation transaction is generated. i Zero-knowledge tokens Transfer to P j Zero-knowledge tokens The old version belongs to P j Zero-knowledge tokens Transfer to P i Zero-knowledge tokens When retrieving the old version of P j Zero-knowledge tokens When P j The operations performed are as follows: User P j Generate a zero-knowledge proof π Rev , prove the following: The original zero-knowledge token Among them, pk 2-PC is the payment channel address, pk j For user P j The address of v j for The corresponding plaintext amount, is the old serial number, for The corresponding unique serial number, Y is C VTD The commitment value corresponding to the secret value stored in; old serial number in is the old random number; Newly generated zero-knowledge tokens Among them, pk j For user P j Address, pk i For user P i The address of v j for The corresponding plaintext amount, for The corresponding unique serial number, for The corresponding unique serial number; New Serial Number in A newly generated random number; The public parameters are The private parameter is pk 2-PC , p ki , v j , Then, user P j Use pk j The corresponding private key sk j For public information and π Rev Sign and generate signature σ Rev ; Afterwards, user P j The public parameters, π Rev and σ Rev Sent to user P off-chain i ; When user P j When publishing old transactions, P i The public parameters, π Rev and σ Rev Sent to the blockchain system, and then the nodes on the blockchain verify π through public parameters Rev and σ Rev The correctness of the transaction. If it is correct, the transaction will be recorded on the blockchain to protect its legal rights and interests. When retrieving the old version of P i Zero-knowledge tokens When P i The operations performed are similar to P j Same.

6. A payment channel privacy protection method based on zero-knowledge proof as claimed in claim 1, characterized in that: Step 5 includes: When user P i and P j After the transaction is completed, both parties can publish the latest off-chain transaction to the chain. After being confirmed by the blockchain node, the payment channel is completely closed.

Images