Data fair transaction method based on zero-knowledge proof and smart contract

Abstract

The invention relates to the technical field of transaction, and discloses a zero-knowledge proof and smart contract-based data fair transaction method, which comprises the following steps of: firstly, generating public safety parameters based on a secp256k1 elliptic curve; the two transaction parties negotiate the selling price of the transaction data, the two transaction parties agree on the unique feature marking one piece of data, the data purchased by the data buyer is in one-to-one correspondence with the features of the marked data, the features are recorded as Mark.Mark and are recorded as public information, and the seller encrypts the data and transmits a ciphertext to the buyer through a chain; selecting public parameters of the zero-knowledge proof protocol through Setup; a random secret key is generated through the Prover; the buyer verifies the authenticity of the ciphertext and performs data verification; and after the data verification is passed, the buyer and the seller perform data transaction. According to the invention, the fairness, the security and the transaction efficiency of the transaction are improved.

Description

Technical Field

[0001] The present invention relates to the field of transaction technology, and in particular to a data fair transaction method based on zero-knowledge proof and smart contracts. Background Art

[0002] With the development of the information age, data is everywhere and plays an increasingly important role in people's lives: such as search engine history, smart device collection records, etc., and returns to provide better services, such as merchant platforms can improve the accuracy of product recommendations based on user data. The rapid appreciation of the value of big data has led to the rapid development of the data trading market. Data trading is also known as the transaction of digital assets. That is, the seller sells some data to the buyer at a certain price. In a transaction, when the buyer receives the desired data, the seller gets the corresponding purchase money. Then the data transaction is considered fair. However, data trading involves distrust between participants, which may lead to a deadlock in data trading. For example, the buyer is unwilling to pay before the seller ships the goods, and the seller is unwilling to send the data before the buyer pays.

[0003] Traditional trusted third-party data fair trading schemes often face single point failures, data leakage, and even the third party itself will do evil, which greatly reduces the security of the trading scheme. After Satoshi Nakamoto formally proposed Bitcoin, blockchain technology has developed rapidly, and many scholars have focused on combining the distributed ledger characteristics of blockchain to replace traditional trusted third parties to achieve fair trading. A model that realizes fair data trading by transmitting encrypted data off-chain and conducting data transactions on-chain, combined with blockchain, has been widely used. This model mainly includes three stages: data negotiation, data verification, and atomic exchange. The data verification stage and the atomic exchange stage determine whether the data transaction can be successful. Specifically, in the data negotiation stage, the buyer and seller agree on the price of the data, and the seller sends the corresponding ciphertext of the encrypted data to the buyer; in the data verification stage, the buyer verifies the correctness of the data; in the atomic exchange stage, the buyer and seller either exchange the decryption key and the purchase price at the same time, that is, the buyer obtains the decryption key, opens the data ciphertext, obtains the data, and the seller obtains the purchase price in the negotiation stage, and the transaction is successful; or no exchange occurs, and the transaction is declared a failure. On the basis of this model, a fair data transaction scheme based on blockchain is proposed; for example, "A data transaction method based on blockchain", application number: CN202211192099.0, this invention provides a data transaction method based on blockchain, which belongs to the field of blockchain data transaction technology, and its technical solution is:

[0004] Step 1: Build a distributed data transaction method that does not require the participation of a third party, and make both parties of the data transaction anonymous. Users can sell data as data owners to earn revenue, or they can purchase the data they need as data consumers.

[0005] Step 2: Use the private blockchain to register the user's verification record transaction record and data score, and provide a reference for data buyers before purchasing data;

[0006] Step 3: Obtain a fair random number through hashing;

[0007] Step 4: Use the Ethereum smart contract transaction to decrypt the data key. Add a process to verify the decryption key in the Ethereum contract. Only when the data owner provides the correct decryption key can the transaction currency be obtained. The data consumer obtains the private key and data plaintext through calculation.

[0008] Regarding the above application, there are the following problems:

[0009] 1. Low efficiency. In addition to encrypting the original data, the seller also needs to encrypt the cut data blocks. The number of encryptions by the seller increases with the number of blocks. When fine-grained blocks are used, the efficiency of the scheme will be very low.

[0010] 2. Low security may cause transaction data leakage. During the data verification stage, the buyer can obtain part of the original data by decrypting some data blocks with the key provided by the seller. If the buyer randomly selects too many encrypted data blocks, the authenticity of the data will be improved, but the data information will be leaked more; if the buyer randomly selects too few encrypted data blocks, although the data information leakage will be reduced, the authenticity of the data will be reduced, and the trust problem cannot be solved.

[0011] 3. Low fairness. ① In the data verification stage, after decrypting and verifying some data blocks, the buyer can obtain part of the data and unilaterally withdraw from the transaction, causing the transaction to fail. In addition, malicious sellers can repeat the above process many times and obtain part of the data each time, thereby obtaining most of the original data and causing data leakage.

[0012] In order to solve the security and fairness problems existing in the above schemes, the present invention proposes a fair data trading scheme based on zero-knowledge proof and smart contracts, which makes the whole transaction process more secure and reliable. Summary of the invention

[0013] The purpose of the present invention is to solve the above-mentioned problems in the prior art and provide a data fair transaction method based on zero-knowledge proof and smart contract. The present invention uses zero-knowledge proof technology to verify the authenticity of data without leaking data information; and uses smart contracts to achieve the simultaneous exchange of the decryption key of the data ciphertext and the data purchase payment. This improves the fairness, security and efficiency of transactions.

[0014] The present invention is achieved through the following technical solution: comprising the following steps:

[0015] S 1 : Based on the secp256k1 elliptic curve, public security parameters are generated; the discrete logarithm on the elliptic curve can be described as given a point P and another point Q on the elliptic curve, it is difficult to find an integer n such that nP=Q, which has a high security guarantee. Secp256k1 is an elliptic curve based on the Fp finite field. Due to the particularity of its special structure, its optimized implementation can improve the performance of other curves by 30%, and has the following two advantages: ① It occupies very little bandwidth and storage resources, and the key length is very short. ② Allow all users to use the same operation to complete domain operations. It is a relatively secure elliptic curve, so the present invention uses the elliptic curve secp256k1;

[0016] The public security parameters based on the secp256k1 elliptic curve include:

[0017] p: prime number, representing the modulus of the finite field Fp, p = 2^256-2^32-977;

[0018] a, b: constants in the finite field Fp, defining the equation of the elliptic curve, where the equation of the secp256k1 curve is y^2=x^3+7;

[0019] G: base point, a point on an elliptic curve. The public and private keys are constructed from the base point. On the secp256k1 curve, the coordinates of G are:

[0020] Gx=0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798;

[0021] Gy=0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8;

[0022] n: the order of point G on the elliptic curve;

[0023] n=0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141;

[0024] h: a constant in the finite field Fp, h=1.

[0025] S 2 : The two parties to the transaction negotiate on the selling price of the transaction data. The two parties to the transaction agree to mark the unique characteristics of a piece of data. The data purchased by the data buyer corresponds to the characteristics of the marked data one by one, where the characteristics are recorded as Mark.Mark, and the characteristics are recorded as public information. The seller encrypts the data and transmits the ciphertext to the buyer through the chain; the data is encoded according to the national secret algorithm SM2 standard and converted into an integer form on a finite field. The integer is recorded as m. After the buyer receives the data, m is decoded according to the SM2 standard to restore the original data.

[0026] S 3 : Through Setup, select the public parameters of the zero-knowledge proof protocol; zero-knowledge proof is that the prover can convince the verifier that a certain assertion is correct without providing any useful information to the verifier, thus achieving zero information leakage. With the development and maturity of blockchain technology, zero-knowledge proof technology has been widely used in the blockchain field, including privacy protection, identity authentication, verifiable computing and other aspects.

[0027] S 4 : Generate a random key through Prover;

[0028] S 5 : The buyer verifies the authenticity of the ciphertext and performs data verification;

[0029] S 6 : After the data verification is passed, the buyer and seller conduct data transactions. The specific steps are as follows:

[0030] S 6.1 :First, the key is split, and the seller provides the decryption key k or uses the buyer's information about k;

[0031] The seller divides the key k into two parts, k1 and k2, where k = k1 + k2. The seller first sends k1 to the buyer through a secure channel.

[0032] S 6.2 :After the buyer receives k1, he starts to deploy the smart contract on the network; when deploying the smart contract, it includes Input to represent the input variable. When Input satisfies Input*G=K-k1*G, the buyer sends the purchase money M to the seller's account;

[0033] When the trading time expires, the buyer sends the purchase amount M back to the buyer's own account.

[0034] A smart contract is a programming paradigm based on blockchain technology that enables decentralized trusted computing. A smart contract is a program written as code that can be deployed to a blockchain network to automatically execute protocols, transactions, and other operations without human intervention.

[0035] The encryption in the smart contract uses a commitment scheme, which is a cryptographic technique for committing to a value to others without revealing the specific content of the value. It can be regarded as a digital envelope that contains a secret message, but the envelope can only be opened and the message revealed after the public secret key is disclosed.

[0036] S 6.3 : Under the judgment of the smart contract, an atomic transaction is carried out. The buyer obtains k2 through monitoring the network and can recover the decryption key k together with k1 in hand. By decrypting E(m) with the key k to obtain the original data m, the transaction is successful.

[0037] Before the trading timeout, if the key k2 sent by the seller still cannot pass the verification of the smart contract, the transaction fails.

[0038] Further, in step S 3 The public parameters specifically include:

[0039] G: The base point of the secp256k1 curve;

[0040] Mark: Used to represent the unique feature of the data m, satisfying that Mark is not equal to G or K or R. Among them, the generation methods of G and Mark are as follows:

[0041] Generate G: Obtained from the parameters of the secp256k1 curve;

[0042] Generate Mark: Map the data m to the elliptic curve to get the point Mark = m * G;

[0043] The parameters G and Mark generated in the Setup phase are publicly known.

[0044] Further, in step S 4 A random key k is generated, (0 <= k < n), where n is the order of the elliptic curve. The data m is encrypted with the random key k using the one-time pad encryption method: E(m) = k + m;

[0045] Generate K: Then map the random key k to the elliptic curve to get the point K = k * G;

[0046] The advantage of using a one-time pad to encrypt data m is that it has high security, because the key is completely random and is only used once, making it difficult for cryptanalysts to crack the encrypted information by analyzing the ciphertext;

[0047] Generate proof = (E(m), K) and send the proof to the data buyer; the proof generated in the Prover stage includes two parameters E(m) and K.

[0048] Furthermore, in step S 5 , follow these steps:

[0049] S 5.1 :The buyer verifies whether the equation E(m)*G=Mark+K holds; where Mark corresponds to E(m), where Mark is the unique identifier corresponding to data m, and E(m) is the encryption algorithm of data m. Formula (1) is used to prove that the encryption object of the one-time encryption algorithm E(m) is m without leaking the plaintext data m, thus completing the data authenticity verification process;

[0050] E(m)*G=(k+m)*G=k*G+m*G=Mark+K Formula (1)

[0051] At the same time, without revealing the key k, it is proved that the encryption key of E(m) is k. In the subsequent transaction process, when the seller provides k, the buyer can decrypt E(m) and obtain data m.

[0052] S 5.2 :After receiving the proof, the buyer verifies the above equation. If the equation is true, it means the verification is successful, the encrypted data sent by the seller is correct, and the buyer agrees to enter the next stage of the transaction;

[0053] If the equation does not hold, it proves that the encrypted data sent by the data seller is incorrect and the transaction fails.

[0054] Compared with the prior art, the beneficial effects of the present invention include:

[0055] 1. Zero-knowledge proof is achieved through the commitment scheme. Zero-knowledge proof means that the prover can convince the verifier that a certain assertion is correct without providing any useful information to the verifier, thus achieving zero information leakage and ensuring that the plaintext data will not be exposed before the data transaction is completed. At the same time, combined with smart contracts, the decryption key and the purchase money can be exchanged simultaneously to achieve fair data transactions.

[0056] 2. The data obtained by the buyer is the data agreed upon during the negotiation phase. The data delivery and the purchase price delivery must occur at the same time, that is, atomic exchange is maintained. The plaintext data will not be leaked before the transaction is completed. The decryption key provided by the seller must be authentic and valid, which improves the fairness of the transaction process.

[0057] 3. The buyer only needs to verify once to determine whether E(m)*G=K+M is true to complete the verification process, which greatly reduces the buyer's computing overhead and improves the efficiency of the solution. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 is a flow chart of the method of the present invention;

[0059] Figure 2 It is a schematic diagram of the data negotiation and verification process of the present invention;

[0060] Figure 3 A schematic diagram of the internal diagram of a smart contract of the present invention;

[0061] Figure 4 This is a diagram of the data transaction process of the present invention. DETAILED DESCRIPTION

[0062] The present invention is further described in detail below in conjunction with the accompanying drawings:

[0063] refer to Figure 1-4 As shown, the data fair transaction method based on zero-knowledge proof and smart contract provided by the present invention includes the following steps: Figure 1 As shown:

[0064] S 1 : Based on the secp256k1 elliptic curve, public security parameters are generated; the discrete logarithm on the elliptic curve can be described as given a point P and another point Q on the elliptic curve, it is difficult to find an integer n such that nP=Q, which has a high security guarantee. Secp256k1 is an elliptic curve based on the Fp finite field. Due to the particularity of its special structure, its optimized implementation can improve the performance of other curves by 30%, and has the following two advantages: ① It occupies very little bandwidth and storage resources, and the key length is very short. ② Allow all users to use the same operation to complete domain operations. It is a relatively secure elliptic curve, so the present invention uses the elliptic curve secp256k1;

[0065] The public security parameters based on the secp256k1 elliptic curve include:

[0066] p: prime number, representing the modulus of the finite field Fp, p = 2^256-2^32-977;

[0067] a, b: constants in the finite field Fp, defining the equation of the elliptic curve, where the equation of the secp256k1 curve is y^2=x^3+7;

[0068] G: base point, a point on an elliptic curve. The public and private keys are constructed from the base point. On the secp256k1 curve, the coordinates of G are:

[0069] Gx=0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798;

[0070] Gy=0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8;

[0071] n: the order of point G on the elliptic curve;

[0072] n=0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141;

[0073] h: a constant in the finite field Fp, h=1.

[0074] like Figure 2 , S 2 : The two parties to the transaction negotiate on the selling price of the transaction data. The two parties to the transaction agree to mark the unique characteristics of a piece of data. The data purchased by the data buyer corresponds to the characteristics of the marked data one by one, where the characteristics are recorded as Mark.Mark, and the characteristics are recorded as public information. The seller encrypts the data and transmits the ciphertext to the buyer through the chain; the data is encoded according to the national secret algorithm SM2 standard and converted into an integer form on a finite field. The integer is recorded as m. After the buyer receives the data, m is decoded according to the SM2 standard to restore the original data.

[0075] S 3 : Through Setup, select the public parameters of the zero-knowledge proof protocol; zero-knowledge proof is that the prover can convince the verifier that a certain assertion is correct without providing any useful information to the verifier, thus achieving zero information leakage. With the development and maturity of blockchain technology, zero-knowledge proof technology has been widely used in the blockchain field, including privacy protection, identity authentication, verifiable computing and other aspects.

[0076] In step S 3 The public parameters include:

[0077] G: base point of curve secp256k1;

[0078] Mark: It is used to represent the unique feature of data m, and satisfies that Mark is not equal to G or K or R. Among them, the generation methods of G and Mark are as follows:

[0079] Generate G: Obtained from the parameters of the secp256k1 curve;

[0080] Generate Mark: Map the data m to the elliptic curve to obtain the point Mark = m * G;

[0081] The parameters G and Mark generated in the Setup phase are publicly known.

[0082] In this embodiment, in step S 4 Generate a random key k, (0 < k < n), where n is the order of the elliptic curve. Encrypt the data m with the one-time pad encryption method: E(m) = k + m;

[0083] Generate K: Then map the random key k to the elliptic curve to obtain the point K = k * G;

[0084] The advantage of encrypting the data m with the one-time pad is high security, because the key is completely random and only used once, making it difficult for cryptanalysts to crack the encrypted information by analyzing the ciphertext;

[0085] Generate proof = (E(m), K), and send the proof to the data buyer; The proof generated in the Prover phase, this proof includes two parameters E(m) and K.

[0086] S 4 : Generate a random key through the Prover;

[0087] S 5 : The buyer verifies the authenticity of the ciphertext and conducts data verification;

[0088] S 5.1 : The buyer verifies whether the equation E(m) * G = Mark + K holds; where Mark corresponds to E(m), where Mark is the unique identifier corresponding to the data m, and E(m) is the encryption algorithm of the data m. Through formula (1), it is realized that without revealing the data plaintext m, it is proved that the encryption object of the one-time pad encryption algorithm E(m) is m, and the data authenticity verification process is completed;

[0089] E(m) * G = (k + m) * G = k * G + m * G = Mark + K Formula (1)

[0090] At the same time, without revealing the key k, it is proved that the encryption key of E(m) is k. In the subsequent transaction process, when the seller provides k, the buyer can decrypt E(m) and obtain data m.

[0091] S 5.2 :After receiving the proof, the buyer verifies the above equation. If the equation is true, it means the verification is successful, the encrypted data sent by the seller is correct, and the buyer agrees to enter the next stage of the transaction;

[0092] If the equation does not hold, it proves that the encrypted data sent by the data seller is incorrect and the transaction fails.

[0093] S 6 : After the data verification is passed, the buyer and seller conduct data transactions. The specific steps are as follows:

[0094] S 6.1 :First, the key is split, and the seller provides the decryption key k or uses the buyer's information about k;

[0095] The seller divides the key k into two parts, k1 and k2, where k = k1 + k2. The seller first sends k1 to the buyer through a secure channel.

[0096] S 6.2 :After the buyer receives k1, he starts to deploy the smart contract on the network; when deploying the smart contract, it includes Input to represent the input variable. When Input satisfies Input*G=K-k1*G, the buyer sends the purchase money M to the seller's account;

[0097] When the transaction time expires, the buyer will send the purchase money M back to the buyer's own account.

[0098] like Figure 3 , where smart contracts are a programming paradigm based on blockchain technology that can achieve decentralized trusted computing. Smart contracts are a program written in code that can be deployed on a blockchain network to automatically execute agreements, transactions, and other operations without human intervention;

[0099] The encryption in the smart contract adopts the commitment scheme, which is a cryptographic technique used to promise a value to others without revealing the specific content of the value. It can be regarded as a digital envelope containing a secret message, but only after the secret key is disclosed can the envelope be opened and the information be disclosed.

[0100] like Figure 4 , S 6.3:Atomic transactions are carried out under the judgment of smart contracts. The buyer obtains k2 through monitoring the network, and can recover the decryption key k with k1 in hand. E(m) is decrypted by key k to obtain the original data m, and the transaction is successful;

[0101] If the key k2 sent by the seller still cannot be verified by the smart contract before the transaction times out, the transaction fails.

[0102] In this embodiment, by constructing a zero-knowledge proof scheme, it is possible to prove that the encrypted object of the encryption algorithm E(m) is m without exposing the data m and the encryption key k. During the entire data verification stage, the buyer only has the ciphertext E(m), the commitment K of the decryption key k, and the relevant information of the commitment A of the data m according to the received proof. No information about the data m is leaked, which ensures that the data will not be leaked before the transaction is completed. ② Through the key splitting mechanism, the key k is divided into two parts and sent separately, which avoids the key k being exposed in the network in plain text and effectively protects k. ③ Through smart contracts, the traditional trusted third party role is replaced. In the data transaction stage, the present invention uses the binding relationship between K and k=k1+k2. The smart contract only needs to verify whether k2*G=K-k1*G is established to ensure that the key presented by the seller to the smart contract must be a true key, otherwise the seller cannot receive the purchase money M. ④ The present invention only needs to encrypt the data m once, and there is no need to divide m into multiple blocks and encrypt them separately and then decrypt and verify them, which greatly improves the overall efficiency of the scheme.

[0103] In this embodiment, the security and fairness of the present invention, in this embodiment, the cheating method of the seller is analyzed, including encrypting fake data m' and delivering fake key k2';

[0104] Targeted analysis: If the seller commits fraud by encrypting false data m', the buyer will find during the data verification phase that the equation E(m)*G=K+Mark does not hold, thereby interrupting the transaction; if the seller delivers a false key k2', during the data transaction phase, the smart contract verifies that the equation k2'*G=K-k1*G, but the verification still fails and the transaction is unsuccessful.

[0105] ② The buyer’s cheating methods include exiting the transaction after obtaining the encrypted data E(m) and then trying to crack the ciphertext, or cheating when the buyer deploys the smart contract and obtaining the key k2 without paying, thereby decrypting the data m;

[0106] Analysis: If the buyer tries to obtain data m by cracking the ciphertext, the buyer cannot obtain any information from the encrypted data, because the present invention adopts zero-knowledge proof, and the entire verification stage will not leak any information about data m. At the same time, the encryption scheme adopts a one-time one-key method, which is very secure and the buyer is unlikely to successfully crack the ciphertext. When the buyer deploys the smart contract, he modifies the equation to be verified to Input*G=K-k1'*G. Then, when the seller sends k2, the smart contract will still fail to verify, the transaction cannot be passed, and the seller cannot get the purchase money M. Since the internal state of the smart contract is visible, the buyer can obtain k2 and restore k with k1 in his hand, thereby decrypting E(m) and obtaining m. However, it is precisely because the internal state of the Judger is visible and the seller knows the information such as K, G, and k1, that the seller will calculate the result of K-k1*G locally in advance before sending k2 to the judge and compare it with the result of the equation K-k1'*G verified by the judge. If the comparison is inconsistent, it means that the buyer cheated when deploying the smart contract Judger, then the seller will not send k2 to Judger, thus avoiding the situation where the buyer gets the key k2 without paying.

[0107] ③Analysis of smart contract judges

[0108] Since any behavior and internal state of a smart contract can be read by anyone, nodes in the entire blockchain network will cause information leakage during the transaction by reading the smart contract, such as the leakage of the decryption key k. However, since the ciphertext E(m) is transmitted off-chain, the information of E(m) will not be leaked from the chain. Even if other nodes monitor the smart contract, they can only obtain k2, but cannot decrypt and obtain data m.

[0109] In summary, compared with the existing transaction schemes, the present invention avoids the leakage of data information during the data verification stage, which greatly reduces the motivation of buyers and sellers to do evil at this stage. In addition, during the atomic exchange stage, the present invention changes the judgment of the authenticity of the key from the buyer to the smart contract, which reduces the possibility of buyers and sellers doing evil at this stage and improves the fairness of the scheme.

[0110] In this embodiment, the efficiency of this solution is analyzed:

[0111] In the data verification phase, the current corner method needs to split the original data m into n blocks, encrypt each data block with ki (0 < i <= n), and then encrypt the key ki again separately with the public key pk, for a total of 2n encryptions. The present invention only needs to encrypt m once and adopts a one-time pad scheme, greatly improving the encryption efficiency. In addition, in the current trading method, the seller also needs to calculate a random seed through a hash function, generate j random numbers, and select partial keys. After encryption, the seller needs to send 2n encrypted blocks, partial keys, etc. to the buyer. After receiving the encrypted blocks, the buyer still needs to perform one hash calculation and j decryptions to complete the verification. In the present invention, the buyer only needs to perform one verification to determine whether E(m) * G = K + M holds to complete the verification process, greatly reducing the computational overhead of the buyer and improving the efficiency of the scheme.

[0112] The above technical solution is only one implementation manner of the present invention. For those skilled in the art, based on the disclosed principle of the present invention, it is very easy to make various types of improvements or deformations, not limited to the technical solution described in the above specific embodiments of the present invention. Therefore, the foregoing description is only preferred and does not have a restrictive meaning.

Claims

1. A data fair transaction method based on zero-knowledge proof and smart contract, characterized in that: It includes the following steps: S1: Generate public security parameters based on the secp256k1 elliptic curve; S2: The two trading parties negotiate the selling price of the transaction data. The two trading parties agree to mark the unique characteristics of a piece of data. The data purchased by the data buyer corresponds one-to-one with the characteristics of the marked data. The characteristics are denoted as Mark.Mark, and the characteristics are recorded as public information. The seller encrypts the data and transmits the ciphertext to the buyer off-chain; S3: Through Setup, select the public parameters of the zero-knowledge proof protocol; S4: Generate a random key by the Prover; S5: The buyer verifies the authenticity of the ciphertext and conducts data verification; S6: After the data verification passes, the buyer and the seller conduct a data transaction.

2. The data fair transaction method based on zero-knowledge proof and smart contract according to claim 1 is characterized in that: In step S1, the public security parameters specifically include: p: A prime number representing the modulus of the finite field Fp, p = 2^256 - 2^32 - 977; a, b: Constants in the finite field Fp, defining the equation of the elliptic curve. The equation of the secp256k1 curve is y^2 = x^3 + 7; G: The base point, a point on the elliptic curve. Public keys and private keys are constructed through the base point. On the secp256k1 curve, the coordinates of G are: Gx = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798; Gy = 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8; n: The order of point G on the elliptic curve; n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141; h: A constant in the finite field Fp, h = 1.

3. The data fair transaction method based on zero-knowledge proof and smart contract according to claim 1 is characterized in that: In step S2, the data is encoded according to the national cryptographic algorithm SM2 standard and converted into an integer form on the finite field. This integer is denoted as m. After the buyer receives the data, the original data is restored by decoding m according to the SM2 standard.

4. The data fair transaction method based on zero-knowledge proof and smart contract according to claim 1 is characterized in that: In step S3, the public parameters specifically include: G: The base point of the curve secp256k1; Mark: Used to represent the unique characteristics of data m, satisfying Mark is not equal to G or K or R. Among them, the generation methods of G and Mark are as follows: Generate G: Obtained from the parameters of the secp256k1 curve; Generate Mark: Map the data m to the elliptic curve to get the point Mark = m*G; The parameters G and Mark generated in the Setup phase are publicly known.

5. The data fair transaction method based on zero-knowledge proof and smart contract according to claim 1 is characterized in that: In step S4, generate a random key k, (0 <= k < n), where n is the order of the elliptic curve. Encrypt the data m with the random key k using the one-time pad encryption method: E(m) = k + m; Generate K: Then map the random key k to the elliptic curve to get the point K = k*G; Generate proof = (E(m), K) and send the proof to the data buyer; the proof generated in the Prover stage includes two parameters E(m) and K.

6. The data fair transaction method based on zero-knowledge proof and smart contract according to claim 1 is characterized in that: In step S5, the following steps are specifically performed: S 5.1 :The buyer verifies whether the equation E(m)*G=Mark+K holds; where Mark corresponds to E(m), where Mark is the unique identifier corresponding to data m, and E(m) is the encryption algorithm of data m. Formula (1) is used to prove that the encryption object of the one-time encryption algorithm E(m) is m without leaking the plaintext data m, thus completing the data authenticity verification process; E(m)*G=(k+m)*G=k*G+m*G=Mark+K Formula (1) At the same time, without revealing the key k, it is proved that the encryption key of E(m) is k. In the subsequent transaction process, when the seller provides k, the buyer can decrypt E(m) and obtain data m. S 5.2 :After receiving the proof, the buyer verifies the above equation. If the equation is true, it means the verification is successful, the encrypted data sent by the seller is correct, and the buyer agrees to enter the next stage of the transaction; If the equation does not hold, it proves that the encrypted data sent by the data seller is incorrect and the transaction fails.

7. The data fair transaction method based on zero-knowledge proof and smart contract according to claim 6 is characterized in that: In step S6, the following steps are specifically performed: S 6.1 :First, the key is split, and the seller provides the decryption key k or uses the buyer's information about k; The seller divides the key k into two parts, k1 and k2, where k = k1 + k2. The seller first sends k1 to the buyer through a secure channel. S 6.2 :After the buyer receives k1, he starts to deploy the smart contract on the network; S 6.3 : Perform atomic transactions under the judgment of smart contracts.

8. The data fair transaction method based on zero-knowledge proof and smart contract according to claim 7 is characterized in that: In step S 6.2 In the deployment of smart contracts, Input is included to represent input variables. When Input satisfies Input*G=K-k1*G, the buyer sends the purchase amount M to the seller's account. When the transaction time expires, the buyer will send the purchase money M back to the buyer's own account.

9. The data fair transaction method based on zero-knowledge proof and smart contract according to claim 7 is characterized in that: In step S 6.3 In the process, the buyer obtains k2 through monitoring the network, and can recover the decryption key k with k1 in his hand. Then, he can decrypt E(m) with the key k and obtain the original data m, and the transaction is successful. If the key k2 sent by the seller still cannot be verified by the smart contract before the transaction times out, the transaction fails.

Images