Decentralized group signature-based traceable anonymous alliance chain construction method and system

Abstract

The invention discloses a traceable anonymous alliance chain construction method and a traceable anonymous alliance chain construction system based on decentralized group signatures, in a group signature algorithm, a group private key and a group public key are jointly calculated by a plurality of group administrator nodes, the group administrator node exceeding a threshold can issue and cancel a user private key, and the group administrator node can issue and cancel the user private key; the user signs the information on behalf of the group members through the private key and the group public key of the user, so that the effect of hiding the user identity is achieved, the group administrator node exceeding the threshold can open the signature to trace the user identity, and thus distributed user identity tracing is realized. In the traceable anonymous alliance chain construction method, an alliance chain is jointly maintained by a plurality of organizations, a plurality of group administrator nodes jointly calculate and generate a secret key in each organization, and when a user private key needs to be issued and revoked and a user identity needs to be traced, group administrators exceeding a threshold need to be combined to use respective private keys to jointly complete the operation. And a decentralized traceable anonymous block chain is realized.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and relates to a threshold group signature algorithm and a traceable anonymous alliance chain construction method and system, and specifically to a traceable anonymous alliance chain construction method and system based on decentralized group signature. Background Art

[0002] Blockchain technology is instantiated as public chains (e.g., Bitcoin and Ethereum) and consortium chains (e.g., Fabric and Corda). In a consortium chain, blockchain nodes are a group of known entities, and transactions are verified by and open to specific blockchain nodes. Consortium chains usually involve real-world organizational alliances and are widely adopted in finance, the Internet of Things, and credit systems. Due to the sensitivity of transactions in many real-world systems, amount privacy and identity privacy in blockchains have received widespread attention. Amount privacy mainly involves the amount transferred in a transaction, and identity privacy mainly involves the payer and payee of a transaction. Although public chains have many practical privacy protection solutions, they cannot be ported to consortium chains due to different identity management strategies. Therefore, it is necessary to design an anonymous consortium chain.

[0003] Existing anonymous consortium chains can be divided into two categories: non-traceable and traceable. In a non-traceable blockchain, no node knows the identity of the payer or payee. However, in practice, a traceability mechanism is usually required because malicious blockchain nodes may misbehave in an anonymous setting. In a traceable consortium chain, the payer and payee are anonymous, but some entities can disclose their identities in certain circumstances. These solutions use technologies such as anonymous credentials, zero-knowledge proofs, or group signatures. However, these solutions rely on trusted parties to issue user private keys or trace user identities, resulting in security bottlenecks in the system.

[0004] The use of a decentralized group signature algorithm can effectively solve the above problems. The alliance system involves an alliance of organizations, each of which contains multiple group administrators and users. These organizations have launched many nodes called consensus nodes. The consensus node maintains a blockchain consisting of many blocks, each of which contains multiple transactions, and the first block is called the genesis block. The consensus node initializes the blockchain system by generating public parameters and generating a genesis block. Then, they provide registration services to the organization. After registering the organization to the consensus node, the group administrator collaborates to issue and revoke private keys for users. Each user generates transactions on behalf of their organization and sends them to the group administrator, who then forwards them to the consensus node for consensus. In addition, the group administrator maintains transactions locally for users to trace back. Therefore, decentralized organization registration, user private key issuance and transaction tracing can be achieved, and users can upload transactions anonymously through the group signature algorithm. Summary of the invention

[0005] In order to solve the problems that the existing traditional group signature technology cannot be completed in a decentralized environment, the central node is easily attacked or maliciously used, and some schemes have low issuance, revocation and tracing efficiency, resulting in security bottlenecks in anonymous blockchains and low alliance chain operation efficiency, the present invention provides a traceable anonymous alliance chain construction method and system based on decentralized group signature.

[0006] The technical solution adopted by the decentralized group signature method of the present invention is: a decentralized group signature method, including group key generation, issuance of user private keys, revocation of user private keys, user signature, signature verification and user identity tracing process;

[0007] The group key generation: all group administrators in the group use a distributed method to generate the group public key and group private key. Each group administrator holds a shard of the group private key and makes the public key public. Only group administrators exceeding the threshold can recover the group private key.

[0008] The issuing of user private keys, based on the user's identity information, exceeds a threshold number of group administrators using group private key shards to jointly issue user private keys to users;

[0009] The revocation of user private keys, based on the identity information of the user to be revoked, exceeds the threshold and the group administrator can revoke one or more user private keys. The revoked user private keys will not be able to be used to generate valid signatures;

[0010] The user signature, based on the group public key and the user private key, the user signs the identity information, and the signature does not expose the user's identity information;

[0011] The verification signature is based on the group public key, user identity information and corresponding signature. Any node verifies the validity of the signature, that is, whether the signature is generated by a legitimate user;

[0012] The user identity is traced back to the signature. If more than a threshold number of group administrators use the group private key to collaboratively open the signature and obtain the identity information of the signing user, based on the signature.

[0013] As a preferred embodiment, for group key generation, all group administrators in the group generate group public keys and group private keys in a distributed manner according to security parameters.

[0014] Preferably, the user private key is issued, and more than a threshold number of group administrators use the group public key and their own group private key fragments to process the user identity information, and return the processed information to the user. The user obtains the user private key after aggregation and processing, and the group administrator maintains the identity information of all users.

[0015] Preferably, the revoking of the user private key is based on the identity information of the user to be revoked. A threshold number of group administrators use the group public key and their own group private key fragments to process the user identity information, and then revoke the corresponding user private key. The revoked user private key cannot be used to generate a valid signature.

[0016] As a preferred method, the user identity is traced back to the user's signature. When the number of group administrators exceeds the threshold, they use the group public key and their own group private key to process the user information, and then summarize the information related to the user identity, and then find the identity information in the user list through the information, so as to obtain the information of the signer.

[0017] The technical solution adopted by the decentralized group signature system of the present invention is: a decentralized group signature system, comprising:

[0018] one or more processors;

[0019] A storage device is used to store one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement the decentralized group signature method.

[0020] The technical solution adopted by the traceable anonymous alliance chain construction method of the present invention is: a traceable anonymous alliance chain construction method based on decentralized group signature, including blockchain initialization, organization registration, user private key issuance and transaction generation process;

[0021] The blockchain initialization involves consensus nodes and multiple organizations that serve as chain administrators in the alliance chain. The consensus node completes the initialization phase; the consensus node generates system parameters and an organization list, which is used to store and update information about all participating organizations in the system, and then writes this information into the genesis block;

[0022] After the organization registration and blockchain initialization steps are completed, each organization registers information with the consensus node, and each organization corresponds to a group in the decentralized group signature method; first, all group administrator nodes in the organization generate a group public and private key pair and an empty user list, where the user list is used to store the identities of all users in the organization and information to assist in tracing the user identities; then, the group administrator sends the group public key and organization identifier to the consensus node; after receiving the message, the consensus node updates the organization list, and records the update of the organization list and the initialization of the user list of the organization on the chain;

[0023] The user private key is issued. The user sends his or her identity information to the group administrator node. Then, more than a threshold number of group administrator nodes issue the user private key to the user, and update the user list in the organization. At the same time, the update is sent to the consensus node, which records it on the chain.

[0024] In the generated transaction, each user can transfer money to multiple users at one time, and the receiver sends the transfer amount and commitment, encrypted information and the group public key of the receiver's group to the sender; then the sender will generate a range proof of the transfer amount based on this information, and record this information in the transaction; then the transaction is signed by the group public key and the user's private key, and the transaction with a valid signature is a complete transaction; then the sender sends the transaction to the group administrator, and the group administrator verifies the transaction amount and signature and sends the transaction to the consensus node, which records the transaction on the chain after verification; after the transaction is on the chain, the receiver uses the currency of the amount by unlocking the encrypted information.

[0025] As a preference, it also includes a user private key revocation process. When a member change or malicious behavior occurs within the organization, group administrators exceeding a threshold will revoke the user's private key. After the revocation is completed, the group administrator will send the updated organization information and user information to the consensus node, and the consensus node will record this information on the chain.

[0026] As a preferred embodiment, a transaction tracing process is also included, in which group administrators exceeding a threshold open the signature of a transaction through their own private key shards, obtain the identity information of the transaction signer, find the corresponding user identity information through the additional information of the local user list, and trace the identity of the signer.

[0027] The technical solution adopted by the traceable anonymous alliance chain construction system of the present invention is: a traceable anonymous alliance chain construction system based on decentralized group signature, comprising:

[0028] one or more processors;

[0029] A storage device is used to store one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the method for constructing a traceable anonymous alliance chain based on decentralized group signatures.

[0030] The beneficial effects of the present invention include:

[0031] 1. This paper designs an efficient decentralized dynamic group signature scheme that supports threshold user private key release and revocation and user identity information disclosure. In addition, the scheme provides efficient batch revocation. Users can sign transactions on behalf of their organizations to protect identity privacy; multiple group administrators can collaborate to revoke users' private keys and disclose user identity information from signatures.

[0032] 2. The present invention designs a decentralized alliance chain architecture, which involves multiple consensus nodes and multiple organizations. The consensus nodes maintain a blockchain composed of many blocks and provide registration services for the organizations. The organizations register their identities with the consensus nodes and provide identity management services for users.

[0033] 3. The present invention designs a traceable anonymous alliance chain system. In particular, the management of organizational identity and user identity in the system is designed in a decentralized manner. Organizational identity and user identity are maintained in a decentralized manner through consensus. Therefore, trust is distributed among entities, and no entity can control the identity in the system alone. In addition, bullet proof is used to achieve the privacy of the amount in the transaction. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The technical solution of the present invention is further described below using embodiments and specific implementation methods. In addition, in the process of describing the technical solution, some drawings are also used. For those skilled in the art, other drawings and the intention of the present invention can also be obtained based on these drawings without paying creative work.

[0035] Figure 1 A schematic diagram of a method according to an embodiment of the present invention;

[0036] Figure 2 The figure is a flow chart of a method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0037] In order to facilitate the understanding and implementation of the present invention by those skilled in the art, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the implementation examples described herein are only used to illustrate and explain the present invention and are not used to limit the present invention.

[0038] Please see Figure 1 and Figure 2 , a decentralized group signature method provided in this embodiment includes group key generation, issuing user private keys, revoking user private keys, user signature, signature verification and user identity tracing process;

[0039] Group key generation: All group administrators in a group use a distributed method to generate group public keys and group private keys. Each group administrator holds a shard of the group private key and makes the public key public. Only group administrators exceeding a threshold can recover the group private key.

[0040] In one implementation, all group administrators in the group generate a group public key and a group private key in a distributed manner according to the security parameter Λ, the total number of group administrators n, and the group administrator threshold t.

[0041] According to the security parameter Λ, the total number of group managers n and the group manager threshold t, all group managers {GM1, ..., GM n}Use a distributed method to generate the group public key gpk, group private key gsk, universal reference string and local user identity information list. Each group administrator GM i (i∈1,...,n) holds the group private key shard gski , group public key gpk, universal reference string crS and local user identity information list UL i , and publish the public key gpk, crs, and initialize a public user list CL = {} and a public revocation list RL = {}. Where crs←ZKP.ZKPSetup(ck, 1 Λ ) is the public parameter generation algorithm in zero-knowledge proof technology, ck is the public verification key; π←ZKP.ZKProve(crs, (C P , c u ), (P, u), r u ) is an algorithm for generating non-membership proofs in zero-knowledge proof technology. P is a summary of an RSA accumulator that stores a set RS, c u is a Pedersen commitment to an element u, P is the product of all elements in RS, r u is the Pedersen commitment c u The random number r in u , the algorithm outputs a proof π to prove ;δ←ZKP.ZKPVrfy(crs,(C P , c u ), π) is an algorithm for verifying non-membership proofs in zero-knowledge proof technology. If π is If there is a legal proof, then output δ←1, otherwise output δ←0. Specifically:

[0042] First, the group administrator defines a hash function {0, 1} * represents a 0-1 sequence of any length, Represents a set of positive integers less than or equal to p; generates a multiplicative cyclic group G of order p, where p is a prime number of length Λ; then generates four public generators g, g1, g2, h c ∈G, and then they generate a random polynomial f∈Z of order t-1 p [X], where α = f(0)∈Z p , t is the threshold of the group administrator, α is a non-negative number set Z less than or equal to p p The random number in each group manager GM i Get h = g α and f(i); finally generate a commitment key ck and a universal reference string crs for set non-membership proof, where the generator of the commitment scheme is and g1, each group administrator GM i Get (gpk = (g, g1, g2, h, h c , vk=(gf(1) , ..., g f(n) )), The universal reference string crs and an initialized local client information list UL i .

[0043] The issuing of user private keys, based on the user's identity information, exceeds a threshold number of group administrators using group private key shards to jointly issue user private keys to users;

[0044] In one implementation, more than a threshold number of group administrators use the group public key and their respective group private key shards to process user identity information, and return the processed information to the user. The user can obtain the user's private key after the aggregate processing, and the group administrator maintains the identity information of all users.

[0045] According to the user's identity information id U , each group administrator GM i (i∈{1, ..., t′}, t′>t) Input group public key gpk, group private key gsk i , user private key sk U , all group administrators update the user list CL.

[0046] First, user U chooses a random prime number sk id ∈Z p and a random polynomial f of order t-1 id ∈Z p [X], where f id (0) = sk id ; Then the registration information Send to group administrators GM1,...,GM respectively t′ , and finally t' group administrators generate partial user private keys for users where {λ1, ..., λ t′} is the Lagrange coefficient; user obtains User private key sk U =(sk id , r2). Finally, user U will U , r1, f id (i)) Send to group administrator GM i (i∈{1,...,n}), each group manager GM i (i∈{1,...,n}) updates the public client list CL←CL∪{(id u , r1)} and private client information UL←UL∪{(id I , f id (i))}.

[0047] The revocation of user private keys, based on the identity information of the user to be revoked, exceeds the threshold and the group administrator can revoke one or more user private keys. The revoked user private keys will not be able to be used to generate valid signatures;

[0048] In one implementation, based on the identity information of the user to be revoked, more than a threshold number of group administrators use the group public key and their respective group private key shards to process the user identity information, and then revoke the corresponding user private key. The revoked user private key cannot be used to generate a valid signature.

[0049] According to the identity list id of the user to be revoked rs , each group administrator GM i (i∈{1,...,t′},t′>t) Input public key gpk, local user list UL i , universal reference string crs, updates the user revocation list and outputs the RSA accumulator value of all revoked certificates.

[0050] First, for each identity id U ∈id rs , group administrator restores user's private information Then get a collection Then use Update RL = ({rs1, ..., rs γ}, P RL , C RL ), where {rs1, ..., rs γ} is the private key of the revoked user, γ is the number of revoked users; in particular, {rs1, ..., rs γ}In the case of RL and sk rs Get (P ′ RL , C′ RL ). Finally, all group administrators can obtain the updated revocation list RL'.

[0051] The user signature, based on the group public key and the user private key, the user signs the identity information, and the signature does not expose the user's identity information;

[0052] In one embodiment, according to the group public key gpk, the user private key sk U , public message crs, message m and revocation list RL, the user outputs signature σ.

[0053] First, the user chooses a random number s, s1∈Z p and calculate the commitment value Then encrypt the message m by c1, c2, c3, c4←h c·C U , g s ,h s·H(m) Get the ciphertext ct←(c1, c2, c3, c4); then get the revocation list information rs, P RL , C RL ←RL, and then use zero-knowledge proof technology to generate non-member proof π1←ZKP.ZKProve(crs, (C RL , C U ), (P RL ,sk id ), s); Generate random numbers a1, a2, a3, a4←Z p , which is proved by the following calculation, where e() is a bilinear mapping function, c←H(m, c1, c2, c3, c4, d1, d2, d3, d4), b1←a1+c·s1, b2←a2+c·s, b3←a3+c·s1·s, b4←a4+c·sk id ,π←(C U ,π1,c,b1,b2,b3,b4), and then obtain the group signature σ←{ct,π}.

[0054] The verification signature, based on the group public key, user identity information and corresponding signature, any node can verify the validity of the signature, that is, whether the signature is generated by a legitimate user;

[0055] In one embodiment, according to the group public key gpk, the universal reference string crs, the commitment value C of all revocation information RL and a message-signature pair (m,σ), output a bit b, where 0 / 1 indicates that σ is an invalid / valid signature for message m.

[0056] First, check the ciphertext C by the following equation: First calculate If the equation e(c2, h H(m) g2) = e(c3, g) and c = H(m, ct, d′1, d′2, d′3, d′4) hold, the ciphertext is legal, and then the set non-membership proof scheme is used to determine whether the user's private key has been revoked ZKP.ZKPVrfy(crs, (C RL , C U ),π1), if the above verifications are all passed, the algorithm returns b←1, otherwise it returns b←0.

[0057] The user identity is traced back to the signature. If more than a threshold number of group administrators use the group private key to collaboratively open the signature and obtain the identity information of the signing user, based on the signature.

[0058] In one embodiment, each group manager GM i (i∈{1, ..., t′}, t′>t) Input group public key gpk and group private key gsk i , universal reference string Crs, RSA accumulator value of all revoked certificates and a message signature pair (m, σ), and output the user's identity id U .

[0059] First, each group administrator GM i Verify the group signature and stop the protocol if the message is illegal. Then they decrypt the ciphertext ct to obtain the additional information e(r′1,h). Finally, they traverse the client list CL and obtain the user identity (id U , r1), where e(r′1,h)=e(r1,h).

[0060] Please see Figure 1 and Figure 2 , this embodiment provides a traceable anonymous alliance chain construction method based on decentralized group signature, including blockchain initialization, organization registration, user private key issuance, transaction generation, user private key revocation and process;

[0061] The blockchain initialization involves consensus nodes and multiple organizations that serve as chain administrators in the alliance chain. The consensus node completes the initialization phase; the consensus node generates system parameters and an organization list, which is used to store and update information about all participating organizations in the system, and then writes this information into the genesis block;

[0062] In one implementation, the consensus node first generates system parameters pp, which include information such as the key security parameter length used to generate nodes in the system, and then generates an empty organization list OL={}, which is used to store and update information of all participating organizations in the system, including organization identifiers and organization public keys, and then through a structure called organization list node ((org, gpk), addr ol , hash ol ) to incrementally update the organization list, where org represents the organization's identifier, gpk represents the organization's public key, and addr ol Indicates the transaction address storing the organization information, hash ol Indicates the current hash value of the organization list. Finally, the initialized organization list node (null, null, H(OL)) and system parameters are written into the transaction in the genesis block;

[0063] After the organization registration and blockchain initialization steps are completed, each organization can register information with the consensus node. Each organization corresponds to a group in the decentralized group signature method. First, all group administrator nodes in the organization generate a group public and private key pair and an empty user list, where the user list is used to store the identities of all users in the organization and some information to assist in tracing the user's identity. Then, the group administrator sends the group public key and organization identifier to the consensus node. After receiving the message, the consensus node updates the organization list and records the update of the organization list and the initialization of the user list of the organization on the chain.

[0064] In one embodiment, first, all group administrator nodes in the organization generate a group public and private key pair (gpk, gsk1, ..., gsk n ) and an empty user list CL = {}. Then, the group administrator sends the group public key gpk and the organization identifier org to the consensus node. After receiving the message, the consensus node generates a new organization list node ((org, gpk), addr ol , H(OL′)) updates the list OL to OL′=OL∪{(org, gpk)}, and records the update of the organization list and initializes the user list CL of the organization on the chain, where the update of the user list is achieved by storing a data structure called user list node on the chain (org, (id, au), addr cl , H(CL)), where (id, au) is the user's identity information and auxiliary information for tracing, addr cl is the transaction address of the previous CL node, and H(CL) is the hash value of the current CL;

[0065] The user private key is issued. The user sends his or her identity information to the group administrator node. Then, more than a threshold number of group administrator nodes issue the user private key to the user, and update the user list in the organization. At the same time, the update is sent to the consensus node, which records it on the chain.

[0066] In one implementation, the user sends his or her identity information id to multiple group administrator nodes, and then more than a threshold number of group administrator nodes issue a private key sk to the user through the user private key issuance algorithm in the group signature, and generate a new user list node (org, (id, au), addr cl , H(CL′)) to update the user list CL′=CL∪{(id, au)} in the organization, and send the update to the consensus node, which records it on the chain;

[0067] The transaction is generated in such a way that each user can transfer money to multiple users at one time, and the receiver sends the transfer amount and commitment (bullet proof principle), encrypted information (hash time lock principle) and the group public key of the receiver's group to the sender; the sender then generates a range proof of the transfer amount based on this information and records this information in the transaction; the transaction is then signed by the group public key and the user's private key, and the transaction with a valid signature is a complete transaction; the sender then sends the transaction to the group administrator, who verifies the transaction amount and signature and then sends the transaction to the consensus node, which records the transaction on the chain after verification; after the transaction is on the chain, the receiver can use the currency of that amount by unlocking the encrypted information.

[0068] In one embodiment, each user can transfer money to multiple users at one time, and the receiver sends the transfer amount v and the commitment com to the sender. v , a hash value pre and the group public key gpk of the recipient's group. The sender will then generate a range proof wit of the transfer amount based on this information, and record this information in the transaction. The transaction tx is then signed by the group public key and the user's private key to obtain the signature information σ. The transaction with a valid signature is a complete transaction. The sender then sends the transaction to the group administrator, who verifies the transaction amount and signature and sends the transaction to the consensus node. The consensus node verifies and records the transaction on the chain. After the transaction is on the chain, the recipient can use the amount of currency by unlocking the encrypted information. Specifically, the recipient provides the original image of the hash value pre and signs the transaction using the user's private key in the organization corresponding to gpk.

[0069] The user private key revocation, when a member change or malicious behavior occurs within the organization, the group administrator uses the above-mentioned user private key revocation algorithm to revoke the user private key when the number exceeds the threshold. After the revocation is completed, the group administrator packages the updated organization information and user information into an organization list node and a user list node, and sends them to the consensus node, which records this information on the chain.

[0070] For the transaction tracing, when the number of group administrators exceeding the threshold exceeds the threshold, the group administrator opens the transaction signature through the transaction tracing algorithm, obtains the information of the transaction signer, finds the corresponding user identity information id through the additional information au of the public user list CL, and thus traces the identity of the signer.

[0071] The present invention can provide users with a privacy, security, anonymity and traceable identity management method in identity management, the Internet of Things and other fields.

[0072] It should be understood that the embodiments described above are part of the embodiments of the present invention, rather than all of the embodiments. In addition, the technical features in the various embodiments or single embodiments provided by the present invention can be combined with each other arbitrarily to form a feasible technical solution. Such combination is not restricted by the sequence of steps and / or the structural composition mode, but must be based on the ability of ordinary technicians in the field to implement. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such combination of technical solutions does not exist and is not within the protection scope required by the present invention.

[0073] It should be understood that the above description of the preferred embodiment is relatively detailed and cannot be regarded as limiting the scope of patent protection of the present invention. Under the enlightenment of the present invention, ordinary technicians in this field can also make substitutions or modifications without departing from the scope of protection of the claims of the present invention, which all fall within the scope of protection of the present invention. The scope of protection requested for the present invention shall be based on the attached claims.

Claims

1. A decentralized group signature method, characterized in that: Including group key generation, issuing user private keys, revoking user private keys, user signatures, signature verification and user identity tracing processes; The group key generation: all group administrators in the group use a distributed method to generate the group public key and group private key. Each group administrator holds a shard of the group private key and makes the public key public. Only group administrators exceeding the threshold can recover the group private key. The issuing of user private keys, based on the user's identity information, exceeds a threshold number of group administrators using group private key shards to jointly issue user private keys to users; The revocation of user private keys, based on the identity information of the user to be revoked, exceeds the threshold. The group administrator revokes one or more user private keys, and the revoked user private keys will not be able to be used to generate valid signatures; The user signature, based on the group public key and the user private key, the user signs the identity information, and the signature does not expose the user's identity information; The verification signature is based on the group public key, user identity information and corresponding signature. Any node verifies the validity of the signature, that is, whether the signature is generated by a legitimate user; The user identity is traced back to the signature. If more than a threshold number of group administrators use the group private key to collaboratively open the signature and obtain the identity information of the signing user, based on the signature.

2. The decentralized group signature method according to claim 1, characterized in that: The group key generation: all group administrators in the group generate group public keys and group private keys in a distributed manner based on security parameters.

3. The decentralized group signature method according to claim 1, characterized in that: The user private key is issued, and group administrators exceeding the threshold use the group public key and their own group private key fragments to process the user identity information, and return the processed information to the user. The user obtains the user private key after summarizing the processing, and the group administrator maintains the identity information of all users.

4. The decentralized group signature method according to claim 1, characterized in that: The revocation of the user private key is based on the identity information of the user to be revoked. Group administrators exceeding the threshold use the group public key and their own group private key fragments to process the user identity information, and then revoke the corresponding user private key. The revoked user private key cannot be used to generate a valid signature.

5. The decentralized group signature method according to any one of claims 1 to 4, characterized in that: The user identity is traced back, based on the user's signature, and group administrators exceeding the threshold use the group public key and their own group private key fragments to process the user information, and then summarize the information related to the user identity, and then use the information to find the identity information in the user list, thereby obtaining the signer's information.

6. A decentralized group signature system, characterized in that: include: one or more processors; A storage device for storing one or more programs, which, when executed by the one or more processors, enables the one or more processors to implement the decentralized group signature method as described in any one of claims 1 to 5.

7. A method for constructing a traceable anonymous alliance chain based on decentralized group signature, characterized in that: Including blockchain initialization, organization registration, user private key issuance and transaction generation process; The blockchain initialization involves consensus nodes and multiple organizations that serve as chain administrators in the alliance chain. The consensus node completes the initialization phase; the consensus node generates system parameters and an organization list, which is used to store and update information about all participating organizations in the system, and then writes this information into the genesis block; After the organization registration and blockchain initialization steps are completed, each organization registers information with the consensus node, and each organization corresponds to a group in the decentralized group signature method; first, all group administrator nodes in the organization generate a group public and private key pair and an empty user list, where the user list is used to store the identities of all users in the organization and information to assist in tracing user identities; Then, the group administrator sends the group public key and organization identifier to the consensus node. After receiving the message, the consensus node updates the organization list and records the update of the organization list and initializes the user list of the organization on the chain. The user private key is issued. The user sends his or her identity information to the group administrator node. Then, more than a threshold number of group administrator nodes issue the user private key to the user, and update the user list in the organization. At the same time, the update is sent to the consensus node, which records it on the chain. In the generation transaction, each user can transfer money to multiple users at one time, and the receiver sends the transfer amount and commitment, encrypted information and the group public key of the receiver's group to the sender; The sender will then generate a range proof of the transfer amount based on this information and record this information in the transaction; the transaction will then be signed using the group public key and the user’s private key, and the transaction with a valid signature is a complete transaction; the sender will then send the transaction to the group administrator, who will verify the transaction amount and signature before sending the transaction to the consensus node, which will verify and record the transaction on the chain; after the transaction is on the chain, the recipient can use the currency for that amount by unlocking the encrypted information.

8. The method for constructing a traceable anonymous alliance chain based on decentralized group signature according to claim 7, characterized in that: It also includes the user private key revocation process. When a member change or malicious behavior occurs within the organization, group administrators exceeding the threshold will revoke the user's private key. After the revocation is completed, the group administrator will send the updated organization information and user information to the consensus node, and the consensus node will record this information on the chain.

9. The method for constructing a traceable anonymous alliance chain based on decentralized group signature according to claim 7, characterized in that: It also includes a transaction tracing process. When a group administrator exceeds the threshold, he or she opens the signature of a transaction through his or her own private key shards, obtains the identity information of the transaction signer, and finds the corresponding user identity information through the additional information of the local user list, thereby tracing the identity of the signer.

10. A traceable anonymous alliance chain construction system based on decentralized group signature, characterized in that: include: one or more processors; A storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the traceable anonymous alliance chain construction method based on decentralized group signature as described in any one of claims 7 to 9.

Images