Decentralized group signature-based traceable anonymous consortium chain construction method and system

Abstract

The application discloses a kind of traceable anonymous consortium chain construction method and system based on decentralized group signature, in group signature algorithm, group private key and group public key are obtained by multiple group administrator nodes jointly calculating, more than threshold group administrator node can issue and revoke user private key, user is signed to information by its private key and group public key, and group member is represented to information, so as to achieve the effect of hiding user identity, more than threshold group administrator node can open signature and trace user identity, so as to realize distributed user identity tracing.In traceable anonymous consortium chain construction method, consortium chain is jointly maintained by multiple organizations, multiple group administrator nodes in each organization jointly calculate and generate keys, when it is necessary to issue and revoke user private key and trace user identity, more than threshold group administrator needs to be jointly used to complete by using respective private key, to realize decentralized traceable anonymous blockchain.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and relates to a threshold group signature algorithm and a traceable anonymous consortium chain construction method and system, in particular to a traceable anonymous consortium chain construction method and system based on a decentralized group signature. BACKGROUND

[0002] Blockchain technology is instantiated as public chains and consortium chains (e.g., Fabric and Corda). In a consortium chain, blockchain nodes are a set of known entities, and transactions are verified by and open to specific blockchain nodes. Consortium chains usually involve real-world organizational alliances and are widely used in finance, the Internet of Things, and credit systems. Due to the sensitivity of transactions in many real-world systems, there is widespread concern about the privacy of amounts and identities in blockchains. Amount privacy mainly involves the amounts transferred in transactions, and identity privacy mainly involves the payers and payees of transactions. Although public chains have many practical privacy protection solutions, they cannot be transplanted to consortium chains due to different identity management strategies. Therefore, it is necessary to design an anonymous consortium chain.

[0003] Existing anonymous consortium chains can be divided into two categories: non-traceable and traceable. In non-traceable blockchains, no node knows the identity of the payer or payee. However, in practice, a traceability mechanism is usually needed because malicious blockchain nodes may behave improperly in an anonymous setting. In traceable consortium chains, the payer and payee are anonymous, but certain entities can disclose their identities in certain circumstances. These solutions use technologies such as anonymous credentials, zero-knowledge proofs, or group signatures. However, these schemes rely on trusted parties to issue user private keys or trace user identities, resulting in a security bottleneck in the system.

[0004] The adoption of a decentralized group signature algorithm can effectively solve the above problems. Consortium systems involve an organizational alliance, and each organization contains multiple group administrators and users. These organizations launch many nodes called consensus nodes. Consensus nodes maintain a blockchain composed of many blocks, each containing multiple transactions. The first block is called the genesis block. Consensus nodes initialize the blockchain system by generating public parameters and generating the genesis block. They then provide a registration service to organizations. After registering the organization with the consensus node, the group administrator assists in issuing and revoking private keys for users. Each user generates transactions on behalf of their organization and sends them to the group administrator, who then forwards them to the consensus node for consensus. In addition, the group administrator maintains transactions locally for user traceability. Therefore, decentralized organization registration, user private key issuance, and transaction traceability can be achieved, and users can upload transactions anonymously through the group signature algorithm. SUMMARY

[0005] To address the issues that existing traditional group signature technologies cannot be implemented in a decentralized environment, where central nodes are vulnerable to attack or malicious exploitation, and where some schemes have low efficiency in issuance, revocation, and traceability, resulting in security bottlenecks in anonymous blockchains and low operational efficiency of consortium blockchains, this invention provides a method and system for constructing a traceable anonymous consortium blockchain based on decentralized group signatures.

[0006] The decentralized group signature method of the present invention adopts the following technical solution: a decentralized group signature method, including a group key generation, issuing a user private key, revoking a user private key, user signature, signature verification, and user identity tracing process;

[0007] The group key is generated by all group administrators using a distributed method. Each group administrator holds a fragment of the group private key and publishes the public key. Only a number of group administrators exceeding a certain threshold can recover the group private key.

[0008] The issuance of user private keys involves issuing user private keys to users collectively using group private key shards based on the user's identity information, and exceeding a threshold.

[0009] The revocation of a user's private key, based on the identity information of the user to be revoked, allows group administrators to revoke one or more user private keys beyond a certain threshold. The revoked user private key cannot be used to generate a valid signature.

[0010] The user signature is a signature made by the user on their identity information based on the group public key and the user's private key. The signature does not expose the user's identity information.

[0011] The signature verification process involves any node verifying the validity of the signature, i.e., whether the signature was generated by a legitimate user, based on the group public key, user identity information, and corresponding signature.

[0012] To trace user identity, based on the signature, if the threshold is exceeded, group administrators use the group private key to collaboratively open the signature and obtain the identity information of the signing user.

[0013] As a preferred method, the group key is generated by all group administrators using a distributed approach based on security parameters.

[0014] Preferably, the process involves issuing user private keys, and when the number of group administrators exceeds a threshold, they use the group public key and their respective group private keys to process user identity information in segments, returning the processed information to the user. The user then summarizes and processes the information to obtain their own private key, and the group administrator maintains the identity information of all users.

[0015] Preferably, the revocation of a user's private key involves processing the user's identity information using the group public key and their respective group private key fragments, exceeding a threshold, based on the user's identity information, and then revoking the corresponding user's private key. The revoked user's private key cannot be used to generate a valid signature.

[0016] Preferably, the process of tracing user identity involves, based on the user's signature, group administrators exceeding a threshold using the group public key and their respective group private keys to shard the user information, then summarizing the data to obtain information related to the user's identity, and finally using this information to find the identity information in the user list, thereby obtaining the signer's information.

[0017] The decentralized group signature system of this invention adopts the following technical solution: a decentralized group signature system, comprising:

[0018] One or more processors;

[0019] A storage device for storing one or more programs that, when executed by one or more processors, cause the one or more processors to implement the decentralized group signature method.

[0020] The technical solution adopted by the traceable anonymous consortium blockchain construction method of the present invention is: a traceable anonymous consortium blockchain construction method based on decentralized group signature, including blockchain initialization, organization registration, user private key issuance and transaction generation process;

[0021] The blockchain initialization involves consensus nodes acting as chain administrators and multiple organizations in the consortium blockchain. The consensus nodes complete the initialization phase; the consensus nodes generate system parameters and a list of organizations, which are used to store and update information on all participating organizations within the system, and then write this information into the genesis block.

[0022] After the organization registration and blockchain initialization steps are completed, each organization registers its information with the consensus node. Each organization corresponds to a group in the decentralized group signature method. First, all group administrator nodes within the organization generate a group public-private key pair and an empty user list. The user list is used to store the identities of all users within the organization and information to assist in tracing user identities. Then, the group administrator sends the group public key and organization identifier to the consensus node. After receiving the message, the consensus node updates the organization list and records the update of the organization list and the initialization of the organization's user list on the chain.

[0023] The user private key issuance process involves the user sending their identity information to the group administrator node. Then, if the number of group administrator nodes exceeds a threshold, they will issue a user private key to the user and update the user list within the organization. At the same time, the update will be sent to the consensus node, which will record it on the blockchain.

[0024] The transaction generation process involves each user transferring funds to multiple users simultaneously. The recipient sends the transfer amount, a commitment, encrypted information, and the public key of their group to the sender. The sender then generates a proof of the transfer amount's range based on this information and records it in the transaction. The transaction is then signed using the group's public key and the user's private key; a transaction with a valid signature is considered complete. The sender then sends the transaction to the group administrator, who verifies the transaction amount and signature before sending it to the consensus node. The consensus node verifies the transaction and records it on the blockchain. Once the transaction is on-chain, the recipient unlocks the encrypted information and uses the corresponding amount of currency.

[0025] As an alternative, a user private key revocation process is also included. When a member changes or a member engages in malicious behavior within the organization, group administrators exceeding a threshold revoke the user's private key. After revocation, the group administrators send the updated organization information and user information to the consensus node, which then records this information on the blockchain.

[0026] As an alternative, a transaction tracing process is also included. If the threshold is exceeded, the group administrators can use their respective private keys to shard the signature of a transaction, obtain the identity information of the transaction signer, and find the corresponding user identity information through the additional information in the local user list, thereby tracing the identity of the signer.

[0027] The technical solution adopted by the traceable anonymous consortium blockchain construction system of the present invention is: a traceable anonymous consortium blockchain construction system based on decentralized group signatures, comprising:

[0028] One or more processors;

[0029] A storage device for storing one or more programs, which, when executed by one or more processors, enable the one or more processors to implement the described method for constructing a traceable anonymous consortium blockchain based on decentralized group signatures.

[0030] The beneficial effects of this invention include:

[0031] 1. This invention designs an efficient decentralized dynamic group signature scheme that supports threshold-based issuance and revocation of user private keys and disclosure of user identity information. Furthermore, the scheme provides efficient batch revocation. Users can sign transactions on behalf of their organization, thereby protecting identity privacy; multiple group administrators can collaborate to revoke user private keys and disclose user identity information from the signature.

[0032] 2. This invention designs a decentralized consortium blockchain architecture, which involves multiple consensus nodes and multiple organizations. The consensus nodes maintain a blockchain composed of many blocks and provide registration services for organizations. Organizations register their identities with the consensus nodes and provide identity management services for users.

[0033] 3. This invention designs a traceable anonymous consortium blockchain system. Specifically, the management of organizational and user identities within the system is designed in a decentralized manner. Organizational and user identities are maintained in a distributed manner through consensus. Therefore, trust is distributed among entities, and no single entity can control identities within the system. Furthermore, bullet proofs are used to achieve privacy of transaction amounts. Attached Figure Description

[0034] The technical solutions of the present invention will be further illustrated below using embodiments and specific implementation methods. In addition, some accompanying drawings are used in the description of the technical solutions. Those skilled in the art can obtain other drawings and the intent of the present invention from these drawings without any creative effort.

[0035] Figure 1 This is a schematic diagram of the method according to an embodiment of the present invention;

[0036] Figure 2 This is a flowchart of a method according to an embodiment of the present invention. Detailed Implementation

[0037] To facilitate understanding and implementation of the present invention by those skilled in the art, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0038] Please see Figure 1 and Figure 2 This embodiment provides a decentralized group signature method, which includes the processes of group key generation, issuing user private keys, revoking user private keys, user signature, signature verification, and tracing user identity.

[0039] Group key generation: All group administrators in a group generate the group public key and group private key using a distributed method. Each group administrator holds a fragment of the group private key and publishes the public key. Only a number of group administrators exceeding a threshold can recover the group private key.

[0040] In one implementation, all group administrators in the group generate the group public key and group private key using a distributed method based on the security parameter Λ, the total number of group administrators n, and the group administrator threshold t.

[0041] Based on the security parameter Λ, the total number of group administrators n, and the group administrator threshold t, all group administrators {GM1,…,GM1,…} in a group are defined as follows: n The group uses a distributed method to generate the group public key (gpk), group private key (gsk), a universal reference string, and a list of local user identity information. Each group administrator (GM)... i (i∈1,…,n) holds the group private key fragment gski The group public key (gpk), the generic reference string (crs), and the local user identity information list (UL) i The public key gpk,crs is made public, and a public user list CL = {} and a public revocation list RL = {} are initialized. Here, crs ← ZKP.ZKPSetup(ck,1 Λ ) is the public parameter generation algorithm in zero-knowledge proof technology, and ck is the public verification key; π←ZKP.ZKProve(crs,(C P ,c u ),(P,u),r u C is an algorithm for generating non-membership proofs in zero-knowledge proof techniques. P It is a summary that stores an RSA accumulator of a set RS, c u R is a Pedersen commitment of an element u, where P is the product of all elements in RS, and r u It is Pedersen's commitment. u The random number r in u The algorithm outputs a proof π to prove... δ←ZKP.ZKPVrfy(crs,(C P ,c u ),π) is an algorithm in zero-knowledge proof techniques for verifying non-membership proofs, if π is If a valid proof is found, output δ←1; otherwise, output δ←0. Specifically:

[0042] First, the group administrator defines a hash function. {0,1} * Represents a 0-1 sequence of arbitrary length. Represent the set of positive integers less than or equal to p; generate a multiplicative cyclic group G of order p, where p is a prime number of length Λ; then generate four public generators g, g1, g2, h. c ∈G, and then they generate a random polynomial f∈Z of order t-1. p [X], where α=f(0)∈Z p t is the group administrator threshold, and α is the set of non-negative numbers Z less than or equal to p. p Random numbers in the group; each group administrator (GM) i Get h = g α And f(i); finally, a commitment key ck and a generic reference string crs for set non-membership proofs are generated, where the generator of the commitment scheme is And g1, each group administrator GM i Obtain (gpk=(g,g1,g2,h,h) c ,vk=(g f(1),…,g f(n) )), A generic reference string crs and an initialized local customer information list UL i .

[0043] The issuance of user private keys involves issuing user private keys to users collectively using group private key shards based on the user's identity information, and exceeding a threshold.

[0044] In one implementation, group administrators exceeding a threshold use the group public key and their respective group private key fragments to process user identity information, return the processed information to the user, and the user can obtain the user's private key after summarizing and processing. The group administrator maintains the identity information of all users.

[0045] Based on the user's identity information ID U Each group administrator (GM) i (i∈{1,…,t′},t′>t) Input the group public key gpk and the group private key gsk i User private key sk U All group administrators updated the user list CL.

[0046] First, user U selects a random prime number sk. id ∈Z p and a random polynomial f of order t-1 id ∈Z p [X], where f id (0)=sk id Then register information Send to group administrators GM1, ..., GM respectively t′ Finally, the group administrators generated partial user private keys for each user. Where {λ1,…,λ t′} represents the Lagrange multiplier; user acquisition User private key sk U =(sk id Finally, user U will (id) U ,r1,f id (i) Send to group administrator GM i (i∈{1,…,n}), each group administrator GM i (i∈{1,…,n}) Update the public client list CL←CL∪{(id u ,r1)} and private client information UL←UL∪{(id U ,f id (i))}.

[0047] The revocation of a user's private key, based on the identity information of the user to be revoked, allows group administrators to revoke one or more user private keys beyond a certain threshold. The revoked user private key cannot be used to generate a valid signature.

[0048] In one implementation, based on the identity information of the user to be revoked, group administrators exceeding a threshold process the user's identity information using the group public key and their respective group private key fragments, and then revoke the corresponding user's private key. The revoked user's private key cannot be used to generate a valid signature.

[0049] Based on the ID of the user list to be revoked rs Each group administrator (GM) i (i∈{1,…,t′},t′>t) Input public key gpk, local user list UL i The generic reference string crs updates the user revocation list and outputs the RSA accumulator values ​​for all revoked certificates.

[0050] First, for each identity ID U ∈id rs The group administrator restored the user's private information. Then you get a set Then use Update RL = ({rs1,…,rs) γ},P RL C RL ), where {rs1,…,rs γ} represents the private key of the revoked user, and γ represents the number of revoked users; specifically, it is possible to revoke {rs1,…,rs} without prior knowledge. γ In the case of P RL and SK rs Get (P′) RL ,C′ RL Finally, all group administrators can obtain the updated undo list RL'.

[0051] The user signature is a signature made by the user on their identity information based on the group public key and the user's private key. The signature does not expose the user's identity information.

[0052] In one implementation, based on the group public key gpk and the user private key sk U The system includes public message crs, message m, and revocation list RL, with user-output signature σ.

[0053] First, the user selects random numbers s, s1∈Z p and calculate the commitment value Then the message m is encrypted. Obtain the ciphertext ct←(c1,c2,c3,c4); then obtain the undo list information rs,P RL C RL ←RL, then use zero-knowledge proof techniques to generate a non-membership proof π1←ZKP.ZKProve(crs,(C RL C U ),(P RL ,sk id ),s); Generate random numbers a1, a2, a3, a4 ← Z p The proof is obtained through the following calculations, where e() is a bilinear mapping function. c←H(m,c1,c2,c3,c4,d1,d2,d3,d4), b1←a1+c·s1,b2←a2+c·s, b3←a3+c·s1·s,b4←a4+c·sk id ,π←(C U ,π1,c,b1,b2,b3,b4), and then obtain the group signature σ←{ct,π}.

[0054] The signature verification process involves any node verifying the validity of the signature, i.e., whether the signature was generated by a legitimate user, based on the group public key, user identity information, and corresponding signature.

[0055] In one implementation, the group public key gpk, the universal reference string crs, and the commitment value C of all revocation messages are used. RL Given a message signature pair (m, σ), output a bit b, where 0 / 1 indicates that σ is an invalid / valid signature for message m.

[0056] First, check the ciphertext C using the following equation: First calculate... If the equation e(c2,h) H(m) If g2)=e(c3,g) and c=H(m,ct,d′1,d′2,d′3,d′4) are true, then the ciphertext is valid. Then, a set of non-membership proofs is used to determine whether the user's private key has been revoked. ZKP.ZKPVrfy(crs,(C RL C U If all the above verifications pass, the algorithm returns b←1; otherwise, it returns b←0.

[0057] To trace user identity, based on the signature, if the threshold is exceeded, group administrators use the group private key to collaboratively open the signature and obtain the identity information of the signing user.

[0058] In one implementation, each group administrator (GM) i(i∈{1,…,t′},t′>t) Input the group public key gpk and the group private key gsk i The output includes the generic reference string "crs", the RSA accumulator values ​​of all revoked certificates, and a message signature pair (m, σ), and also outputs the user's identity ID. U .

[0059] First, each group administrator (GM) i The group signature is verified; if the message is invalid, the protocol is terminated. Then, they decrypt the ciphertext ct to obtain the additional information e(r′1,h). Finally, they iterate through the client list CL and obtain the user's identity (id). U ,r1), where e(r′1,h)=e(r1,h).

[0060] Please see Figure 1 and Figure 2 This embodiment provides a method for constructing a traceable anonymous consortium blockchain based on decentralized group signatures, including blockchain initialization, organization registration, user private key issuance, transaction generation, user private key revocation, and process.

[0061] The blockchain initialization involves consensus nodes acting as chain administrators and multiple organizations in the consortium blockchain. The consensus nodes complete the initialization phase; the consensus nodes generate system parameters and a list of organizations, which are used to store and update information on all participating organizations within the system, and then write this information into the genesis block.

[0062] In one implementation, the consensus node first generates system parameters pp, which include information such as the key security parameter length used to generate nodes in the system. Then, it generates an empty organization list OL = {}, which is used to store and update information about all participating organizations within the system, including organization identifiers and organization public keys. This information is then processed through a structure called an organization list node ((org, gpk), addr...). ol ,hash ol This is used to incrementally update the list of organizations, where org represents the organization's identifier, gpk represents the organization's public key, and addr... ol The hash represents the transaction address where the organization's information is stored. ol This represents the current hash value of the organization list. Finally, the initialized organization list nodes (null, null, H(OL)) and system parameters are written into the genesis block.

[0063] After the organization registration and blockchain initialization steps are completed, each organization can register its information with the consensus node. Each organization corresponds to a group in the decentralized group signature method. First, all group administrator nodes within the organization generate a group public-private key pair and an empty user list. The user list is used to store the identities of all users within the organization and some information to help trace user identities. Then, the group administrator sends the group public key and organization identifier to the consensus node. After receiving the message, the consensus node updates the organization list and records the update of the organization list and the initialization of the organization's user list on the chain.

[0064] In one implementation, firstly, all group administrator nodes within the organization generate group public-private key pairs (gpk, gsk1, ..., gsk) using a key generation algorithm. n The group administrator sends the group public key gpk and the organization identifier org to the consensus node. Upon receiving the message, the consensus node generates a new organization list node((org, gpk), addr...). ol H(OL′)) updates the list OL to OL′=OL∪{(org,gpk)} and records the update of the organization list and the initialization of the organization's user list CL on the chain. The update of the user list is achieved by storing a data structure called user list node (org,(id,au),addr) on the chain. cl The process is completed by H(CL)), where (id,au) is the user's identity information and auxiliary information used for tracing, and addr cl H(CL) is the transaction address of the previous CL node, and H(CL) is the hash value of the current CL.

[0065] The user private key issuance process involves the user sending their identity information to the group administrator node. Then, if the number of group administrator nodes exceeds a threshold, they will issue a user private key to the user and update the user list within the organization. At the same time, the update will be sent to the consensus node, which will record it on the blockchain.

[0066] In one implementation, a user sends their identity information (id) to multiple group administrator nodes. Then, if a threshold number of group administrator nodes exceed a certain number, they issue a private key (sk) to the user using the user private key issuance algorithm in the group signature. This is done by generating a new user list node (org,(id,au),addr). cl H(CL′)) is used to update the user list CL′=CL∪{(id,au)} within the organization, and at the same time, the update is sent to the consensus node so that the consensus node records it on the chain;

[0067] The transaction generation process involves each user transferring funds to multiple users at once. The recipient sends the transfer amount and a commitment (based on the bullet proof principle), encrypted information (based on the hash time lock principle), and the public key of the recipient's group to the sender. The sender then generates a range proof for the transfer amount based on this information and records it in the transaction. The transaction is then signed using the group public key and the user's private key; a transaction with a valid signature is considered complete. The sender then sends the transaction to the group administrator, who verifies the transaction amount and signature before sending it to the consensus node. The consensus node verifies the transaction and records it on the blockchain. Once the transaction is on the blockchain, the recipient can use the currency by unlocking the encrypted information.

[0068] In one implementation, each user can transfer funds to multiple users at once, with the recipient sending the transfer amount v and a commitment com to the sender. v The process involves the sender generating a range proof (wit) for the transfer amount using a hash value `pre` and the recipient's group's public key (gpk). This information is then recorded in the transaction. The sender signs the transaction `tx` using the group's public key and the user's private key to obtain the signature information `σ`. A transaction with a valid signature is considered complete. The sender then sends the transaction to the group administrator, who verifies the transaction amount and signature before sending it to the consensus node. The consensus node verifies the transaction and records it on the blockchain. Once the transaction is on-chain, the recipient can use the currency by decrypting the encrypted information. Specifically, this involves providing the preimage of the hash value `pre` and signing the transaction using the user's private key from the organization corresponding to `gpk`.

[0069] The user private key revocation is performed when there is a change in members or malicious behavior by members within the organization. When the threshold number of group administrators exceeds the limit, they use the above-mentioned user private key revocation algorithm to revoke the user private key. After the revocation is completed, the group administrators package the updated organization information and user information into organization list nodes and user list nodes, and send them to the consensus node. The consensus node records this information on the blockchain.

[0070] The transaction tracing process involves group administrators exceeding a certain threshold using a transaction tracing algorithm to open the transaction signature, obtain the signer's information, and then find the corresponding user identity information (id) through the additional information (au) of the public user list (CL), thereby tracing the signer's identity.

[0071] This invention can provide users with a private, secure, anonymous, and traceable identity management method in more fields such as identity management and the Internet of Things.

[0072] It should be understood that the embodiments described above are only some, not all, of the embodiments of the present invention. Furthermore, the technical features of the various embodiments or individual embodiments provided by the present invention can be arbitrarily combined to form feasible technical solutions. Such combinations are not constrained by the order of steps and / or structural composition patterns, but must be based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by the present invention.

[0073] It should be understood that the above description of the preferred embodiments is quite detailed, but it should not be considered as a limitation on the scope of protection of this invention. Those skilled in the art, under the guidance of this invention, can make substitutions or modifications without departing from the scope of protection of the claims of this invention, and all such substitutions or modifications fall within the scope of protection of this invention. The scope of protection of this invention should be determined by the appended claims.

Claims

1. A method for constructing a traceable anonymous consortium blockchain based on decentralized group signatures, characterized in that: This includes the blockchain initialization, organization registration, user private key issuance, and transaction generation processes; The blockchain initialization involves consensus nodes acting as chain administrators and multiple organizations in the consortium blockchain. The consensus nodes complete the initialization phase; the consensus nodes generate system parameters and a list of organizations, which are used to store and update information on all participating organizations within the system, and then write this information into the genesis block. After the organization registration and blockchain initialization steps are completed, each organization registers its information with the consensus node. Each organization corresponds to a group in the decentralized group signature method. First, all group administrator nodes within the organization generate a group public-private key pair and an empty user list. The user list is used to store the identities of all users within the organization and information to assist in tracing user identities. Each group administrator node holds a group private key shard and publishes the public key. Only a number of group administrator nodes exceeding a threshold can recover the group private key. Then, the group administrator node sends the group public key and organization identifier to the consensus node; upon receiving the message, the consensus node updates the organization list and records the update of the organization list and initializes the user list of the organization on the chain. The user private key issuance process involves the user sending their identity information to the group administrator node. Then, if the number of group administrator nodes exceeds a threshold, they will issue a user private key to the user and update the user list within the organization. At the same time, the update will be sent to the consensus node, which will record it on the blockchain. In the transaction generation, each user can transfer funds to multiple users at once, and the recipient sends the transfer amount and commitment, encrypted information and the public key of the group to which the recipient belongs to the sender. The sender then generates a range proof of the transfer amount based on this information and records this information in the transaction. The transaction is then signed using the group public key and the user's private key. A transaction with a valid signature is a complete transaction. The sender then sends the transaction to the group administrator node. After verifying the transaction amount and signature, the group administrator node sends the transaction to the consensus node. After verification, the consensus node records the transaction on the blockchain. Once the transaction is on the blockchain, the recipient uses the corresponding currency of the transfer amount by unlocking the encrypted information. It also includes the process of revoking user private keys. When there is a change in members or malicious behavior by members within the organization, the group administrator nodes that exceed the threshold will revoke the user's private key. After the revocation is completed, the group administrator nodes will send the updated organization information and user information to the consensus nodes, and the consensus nodes will record this information on the chain. It also includes a transaction tracing process. If the threshold is exceeded, each group administrator node will use its private key to open the signature of a transaction, obtain the identity information of the transaction signer, and find the corresponding auxiliary traceability user information through the additional information of the local user list, thereby tracing the identity of the signer.

2. A traceable anonymous consortium blockchain construction system based on decentralized group signatures, characterized in that, include: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to implement the method for constructing a traceable anonymous consortium blockchain based on decentralized group signatures as described in claim 1.

Images