Block chain transaction supervision method and system based on threshold encryption and link algorithm

Abstract

The invention discloses a block chain transaction supervision method and system based on threshold encryption and a link algorithm, and the method comprises the steps: initializing a system, and generating a threshold encryption public and private key pair and a threshold value; a user initiates a transaction to generate an initial Tx, and then encrypts the initial Tx to generate an encrypted Tx; the verifier verifies the validity of the encrypted Tx, and packages, records and uplinks the encrypted Tx; the government detects an abnormal transaction, then submits the abnormal transaction to the supervisor for reviewing, and finally, the user, the supervisor and the government respectively decide whether to submit private key tracking or not; according to the method, a private key distribution mechanism of threshold encryption is utilized to enable the user to obtain certain power to ensure that the privacy of the user cannot be forcibly decrypted, meanwhile, the user with abnormal transaction is supervised according to a self-developed link algorithm, the two methods are combined to realize that the transaction abnormity is supervised by multiple parties together, and the user experience is improved. The collusion between the government and the supervisor is effectively prevented, and the privacy of the user is also protected.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to a blockchain transaction supervision method and system based on threshold encryption and linking algorithm. Background Art

[0002] With the rapid development of blockchain technology, more and more application scenarios need to ensure the anonymity of transactions to protect user privacy. Although anonymity is a practical requirement of users, excessive anonymity can facilitate criminal activities such as money laundering, smuggling, and extortion. In other words, illegal transactions conducted by criminals using anonymous cryptocurrencies are difficult to identify and track. Therefore, how to achieve traceability while protecting user privacy so that the identity of the real trader can be tracked when necessary has become an important technical problem.

[0003] Among existing technologies, ring signatures, coin mixing technology, homomorphic encryption, etc. all provide anonymity and privacy protection to a certain extent, but these technologies have certain shortcomings in achieving traceability. At the same time, with the rise of the concept of data sovereignty, how to ensure that users have certain control over their data in the blockchain system has also become an urgent problem to be solved. Summary of the invention

[0004] The purpose of the present invention is to provide a blockchain anonymous transaction privacy protection traceable blockchain system with data sovereignty, which can achieve transaction traceability while protecting user privacy and ensure user sovereignty over their data.

[0005] The technical solution adopted by the present invention is as follows:

[0006] The first aspect provides a blockchain transaction supervision method based on threshold encryption and linking algorithm, including:

[0007] Initialize the system, generate threshold encryption public and private key pairs, threshold values, and user public and private key pairs;

[0008] Users conduct transactions with each other using pseudonyms, and generate initial transactions based on the pseudonyms of the users, which are then encrypted to obtain encrypted transactions. The pseudonyms are obtained by encrypting the user public keys using threshold public keys. The encrypted transactions include the transaction amount and the linkable IDs of both parties to the transaction. The linkable IDs are generated by the pseudonyms through a linking algorithm.

[0009] The validator verifies the validity of the encrypted transaction. Once the verification is passed, the valid encrypted transaction is packaged and uploaded to the chain;

[0010] The encrypted transactions generated by the same user within a preset time period are linked, and the transaction amounts in the encrypted transactions are aggregated to calculate the total transaction amount and number of transactions within the preset time period; and whether the regulatory rules are violated is determined based on the number of transactions T and the total transaction amount; if violated, the abnormal transaction is submitted to the regulator for re-examination, and finally the user, regulator and government each decide whether to submit private key tracking.

[0011] In one embodiment, the system is initialized to generate a threshold encryption public-private key pair, a threshold value, and a user public-private key pair, including:

[0012] Choose a secure bilinear pairing group G1, G2 and target group G T , whose order is a prime number p;

[0013] Generate a bilinear pairing e:G1×G2→G T ;

[0014] Select a generator g∈G1 and a random private key α∈Zp;

[0015] Calculate the public key g α =g α , where g α ∈G1, the system generates a public key (g,g α ), as the threshold public key pkt, and generate the private key α, as the threshold private key skt, generate the threshold value and the user public key and the user private key;

[0016] The threshold public key pkt and the threshold value t are broadcasted, the threshold private key skt is secret, and the threshold private key skt is divided into j private key shards and temporarily stored.

[0017] In one embodiment, users conduct transactions with each other using pseudonyms, and generate initial transactions based on the pseudonyms of the users, and then encrypt the generated initial transactions to obtain encrypted transactions, including:

[0018] The initial transaction Tx includes the user pseudonym and the transaction amount. The user pseudonym is encrypted again through the linking algorithm to generate a linkable ID, and the transaction amount value is encrypted through Paillier homomorphic encryption to generate the encrypted transaction amount. The specific method is as follows:

[0019] linkable_ID=Enc(nym,R)=nym·g R

[0020] E(value)=Enc paillier (value,r)=g value ·r N modN 2

[0021] Where R is a random number, nym is a user pseudonym, linkable_ID is a linkable ID, r is a random number in Paillier encryption, N is the modulus of Paillier encryption, value is the transaction amount, and E(value) is the encrypted transaction amount;

[0022] Generate non-interactive zero-knowledge proof π;

[0023] Calculate the message hash m:

[0024] m=H(linkable_ID from ,linkable_ID to ,E(value),π)

[0025] Where H is a cryptographic hash function, linkable_ID from Indicates the linkable ID of the payer, linkable_ID to Indicates that the payee can link the ID and use the user's private key SKU to generate a signature σ:

[0026] σ=Sign(SKU,m)=SKU·H(m)

[0027] Integrate the linkable IDs, encrypted transaction amounts, zero-knowledge proofs, and signatures of both parties to construct a complete encrypted transaction T'x:

[0028] T'x={linkable_ID from ,linkable_ID to ,E(value),π,σ}.

[0029] In one implementation, the verifier verifies the validity of the encrypted transaction, and after the verification is passed, the valid encrypted transaction is packaged and uploaded to the chain, including:

[0030] The verifier checks whether the content contained in the encrypted transaction complies with the predetermined transaction format requirements;

[0031] The verifier verifies the correctness of the identity of the transaction party by verifying the proof π;

[0032] The verifier verifies that the payer's balance is sufficient for the transaction. If it is sufficient, the transaction is valid.

[0033] Once the verification is passed, the valid transaction will be packaged and recorded on the blockchain, where the updated data on the chain is updated to the off-chain through the oracle.

[0034] In one embodiment, the verifier verifies that the payer's balance is sufficient for the transaction, including:

[0035] The verifier decrypts the payer's linkable ID to obtain the payer's pseudonym, then reviews the payer's balance based on the state tree, extracts the plaintext of the user's balance and the ciphertext of the transaction amount, and decrypts the ciphertext of the transaction amount to obtain the transaction amount:

[0036] value=D k (E(value))

[0037] Among them, D k It is the decryption function of Paillier homomorphic encryption;

[0038] Verify whether the user's balance is sufficient for the transaction amount:

[0039] Balance≥value

[0040] Balance is the user balance. If the user balance is greater than the transaction amount, it means that the user balance is sufficient for this transaction and the transaction is valid.

[0041] In one embodiment, the encrypted transactions generated by the same user within a preset time period are linked, and the transaction amounts in the encrypted transactions are aggregated to calculate the total transaction amount and the number of transactions within the preset time period; and whether the regulatory rules are violated is determined based on the number of transactions T and the total transaction amount, including:

[0042] The government links crypto transactions using the same pseudonym over a preset period of time:

[0043] {Tx i |Dec(linkable_ID i )=nym}

[0044] Among them, Tx i Indicates the linked transaction, i indicates the i-th transaction among all transactions within the preset time period, linkable_ID i represents the linkable ID contained in the i-th transaction, and Dec is the decryption function of the linkable ID;

[0045] Calculate the number of transactions T based on the linked transactions:

[0046]

[0047] Where S is the total number of transactions in the preset time period, 1(·) is an indicator function, which takes the value 1 when the condition is true and takes the value 0 when it is false;

[0048] The smart contract aggregates and adds up the encrypted transaction amounts of all transactions of a pseudonymous user within a preset time period to obtain the total encrypted amount, and then generates a commitment c for the total encrypted amount. The total encrypted amount and commitment c are then sent to the government. The encrypted transaction amount aggregation and commitment are generated in the following way:

[0049]

[0050] Among them, E(value i ) is the encrypted transaction amount of the i-th transaction, E(value sum ) is the total encrypted amount, and then generates a commitment c to the total encrypted amount:

[0051] c=Commitment(E(value sum )) = g E(valuesum) modp

[0052] g is a generator, p is a large prime number;

[0053] The government decrypts the encrypted total amount to obtain the original total amount. The decryption method is:

[0054] value sum =D key (E(value sum ))

[0055] Among them, D key is the decryption function, key is the decryption key, value sum is the total amount of the original amount;

[0056] The government determines whether regulatory rules have been violated by analyzing the number of transactions T and the total original amount.

[0057] In one embodiment, the method further includes decrypting the user who violates the transaction rules and tracking and obtaining the user public key information, specifically:

[0058] The smart contract divides the threshold private key skt into j parts, each of which is a threshold private key shard, and distributes them to users, governments, and regulators. Each entity obtains j / 3 threshold private key shards, where j is the number of threshold private key shards.

[0059] When the regulator submits private key tracking, the private key shards submitted by the regulator are collected through the smart contract. If the total number of collected private key shards is greater than or equal to the threshold value t, the user's real public key is decrypted.

[0060] Based on the same inventive concept, the second aspect of the present invention provides a blockchain transaction supervision system based on threshold encryption and linking algorithm, including:

[0061] System initialization module, used to initialize the system, generate threshold encryption public and private key pairs, threshold values, and user public and private key pairs;

[0062] An encryption module is used for users to conduct transactions with each other using pseudonyms, and to generate an initial transaction based on the pseudonym of the user, and then to encrypt the generated initial transaction to obtain an encrypted transaction, wherein the pseudonym is obtained by encrypting the user's public key using the threshold public key, and the encrypted transaction includes the transaction amount and the linkable IDs of the two parties to the transaction, and the linkable ID is generated by the pseudonym through a linking algorithm;

[0063] The verification module is used by the verifier to verify the validity of the encrypted transaction. After the verification is passed, the valid encrypted transaction will be packaged and uploaded to the chain;

[0064] The aggregation module is used to link the encrypted transactions generated by the same user within a preset time period, aggregate the transaction amounts in the encrypted transactions, calculate the total transaction amount and the number of transactions within the preset time period; and determine whether the regulatory rules are violated based on the number of transactions T and the total transaction amount; if violated, the abnormal transaction will be submitted to the regulator for re-examination, and

[0065] The tracking module is used by the final user, regulator and government to decide whether to submit private key tracking.

[0066] Based on the same inventive concept, the third aspect of the present invention provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, it implements the blockchain transaction supervision method based on threshold encryption and linking algorithm described in the first aspect.

[0067] Based on the same inventive concept, the fourth aspect of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the blockchain transaction supervision method based on threshold encryption and linking algorithm described in the first aspect is implemented.

[0068] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows:

[0069] The present invention provides a blockchain transaction supervision method based on threshold encryption and linking algorithm. First, the system initialization step generates relevant parameters of the system, and the transactions generated by the user are verified, and then the encrypted transactions are verified. After the verification is passed, the valid encrypted transactions are packaged and chained; the encrypted transactions generated by the same user within a preset time period are linked, and the transaction amounts in the encrypted transactions are aggregated to calculate the total transaction amount and the number of transactions within the preset time period; and whether the regulatory rules are violated is determined according to the number of transactions T and the total transaction amount; if violated, the abnormal transaction is submitted to the regulator for review again, and finally the user, the regulator and the government each decide whether to submit the private key tracking. The above scheme greatly enhances the privacy protection of users by using linking algorithms and threshold encryption technology. Even when the transaction records are widely analyzed, the real identity of the user is still difficult to be directly identified. This avoids the risk faced by users due to identity exposure when conducting legal transactions. While maintaining the anonymity of transactions, the present invention allows users to be tracked and supervised when necessary. This design is of great significance in combating illegal activities and ensuring compliance, especially in blockchain application scenarios that need to meet strict regulatory requirements.

[0070] In addition, the present invention ensures the user's sovereignty over their data, and distributes the tracking rights of user information to three entities through a threshold private key distribution mechanism, preventing unauthorized access or abuse, and effectively preventing internal collusion within the regulatory authorities, avoiding the risk of single point failure. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0072] Figure 1 A flowchart of a blockchain transaction supervision method based on threshold encryption and linking algorithm provided in an embodiment of the present invention;

[0073] Figure 2 A framework flow chart of the blockchain-based transaction supervision of the present invention provided for an embodiment of the present invention;

[0074] Figure 3 A module diagram of a blockchain transaction supervision system based on threshold encryption and linking algorithm provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0075] The present invention discloses a blockchain transaction supervision method based on threshold encryption and linking algorithm. The entities involved in the present invention include users, regulators, governments, verifiers, and smart contracts; the main implementation steps are as follows: step 1, system initialization, generating threshold encryption public and private key pairs and threshold values; step 2, the user initiates a transaction to generate an initial Tx, then encrypts the initial Tx, and generates an encrypted transaction T'x; step 3, the verifier verifies the validity of T'x, and packages and records it on the chain; step 4, the government detects abnormal transactions, and then submits the abnormal transactions to the regulator for review again, and finally the user, the regulator and the government each decide whether to submit private key tracking; the present invention uses the private key distribution mechanism of threshold encryption so that users also have certain rights to ensure that their privacy will not be forcibly decrypted, and at the same time, according to the self-developed linking algorithm, it realizes the supervision of users with abnormal transactions, and the two methods are combined to realize the abnormal supervision of transactions by multiple parties, effectively preventing the conspiracy between the government and the regulator, and protecting the privacy of users.

[0076] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0077] Embodiment 1

[0078] The present invention discloses a blockchain transaction supervision method based on threshold encryption and linking algorithm, see Figure 1 ,include:

[0079] S1: Initialize the system and generate threshold encryption public and private key pairs, threshold values, and user public and private key pairs;

[0080] S2: Users conduct transactions with each other using pseudonyms, and generate initial transactions based on the pseudonyms of the users, and then encrypt the generated initial transactions to obtain encrypted transactions, wherein the pseudonyms are obtained by encrypting the user public keys using the threshold public key. The encrypted transactions include the transaction amount and the linkable IDs of the two parties to the transaction, which are generated by the pseudonyms through a linking algorithm;

[0081] S3: The validator verifies the validity of the encrypted transaction. Once the verification is passed, the valid encrypted transaction is packaged and uploaded to the chain;

[0082] S4: Link the encrypted transactions generated by the same user within a preset time period, aggregate the transaction amounts in the encrypted transactions, calculate the total transaction amount and number of transactions within the preset time period; and determine whether the regulatory rules are violated based on the number of transactions T and the total transaction amount; if violated, the abnormal transaction will be submitted to the regulator for re-examination, and finally the user, regulator and government will each decide whether to submit private key tracking.

[0083] This embodiment proposes a blockchain transaction supervision method based on threshold encryption and self-developed linking algorithm, which combines threshold encryption technology and self-developed linking algorithm (the linking algorithm adopted by the present invention). The combination of the two technologies ensures user privacy while achieving compliance and traceability of transactions, and solves the problem of user data sovereignty in the blockchain transaction system and the problem of over-concentration of regulatory rights. The designed linking algorithm is interspersed in each step, and its specific scheme involves the following algorithms and steps:

[0084] Key generation algorithm (KeyGen): responsible for generating the key pairs required by the system (including threshold encryption public and private key pairs, user public and private key pairs), preparing for the subsequent system to protect user privacy and track and supervise.

[0085] Link Encrypt Algorithm: Responsible for linking the user's real public key and encrypting the amount of the user's transaction, ensuring the user's privacy while being able to track the user's true identity when the user violates the rules.

[0086] Encrypted Tx Generation Algorithm (TxGen): Responsible for generating encrypted transactions T'x, ensuring the privacy of transactions while ensuring the verifiability of transactions, and ensuring the privacy and security of transactions.

[0087] Transaction Verification Algorithm (TxVerify): Responsible for verifying the encrypted transaction T'x, verifying the validity of the transaction, and ensuring the legality, integrity and security of each transaction.

[0088] Transaction Link Algorithm (TxLink): Responsible for linking all transactions of the same user within a period of time. The government uses the linked transactions to preliminarily determine which users have violated the rules and submit the violating users to the regulator for further review.

[0089] Transaction Tracking Algorithm (TxTrace): Responsible for tracking suspicious users. The three entities decide whether to submit private keys to track the user's real public key.

[0090] The mentioned linking algorithms are interspersed in each step and are therefore not listed separately.

[0091] Step S1: System initialization, generating threshold encryption public and private key pairs, threshold values, and user public and private keys;

[0092] In order to generate basic cryptographic parameters to distribute key shards, the security and functionality of the entire system are ensured. In this way, the system can set the required keys and parameters to lay the foundation for subsequent encryption and verification operations. The generated threshold public key pkt is used to encrypt the user's public key pku and generate the pseudonym nym to provide the user with the first layer of anonymity protection; the generated threshold private key skt will be divided into j private key shards for temporary storage according to the characteristics of threshold encryption, and will be distributed to users, governments and regulators in the final tracking stage. The number of distributions is determined by these three entities; the setting of the threshold value t is related to the power of users, regulators and governments, and should be set according to actual conditions.

[0093] In step S2, the user initiates a transaction to generate an initial Tx, and then encrypts the initial Tx to generate an encrypted Tx;

[0094] In order to protect the privacy of users, the initial Tx initiated by the original user needs to be encrypted. Since the user privacy involved in Tx includes the public keys of both transaction users and the transaction amount, only the public keys of both transaction users and the transaction amount are encrypted here. In order to facilitate subsequent tracking, the encryption of the public keys of both users and the transaction amount uses a self-developed link algorithm.

[0095] Step S3 verifies the validity of the transaction and packages and records it on the chain;

[0096] In order to ensure the validity of transactions and ensure the legality, integrity and security of each transaction, a strict transaction verification mechanism is implemented to prevent malicious transactions from entering the blockchain system and ensure the overall security and stability of the system.

[0097] Step S4: The government detects abnormal transactions and then submits them to the regulator for further review. Finally, the user, the regulator, and the government each decide whether to submit private key tracking.

[0098] In order to ensure the legitimacy of transactions, screen and identify illegal transactions, track down the real public keys of malicious users, and protect users' data sovereignty over their own data, prevent regulatory authorities from having excessive power, resulting in collusion attacks and single point failures, this is achieved here through the distribution of self-developed link algorithms and threshold private keys skt.

[0099] In one implementation, S1 may be implemented in the following manner:

[0100] The system initialization generates a threshold public-private key pair (pkt, skt) and public parameters such as threshold value t, user public key, user private key, etc., and selects a secure bilinear pairing group G1, G2 and target group G T, whose order is a prime number p; generate a bilinear pairing e:G1×G2→G T ; Select a generator g∈G1 and a random private key α∈Zp; then calculate the public key g α =g α , where g α ∈G1; the system generates a public key (g,g α ), named as threshold public key pkt, and generate private key α, named as threshold private key skt; define system parameter n as the total number of participants, t as the threshold value; the setting of threshold value t involves three entities (users, regulators, and the government), and the three entities jointly determine the generation of these parameters, and finally broadcast the threshold public key pkt and threshold value t, and the threshold private key skt is secret. The user public key pku is encrypted with the threshold public key pkt to generate the pseudonym, and the mapping relationship between the pseudonym and the user public key pku is one-to-one; the threshold private key skt will be divided into j private key shards for temporary storage, and these j private key shards will be distributed to the three entities of users, regulators, and governments at a specific time. The three entities jointly determine the number of private key shards to be distributed, and the number of private key shards is proportional to the power.

[0101] In one embodiment, the initial transaction Tx in step S2 is in the following form:

[0102] Tx = {nym from ,nym to ,value}

[0103] nym from Indicates the payer's pseudonym, nym to It indicates the pseudonym of the payee, the payer and the payee are users, and value indicates the transaction amount.

[0104] The encrypted transaction T'x has the following form:

[0105] T'x={linkable_ID from ,linkable_ID to ,E(value),R,π,σ}

[0106] linkable_ID from Indicates the linkable ID of the payer, linkable_ID toIt represents the linkable ID of the payee, E(value) represents the encrypted transaction amount (transaction amount ciphertext), R represents a random number, π represents zero-knowledge proof, and σ represents a signature. The linkable ID is obtained by encrypting the pseudonym with the self-developed linking algorithm. The pseudonym and the linkable ID are in a one-to-many mapping relationship. Each time the user generates an initial transaction tx, it must be encrypted with the self-developed linking algorithm. The linkable ID generated by the same pseudonym each time it is encrypted with the self-developed linking algorithm is different. The same transaction amount value is encrypted with the self-developed linking algorithm each time. The transaction amount ciphertext obtained is different, thereby preventing malicious users from analyzing the transaction amount value to obtain the user's true identity.

[0107] The specific implementation of step S2 includes the following sub-steps:

[0108] S2.1: The pseudonym in the initial transaction Tx is encrypted again through the linkable algorithm to generate linkable_ID:

[0109] linkable_ID=Enc(nym,R)=nym·g R

[0110] R is a random number used to ensure that the linkable ID generated by each encryption of the same pseudonym is different, preventing malicious users from obtaining the user's real public key by analyzing the fixed pseudonym nym;

[0111] S2.2: The transaction amount value is generated through Paillier homomorphic encryption E(value):

[0112] E(value)=Enc paillier (value,r)=g value ·r N modN 2

[0113] Where r is the random number in Paillier encryption, and N is the modulus of Paillier encryption. The same transaction amount value is encrypted each time using the self-developed link algorithm to obtain a different encrypted amount E(value) ciphertext. This is also to prevent malicious users from analyzing the transaction amount value to obtain the user's true identity.

[0114] S2.3: Generate a non-interactive zero-knowledge proof π, which is used to prove the correctness of the transaction user and to facilitate subsequent verification with the verifier without revealing the user's identity;

[0115] S2.4: Calculate the message hash m:

[0116] m=H(linkable_IDfrom ,linkable_ID to ,E(value),π)

[0117] Where H is a cryptographic hash function; the signature σ is generated using the user's private key SKU:

[0118] σ=Sign(SKU,m)=SKU·H(m)

[0119] S2.5: Integrate the linkable IDs, encrypted transaction amounts, zero-knowledge proofs, and signatures of both parties to construct a complete encrypted Tx:

[0120] Encrypted Tx = {linkable_ID from ,linkable_ID to ,E(value),π,σ}

[0121] Among them, the encrypted Tx contains the linkable IDs of the two parties to the transaction, the encrypted value of the transaction amount, non-interactive zero-knowledge proof and signature, ensuring the privacy, authenticity and verifiability of the transaction.

[0122] In one embodiment, step S3 verifies the validity of the transaction and packages and records the contents on the chain as follows:

[0123] The verifier verifies the validity of the encrypted transaction T'x, including the correctness of the transaction format, the correctness of the identities of the two parties to the transaction, and whether the payer's balance is sufficient for the transaction. The verifier verifies the correctness of the identities of the two parties to the transaction by verifying the proof π in the encrypted Tx, the correctness of the transaction format by verifying the content in the encrypted Tx, and whether the user's balance is sufficient for the transaction by reviewing the user's balance through the state tree. After the verification is completed, the valid encrypted Tx is packaged and recorded on the chain.

[0124] The construction of the state tree is based on the Merkle Patricia Tree (MPT) structure, which is an improved structure based on Ethereum. It initializes the on-chain and off-chain storage parts. The on-chain storage block summary (Root Hash) and the off-chain storage block body contain specific account status information. The on-chain and off-chain data are updated and synchronized through the oracle. The purpose of storing the block body off-chain is to protect the privacy of users. The user account information stored in the block body can only be opened by the validator.

[0125] The state tree node structure contains the following fields: node type (branch node, extension node or leaf node), key-value pair (storing account address and corresponding account status) and hash value;

[0126] The account status includes the following information: pseudonym (the user's public key PKU obtained through threshold encryption), balance (the user's account balance), and nonce.

[0127] In one embodiment, the specific implementation of step S3 includes the following sub-steps:

[0128] S3.1: The verifier checks whether the contents of the encrypted transaction T'x conform to the predetermined transaction format requirements;

[0129] Vry(T'x)→0 / 1

[0130] S3.2: The verifier verifies the correctness of the identity of the transaction party by verifying the proof π;

[0131] Vry(π)→0 / 1

[0132] S3.3: The verifier verifies that the payer's balance is sufficient for this transaction. First, the verifier decrypts the payer's linkable_ID to obtain the pseudonym. Then, the verifier reviews the user's balance according to the state tree, extracts the plaintext Balance of the user's balance and the ciphertext E(value) of the transaction amount, and decrypts the ciphertext of the transaction amount to obtain the plaintext value:

[0133] value=D k (E(value))

[0134] Among them, Dk is the decryption function of Paillier homomorphic encryption; then verify whether the user balance is sufficient for the transaction amount. If the user balance is greater than the transaction amount:

[0135] Balance≥value

[0136] This indicates that the user's balance is sufficient for this transaction and the transaction is valid;

[0137] After confirming the validity of the encrypted transaction, the validator packages it and records it on the blockchain. The updated data on the chain is updated to the off-chain through the oracle to ensure the real-time nature of the block summary stored on the chain and the block data stored off-chain.

[0138] In one embodiment, the government in step 4 detects abnormal transactions, and then submits the abnormal transactions to the regulator for further review. Finally, the user, the regulator, and the government each decide whether to submit private key tracking; specifically, the following steps are included:

[0139] The government links the transaction records on the blockchain over a period of time to obtain all the encrypted Tx of users who use the same pseudonym to trade over a period of time, calculates the number of transactions, and the smart contract aggregates and adds the encrypted transaction amount E(value) to obtain the total encrypted amount E(value).sum ), and E(value sum ) Submit it to the government for decryption to obtain the value sum Then, by comparing the number of transactions and value sum Determine whether the regulatory rules are violated. If so, the smart contract will sum ) is submitted to the regulator for another review. The regulator will review the number of transactions and E(value sum ) Decrypt again to determine whether it violates the regulatory rules. When the judgment ends, the system distributes the threshold private key shard skt through the smart contract, and divides skt into j parts to each entity of the user, government and regulator j / 3 parts. Then the three entities decide whether to submit the private key and decide whether to track. The submitted private key is collected through the smart contract. If the total number of private key shards n collected is greater than or equal to the threshold value t, the user's real public key can be decrypted. It is assumed here that the regulator always aims to obtain the maximum benefit. The regulator who correctly supervises a transaction can get k gold coins and increase the reputation by 1 point as a reward. For users who have generated illegal transactions but the regulator does not submit the private key, 10k gold coins and 5 reputation points will be deducted from the regulator as a penalty. When the regulator's reputation is reduced to 0, the system automatically revokes the regulator's regulatory authority.

[0140] See also Figure 2 This is a flowchart of the transaction supervision based on blockchain of the present invention.

[0141] In one embodiment, the specific implementation of step 4 includes the following sub-steps:

[0142] S4.1: Link transaction users. Let the set of all transactions on the blockchain within a period of time be , where S is the total number of transactions in the time period, and i represents the i-th transaction among all transactions in the time period; the government Find all transactions using the same nym by linking the linkable_ID in the url:

[0143] {Tx i |Dec(linkable_ID i )=nym}

[0144] Where Dec is the decryption function of the linkable ID;

[0145] The government links the transaction records on the blockchain during that period of time to obtain all encrypted transactions of users who use the same pseudonym to conduct transactions during a period of time and calculates the number of transactions T:

[0146]

[0147] Where 1(·) is an indicator function, which takes the value 1 when the condition is true and takes the value 0 when it is false. Through the above operations, transactions with the same pseudonym are linked and the number of transactions is calculated.

[0148] S4.2: Aggregate encrypted transaction amount. The smart contract encrypts the transaction amount E (value) of all transactions of the pseudonymous user during the time period. i ) are aggregated and added to obtain the total encrypted amount E(value sum ):

[0149]

[0150] Then generate the aggregate amount E(value sum )'s commitment c:

[0151] c=Commitment(E(value sum )) = g E(valuesum) modp

[0152] Where g is the generator, p is a large prime number, and then the total amount of encrypted amount E (value sum ) and commitment c sent to the government;

[0153] S4.3: Government's E(value sum ) to decrypt and get value sum :

[0154] value sum =D key (E(value sum ))

[0155] Among them, Dkey is the decryption function and key is the decryption key.

[0156] S4.4: First, the government calculates the number of transactions T and value sum Determine whether it violates the regulatory rules; if it violates the regulatory rules, the smart contract will sum ) is submitted to the regulator for another review; then the regulator reviews E(value sum ) Decryption again to determine whether it violates regulatory rules and submission for review again is to prevent the government from having too much power, which would make it easy to be attacked by collusion and lead to a single point of failure;

[0157] S4.5: Split the threshold private key skt into j parts so that any t parts or more can reconstruct the original private key skt. The specific steps are as follows:

[0158] (1) Choose a finite field F of order q q ;

[0159] (2) Select a random polynomial f(x) such that f(0) = skt, that is:

[0160] f(x)=skt+a1x+a2x 2 +...+a t-1 x t-1 modq

[0161] (3) Calculate the private key shard skt m is f(m), that is:

[0162] skt m =f(m)modq for m=1,2,...,j

[0163] S4.6: Shard the private key skt m They are sent to users, governments and regulators respectively. The three entities decide whether to submit private key shards for tracking. When the threshold private key skt needs to be reconstructed, any t private key shards skt m You can use the Lagrange interpolation method to reconstruct skt:

[0164]

[0165] Through the above steps, when the number of collected private key fragments is greater than or equal to the threshold value t, the threshold private key skt can be recovered;

[0166] S4.7: Use the threshold private key skt to decrypt the user's pseudonym and obtain the user's real public key pku:

[0167] pku←dec(nym,skt)

[0168] Tracking successful.

[0169] Embodiment 2

[0170] Based on the same inventive concept, this embodiment discloses a blockchain transaction supervision system based on threshold encryption and linking algorithm, see Figure 3 ,include:

[0171] The system initialization module 301 is used to initialize the system and generate a threshold encryption public-private key pair, a threshold value, and a user public key;

[0172] The encryption module 302 is used for users to conduct transactions with each other using pseudonyms, and to generate an initial transaction based on the pseudonyms of the users, and then to encrypt the generated initial transaction to obtain an encrypted transaction, wherein the pseudonym is obtained by encrypting the user public key using the threshold public key, and the encrypted transaction includes the transaction amount and linkable IDs of both parties to the transaction, and the linkable ID is generated by the pseudonym through a linking algorithm;

[0173] Verification module 303 is used for the verifier to verify the validity of the encrypted transaction. After the verification is passed, the valid encrypted transaction is packaged and uploaded to the chain;

[0174] Aggregation module 304, used to link encrypted transactions generated by the same user within a preset time period, aggregate the transaction amounts in the encrypted transactions, calculate the total transaction amount and the number of transactions within the preset time period; and determine whether the regulatory rules are violated based on the number of transactions T and the total transaction amount; if violated, the abnormal transaction is submitted to the regulator for re-examination, and

[0175] The tracking module 305 is used for the final user, regulator and government to decide whether to submit private key tracking.

[0176] Among them, the aggregation link module is mainly used to link the encrypted Tx generated by the same user's transactions, aggregate the transaction amount, calculate the total transaction amount ciphertext and transaction number within a period of time, and screen out illegal users;

[0177] The tracking module is mainly used to decrypt users who violate transaction rules and track their user public key information.

[0178] Since the system introduced in the second embodiment of the present invention is a system used to implement the blockchain transaction supervision method based on threshold encryption and linking algorithm in the first embodiment of the present invention, based on the method introduced in the first embodiment of the present invention, the person skilled in the art can understand the specific structure and deformation of the system, so it is not repeated here. All systems used in the method in the first embodiment of the present invention belong to the scope of protection of the present invention.

[0179] Embodiment 3

[0180] Based on the same inventive concept, the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method described in the first embodiment is implemented.

[0181] Since the computer-readable storage medium introduced in the third embodiment of the present invention is a computer-readable storage medium used to implement the blockchain transaction supervision method based on threshold encryption and linking algorithm in the first embodiment of the present invention, based on the method introduced in the first embodiment of the present invention, the person skilled in the art can understand the specific structure and deformation of the computer-readable storage medium, so it is not repeated here. All computer-readable storage media used in the method of the first embodiment of the present invention belong to the scope of protection of the present invention.

[0182] Embodiment 4

[0183] The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in Embodiment 1 when executing the program.

[0184] Since the computer device introduced in the fourth embodiment of the present invention is a computer device used to implement the blockchain transaction supervision method based on threshold encryption and linking algorithm in the first embodiment of the present invention, based on the method introduced in the first embodiment of the present invention, the person skilled in the art can understand the specific structure and deformation of the computer device, so it is not repeated here. All computer devices used in the method of the first embodiment of the present invention belong to the scope of protection of the present invention.

[0185] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0186] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0187] Although preferred embodiments of the present invention have been described, additional changes and modifications may be made to these embodiments by those skilled in the art once the basic creative concepts are known. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention. Obviously, those skilled in the art may make various changes and modifications to the embodiments of the present invention without departing from the spirit and scope of the embodiments of the present invention. Thus, if these modifications and variations of the embodiments of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A blockchain transaction supervision method based on threshold encryption and linking algorithm, characterized in that: include: Initialize the system, generate threshold encryption public and private key pairs, threshold values, and user public and private key pairs; Users conduct transactions with each other using pseudonyms, and generate initial transactions based on the pseudonyms of the users, which are then encrypted to obtain encrypted transactions. The pseudonyms are obtained by encrypting the user public keys using threshold public keys. The encrypted transactions include the transaction amount and the linkable IDs of both parties to the transaction. The linkable IDs are generated by the pseudonyms through a linking algorithm. The validator verifies the validity of the encrypted transaction. Once the verification is passed, the valid encrypted transaction is packaged and uploaded to the chain; The encrypted transactions generated by the same user within a preset time period are linked, and the transaction amounts in the encrypted transactions are aggregated to calculate the total transaction amount and number of transactions within the preset time period; and whether the regulatory rules are violated is determined based on the number of transactions T and the total transaction amount; if violated, the abnormal transaction is submitted to the regulator for re-examination, and finally the user, regulator and government each decide whether to submit private key tracking.

2. The blockchain transaction supervision method based on threshold encryption and linking algorithm as claimed in claim 1 is characterized in that: System initialization, generating threshold encryption public and private key pairs, threshold values, and user public and private key pairs, including: Choose a secure bilinear pairing group G1, G2 and target group G T , whose order is a prime number p; Generate a bilinear pairing e:G1×G2→G T ; Select a generator g∈G1 and a random private key α∈Zp; Calculate the public key g α =g α , where g α ∈G1, the system generates a public key (g,g α ), as the threshold public key pkt, and generate the private key α, as the threshold private key skt, generate the threshold value and the user public key and the user private key; The threshold public key pkt and the threshold value t are broadcasted, the threshold private key skt is secret, and the threshold private key skt is divided into j private key shards and temporarily stored.

3. The blockchain transaction supervision method based on threshold encryption and linking algorithm as claimed in claim 2 is characterized in that: Users conduct transactions with each other using pseudonyms, and generate initial transactions based on the pseudonyms of the users. The generated initial transactions are then encrypted to obtain encrypted transactions, including: The initial transaction Tx includes the user pseudonym and the transaction amount. The user pseudonym is encrypted again through the linking algorithm to generate a linkable ID, and the transaction amount value is encrypted through Paillier homomorphic encryption to generate the encrypted transaction amount. The specific method is as follows: <h2 style=";text-align:left;direction:ltr">linkable_ID = Enc(nym,R) = nym g<h2 style=";text-align:left;direction:ltr"> R E(value)=Enc paillier (value,r)=g value ·r N modN 2 Where R is a random number, nym is a user pseudonym, linkable_ID is a linkable ID, r is a random number in Paillier encryption, N is the modulus of Paillier encryption, value is the transaction amount, and E(value) is the encrypted transaction amount; Generate non-interactive zero-knowledge proof π; Calculate the message hash m: m=H(linkable_ID from ,linkable_ID to ,E(value),π) Where H is a cryptographic hash function, linkable_ID from Indicates the linkable ID of the payer, linkable_ID to Represents the linkable ID of the payee, using the user's private key SKU to generate the signature σ: σ=Sign(SKU,m)=SKU·H(m) Integrate the linkable IDs, encrypted transaction amounts, zero-knowledge proofs, and signatures of both parties to construct a complete encrypted transaction T'x: T'x={linkable_ID from ,linkable_ID to ,E(value),π,σ}。 4. The blockchain transaction supervision method based on threshold encryption and linking algorithm as claimed in claim 1, characterized in that: The validator verifies the validity of the encrypted transaction. After the verification is passed, the valid encrypted transaction is packaged and uploaded to the chain, including: The verifier checks whether the content contained in the encrypted transaction complies with the predetermined transaction format requirements; The verifier verifies the correctness of the identity of the transaction party by verifying the proof π; The verifier verifies that the payer's balance is sufficient for the transaction. If it is sufficient, the transaction is valid. Once the verification is passed, the valid transaction will be packaged and recorded on the blockchain, where the updated data on the chain is updated to the off-chain through the oracle.

5. The blockchain transaction supervision method based on threshold encryption and linking algorithm as claimed in claim 4 is characterized in that: The validator verifies that the payer's balance is sufficient for the transaction, including: The verifier decrypts the payer's linkable ID to obtain the payer's pseudonym, then reviews the payer's balance based on the state tree, extracts the plaintext of the user's balance and the ciphertext of the transaction amount, and decrypts the ciphertext of the transaction amount to obtain the transaction amount: value=D k (E(value)) Among them, D k It is the decryption function of Paillier homomorphic encryption; Verify whether the user's balance is sufficient for the transaction amount: Balance≥value Balance is the user balance. If the user balance is greater than the transaction amount, it means that the user balance is sufficient for this transaction and the transaction is valid.

6. The blockchain transaction supervision method based on threshold encryption and linking algorithm as claimed in claim 2 is characterized in that: Link the encrypted transactions generated by the same user within a preset time period, aggregate the transaction amounts in the encrypted transactions, and calculate the total transaction amount and number of transactions within the preset time period; And determine whether there is a violation of regulatory rules based on the number of transactions T and the total transaction amount, including: The government links crypto transactions using the same pseudonym over a preset period of time: <h2 style=";text-align:left;direction:ltr">{Tx<h2 style=";text-align:left;direction:ltr"> i <h2 style=";text-align:left;direction:ltr"> |Dec(linkable_ID<h2 style=";text-align:left;direction:ltr"> i <h2 style=";text-align:left;direction:ltr"> )=nym} Among them, Tx i Indicates the linked transaction, i indicates the i-th transaction among all transactions within the preset time period, linkable_ID i represents the linkable ID contained in the i-th transaction, and Dec is the decryption function of the linkable ID; Calculate the number of transactions T based on the linked transactions: Where S is the total number of transactions in the preset time period, 1(·) is an indicator function, which takes the value 1 when the condition is true and takes the value 0 when it is false; The smart contract aggregates and adds up the encrypted transaction amounts of all transactions of a pseudonymous user within a preset time period to obtain the total encrypted amount, and then generates a commitment c for the total encrypted amount. The total encrypted amount and commitment c are then sent to the government. The encrypted transaction amount aggregation and commitment are generated in the following way: Among them, E(value i ) is the encrypted transaction amount of the i-th transaction, E(value sum ) is the total encrypted amount, and then generates a commitment c to the total encrypted amount: c=Commitment(E(value sum ))=g E(valuesum) modp g is a generator, p is a large prime number; The government decrypts the encrypted total amount to obtain the original total amount. The decryption method is: value sum =D key (E(value sum )) Among them, D key is the decryption function, key is the decryption key, value sum is the total amount of the original amount; The government determines whether regulatory rules have been violated by analyzing the number of transactions T and the total original amount.

7. The blockchain transaction supervision method based on threshold encryption and linking algorithm as claimed in claim 2 is characterized in that: The method also includes decrypting the user who violates the transaction rules and tracking and obtaining the user public key information, specifically: The smart contract divides the threshold private key skt into j parts, each of which is a threshold private key shard, and distributes them to users, governments, and regulators. Each entity obtains j / 3 threshold private key shards, where j is the number of threshold private key shards. When the regulator submits private key tracking, the private key shards submitted by the regulator are collected through the smart contract. If the total number of collected private key shards is greater than or equal to the threshold value t, the user's real public key is decrypted.

8. A blockchain transaction supervision system based on threshold encryption and linking algorithm, characterized in that: include: System initialization module, used to initialize the system, generate threshold encryption public and private key pairs, threshold values, and user public and private key pairs; An encryption module is used for users to conduct transactions with each other using pseudonyms, and to generate an initial transaction based on the pseudonym of the user, and then to encrypt the generated initial transaction to obtain an encrypted transaction, wherein the pseudonym is obtained by encrypting the user's public key using the threshold public key, and the encrypted transaction includes the transaction amount and the linkable IDs of the two parties to the transaction, and the linkable ID is generated by the pseudonym through a linking algorithm; The verification module is used by the verifier to verify the validity of the encrypted transaction. After the verification is passed, the valid encrypted transaction will be packaged and uploaded to the chain; The aggregation module is used to link the encrypted transactions generated by the same user within a preset time period, aggregate the transaction amounts in the encrypted transactions, calculate the total transaction amount and the number of transactions within the preset time period; and determine whether the regulatory rules are violated based on the number of transactions T and the total transaction amount; if violated, the abnormal transaction will be submitted to the regulator for re-examination, and The tracking module is used by the final user, regulator and government to decide whether to submit private key tracking.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, it implements the blockchain transaction supervision method based on threshold encryption and linking algorithm as described in any one of claims 1 to 7.

10. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, it implements the blockchain transaction supervision method based on threshold encryption and linking algorithm as described in any one of claims 1 to 7.

Images