A blockchain transaction supervision method and system based on threshold encryption and linking algorithm

Abstract

The present invention discloses a blockchain transaction supervision method and system based on threshold encryption and linking algorithm, wherein the method comprises: system initialization, generation of threshold encryption public-private key pair and threshold value; user initiates transaction to generate initial Tx, then encrypts initial Tx, and generates encrypted Tx; verifier verifies the validity of encrypted Tx, and packages and records it on the chain; government detects abnormal transactions, then submits the abnormal transactions to regulator for re-examination, and finally the user, regulator and government each decide whether to submit private key tracking; the present invention utilizes the private key distribution mechanism of threshold encryption to enable users to obtain certain rights to ensure that their privacy will not be forcibly decrypted, and at the same time, according to the self-developed linking algorithm, realizes supervision of users with abnormal transactions. The combination of the two methods realizes multi-party supervision of transaction anomalies, effectively prevents collusion between the government and regulators, and protects the privacy of users.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to a blockchain transaction supervision method and system based on threshold encryption and linking algorithm. Background Art

[0002] With the rapid development of blockchain technology, an increasing number of application scenarios require transaction anonymity to protect user privacy. While anonymity is a practical requirement for users, excessive anonymity can facilitate criminal activities such as money laundering, smuggling, and extortion. In other words, illegal transactions conducted by criminals using anonymous cryptocurrencies are difficult to identify and track. Therefore, how to achieve traceability while protecting user privacy, so that the identity of the actual transaction can be traced when necessary, has become a significant technical challenge.

[0003] Existing technologies, such as ring signatures, coin mixing, and homomorphic encryption, all offer a degree of anonymity and privacy protection. However, these technologies lack traceability. Furthermore, with the rise of the concept of data sovereignty, ensuring that users have a degree of control over their data within blockchain systems has become a pressing issue. Summary of the Invention

[0004] The purpose of the present invention is to provide a blockchain anonymous transaction privacy protection traceable blockchain system with data sovereignty, which can achieve transaction traceability while protecting user privacy and ensure user sovereignty over their data.

[0005] The technical solution adopted in the present invention is as follows:

[0006] The first aspect provides a blockchain transaction supervision method based on threshold encryption and linking algorithm, including:

[0007] Initialize the system, generate threshold encryption public and private key pairs, threshold values, and user public and private key pairs;

[0008] Users conduct transactions with each other using pseudonyms. An initial transaction is generated based on the user's pseudonym, and then the generated initial transaction is encrypted to obtain an encrypted transaction. The pseudonym is obtained by encrypting the user's public key using the threshold public key. The encrypted transaction includes the transaction amount and the linkable IDs of the two parties to the transaction. The linkable ID is generated by the pseudonym through a linking algorithm.

[0009] The validator verifies the validity of the encrypted transaction and packages the valid encrypted transaction on the chain after passing the verification;

[0010] The encrypted transactions generated by the same user within a preset time period are linked, and the transaction amounts in the encrypted transactions are aggregated to calculate the total transaction amount and number of transactions within the preset time period; and whether the regulatory rules are violated is determined based on the number of transactions T and the total transaction amount; if violated, the abnormal transaction is submitted to the regulator for re-examination, and finally the user, regulator and government each decide whether to submit private key tracking.

[0011] In one embodiment, system initialization, generation of a threshold encryption public-private key pair, a threshold value, and a user public-private key pair, includes:

[0012] Choose a secure bilinear pairing group G1, G2 and target group G T , whose order is a prime number p;

[0013] Generate a bilinear pairing e:G1×G2→G T ;

[0014] Select a generator g∈G1 and a random private key α∈Zp;

[0015] Calculate the public key g α =g α , where g α ∈G1, the system generates a public key (g,g α ), as the threshold public key pkt, and generate the private key α, as the threshold private key skt, generate the threshold value and the user public key and the user private key;

[0016] The threshold public key pkt and the threshold value t are broadcasted, the threshold private key skt is secret, and the threshold private key skt is divided into j private key shards and temporarily stored.

[0017] In one embodiment, users conduct transactions with each other using pseudonyms, generate an initial transaction based on the pseudonyms of the users, and then encrypt the generated initial transaction to obtain an encrypted transaction, including:

[0018] The initial transaction Tx includes the user pseudonym and the transaction amount. The user pseudonym is encrypted again through the linking algorithm to generate a linkable ID, and the transaction amount value is encrypted through Paillier homomorphic encryption to generate the encrypted transaction amount. The specific method is as follows:

[0019] linkable_ID=Enc(nym,R)=nym·g R

[0020] E(value)=Enc paillier (value,r)=g value ·r N modN 2

[0021] Where R is a random number, nym represents the user pseudonym, linkable_ID represents the linkable ID, r is the random number in the Paillier encryption, N is the modulus of the Paillier encryption, value is the transaction amount, and E(value) is the encrypted transaction amount.

[0022] Generate non-interactive zero-knowledge proof π;

[0023] Calculate the message hash m:

[0024] m=H(linkable_ID from ,linkable_ID to ,E(value),π)

[0025] Where H is a cryptographic hash function, linkable_ID from Indicates the linkable ID of the payer, linkable_ID to Indicates that the payee can link the ID and use the user's private key SKU to generate the signature σ:

[0026] σ=Sign(SKU,m)=SKU·H(m)

[0027] The linkable IDs, encrypted transaction amounts, zero-knowledge proofs, and signatures of both parties are integrated to construct a complete encrypted transaction T'x:

[0028] T'x={linkable_ID from ,linkable_ID to ,E(value),π,σ}.

[0029] In one embodiment, the validator verifies the validity of the encrypted transaction and, upon passing the verification, packages the valid encrypted transaction onto the blockchain, including:

[0030] The verifier checks whether the content contained in the encrypted transaction complies with the predetermined transaction format requirements;

[0031] The verifier verifies the correctness of the transaction party’s identity by verifying the proof π;

[0032] The verifier verifies that the payer's balance is sufficient for the transaction. If it is sufficient, the transaction is valid.

[0033] Once the verification is passed, the valid transaction will be packaged and recorded on the blockchain, where the updated data on the chain will be updated to the off-chain through the oracle.

[0034] In one embodiment, the verifier verifies that the payer's balance is sufficient for the transaction, including:

[0035] The verifier decrypts the payer's linkable ID to obtain the payer's pseudonym, then reviews the payer's balance based on the state tree, extracts the user's balance plaintext and the transaction amount ciphertext, and decrypts the transaction amount ciphertext to obtain the transaction amount:

[0036] value=D k (E(value))

[0037] Among them, D k It is the decryption function of Paillier homomorphic encryption;

[0038] Verify whether the user's balance is sufficient for the transaction amount:

[0039] Balance≥value

[0040] Balance is the user's balance. If the user's balance is greater than the transaction amount, it means that the user's balance is sufficient for this transaction and the transaction is valid.

[0041] In one embodiment, encrypted transactions generated by the same user within a preset time period are linked, and the transaction amounts in the encrypted transactions are aggregated to calculate the total transaction amount and the number of transactions within the preset time period; and whether regulatory rules are violated is determined based on the number of transactions T and the total transaction amount, including:

[0042] The government links crypto transactions using the same pseudonym within a preset time period:

[0043] {Tx i |Dec(linkable_ID i )=nym}

[0044] Among them, Tx i Indicates the linked transaction, i represents the i-th transaction among all transactions within the preset time period, linkable_ID i represents the linkable ID contained in the i-th transaction, and Dec is the decryption function of the linkable ID;

[0045] Calculate the number of transactions T based on the linked transactions:

[0046]

[0047] Where S is the total number of transactions in the preset time period, 1(·) is an indicator function, which takes the value 1 when the condition is true and 0 when it is false;

[0048] The smart contract aggregates the encrypted transaction amounts of all transactions by a pseudonymous user within a preset time period to obtain the total encrypted amount, then generates a commitment c for the total encrypted amount. The total encrypted amount and commitment c are then sent to the government. The encrypted transaction amount aggregation and commitment are generated as follows:

[0049]

[0050] Among them, E(value i ) is the encrypted transaction amount of the i-th transaction, E(value sum ) is the total encrypted amount, and then generates a commitment c to the total encrypted amount:

[0051] c=Commitment(E(value sum ))=g E(valuesum) modp

[0052] g is a generator, p is a large prime number;

[0053] The government decrypts the encrypted total amount to obtain the original total amount. The decryption method is:

[0054] value sum =D key (E(value sum ))

[0055] Among them, D key Is the decryption function, key is the decryption key, value sum is the total original amount;

[0056] The government determines whether regulatory rules have been violated by analyzing the number of transactions T and the total original amount.

[0057] In one embodiment, the method further includes decrypting the user who violates the transaction rules and tracking and obtaining the user's public key information, specifically:

[0058] The smart contract divides the threshold private key skt into j parts, each of which is a threshold private key shard, and distributes them to users, governments, and regulators. Each entity receives j / 3 threshold private key shards, where j is the number of threshold private key shards.

[0059] When the regulator submits a private key for tracking, the private key shards submitted by the regulator are collected through the smart contract. If the total number of collected private key shards is greater than or equal to the threshold value t, the user's real public key is decrypted.

[0060] Based on the same inventive concept, the second aspect of the present invention provides a blockchain transaction supervision system based on threshold encryption and linking algorithm, comprising:

[0061] System initialization module, used to initialize the system and generate threshold encryption public and private key pairs, threshold values, and user public and private key pairs;

[0062] An encryption module, used to conduct transactions between users using pseudonyms, generate an initial transaction based on the user's pseudonym, and then encrypt the generated initial transaction to obtain an encrypted transaction. The pseudonym is obtained by encrypting the user's public key using the threshold public key. The encrypted transaction includes the transaction amount and the linkable IDs of the two parties to the transaction. The linkable ID is generated by the pseudonym using a linking algorithm;

[0063] The verification module is used by the verifier to verify the validity of the encrypted transaction. After the verification is passed, the valid encrypted transaction is packaged and uploaded to the chain;

[0064] The aggregation module is used to link the encrypted transactions generated by the same user within a preset time period, aggregate the transaction amounts in the encrypted transactions, calculate the total transaction amount and number of transactions within the preset time period; and determine whether the regulatory rules are violated based on the number of transactions T and the total transaction amount; if violated, the abnormal transaction will be submitted to the regulator for re-examination, and

[0065] The tracking module is used by the final user, regulator and government to decide whether to submit private key tracking.

[0066] Based on the same inventive concept, the third aspect of the present invention provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, it implements the blockchain transaction supervision method based on threshold encryption and linking algorithm described in the first aspect.

[0067] Based on the same inventive concept, the fourth aspect of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the processor executes the program, the blockchain transaction supervision method based on threshold encryption and linking algorithm described in the first aspect is implemented.

[0068] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows:

[0069] This invention provides a blockchain transaction monitoring method based on threshold encryption and a chaining algorithm. The method begins by generating relevant system parameters through system initialization, then verifies user-generated transactions. After verification, valid encrypted transactions are packaged and uploaded to the blockchain. Encrypted transactions generated by the same user within a preset time period are chained, and the transaction amounts within the encrypted transactions are aggregated to calculate the total transaction amount and number of transactions within the preset time period. Violations of regulatory rules are determined based on the number of transactions T and the total transaction amount. If violations occur, the abnormal transaction is submitted to the regulator for further review. Finally, the user, regulator, and government each decide whether to submit private key tracking. This scheme, through the use of chaining algorithms and threshold encryption, significantly enhances user privacy. Even when transaction records are extensively analyzed, the user's true identity remains difficult to directly identify. This mitigates the risk of identity exposure faced by users during legitimate transactions. While maintaining transaction anonymity, the present invention allows for user tracking and monitoring when necessary. This design is significant in combating illegal activities and ensuring regulatory compliance, particularly in blockchain applications that must meet strict regulatory requirements.

[0070] In addition, the present invention ensures the user's sovereignty over their data and distributes the tracking rights of user information to three entities through a threshold private key distribution mechanism, preventing unauthorized access or abuse, and effectively preventing internal collusion within regulatory authorities, avoiding the risk of single point failure. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0072] Figure 1 A flowchart of a blockchain transaction supervision method based on threshold encryption and linking algorithm provided in an embodiment of the present invention;

[0073] Figure 2 A flowchart of the framework of blockchain-based transaction supervision provided for an embodiment of the present invention;

[0074] Figure 3 A module diagram of a blockchain transaction monitoring system based on threshold encryption and linking algorithms provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0075] The present invention discloses a blockchain transaction supervision method based on threshold encryption and a linking algorithm. The entities involved in the present invention include users, regulators, governments, verifiers, and smart contracts. The main implementation steps are as follows: Step 1: System initialization, generating a threshold encryption public-private key pair and a threshold value; Step 2: The user initiates a transaction to generate an initial Tx, which is then encrypted to generate an encrypted transaction T'x; Step 3: The verifier verifies the validity of T'x and packages and records it on the blockchain; Step 4: The government detects abnormal transactions and then submits the abnormal transactions to the regulator for further review. Finally, the user, regulator, and government each decide whether to submit private key tracking. The present invention utilizes the private key distribution mechanism of threshold encryption to give users a certain degree of power to ensure that their privacy will not be forcibly decrypted. At the same time, based on the self-developed linking algorithm, it realizes the supervision of users with abnormal transactions. The two methods are combined to realize the supervision of transaction anomalies by multiple parties, effectively preventing collusion between the government and regulators and protecting the privacy of users.

[0076] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0077] Example 1

[0078] This invention discloses a blockchain transaction supervision method based on threshold encryption and linking algorithm, see Figure 1 ,include:

[0079] S1: Initialize the system and generate threshold encryption public and private key pairs, threshold values, and user public and private key pairs;

[0080] S2: Users conduct transactions with each other using pseudonyms. An initial transaction is generated based on the user's pseudonym, and then the generated initial transaction is encrypted to obtain an encrypted transaction. The pseudonym is obtained by encrypting the user's public key using the threshold public key. The encrypted transaction includes the transaction amount and the linkable IDs of the two parties to the transaction. The linkable ID is generated by the pseudonym using a linking algorithm.

[0081] S3: The validator verifies the validity of the encrypted transaction. Once the verification is passed, the valid encrypted transaction is packaged and uploaded to the chain;

[0082] S4: Link the encrypted transactions generated by the same user within a preset time period, aggregate the transaction amounts in the encrypted transactions, and calculate the total transaction amount and number of transactions within the preset time period; and determine whether the regulatory rules are violated based on the number of transactions T and the total transaction amount; if violated, the abnormal transaction will be submitted to the regulator for re-examination, and finally the user, regulator and government will each decide whether to submit private key tracking.

[0083] This embodiment proposes a blockchain transaction supervision method based on threshold encryption and a self-developed linking algorithm. This method combines threshold encryption technology with a self-developed linking algorithm (the linking algorithm used in this invention). The combination of the two technologies ensures user privacy while achieving transaction compliance and traceability. It also solves the problem of user data sovereignty in the blockchain transaction system and the problem of over-centralization of regulatory power. The designed linking algorithm is interspersed in each step. The specific solution involves the following algorithms and steps:

[0084] Key Generation Algorithm (KeyGen): Responsible for generating the key pairs required by the system (including threshold encryption public and private key pairs, user public and private key pairs), preparing for the subsequent system to protect user privacy and track and supervise.

[0085] LinkEncrypt: This algorithm is responsible for encrypting the user's real public key in a linkable manner and encrypting the user's transaction amount, ensuring user privacy while being able to track the user's true identity when the user violates the rules.

[0086] Encrypted Tx Generation Algorithm (TxGen): Responsible for generating encrypted transactions T'x, ensuring transaction privacy while ensuring transaction verifiability, ensuring transaction privacy and security.

[0087] Transaction Verification Algorithm (TxVerify): Responsible for verifying the encrypted transaction T'x, verifying the validity of the transaction, and ensuring the legality, integrity and security of each transaction.

[0088] Transaction Link Algorithm (TxLink): Responsible for linking all transactions of the same user within a period of time. The government uses linked transactions to preliminarily determine which users have violated regulations and submits the violating users to regulators for further review.

[0089] Transaction Tracking Algorithm (TxTrace): Responsible for tracking suspicious users. The three entities decide whether to submit private keys to track the user's real public key.

[0090] The mentioned linking algorithms are interspersed in each step and are therefore not listed separately.

[0091] In step S1, the system is initialized to generate a threshold encryption public-private key pair, a threshold value, and a user's public-private key;

[0092] In order to generate basic cryptographic parameters and distribute key shards, the security and functionality of the entire system are ensured. In this way, the system can set the required keys and parameters, laying the foundation for subsequent encryption and verification operations. The generated threshold public key pkt is used to encrypt the user's public key pku and generate the pseudonym nym, providing the user with a first layer of anonymity protection; the generated threshold private key skt will be divided into j private key shards according to the characteristics of threshold encryption and temporarily stored. It will be distributed to users, governments and regulators in the final tracking stage. The number of shards distributed is determined by these three entities. The setting of the threshold value t is related to the power of users, regulators and governments, and should be set according to actual conditions.

[0093] In step S2, the user initiates a transaction to generate an initial Tx, then encrypts the initial Tx to generate an encrypted Tx;

[0094] In order to protect the privacy of users, the initial Tx initiated by the original user needs to be encrypted. Since the parts of Tx involving user privacy include the public keys of both transaction users and the transaction amount, only the public keys of both transaction users and the transaction amount are encrypted here. In order to facilitate subsequent tracking, the encryption of the public keys of both users and the transaction amount uses a self-developed linking algorithm.

[0095] Step S3 verifies the validity of the transaction and packages and records it on the chain;

[0096] In order to ensure the validity of transactions and ensure the legality, integrity and security of each transaction, a strict transaction verification mechanism is implemented to prevent malicious transactions from entering the blockchain system and ensure the overall security and stability of the system.

[0097] Step S4: The government detects abnormal transactions and then submits them to the regulator for further review. Finally, the user, regulator, and government each decide whether to submit private key tracking.

[0098] In order to ensure the legitimacy of transactions, screen and identify illegal transactions, track down the real public keys of malicious users, and protect users' data sovereignty, prevent regulators from having too much power, resulting in collusion attacks and thus single points of failure, this is achieved here through the distribution of self-developed linking algorithms and threshold private keys skt.

[0099] In one embodiment, S1 may be implemented as follows:

[0100] System initialization generates a threshold public-private key pair (pkt, skt) and public parameters such as threshold value t, user public key, user private key, etc., and selects a secure bilinear pairing group G1, G2 and target group G T, whose order is a prime number p; generate a bilinear pairing e:G1×G2→G T ; Select a generator g∈G1 and a random private key α∈Zp; then calculate the public key g α =g α , where g α ∈G1; the system generates a public key (g,g α ), named the threshold public key pkt, and the generated private key α, named the threshold private key skt; define the system parameters n as the total number of participants, and t as the threshold value; the setting of the threshold value t involves three entities (users, regulators, and the government), who jointly determine the generation of these parameters. Finally, the threshold public key pkt and the threshold value t are broadcast, and the threshold private key skt is kept secret. The user public key pku is encrypted with the threshold public key pkt to generate the pseudonym nym, and the mapping relationship between the pseudonym and the user public key pku is one-to-one; the threshold private key skt is divided into j private key shards for temporary storage, and these j private key shards are distributed to the three entities of users, regulators, and governments at a specific time. The three entities jointly determine the number of private key shards to be distributed, and the number of private key shards is proportional to the power.

[0101] In one embodiment, the initial transaction Tx in step S2 is in the following form:

[0102] Tx={nym from ,nym to ,value}

[0103] nym from Indicates the payer's pseudonym, nym to The payee's pseudonym is used, the payer and payee are users, and value represents the transaction amount.

[0104] The encrypted transaction T'x has the following form:

[0105] T'x={linkable_ID from ,linkable_ID to ,E(value),R,π,σ}

[0106] linkable_ID from Indicates the linkable ID of the payer, linkable_ID toIt represents the linkable ID of the payee, E(value) represents the encrypted transaction amount (transaction amount ciphertext), R represents a random number, π represents zero-knowledge proof, and σ represents a signature. The linkable ID is obtained by encrypting the pseudonym with the self-developed linking algorithm. The pseudonym and the linkable ID are in a one-to-many mapping relationship. Each time a user generates an initial transaction tx, it must be encrypted with the self-developed linking algorithm. The linkable ID generated by the same pseudonym each time it is encrypted with the self-developed linking algorithm is different. The transaction amount ciphertext obtained by encrypting the same transaction amount value each time is different, thereby preventing malicious users from analyzing the transaction amount value to obtain the user's true identity.

[0107] The specific implementation of step S2 includes the following sub-steps:

[0108] S2.1: The pseudonym in the initial transaction Tx is encrypted again using the linkable algorithm to generate a linkable_ID:

[0109] linkable_ID=Enc(nym,R)=nym·g R

[0110] R is a random number used to ensure that the linkable ID generated by each encryption of the same pseudonym is different, preventing malicious users from obtaining the user's real public key by analyzing the fixed pseudonym nym;

[0111] S2.2: The transaction amount value is generated through Paillier homomorphic encryption to generate E(value):

[0112] E(value)=Enc paillier (value,r)=g value ·r N modN 2

[0113] Where r is the random number in the Paillier encryption, and N is the modulus of the Paillier encryption. The same transaction amount, value, is encrypted using the self-developed linking algorithm, resulting in a different encrypted amount, E(value), each time. This is to prevent malicious users from analyzing the transaction amount value to reveal the user's true identity.

[0114] S2.3: Generate a non-interactive zero-knowledge proof π. This zero-knowledge proof π is used to prove the correctness of the transaction user and to facilitate subsequent verification with the verifier without revealing the user's identity.

[0115] S2.4: Calculate the message hash m:

[0116] m=H(linkable_IDfrom ,linkable_ID to ,E(value),π)

[0117] Where H is a cryptographic hash function; the signature σ is generated using the user's private key SKU:

[0118] σ=Sign(SKU,m)=SKU·H(m)

[0119] S2.5: Integrate the linkable IDs, encrypted transaction amount, zero-knowledge proof, and signature of both parties to construct a complete encrypted Tx:

[0120] Encrypted Tx = {linkable_ID from ,linkable_ID to ,E(value),π,σ}

[0121] Among them, the encrypted Tx contains the linkable IDs of both parties to the transaction, the encrypted value of the transaction amount, non-interactive zero-knowledge proof and signature, ensuring the privacy, authenticity and verifiability of the transaction.

[0122] In one embodiment, step S3 verifies the validity of the transaction and packages and records the contents on the chain as follows:

[0123] The validator verifies the validity of the encrypted transaction T'x. The verification content includes: the correctness of the transaction format, the correctness of the identities of the two parties to the transaction, and whether the payer's balance is sufficient for the transaction. The validator verifies the correctness of the identities of the two parties to the transaction by verifying the proof π in the encrypted Tx, verifies the correctness of the transaction format by verifying the content in the encrypted Tx, and determines whether the user's balance is sufficient for the transaction by reviewing the user's balance through the state tree. After the verification is completed, the valid encrypted Tx is packaged and recorded on the chain.

[0124] The state tree is constructed based on the Merkle Patricia Tree (MPT) structure, an improved structure based on Ethereum. It initializes the on-chain and off-chain storage parts. The on-chain storage is the block summary (Root Hash), and the off-chain storage is the block body. The block body contains specific account status information. The on-chain and off-chain data are updated and synchronized through the oracle. The purpose of storing the block body off-chain is to protect the privacy of users. The user account information stored in the block body can only be opened by validators.

[0125] The state tree node structure contains the following fields: node type (branch node, extension node or leaf node), key-value pair (storing account address and corresponding account status) and hash value;

[0126] The account status includes the following information: pseudonym (the user's public key PKU obtained through threshold encryption), balance (the user's account balance), and nonce.

[0127] In one embodiment, the specific implementation of step S3 includes the following sub-steps:

[0128] S3.1: The verifier checks whether the contents of the encrypted transaction T'x conform to the predetermined transaction format requirements;

[0129] Vry(T'x)→0 / 1

[0130] S3.2: The verifier verifies the correctness of the transaction party’s identity by verifying the proof π;

[0131] Vry(π)→0 / 1

[0132] S3.3: The verifier verifies that the payer's balance is sufficient for this transaction. First, the verifier decrypts the payer's linkable_ID to obtain the pseudonym. Then, the verifier reviews the user's balance according to the state tree, extracts the user's balance (Balance) and the ciphertext of the transaction amount (E(value)), and decrypts the ciphertext of the transaction amount to obtain the plaintext value:

[0133] value=D k (E(value))

[0134] Among them, Dk is the decryption function of Paillier homomorphic encryption; then verify whether the user balance is sufficient for the transaction amount. If the user balance is greater than the transaction amount:

[0135] Balance≥value

[0136] This indicates that the user's balance is sufficient for this transaction and the transaction is valid;

[0137] After confirming the validity of the encrypted transaction, the validator packages it and records it on the blockchain. The updated data on the chain is updated to the off-chain through the oracle, ensuring the real-time performance of the block summary stored on the chain and the block data stored off-chain.

[0138] In one embodiment, the government detects abnormal transactions as described in step 4 and then submits the abnormal transactions to the regulator for further review. Finally, the user, the regulator, and the government each decide whether to submit private key tracking; specifically, the following steps are involved:

[0139] The government links the transaction records on the blockchain over a period of time to obtain all the encrypted Txs of users who use the same pseudonym to conduct transactions over a period of time, calculates the number of transactions, and the smart contract aggregates and adds up the encrypted transaction amount E(value) to obtain the total encrypted amount E(value).sum ), and E(value sum ) Submit it to the government for decryption to obtain the value sum Then, by comparing the number of transactions and value sum Determine whether the regulatory rules are violated. If so, the smart contract will sum ) is submitted to the regulator for another review. The regulator will review the number of transactions and the value of E( sum ) Decrypt again to determine whether it violates the regulatory rules. When the judgment ends, the system distributes the threshold private key shard skt through the smart contract, and divides skt into j parts to each entity j / 3 of the user, government and regulator. Then the three entities each decide whether to submit the private key and whether to track. The submitted private key is collected through the smart contract. If the total number n of collected private key shards is greater than or equal to the threshold value t, the user's real public key can be decrypted. It is assumed here that the regulator always aims to obtain the maximum benefit. The regulator who correctly supervises a transaction can get k gold coins and increase the reputation value by 1 point as a reward. For users who have generated illegal transactions but the regulator does not submit the private key, 10k gold coins and 5 reputation points will be deducted from the regulator as a penalty. When the regulator's reputation value is reduced to 0, the system automatically revokes the regulator's regulatory authority.

[0140] See Figure 2 This is a flowchart of the transaction supervision based on blockchain in the present invention.

[0141] In one embodiment, the specific implementation of step 4 includes the following sub-steps:

[0142] S4.1: Link transaction users. Let the set of all transactions on the blockchain within a period of time be , where S is the total number of transactions in the time period, i represents the i-th transaction among all transactions in the time period; the government Find all transactions using the same pseudonym by linking the linkable_ID in the .

[0143] {Tx i |Dec(linkable_ID i )=nym}

[0144] Where Dec is the decryption function of the linkable ID;

[0145] The government links the transaction records during that period on the blockchain to obtain all encrypted transactions of users using the same pseudonym during that period and calculates the number of transactions T:

[0146]

[0147] Where 1(·) is an indicator function, which takes the value 1 when the condition is true and takes the value 0 when it is false. Through the above operations, transactions with the same pseudonym are linked and the number of transactions is calculated.

[0148] S4.2: Aggregate encrypted transaction amount. The smart contract encrypts the transaction amount E (value) of all transactions of the pseudonymous user in this time period. i ) are aggregated and added to obtain the total encrypted amount E(value sum ):

[0149]

[0150] Then generate the aggregate amount E(value sum )'s commitment c:

[0151] c=Commitment(E(value sum ))=g E(valuesum) modp

[0152] Where g is the generator, p is a large prime number, and then the total amount of encrypted amount E (value sum ) and commitment c sent to the government;

[0153] S4.3: Government's E(value sum ) to decrypt and get value sum :

[0154] value sum =D key (E(value sum ))

[0155] Among them, Dkey is the decryption function and key is the decryption key.

[0156] S4.4: First, the government calculates the number of transactions T and value sum Determine whether the regulatory rules are violated; if the regulatory rules are violated, the smart contract will sum ) is submitted to the regulator for another review; then the regulator will review E(value sum ) Decryption is repeated to determine whether regulatory rules are violated. Submitting the information for review again aims to prevent excessive government power, which could lead to collusion attacks and single points of failure.

[0157] S4.5: Split the threshold private key skt into j parts so that any t or more parts can reconstruct the original private key skt. The specific steps are as follows:

[0158] (1) Choose a finite field F of order q q ;

[0159] (2) Select a random polynomial f(x) such that f(0) = skt, that is:

[0160] f(x)=skt+a1x+a2x 2 +...+a t-1 x t-1 modq

[0161] (3) Calculate the private key shard skt m is f(m), that is:

[0162] skt m =f(m)modq for m=1,2,...,j

[0163] S4.6: Shard the private key skt m Sent to users, governments and regulators respectively, and the three entities decide whether to submit private key shards for tracking; when the threshold private key skt needs to be reconstructed, any t private key shards skt m You can use the Lagrange interpolation method to reconstruct skt:

[0164]

[0165] Through the above steps, when the number of collected private key fragments is greater than or equal to the threshold value t, the threshold private key skt can be recovered;

[0166] S4.7: Use the threshold private key skt to decrypt the user's pseudonym and obtain the user's real public key pku:

[0167] pku←dec(nym,skt)

[0168] Tracking successful.

[0169] Example 2

[0170] Based on the same inventive concept, this embodiment discloses a blockchain transaction supervision system based on threshold encryption and linking algorithm, see Figure 3 ,include:

[0171] System initialization module 301, used to initialize the system and generate threshold encryption public and private key pairs, threshold values, and user public keys;

[0172] Encryption module 302 is used to conduct transactions between users using pseudonyms, generate an initial transaction based on the user's pseudonym, and then encrypt the generated initial transaction to obtain an encrypted transaction. The pseudonym is obtained by encrypting the user's public key using the threshold public key. The encrypted transaction includes the transaction amount and linkable IDs of the two parties to the transaction. The linkable IDs are generated from the pseudonym using a linking algorithm.

[0173] Verification module 303 is used by the verifier to verify the validity of the encrypted transaction. After verification, the valid encrypted transaction is packaged and uploaded to the chain;

[0174] Aggregation module 304 is used to link the encrypted transactions generated by the same user within a preset time period, aggregate the transaction amounts in the encrypted transactions, calculate the total transaction amount and the number of transactions within the preset time period; and determine whether the regulatory rules are violated based on the number of transactions T and the total transaction amount; if violated, the abnormal transaction is submitted to the regulator for re-examination, and

[0175] The tracking module 305 is used for the final user, regulator and government to decide whether to submit private key tracking.

[0176] The aggregation link module is mainly used to link the encrypted Tx generated by the same user's transactions, aggregate the transaction amount, calculate the total transaction amount and transaction number within a period of time, and screen out illegal users;

[0177] The tracking module is mainly used to decrypt users who violate transaction rules and track their public key information.

[0178] Since the system described in Example 2 of the present invention is the system used to implement the blockchain transaction supervision method based on threshold encryption and linking algorithm described in Example 1 of the present invention, those skilled in the art will be able to understand the specific structure and variations of this system based on the method described in Example 1 of the present invention, and therefore will not be described in detail here. All systems used in the method described in Example 1 of the present invention fall within the scope of protection of the present invention.

[0179] Example 3

[0180] Based on the same inventive concept, the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method described in the first embodiment is implemented.

[0181] Since the computer-readable storage medium described in the third embodiment of the present invention is the computer-readable storage medium used to implement the blockchain transaction supervision method based on threshold encryption and linking algorithm in the first embodiment of the present invention, the specific structure and variations of the computer-readable storage medium are well understood by those skilled in the art based on the method described in the first embodiment of the present invention, and therefore will not be described in detail here. All computer-readable storage media used in the method of the first embodiment of the present invention fall within the scope of protection of the present invention.

[0182] Example 4

[0183] The present invention also provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first embodiment when executing the program.

[0184] Since the computer device described in Example 4 of the present invention is the computer device used to implement the blockchain transaction supervision method based on threshold encryption and linking algorithm in Example 1 of the present invention, those skilled in the art will be able to understand the specific structure and variations of the computer device based on the method described in Example 1 of the present invention, and therefore will not be described in detail here. All computer devices used in the method of Example 1 of the present invention fall within the scope of protection of the present invention.

[0185] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0186] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0187] Although preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they are aware of the basic inventive concepts. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention. Obviously, those skilled in the art may make various changes and modifications to the embodiments of the present invention without departing from the spirit and scope of the embodiments of the present invention. Thus, the present invention is intended to include such changes and modifications to the embodiments of the present invention if they fall within the scope of the claims and their equivalents.

Claims

1. A blockchain transaction supervision method based on threshold encryption and linking algorithm, characterized in that: include: Initialize the system, generate threshold encryption public and private key pairs, threshold values, and user public and private key pairs; Users conduct transactions with each other using pseudonyms, and generate an initial transaction based on the user's pseudonym. The generated initial transaction is then encrypted to obtain an encrypted transaction. The pseudonym is obtained by encrypting the user's public key using the threshold public key. The encrypted transaction includes the transaction amount and the linkable IDs of both parties to the transaction. The linkable ID is generated by the pseudonym through a linking algorithm. The linkable ID is calculated as follows: , R represents a random number, Indicates the user's pseudonym, Indicates a linkable ID; The validator verifies the validity of the encrypted transaction and packages the valid encrypted transaction on the chain after passing the verification; The encrypted transactions generated by the same user within a preset time period are linked, and the transaction amounts in the encrypted transactions are aggregated to calculate the total transaction amount and number of transactions within the preset time period; and whether the regulatory rules are violated is determined based on the number of transactions T and the total transaction amount; if violated, the abnormal transaction is submitted to the regulator for re-examination, and finally the user, regulator and government each decide whether to submit private key tracking.

2. The blockchain transaction supervision method based on threshold encryption and linking algorithm as claimed in claim 1 is characterized in that: System initialization generates threshold encryption public and private key pairs, threshold values, and user public and private key pairs, including: Choose a secure bilinear pairing group G 1. G 2 and target group G T , whose order is a prime number p; Generate a bilinear pairing e: ; Select a generator g∈ G 1 and a random private key α∈Zp; Calculate the public key g α = g α , where g α ∈ G 1. The system generates a public key ( g,g α ), as the threshold public key pkt, and generate the private key α, as the threshold private key skt, generate the threshold value and the user public key and the user private key; The threshold public key pkt and the threshold value t are broadcasted, the threshold private key skt is secret, and the threshold private key skt is divided into j private key shards and temporarily stored.

3. The blockchain transaction supervision method based on threshold encryption and linking algorithm as claimed in claim 2 is characterized in that: Users conduct transactions with each other using pseudonyms, and generate initial transactions based on the user's pseudonym. The generated initial transactions are then encrypted to obtain encrypted transactions, including: The initial transaction Tx includes the user pseudonym and the transaction amount. The user pseudonym is encrypted again through the linking algorithm to generate a linkable ID, and the transaction amount value is encrypted through Paillier homomorphic encryption to generate the encrypted transaction amount. The specific method is as follows: Where r is the random number in Paillier encryption, N is the modulus of Paillier encryption, is the transaction amount, The encrypted transaction amount; Generate non-interactive zero-knowledge proof π; Calculate the message hash m: Among them, H is a cryptographic hash function, A linkable ID representing the payer, Represents the linkable ID of the payee, and uses the user's private key SKU to generate the signature σ: Integrate the linkable IDs, encrypted transaction amounts, zero-knowledge proofs, and signatures of both parties to construct a complete encrypted transaction. : 。 4. The blockchain transaction supervision method based on threshold encryption and linking algorithm as claimed in claim 1 is characterized in that: The validator verifies the validity of the encrypted transaction. Once the verification is passed, the valid encrypted transaction is packaged and uploaded to the chain, including: The verifier checks whether the content contained in the encrypted transaction complies with the predetermined transaction format requirements; The verifier verifies the correctness of the transaction party’s identity by verifying the proof π; The verifier verifies that the payer's balance is sufficient for the transaction. If it is sufficient, the transaction is valid. Once the verification is passed, the valid transaction will be packaged and recorded on the blockchain, where the updated data on the chain will be updated to the off-chain through the oracle.

5. The blockchain transaction supervision method based on threshold encryption and linking algorithm as claimed in claim 4 is characterized in that: The validator verifies that the payer's balance is sufficient for the transaction, including: The verifier decrypts the payer's linkable ID to obtain the payer's pseudonym, then reviews the payer's balance based on the state tree, extracts the user's balance plaintext and the transaction amount ciphertext, and decrypts the transaction amount ciphertext to obtain the transaction amount: in, It is the decryption function of Paillier homomorphic encryption; Verify whether the user's balance is sufficient for the transaction amount: The user balance. If the user balance is greater than the transaction amount, it means that the user balance is sufficient for this transaction and the transaction is valid.

6. The blockchain transaction supervision method based on threshold encryption and linking algorithm as claimed in claim 2 is characterized in that: Link the encrypted transactions generated by the same user within a preset time period, aggregate the transaction amounts in the encrypted transactions, and calculate the total transaction amount and number of transactions within the preset time period; And determine whether there is a violation of regulatory rules based on the number of transactions T and the total transaction amount, including: The government links crypto transactions using the same pseudonym within a preset time period: in, Represents the linked transaction, i represents the i-th transaction among all transactions within the preset time period, represents the linkable ID contained in the i-th transaction, and Dec is the decryption function of the linkable ID; Calculate the number of transactions T based on the linked transactions: Where S is the total number of transactions in the preset time period, 1(·) is an indicator function, which takes the value 1 when the condition is true and 0 when it is false; The smart contract aggregates the encrypted transaction amounts of all transactions by a pseudonymous user within a preset time period to obtain the total encrypted amount, then generates a commitment c for the total encrypted amount. The total encrypted amount and commitment c are then sent to the government. The encrypted transaction amount aggregation and commitment are generated as follows: in, is the encrypted transaction amount of the i-th transaction, The encrypted amount is then summed up to generate a commitment c to the encrypted amount: is a generator, p is a large prime number; The government decrypts the encrypted total amount to obtain the original total amount. The decryption method is: in, is the decryption function, key is the decryption key, is the total original amount; The government determines whether regulatory rules have been violated by analyzing the number of transactions T and the total original amount.

7. The blockchain transaction supervision method based on threshold encryption and linking algorithm as claimed in claim 2 is characterized in that: The method further includes decrypting the user who violates the transaction rules and tracking and obtaining the user's public key information, specifically: The smart contract divides the threshold private key skt into j parts, each of which is a threshold private key shard, and distributes them to users, governments, and regulators. Each entity receives j / 3 threshold private key shards, where j is the number of threshold private key shards. When the regulator submits a private key for tracking, the private key shards submitted by the regulator are collected through the smart contract. If the total number of collected private key shards is greater than or equal to the threshold value t, the user's real public key is decrypted.

8. A blockchain transaction supervision system based on threshold encryption and linking algorithm, characterized in that: include: System initialization module, used to initialize the system and generate threshold encryption public and private key pairs, threshold values, and user public and private key pairs; The encryption module is used to conduct transactions between users using pseudonyms. It generates an initial transaction based on the user's pseudonym and then encrypts the generated initial transaction to obtain an encrypted transaction. The pseudonym is obtained by encrypting the user's public key using the threshold public key. The encrypted transaction includes the transaction amount and the linkable IDs of the two parties to the transaction. The linkable ID is generated by the pseudonym through a linking algorithm. The linkable ID is calculated as follows: , R represents a random number, Indicates the user's pseudonym, Indicates a linkable ID; The verification module is used by the verifier to verify the validity of the encrypted transaction. After the verification is passed, the valid encrypted transaction is packaged and uploaded to the chain; The aggregation module is used to link the encrypted transactions generated by the same user within a preset time period, aggregate the transaction amounts in the encrypted transactions, calculate the total transaction amount and number of transactions within the preset time period; and determine whether the regulatory rules are violated based on the number of transactions T and the total transaction amount; if violated, the abnormal transaction will be submitted to the regulator for re-examination, and The tracking module is used by the final user, regulator and government to decide whether to submit private key tracking.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, it implements the blockchain transaction supervision method based on threshold encryption and linking algorithm as described in any one of claims 1 to 7.

10. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, it implements the blockchain transaction supervision method based on threshold encryption and linking algorithm as described in any one of claims 1 to 7.

Images