Secure and controllable transaction method and system of block chain

Abstract

The embodiment of the invention provides a safe and controllable transaction method and system of a block chain, and the method comprises the steps: selecting a base point G in a finite field defined by an elliptic curve E, and generating a public key B according to the base point G and a private key b randomly selected by a receiver; the receiving side sends a public key B and a signature of the public key B to the supervisor, a random factor d sent by the supervisor is received, the random factor d is selected after the supervisor verifies the signature of the public key B, and a transaction public key D is obtained through calculation according to the random factor d and the public key B; the receiver sends the transaction public key D to the sender, receives a sender public key R returned by the sender, calculates and obtains a shared secret key c based on the transaction public key D and the public key R, and the receiver obtains assets transacted by the sender through the temporary address C according to the shared secret key c, the temporary address C is calculated by the sender according to the transaction public key D and the shared secret key c.

Description

Technical Field

[0001] The present application belongs to the field of computer software and security detection technology, and specifically relates to a secure and controllable transaction method and system for blockchain. Background Art

[0002] In the blockchain, the two parties exchanging data can be anonymous. Each node in the system can conduct transactions or transfers without knowing each other's identity and personal information. That is, the parties involved in the transaction can only be identified by the addresses derived from their public keys. Although these addresses are associated with individuals in the real world, other people do not know the specific identities behind these addresses, which is the anonymity of the blockchain. In the transaction process of the existing blockchain, a temporary address is negotiated by the sender and the receiver. The receiver has the private key of the temporary address, that is, the control authority. Each existing transaction is related to the generated temporary address. The real address of the receiver cannot be derived from the temporary address, thereby protecting the identity of the transferor.

[0003] The sender of the existing transaction still knows the correspondence between the receiver's real address and the temporary address, so the sender may leak the receiver's real address; and the sender may operate on the transaction assets, affecting the security of the blockchain transaction. Summary of the invention

[0004] The present application provides a secure and controllable transaction method and system for blockchain, which can prevent the sender from leaking the real address of the receiver and can prevent the sender from manipulating the transaction assets, thereby improving the security of blockchain transactions.

[0005] In a first aspect, the present application provides a secure and controllable transaction method of a blockchain, the method comprising the following steps:

[0006] Select a base point G on the finite field defined by the elliptic curve E, and generate a public key B based on the base point G and the private key b randomly selected by the recipient;

[0007] The receiver sends the public key B and the signature of the public key B to the regulator, and receives the random factor d sent by the regulator, where the random factor d is the random factor d selected by the regulator after verifying the signature of the public key B, and the transaction public key D is calculated based on the random factor d and the public key B;

[0008] The receiving party sends the transaction public key D to the sender, receives the sender's public key R returned by the sender, and calculates the shared secret key c based on the transaction public key D and the public key R. The receiving party obtains the assets traded by the sender through the temporary address C based on the shared secret key c. The temporary address C is a temporary address calculated by the sender based on the transaction public key D and the shared secret key c.

[0009] In a second aspect, a secure and controllable transaction system of a blockchain is provided, the system comprising:

[0010] A generation unit, used to select a base point G on the finite field defined by the elliptic curve E, and generate a public key B based on the base point G and a private key b randomly selected by the receiver;

[0011] A communication unit, used to send the public key B and the signature of the public key B to the supervisor, and receive the random factor d sent by the supervisor, where the random factor d is the random factor d selected by the supervisor after verifying the signature of the public key B;

[0012] A processing unit, configured to calculate a transaction public key D according to the random factor d and the public key B;

[0013] A communication unit, used to send the transaction public key D to the sender, and receive the sender public key R returned by the sender;

[0014] The processing unit is also used to calculate a shared secret key c based on the transaction public key D and the public key R. The recipient obtains the assets traded by the sender through the temporary address C based on the shared secret key c. The temporary address C is a temporary address calculated by the sender based on the transaction public key D and the shared secret key c.

[0015] In a third aspect, the present application provides a computer storage medium storing a computer program for electronic data exchange, wherein the computer program enables a computer to execute some or all of the steps described in the first aspect of the present application.

[0016] The embodiments of the present application have the following beneficial effects:

[0017] The generation of the temporary address C of the technical solution provided by the present application depends on the shared secret key C and the transaction public key D, and the generation of the shared secret key C depends on the private key R temporarily generated by the sender and the factor d randomly generated by the receiver, so each transaction address (i.e., temporary address C) is different, thereby effectively preventing the attacker from associating the actual receiver entity identity through on-chain data analysis. Since the sender does not know the random factor d; the sender only knows the transaction public key D, and the transaction public key D is calculated by the public key B and the random factor d, it is impossible to deduce the receiver's real receiving address B, thereby preventing the sender from leaking the receiver's real address; on the other hand, for the temporary address C, the temporary address C is a temporary address calculated based on the transaction public key D and the shared secret key c. Since the sending method directly receives the transaction public key D, it is impossible to deduce the private key b and the random factor d based on the transaction public key D, and it is impossible to construct the private key b*c*d of the temporary address C, so the sender cannot operate the assets in the temporary address C, that is, the sender cannot operate the transaction assets in the temporary address C, thereby ensuring the security of the assets. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 is a schematic diagram of the structure of a computer provided in an embodiment of the present application;

[0020] Figure 2 This is a flowchart of a secure and controllable transaction method of a blockchain provided by an embodiment of the present application;

[0021] Figure 3 This is a flowchart of a secure and controllable transaction method of a blockchain provided in Example 1 of the present application;

[0022] Figure 4 It is a structural diagram of a secure and controllable transaction system of a blockchain provided in an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0024] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, systems, products or devices.

[0025] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0026] The following is an introduction to the relevant terms involved in this application.

[0027] Blockchain: A new distributed infrastructure and computing method that uses block chain data structures to verify and store data, distributed node consensus algorithms to generate and update data, cryptography to ensure the security of data transmission and access, and smart contracts composed of automated script codes to program and operate data.

[0028] Public key system: keys are generated in pairs, each pair of keys consists of a public key and a private key. In practical applications, the private key is kept by the owner, while the public key needs to be made public.

[0029] Elliptic Curve Cryptography (ECC) is a public key cryptographic algorithm based on elliptic curve mathematics. It provides a secure way to perform cryptographic operations such as key exchange, digital signatures, and encryption.

[0030] Hash: It can also be called hash or hash. It transforms input of any length into output of fixed length through a hash algorithm, and ensures that different inputs will not have the same output with a high probability.

[0031] Key negotiation: A key negotiation algorithm widely used in computer network communications. It can securely create a shared key over an insecure channel, allowing the communicating parties to negotiate a secure communication key without any pre-shared key.

[0032] The following describes the system architecture of a computer related to an embodiment of the present application.

[0033] The present application also provides a computer 10, such as Figure 1 As shown, it includes at least one processor 11 and a memory 12, and may also include a communications interface 14 and a bus 13. The processor 11, the memory 12 and the communications interface 14 may communicate with each other through the bus 13. The communications interface 14 may transmit information. The processor 11 may call the logic instructions in the memory 12 to execute the method in the above embodiment.

[0034] In addition, the logic instructions in the above-mentioned memory 12 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. The above-mentioned logic instructions can also become an operating system, application program or computer program, etc.

[0035] The memory 12 is a computer-readable storage medium that can be configured to store software programs, computer executable programs, such as program instructions or modules corresponding to the methods in the embodiments of the present disclosure. The processor 11 executes functional applications and data processing by running the software programs, instructions or modules stored in the memory 12, that is, implementing the methods in the above embodiments.

[0036] The memory 12 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and at least one application required for a function; the data storage area may store data created according to the use of the computer 10, etc. In addition, the memory 12 may include a high-speed random access memory and may also include a non-volatile memory. For example, a variety of media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, may also be a transient storage medium.

[0037] It is understandable that the computer in this embodiment can be understood as a server, for example, the server includes a cloud server or an edge server, and no unique limitation is made here. Of course, in an optional technical scenario, the above-mentioned computer can also be a personal computer (PC), a tablet computer, a laptop computer, and other smart devices. This application does not limit the specific form of the above-mentioned computer, as long as the above-mentioned computer has an operating system and shortcuts.

[0038] The specific methods are introduced in detail below.

[0039] See also Figure 2 , This application also provides a safe and controllable transaction method for blockchain, Figure 2 A flowchart of a secure and controllable transaction method of blockchain provided in this application, the above method can be used in Figure 1 The computer shown in the figure can be a personal computer, a server, a tablet computer, a laptop computer or other smart devices. The computer can form a blockchain network. The method is as follows: Figure 2 As shown, the following steps are included:

[0040] Step S201, select a base point G on the finite field defined by the elliptic curve E, and generate a public key B based on the base point G and a private key b randomly selected by the recipient;

[0041] For example, the elliptic curve E can be defined on a finite field Fp, where p is a large prime number, and the base point G can be a generator of the elliptic curve E on the finite field Fp.

[0042] The following example illustrates the selection of the base point G. Here, it is assumed that the elliptic curve E is: 2 =X 3 +7, the above elliptic curve E in the finite field F 23 On the graph, the selected base point G can be: (19,1), that is, the base point G is used as the generator of the elliptic curve E.

[0043] For example, the generation of the public key B based on the base point G and the private key b randomly selected by the recipient may specifically include:

[0044] B = b·G; where b is the private key randomly selected by the recipient.

[0045] Here we assume that the recipient randomly selects the private key b=5, then B=5·(19,1)=(1,13).

[0046] Step S202: The receiver sends the public key B and the signature of the public key B to the supervisor, and receives the random factor d sent by the supervisor, where the random factor d is the random factor d selected by the supervisor after verifying the signature of the public key B, and the transaction public key D is calculated based on the random factor d and the public key B;

[0047] For example, the transaction public key D calculated based on the random factor d and the public key B may specifically include:

[0048] After the regulator verifies the signature of public key B, it generates a random factor d, which satisfies d∈Fp. D is calculated based on the random factor d and public key B, and a mapping relationship between the recipient's real address and the transaction public key D is established. The specific calculation method of D includes:

[0049] D = d·B;

[0050] Assuming that the regulator chooses d=7, then the calculated D=7*(1,13)=(19,16).

[0051] For the receiver, after receiving the random factor, D can be calculated according to the above formula.

[0052] Step S203: The receiving party sends the transaction public key D to the sender, receives the sender's public key R returned by the sender, and calculates the shared secret key c based on the transaction public key D and the public key R. The receiving party obtains the assets traded by the sender through the temporary address C according to the shared secret key c. The temporary address C is a temporary address calculated by the sender based on the transaction public key D and the shared secret key c.

[0053] For example, the above-mentioned calculation of the shared secret key c based on the transaction public key D and the private key r may specifically include:

[0054] The receiver calculates the sender's private key r based on the public key R. The specific calculation method may include:

[0055] R = r·G;

[0056] The receiver then calculates the shared secret key c based on the transaction public key D and private key r. The specific calculation method is:

[0057] c = H (D·r) mod p;

[0058] Among them, H represents hash calculation. Here, SHA-256 is selected as the hash function. Of course, in other technical scenarios, other hash functions can also be selected; mod represents the remainder after dividing two values, and p is a large prime number. In the above example, p here is 23.

[0059] The recipient calculates the temporary address C based on the transaction public key D and the shared secret key c. The specific calculation method may include:

[0060] C=c·D

[0061] For the sender, the sender calculates the public key R according to the above formula, then calculates the shared secret key c according to the calculation formula, and then calculates the temporary address C according to the calculation formula of the temporary address C.

[0062] For example, the calculation of the temporary address C by the receiver may specifically include:

[0063] If D = (19, 16), p = 23, r = 3;

[0064] (19,18)=r·(19,1), r=3.

[0065] c=H(3·(19,16))mod 23=H(20,10)mod 23=15;

[0066] C=c·D=15·(19,16)=(20,12).

[0067] For the sender, the method of calculating the temporary address C is similar.

[0068] Since the hash operation is relatively complicated, in order to simplify the operation, the value of c is directly specified as 15. The 15 here does not represent the actual calculation result shown above.

[0069] In the above scheme, for the sender, what it directly receives is D, and D=d·B. If the sender cannot obtain the random factor d, it is impossible to deduce the public key B, so it is impossible to reversely deduce the real address of the receiver, thereby protecting the receiver.

[0070] The generation of the temporary address C of the technical solution provided by the present application depends on the shared secret key C and the transaction public key D, and the generation of the shared secret key C depends on the private key R temporarily generated by the sender and the factor d randomly generated by the receiver, so each transaction address (i.e., temporary address C) is different, thereby effectively preventing the attacker from associating the actual receiver entity identity through on-chain data analysis. Since the sender does not know the random factor d; the sender only knows the transaction public key D, and the transaction public key D is calculated by the public key B and the random factor d, it is impossible to deduce the receiver's real receiving address B, thereby preventing the sender from leaking the receiver's real address; on the other hand, for the temporary address C, the temporary address C is a temporary address calculated based on the transaction public key D and the shared secret key c. Since the sending method directly receives the transaction public key D, it is impossible to deduce the private key b and the random factor d based on the transaction public key D, and it is impossible to construct the private key b·c·d of the temporary address C, so the sender cannot operate the assets in the temporary address C, that is, the sender cannot operate the transaction assets in the temporary address C, thereby ensuring the security of the assets.

[0071] Optionally, the above method may further include:

[0072] The sender randomly selects k, calculates the challenge K based on the random selection k and the transaction public key D, generates a commitment challenge value e based on the challenge K, the temporary address C and the transaction m, builds a trusted proof z based on the random selection k and the commitment challenge value e, and sends the challenge K, transaction m, transaction public key D, commitment adjustment value e and trusted proof z to the regulator for transaction supervision. The transaction m contains the temporary address C.

[0073] For example, the challenge K calculated based on the random selection k and the transaction public key D may specifically include:

[0074] K = k·D;

[0075] Assuming here that k=11, the above K=k·D=11·(19,16)=(18,13).

[0076] For example, the generation of the commitment challenge value e based on the challenge K, the temporary address C and the transaction m may specifically include:

[0077] e=H(K||C||m);

[0078] Where m is the transaction data, C is the temporary address, and H represents the hash calculation.

[0079] For example, the above-mentioned construction of a trusted proof z based on the random selection k and the commitment challenge value e may specifically include:

[0080] z=k+ec;

[0081] Among them, k is randomly selected and c is the shared private key.

[0082] Optionally, sending the challenge K, transaction m, transaction public key D, commitment adjustment value e, and trusted proof z to the regulator for transaction supervision may specifically include:

[0083] The regulator receives the challenge K, transaction m, commitment adjustment value e and trusted proof z, calculates the product of the trusted proof and the transaction public key D to obtain the first product, calculates the product of the commitment adjustment value e and the temporary address C to obtain the second product, calculates the difference between the first product and the second product, and determines whether the challenge K is equal to the difference. If they are equal, it is determined that the temporary address C has been verified. Otherwise, it is determined that the temporary address C has failed to be verified.

[0084] For example, the supervisory party determining whether the challenge K is equal to the difference may specifically include:

[0085] K? = z·D-e·C;

[0086] Among them, ? = indicates whether they are equal.

[0087] For C = c·D, therefore:

[0088] z·D-e·C=(k+ec)·D-e·c·D=k·D+e·c·D-e·c·D=k·D=K; therefore, if the above parameters are the same, the above equations will be equal. If they are not equal, it is determined that the above parameter values ​​are different, that is, the verification of the temporary address C fails.

[0089] For example, for the above parameter values, we can calculate:

[0090] z·D-e·C=(11+17×15)·(19,16)-17·(20,12)=(18,13).

[0091] For example, the mapping relationship between the real address of the recipient and the transaction public key D may include:

[0092] Since the regulatory agency knows the mapping relationship between the random factor d and the real address B of the recipient <d, D, B>, it can find the corresponding random factor d and the real address B of the recipient based on D, so it only needs to verify whether the following equation holds:

[0093] D' = d·B? = D;

[0094] When the above equation holds true, a mapping relationship Lm=<d, D, B, C, m> is established between the recipient's real address and the transaction public key D.

[0095] Obviously, only when D'=D can it be said that D is generated based on B, and vice versa, which will not be elaborated. Because:

[0096] D'=d·B=b·d·G=D

[0097] This means that D must be generated based on B, so it is determined that C must be generated based on D, and C must be generated based on B, which means that C is associated with the real recipient address B. The regulatory agency associates the temporary address C and transaction m, that is, establishes a mapping relationship Lm=<d, D, B, C, m>; it means that the sender will transfer funds to the temporary address C through transaction m, and the real recipient address is B.

[0098] For example, before the receiving party obtains the assets traded by the sender through the temporary address C according to the shared secret key c, the above method may also include:

[0099] The sender signs the transaction data m using the sender's private key a to obtain the signed transaction data Ma = (m, S am ), and then use the shared key c to encrypt the signed transaction data Ma to obtain the encrypted data C(Ma), and transmit the encrypted data C(Ma) to the blockchain.

[0100] The above S am The specific calculation methods may include:

[0101] S am =Sign(m,a), where Sign is the signature algorithm, a is the private key, and m is the transaction data;

[0102] The calculation method of the above C(Ma) may specifically include:

[0103] C(Ma)=Enc(Ma,c), where Enc is a symmetric encryption algorithm. The encryption of C(Ma) can adopt the Sign signature algorithm. Of course, in other application scenarios, other signature algorithms can also be used. This application does not limit the specific form of the above signature algorithm.

[0104] For example, the receiving party may obtain the assets traded by the sender through the temporary address C based on the shared secret key c, which may specifically include:

[0105] The receiver monitors all encrypted data on the blockchain and uses the shared key c to decrypt the encrypted data (the decryption algorithm can use Enc). If the decryption is successful, the signed transaction data Ma is obtained after decryption, and the transaction asset m is obtained based on the transaction data Ma.

[0106] The above-mentioned acquisition of transaction asset m based on transaction data Ma can adopt the reverse signature algorithm, that is, the reverse algorithm of Sign to realize the extraction of m.

[0107] For example, the above method may further include:

[0108] The supervisor obtains the signed transaction data M sent by the recipient b ; Transaction data M b The data obtained by signing the transaction data Ma with the private key b can be used to query whether there is a mapping relationship Lm of m based on the transaction m. If the mapping relationship Lm is not found, the transaction is determined to be illegal and the recipient is notified to reject the transaction asset m.

[0109] For example, the above method may further include:

[0110] After the regulator queries the mapping relationship Lm with m, it extracts the temporary address of the mapping relationship Lm and determines whether the temporary address of Lm is equal to the temporary address C. If the temporary address C is not equal, it is determined that the transaction does not match the actual receiving address, and the recipient is notified to reject the transaction asset m.

[0111] For example, the above method may further include:

[0112] When the supervisor determines that the temporary address of Lm is consistent with the temporary address C, based on the transaction signature S bm The public key B in Lm is used to verify whether the signature is correct. If the verification is incorrect, the recipient is determined to be illegal. If the verification is correct, the recipient is notified that the verification is successful. After the recipient receives the verification feedback from the regulator, the decrypted signature and transaction data are uploaded to the chain, so that the assets are transferred to the temporary address C to complete the transaction.

[0113] Embodiment 1

[0114] See also Figure 3 , Embodiment 1 of the present application also provides a safe and controllable transaction method of blockchain, Figure 3 A flowchart of a secure and controllable transaction method of blockchain provided in this application, the above method can be used in Figure 1The computer shown in the figure can be a personal computer, a server, a tablet computer, a laptop computer or other smart devices, and the computer can form a blockchain network. In the technical scenario of this embodiment, the ellipse curve E is selected during initialization to be defined in a finite field F. P In the above example, p is a large prime number. For the convenience of calculation, p=23. A base point G is selected as the generator and H is the hash function. Assume that the elliptic curve E is: Y 2 =X 3 +7, the above elliptic curve E in the finite field F 23 On the other hand, the selected base point G can be: (19,1), and the hash function H uses SHA-256; the above method is as follows Figure 3 As shown, the following steps are included:

[0115] Step S301: The receiver randomly selects b=5 as the private key, calculates the public key B as (1,13) through G and b, and sends the public key B and the random factor of B's ​​signature application to the supervisor;

[0116] Step S302: After receiving the random factor application, the supervisor verifies B's signature, returns the random factor d=7, and constructs a corresponding relationship between the recipient's real address and the transaction public key D <d, D, B>.

[0117] The above D=d·B=7*(1,13)=(19,16).

[0118] Step S303: The receiver receives the random factor d=7, calculates the current transaction public key D=(19,16) based on the private key b and the random factor d, and sends the transaction public key D to the sender;

[0119] Step S304: The sender randomly selects r=3 as the sender's private key, calculates the sender's public key R=(19,18) based on r and G, calculates the shared key c and temporary address C based on the private key r and the transaction public key D through SHA-256, and sends the public key R to the receiver;

[0120] c=H(3·(19,16))mod 23=H(20,10)mod 23=15;

[0121] C=c·D=15·(19,16)=(20,12)

[0122] Step S305: The receiver calculates the shared private key c and the temporary address C based on the public key R and the transaction public key D, and the sender and receiver implement the transaction through the temporary address C.

[0123] According to R = r·G

[0124] (19,18)=r·(19,1), r=3.

[0125] c=H(3·(19,16))mod 23=H(20,10)mod 23=15;

[0126] C=c·D=15·(19,16)=(20,12).

[0127] By way of example, the above method may further include: an address registration phase and an address verification phase.

[0128] Address registration phase

[0129] In order to meet regulatory requirements and ensure asset security, regulators, as trusted institutions, need to know the actual receiving address and fund flow of each transaction to prevent risks such as money laundering and terrorist financing. In order to achieve the above goals, the sender needs to register with the regulator after generating a temporary address, and the regulator needs to be able to verify that the temporary address is generated based on the recipient's real address without disclosing the private key and shared secret key c of the temporary address C.

[0130] To meet the above requirements, the sender needs to provide a proof so that the regulator can verify that the temporary address C of the sender's transfer is generated based on the temporary address D provided by the receiver, and that the shared key c cannot be obtained. At the same time, the regulator can verify that the receiver's temporary address D is generated based on the receiver's real address B.

[0131] The sender randomly selects k and calculates the challenge K, followed by the user's subsequent proof and verification process.

[0132] K=k·D

[0133] Here we choose k=11, then K=k·D=11·(19,16)=(18,13).

[0134] The sender constructs a commitment challenge value e based on K, C and transaction m, where H is a hash function and || is a connector. Since the construction of e depends on C, K and m, and the generation of C and K is based on random numbers b, c, d, k, the challenge value is random, ensuring that the challenge value cannot be forged. Since the challenge value cannot be forged, it means that the verifier does not need to challenge and can be verified in a non-interactive way. Here, for the sake of simplicity of calculation, e=17 is taken.

[0135] e=H(K||C||m)

[0136] The sender constructs a trusted proof (e, z) based on the challenge value:

[0137] z=k+ec;

[0138] The sender sends the final challenge K, the recipient's temporary address D, the transaction m (including the transaction address C) and the proof (e, z) to the regulator to complete the address registration.

[0139] Address verification phase

[0140] After receiving the sender's address registration information, the regulatory agency verifies the address, that is, it needs to be able to prove that the temporary address C is associated with the real recipient address B based on relevant information, and only the regulatory agency can obtain the associated information.

[0141] The regulatory structure finds the corresponding registration information based on the temporary address C, and then verifies whether the two ends of the following equation are equal.

[0142] K? = z·D-e·C

[0143] Since C = c·D, therefore:

[0144] z·D-e·C=(k+ec)·D-e·c·D=k·D+e·c·D-e·c·D=k·D=KBased on the above parameters, we can calculate:

[0145] z·D-e·C=(11+17×15)·(19,16)-17·(20,12)=(18,13).

[0146] From this, we can see that if the temporary address C is generated based on the temporary address D of the receiver, then the above equation must hold, and vice versa, that is, C must be generated based on D.

[0147] Since the regulatory agency knows the mapping relationship between the random factor d and the real address B of the recipient <d, D, B>, it can find the corresponding random factor d and the real address B of the recipient based on D, so it only needs to verify whether the following equation holds:

[0148] D'=d·B?=D

[0149] Obviously, only when D'=D can it be said that D is generated based on B, and vice versa, which will not be elaborated; because:

[0150] D'=d·B=b·d·G=D

[0151] This means that D must be generated based on B. From 1), we know that C must be generated based on D, so C must be generated based on B, which means that C is associated with the real recipient address B. The regulatory agency associates the temporary address C and transaction m, as follows, which means that the sender will transfer funds to the temporary address C through transaction m, and the real recipient address is B.

[0152] Lm=<d,D,B,C,m>

[0153] Since c and k are randomly selected, and e is also random, the attacker cannot deduce any information about c and b from K and z, ensuring the security of the recipient's assets. In addition, the reason why the shared secret key c is not directly told to the regulator, but verified by constructing a proof, is mainly because the shared key will be used to encrypt transaction data later. Once the regulator knows c, it can decrypt the transaction and privately upload the transaction to the chain without the recipient's confirmation.

[0154] For example, the sender and receiver may implement the transaction through the temporary address C by:

[0155] The sender encapsulates the transaction. The encapsulation logic is to first sign the transaction data m using its own private key a to obtain the signed transaction data Ma = (m, S am ), as follows, where Sign is the signature algorithm, S am It is the transaction signature after the transaction m is signed using the secret key a and the signature algorithm Sign.

[0156] S am =Sign(m, a), where Sign is the signature algorithm, a is the private key, and m is the transaction data

[0157] The sender then uses the shared secret key c to encrypt the signed transaction data M, obtains the encrypted data C(Ma), and uploads C(Ma) to the chain.

[0158] C(Ma)=Enc(Ma,c); Enc is a symmetric encryption algorithm, and the encryption of C(Ma) can adopt the Sign signature algorithm.

[0159] The receiver actively monitors all transactions on the blockchain and tries to decrypt them using the shared secret key c. If the decryption is successful, the transaction is sent to him / her. The receiver can obtain the signed transaction data Ma by decrypting:

[0160] Ma=(m,S am )

[0161] The receiver signs m with the private key b and sends the signed transaction data M b Send to regulatory authorities:

[0162] M b =(m, S bm )

[0163] Regulators are looking for signed transactions M b Verification is performed; specific verification methods include:

[0164] Based on transaction m, search for the previous association relationship Lm=<d, D, B, C, m>. If it is not found, it means that the transaction is illegal and informs the recipient to reject the transaction;

[0165] If the corresponding association can be found, the regulatory agency checks whether the temporary transfer address in transaction m is C. If not, it means that the transaction and the actual receiving address do not match, and informs the recipient to reject the transaction;

[0166] If the temporary transfer address in transaction m is consistent with the temporary address C in the association relationship, then based on the transaction signature S bm Verify whether the signature is correct with the public key B in the associated relationship. If it is incorrect, it means that the current recipient is illegal. Otherwise, the recipient is informed that the verification is successful.

[0167] After the recipient receives the verification feedback from the regulator, the decrypted signature and transaction data are uploaded to the chain, so that the assets are transferred to the temporary address C.

[0168] Since the sender does not have the receiver's private key b and random factor d, and the regulator does not have the receiver's private key b and shared secret key c, neither the sender nor the regulator can construct the private key b·c·d of the temporary address C, and thus cannot operate the assets in C in the temporary address, so the receiver does not need to worry about the security of the assets. At the same time, through the above verification process, the regulator can clearly know the details and counterparties of each transaction, so as to conduct more effective supervision and management.

[0169] See also Figure 4 , Figure 4 A structural diagram of a secure and controllable transaction system of a blockchain is provided for this application, see 4, the system includes:

[0170] A generating unit 401 is used to select a base point G on a finite field defined by an elliptic curve E, and generate a public key B according to the base point G and a private key b randomly selected by a receiver;

[0171] The communication unit 402 is used to send the public key B and the signature of the public key B to the supervisor, and receive the random factor d sent by the supervisor, where the random factor d is the random factor d selected by the supervisor after verifying the signature of the public key B;

[0172] A processing unit 403 is configured to calculate a transaction public key D according to the random factor d and the public key B;

[0173] The communication unit 402 is used to send the transaction public key D to the sender, and receive the sender public key R returned by the sender;

[0174] The processing unit 403 is also used to calculate the shared secret key c based on the transaction public key D and the public key R. The recipient obtains the assets traded by the sender through the temporary address C based on the shared secret key c. The temporary address C is a temporary address calculated by the sender based on the transaction public key D and the shared secret key c.

[0175] By way of example, the above-mentioned generation of the public key B based on the base point G and the private key b randomly selected by the recipient specifically includes: the public key B is the product of the private key b and the base point G; the calculation of the transaction public key D based on the random factor d and the public key B specifically includes: the transaction public key D is the product of the random factor d and the public key B.

[0176] For example,

[0177] The processing unit 403 is specifically used to calculate the quotient of the public key R and the base point G to obtain the private key r, calculate the hash value of the product of the private key r and the transaction public key D, and calculate the remainder of the hash value and the prime number p of the finite field defined by the elliptic curve E, where the remainder is the shared secret key c.

[0178] For example,

[0179] The sending device is used to randomly select k, calculate the challenge K based on the randomly selected k and the transaction public key D, generate the commitment challenge value e based on the challenge K, the temporary address C and the transaction m, build the trusted proof z based on the randomly selected k and the commitment challenge value e, and send the challenge K, transaction m, transaction public key D, commitment adjustment value e and trusted proof z to the regulator for transaction supervision, wherein the transaction m includes the temporary address C.

[0180] For example,

[0181] The supervisory device is used to receive the challenge K, the transaction m, the commitment adjustment value e and the trusted proof z, calculate the product of the trusted proof and the transaction public key D to obtain a first product, calculate the product of the commitment adjustment value e and the temporary address C to obtain a second product, calculate the difference between the first product and the second product, and determine whether the challenge K is equal to the difference. If they are equal, it is determined that the temporary address C has been verified, otherwise, it is determined that the temporary address C has failed to be verified.

[0182] For example,

[0183] The sending device is used to sign the transaction data m using the sender's private key a to obtain the signed transaction data Ma=(m, S am ), and then use the shared key c to encrypt the signed transaction data Ma to obtain the encrypted data C(Ma), and transmit the encrypted data C(Ma) to the blockchain.

[0184] For example,

[0185] The processing unit is specifically used for the receiver to monitor all encrypted data on the blockchain, and use the shared secret key c to decrypt the encrypted data. If the decryption is successful, the asset Ma of the transaction with the signature obtained after decryption is obtained, and the asset m of the transaction in Ma is extracted.

[0186] For example,

[0187] The supervisory device is used to obtain the transaction data M with signature sent by the recipient. b ; Transaction data M b The data obtained by signing the transaction data Ma using the private key b is the data obtained by the supervisor based on the transaction data M b Regulate transactions.

[0188] For example,

[0189] The supervisory device is specifically used to query whether there is a mapping relationship Lm of m based on the transaction m. If no mapping relationship Lm is found, the transaction is determined to be illegal, and the recipient is notified to reject the transaction asset m;

[0190] If there is a mapping relationship Lm of m, extract the temporary address of the mapping relationship Lm, determine whether the temporary address of Lm is equal to the temporary address C, if the temporary address C is not equal, determine that the transaction does not match the actual receiving address, and notify the recipient to reject the transaction asset m;

[0191] When the supervisor determines that the temporary address of Lm is consistent with the temporary address C, based on the transaction signature S bm The signature is verified with the public key B in Lm. If the verification is incorrect, the recipient is determined to be illegal. If the verification is correct, the recipient is notified that the verification is successful.

[0192] An embodiment of the present application also provides a computer storage medium, wherein the computer storage medium stores a computer program for electronic data exchange, wherein the computer program enables a computer to execute part or all of the steps of any method described in the above method embodiments, and the above computer includes an electronic device.

[0193] The embodiment of the present application also provides a computer program product, the computer program product includes a non-transitory computer-readable storage medium storing a computer program, the computer program is operable to cause a computer to execute some or all of the steps of any method described in the method embodiment. The computer program product may be a software installation package, and the computer includes an electronic device.

[0194] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0195] In the several embodiments provided in the present application, it should be understood that the disclosed methods, systems and systems can be implemented in other ways. For example, the system embodiments described above are only schematic; for example, the division of the units is only a logical function division, and there may be other division methods in actual implementation; for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of systems or units, which can be electrical, mechanical or other forms.

[0196] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0197] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may be physically included separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0198] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform some steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: a USB flash drive, a mobile hard disk, a magnetic disk, an optical disk, a volatile memory or a non-volatile memory. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM) or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM) and direct RAM bus RAM (DR RAM). Various media that can store program code are available.

[0199] Although the present invention is disclosed as above, the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions without departing from the spirit and scope of the present invention, and can make various changes and modifications, including the combination of the above-mentioned different functions and implementation steps, including software and hardware implementation methods, all of which are within the scope of protection of the present invention.

Claims

1. A safe and controllable transaction method for blockchain, characterized in that: The method comprises the following steps: Select a base point G on the finite field defined by the elliptic curve E, and generate a public key B based on the base point G and the private key b randomly selected by the recipient; The receiver sends the public key B and the signature of the public key B to the regulator, and receives the random factor d sent by the regulator, where the random factor d is the random factor d selected by the regulator after verifying the signature of the public key B, and the transaction public key D is calculated based on the random factor d and the public key B; The receiving party sends the transaction public key D to the sender, receives the sender's public key R returned by the sender, and calculates the shared secret key c based on the transaction public key D and the public key R. The receiving party obtains the assets traded by the sender through the temporary address C based on the shared secret key c. The temporary address C is a temporary address calculated by the sender based on the transaction public key D and the shared secret key c.

2. The secure and controllable transaction method of blockchain according to claim 1, characterized in that: The generating of the public key B according to the base point G and the private key b randomly selected by the receiver specifically includes: the public key B is the product of the private key b and the base point G; The step of calculating the transaction public key D based on the random factor d and the public key B specifically includes: the transaction public key D is the product of the random factor d and the public key B.

3. The secure and controllable transaction method of blockchain according to claim 2, characterized in that: The calculation of the shared secret key c based on the transaction public key D and the public key R specifically includes: The quotient of the public key R and the base point G is calculated to obtain the private key r, the hash value of the product of the private key r and the transaction public key D is calculated, and the remainder of the hash value and the prime number p of the finite field defined by the elliptic curve E is calculated, and the remainder is the shared secret key c.

4. The secure and controllable transaction method of blockchain according to claim 2 or 3, characterized in that: The method further comprises: The sender randomly selects k, calculates the challenge K based on the random selection k and the transaction public key D, generates a commitment challenge value e based on the challenge K, the temporary address C and the transaction m, builds a trusted proof z based on the random selection k and the commitment challenge value e, and sends the challenge K, transaction m, transaction public key D, commitment adjustment value e and trusted proof z to the regulator for transaction supervision. The transaction m contains the temporary address C.

5. The secure and controllable transaction method of blockchain according to claim 4 is characterized in that: The method further comprises: The regulator receives the challenge K, transaction m, commitment adjustment value e and trusted proof z, calculates the product of the trusted proof and the transaction public key D to obtain the first product, calculates the product of the commitment adjustment value e and the temporary address C to obtain the second product, calculates the difference between the first product and the second product, and determines whether the challenge K is equal to the difference. If they are equal, it is determined that the temporary address C has been verified. Otherwise, it is determined that the temporary address C has failed to be verified.

6. The secure and controllable transaction method of blockchain according to claim 2, characterized in that: Before the receiving party obtains the assets traded by the sending party through the temporary address C according to the shared secret key c, the method further includes: The sender signs the transaction data m using the sender's private key a to obtain the signed transaction data Ma = (m, S am ), and then use the shared secret key c to encrypt the signed transaction data Ma to obtain the encrypted data C(Ma), and transmit the encrypted data C(Ma) to the blockchain.

7. The secure and controllable transaction method of blockchain according to claim 6, characterized in that: The receiving party obtains the assets traded by the sender through the temporary address C according to the shared secret key c, specifically including: The receiver monitors all encrypted data on the blockchain and decrypts the encrypted data using the shared key c. If the decryption is successful, the receiver obtains the asset Ma of the transaction with the signature obtained after decryption and extracts the asset m of the transaction within Ma.

8. The secure and controllable transaction method of blockchain according to claim 7, characterized in that: The method further comprises: The supervisor obtains the signed transaction data M sent by the recipient b ; Transaction data M b The data obtained by signing the transaction data Ma using the private key b is the data obtained by the supervisor based on the transaction data M b Regulate transactions.

9. The secure and controllable transaction method of blockchain according to claim 8, characterized in that: The supervisory party is based on the transaction data M b The supervision of transactions includes: Based on transaction m, check whether there is a mapping relationship Lm of m. If no mapping relationship Lm is found, the transaction is determined to be illegal, and the recipient is notified to reject the transaction asset m. If there is a mapping relationship Lm of m, extract the temporary address of the mapping relationship Lm, determine whether the temporary address of Lm is equal to the temporary address C, if the temporary address C is not equal, determine that the transaction does not match the actual receiving address, and notify the recipient to reject the transaction asset m; When the supervisor determines that the temporary address of Lm is consistent with the temporary address C, based on the transaction signature S bm The signature is verified with the public key B in Lm. If the verification is incorrect, the recipient is determined to be illegal. If the verification is correct, the recipient is notified that the verification is successful.

10. A secure and controllable transaction system for blockchain, characterized in that: The system comprises: A generation unit, used to select a base point G on the finite field defined by the elliptic curve E, and generate a public key B based on the base point G and a private key b randomly selected by the receiver; A communication unit, used to send the public key B and the signature of the public key B to the supervisor, and receive the random factor d sent by the supervisor, where the random factor d is the random factor d selected by the supervisor after verifying the signature of the public key B; A processing unit, configured to calculate a transaction public key D according to the random factor d and the public key B; A communication unit, used to send the transaction public key D to the sender, and receive the sender public key R returned by the sender; The processing unit is also used to calculate a shared secret key c based on the transaction public key D and the public key R. The recipient obtains the assets traded by the sender through the temporary address C based on the shared secret key c. The temporary address C is a temporary address calculated by the sender based on the transaction public key D and the shared secret key c.

Images