Block chain supervisible identity privacy protection method based on compression ring signature

Abstract

The invention provides a block chain supervisible identity privacy protection method based on a compression ring signature. The method comprises the following steps: a system executes an initialization algorithm to generate a key pair of a user and a supervisor; a transaction sender obtains a public key set from a block chain, confuses own public keys in the public key set, executes a one-time linkable mark generation algorithm, an ElGamal encryption algorithm and a one-time linkable revocable compression ring signature generation algorithm, and sends generated encrypted transaction information to an intelligent contract on a block chain transaction system; the smart contract calls a pre-compiled contract to verify the validity of the ring signature, and the verified secret transaction information is uploaded to the block chain; and the supervisor obtains the secret transaction information from the block chain, executes a supervision recovery algorithm, and recovers the signature public key of the transaction sender. According to the method, the identity privacy of the transaction sender can be protected, meanwhile, supervision is achieved, the storage overhead and communication consumption are smaller, and the performance is higher in the aspect of system execution.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to a blockchain supervised identity privacy protection method based on compressed ring signature. Background Art

[0002] Since the ledger of the blockchain transaction system is public, it is particularly important to protect the identity privacy of the transaction parties. Ring Signature is a simplified group signature without an administrator. The signer can use his private key and the public key of other users in the ring to sign. The outside world cannot know which one of the public keys of the signer is in the ring. Applying ring signatures to blockchain transactions can be used as an identity privacy protection technology to protect the identity privacy of the sender.

[0003] Ring signatures can confuse the sender's identity information in a ring (an anonymous collection of multiple users). The verifier can verify the validity of the ring signature and confirm whether the transaction is credible, but the verifier cannot identify the signer to a specific member of the ring, thereby achieving the anonymity of the signer. However, the privacy protection schemes currently implemented based on ring signatures are not fully applicable to blockchain transaction scenarios, and most of them have not been regulated. In addition, the size of the ring signature in the scheme needs to be optimized. In terms of system implementation, most current blockchain transaction systems use smart contracts to implement transaction rules and verify the validity of ring signatures. When the verification rules are complex, the computing efficiency is low and the system performance needs to be improved.

[0005] Therefore, how to develop a blockchain-supervisable identity privacy protection method with higher performance and smaller storage overhead and communication consumption is an urgent problem to be solved. Summary of the invention

[0006] The embodiments of the present invention provide a blockchain supervised identity privacy protection method based on compressed ring signature, which can realize supervision while protecting the identity privacy of the transaction sender.

[0007] In order to achieve the above object, the present invention adopts the following technical scheme.

[0008] A blockchain-supervisory identity privacy protection method based on compressed ring signature, comprising:

[0009] The system executes the initialization algorithm to generate key pairs for the user and the regulator;

[0010] The transaction sender obtains the public key set from the blockchain, mixes its own public key with the public key set, executes the one-time linkable mark generation algorithm, the ElGamal encryption algorithm, and the one-time linkable revocable compressed ring signature generation algorithm, and sends the generated confidential transaction information to the smart contract on the blockchain transaction system;

[0011] The smart contract calls the precompiled contract to verify the validity of the ring signature and uploads the verified encrypted transaction information to the blockchain;

[0012] The supervisor obtains the confidential transaction information from the blockchain, executes the supervisory recovery algorithm, and recovers the signature public key of the transaction sender.

[0013] Preferably, the system executes an initialization algorithm to generate a key pair of the user and the supervisor, including:

[0014] Input the security parameter λ, the system executes the initialization algorithm, and outputs the public parameter pp(G q ,G,H,q,H1,H2), where G q is a cyclic group of order q, q is a prime number, G and H are G q The generator of H1 is {0,1} * →Z q The cryptographic hash function Z q is an integer group of order q, H2 is {0,1} * →G q Cryptographic hash function; generate user key pairs, user i selects a random number r i ∈Z q As the private key, calculate the public key P i =r i G, get the key pair (r i , P i ); and generate the supervisor's key pair (r reg ,P reg ), where r reg ∈Z q , P reg =r reg G.

[0015] The generated user public key is uploaded to the blockchain, and the smart contract initializes a linkable flag list, which is used to record the one-time linkable flag in the chain ring signature.

[0016] Preferably, the transaction sender obtains a public key set from the blockchain, confuses its own public key in the public key set, executes a one-time linkable mark generation algorithm, an ElGamal encryption algorithm, and a one-time linkable revocable compressed ring signature generation algorithm, and the transaction sender sends the generated secret transaction information to the smart contract on the blockchain transaction system, including:

[0017] The transaction sender obtains N-1 public keys from the blockchain, and combines the N-1 public keys with the transaction sender's own public key to form an anonymous set R = {P0,...,P N―1}, M is a message to be signed, let the public key yi ={P0,...,P N―1}, the corresponding private key x i ={x0,...,x N―1}, where the sender's public key is subscripted in the set as l∈[0,N―1], that is, the sender's public key is y l , whose private key is x l , let the supervisor's private key r reg =x reg , public key P reg = reg y;

[0018] The transaction sender calculates the one-time linkable flag T = x l E, where E = H2(y l ), choose a random number u∈Z q , calculate the supervision ciphertext C←{C1,C2}, where C1=uG, C2=uy reg +y l ;

[0019] The transaction sender constructs a zero-knowledge proof PK1: PK1{(x l ):y0=Com ck (0; x0)∨y1=Com ck (0; x1)∨...∨y l =Com ck (0; x l )∨...∨y N―1 =Com ck (0; x N―1 )}, that is, to prove that the transaction sender is a member of the anonymous set R, where Com ck (a; b) is a commitment, a is the commitment value, b is a random number, ck is the commitment parameter, that is, the public parameter pp, p i,k is the polynomial coefficient parameter, l is the subscript of the sender's public key in the set R, x l is the sender's private key;

[0020] The generation and verification of the interactive zero-knowledge proof PK1 is realized through the interaction between the prover and the verifier, which is divided into four parts: first, the prover calculates the commitment part, that is, P1(ck,(y0,…y N―1 ),(l,x l )) Calculate commitment and The generated commitment value is sent to the verifier, and then the verifier randomly selects a challenge value x and sends it to the prover. The third part is that the prover calculates the response based on the challenge value x, that is, P1(ck,(y0,…yN―1 ),(l,x l f in ) j , and z d , and sends the generated response to the verifier. Finally, the verifier executes V1(ck,(y0,…y N―1 ))’s verification process verifies the zero-knowledge proof;

[0021] The transaction sender constructs a zero-knowledge proof PK2: PK2{(x l ):T=Com ck′ (0; x0)∨T=Com ck′ (0; x1)∨...∨T=Com ck′ (0; x l )∨...∨T=Com ck′ (0; x N―1 )}, that is, to prove that the sender has the private key that generates the one-time linkable token, where ck′ is the public parameter (G q ,H2), T is a one-time linkable flag, and the interactive process of this interactive zero-knowledge proof is the same as PK1;

[0022] The transaction sender constructs zero-knowledge proof PK3:

[0023] That is, it proves that it has the secret value u that generates the supervision ciphertext C, where ck0 is the public parameter pp and ck1 is the public parameter (G q ,y reg ,H,q,H1,H2), use c to represent C1, and use c0,...,c N―1 represents C2 / y0,...,C2 / y N―1 , the interactive process of this interactive zero-knowledge proof is the same as PK1;

[0024] The transaction sender combines the three interactive zero-knowledge proofs PK1, PK2 and PK3 with the Fiat-Shamir heuristic to construct a non-interactive zero-knowledge proof and obtains a ring signature σ = (a1, a2, a3, z1, z2, z3, T, C), where a1, a2, a3 are the commitments calculated in the first part of the zero-knowledge proofs PK1, PK2 and PK3, that is, and z1, z2, z3 are the responses calculated in the third part of PK1, PK2 and PK3, i.e., f j , and z d ;

[0025] The transaction sender sends the generated confidential transaction information to the smart contract on the blockchain transaction system. The confidential transaction information includes the ring signature generated by the sender, and the one-time connectable flag and regulatory ciphertext contained in the ring signature.

[0026] Preferably, the smart contract calls the precompiled contract to verify the validity of the ring signature, and uploads the verified confidential transaction information to the blockchain, including:

[0027] The smart contract calls the precompiled contract to verify the ring signature σ. First, the challenge value x=H1(R,M,T,C,G,H,y reg ,a1,a2,a3), substitute the challenge value x into the verification process V1(ck,(y0,…y N―1 )), verification process V2(ck′,T) and verification process V3(ck0,ck1,(c,c0,…c N―1 )), if the verification is successful, the confidential transaction information is transmitted to the blockchain, and the one-time linkable flag T is added to the linkable flag list;

[0028] Verification process V1(ck,(y0,…y N―1 )) Includes: Using the commitment value generated in the first part of PK1 combined with the challenge value to calculate At the same time, the answer calculation generated by the third part is combined And respectively with and Perform equality comparison. If they are equal, it means that the subscript l is converted into binary form, that is, composed of 0\1; then use the public key set (y0,...,y N―1 ) and the commitment generated in the first part of PK1 calculate And with Com ck (0; z d ) are compared. If they are equal, it means that the prover has the public key set (y0,...,y N―1 ) corresponds to a private key x l ;

[0029] The verification process V2(ck′,T) includes: using the commitment value generated in the first part of PK2 combined with the challenge value to calculate At the same time, the answer calculation generated by the third part is combined And respectively with and Perform an equality comparison. If they are equal, it means that the subscript l is converted into binary form, that is, it consists of 0\1; then use the one-time linkable flag T and the commitment generated by the first part of PK2 calculate And with Com ck‘ (0; z d ) are compared. If they are equal, it means that the prover has the secret value x that generates the mark T. l ;

[0030] Verification process V3(ck0,ck1,(c,c0,…c N―1 )) includes: using the commitment value generated in the first part of PK3 combined with the challenge value to calculate c x c a and c x―f c b , respectively and Compare for equality, calculate At the same time, the answer calculation generated by the third part is combined And respectively with and Compare for equality; then use (c0,...,c N―1 ) and the commitment generated in the first part of PK3 calculate and with Compare them, if they are equal, it means that the prover has the knowledge u to generate the ciphertext C.

[0031] Preferably, the supervisor obtains the confidential transaction information from the blockchain, executes the supervisory recovery algorithm, and recovers the signature public key of the transaction sender, including:

[0032] The regulator obtains confidential transaction information from the blockchain and uses its private key x reg Calculate the sender's signature public key: Revoke the anonymity of the signer's identity and restore the sender's identity.

[0033] It can be seen from the technical solutions provided by the above-mentioned embodiments of the present invention that the blockchain-supervisable identity privacy protection method and system based on compressed ring signatures in the embodiments of the present invention can achieve supervision while protecting the identity privacy of the transaction sender. The supervisor can restore the signature public key of the transaction sender when necessary, and the solution has smaller storage overhead and communication consumption, and has higher performance in system execution.

[0034] Additional aspects and advantages of the present invention will be given in part in the following description, which will become obvious from the following description, or may be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0036] Figure 1 A schematic diagram of an implementation method of a blockchain-supervisable identity privacy protection method based on a compressed ring signature provided in an embodiment of the present invention;

[0037] Figure 2 A specific processing flow chart of a blockchain supervised identity privacy protection method based on compressed ring signature provided by an embodiment of the present invention;

[0038] Figure 3 A schematic diagram of a specific protocol content of a zero-knowledge proof PK1 provided in an embodiment of the present invention;

[0039] Figure 4 A schematic diagram of the specific protocol content of a zero-knowledge proof PK2 provided in an embodiment of the present invention;

[0040] Figure 5 A schematic diagram of a specific protocol content of a zero-knowledge proof PK3 provided in an embodiment of the present invention;

[0041] Figure 6 A schematic diagram of specific contents of a non-interactive proof provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0042] The embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be interpreted as limiting the present invention.

[0043] It will be understood by those skilled in the art that, unless expressly stated, the singular forms "one", "said", and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present invention refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we refer to an element as being "connected" or "coupled" to another element, it may be directly connected or coupled to the other element, or there may be intermediate elements. In addition, the "connection" or "coupling" used herein may include wireless connection or coupling. The term "and / or" used herein includes any unit and all combinations of one or more associated listed items.

[0044] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as those generally understood by those skilled in the art in the art to which the present invention belongs. It should also be understood that terms such as those defined in common dictionaries should be understood to have meanings consistent with the meanings in the context of the prior art, and will not be interpreted with idealized or overly formal meanings unless defined as herein.

[0045] To facilitate understanding of the embodiments of the present invention, several specific embodiments will be further explained below with reference to the accompanying drawings, and each embodiment does not constitute a limitation on the embodiments of the present invention.

[0046] In order to achieve controllable transaction identity privacy protection in blockchain transactions, reduce storage overhead and communication consumption, and improve system performance, the present invention uses a one-time linkable and revocable compressed ring signature scheme and precompiled contract technology for implementation.

[0047] Definition 1: Transaction identity privacy protection. In the present invention, transaction identity privacy protection mainly targets the identity privacy protection of the transaction sender.

[0048] Definition 2: One-time linkability and revocability. In the present invention, one-time linkability means that a pair of public and private keys of a signer can only sign once. When applied to blockchain transactions, it can ensure that the same UTXO can only be spent once, and when the same UTXO is spent repeatedly, it will be linked. Revocability is used by the regulator to recover the signature public key of the sender.

[0049] Definition 3: Compressed ring signature. In the present invention, compressed ring signature means that the size of the ring signature grows logarithmically with the number of ring members, which is different from the traditional ring signature scheme in which the size of the ring signature grows linearly with the number of ring members.

[0050] Definition 4: Precompiled contract. Precompiled contracts are implemented using C++ code, which is compiled in the underlying layer and does not need to enter the EVM for execution, so higher performance can be achieved.

[0051] The embodiment of the present invention provides a blockchain-supervisable identity privacy protection method based on compressed ring signature. The following steps are performed on a blockchain transaction: the system executes an initialization algorithm; the sender obtains a ring member set (anonymous set) from the chain; the sender executes a one-time linkable and revocable compressed ring signature algorithm based on the improved Sigma protocol to protect the identity of the transaction sender, and calculates the supervision ciphertext; the transaction information is packaged and sent to the smart contract; the smart contract calls the precompiled contract to execute the transaction verification algorithm; the supervisor obtains the secret transaction information from the chain to execute the supervision algorithm to restore the sender's signature public key. The present invention realizes the identity privacy protection and supervision of the transaction sender in the blockchain transaction. The supervisor can revoke the anonymity of the signer and restore the sender's signature public key. At the same time, based on the compressed ring signature scheme, it reduces the storage overhead and communication consumption, and uses the precompiled contract for ring signature verification, which has higher execution performance.

[0052] The implementation principle of a blockchain supervised identity privacy protection method based on compressed ring signature provided by an embodiment of the present invention is as follows: Figure 1 The specific processing flow is as shown in Figure 2 As shown, the processing steps include the following:

[0053] Step S10: The system executes the initialization algorithm to generate a key pair for the user and the supervisor.

[0054] Step S20: The transaction sender obtains a public key set from the blockchain, mixes its own public key with the public key set, and executes a one-time linkable marker generation algorithm, an ElGamal encryption algorithm, and a one-time linkable revocable compressed ring signature generation algorithm.

[0055] Step S30: The transaction sender sends the generated confidential transaction information to the smart contract on the blockchain transaction system.

[0056] Step S40: The smart contract calls the precompiled contract to verify the validity of the ring signature, that is, executes the one-time linkable and revocable compressed ring signature verification algorithm (verifies the validity of the ring signature and whether double spending exists), and uploads the verified confidential transaction information to the chain.

[0057] Step S50: The supervisor obtains the confidential transaction information from the chain, executes the supervisory recovery algorithm, and recovers the signature public key of the transaction sender.

[0058] Specifically, the above step S10 includes: inputting the security parameter λ, the system executing the initialization algorithm, and outputting the public parameter pp(G q,G,H,q,H1,H2), where G q is a cyclic group of order q, q is a prime number, G and H are G q The generator of H1 is {0,1} * →Z q The cryptographic hash function Z q is an integer group of order q, H2 is {0,1}*→G q The cryptographic hash function is then used to generate a user key pair. User i selects a random number r i ∈Z q As the private key, calculate the public key P i =r i G, get the key pair (r i , P i ); and generate the supervisor's key pair (r reg ,P reg ), where r reg ∈Z q , P reg =r reg G.

[0059] The generated user public key is uploaded to the blockchain, and the smart contract initializes the linkable flag list, which is used to record the one-time linkable flag in the chain ring signature.

[0060] Specifically, the above step S20 includes: the transaction sender first obtains N-1 public keys from the blockchain, and combines the N-1 public keys with the transaction sender's own public key to form an anonymous set R = {P0, ..., P N―1}, the number of public keys in the anonymous set R is generally an integer power of 2. If not, the obtained public key is copied so that the number of public keys in the ring is an integer power of 2, and M is a message to be signed. For the convenience of representation, let the public key y i ={P0,...,P N―1}, the corresponding private key x i ={x0,...,x N―1}, where the sender's public key is subscripted in the set as l∈[0,N―1], that is, the sender's public key is y l , whose private key is x l , let the supervisor's private key r reg =x reg , public key P reg =y reg .

[0061] The transaction sender generates a ring signature σ, specifically the sender calculates a one-time linkable flag T = x l E, where E = H2(y l ). Choose a random number u∈Zq , calculate the supervision ciphertext C←{C1,C2}, where C1=uG, C2=uy reg +y l .

[0062] The specific protocol content of a zero-knowledge proof PK1, PK2 and PK3 provided by an embodiment of the present invention is as follows: Figure 3 , Figure 4 and Figure 5 shown.

[0063] The transaction sender constructs a zero-knowledge proof PK1: PK1{(x l ):y0=Com ck (0; x0) Vy1 = Com ck (0; x1)V...∨y l =Com ck (0; x l )∨...Vy N―1 =Com ck (0; x N―1 )}, that is, to prove that the transaction sender is a member of the anonymous set R, where Com ck (a; b) is a commitment, a is the commitment value, b is a random number, ck is the commitment parameter, that is, the public parameter pp, p i,k is the polynomial coefficient parameter, l is the subscript of the sender's public key in the set R, x l is the sender’s private key, and are all commitments, x is the challenge value, f j , and f d All are responses to the challenge value (except for some parameters that are specially explained, the parameter explanations in zero-knowledge proof PK2 and PK3 are the same as above).

[0064] The generation and verification of the interactive zero-knowledge proof PK1 is realized through the interaction between the prover and the verifier, which is divided into four parts: first, the prover calculates the commitment part, that is, P1(ck,(y0,…y N―1 ),(l,x l )) Calculate commitment and The generated commitment value is sent to the verifier, and then the verifier randomly selects a challenge value x and sends it to the prover. The third part is that the prover calculates the response based on the challenge value x, that is, P1(ck,(y0,…y N―1 ),(l,x l f in ) j , and z d , and sends the generated response to the verifier. Finally, the verifier executes V1(ck,(y0,…y N―1 ))’s verification process verifies the zero-knowledge proof;

[0065] Since the subscripts of the N ring members only require log2N binary numbers to represent them, the number of commitments or responses constructed is also logarithmic, which compresses the size of the proof (the same applies to the proof below).

[0066] The transaction sender constructs a zero-knowledge proof PK2: PK2{(x l ):T=Com ck′ (0; x0)∨T=Com ck′ (0; x1)V...∨T=Com ck′ (0; x l )V...∨T=Com ck′ (0; x N―1 )}, that is, to prove that the sender has the private key that generates the one-time linkable token, where ck′ is the public parameter (G q ,H2), T is a one-time linkable flag, and the interactive process of this interactive zero-knowledge proof is the same as PK1. The specific interactive protocol is as follows Figure 4 shown.

[0067] The transaction sender constructs zero-knowledge proof PK3:

[0068] That is, it proves that it has the secret value u that generates the supervision ciphertext C, where ck0 is the public parameter pp and ck1 is the public parameter (G q ,y reg ,H,q,H1,H2), use c to represent C1, and use c0,...,c N―1 represents C2 / y0,...,C2 / y N―1 The interactive process of this interactive zero-knowledge proof is the same as PK1. For the specific interactive protocol, see Figure 5 At the same time, the above proof process ensures that the signer cannot use a non-regulatory public key to encrypt his address, and cannot use other users' public keys as the signer's public key.

[0069] like Figure 6 As shown in the figure, the three interactive zero-knowledge proofs PK1, PK2 and PK3 are combined with the Fiat-Shamir heuristic to construct a non-interactive zero-knowledge proof, and the ring signature σ=(a1,a2,a3,z1,z2,z3,T,C) is obtained, where a1,a2,a3 are Figure 3 , Parameters generated in the first round of interaction in 4 and 5, z1, z2, and z3 are Figure 3 , 4, and 5. Since the sender mixes its identity (public key) in a randomly selected anonymous set, the verifier can verify the validity of the ring signature, but cannot know which of the sender's identities is in the set, that is, the sender's identity is protected.

[0070] Specifically, the above step S30 includes: the transaction sender sends the generated confidential transaction information to the smart contract on the blockchain transaction system. The above confidential transaction information includes the ring signature generated by the sender, and the one-time connectable flag and supervision ciphertext contained in the ring signature.

[0071] The smart contract first obtains the one-time linkable flag T from the above-mentioned secret transaction information, and then traverses the linkable flag list. If T exists in the linkable flag list, the transaction is terminated, indicating that the sender is making repeated spending. Otherwise, the validity of the ring signature σ is verified.

[0072] Specifically, the above step S40 includes: the smart contract calls the precompiled contract to verify the ring signature σ, first calculates the challenge value x=H1(R,M,T,C,G,H,y reg ,a1,a2,a3), and then execute Figure 6 The verification algorithm shown is to substitute the challenge value x into Figure 3 Verification process V1, Figure 4 Verification process V2 and Figure 5 In the verification process V3, if the verification is successful, the confidential transaction information is transmitted to the blockchain, and the one-time linkable flag T is added to the linkable flag list.

[0073] Figure 3 The verification process V1 in PK1 includes: using the commitment value generated in the first part of PK1 combined with the challenge value to calculate At the same time, the answer calculation generated by the third part is combined And respectively with and Perform equality comparison. If they are equal, it means that the subscript l is converted into binary form, that is, composed of 0\1; then use the public key set (y0,...,y N―1 ) and the commitment generated in the first part of PK1 calculate And with Com ck (0; z d ) are compared. If they are equal, it means that the prover has the public key set (y0,...,y N―1 ) corresponds to a private key x l .

[0074] Figure 4 The verification process V2(ck′,T) in PK2 includes: using the commitment value generated in the first part of PK2 combined with the challenge value to calculate At the same time, the answer calculation generated by the third part is combined And respectively with and Perform an equality comparison. If they are equal, it means that the subscript l is converted into binary form, that is, it consists of 0\1; then use the one-time linkable flag T and the commitment generated by the first part of PK2 calculate And with Con ck '(0;z d ) are compared. If they are equal, it means that the prover has the secret value x that generates the mark T. l .

[0075] Figure 5 The verification process V3(ck0,ck1,(c,c0,…c N―1 )) includes: using the commitment value generated in the first part of PK3 combined with the challenge value to calculate c x c a and c x-f c b , respectively and Compare for equality, calculate At the same time, the answer calculation generated by the third part is combined And respectively with and Compare for equality; then use (c0,...,c N―1 ) and the commitment generated in the first part of PK3 calculate and with Compare them, if they are equal, it means that the prover has the knowledge u to generate the ciphertext C.

[0076] Specifically, the above step S50 includes: the supervisor obtains the confidential transaction information from the blockchain and uses its private key x reg Calculate the sender's signature public key: The anonymity of the signer's identity is then revoked and the sender's identity is restored.

[0077] In summary, the embodiment of the present invention provides a one-time linkable and revocable compressed ring signature scheme, which ensures the integrity and authenticity of transaction information while protecting the identity privacy of the sender. The ring signature size is compressed, and the ring signature size is logarithmically related to the number of ring members. When the number of ring members is large, there is less storage overhead and communication consumption. The regulator is supported to recover the sender's signature public key when necessary (such as when transaction verification is required). The smart contract calls the precompiled contract to verify the confidential transaction information, which improves the system performance, proposes the security attribute of one-time linkability, and clearly defines its concept as a pair of public and private keys of a signer can only be used to sign once.

[0078] The present invention proposes a blockchain regulated identity privacy protection method based on compressed ring signature, which can realize supervision while protecting the identity privacy of the transaction sender, and the supervisor can restore the signature public key of the transaction sender when necessary, and the scheme has smaller storage overhead and communication consumption, and has higher performance in system execution. In most current research schemes, the size of the ring signature increases linearly with the number of ring members. As the number of ring members increases, the storage overhead and communication consumption increase significantly. And there are few ring signature schemes that can meet regulatory requirements at the same time. In addition, the system performance needs to be improved. The present invention designs a ring signature algorithm based on the improved Sigma protocol and ElGamal encryption scheme. The sender confuses its identity (public key) in a public key set, and uses its private key to perform a ring signature, realizing the sender's identity privacy and supervision, while compressing the ring signature size to a logarithmic level, that is, the ring signature size grows logarithmically with the number of ring members, which is achieved by converting the public key subscript to binary. In addition, the use of linkability can prevent the sender from double-spending. The system builds the Fisco Bcos blockchain platform and uses smart contracts to call pre-compiled contracts to verify the validity of the ring signature, improve computing efficiency, and make the system have higher performance.

[0079] Those skilled in the art can understand that the accompanying drawings are only schematic diagrams of an embodiment, and the modules or processes in the accompanying drawings are not necessarily required to implement the present invention.

[0080] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present invention can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present invention or certain parts of the embodiments.

[0081] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. The device and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0082] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A blockchain supervised identity privacy protection method based on compressed ring signature, characterized in that: include: The system executes the initialization algorithm to generate key pairs for the user and the regulator; The transaction sender obtains the public key set from the blockchain, mixes its own public key with the public key set, executes the one-time linkable mark generation algorithm, the ElGamal encryption algorithm, and the one-time linkable revocable compressed ring signature generation algorithm, and sends the generated confidential transaction information to the smart contract on the blockchain transaction system; The smart contract calls the precompiled contract to verify the validity of the ring signature and uploads the verified encrypted transaction information to the blockchain; The supervisor obtains the confidential transaction information from the blockchain, executes the supervisory recovery algorithm, and recovers the signature public key of the transaction sender.

2. The method according to claim 1, characterized in that The system executes an initialization algorithm to generate a key pair for the user and the supervisor, including: Input the security parameter λ, the system executes the initialization algorithm, and outputs the public parameter pp(G q ,G,H,q,H1,H2), where G q is a cyclic group of order q, q is a prime number, G and H are G q The generator of H1 is {0,1} * →Z q The cryptographic hash function Z q is an integer group of order q, H2 is {0,1} * →G q Cryptographic hash function; generate user key pairs, user i selects a random number r i ∈Z q As the private key, calculate the public key P i =r i G, get the key pair (r i , P i ); and generate the supervisor's key pair (r reg ,P reg ), where r reg ∈Z q , P reg =r reg G. The generated user public key is uploaded to the blockchain, and the smart contract initializes a linkable flag list, which is used to record the one-time linkable flag in the chain ring signature.

3. The method according to claim 2, characterized in that The transaction sender obtains a public key set from the blockchain, confuses its own public key in the public key set, executes a one-time linkable flag generation algorithm, an ElGamal encryption algorithm, and a one-time linkable revocable compressed ring signature generation algorithm, and the transaction sender sends the generated secret transaction information to the smart contract on the blockchain transaction system, including: The transaction sender obtains N-1 public keys from the blockchain, and combines the N-1 public keys with the transaction sender's own public key to form an anonymous set R = {P0,...,P N―1 }, M is a message to be signed, let the public key y i ={P0,...,P N―1 }, the corresponding private key x i ={x0,...,x N―1 }, where the sender's public key is subscripted in the set as l∈[0,N―1], that is, the sender's public key is y l , whose private key is x l , let the supervisor's private key r reg =x reg , public key P reg =y reg ; The transaction sender calculates the one-time linkable flag T = x l E, where E = H2(y l ), choose a random number u∈Z q , calculate the supervision ciphertext C←{C1,C2}, where C1=uG, C2=uy reg +y l ; The transaction sender constructs a zero-knowledge proof PK1: PK1{(x l ):y0=Com ck (0; x0) Vy1 = Com ck (0; x1)∨...∨y l =Com ck (0; x l )∨...∨y N―1 =Com ck (0; x N―1 )}, that is, to prove that the transaction sender is a member of the anonymous set R, where Com ck (a; b) is a commitment, a is the commitment value, b is a random number, ck is the commitment parameter, that is, the public parameter pp, p i,k is the polynomial coefficient parameter, l is the subscript of the sender's public key in the set R, x l is the sender's private key; The generation and verification of the interactive zero-knowledge proof PK1 is realized through the interaction between the prover and the verifier, which is divided into four parts: first, the prover calculates the commitment part, that is, P1(ck,(y0,…y N―1 ),(l,x l )) Calculate commitment and The generated commitment value is sent to the verifier, and then the verifier randomly selects a challenge value x and sends it to the prover. The third part is that the prover calculates the response based on the challenge value x, that is, P1(ck,(y0,…y N―1 ),(l,x l f in )) j , and z d , and sends the generated response to the verifier. Finally, the verifier executes V1(ck,(y0,…y N―1 ))’s verification process verifies the zero-knowledge proof; The transaction sender constructs a zero-knowledge proof PK2: PK2{(x l ):T=Com ck′ (0; x0)∨T=Com ck′ (0; x1)∨...∨T=Com ck′ (0; x l )∨...∨T=Com ck′ (0; x N―1 )}, that is, to prove that the sender has the private key that generates the one-time linkable token, where ck′ is the public parameter (G q ,H2), T is a one-time linkable flag, and the interactive process of this interactive zero-knowledge proof is the same as PK1; The transaction sender constructs zero-knowledge proof PK3: That is, it proves that it has the secret value u that generates the supervision ciphertext C, where ck0 is the public parameter pp and ck1 is the public parameter (G q ,y reg ,H,q,H1,H2), use c to represent C1, and use c0,...,c N―1 represents C2 / y0,...,C2 / y N―1 , the interactive process of this interactive zero-knowledge proof is the same as PK1; The transaction sender combines the three interactive zero-knowledge proofs PK1, PK2 and PK3 with the Fiat-Shamir heuristic to construct a non-interactive zero-knowledge proof and obtains a ring signature σ = (a1, a2, a3, z1, z2, z3, T, C), where a1, a2, a3 are the commitments calculated in the first part of the zero-knowledge proofs PK1, PK2 and PK3, that is, and z1, z2, z3 are the responses calculated from the third part of PK1, PK2 and PK3, i.e., f j , and z d ; The transaction sender sends the generated confidential transaction information to the smart contract on the blockchain transaction system. The confidential transaction information includes the ring signature generated by the sender, and the one-time connectable flag and regulatory ciphertext contained in the ring signature.

4. The method according to claim 2, characterized in that: The smart contract calls the precompiled contract to verify the validity of the ring signature and uploads the verified encrypted transaction information to the blockchain, including: The smart contract calls the precompiled contract to verify the ring signature σ. First, the challenge value x=H1(R,M,T,C,G,H,y reg ,a1,a2,a3), substitute the challenge value x into the verification process V1(ck,(y0,…y N―1 )), verification process V2(ck′,T) and verification process V3(ck0,ck1,(c,c0,…c N―1 )), if the verification is successful, the confidential transaction information is transmitted to the blockchain, and the one-time linkable flag T is added to the linkable flag list; Verification process V1(ck,(y0,…y N―1 )) Includes: Using the commitment value generated in the first part of PK1 combined with the challenge value to calculate At the same time, the answer calculation generated by the third part is combined And respectively with and Perform equality comparison. If they are equal, it means that the subscript l is converted into binary form, that is, composed of 0\1; then use the public key set (y0,...,y N―1 ) and the commitment generated in the first part of PK1 calculate And with Com ck (0; z d ) are compared. If they are equal, it means that the prover has the public key set (y0,...,y N―1 ) corresponds to a private key x l ; The verification process V2(ck′,T) includes: using the commitment value generated in the first part of PK2 combined with the challenge value to calculate At the same time, the answer calculation generated by the third part is combined And respectively with and Perform an equality comparison. If they are equal, it means that the subscript l is converted into binary form, that is, it consists of 0\1; then use the one-time linkable flag T and the commitment generated by the first part of PK2 calculate And with Com ck‘ (0; z d ) are compared. If they are equal, it means that the prover has the secret value x that generates the mark T. l ; Verification process V3(ck0,ck1,(c,c0,…c N―1 )) includes: using the commitment value generated in the first part of PK3 combined with the challenge value to calculate c x c a and c x―f c b , respectively and Compare for equality, calculate At the same time, the answer calculation generated by the third part is combined And respectively with and Compare for equality; then use (c0,...,c N―1 ) and the commitment generated in the first part of PK3 calculate and with Compare them, if they are equal, it means that the prover has the knowledge u to generate the ciphertext C.

5. The method according to claim 4, characterized in that The supervisor obtains the confidential transaction information from the blockchain, executes the supervisory recovery algorithm, and recovers the signature public key of the transaction sender, including: The regulator obtains confidential transaction information from the blockchain and uses its private key x reg Calculate the sender's signature public key: Revoke the anonymity of the signer's identity and restore the sender's identity.

Images