Seller autonomous auction system and method with bidding anonymity and bidding privacy

Abstract

The invention discloses a seller autonomous auction system and method with bidding anonymity and bidding privacy, and the system comprises four entities: a seller, a bidder, an auction platform and an anonymous identity provider, and is divided into six stages: initialization, registration, auction release, bidding, winner calculation and transaction. The invention designs a group signature variant, namely a zero-knowledge shielding group signature, aiming at the problem of balancing the autonomous right of a seller and privacy protection of a buyer in anonymous auction. According to the signature, the zero-knowledge proof is combined with the group signature, so that a blacklist shielding mechanism defined by a seller does not damage the anonymity of a bidder. Meanwhile, the homomorphic encryption technology is used, it is guaranteed that all the winning bid calculation of the auction is carried out under the ciphertext, and the bidding amount and sorting privacy of the bidder are achieved. And in the final transaction stage, the winner shows the bid commitment open value of the winning bid, so that the winner is correctly identified by the seller without exposing the identity, and smooth transaction is ensured.

Description

Technical Field

[0001] The present invention belongs to the technical field of anonymity and data privacy protection in applied cryptography, and relates to a privacy-protected auction system and method, and specifically to a seller-autonomous auction system and method with bidding anonymity and bid privacy. Background Art

[0002] Electronic auction is an online commodity trading method in which buyers bid publicly for auction items, and the highest bidder wins and purchases the auction item with the winning bid. However, as important information in electronic auctions, the identity of bidders and bid prices may be leaked, which may cause bidders to suffer losses. For example, in the auction of expensive goods, the disclosure of bidders' identities and bids may expose them to risks such as theft and robbery.

[0003] To eliminate this threat, some privacy-preserving auction methods have been proposed. In these schemes, the auction system is able to verify the bidders' identities and calculate the winner in a way that does not reveal the bidders' identities and bid prices. Unfortunately, such privacy-preserving auctions may undermine the seller's autonomy, as sellers may want to prevent certain bidders with whom they have had unpleasant transactions from participating in their future auctions.

[0004] Anonymous bidding schemes based on privacy-preserving signatures can reveal the identity of anonymous buyers by opening the winning tag name to reject bidders who behave badly. However, this solution undermines the identity privacy of legitimate bidders. The application of linkable ring (group) signatures can balance the above-mentioned issues of bidder privacy and seller autonomy to a certain extent, because the seller can determine whether the winner is the same as the previous misbehaver by linking two signatures. Although this linkability does not necessarily mean identity leakage, the bidding history of all bidders will be leaked through the signature. In other words, these solutions will also compromise the privacy of bidders. Summary of the invention

[0005] In order to solve the trade-off problem between bidder privacy and seller autonomy, the present invention provides a seller autonomous auction system and method with bidding anonymity and bid privacy.

[0006] The technical solution adopted by the system of the present invention is: a seller autonomous auction system with bidding anonymity and bid privacy, including four entities: sellers, bidders, auction platforms and anonymous identity providers;

[0007] The seller, being the initiator of the auction, has a bidder blacklist customized by the seller, initiates an auction request to the auction platform, and trades with the winning bidder according to the result returned by the auction platform;

[0008] The bidders participate in the bidding by placing encrypted bids on the auction platform, and the winning bidders can purchase the items auctioned by the sellers at their own bids;

[0009] The auction platform is responsible for processing the auction request from the seller and publishing it publicly, collecting the encrypted bids of the bidders, verifying the legitimacy of the bids and calculating the winning bidder based on the bidder blacklist provided by the seller, and finally returning the result to the seller;

[0010] The anonymous identity provider provides anonymous identity authentication services for the bidders so that the auction platform can verify the legitimacy of the anonymous bidding.

[0011] The technical solution adopted by the method of the present invention is: a seller autonomous auction method with bidding anonymity and bid privacy, including an initialization phase, a registration phase, an auction release phase, a bidding phase, a winner calculation phase and a transaction phase;

[0012] During the initialization phase, the auction platform and the anonymous identity provider generate public parameters and keys;

[0013] In the registration stage, the user registers as a seller with the auction platform or as a bidder with an anonymous identity provider;

[0014] In the auction release phase, the seller releases the auction item information and blacklist to the auction platform, and the auction platform broadcasts the message to all bidders after verification;

[0015] In the bidding stage, bidders participate in the auction and send their own encrypted bids to the auction platform;

[0016] In the winner calculation stage, the auction platform collects all bids for the same auction, screens valid bids based on the seller's blacklist, calculates the winner under ciphertext, and sends the result to the seller for decryption;

[0017] In the transaction phase, the seller broadcasts the winner's bid commitment, and the winner proves his or her identity by presenting the open value of the commitment, thereby completing the transaction.

[0018] Preferably, in the initialization phase, the anonymous identity provider generates a group public key, an administrator private key, an open private key and a group initial state, and sends the group public key to the auction platform; the auction platform generates its own signature public-private key pair, and publicly releases its own signature public key.

[0019] Preferably, during the registration stage, the user registers as a seller or an anonymous bidder;

[0020] When registering as a seller, the user generates his own homomorphic encryption public-private key pair and signature public-private key pair, makes the two public keys public, and sends a registration request containing his identity information to the auction platform;

[0021] When registering as a bidder, the user sends a registration request containing his or her identity information to the anonymous identity provider. The anonymous identity provider verifies the request and updates the group status, and generates a new group private key and returns it to the user.

[0022] Preferably, during the auction publishing stage, the seller signs the auction item information and blacklist, and then sends his or her identity number, signature, auction item information and blacklist to the auction platform; the auction platform verifies the signature, and if the verification is successful, an auction number is assigned to the auction, and an auction notice containing the auction number, seller identity number, auction item information and blacklist is generated, and then the auction notice is signed, and finally the signature and auction notice are broadcast to all bidders.

[0023] Preferably, the bidding stage is specifically implemented by the following steps:

[0024] Step 1: The bidder verifies the auction notice signature from the auction platform. If it passes and the bidder is interested in the auction, proceed to step 2, otherwise it ends;

[0025] Step 2: The bidder checks whether he is on the blacklist in the auction notice, that is, checks whether there is a blocked tag he has generated in the blacklist. If not, proceed to step 3, otherwise end;

[0026] Step 3: The bidder encrypts his bid with the seller’s public key.

[0027] Step 4: The bidder selects a random number and uses a hash function to calculate a bid commitment using the auction number on the auction notice, the bid plaintext, and the random number.

[0028] Step 5: The bidder generates a bid containing the auction number, bid plaintext and bid commitment, signs the bid, generates a shielding tag corresponding to the signature, and finally sends the signature, shielding tag and bid to the auction platform.

[0029] Preferably, in the winner calculation stage, the auction platform collects all bids of the same auction according to the auction number and verifies the legitimacy of the bids; then the auction platform uses a fully homomorphic computing circuit to calculate the maximum bid price and the ciphertext of the bid commitment among all legal bids in the auction, and sends it to the seller after signing it with the auction number; after the seller verifies the signature, he uses the private key to decrypt it to obtain the plaintext of the maximum bid price and the bid commitment.

[0030] The fully homomorphic computing circuit inputs the seller's homomorphic encryption public key epk sid , the encrypted price of all valid bids Bid receipts for all valid bids The parameters n and d of the approximate function Comp; each time, all encrypted prices are divided into two groups, and the size of each pair is compared using the Comp algorithm. The larger encrypted price and its bid certificate are retained and enter the next round of comparison; after logk comparisons, the maximum encrypted bid is obtained and its bid certificate And output; the approximate function Comp is:

[0031]

[0032]

[0033] Among them, a and b represent the two input values ​​that need to be compared, and d represents the function f n (x) is the number of iterations, n is a number used to limit 0≤i≤n, x represents the function f n The input of (x), k represents the total number of bid vouchers, and logk represents the logarithm operation with base 2 on k.

[0034] Preferably, during the transaction stage, the seller signs the winner's bid commitment, and then broadcasts the auction number, bid commitment and signature; after the winner verifies the signature, he sends a transaction request message and the random number he used to generate the bid commitment to the buyer; finally, the seller opens the commitment and conducts the transaction; if the seller is not satisfied with the transaction, he applies to the auction platform to add the shielding tag of the anonymous winning buyer to his own blacklist.

[0035] Preferably, the method includes a fully homomorphic encryption scheme, a zero-knowledge shieldable group signature scheme, a common signature scheme and an encryption scheme;

[0036] The fully homomorphic encryption scheme includes four algorithms: key generation, encryption, evaluation and decryption. It supports that the result of ciphertext calculation is equivalent to the result of plaintext calculation after decryption, and is used to protect the price privacy of bidders.

[0037] The zero-knowledge shielded group signature scheme includes five algorithms: initialization, joining, signing, verification, and opening. It invalidates the signatures of blacklisted users without destroying the anonymity of users, and is used to screen legitimate bids according to seller requirements during the winner calculation stage.

[0038] The common signature scheme includes three algorithms: key generation, signature and verification, which are used to ensure the integrity of messages transmitted between entities;

[0039] The common encryption scheme includes three algorithms: key generation, encryption and decryption, which are used to ensure the confidentiality of messages transmitted between entities.

[0040] The beneficial effects of the present invention include:

[0041] 1. The present invention proposes a privacy-protecting seller autonomous auction system, which supports the application of seller-defined auction blacklists under the premise of protecting bidders' bidding privacy and identity privacy.

[0042] 2. The present invention proposes a zero-knowledge shieldable group signature technology. By using zero-knowledge proof and pseudo-random function to transform the original dynamic group signature technology, the signatures of anonymous users on the blacklist can be invalidated in a specified round of verification without destroying the unlinkability of other signatures.

[0043] 3. The present invention applies homomorphic encryption technology and designs homomorphic encryption circuits to achieve the whole process of calculating the winning bid of the auction in ciphertext, ensuring that except for the winning bid being known to the seller in the end, all bid prices will not be known to any party other than the bidder.

[0044] 4. The present invention applies commitment technology and enables the final seller to confirm the transaction to the buyer by opening an identity-independent commitment, thereby maintaining the anonymity of the winning bidder in the transaction stage. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The technical solution of the present invention is further described below using embodiments and specific implementation methods. In addition, in the process of describing the technical solution, some drawings are also used. For those skilled in the art, other drawings and the intention of the present invention can also be obtained based on these drawings without paying creative work.

[0046] Figure 1 A system model diagram of an embodiment of the present invention;

[0047] Figure 2 The figure is a flow chart of a single-round auction according to an embodiment of the present invention. DETAILED DESCRIPTION

[0048] In order to facilitate ordinary technicians in the field to understand and implement the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the implementation examples described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0049] Please see Figure 1 ,This embodiment provides a seller autonomous auction system with bidding anonymity and bid privacy, including four entities: sellers, bidders, auction platforms and anonymous identity providers;

[0050] The sellers can initiate auctions and manage their respective bidder blacklists;

[0051] The bidders may participate in bidding for the auction items they are interested in;

[0052] The auction platform organizes privacy-preserving auctions and calculates winners;

[0053] The anonymous identity provider provides anonymous authentication services for bidders;

[0054] The seller is the initiator of the auction, initiates an auction request to the auction platform, and conducts transactions with the winning bidder based on the results returned by the auction platform; the auction platform is responsible for processing the auction request from the seller and publishing it publicly, collecting the bidders' encrypted bids, verifying the legitimacy of the bids, calculating the winning bidder, and finally returning the result to the seller; the bidder participates in the auction by placing an encrypted bid on the auction platform, and the winning bidder can purchase the items auctioned by the seller at his own bid; the anonymous identity provider provides anonymous identity authentication services for the bidder so that the auction platform can verify the legitimacy of the anonymous bid.

[0055] Please see Figure 2 ,This embodiment provides a seller autonomous auction method with bidding anonymity and bid privacy, including six stages: initialization, registration, auction release, bidding, winner calculation and transaction;

[0056] During the initialization phase, the auction platform and the anonymous identity provider generate necessary public parameters and keys;

[0057] In one implementation, during the initialization phase, the anonymous identity provider runs an initialization protocol of a zero-knowledge shielded group signature scheme to generate a group public key, an administrator private key, an open private key, and a group initial state, and sends the group public key to the auction platform; the auction platform runs a key generation algorithm of a common signature scheme to generate its own signature public-private key pair, and publicly releases its own signature public key.

[0058] During the registration phase, users can register as sellers with the auction platform or as bidders with an anonymous identity provider;

[0059] In one embodiment, during the registration phase, a user can register as a seller or an anonymous bidder at the same time, but each person can only register one identity for each role; when registering as a seller, the user runs the homomorphic encryption key generation algorithm and the ordinary signature scheme key generation algorithm to generate his own homomorphic encryption public-private key pair and signature public-private key pair, publishes these two public keys and sends a registration request containing his own identity information to the auction platform; when registering as a bidder, the user sends a registration request containing his own identity information to the anonymous identity provider, the anonymous identity provider verifies the request and runs the joining algorithm of the zero-knowledge shielded group signature scheme, updates the group status, and generates a new group private key and returns it to the user.

[0060] Once the system is initialized and user registration is completed, the auction process can begin. A complete auction process consists of four stages: auction release, bidding, winner calculation and transaction. Figure 2 .

[0061] In the auction release phase, the seller releases the auction item information and blacklist to the auction platform, and the auction platform broadcasts the message to all bidders after verification;

[0062] In one embodiment, during the auction publishing stage, the seller runs the signature algorithm of the ordinary signature scheme to sign the auction item information and the blacklist, and then sends his own identity number, signature, auction item information and blacklist to the auction platform; the auction platform runs the verification algorithm of the ordinary signature scheme to verify the signature, and if the verification passes, an auction number is assigned to the auction, and an auction notice containing the auction number, the seller's identity number, the auction item information and the blacklist is generated, and then the signature algorithm of the ordinary signature scheme is run to sign the auction notice, and finally the signature and the auction notice are broadcast to all bidders.

[0063] During the bidding phase, bidders can participate in the auction according to their own interests and send their own encrypted bids to the auction platform;

[0064] In one embodiment, the bidding stage includes the following steps:

[0065] Step 1: The bidder runs the verification algorithm of the common signature scheme to verify the auction notice signature from the auction platform. If it passes and the bidder is interested in the auction, step 2 can be performed, otherwise it ends;

[0066] Step 2: The bidder checks whether he is on the blacklist in the auction notice, that is, checks whether there is a blocked tag he has generated in the blacklist. If not, proceed to step 3, otherwise the subsequent steps are invalid;

[0067] Step 3: The bidder runs the encryption algorithm of the fully homomorphic encryption scheme and encrypts his bid with the seller’s public key;

[0068] Step 4: The bidder selects a random number and uses a hash function to calculate a bid commitment using the auction number on the auction notice, the bid plaintext, and the random number.

[0069] Step 5: The bidder generates a bid including the auction number, bid plaintext and bid commitment, signs the bid using the signature algorithm of the zero-knowledge shielded group signature scheme, generates a shielding tag corresponding to the signature, and finally sends the signature, shielding tag and bid to the auction platform.

[0070] In the winner calculation stage, the auction platform collects all bids for the same auction, screens valid bids based on the seller's blacklist, calculates the winner under ciphertext, and sends the result to the seller for decryption;

[0071] In one embodiment, during the winner calculation stage, the auction platform collects all bids of the same auction according to the auction number, and runs the verification algorithm of the zero-knowledge shielded group signature scheme to verify the legitimacy of the bids; then the auction platform uses a fully homomorphic computing circuit to calculate the maximum bid price and the ciphertext of the bid commitment among all legal bids in the auction, and signs it with the auction number and sends it to the seller; after the seller verifies the signature, he uses the private key to decrypt it to obtain the plaintext of the maximum bid price and bid commitment.

[0072] In one implementation, see Table 1, the specific implementation process of the fully homomorphic computing circuit is:

[0073] Enter the seller's homomorphic encryption public key epk sid , the encrypted price of all valid bids Bid receipts for all valid bids The parameters n and d of the approximate function Comp. Each time, all encrypted prices are divided into two groups, and the size of each pair is compared using the Comp algorithm. The larger encrypted price and its bid certificate are retained and enter the next round of comparison. After logk comparisons, the maximum encrypted bid is obtained. and its bid certificate And output. The calculation formula of the approximate function is And there is Among them, a and b represent the two input values ​​that need to be compared, and d represents the function f n (x) is the number of iterations, n is a number used to limit 0≤i≤n, x represents the function f n The input of (x), k represents the total number of bid vouchers, and logk represents the logarithm operation with base 2 on k.

[0074]

[0075]

[0076] In the transaction phase, the seller broadcasts the winner's bid commitment, and the winner proves his or her identity by presenting the open value of the commitment, thereby completing the transaction.

[0077] In one embodiment, during the transaction phase, the seller signs the bid commitment of the winner, and then broadcasts the auction number, bid commitment and signature; after the winner verifies the signature, it sends the buyer a transaction request message and the random number (i.e., the opening value) used to generate the bid commitment; finally, the seller opens the commitment and conducts the transaction. If the seller is not satisfied with the transaction, he can apply to the auction platform to add the shielding tag of the anonymous winning buyer to his blacklist.

[0078] The various encryption and decryption signature schemes adopted by the present invention are further described below through specific embodiments.

[0079] The encryption and decryption signature scheme used in this embodiment includes a fully homomorphic encryption scheme, a zero-knowledge shieldable group signature scheme, a general signature scheme, and an encryption scheme;

[0080] The fully homomorphic encryption scheme includes four algorithms: key generation, encryption, evaluation and decryption. It supports that the result of ciphertext calculation is equivalent to the result of plaintext calculation after decryption, and is used to protect the price privacy of bidders.

[0081] The fully homomorphic computing circuit can compare the plaintext values ​​of two homomorphically encrypted ciphertexts without decrypting them, and is used to calculate the ciphertext of the maximum bid and its bid commitment in the winner calculation phase;

[0082] The common signature scheme includes three algorithms: key generation, signature and verification, which are used to ensure the integrity of messages transmitted between entities;

[0083] The common encryption scheme includes three algorithms: key generation, encryption and decryption, which are used to ensure the confidentiality of messages transmitted between entities. For the sake of brevity, they are omitted in the following description.

[0084] The zero-knowledge shielded group signature scheme includes five algorithms: initialization, joining, signing, verification, and opening. It can invalidate the signature of blacklisted users without destroying the anonymity of users, and is used to screen legitimate bids according to seller requirements during the winner calculation stage;

[0085] In one implementation, the zero-knowledge shieldable group signature scheme is specifically implemented as follows:

[0086] If Alg is an algorithm, x and y are two variables. In this example, y←Alg(x) is used to indicate that when the input is x, the output of running the probabilistic algorithm Alg is y. y:=Alg(x) is used to indicate that when the input is x, the output of running the deterministic algorithm Alg is y. In this example, ZKBGS.Setup, ZKBGS.Join, ZKBGS.Sign, ZKBGS.Verify, and ZKBGS.Open are used to represent the initialization, joining, signing, verification, and opening algorithms of the zero-knowledge shielded group signature scheme, respectively. DGS.Setup, DGS.Join, DGS.Sign, DGS.Verify, and DGS.Open are used to represent the initialization, joining, signing, verification, and opening algorithms of the dynamic group signature scheme, respectively. ZKP.Setup, ZKP.Prove, and ZKP.Verify are used to represent the initialization, proof, and verification algorithms of the zero-knowledge proof scheme, respectively.

[0087] The key generation algorithm of the zero-knowledge shielded group signature scheme is expressed as (gpk, isk, osk, st)←ZKBGS.Setup(1 λ ), whose input is the security parameter λ. First, the algorithm runs the dynamic group signature initialization algorithm (gpk DGS , isk DGS ,osk,st)←DGS.Setup(1 λ ), whose input is the security parameter λ and output is the group public key gpk of the dynamic group signature algorithm DGS , administrator private key isk, open private key osk, group status st. Then set the relationship R that needs to be proved L ={(x=(nonce, tag), w=gsk): tag=PRF gsk (nonce)}, where the statement x includes a random number nonce and a tag tag, the knowledge w is the user's private key gsk, and the relationship tag = PRF gsk (nonce) indicates a tag (length l out ) uses gsk as the key (length l key ), with nonce as input (length l in ), calculated using the pseudo-random function PRF. Then execute the zero-knowledge proof initialization algorithm pp←ZKP.Setup(1 λ , R L ) obtains the output proof parameter pp. Set the zero-knowledge shielded group signature group public key gpk = (gpk DGS , pp), administrator private key isk = isk DGS , output (gpk, isk, osk, st).

[0088] The joining algorithm of the zero-knowledge shieldable group signature scheme is expressed as (gsk i , st′)←ZKBGS.Join(isk,st,i), whose input is an administrator private key isk, group state st and a user identity i. The algorithm first runs the dynamic group signature joining algorithm DGS.Join(isk,st,i) to get (gsk DGS，i , st′ DGS ), where gsk DGS，i is the group private key of the dynamic group signature algorithm of user i, st′ DGS is the new group state. Let user i’s zero-knowledge shield the group private key gsk of the group signature i =gsk DGS，i , the new zero-knowledge shielded group state st′=st′ DGS , output (gsk i , st′).

[0089] The signature algorithm of the zero-knowledge shieldable group signature scheme is expressed as (σ, bt)←ZKBGS.Sign(gpk, gsk i , m, list), whose input is a group public key gpk=(gpk DGS ,pp)(where gpk DGS is the dynamic group signature public key, pp is the zero-knowledge proof parameter), a private key gsk of user i i =gsk DGS，i (i.e., the dynamic group signature private key of user i), a message m and a blacklist list consisting of n tuples = {(nonce1, tag1), (nonce2, tag2), ..., (nonce n , tag n )}, where each tuple (nonce i , tag i ) includes a random number nonce i and a tag i The algorithm first runs the signature algorithm σ of the dynamic group signature DGS ←DGS.Sign(gpk DGS , gsk DGS，i , m) obtain the dynamic group signature σ of user i for message m DGS Next, select a length l in The random value nonce0 is used to calculate a tag for this message transmission. In addition, for j = 0, 1, ..., n, this embodiment also calculates the label And by running the proof algorithm π of the zero-knowledge proof scheme j←ZKP.Prove(pp,(nonce j , tag′ j ), gsk DGS，i ) Generate the corresponding proof π j , to prove that tag′ j It is a legitimate private key gsk DGS，i Finally, this embodiment sets the proof material π=(π0,π1,...,π n ), signature σ=(σ DGS , tag′1,...,tag′ n , П), shield the tag bt = (nonce0, tag′0), and output (σ, bt).

[0090] The verification algorithm of the zero-knowledge shielded group signature scheme is expressed as 0 / 1: =ZKBGS.Verify(gpk, m, list, σ, bt), whose input is a group public key gpk=(gpk DES , pp), a message m, a signature σ=(σ DGS , tag′1,...,tag′ n , ∏), a blacklist list = {(nonce1, tag1), (nonce2, tag2), ..., (nonce n , tag n )} and a masking tag bt = (nonce0, tag′0), where Π = (π0, π1, ..., π n ) to check the validity of these proofs. That is, 1) the verification algorithm of the dynamic group signature scheme DGS.Verify(gpk DGS , m, σ DGS ) Output 1, which is the signature σ DGS is a valid dynamic group signature; 2) for any j = 1, ..., n, there is a tag j ≠tag′ j , that is, all the tags in the blacklist are not calculated by the private key of the signing user; 3) For any j = 0, ..., n, the algorithm ZKP.Verify(pp, (nonce j , tag′ j ), π j ) Output 1, which proves π j Valid, all tags are correctly calculated using the signing user's private key. If all three of the above conditions are met, the algorithm outputs 1, otherwise it outputs 0.

[0091] The opening algorithm of the zero-knowledge shieldable group signature scheme is represented as i:=ZKBGS.Open(gpk,osk,m,σ), whose input is a group public key gpk=(gpk DGS , pp), message m, signature σ=(σ DGS , tag′1,...,tag′ n , П). The algorithm runs the dynamic group signature opening algorithm i: = DGS.Open(gpk DGS ,osk,m,σ DGS ), output the obtained user identity i.

[0092] It should be understood that the embodiments described above are part of the embodiments of the present invention, rather than all of the embodiments. In addition, the technical features in the various embodiments or single embodiments provided by the present invention can be combined with each other arbitrarily to form a feasible technical solution. Such combination is not restricted by the sequence of steps and / or the structural composition mode, but must be based on the ability of ordinary technicians in the field to implement. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such combination of technical solutions does not exist and is not within the protection scope required by the present invention.

[0093] It should be understood that the above description of the preferred embodiment is relatively detailed and cannot be regarded as limiting the scope of patent protection of the present invention. Under the enlightenment of the present invention, ordinary technicians in this field can also make substitutions or modifications without departing from the scope of protection of the claims of the present invention, which all fall within the scope of protection of the present invention. The scope of protection requested for the present invention shall be based on the attached claims.

Claims

1. A seller-autonomous auction system with bidding anonymity and bid privacy, characterized by: It includes four entities: sellers, bidders, auction platforms, and anonymous identity providers; The seller, being the initiator of the auction, has a bidder blacklist customized by the seller, initiates an auction request to the auction platform, and trades with the winning bidder according to the result returned by the auction platform; The bidders participate in the bidding by placing encrypted bids on the auction platform, and the winning bidders can purchase the items auctioned by the seller at their own bids; The auction platform is responsible for processing the auction request from the seller and publishing it publicly, collecting the encrypted bids of the bidders, verifying the legitimacy of the bids and calculating the winning bidder, and finally returning the result to the seller; The anonymous identity provider provides anonymous identity authentication services for the bidders so that the auction platform can verify the legitimacy of the anonymous bids.

2. A seller-autonomous auction method with bidding anonymity and bid privacy, characterized by: It includes the initialization phase, registration phase, auction release phase, bidding phase, winner calculation phase and transaction phase; During the initialization phase, the auction platform and the anonymous identity provider generate public parameters and keys; In the registration stage, the user registers as a seller with the auction platform or as a bidder with an anonymous identity provider; In the auction release phase, the seller releases the auction item information and blacklist to the auction platform, and the auction platform broadcasts the message to all bidders after verification; In the bidding stage, bidders participate in the auction and send their own encrypted bids to the auction platform; In the winner calculation stage, the auction platform collects all bids for the same auction, screens valid bids based on the seller's blacklist, calculates the winner under ciphertext, and sends the result to the seller for decryption; In the transaction phase, the seller broadcasts the winner's bid commitment, and the winner proves his or her identity by presenting the open value of the commitment, thereby completing the transaction.

3. The seller-autonomous auction method with bidding anonymity and bid privacy according to claim 2, characterized in that: In the initialization phase, the anonymous identity provider generates a group public key, an administrator private key, an open private key and a group initial state, and sends the group public key to the auction platform; the auction platform generates its own signature public-private key pair and publicly releases its own signature public key.

4. The seller-autonomous auction method with bidding anonymity and bid privacy according to claim 2, characterized in that: In the registration stage, the user registers as a seller or an anonymous bidder; When registering as a seller, the user generates his own homomorphic encryption public-private key pair and signature public-private key pair, makes the two public keys public, and sends a registration request containing his identity information to the auction platform; When registering as a bidder, the user sends a registration request containing his or her identity information to the anonymous identity provider. The anonymous identity provider verifies the request, updates the group status, and generates a new group private key and returns it to the user.

5. The seller-autonomous auction method with bidding anonymity and bid privacy according to claim 2, characterized in that: During the auction publishing stage, the seller signs the auction item information and blacklist, and then sends his or her identity number, signature, auction item information and blacklist to the auction platform; the auction platform verifies the signature, and if the verification is successful, an auction number is assigned to the auction, and an auction notice containing the auction number, seller identity number, auction item information and blacklist is generated, and then the auction notice is signed, and finally the signature and auction notice are broadcast to all bidders.

6. The seller-autonomous auction method with bidding anonymity and bid privacy according to claim 2, characterized in that: The bidding stage specifically includes the following steps: Step 1: The bidder verifies the auction notice signature from the auction platform. If it passes and the bidder is interested in the auction, proceed to step 2, otherwise the process ends; Step 2: The bidder checks whether he is on the blacklist in the auction notice, that is, checks whether there is a blocking tag he has generated in the blacklist. If not, proceed to step 3, otherwise the process ends; Step 3: The bidder encrypts his bid with the seller’s public key. Step 4: The bidder selects a random number and uses a hash function to calculate a bid commitment using the auction number on the auction notice, the bid plaintext, and the random number. Step 5: The bidder generates a bid containing the auction number, bid plaintext and bid commitment, signs the bid, generates a shielding tag corresponding to the signature, and finally sends the signature, shielding tag and bid to the auction platform.

7. The seller-autonomous auction method with bidding anonymity and bid privacy according to claim 2, characterized in that: In the winner calculation stage, the auction platform collects all bids of the same auction according to the auction number to verify the legitimacy of the bids; then the auction platform uses a fully homomorphic computing circuit to calculate the maximum bid price and the ciphertext of the bid commitment among all the legal bids in the auction, and sends it to the seller after signing it with the auction number; after the seller verifies the signature, he uses the private key to decrypt it to obtain the plaintext of the maximum bid price and the bid commitment; The fully homomorphic computing circuit inputs the seller's homomorphic encryption public key epk sid , the encrypted price of all valid bids Bid receipts for all valid bids The parameters n and d of the approximate function Comp are as follows: each time, all encrypted prices are divided into two groups, and the size of each group is compared with the Comp algorithm. The larger encrypted price and its bid certificate are retained and enter the next round of comparison; after logk comparisons, the maximum encrypted bid is obtained. and its bid certificate And output; the approximate function Comp is: Among them, a and b represent the two input values ​​that need to be compared, and d represents the function f n (x) is the number of iterations, n is a number used to limit 0≤i≤n, x represents the function f n The input of (x), k represents the total number of bid vouchers, and logk represents the logarithm operation with base 2 on k.

8. The seller-autonomous auction method with bidding anonymity and bid privacy according to claim 2, characterized in that: During the transaction stage, the seller signs the winner's bid commitment, and then broadcasts the auction number, bid commitment and signature; after the winner verifies the signature, it sends a transaction request message and the random number used to generate the bid commitment to the buyer; finally, the seller opens the commitment and conducts the transaction; if the seller is not satisfied with the transaction, he / she applies to the auction platform to add the shielding tag of the anonymous winning buyer to his / her blacklist.

9. The seller-autonomous auction method with bidding anonymity and bid privacy according to any one of claims 2 to 8, characterized in that: Including fully homomorphic encryption schemes, zero-knowledge shieldable group signature schemes, ordinary signature schemes and encryption schemes; The fully homomorphic encryption scheme includes four algorithms: key generation, encryption, evaluation and decryption. It supports that the result of ciphertext calculation is equivalent to the result of plaintext calculation after decryption, and is used to protect the price privacy of bidders. The zero-knowledge shielded group signature scheme includes five algorithms: initialization, joining, signing, verification, and opening. It invalidates the signatures of blacklisted users without destroying the anonymity of users, and is used to screen legitimate bids according to seller requirements during the winner calculation stage. The common signature scheme includes three algorithms: key generation, signature and verification, which are used to ensure the integrity of messages transmitted between entities; The common encryption scheme includes three algorithms: key generation, encryption and decryption, which are used to ensure the confidentiality of messages transmitted between entities.

Images