Full-function layered deterministic wallet model supporting cloaking address and signature aggregation

Abstract

The invention provides a full-function layered deterministic wallet model supporting invisible address and signature aggregation. The full-function layered deterministic wallet model comprises a full-function layered deterministic wallet management layer supporting hierarchical organization and a transaction function layer supporting each manager entity in the organization, the full-function hierarchical deterministic wallet management layer supports hierarchical organization and comprises wallet key generation of a root manager entity and wallet key generation of an upper layer manager entity for a direct lower layer manager entity of the upper layer manager entity; a transaction function layer of each administrator entity in the organization is supported, including generation and verification of a single transaction signature and generation and verification of an aggregate signature. According to the invention, the invisible address function is added to the layered deterministic wallet, and a sender can very conveniently obtain the receiving address of the digital assets through a non-interactive key derivation mechanism, so that the main public key characteristic of the layered deterministic wallet is enhanced, and the user convenience and user privacy are better realized.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to a full-function hierarchical deterministic wallet model supporting stealth addresses and signature aggregation. Background Art

[0002] In blockchain applications, the generation, management (such as backup and recovery) and use of user keys can be achieved through cryptographic wallets. Hierarchical Deterministic Wallet (HDW) has become one of the most widely used cryptographic wallets due to its deterministic generation characteristics, master public key derivation characteristics and hierarchical management characteristics. The deterministic generation characteristic means that all keys in the wallet are deterministically generated directly or indirectly from the "seed", so when necessary (for example, the device used to host the wallet is damaged), the wallet owner can recover all keys from the seed. The master public key characteristic means that the wallet owner can directly calculate multiple derived public keys from the master public key as the receiving address of the digital asset, and no private key is required in this process, and the hierarchical management characteristic means that the derived public key can be used as the master public key of the next level to continue to derive. The deterministic generation feature makes it easy to back up and restore the wallet. The master public key derivation feature allows users to easily generate one-time addresses (without worrying about exposing private keys to dangerous network environments) to increase security and privacy. The hierarchical management feature allows it to be widely used in hierarchical management organizations such as large enterprises or institutions. For example, the treasurer allocates digital assets to subordinate departments: the treasurer has the company's master key pair and can create derived key pairs for each department. Each department only has the key pair of its own digital assets and can manage and trade the digital assets of the department. In addition, these features are even used to support and implement some newly expanded application scenarios, such as trustless auditing: the wallet owner gives the master public key to the auditor, and the auditor can scan the blockchain to audit the wallet owner's related transactions, and the wallet owner does not have to worry about the auditor obtaining the relevant private key to dispose of his digital assets. However, when using the HDW algorithm, in addition to keeping the master private key secret and secure, the user also needs to keep the master public key and all derived private keys secret and secure. This is because the HDW algorithm in BIP32 has a fatal security issue (also known as a privilege escalation attack), that is, when an attacker obtains the master public key and any derived private key, the master private key can be recovered. This attack is catastrophic for the use case where the treasurer allocates digital assets to subordinate departments. Because once the department manager (who owns the derived private key) somehow obtains the master public key, he can steal all the company's digital assets. In addition, the treasurer's allocation of digital assets to subordinate departments and trustless auditing cannot be achieved at the same time, because the auditor may collude with a department manager (who owns the derived private key) to leak the master public key and then steal all the company's digital assets.

[0003] Stealth address is a widely used privacy protection technology in the blockchain field. Through a non-interactive key derivation method, the sender of the transaction can generate a one-time, brand-new derived public key as the receiving address of the digital asset without interacting with the receiver, making it very user-friendly and convenient to implement the one-time address function, thereby enhancing privacy.

[0004] In a blockchain system, all nodes in the system must store growing blockchain data (including but not limited to signatures, business data, etc.). Currently, the size of blockchain data in most blockchain systems exceeds hundreds of GB, and some even exceed several TB. Signatures usually occupy a large part of the block size. Aggregate signatures are an important tool in the field of cryptography to effectively reduce storage, communication, and computing overhead. Aggregate signatures allow n different signatures on n different messages to be aggregated into one signature. Aggregate signatures can be applied to blockchains to reduce the size of signatures in blocks. In addition to effectively reducing transaction storage overhead and transmission overhead, it can also increase the speed of block verification.

[0005] The academic community has proposed many methods for HDW, but there is currently no full-featured HDW or HDW model and method that supports invisible address and signature aggregation functions. Summary of the invention

[0006] In view of the defects in the prior art, the purpose of the present invention is to provide a full-featured hierarchical deterministic wallet model that supports stealth addresses and signature aggregation.

[0007] The fully functional hierarchical deterministic wallet model supporting stealth addresses and signature aggregation provided by the present invention includes: a fully functional hierarchical deterministic wallet management layer supporting hierarchical organizations and a transaction function layer supporting each manager entity in the organization;

[0008] The fully functional hierarchical deterministic wallet management layer supporting hierarchical organization, including wallet key generation for the root manager entity, and generation of wallet keys by the upper manager entity for its directly lower manager entity;

[0009] The transaction function layer of each manager entity in the supporting organization includes the generation and verification of single transaction signatures and the generation and verification of aggregate signatures;

[0010] In the model, each manager entity has a unique identifier ID = (id0, id1, ..., id t ), t≥0, use the identifier ID=(id0) to represent the hierarchical organization, that is, the organization ID=ID0; let the identifier of the t≥0 layer be ID=(id0,id1,…,id t ), then there is an ID |t=ID,ID |(t-1) is the identifier of the parent manager entity of ID, and ID |i (i=0,…,t-1) is the identifier of the ancestor manager entity of ID, and the identifier ID is used to represent the manager entity or its wallet.

[0011] Preferably, the wallet model implementation process is:

[0012] Step 1: Generate system parameters PP using the Setup() algorithm;

[0013] Step 2: The root administrator entity runs the RootWalletKeyGen() algorithm to generate a root (wallet public key, wallet private key) pair (wpk ID ,wsk ID ), where the wallet private key is wsk ID =(wssk ID ,wsvk ID ), wssk ID It is the wallet spending private key, wsvk ID It is the wallet that checks the private key;

[0014] Step 3: The upper-level management entity uses its own wallet key pair (wpk ID ,wsk ID ), runs the WalletKeyDelegate() algorithm to generate a wallet key pair for its direct subordinate manager entity;

[0015] Step 4: When the sender sends digital assets to the receiver whose identifier is ID, the sender uses the receiver's ID and the corresponding wallet public key wpk ID , run the VerifyKeyDerive() algorithm to generate a derived verification public key dvk as the receiving address of the recipient's digital asset;

[0016] Step 5: The receiver enters his own wsvk ID , ID and wpk ID , and the receiving address dvk, run the VerifyKeyCheck() algorithm, if the algorithm output is 1, it means that dvk belongs to the receiver; otherwise, the opposite; if dvk belongs to the receiver, the receiver enters his own wsk ID , ID and wpk ID , run the SignKeyDerive() algorithm to generate the derived signature private key dsk corresponding to the dvk. The recipient uses dsk to run the Sign() algorithm to generate the signature σ, thereby trading the digital assets on the dvk;

[0017] Step 6: Anyone inputs dvk and (message, signature) to run the Verify() algorithm on (m,σ) to verify the validity of a single signature;

[0018] Step 7: For multiple (message, signature, derived verification public key) tuples (m i ,σ i ,dvk i ), i = 1, ..., n, anyone runs the aggregation algorithm Aggregation() to generate an aggregate signature σ agg ;

[0019] Step 8: Anyone inputs (message, derived verification public key) to (m i ,dvk i ), i = 1, ..., n, and an aggregate signature σ agg , run the aggregation verification algorithm AggVerify() to verify the validity of the aggregation signature.

[0020] Preferably, the step 1 comprises:

[0021] Choose a security parameter λ;

[0022] Choose the group of bilinear maps Where p is a prime number of length λ bits, G1 is a p-order additive cyclic group, G2 is a p-order multiplicative cyclic group, P is the generator of G1; (G1, G2) is a bilinear mapping group, there exists a bilinear mapping

[0023] Choose from eight hash functions:

[0024] in, Message space M: = {0,1} * , the identifier space

[0025] Output system parameters:

[0026] Preferably, the step 2 comprises:

[0027] The root administrator entity inputs the root entity 0 layer identifier ID = (id0) and runs the RootWalletKeyGen algorithm to generate the root wallet key pair. The process is as follows:

[0028] Choose two uniformly random

[0029] Calculate A ID =αID P, B ID =β ID P;

[0030] Output the root wallet key pair of the root administrator entity: wpk ID :=(A ID ,B ID )=(α ID P,β ID P)∈G1×G1,

[0031] Preferably, the step 3 comprises:

[0032] The upper management entity uses its own wallet public key wpk ID|(t-1) ∈G1×G1 and wallet private key wsk ID|(t-1) =(αID|(t-1),βID|(t-1))∈Zp*×Zp*, run the WalletKeyDelegate algorithm, and generate a wallet key pair for its direct subordinate manager entity. The process is as follows:

[0033] Calculate the result of hash function H0

[0034] calculate

[0035] calculate

[0036] Output the wallet key pair of the direct lower-level manager entity ID: wpk ID :=(A ID ,B ID )=(α ID P,β ID P)∈G1×G1,

[0037] Preferably, step 4 comprises:

[0038] The sender uses the receiver's t≥0th layer identifier ID=(id0,id1,…,id t ) and wallet public key wpk ID =(A ID ,B ID ) generates a derived verification public key, the process is as follows:

[0039] Choose a uniform random parameter

[0040] Calculate Q r =rP∈G1;

[0041] calculate

[0042] calculate

[0043] Output a derived verification public key dvk: = (Q r ,Qvk0,Qvk1)∈G1×G2×G2.

[0044] Preferably, step 5 comprises:

[0045] The receiver uses its own layer t≥0 identifier ID=(id0,id1,…,id t ), wallet public key wpk ID =(A ID ,B ID )∈G1×G1 and wallet view private key wsvk ID =β ID , verify whether dvk is valid, the process is as follows:

[0046] Verify the equation

[0047] Verify the equation

[0048] If both equations hold, the VerifyKeyCheck algorithm outputs 1; otherwise, it outputs 0.

[0049] The receiver uses its own layer t≥0 identifier ID=(id0,id1,…,id t ), wallet key pair wpk ID =(A ID ,B ID )∈G Q ×G1 and Verify the equation and Is it true? If so, output the derived signature private key. The process is as follows:

[0050] Calculate dsk0 = α ID H3(B ID ,Q r ,β ID Q r )∈G1;

[0051] Calculate dsk1 = α ID H4(B ID ,Q r ,β ID Q r )∈G1;

[0052] Output derived signature private key dsk: = (dsk0, dsk1) = (α ID H3(B ID ,Qr ,β ID Q r ),α ID H4(B ID ,Q r ,β ID Q r ))∈G1×G1;

[0053] Given an aggregate tag w, a message m∈M, and a derived verification public key dvk=(Q r ,Qvk0,Qvk1)∈G1×G2×G2 and a derived signature private key dsk=(dsk0,dsk1)∈G1×G1, thereby generating a signature. The process is as follows:

[0054] Choose a uniform random parameter Calculate X′=xP∈G1;

[0055] calculate

[0056] calculate

[0057] calculate

[0058] Calculate S′=h·dsk0+c·dsk1+xP w ∈G1;

[0059] Output signature σ=(X′,S′)∈G1×G1.

[0060] Preferably, step 6 comprises:

[0061] Given an aggregate tag w, a message m, a signature σ = (X′, S′) ∈ G1×G1 and a derived verification public key dvk = (Q r ,Qvk0,Qvk1)∈G1×G2×G2, verify the validity of a single signature, the process is as follows:

[0062] calculate

[0063] calculate

[0064] calculate

[0065] Check the equation Is it true? If so, the Verify algorithm outputs 1; otherwise, it outputs 0.

[0066] Preferably, the step 7 comprises:

[0067] Given an aggregate tag w and multiple (message, signature, derived verification public key) tuples (m i ,σ i ,dvk i ), i=1,…,n, satisfying Verify(w,m i ,σ i ,dvk i )→1, where σ i =(X′ i ,S′ i )∈G1×G1, thereby generating an aggregate signature, the process is as follows:

[0068] Calculate X = (X′1,…,X′ n );

[0069] calculate

[0070] Output aggregate signature σ agg =(X,S n ).

[0071] Preferably, step 8 comprises:

[0072] Given an aggregate tag w, multiple (message, derived verification public key) pairs (m i ,dvk i =(Q ri ,Qvk i,0 ,Qvk i,1 )), i = 1, ..., n, an aggregate signature σ agg =(X,S n ), thereby verifying the validity of the aggregate signature. The process is as follows:

[0073] calculate

[0074] calculate

[0075] calculate

[0076] calculate

[0077] Calculation check equation Is it true? If so, the AggVerify algorithm outputs 1, otherwise it outputs 0.

[0078] Compared with the prior art, the present invention has the following beneficial effects:

[0079] (1) The full-function hierarchical deterministic wallet method supporting stealth address and signature aggregation of the present invention not only supports all functions of HDW, but also supports stealth address and signature aggregation functions, and there is no problem of privilege escalation attack;

[0080] (2) The model of the present invention consists of a management layer and a transaction layer. The usage instructions and benefits of each algorithm in the present invention are given in each layer, providing clear guidance and examples for users (especially enterprise users) to apply the model.

[0081] (3) The present invention adds the invisible address function to HDW, and through a non-interactive key derivation mechanism, the sender can easily obtain the receiving address of the digital asset, thereby strengthening the master public key feature of HDW and better realizing user convenience and user privacy;

[0082] (4) The present invention adds the signature aggregation function to HDW, effectively reducing the communication, computing and storage costs of blockchain service operators. BRIEF DESCRIPTION OF THE DRAWINGS

[0083] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0084] Figure 1 This is a diagram of the wallet model structure. DETAILED DESCRIPTION

[0085] The present invention is described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those of ordinary skill in the art, several changes and improvements can also be made without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

[0086] Example

[0087] The present invention provides a fully functional hierarchical deterministic wallet model that supports stealth addresses and signature aggregation. The model structure is as follows: Figure 1 As shown. The model has two layers: one is a fully functional hierarchical deterministic wallet management layer that supports hierarchical organizations, including wallet key generation for the root manager entity, and wallet key generation by the upper manager entity for its directly lower manager entity (i.e., the root manager entity or the lower manager entity generates keys for its directly lower manager entity); the other is a transaction function layer that supports each manager entity in the organization, including the generation and verification of a single transaction signature, as well as the generation and verification of an aggregate signature. In the model, each manager entity has a unique identifier ID = (id0, id1, ..., id t), t≥0, use the identifier ID=(id0) to represent the hierarchical organization, that is, the organization ID=ID0. Assume that the identifier of the t≥0 layer is ID=(id0,id1,…,id t ), then there is an ID |t =ID,ID |(t-1) is the identifier of the parent manager entity of ID (i.e., the immediate parent), and ID |i (i=0,…,t-1) is the identifier of the ancestor manager entity of ID. The identifier ID is used to represent the manager entity or its wallet. The full-featured hierarchical deterministic wallet method that supports stealth addresses and signature aggregation consists of ten polynomial time algorithms (Setup, RootWalletKeyGen, WalletKeyDelegate, VerifyKeyDerive, VerifyKeyCheck, SignKeyDerive, Sign, Verify, Aggregation, AggVerify), which runs as follows:

[0088] (1) The Setup() algorithm is run to generate the system parameters PP.

[0089] (2) The root administrator entity runs the RootWalletKeyGen() algorithm to generate a root (wallet public key, wallet private key) pair (wpk ID ,wsk iD ), where the wallet private key is wsk ID =(wssk ID ,wsvk ID ), wssk ID It is the wallet spending private key, wsvk ID It is the wallet that views the private key.

[0090] (3) The upper-level management entity uses its own wallet key pair (wpk ID ,wsk ID ), runs the WalletKeyDelegate() algorithm to generate a wallet key pair for its direct subordinate manager entity.

[0091] (4) When the sender sends digital assets to the receiver whose identifier is ID, the sender uses the receiver’s ID and the corresponding wallet public key wpk ID , run the VerifyKeyDerive() algorithm to generate a derived verification public key dvk as the receiving address of the recipient's digital asset.

[0092] (5) The receiver enters his own wsvk ID (and ID and wpk ID) and the receiving address dvk, run the VerifyKeyCheck() algorithm, if the algorithm output is 1, it means that dvk belongs to the receiver; otherwise, the opposite is true. If dvk belongs to the receiver, the receiver enters his own wsk ID (and ID and wpk ID ), runs the SignKeyDerive() algorithm to generate the derived signature private key dsk corresponding to the dvk. The recipient uses dsk to run the Sign() algorithm to generate the signature σ, thereby trading the digital assets on the dvk.

[0093] (6) Anyone can input dvk and (message, signature) to run the Verify() algorithm on (m,σ) to verify the validity of a single signature.

[0094] (7) For multiple (message, signature, derived verification public key) tuples (m i ,σ i ,dvk i ), i = 1, ..., n, anyone can run the aggregation algorithm Aggregation() to generate an aggregate signature σ agg .

[0095] (8) Anyone can enter (message, derived verification public key) to (m i ,dvk i ), i = 1, ..., n, and an aggregate signature σ agg , run the aggregation verification algorithm AggVerify() to verify the validity of the aggregation signature.

[0096] Based on the above system model, it is not difficult to see that the full-featured hierarchical deterministic wallet method that supports stealth address and signature aggregation not only realizes the deterministic generation characteristics, master public key derivation characteristics and hierarchical management characteristics of HDW, but also provides the functions of stealth address and signature aggregation. In terms of security, this method achieves complete resistance to privilege escalation attacks. Specifically, the leakage of the derived signature private key will not affect the security of any other derived signature private key or wallet private key, and the leakage of the wallet private key will not affect the security of any other derived signature private key and wallet private key, except for the security of the leaked wallet and its direct / indirect lower-level manager entities. At the same time, under the signature aggregation function, the user's digital assets are also safe. In terms of user privacy, for the target wallet owner with identifier ID, as long as its wallet private key and its ancestor's wallet private key are safe, given the target derived verification public key dvk, no one (except the creator of dvk) can determine whether dvk belongs to the ID.

[0097] The present invention also discloses a specific full-function hierarchical deterministic wallet method supporting stealth addresses and signature aggregation, which includes ten algorithms, which are as follows:

[0098] 1. Initialization algorithm Setup: Generate system parameters. The algorithm steps are as follows:

[0099] 1) Choose a security parameter λ.

[0100] 2) Choose the bilinear mapping group Where p is a prime number of length λ bits, G1 is a p-order additive cyclic group, G2 is a p-order multiplicative cyclic group, and P is the generator of G1. (G1, G2) is a bilinear mapping group, and there exists a bilinear mapping

[0101] 3) Select eight hash functions: in Message space M: = {0,1} * , the identifier space

[0102] 4) Output system parameters:

[0103] The parameter PP is implicitly input into all the following algorithms.

[0104] 2. Root wallet key generation algorithm RootWalletKeyGen: The root administrator entity inputs the root entity (0 layer) identifier ID = (id0) and runs the RootWalletKeyGen algorithm to generate the root wallet key pair. The algorithm steps are as follows:

[0105] 1) Select two uniformly random

[0106] 2) Calculate A ID =α ID P, B ID =β ID P;

[0107] 3) Output the root wallet key pair of the root administrator entity: wpk ID :=(A ID ,B ID )=(α ID P,β ID P)∈G1×G1,

[0108] 3. Key proxy algorithm WalletKeyDelegate: The upper-level management entity uses its own wallet public key wpk ID|(t-1) ∈G1×G1 and wallet private key Run the WalletKeyDelegate algorithm and give the direct subordinate manager entity (i.e., identifier ID = (id0, id1, ..., id t ), t≥1) generates a wallet key pair. The algorithm steps are as follows:

[0109] 1) Calculation

[0110] 2) Calculation

[0111] 3) Calculation

[0112] 4) Output the wallet key pair of the direct lower-level manager entity ID: wpk ID :=(A ID ,B ID )=(α ID P,β ID P)∈G1×G1,

[0113] 4. Derived verification public key generation algorithm VerifyKeyDerive: The sender generates a public key based on the receiver's t≥0th layer identifier ID=(id0,id1,…,id t ) and wallet public key wpk ID =(A ID ,B ID ) generates a derived verification public key. The algorithm steps are as follows:

[0114] 1) Select a uniformly random

[0115] 2) Calculate Q r =rP∈G1;

[0116] 3) Calculation

[0117] 4) Calculation

[0118] 5) Output a derived verification public key dvk: = (Q r ,Qvk0,Qvk1)∈G1×G2×G2.

[0119] 5. Derived verification public key check algorithm VerifyKeyCheck: The receiver uses its own t≥0th layer identifier ID=(id0,id1,…,id t ), wallet public key wpk ID =(A ID ,B ID )∈G1×G1 and wallet view private key wsvk ID =βID , verify whether dvk is valid. The algorithm steps are as follows:

[0120] 1) Verify the equation

[0121] 2) Verify the equation

[0122] 3) If both equations hold, the VerifyKeyCheck algorithm outputs 1; otherwise, it outputs 0.

[0123] 6. Derived signature private key generation algorithm SignKeyDerive: The receiver uses its own t≥0th layer identifier ID=(id0,id1,…,id t ), wallet key pair wpk ID =(A ID ,B ID )∈G1×G1 and Verify the equation and Is it true? If true, output the derived signature private key. The algorithm steps are as follows:

[0124] 1) Calculate dsk0 = α ID H3(B ID ,Q r ,β ID Q r )∈G1;

[0125] 2) Calculate dsk1 = α ID H4(B ID ,Q r ,β ID Q r )∈G1;

[0126] 3) Output the derived signature private key dsk: = (dsk0, dsk1) = (α ID H3(B ID ,Q r ,β ID Q r ),α ID H4(B ID ,Q r ,β ID Q r ))∈G1×G1.

[0127] VII. Signature Algorithm Sign: Given an aggregate tag w, a message m∈M, and a derived verification public key dvk=(Q r,Qvk0,Qvk1)∈G1×G2×G2 and a derived signature private key dsk=(dsk0,dsk1)∈G1×G1. Here w is a tag used for aggregation. In the aggregation algorithm, only signatures with the same aggregation tag can be aggregated. In practice, the value of the aggregation tag w may be the latest block height or block version when the message is signed. The algorithm steps are as follows:

[0128] 1) Select a uniformly random Calculate X′=xP∈G1;

[0129] 2) Calculation

[0130] 3) Calculation

[0131] 4) Calculation

[0132] 5) Calculate S′=h·dsk0+c·dsk1+xP w ∈G1;

[0133] 6) Output signature σ = (X′, S′) ∈ G1×G1.

[0134] 8. Signature Verification Algorithm Verify: Given an aggregate tag w, a message m, a signature σ = (X′, S′) ∈ G1×G1 and a derived verification public key dvk = (Q r ,Qvk0,Qvk1)∈G1×G2×G2. The algorithm steps are as follows:

[0135] 1) Calculation

[0136] 2) Calculation

[0137] 3) Calculation

[0138] 4) Check the equation Is it true? If true, the Verify algorithm outputs 1; otherwise, it outputs 0.

[0139] 9. Aggregation algorithm: Anyone can aggregate individual signatures using the same aggregation tag w. Given an aggregation tag w and multiple (message, signature, derived verification public key) tuples (m i ,σ i ,dvk i )(i=1,…,n satisfies Verify(w,mi,σi,dvki)→1, where σi=(Xi′,Si′)∈G1×G1. The algorithm steps are as follows:

[0140] 1) Calculate X = (X′1,…,X′ n );

[0141] 2) Calculation

[0142] 3) Output aggregate signature σ agg =(X,S n ).

[0143] 10. Aggregate Verification Algorithm AggVerify: Given an aggregate tag w, multiple (message, derived verification public key) pairs (m i ,dvk i =(Q ri ,Qvk i,0 ,Qvk i,1 ))(i=1,…,n), an aggregate signature σ agg =(X,S n ). The algorithm steps are as follows:

[0144] 1) Calculation

[0145] 2) Calculation

[0146] 3) Calculation

[0147] 4) Calculation

[0148] 5) Calculate and check the equation Is it true? If true, the AggVerify algorithm outputs 1, otherwise it outputs 0.

[0149] It is clear that our approach supports popular use cases such as low-maintenance wallets that are easy to backup and restore, convenient derivation of cold addresses, treasurers allocating digital assets to subordinate departments, and trustless auditing. In our full-featured hierarchical deterministic wallet approach that supports stealth addresses and signature aggregation, the derivation of the wallet viewing private key and the derivation of the wallet spending private key are actually independent, which can support flexible trustless auditing. In particular, the root manager entity of an organization can reveal his wallet viewing private key to the auditor, and then the auditor can generate wallet viewing private keys for each manager entity in the organization, and then view all digital assets / transactions related to any manager entity in the organization. On the other hand, the root manager entity can reveal the wallet viewing private key wsvk of a specific manager entity (such as the identifier ID) to the auditor. ID, so that auditors can only view digital assets / transactions related to the direct and indirect manager entities of the manager entity ID. In terms of stealth addresses, the sender can generate a one-time derived public key without interacting with the receiver, thereby enhancing privacy. In terms of signature aggregation, the present invention can also support aggregating transaction signatures within a block into a single signature, reducing the size of transaction signatures in the block, and effectively reducing the overhead of block transmission, block verification, and block storage.

[0150] Those skilled in the art know that, in addition to implementing the system, device and its various modules provided by the present invention in a purely computer-readable program code, it is entirely possible to implement the same program in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers and embedded microcontrollers by logically programming the method steps. Therefore, the system, device and its various modules provided by the present invention can be considered as a hardware component, and the modules included therein for implementing various programs can also be considered as structures within the hardware component; the modules for implementing various functions can also be considered as both software programs for implementing the method and structures within the hardware component.

[0151] The above describes the specific embodiments of the present invention. It should be understood that the present invention is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essence of the present invention. In the absence of conflict, the embodiments of the present application and the features in the embodiments can be combined with each other arbitrarily.

Claims

1. A fully functional hierarchical deterministic wallet model that supports stealth addresses and signature aggregation, characterized in that: include: A fully functional hierarchical deterministic wallet management layer that supports hierarchical organizations and a transaction functionality layer that supports each manager entity in the organization; The fully functional hierarchical deterministic wallet management layer supporting hierarchical organization, including wallet key generation for the root manager entity, and generation of wallet keys by the upper manager entity for its directly lower manager entity; The transaction function layer of each manager entity in the supporting organization includes the generation and verification of single transaction signatures and the generation and verification of aggregate signatures; In the model, each manager entity has a unique identifier ID = (id0, id1, ..., id t ), t≥0, use the identifier ID=(id0) to represent the hierarchical organization, that is, the organization ID=ID0; let the identifier of the t≥0 layer be ID=(id0, id1, ..., id t ), then there is an ID |t =ID,ID |(t-1) is the identifier of the parent manager entity of ID, and ID |i (i=0, ..., t-1) is the identifier of the ancestor manager entity of ID, and the identifier ID is used to represent the manager entity or its wallet.

2. The fully functional hierarchical deterministic wallet model supporting stealth addresses and signature aggregation according to claim 1, characterized in that: The wallet model implementation process is: Step 1: Generate system parameters PP using the Setup() algorithm; Step 2: The root administrator entity runs the RootWalletKeyGen() algorithm to generate a root (wallet public key, wallet private key) pair (wpk ID , wsk ID ), where the wallet private key is wsk ID =(wssk ID ,wsvk ID ), wssk ID It is the wallet spending private key, wsvk ID It is the wallet that checks the private key; Step 3: The upper-level management entity uses its own wallet key pair (wpk ID , wsk ID ), runs the WalletKeyDelegate() algorithm to generate a wallet key pair for its direct subordinate manager entity; Step 4: When the sender sends digital assets to the receiver whose identifier is ID, the sender uses the receiver's ID and the corresponding wallet public key wpk ID , run the VerifyKeyDerive() algorithm to generate a derived verification public key dvk as the receiving address of the recipient's digital asset; Step 5: The receiver enters his own wsvk ID , ID and wpk ID , and the receiving address dvk, run the VerifyKeyCheck() algorithm, if the algorithm output is 1, it means that dvk belongs to the receiver; otherwise, the opposite; if dvk belongs to the receiver, the receiver enters his own wsk ID , ID and wpk ID , run the SignKeyDerive() algorithm to generate the derived signature private key dsk corresponding to the dvk. The recipient uses dsk to run the Sign() algorithm to generate the signature σ, thereby trading the digital assets on the dvk; Step 6: Anyone inputs dvk and (message, signature) to run the Verify() algorithm on (m, σ) to verify the validity of a single signature; Step 7: For multiple (message, signature, derived verification public key) tuples (m i , σ i , dvk i ), i = 1, ..., n, anyone runs the aggregation algorithm Aggregation() to generate an aggregate signature σ agg ; Step 8: Anyone inputs (message, derived verification public key) to (m i , dvk i ), i = 1, ..., n, and an aggregate signature σ agg , run the aggregation verification algorithm AggVerify() to verify the validity of the aggregation signature.

3. The fully functional hierarchical deterministic wallet model supporting stealth addresses and signature aggregation according to claim 2 is characterized in that: The step 1 comprises: Choose a security parameter λ; Choose the group of bilinear maps Where p is a prime number of length λ bits, G1 is a p-order additive cyclic group, G2 is a p-order multiplicative cyclic group, P is the generator of G1; (G1, G2) is a bilinear mapping group, there exists a bilinear mapping Choose from eight hash functions: in, Message space M: = {0, 1}*, identifier space Output system parameters:

4. The fully functional hierarchical deterministic wallet model supporting stealth addresses and signature aggregation according to claim 3 is characterized in that: The step 2 comprises: The root administrator entity inputs the root entity 0 layer identifier ID = (id0) and runs the RootWalletKeyGen algorithm to generate the root wallet key pair. The process is as follows: Choose two uniformly random α ID , Calculate A ID =α ID P, B ID =β ID P; Output the root wallet key pair of the root administrator entity: wpk ID :=(A ID , B ID )=(α ID P, β ID P)∈G1×G1, 5. The fully functional hierarchical deterministic wallet model supporting stealth addresses and signature aggregation according to claim 4 is characterized in that: The step 3 comprises: The upper management entity uses its own wallet public key wpk ID|(t-1) ∈G1×G1 and wallet private key Run the WalletKeyDelegate algorithm to generate a wallet key pair for the manager entity directly below it. The process is as follows: Calculate the result of hash function H0 calculate calculate Output the wallet key pair of the direct lower-level manager entity ID: wpk ID :=(A ID , B ID )=(α ID P, β ID P)∈G1×G1, 6. The fully functional hierarchical deterministic wallet model supporting stealth addresses and signature aggregation according to claim 5, characterized in that: The step 4 comprises: The sender uses the receiver's t≥0th layer identifier ID=(id0,id1,...,id t ) and wallet public key wpk ID =(A ID , B ID ) generates a derived verification public key, the process is as follows: Choose a uniform random parameter Calculate Q r =rP∈G1; calculate calculate Output a derived verification public key dvk: = (Q r , Qvk0, Qvk1)∈G1×G2×G2.

7. The fully functional hierarchical deterministic wallet model supporting stealth addresses and signature aggregation according to claim 6, characterized in that: The step 5 comprises: The receiver uses its own layer t≥0 identifier ID=(id0,id1,...,id t ), wallet public key wpk ID =(A ID , B ID )∈G1×G1 and wallet view private key wsvk ID =β ID , verify whether dvk is valid, the process is as follows: Verify the equation Verify the equation If both equations hold, the VerifyKeyCheck algorithm outputs 1; otherwise, it outputs 0. The receiver uses its own layer t≥0 identifier ID=(id0,id1,...,id t ), wallet key pair wpk ID =(A ID , B ID )∈G1×G1 and Verify the equation and Is it true? If so, output the derived signature private key. The process is as follows: Calculate dsk0 = α ID H3(B ID , Q r , β ID Q r )∈G1; Calculate dsk1 = α ID H4(B ID , Q r , β ID Q r )∈G1; Output derived signature private key dsk: = (dsk0, dsk1) = (α ID H3(B ID , Q r , β ID Q r ), α ID H4(B ID , Q r , β ID Q r ))∈G1×G1; Given an aggregate tag w, a message m∈M, and a derived verification public key dvk=(Q r , Qvk0, Qvk1)∈G1×G2×G2 and a derived signature private key dsk=(dsk0,dsk1)∈G1×G1, thereby generating a signature. The process is as follows: Choose a uniform random parameter Calculate X′=xP∈G1; calculate calculate calculate Calculate S′=h·dsk0+c·dsk1+xP w ∈G1; Output signature σ = (X′, S′)∈G1×G1.

8. The fully functional hierarchical deterministic wallet model supporting stealth addresses and signature aggregation according to claim 7, characterized in that: The step 6 comprises: Given an aggregate tag w, a message m, a signature σ = (X′, S′) ∈ G1×G1 and a derived verification public key dvk = (Q r , Qvk0, Qvk1)∈G1×G2×G2, verify the validity of a single signature, the process is as follows: calculate calculate calculate Check the equation Is it true? If so, the Verify algorithm outputs 1; otherwise, it outputs 0.

9. The fully functional hierarchical deterministic wallet model supporting stealth addresses and signature aggregation according to claim 8, characterized in that: The step 7 comprises: Given an aggregate tag w and multiple (message, signature, derived verification public key) tuples (m i , σ i , dvk i ), i = 1, ..., n, satisfying Verify(w, m i , σ i , dvk i )→1, where σ i =(X′ i , S′ i )∈G1×G1, thereby generating an aggregate signature, the process is as follows: Calculate X = (X'1, ..., X' n ); calculate Output aggregate signature σ agg =(X, S n ).

10. The fully functional hierarchical deterministic wallet model supporting stealth addresses and signature aggregation according to claim 9, characterized in that: The step 8 comprises: Given an aggregate tag w, multiple (message, derived verification public key) pairs (m i , dvk i =(Q ri , Qvk i，0 , Qvk i，1 )), i=1,...,n, an aggregate signature σ agg =(X, S n ), thereby verifying the validity of the aggregate signature. The process is as follows: calculate calculate calculate calculate Calculation check equation Is it true? If so, the AggVerify algorithm outputs 1, otherwise it outputs 0.

Images