Full-featured hierarchical deterministic wallet model supporting stealth addresses and signature aggregation

Abstract

The application provides a full-function hierarchical deterministic wallet model supporting stealth address and signature aggregation, comprising: a full-function hierarchical deterministic wallet management layer supporting hierarchical organization and a transaction function layer supporting each manager entity in the organization; the full-function hierarchical deterministic wallet management layer supporting hierarchical organization comprises wallet key generation of a root manager entity and wallet key generation of an upper manager entity for a directly lower manager entity; the transaction function layer supporting each manager entity in the organization comprises single transaction signature generation and verification and aggregated signature generation and verification. The application adds stealth address function to the hierarchical deterministic wallet, makes a sender obtain a receiving address of a digital asset very conveniently through a non-interactive key derivation mechanism, strengthens the main public key characteristics of the hierarchical deterministic wallet, and better realizes user convenience and user privacy.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of blockchain, in particular, to a full-featured hierarchical deterministic wallet model supporting stealth address and signature aggregation. BACKGROUND

[0002] In the blockchain application, the generation, management (such as backup and recovery, etc.), and use of the user's key can be implemented through a cryptographic wallet. The hierarchical deterministic wallet (HDW) becomes one of the most widely used cryptographic wallets due to its deterministic generation characteristics, master public key derivation characteristics, and hierarchical management characteristics. The deterministic generation characteristic means that all keys in the wallet are directly or indirectly determined by the "seed" and thus the wallet owner can recover all keys from the seed when necessary (for example, when the device used for the hosted wallet is damaged). The master public key characteristic means that the wallet owner can directly calculate multiple derived public keys from the master public key as the receiving address of the digital asset, and no private key is needed in this process. The hierarchical management characteristic means that the derived public key can be used as the master public key of the next level for further derivation. The deterministic generation characteristic makes the backup and recovery of the wallet easy, the master public key derivation characteristic allows the user to easily generate a one-time address (without worrying about the exposure of the private key in a dangerous networked environment) to increase security and privacy, and the hierarchical management characteristic allows it to be widely used in large enterprises or institutions such as hierarchical management organizations, for example, the treasurer allocates digital assets to subordinate departments: the treasurer has the master key pair of the company, can create derived key pairs for each department, and each department only has the key pair of its part of the digital asset, which can be managed and traded within the department. In addition, these characteristics are even used to support and implement some newly expanded application scenarios, such as trustless audit: the wallet owner gives the master public key to the auditor, and the auditor can scan the blockchain to audit the relevant transactions of the wallet owner, without the wallet owner worrying that the auditor will obtain the relevant private key to dispose of his digital assets. However, when using the HDW algorithm, the user needs to keep the master public key and all derived private keys secret and secure in addition to keeping the master private key secret and secure. This is because the HDW algorithm in BIP32 has a fatal security problem (also known as privilege escalation attack), that is, when an attacker obtains the master public key and any derived private key, the master private key can be recovered. This attack is disastrous for the use case of the treasurer allocating digital assets to subordinate departments. Because once the department manager (who has the derived private key) obtains the master public key in some way, he can steal all the digital assets of the company. In addition, the treasurer allocating digital assets to subordinate departments and trustless audit cannot be implemented at the same time, because the auditor may collude with a department manager (who has a derived private key) to leak the master public key and then steal all the digital assets of the company.

[0003] Stealth address is a widely used privacy protection technology in the field of blockchain at present, through a non-interactive key derivation method, the sender of a transaction can generate a one-time, brand-new derived public key as a receiving address of a digital asset without interacting with the receiver, so that the user can very friendly and conveniently realize the one-time address function, thereby enhancing the privacy.

[0004] In a blockchain system, full nodes in the system must store growing blockchain data (including but not limited to signature, business data, etc.). At present, the size of the blockchain data in most blockchain systems exceeds hundreds of GB, and some even exceed several TB. The signature usually occupies a large part of the block size. Aggregated signature is an important tool in the field of cryptography to effectively reduce storage, communication and calculation overhead. Aggregated signature allows n different signatures on n different messages to be aggregated into one signature. Aggregated signature can be applied to blockchain to reduce the size of signature in block. In addition to effectively reducing transaction storage overhead and transmission overhead, it can also improve the speed of block verification.

[0005] At present, many methods about HDW have been proposed in the academic field, but there is no full-featured HDW and HDW model and method supporting stealth address and signature aggregation function. SUMMARY

[0006] In view of the defects in the prior art, the purpose of the present application is to provide a full-featured hierarchical deterministic wallet model supporting stealth address and signature aggregation.

[0007] The full-featured hierarchical deterministic wallet model supporting stealth address and signature aggregation provided by the present application comprises: a full-featured hierarchical deterministic wallet management layer supporting hierarchical organization and a transaction function layer supporting each manager entity in the organization.

[0008] The full-featured hierarchical deterministic wallet management layer supporting hierarchical organization comprises wallet key generation of a root manager entity and wallet key generation of an upper manager entity for its directly lower manager entity.

[0009] The transaction function layer supporting each manager entity in the organization comprises generation and verification of a single transaction signature and generation and verification of an aggregated signature.

[0010] In the model, each manager entity has a unique identifier ID=(id0, id1,..., id t ), t>=0, and the identifier ID=(id0) is used to represent hierarchical organization, i.e. organization ID=ID0; let the identifier of the t>=0 layer be ID=(id0, id1,..., id t ), then ID |t= ID, ID |(t-1) is the identifier of the parent manager entity of ID, and ID |i (i = 0, …, t-1) are the identifiers of the ancestor manager entities of ID, using the identifier ID to represent the manager entity or its wallet.

[0011] Preferably, the wallet model implementation process is:

[0012] Step 1: generate system parameters PP using the Setup() algorithm;

[0013] Step 2: the root manager entity runs the RootWalletKeyGen() algorithm to generate a root (wallet public key, wallet private key) pair (wpk ID , wsk ID ) for the organization identifier ID = (id0), wherein the wallet private key wsk ID = (wssk ID , wsvk ID ), wssk ID is a wallet spending private key, and wsvk ID is a wallet viewing private key;

[0014] Step 3: the upper manager entity runs the WalletKeyDelegate() algorithm using its own wallet key pair (wpk ID , wsk ID ) to generate a wallet key pair for its directly lower manager entity;

[0015] Step 4: when a sender sends a digital asset to a recipient with identifier ID, the sender runs the VerifyKeyDerive() algorithm using the recipient's ID and corresponding wallet public key wpk ID to generate a derived verification public key dvk as the receiving address of the digital asset of the recipient;

[0016] Step 5: the recipient inputs its own wsvk ID , ID and wpk ID , and the receiving address dvk, and runs the VerifyKeyCheck() algorithm. If the algorithm output is 1, it indicates that dvk belongs to the recipient; otherwise, it does not. If dvk belongs to the recipient, the recipient inputs its own wsk ID , ID and wpk ID , and runs the SignKeyDerive() algorithm to generate a derived signature private key dsk corresponding to the dvk, and the recipient uses dsk to run the Sign() algorithm to produce a signature σ, thereby transferring the digital asset on the dvk;

[0017] Step 6: Anyone inputs dvk and runs the Verify() algorithm on the pair (m, σ) to verify the validity of the single signature;

[0018] Step 7: Anyone runs the aggregation algorithm Aggregation() on the multiple pairs of (message, signature, derived verification public key) (m i ,σ i ,dvk i ), i = 1,..., n on the blockchain network to produce an aggregated signature σ agg ;

[0019] Step 8: Anyone inputs the pair (message, derived verification public key) (m i ,dvk i ), i = 1,..., n and an aggregated signature σ agg , runs the aggregated verification algorithm AggVerify() to verify the validity of the aggregated signature.

[0020] Preferably, the step 1 comprises:

[0021] Select a security parameter λ;

[0022] Select a bilinear mapping group where p is a prime of λ-bit length, G1 is a p-order additive cyclic group, G2 is a p-order multiplicative cyclic group, P is a generator of G1; (G1, G2) is a bilinear mapping group, there is a bilinear mapping

[0023] Select eight hash functions:

[0024] where, Message space M: = {0, 1} * , identifier space

[0025] Output system parameters:

[0026] Preferably, the step 2 comprises:

[0027] The root manager entity inputs the root entity 0 layer identifier ID = (id0) and runs the RootWalletKeyGen algorithm to generate the root wallet key pair, the process is as follows:

[0028] Select two uniformly random

[0029] Calculate A ID = αID P, B ID = β ID P;

[0030] Output the root wallet key pair of the root manager entity: wpk ID = (A ID , B ID ) = (α ID P, β ID P) ∈ G1xG1,

[0031] Preferably, the step 3 comprises:

[0032] The upper manager entity uses its own wallet public key wpk ID|(t-1) ∈ G1xG1and wallet private key wsk ID|(t-1) = (αID|(t-1), βID|(t-1)) ∈ Zp* x Zp* to run the WalletKeyDelegate algorithm to generate a wallet key pair for its immediate lower manager entity, with the process as follows:

[0033] Compute the result of the hash function H0

[0034] Compute

[0035] Compute

[0036] Output the wallet key pair of the immediate lower manager entity ID: wpk ID = (A ID , B ID ) = (α ID P, β ID P) ∈ G1xG1,

[0037] Preferably, the step 4 comprises:

[0038] The sender generates a derived verification public key according to the receiver's t ≥ 0 layer identifier ID = (id0, id1, …, id t ) and wallet public key wpk ID = (A ID , B ID ) with the process as follows:

[0039] Select a uniform random parameter

[0040] Compute Q r = rP ∈ G1;

[0041] Compute

[0042] Compute

[0043] Output a derived verification public key dvk := (Q r ,Qvk0,Qvk1)∈G1×G2×G2.

[0044] Preferably, the step 5 comprises:

[0045] The receiver uses its own t ≥ 0 level identifier ID = (id0, id1, …, id t ), a wallet public key wpk ID = (A ID ,B ID )∈G1×G1 and a wallet view private key wsvk ID = β ID , to verify whether the derived verification public key dvk is valid, as follows:

[0046] Verify the equality

[0047] Verify the equality

[0048] If both equalities hold, the VerifyKeyCheck algorithm outputs 1; otherwise, it outputs 0.

[0049] The receiver uses its own t ≥ 0 level identifier ID = (id0, id1, …, id t ), a wallet key pair wpk ID = (A ID ,B ID )∈G Q ×G1 and verifies whether the equalities and hold; if so, it outputs a derived signature private key; the process is as follows:

[0050] Compute dsk0 = α ID H3(B ID ,Q r ,β ID Q r )∈G1;

[0051] Compute dsk1 = α ID H4(B ID ,Q r ,β ID Q r )∈G1;

[0052] Output the derived signature private key dsk := (dsk0, dsk1) = (α ID H3(B ID ,Qr ,β ID Q r ),α ID H4(B ID ,Q r ,β ID Q r ))∈G1xG1;

[0053] Given an aggregate tag w, a message m e M, a derived verification public key dvk = (Q r , Qvk0, Qvk1) e G1xG2xG2 and a derived signature private key dsk = (dsk0, dsk1) e G1xG1, the process to produce a signature is as follows:

[0054] Choose a uniformly random parameter Compute X' = xP e G1;

[0055] Compute

[0056] Compute

[0057] Compute

[0058] Compute S' = h - dsk0 + c - dsk1 + xP w e G1;

[0059] Output the signature σ = (X', S') e G1xG1.

[0060] Preferably, said step 6 comprises:

[0061] Given an aggregate tag w, a message m, a signature σ = (X', S') e G1xG1 and a derived verification public key dvk = (Q r , Qvk0, Qvk1) e G1xG2xG2, the process to verify the validity of a single signature is as follows:

[0062] Compute

[0063] Compute

[0064] Compute

[0065] Check if the equation holds, and if so, the Verify algorithm outputs 1; otherwise, it outputs 0.

[0066] Preferably, said step 7 comprises:

[0067] Given an aggregation label w and a plurality of (message, signature, derived verification public key) tuples (m i ,σ i ,dvk i ), i = 1,..., n, satisfying Verify(w, m i ,σ i ,dvk i ) → 1, where σ i = (X' i , S' i ) ∈ G1 x G1, an aggregated signature is generated, the process being as follows:

[0068] Compute X = (X'1,..., X' n );

[0069] Compute

[0070] Output aggregated signature σ agg = (X, S n ).

[0071] Preferably, said step 8 comprises:

[0072] Given an aggregation label w, a plurality of (message, derived verification public key) pairs (m i ,dvk i = (Q ri , Qvk i,0 , Qvk i,1 )), i = 1,..., n, and an aggregated signature σ agg = (X, S n ), the process for verifying the validity of the aggregated signature is as follows:

[0073] Compute

[0074] Compute

[0075] Compute

[0076] Compute

[0077] Compute whether the check equation holds, and if so, the AggVerify algorithm outputs 1, otherwise 0.

[0078] Compared with the prior art, the present application has the following beneficial effects:

[0079] (1) The full-function hierarchical deterministic wallet method supporting stealth address and signature aggregation of the present application not only supports all functions of HDW, but also supports stealth address and signature aggregation functions, and there is no privilege escalation attack problem;

[0080] (2) The model of the present application is composed of a management layer and a transaction layer, and gives the use instructions of each algorithm in each layer and the benefits brought by the algorithm, which provides clear guidance and examples for users (especially enterprise users) to apply the model;

[0081] (3) The present application adds stealth address function to HDW, and through a non-interactive key derivation mechanism, the sender can easily obtain the receiving address of the digital asset, which strengthens the master public key feature of HDW, and better realizes the user convenience and user privacy;

[0082] (4) The present application adds signature aggregation function to HDW, which effectively reduces the communication, calculation and storage costs of the blockchain service operator. BRIEF DESCRIPTION OF DRAWINGS

[0083] Other features, objects and advantages of the present application will become more apparent from the following detailed description of non-limiting embodiments with reference to the following drawings:

[0084] Figure 1 The wallet model structure diagram is shown in DETAILED DESCRIPTION

[0085] The present application will be described in detail below with reference to specific embodiments. The following embodiments will help those skilled in the art to further understand the present application, but do not limit the present application in any form. It should be pointed out that, for those skilled in the art, without departing from the concept of the present application, a number of changes and improvements can be made. These all belong to the protection scope of the present application.

[0086] EMBODIMENT

[0087] The present application gives a full-function hierarchical deterministic wallet model supporting stealth address and signature aggregation, and the model structure is shown in Figure 1 The model has two layers: one is a full-function hierarchical deterministic wallet management layer supporting hierarchical organization, including wallet key generation of root manager entity, and wallet key generation for direct lower manager entity by upper manager entity (i.e., the root manager entity or the lower manager entity generates the key for its direct lower manager entity); the other is a transaction function layer supporting each manager entity in the organization, including generation and verification of single transaction signature, and generation and verification of aggregated signature. In the model, each manager entity has a unique identifier ID=(id0, id1,…, id t), t ≥ 0, to denote a hierarchical organization, i.e. the organization ID = ID0. Assume the t ≥ 0-th level identifier is ID = (id0, id1,..., idt-1, idt), then there is ID t = ID, ID |t = ID, ID |(t-1) is the identifier of the parent manager entity (i.e. the direct upper level) of ID, and ID |i (i = 0,..., t-1) are the identifiers of the ancestral manager entities of ID. An identifier ID is used to denote a manager entity or its wallet. A full-featured hierarchical deterministic wallet method supporting stealth addresses and signature aggregation consists of ten polynomial-time algorithms (Setup, RootWalletKeyGen, WalletKeyDelegate, VerifyKeyDerive, VerifyKeyCheck, SignKeyDerive, Sign, Verify, Aggregation, AggVerify) which run as follows:

[0088] (1) The Setup() algorithm is run to generate system parameters PP.

[0089] (2) The root manager entity runs the RootWalletKeyGen() algorithm to generate a root (wallet public key, wallet private key) pair (wpk ID , wsk iD ) for the organization with identifier ID = (id0), where the wallet private key wsk ID = (wssk ID , wsvk ID ), wssk ID is the wallet spend private key, and wsvk ID is the wallet view private key.

[0090] (3) An upper level manager entity runs the WalletKeyDelegate() algorithm using its own wallet key pair (wpk ID , wsk ID ) to generate a wallet key pair for its direct lower level manager entity.

[0091] (4) When a sender sends a digital asset to a recipient with identifier ID, the sender runs the VerifyKeyDerive() algorithm using the recipient's ID and the corresponding wallet public key wpk ID to generate a derived verification public key dvk as the recipient's digital asset receiving address.

[0092] (5) The recipient inputs his own wsvk ID (and ID and wpk ID) and receiving address dvk, running VerifyKeyCheck() algorithm, if the algorithm output is 1, it indicates that dvk belongs to the receiving party; otherwise, it is the opposite. If dvk belongs to the receiving party, the receiving party inputs its own wsk ID ( and ID and wpk ID ), running SignKeyDerive() algorithm, generating the derived signature private key dsk corresponding to the dvk. The receiving party uses dsk to run Sign() algorithm to produce a signature σ, so that the transaction flows on the digital assets on the dvk.

[0093] (6) Anyone can input dvk and (message, signature) pair (m, σ) to run Verify() algorithm to verify the validity of a single signature.

[0094] (7) For multiple (message, signature, derived verification public key) tuples (m i ,σ i ,dvk i ), i = 1, …, n, anyone can run the aggregation algorithm Aggregation() to produce an aggregated signature σ agg .

[0095] (8) Anyone can input (message, derived verification public key) pair (m i ,dvk i ), i = 1, …, n, and an aggregated signature σ agg , run the aggregated verification algorithm AggVerify() to verify the validity of the aggregated signature.

[0096] Based on the above system model, it is not difficult to see that the full-featured hierarchical deterministic wallet method supporting stealth address and signature aggregation not only realizes the deterministic generation characteristics, master public key derivation characteristics and hierarchical management characteristics of HDW, but also provides the functions of stealth address and signature aggregation. In terms of security, this method realizes complete resistance to privilege escalation attacks. Specifically, the leakage of a derived signature private key will not affect the security of any other derived signature private key or wallet private key, and the leakage of a wallet private key will not affect the security of any other derived signature private key and wallet private key, except for the security of the wallet and its direct / indirect lower-level managers. At the same time, under the function of signature aggregation, the user's digital assets are also secure. In terms of user privacy, for the target wallet owner with identifier ID, as long as its wallet private key and its ancestor's wallet private key are secure, given the target derived verification public key dvk, no one (except the creator of dvk) can judge whether dvk belongs to the ID.

[0097] The application also discloses a specific full-function hierarchical deterministic wallet method supporting invisible address and signature aggregation, which comprises ten algorithms, and the algorithms are as follows.

[0098] I. Initialization algorithm Setup: generating system parameters. The algorithm steps are as follows:

[0099] 1) Select a security parameter λ.

[0100] 2) Select a bilinear mapping group where p is a prime number with a length of λ bits, G1 is a p-order additive cyclic group, G2 is a p-order multiplicative cyclic group, and P is a generator of G1. (G1, G2) is a bilinear mapping group, and there is a bilinear mapping

[0101] 3) Select eight hash functions: where Message space M:={0,1} * , identifier space

[0102] 4) Output system parameters:

[0103] The parameter PP is implicitly input into all the following algorithms.

[0104] II. Root wallet key generation algorithm RootWalletKeyGen: the root manager entity inputs a root entity (0th layer) identifier ID=(id0), and runs the RootWalletKeyGen algorithm to generate a root wallet key pair. The algorithm steps are as follows:

[0105] 1) Select two uniform random

[0106] 2) Calculate A ID =α ID P, B ID =β ID P;

[0107] 3) Output the root wallet key pair of the root manager entity: wpk ID :=(A ID ,B ID )=(α ID P,β ID P)∈G1×G1,

[0108] III. Key proxy algorithm WalletKeyDelegate: the upper manager entity uses the wallet public key wpk ID|(t-1) ∈G1×G1 and the wallet private key Run the WalletKeyDelegate algorithm to assign the identifier ID = (id0, id1, ..., id1) to its direct lower-level manager entity (i.e., the identifier ID = (id0, id1, ..., id2)). t Generate wallet key pairs for (t≥1) and (t≥1). The algorithm steps are as follows:

[0109] 1) Calculation

[0110] 2) Calculation

[0111] 3) Calculation

[0112] 4) Output the wallet key pair of the direct lower-level manager entity ID: wpk ID :=(A ID B ID )=(α ID P,β ID P)∈G1×G1,

[0113] IV. Derivative Verification Public Key Generation Algorithm VerifyKeyDerive: The sender generates the public key based on the receiver's level t≥0 identifier ID = (id0, id1, ..., id...). t ) and wallet public key wpk ID =(A ID B ID Generate a derived verification public key. The algorithm steps are as follows:

[0114] 1) Select a uniformly random...

[0115] 2) Calculate Q r =rP∈G1;

[0116] 3) Calculation

[0117] 4) Calculation

[0118] 5) Output a derived verification public key dvk := (Q r ,Qvk0,Qvk1)∈G1×G2×G2.

[0119] V. Derivative Verification Public Key Check Algorithm: The recipient uses its own level t≥0 identifier ID = (id0, id1, ..., id...) t ), wallet public key wpk ID =(A ID B ID )∈G1×G1 and view the private key wsvk in the wallet ID =βID , verifying that the dvk is valid. The algorithm steps are as follows:

[0120] 1) Verify the equality

[0121] 2) Verify the equality

[0122] 3) If both equalities hold, the VerifyKeyCheck algorithm outputs 1; otherwise, it outputs 0.

[0123] Six, the derived signature private key generation algorithm SignKeyDerive: the receiver uses its own t-th level identifier ID = (id0, id1,..., id t ), the wallet key pair wpk ID = (A ID , B ID ) e G1 x G1 and Verify if the equalities and hold. If so, output the derived signature private key. The algorithm steps are as follows:

[0124] 1) Compute dsk0 = a ID H3(B ID , Q r , b ID Q r ) e G1;

[0125] 2) Compute dsk1 = a ID H4(B ID , Q r , b ID Q r ) e G1;

[0126] 3) Output the derived signature private key dsk := (dsk0, dsk1) = (a ID H3(B ID , Q r , b ID Q r ), a ID H4(B ID , Q r , b ID Q r )) e G1 x G1.

[0127] Seven, the signature algorithm Sign: given an aggregated label w, a message m e M, a derived verification public key dvk = (Q r, and a derived signature private key dsk = (dsk0, dsk1) G1xG1. Here w is a label for aggregation, in the aggregation algorithm, only signatures with the same aggregation label can be aggregated. In practice, the value of aggregation label w can be the latest block height or block version when the message is signed. The algorithm steps are as follows:

[0128] 1) Select a uniformly random Calculate X' = xP G1;

[0129] 2) Calculate

[0130] 3) Calculate

[0131] 4) Calculate

[0132] 5) Calculate S' = h dsk0 + c dsk1 + xP G1; w

[0133] 6) Output the signature σ = (X', S') G1xG1.

[0134] Eight, signature verification algorithm Verify: Given an aggregation label w, a message m, a signature σ = (X', S') G1xG1 and a derived verification public key dvk = (Q r , Qvk0, Qvk1) G1xG2xG2. The algorithm steps are as follows:

[0135] 1) Calculate

[0136] 2) Calculate

[0137] 3) Calculate

[0138] 4) Check if the equation is true. If true, the Verify algorithm outputs 1; otherwise, output 0.

[0139] Nine, aggregation algorithm Aggregation: Anyone can aggregate individual signatures using the same aggregation label w. Given an aggregation label w and multiple (message, signature, derived verification public key) tuples (m i , σ i , dvk i )(i = 1, …, n satisfy Verify(w, mi, σi, dvki) → 1, where σi = (Xi', Si') G1xG1. The algorithm steps are as follows:

[0140] ​1) Compute X = (X'1,...,X'n) = (X1,...,Xn)T. n );

[0141] 2) Compute

[0142] 3) Output aggregated signature σ agg = (X, S n ).

[0143] Ten, Aggregated Verification Algorithm AggVerify: Given an aggregated label w, multiple (message, derived verification public key) pairs (m i , dvk i = (Q ri , Qvk i,0 , Qvk i,1 ) (i = 1,...,n), and an aggregated signature σ agg = (X, S n ). The algorithm steps are as follows:

[0144] 1) Compute

[0145] 2) Compute

[0146] 3) Compute

[0147] 4) Compute

[0148] 5) Check if the equality holds. If it does, the AggVerify algorithm outputs 1, otherwise it outputs 0.

[0149] It is clear that our method supports popular use cases such as low-maintenance wallets with easy backup and recovery, cold address convenient derivation, treasurer assigning digital assets to sub-departments, and trustless auditing. In our full-featured hierarchical deterministic wallet method that supports stealth addresses and signature aggregation, the derivation of wallet view private keys and the derivation of wallet spending private keys are actually independent, which can support flexible trustless auditing. In particular, a root manager entity of an organization can reveal his wallet view private key to an auditor, and then the auditor can generate wallet view private keys for each manager entity in the organization, and then view all digital assets / transactions related to any manager entity in the organization. On the other hand, the root manager entity can reveal the wallet view private key wsvk IDIn this way, the auditor can only view the digital assets / transactions related to the direct and indirect manager entities of the manager entity ID. In terms of stealth addresses, the sender can generate a one-time derived public key without interacting with the recipient, thereby enhancing privacy. In terms of signature aggregation, the application can also support aggregating transaction signatures within a block into a single signature, reducing the size of transaction signatures in the block, and effectively reducing the overhead of block transmission, block verification, and block storage.

[0150] Those skilled in the art know that, in addition to implementing the system, device and each module thereof provided by the present application in the form of pure computer readable program code, the same program can also be implemented in the form of logic gates, switches, application specific integrated circuits, programmable logic controllers and embedded microcontrollers by logically programming the method steps. Therefore, the system, device and each module thereof provided by the present application can be considered as a hardware component, and the modules included therein for implementing various programs can also be considered as structures within the hardware component; the modules for implementing various functions can also be considered as both software programs for implementing methods and structures within the hardware component.

[0151] The specific embodiments of the present application are described above. It needs to be understood that the present application is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essential content of the present application. The embodiments of the present application and the features in the embodiments can be arbitrarily combined with each other without conflict.

Claims

1. A full-featured hierarchical deterministic wallet model supporting stealth address and signature aggregation, characterized in that, include: Supports a fully functional hierarchical deterministic wallet management layer for hierarchical organizations and a transaction functionality layer supporting each manager entity within the organization; The fully functional hierarchical deterministic wallet management layer that supports hierarchical organization includes the generation of wallet keys by the root manager entity and the generation of wallet keys by the upper-level manager entity for its directly subordinate manager entities. The transaction functionality layer that supports each manager entity in the organization includes the generation and verification of individual transaction signatures, as well as the generation and verification of aggregate signatures. In the model, each manager entity has a unique identifier. , Using identifiers To represent hierarchical organization, i.e., organization Let the first Layer identifier is Then there is , yes The identifier of the parent manager entity, and yes The identifier of the ancestor manager entity, using the identifier To represent the managing entity or its wallet; The wallet model implementation process is as follows: Step 1: Use the Setup() algorithm to generate system parameters ; Step 2: The root manager entity runs the RootWalletKeyGen() algorithm to generate the organization identifier. The root (wallet public key, wallet private key) pair Among them, the wallet private key , It is the wallet spending private key. It allows you to view your private key in your wallet. Step 3: The upper-level management entity uses its own wallet key pair Run the WalletKeyDelegate() algorithm to generate wallet key pairs for its direct subordinate manager entity; Step 4: When the sender provides the identifier as When a recipient sends digital assets, the sender uses the recipient's... and the corresponding wallet public key Run the VerifyKeyDerive() algorithm to generate a derived verification public key. The receiving address of the digital assets as the recipient; Step 5: The recipient enters their own... , and receiving address Run the VerifyKeyCheck() algorithm. If the algorithm outputs 1, it indicates... Belongs to the recipient; otherwise, the opposite; if If the user is the recipient, then the recipient should input their own information. , Run the SignKeyDerive() algorithm to generate the... Corresponding derived signature private key The recipient uses Run the Sign() algorithm to generate a signature. Thus, the transaction flows within Digital assets on the platform; Step 6: Anyone can enter and (message, signature) pair Run the Verify() algorithm to verify the validity of a single signature; Step 7: For multiple tuples (message, signature, derived verification public key) on the blockchain network , Anyone can run the aggregation algorithm Aggregation() to generate an aggregate signature. ; Step 8: Anyone can input (message, derived verification public key) to... , and an aggregate signature Run the AggVerify() algorithm to verify the validity of the aggregate signature.

2. The full-featured layered deterministic wallet model supporting stealth address and signature aggregation as described in claim 1, characterized in that, Step 1 includes: Select a security parameter ; Choose the bilinear mapping group ,in yes Prime numbers of bit length for Additive cyclic group for Factorial cyclic group for Generators; It is a group of bilinear mappings, and there exists a bilinear mapping. ; Choose eight hash functions: , , , , , , , ,in, , Message Space identifier space ; Output system parameters: .

3. The full-featured layered deterministic wallet model supporting stealth address and signature aggregation as described in claim 2, characterized in that, Step 2 includes: Root manager entity input: Root entity level 0 identifier The root wallet key pair is generated by running the RootWalletKeyGen algorithm, as follows: Choose two uniformly randomized... , ; calculate , ; Output the root wallet key pair of the root manager entity: , .

4. The full-featured layered deterministic wallet model supporting stealth address and signature aggregation as described in claim 3, characterized in that, Step 3 includes: The upper-level management entity uses its own wallet public key and wallet private key The WalletKeyDelegate algorithm is run to generate wallet key pairs for its direct subordinate management entity. The process is as follows: Calculate the hash function The result ; calculate ; calculate ; Output the direct subordinate manager entity Wallet key pair: ， 。 5. The full-featured layered deterministic wallet model supporting stealth address and signature aggregation according to claim 4, characterized in that, Step 4 includes: The sender, based on the receiver's... Layer identifier and wallet public key The process of generating a derived verification public key is as follows: Choose a uniform random parameter ; calculate ; calculate ; calculate ; Output a derived verification public key .

6. The full-featured layered deterministic wallet model supporting stealth address and signature aggregation as described in claim 5, characterized in that, Step 5 includes: The recipient uses its own first Layer identifier Wallet public key View private keys with wallet ,verify Whether it is effective or not, the process is as follows: Verify the equation ; Verify the equation ; If both equations are true, the VerifyKeyCheck algorithm outputs 1; otherwise, it outputs 0. The recipient uses its own first Layer identifier Wallet key pair and Verify the equation and Check if the condition is met; if so, output the derived signature private key; the process is as follows: calculate ; calculate ; Output derived signature private key ; Given an aggregation label A message A derived verification public key and a derived signature private key This generates a signature, as follows: Choose a uniform random parameter ,calculate ; calculate ; calculate ; calculate ; calculate ; Output signature .

7. The full-featured layered deterministic wallet model supporting stealth address and signature aggregation according to claim 6, characterized in that, Step 6 includes: Given an aggregation label A message A signature and a derived verification public key The process for verifying the validity of a single signature is as follows: calculate ; calculate ; calculate ; Check the equation If true, the Verify algorithm outputs 1; otherwise, it outputs 0.

8. The full-featured layered deterministic wallet model supporting stealth address and signature aggregation according to claim 7, characterized in that, Step 7 includes: Given an aggregation label and multiple tuples (message, signature, derived verification public key) , Verify ,in This generates an aggregate signature, as follows: calculate ; calculate = ; Output aggregate signature .

9. The full-featured layered deterministic wallet model supporting stealth address and signature aggregation according to claim 8, characterized in that, Step 8 includes: Given an aggregation label Multiple (message, derived verification public key) pairs , An aggregate signature This verifies the validity of the aggregate signature, and the process is as follows: calculate ; calculate ; calculate , ; calculate , ; Calculate and check the equation If true, the AggVerify algorithm outputs 1; otherwise, it outputs 0.

Images