Transaction signature method and device, computer readable medium and electronic equipment

Abstract

The invention discloses a transaction signature method and device, a computer readable medium and electronic equipment, and the method comprises the steps: carrying out the elliptic curve point product calculation of a randomly generated signature confusion fragment with a preset length according to an elliptic curve public parameter, and summarizing, and obtaining a confusion voucher; generating a left signature of the transaction information according to the confusion voucher, the transaction information and the elliptic curve public parameters; based on each fragment parameter and the corresponding confusion factor, generating a fragment left parameter and a temporary factor corresponding to each fragment parameter; obtaining a randomly generated confusion parameter group; generating a right signature of the transaction information according to the temporary factor corresponding to each fragment parameter, the confusion parameter group and the left signature; and combining the left signature and the right signature to obtain signature data of the transaction information. According to the technical scheme, complex zero-knowledge proof parameter calculation does not need to be introduced, so that the data volume needing to be transmitted by the transaction participant is reduced, the calculation complexity of the transaction signature is also reduced, and the signature efficiency is improved.

Description

Technical Field

[0001] The present application belongs to the field of data encryption technology, and specifically relates to a transaction signature method, device, computer-readable medium and electronic device. Background Art

[0002] MPC Wallet is a cryptocurrency wallet based on the Multi-Party Computation (MPC) protocol. MPC Wallet protects the security of private keys by distributing and storing them on multiple devices and using the MPC protocol for secure calculations. The MPC protocol allows multiple participants to jointly generate keys without exposing the complete private key to any single participant. This decentralized storage and calculation method allows private keys to remain secure even if certain devices are attacked or leaked. Therefore, MPC Wallet provides higher security and protection measures to protect users' cryptocurrency assets.

[0003] Under the current MPC wallet architecture, in terms of security design, it is necessary to introduce complex zero-knowledge proofs to verify transaction security, so as to avoid key leakage problems caused by malicious acts among multiple participants. Therefore, transaction signatures need to be calculated based on the parameters required by zero-knowledge proofs. However, this signature method requires multiple rounds of interaction between the participants, with high computational complexity and low computational efficiency.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present application, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The purpose of this application is to provide a transaction signature method, device, computer-readable medium and electronic device to reduce the computational complexity of transaction signature and improve signature efficiency.

[0006] Other features and advantages of the present application will become apparent from the following detailed description, or may be learned in part by the practice of the present application.

[0007] According to one aspect of an embodiment of the present application, a transaction signature method is provided, which is applied to a transaction participant, and the method includes:

[0008] Perform elliptic curve point multiplication on the randomly generated signature obfuscated fragments of preset length according to the elliptic curve public parameters to obtain an obfuscated public certificate, and summarize the obfuscated public certificates of all transaction participants to obtain an obfuscated certificate;

[0009] Generate a left signature of the transaction information according to the obfuscated credential, the transaction information and the elliptic curve public parameters;

[0010] Based on each sharding parameter and its corresponding confusion factor, a sharding left parameter corresponding to each sharding parameter is generated, and according to the sum of the sharding left parameter corresponding to each sharding parameter and the confusion factor corresponding to each sharding parameter in other transaction participants, a temporary factor corresponding to each sharding parameter is obtained; each sharding parameter is a randomly generated parameter with a length of the preset length, and the confusion factor is randomly generated data with a length of the preset length;

[0011] Obtaining a randomly generated obfuscation parameter group, wherein the number of obfuscation parameters included in the obfuscation parameter group is the same as the total number of the slice parameters, and the length of the obfuscation parameters included in the obfuscation parameter group is the preset length;

[0012] Generate a right signature of the transaction information according to the temporary factors corresponding to each shard parameter, the obfuscation parameter group and the left signature;

[0013] The left signature and the right signature are combined to obtain signature data of the transaction information, and the signature data is used to verify the transaction information.

[0014] According to one aspect of an embodiment of the present application, a transaction signature device is provided, including:

[0015] The obfuscated certificate calculation module is used to perform elliptic curve point multiplication calculation on the randomly generated signature obfuscated fragments of preset length according to the elliptic curve public parameters to obtain the obfuscated public certificate, and to summarize the obfuscated public certificates of all transaction participants to obtain the obfuscated certificate;

[0016] A left signature generation module, used to generate a left signature of the transaction information according to the obfuscated credential, the transaction information and the elliptic curve public parameters;

[0017] A temporary factor calculation module, used to generate a sharding left parameter corresponding to each sharding parameter based on each sharding parameter and its corresponding confusion factor, and obtain a temporary factor corresponding to each sharding parameter according to the sum of the sharding left parameter corresponding to each sharding parameter and the confusion factor corresponding to each sharding parameter in other transaction participants; each sharding parameter is a randomly generated parameter with a length of the preset length, and the confusion factor is randomly generated data with a length of the preset length;

[0018] An obfuscation parameter acquisition module, used to acquire a randomly generated obfuscation parameter group, wherein the number of obfuscation parameters included in the obfuscation parameter group is the same as the total number of the slice parameters, and the length of the obfuscation parameters included in the obfuscation parameter group is the preset length;

[0019] A right signature generation module, used to generate a right signature of the transaction information according to the temporary factors corresponding to each shard parameter, the obfuscation parameter group and the left signature;

[0020] The signature combination module is used to combine the left signature and the right signature to obtain signature data of the transaction information, and the signature data is used to verify the transaction information.

[0021] According to one aspect of an embodiment of the present application, a computer-readable medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the transaction signature method in the above technical solution is implemented.

[0022] According to one aspect of an embodiment of the present application, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor executes the executable instructions so that the electronic device executes a transaction signature method as in the above technical solution.

[0023] According to one aspect of the embodiments of the present application, a computer program product or a computer program is provided, the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the transaction signature method in the above technical solution.

[0024] In the technical solution provided in the embodiment of the present application, the transaction participants first perform elliptic curve point multiplication calculation on the randomly generated signature obfuscated shards of preset length according to the elliptic curve public parameters to obtain the obfuscated public certificate, and summarize the obfuscated public certificates of all transaction participants to obtain the obfuscated certificate; then generate the left signature of the transaction information according to the obfuscated certificate, transaction information and the elliptic curve public parameters; next, the transaction participants generate the shard left parameters corresponding to each shard parameter based on each shard parameter and its corresponding obfuscation factor, and obtain the temporary factor corresponding to each shard parameter according to the sum of the shard left parameters corresponding to each shard parameter and the obfuscation factors corresponding to each shard parameter in other transaction participants; each shard parameter is a randomly generated parameter with a preset length, and the obfuscation factor is randomly generated data with a preset length; then, the transaction participants obtain the randomly generated obfuscation parameter group, the number of obfuscation parameters contained in the obfuscation parameter group is the same as the total number of each shard parameter, and the length of the obfuscation parameters contained in the obfuscation parameter group is the preset length; then generate the right signature of the transaction information according to the temporary factor corresponding to each shard parameter, the obfuscation parameter group and the left signature; finally, the transaction participants combine the left signature and the right signature to obtain the signature data of the transaction information. It can be seen that the entire transaction signature process mostly uses randomly generated data of preset length for calculation, without the need to introduce complex zero-knowledge proof parameter calculations, thereby reducing the amount of data that transaction participants need to transmit, reducing the computational complexity of transaction signatures, and improving signature efficiency.

[0025] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present application, and together with the specification are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0027] Figure 1 The exemplary system architecture block diagram applying the technical solution of the present application is schematically shown.

[0028] Figure 2 The flowchart of a transaction signature method provided by an embodiment of the present application is schematically shown.

[0029] Figure 3 A schematic diagram of the elliptic curve public parameters of the SM2 algorithm is schematically shown.

[0030] Figure 4The flowchart of a transaction signature method provided by an embodiment of the present application is schematically shown.

[0031] Figure 5 A schematic diagram schematically shows an exemplary application scenario of the technical solution of the present application.

[0032] Figure 6 A schematic diagram schematically shows a public key generation process provided by an embodiment of the present application.

[0033] Figure 7 A schematic diagram schematically shows a signature data generation process provided by an embodiment of the present application.

[0034] Figure 8 The structural block diagram of the transaction signature device provided in an embodiment of the present application is schematically shown.

[0035] Fig. 9 The structure block diagram of a computer system suitable for implementing an electronic device of an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0036] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this application will be more comprehensive and complete and fully convey the concept of the example embodiments to those skilled in the art.

[0037] In addition, described feature, structure or characteristic can be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, components, devices, steps, etc. can be adopted. In other cases, known methods, devices, realizations or operations are not shown or described in detail to avoid blurring the various aspects of the present application.

[0038] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0039] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0040] It is understandable that in the specific implementation of this application, related data such as user information (such as transaction information) is involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0041] Figure 1 The exemplary system architecture block diagram applying the technical solution of the present application is schematically shown.

[0042] like Figure 1 As shown, the system architecture 100 may include a terminal device 110, a network 120 and a server 130. The terminal device 110 may include a smart phone, a tablet computer, a laptop computer, an intelligent voice interaction device, a smart home appliance, a vehicle-mounted terminal, and the like. The server 130 may be an independent physical server, or a server cluster or a distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. The network 120 may be a communication medium of various connection types that can provide a communication link between the terminal device 110 and the server 130, such as a wired communication link or a wireless communication link. The transaction participants in the technical solution of the present application may be a terminal device 110 or a server 130.

[0043] According to the implementation requirements, the system architecture in the embodiment of the present application can have any number of terminal devices, networks and servers. For example, the server 130 can be a server group composed of multiple server devices. In addition, the technical solution provided in the embodiment of the present application can be applied to the terminal device 110, can also be applied to the server 130, or can be implemented by the terminal device 110 and the server 130 together, and the present application does not make any special restrictions on this.

[0044] The transaction signature method provided by this application is described in detail below in conjunction with specific implementation methods.

[0045] Figure 2 The flowchart of a transaction signature method provided by an embodiment of the present application is schematically shown, and the transaction signature method is applied to transaction participants. Figure 2 As shown, the transaction signature method provided in the embodiment of the present application includes the following steps:

[0046] Step 210: Perform elliptic curve point multiplication on the randomly generated signature obfuscated fragments of a preset length according to the elliptic curve public parameters to obtain an obfuscated public certificate, and summarize the obfuscated public certificates of all transaction participants to obtain an obfuscated certificate.

[0047] Specifically, the elliptic curve public key cryptography algorithm is a cryptographic mechanism based on an elliptic curve, referred to as the SM2 algorithm. The elliptic curve public parameters refer to the public parameters of the elliptic curve corresponding to the SM2 algorithm. For example, Figure 3 The various public parameters of the elliptic curve of the SM2 algorithm are shown. In this embodiment, the elliptic curve public parameter used is the elliptic curve base point G of the SM2 algorithm, that is, Figure 3 G x and G y The transaction participants randomly generate a string of data of a preset length locally as the signature obfuscation fragment, for example, randomly generate binary data of a preset length of 256 bits (bits, also called bits) as the signature obfuscation fragment. The transaction participants perform elliptic curve point multiplication on the SM2 algorithm elliptic curve base point G and the signature obfuscation fragment ka to obtain the obfuscated public certificate kaG, then the obfuscated public certificate kaG = ka*G, where * here represents the elliptic curve point multiplication operation.

[0048] Assuming that a transaction includes two participants (i.e., transaction participants), each participant can calculate their own obfuscated public credentials according to step 210. At the same time, each participant sends its own obfuscated public credentials to the other party. Thus, each transaction participant can aggregate the obfuscated public credentials of all transaction participants to obtain an obfuscated credential. For example, assuming that participant A calculates the obfuscated public credential kaG, assuming that participant B calculates the obfuscated public credential kbG, participant A sends the obfuscated public credential kaG to participant B, and participant B sends the obfuscated public credential kbG to participant A, then the obfuscated credentials aggregated by participant A and participant B are the same, which can be recorded as: obfuscated credential kG = kaG + kbG.

[0049] In one embodiment of the present application, considering security issues, the transaction participants can verify the validity of the signature obfuscation fragment after generating it. For example, it is detected whether the first 8 bits of the signature obfuscation fragment are all 0. If they are all 0, it is determined that the signature obfuscation fragment is invalid. At this time, a new signature obfuscation fragment is regenerated, and the verification is continued until the first 8 bits of the generated signature obfuscation fragment are not all 0, and a valid signature obfuscation fragment is obtained.

[0050] It can be understood that any randomly generated data of a preset length in the present application can be randomly generated 256-bit data, and the random number can be verified for validity after generation and used only after the verification passes.

[0051] Step 220: Generate a left signature of the transaction information based on the obfuscated certificate, the transaction information and the elliptic curve public parameters.

[0052] Specifically, transaction information refers to the information of the transaction currently participated in by the transaction participants, such as the transaction information is the transfer of part of the assets from account A to account B. Transaction information can also include information of the transaction participants, such as transaction participant identification, account information, etc. The elliptic curve public parameters used here include Figure 3 All parameters shown, including p, a, b, n, G x and G y The three parameters of the obfuscated certificate, transaction information and elliptic curve public parameters are calculated to obtain the left signature of the transaction information, which is part of the complete signature data of the transaction information.

[0053] Step 230: Generate shard left parameters corresponding to each shard parameter based on each shard parameter and its corresponding confusion factor, and obtain temporary factors corresponding to each shard parameter based on the sum of the shard left parameters corresponding to each shard parameter and the confusion factors corresponding to each shard parameter of other transaction participants; each shard parameter is randomly generated and has a preset length, and the confusion factor is randomly generated data with a preset length.

[0054] Specifically, the sharding parameter is a parameter randomly generated locally by the transaction participants and has a preset length. The confusion factor and the sharding parameter belong to the same type of data, that is, they are also randomly generated data with a preset length. When generating each sharding left parameter, each sharding parameter can be subtracted from its own confusion factor to obtain the sharding left parameter corresponding to each sharding parameter.

[0055] Each transaction participant can send their own confusion factor to the other party, so that each transaction participant has the confusion factor of all participants. When calculating the temporary factor, each transaction participant obtains the temporary factor corresponding to the shard parameter based on its own shard left parameter and the sum of the confusion factors of the corresponding shard parameters of other transaction participants. For example, participant A sends the confusion factor A1 of shard parameter 1 to participant B, and participant B sends the confusion factor B1 of shard parameter 1 to participant A. Then participant A uses the shard left parameter of its own shard parameter 1 plus the confusion factor B1 to obtain the temporary factor of participant A's own shard parameter 1; similarly, participant B uses the shard left parameter of its own shard parameter 1 plus the confusion factor A1 to obtain the temporary factor of participant B's own shard parameter 1. It should be noted that the "shard parameter 1" here refers to the shard parameter type, not the specific value of the shard parameter. Participants A and B can have different specific values ​​for the same type of shard parameter. It can be understood that for any randomly generated data in the technical solution of the present application, each participant can have a different specific value.

[0056] Step 240: Obtain a randomly generated obfuscation parameter group, the number of obfuscation parameters included in the obfuscation parameter group is the same as the total number of each slice parameter, and the length of the obfuscation parameters included in the obfuscation parameter group is a preset length.

[0057] Specifically, the obfuscation parameter group includes multiple obfuscation parameters, which are obtained based on a random number of a preset length. The obfuscation parameters correspond to the sharding parameters one by one, so the number of obfuscation parameters contained in the obfuscation parameter group is the same as the total number of each sharding parameter. The obfuscation parameter group can be generated by the transaction participants themselves, or it can be generated by a third party unrelated to the transaction participants and sent to the transaction participants.

[0058] Step 250: Generate a right signature of the transaction information according to the temporary factors corresponding to each shard parameter, the obfuscation parameter group and the left signature.

[0059] Specifically, after calculation, the temporary factors corresponding to each shard parameter, the obfuscation parameters in the obfuscation parameter group, and the left signature are merged to obtain the right signature of the transaction information, which is part of the complete signature data of the transaction information. In the process of calculating the right signature, the right signature can be divided into two parts for calculation, one part is the right signature left factor, and the other part is the right signature right factor. For the right signature left factor, it can be calculated according to the temporary factors corresponding to each shard parameter and the corresponding obfuscation parameters in the obfuscation parameter group; for the right signature right factor, it can be calculated according to the temporary factors corresponding to each shard parameter and the left signature. Finally, the right signature left factor and the right signature right factor are summarized to obtain the right signature of the transaction information.

[0060] Step 260: Combine the left signature and the right signature to obtain signature data of the transaction information, which is used to verify the transaction information.

[0061] Specifically, after obtaining the left signature and the right signature, the two are combined to obtain the complete signature data. After that, the signature data of the transaction information can be sent to the blockchain, and the blockchain verifies the signature information to confirm the legitimacy of the transaction. Since the elliptic curve cryptographic algorithm is used, there is no need to verify it through zero-knowledge proof. The blockchain can verify the signature data according to the existing SM2 verification method. When the verification passes, the blockchain can execute the transaction normally; if the verification fails, the blockchain can refuse to execute the transaction. The SM2 verification algorithm has a small amount of calculation data, fast calculation speed, and high calculation efficiency, which can improve the efficiency of transaction verification and thus improve the efficiency of transaction execution.

[0062] In the technical solution provided in the embodiment of the present application, the transaction participants first perform elliptic curve point multiplication calculation on the randomly generated signature obfuscated shards of preset length according to the elliptic curve public parameters to obtain the obfuscated public certificate, and summarize the obfuscated public certificates of all transaction participants to obtain the obfuscated certificate; then generate the left signature of the transaction information according to the obfuscated certificate, transaction information and the elliptic curve public parameters; next, the transaction participants generate the shard left parameters corresponding to each shard parameter based on each shard parameter and its corresponding obfuscation factor, and obtain the temporary factor corresponding to each shard parameter according to the sum of the shard left parameters corresponding to each shard parameter and the obfuscation factors corresponding to each shard parameter in other transaction participants; each shard parameter is a randomly generated parameter with a preset length, and the obfuscation factor is randomly generated data with a preset length; then, the transaction participants obtain the randomly generated obfuscation parameter group, the number of obfuscation parameters contained in the obfuscation parameter group is the same as the total number of each shard parameter, and the length of the obfuscation parameters contained in the obfuscation parameter group is the preset length; then generate the right signature of the transaction information according to the temporary factor corresponding to each shard parameter, the obfuscation parameter group and the left signature; finally, the transaction participants combine the left signature and the right signature to obtain the signature data of the transaction information. It can be seen that the entire transaction signature process mostly uses randomly generated data of preset length for calculation, without the need to introduce complex zero-knowledge proof parameter calculations, thereby reducing the amount of data that transaction participants need to transmit, reducing the computational complexity of transaction signatures, and improving signature efficiency.

[0063] Figure 4 The flowchart of the transaction signature method provided by an embodiment of the present application is schematically shown. This embodiment is a further refinement of the above embodiment. Figure 4 As shown, the transaction signature method provided in the embodiment of the present application includes the following steps:

[0064] Step 401: perform elliptic curve point multiplication on randomly generated signature obfuscated fragments of preset length according to elliptic curve public parameters to obtain obfuscated public credentials, and summarize the obfuscated public credentials of all transaction participants to obtain obfuscated credentials.

[0065] For step 401 , reference may be made to the relevant description corresponding to the aforementioned step 210 , which will not be repeated here.

[0066] Step 402: Calculate the elliptic curve public parameters based on the cryptographic hash algorithm to obtain the signature credential factor.

[0067] Specifically, the cryptographic hash algorithm is also called the SM3 algorithm, which is a message digest algorithm and a one-way hash function. The elliptic curve public parameters used here include Figure 3 p, a, b, n, G shown x and G y , and record it as a whole as Parm.

[0068] During the calculation process, the transaction participants first need to obtain the public key of the transaction, which can represent the wallet account address jointly managed by each transaction participant on the blockchain. The public key can be obtained based on the randomly generated private key shard. Specifically, the transaction participants first randomly generate a private key shard of a preset length locally (for example, a 256-bit private key shard is randomly generated, and validity verification can also be performed) da, and then perform an elliptic curve point multiplication operation on the private key shard da and the base point G in the elliptic curve public parameters to obtain the public key shard Pka, that is, Pka = da * G, where * represents the elliptic curve point multiplication operation. The public key shards calculated by each transaction participant can be sent to other participants respectively, so that each participant contains all the public key shards. Next, the transaction participant performs an elliptic curve point addition operation on its own public key shard and the public key shards of other transaction participants to obtain the public key Pk, that is, Pk = Pka + Pkb, where + represents the elliptic curve point addition operation.

[0069] In one embodiment of the present application, after each transaction participant calculates its own public key fragment, it can send its own public key fragment to a third party, and the third party aggregates the public key fragments of each participant to obtain a public key Pk. In this process, when the third party receives the public key fragments sent by each participant, it first authenticates each participant, such as verifying the user identity through operations such as user passwords and mobile phone verification codes. After the verification is passed, the third party aggregates the public key fragments of each participant to generate a public key Pk = Pka + Pkb. After generating the public key Pk, the third party can send the public key Pk to each participant, and encode the public key Pk at the same time to obtain an address data addr, and send the address data addr to the blockchain for storage. The address data addr represents the wallet account address jointly managed by each participant. Among them, the encoding process generally takes a specific length field of the public key Pk as the address data addr. For example, the public key Pk includes 33 bytes. Generally, the first byte is ignored and the first 20 bytes are taken as the address data addr, that is, the 2nd to 21st bytes of the public key Pk are taken as the address data addr.

[0070] After obtaining the public key Pk, the transaction participants concatenate the elliptic curve public parameter parm, the preset data and the public key Pk to obtain the concatenated data, and calculate the concatenated data based on the cryptographic hash algorithm to obtain the signature credential factor. Among them, the preset data is the SM2 standard public parameter ENTL_ID, and the specific value is 123456789123456789. The signature credential factor Z can be expressed as Z = SM3 (ENTL_ID | parm | Pk), where "|" represents the concatenation operation.

[0071] Step 403: Concatenate the signature credential factor and the transaction information to obtain the credential secret parameter.

[0072] Specifically, in the splicing process, the transaction information is first calculated using a cryptographic hash algorithm to obtain a transaction hash value, and then the credential factor and the transaction hash value are spliced ​​to obtain a credential secret parameter. The credential secret parameter is recorded as e, then e = Z|SM3(m), where Z represents the credential factor and m represents the transaction information, such as "A transfers 100 yuan to B".

[0073] Step 404: extract the horizontal coordinate of the obfuscated credential, and calculate the data sum of the horizontal coordinate and the credential secret parameter.

[0074] Specifically, based on the calculation process of the aforementioned obfuscated certificate kG, it can be known that the obfuscated certificate kG is calculated based on the elliptic curve base point G of the SM2 algorithm, so it can be expressed in the form of a point. In fact, the obfuscated certificate kG is equivalent to a point on the elliptic curve, and its horizontal coordinate x1 is taken here. Then, the data sum of the horizontal coordinate x1 and the certificate secret parameter e is calculated in the number field, that is, x1+e, where + represents the algebraic sum calculation operation in the number field.

[0075] Step 405: Take the data and the modulus parameter in the public parameter of the elliptic curve to obtain the left signature of the transaction information.

[0076] Specifically, the data calculated in step 404 is modulo the modulus parameter n in the public parameter of the elliptic curve to obtain the left signature, that is, the left signature r = x1 + e mod n, where the modulus parameter n is as follows: Figure 3 shown.

[0077] Step 406: Subtract the signature-once-passive shard obfuscation factor from the signature-once-passive shard to obtain the signature-once-passive shard left parameter; subtract the private key shard obfuscation factor from the private key shard to obtain the private key shard left parameter; subtract the signature obfuscation shard obfuscation factor from the signature obfuscation shard to obtain the signature obfuscation shard left parameter.

[0078] Specifically, the types of sharding parameters included by the transaction participants are: signature-once-and-secret sharding, private key sharding, and signature-confusion sharding. Among them, the signature-once-and-secret sharding pa is a random number of a preset length generated locally by the transaction participant, the private key sharding da is obtained in the aforementioned step 402, and the signature-confusion sharding ka is obtained in the aforementioned step 401. The transaction participants generate corresponding confusion factors for the above three types of sharding parameters, and the confusion factor is also a random number of a preset length. Then the signature-once-and-secret sharding pa corresponds to the signature-once-and-secret sharding confusion factor pa_r, the private key sharding da corresponds to the private key sharding confusion factor da_r, and the signature-confusion sharding ka corresponds to the signature-confusion sharding confusion factor ka_r.

[0079] Then in the process of calculating the left parameters, each shard parameter is subtracted from its own confusion factor to obtain its own shard left parameter, namely: the signature one-time pad shard left parameter pa_s = pa-pa-_r, the private key shard left parameter da_s = da-da_r, and the signature confusion shard left parameter ka_s = ka-ka_r.

[0080] At the same time, each transaction participant sends its own confusion factor to other participants. For example, participant A has the signature one-time pad shard confusion factor pa_r, private key shard confusion factor da_r and signature confusion shard confusion factor ka_r, and participant B has the signature one-time pad shard confusion factor pa_r, private key shard confusion factor da_r and signature confusion shard confusion factor ka_r. After sending the confusion factors to each other, both participant A and participant B have the above 6 confusion factors at the same time.

[0081] Step 407, obtain the signature one-time pad temporary factor according to the sum of the signature one-time pad sharding left parameter and the signature one-time pad sharding confusion factors of other participants; obtain the private key sharding temporary factor according to the sum of the private key sharding left parameter and the private key sharding confusion factors of other participants; obtain the signature confusion sharding temporary factor according to the sum of the signature confusion sharding left parameter and the signature confusion sharding confusion factors of other participants.

[0082] Specifically, the transaction participants use the sum of their own shard left parameters and the confusion factors of other participants as their own temporary factors. Assuming the two participants A and B mentioned above, then: the signature one-time pad temporary factor p_ra = pa_s + pb_r, the private key shard temporary factor d_ra = da_s + db_r, and the signature confusion shard temporary factor k_ra = ka_s + kb_r. It should be noted that the sum of the temporary factors of all participants is equal to the sum of the corresponding shard parameters of all participants, that is: p_ra + p_rb = pa + pb, d_ra + d_rb = da + db, k_ra + k_rb = ka + kb, where pb, db, and kb represent the signature one-time pad shard, private key shard, and signature confusion shard of participant B, respectively.

[0083] Step 408: Randomly generate a right signature left parameter obfuscated total parameter and a right signature right parameter obfuscated total parameter of a preset length.

[0084] Specifically, the number of right signature left parameter obfuscation total parameters corresponds to the number of the aforementioned slice parameters. Similarly, the number of right signature right parameter obfuscation total parameters also corresponds to the number of the aforementioned slice parameters. According to the aforementioned content, there are a total of 3 slice parameters, so 3 right signature left parameter obfuscation total parameters and 3 right signature right parameter obfuscation total parameters are generated here respectively.

[0085] Here, the three right signature left parameter confusion total parameters are respectively recorded as: right signature left parameter confusion first factor i_l, right signature left parameter confusion second factor u_l and right signature left parameter confusion third factor o_l, wherein the right signature left parameter confusion first factor i_l and the right signature left parameter confusion second factor u_l are both random numbers of preset length (i.e., 256-bit data), and the right signature left parameter confusion third factor o_l = i_l*u_l, where * is a number field multiplication operation.

[0086] The three right signature right parameter confusion total parameters are respectively recorded as: right signature right parameter confusion first factor i_r, right signature right parameter confusion second factor u_r and right signature right parameter confusion third factor o_r, wherein the right signature right parameter confusion first factor i_r and the right signature right parameter confusion second factor u_r are both random numbers of preset length (i.e., 256-bit data), and the right signature right parameter confusion third factor o_r = i_r*u_r, where * is a number field multiplication operation.

[0087] In one embodiment of the present application, the right-signature-left-parameter obfuscated total parameter and the right-signature-right-parameter obfuscated total parameter may be generated by the transaction participants themselves or by a third party.

[0088] Step 409: divide the right-signature-left-parameter obfuscated parameter into multiple right-signature-left-parameter obfuscated parameters, and divide the right-signature-right-parameter obfuscated parameter into multiple right-signature-right-parameter obfuscated parameters according to the number of transaction participants.

[0089] The number of participants in this embodiment is two, so the right signature left parameter obfuscation parameter is divided into two right signature left parameter obfuscation parameters, and the right signature right parameter obfuscation parameter is divided into two. Right signature right parameter obfuscation parameter. According to step 408, the right signature left parameter obfuscation parameter and the right signature right parameter obfuscation parameter have 3 data respectively. After division, each data is divided into two, and a total of 6 data are obtained. Then:

[0090] The right signature left parameter obfuscated first factor i_l is divided into the first part i_l_a of the right signature left parameter obfuscated first factor and the second part i_l_b of the right signature left parameter obfuscated first factor, i_l = i_l_a + i_l_b, which is equivalent to covering part of i_1 with a random mask r1, and obtaining i_1_l and i_1_r, and the covered part has the same length as the mask.

[0091] The right signature left parameter obfuscated second factor u_l is divided into the right signature left parameter obfuscated second factor first part u_l_a and the right signature left parameter obfuscated second factor second part u_l_b, and: u_l=u_l_a+u_l_b.

[0092] The right signature left parameter obfuscated third factor o_l is divided into the first part o_l_a of the right signature left parameter obfuscated third factor and the second part o_l_b of the right signature left parameter obfuscated third factor, and we have: u_l=o_l=o_l_a+o_l_b.

[0093] The right signature right parameter obfuscated first factor i_r is divided into the right signature right parameter obfuscated first factor first part i_r_a and the right signature right parameter obfuscated first factor second part i_r_b, and i_r=i_r_a+i_r_b.

[0094] The right signature right parameter obfuscated second factor u_r is divided into the right signature right parameter obfuscated second factor first part u_r_a and the right signature right parameter obfuscated second factor second part u_r_b, and: u_r=u_r_a+u_r_b.

[0095] The right signature right parameter obfuscated third factor o_r is divided into the first part o_r_a of the right signature right parameter obfuscated third factor and the second part o_r_b of the right signature right parameter obfuscated third factor, and we have: u_l=o_r=o_r_a+o_r_b.

[0096] The division operation of the above data can be performed by a third party, and the third party sends the first part of the data to the first transaction participant (i.e., participant A), and sends the second part of the data to the second transaction participant (i.e., participant B). Then participant A has: the first part of the right signature left parameter confusion of the first, second, and third factors i_l_a, u_l_a, o_l_a and the first part of the right signature right parameter confusion of the first, second, and third factors i_r_a, u_r_a, o_r_a; participant B has: the second part of the right signature left parameter confusion of the first, second, and third factors i_l_b, u_l_b, o_l_b and the second part of the right signature right parameter confusion of the first, second, and third factors i_r_b, u_r_b, o_r_b.

[0097] Step 410: Obtain an obfuscated parameter group according to the right signature left parameter obfuscated parameters and the right signature right parameter obfuscated parameters corresponding to the transaction participants.

[0098] According to the above steps, the obfuscation parameter group of each transaction participant will include the corresponding parts of the first, second and third factors of the right signature left / right parameter obfuscation. For example, the obfuscation parameter group of participant A includes: the first part i_l_a, u_l_a, o_l_a of the right signature left parameter obfuscation of the first, second and third factors and the first part i_r_a, u_r_a, o_r_a of the right signature right parameter obfuscation of the first, second and third factors; the obfuscation parameter group of participant B includes: the second part i_l_b, u_l_b, o_l_b of the right signature left parameter obfuscation of the first, second and third factors and the second part i_r_b, u_r_b, o_r_b of the right signature right parameter obfuscation of the first, second and third factors.

[0099] Step 411: Generate the right signature left factor of the transaction information according to the temporary factors and the obfuscation parameter group corresponding to each shard parameter.

[0100] First, the transaction participant (Party A) increases the private key shard temporary factor d_ra by a set value to obtain the private key shard offset temporary factor d_ra_1. According to the sub-protocol in the cryptographic protocol, the set value here is selected as 1, then d_ra_1=d_ra+1.

[0101] Next, the transaction participants subtract the first part of the right signature left parameter confusion first factor i_l_a from the temporary factor d_ra_1 of the private key shard offset to obtain the right signature confused first shard left parameter epsilon_a_l, that is, epsilon_a_l = d_ra_1-i_l_a.

[0102] Next, the transaction participants will subtract the first part of the right signature left parameter confused second factor u_l_a from the temporary factor p_ra of the one-time signature shard, and obtain the right signature confused first shard right parameter epsilon_a_r, that is, epsilon_a_r = p_ra-u_l_a.

[0103] At the same time, other participants also use their own private key shard temporary factors and signature one-time pad shard temporary factors to generate their own right signature obfuscated first shard left parameters and right signature obfuscated first shard right parameters. For example, participant B calculates the right signature obfuscated first shard left parameter epsilon_b_l=d_rb-i_l_b, and the right signature obfuscated first shard right parameter epsilon_a_b=p_rb-u_l_b. Each participant sends these two data to other participants for data aggregation.

[0104] Then, the transaction participants aggregate the left parameters of the first shard of the right signatures of all transaction participants to obtain the right parameter aggregate parameter of the first shard of the right signatures, and aggregate the right parameters of the first shard of the right signatures of all transaction participants to obtain the right parameter aggregate parameter of the first shard of the right signatures. That is, the left parameter aggregate parameter of the first shard of the right signatures is epsilon_l=epsilon_a_l+epsilon_b_l, and the right parameter aggregate parameter of the first shard of the right signatures is epsilon_r=epsilon_a_r+epsilon_b_r.

[0105] Finally, the transaction participants obtain the right parameter of the right signature obfuscated first shard based on the product of the first part of the second factor of the right signature obfuscated left parameter and the right parameter summary parameter of the first shard of the right signature obfuscated right parameter, the product of the first part of the first factor of the right signature obfuscated left parameter and the right parameter summary parameter of the first shard of the right signature obfuscated right parameter, the product of the right parameter summary parameter of the first shard of the right signature obfuscated left parameter and the right parameter summary parameter of the first shard of the right signature obfuscated right parameter, and the sum of the third factor of the right signature obfuscated left parameter. That is, the right signature left factor s_left_a=o_l_a+u_l_a*epsilon_l+i_l_a*epsilon_r+epsilon_l*epsilon_r. Party B generates the right signature left factor s_left_b in the same way.

[0106] Step 412: Generate the right signature right factor of the transaction information according to the temporary factors corresponding to each shard parameter and the left signature.

[0107] First, the transaction participants subtract the product of the private key shard temporary factor k_ra and the left signature r from the signature confusion shard temporary factor d_ra to obtain the right signature temporary offset factor ran_r_a, that is, ran_r_a=k_ra-r*d_ra.

[0108] Next, the transaction participant subtracts the first part of the right signature right parameter confusion first factor i_r_a from the right signature temporary offset factor ran_r_a to obtain the right signature confusion second fragment left parameter delta_a_l, that is, delta_a_l=ran_r_a-i_r_a.

[0109] Next, the transaction participants subtract the first part of the right signature right parameter confused second factor u_r_a from the signature one-time temporary factor p_ra to obtain the right signature confused second shard right parameter delta_a_r, that is, delta_a_r=p_ra-u_r_a.

[0110] Each participant sends its own right signature mixed with the left parameter of the second shard to other participants for easy aggregation.

[0111] Then, the transaction participant aggregates the right signature obfuscated second shard left parameter with the right signature obfuscated second shard left parameter of other transaction participants to obtain the right signature obfuscated second shard left parameter aggregate parameter, and aggregates the right signature obfuscated second shard right parameter with the right signature obfuscated second shard right parameter of other transaction participants to obtain the right signature obfuscated second shard right parameter aggregate parameter. Taking participants A and B as examples, the right signature obfuscated second shard left parameter aggregate parameter delta_l=delta_a_l+delta_b_l, and the right signature obfuscated second shard right parameter aggregate parameter delta_r=delta_a_r+delta_b_r, where delta_b_l represents the right signature obfuscated second shard left parameter of participant B, and delta_b_r represents the right signature obfuscated second shard right parameter of participant B.

[0112] Finally, the transaction participants obtain the right signature right factor of the transaction information based on the product of the first part of the right signature right parameter obfuscated second factor and the right signature obfuscated second shard left parameter summary parameter, the product of the first part of the right signature right parameter obfuscated first factor and the right signature obfuscated second shard right parameter summary parameter, the product of the right signature obfuscated second shard left parameter summary parameter and the right signature obfuscated second shard right parameter summary parameter, and the right signature right parameter obfuscated third factor. That is, the right signature right factor s_right_a=o_r_a+u_r_a*delta_l+i_r_a*delta_r+delta_l*delta_r. Similarly, participant B calculates the right signature right factor s_right_b.

[0113] Step 413: Sum up the right signature left factor and the right signature right factor to obtain the right signature of the transaction information.

[0114] Specifically, the aggregation process includes the aggregation of the right-signed left factor and the aggregation of the right-signed right factor. Therefore, the sum of the right-signed left factor and the right-signed left factors of other transaction participants is first calculated to obtain the right-signed left factor aggregation, which can be expressed as: the left factor aggregation s_left = s_left_a + s_left_b. Then, the right-signed right factor and the right-signed right factors of other transaction participants are calculated to obtain the right-signed right factor aggregation, which can be expressed as: the right-signed right factor aggregation s_right = s_right_a + s_right_b. Finally, the right-signed left factor aggregation is inverted and multiplied with the right-signed right factor aggregation to obtain the right signature of the transaction information, which can be expressed as: the right signature s = s_left^{-1}*s_right, ^{-1} is the inversion.

[0115] In one embodiment of the present application, each participant may send their own right-signed left factor and right-signed right factor to a third party, which then performs a summary operation.

[0116] Step 414: Combine the left signature and the right signature to obtain signature data of the transaction information, which is used to verify the transaction information.

[0117] Step 414 can refer to the relevant description of the aforementioned step 260, which will not be repeated here. The previous combination process can be implemented by a third party, and the third party sends the combined signature data signature = (r, s) and transaction information m to the blockchain. The blockchain uses the public key Pk jointly managed by each participant in accordance with the existing SM2 verification method to verify the signature signature and transaction m. If the verification is successful, the transaction is successful, otherwise, the transaction is rejected.

[0118] In the technical solution provided in the embodiment of the present application, the transaction signature generation process is implemented based on the national secret SM2 algorithm, with high computational efficiency, small number of network bandwidth transmission rounds, small amount of interaction data, and small amount of interaction in the entire protocol. Compared with the existing solution zkp (zero-knowledge proof), the amount of interaction data needs to be in Mb, and the amount of interaction data in this solution is less than 1kb.

[0119] Figure 5 A schematic diagram schematically shows an exemplary application scenario of the technical solution of the present application.

[0120] like Figure 5 As shown, the application scenario includes a first transaction participant 510, a second transaction participant 520 and a third party 530. The first transaction participant 510 and the second transaction participant 520 are both parties involved in the transaction, and the third party 530 does not participate in the transaction. In this embodiment, the first transaction participant 510 and the second transaction participant 520 can each perform calculations based on the technical solution of the present application, and during the calculation process, send their own calculated data to the other party or the third party 530, and the other party or the third party 530 performs some data aggregation processing.

[0121] Figure 6 The following is a schematic diagram of a public key generation process provided by an embodiment of the present application. Figure 7 The following is a schematic diagram of the signature data generation process provided by an embodiment of the present application. Figure 5-7 Describe the specific implementation process of the technical solution of this application.

[0122] In this embodiment, there are user A, user B and exchange C. User A and user B jointly manage a private key d, corresponding to address address (public key, pk). The public key pk is hosted in exchange C, and the address is set on the blockchain. User A and user B need to participate in the transfer, and only one signature is stored for each transaction on the chain. Among them, user A represents participant A, and user B represents participant B.

[0123] The overall process is as follows:

[0124] 1. Key generation stage: User A and User B generate private key shards and public key shards locally, send the public key shards to exchange C for aggregation, and register them on the blockchain as addresses.

[0125] 2. Signature phase: User A and User B interact with each other to generate a valid signature without knowing each other’s private key shards, and send the signature to Exchange C, which then sends it to the blockchain to complete the transfer.

[0126] For example: User A and User B generate private key shards da and db locally through the client, generate public key shards Pka and Pkb, and send them to exchange C. Exchange C merges them into public key Pk and sends them to the blockchain. The address corresponding to Pk is the wallet address jointly managed by User A and User B.

[0127] User A and user B jointly generate a transfer request m (i.e., transaction m) through their own private key shards da and db, such as transferring 100 yuan to P from an account jointly managed by A and B. A and B jointly generate a transaction signature and send it to exchange C, which verifies it and sends it to the blockchain. After the blockchain verifies the transaction signature, if the verification is successful, it is confirmed that A and B own the transfer ownership and the transfer request m is completed.

[0128] The key generation phase is Figure 6 The public key generation process shown in FIG. 1 specifically includes:

[0129] Step 101, user A and user B locally randomly generate 256-bit private key fragments da and db respectively. If the first 8 bits generated are 0, they are regenerated, and the generated random numbers are such as 0100101000….

[0130] Step 102, user A and user B use the private key shards da and db, and the elliptic curve base point G (public parameter) of the SM2 algorithm to generate public key shards Pka and Pkb, respectively. The generation process is Pka=da*G, and the same is true for Pkb, where * is the elliptic curve point multiplication.

[0131] Step 103: User A and User B send the public key fragments Pka and Pkb to Exchange C.

[0132] Step 104, Exchange C verifies the identities of User A and User B (through existing KYC technology, such as user password, mobile phone verification code login, etc.). After successful verification, it generates the public key Pk=Pka+Pkb corresponding to the address addr jointly managed by A and B, where + is an elliptic curve point addition operation.

[0133] Step 105. Exchange C sends the address addr (the public key is 33 bytes in total, the first 2-21 bytes are taken as the address, and the first byte is generally ignored) encoded with the public key Pk to the blockchain. The blockchain records the address addr as the wallet account address jointly managed by A and B.

[0134] The signing phase is Figure 7 The signature data generation process shown in the figure, in this stage, user A and user B jointly generate a legal signature. In the blockchain, if the signature is verified to be legal, it means that the transaction is legal. This stage specifically includes:

[0135] Step 201: User A and User B locally randomly generate 256-bit signature obfuscated fragments ka and kb respectively. If the first 8 bits generated are 0, they are regenerated. Step 201 is Figure 7 The process of generating signature obfuscation parameters.

[0136] Step 202, user A and user B use the signature obfuscation fragments ka and kb, and the SM2 algorithm elliptic curve base point G (public parameter) to generate obfuscated public certificates kaG and kbG, respectively. The generation process is kaG=ka*G, and the same is true for kbG, where * is the elliptic curve point multiplication.

[0137] Step 203: Users A and B send their obfuscated public credentials kaG to each other, such as A to B and B to A.

[0138] Step 204: User A and B self-aggregate obfuscated credentials kG=kaG+kbG. Steps 202-204 are Figure 7 The process of summarizing the signature public parameters.

[0139] Step 205: Users A and B use the public key Pk, SM2 elliptic curve public parameter Parm (including p, a, b, n, G1, G2, including the entire parameter), and SM2 standard public parameter ENTL_ID (here the ID is 123456789123456789, which is a fixed value) to generate the signature credential factor Z. The generation process is the same as the SM2 algorithm. For the SM3 algorithm, Z=SM3(ENTL_ID|parm|Pk). Step 205 is Figure 7 The process of verifying the signature public parameters.

[0140] Step 206, users A and B use the information m of this transaction (such as the information "the account jointly managed by A and B transfers 100 yuan to P") and the signature credential factor Z to generate the credential secret parameter e=Z|sm3(m), where | is the character linking the two parts.

[0141] Step 207: Users A and B use the obfuscated certificate kG to obtain the obfuscated certificate horizontal coordinate x1. kG is a point on the elliptic curve with horizontal and vertical coordinates. Only the horizontal coordinate is needed here. k is a number, G is a point, and kG represents the elliptic curve point multiplication operation.

[0142] Step 208: User A and User B use the obfuscated credential abscissa x1, credential secret parameter e and elliptic curve public modulus parameter n to generate a left signature r=x1+e mod n (number field addition operation). Steps 206-208 are Figure 7 The process of generating signature fragment 1 in .

[0143] Step 301: User A and User B locally randomly generate 256-bit signature one-time secret fragments pa and pb respectively. If the first 8 bits generated are 0, they are regenerated.

[0144] Step 302: User A and User B respectively use the locally owned signature one-time pad shards pa and pb, private key shards da and db, and signature obfuscation shards ka and kb to randomly generate a 256-bit obfuscation factor for each parameter they own (the parameters here refer to the shards (pa, da, ka) described above). For example, if A has pa, da, and ka, then three random factors pa_r, da_r, and ka_r are generated, and the same applies to B.

[0145] Step 303, taking user A as an example, use the signature one-time pad shard pa and confusion factor pa_r, the private key shard da and confusion factor da_r, the signature confusion shard ka and confusion factor ka_r to generate the signature one-time pad shard left parameter pa_s=pa-pa_r, the private key shard left parameter da_s=da-da_r, and the signature confusion shard left parameter ka_s=ka-ka_r. The same is true for user B.

[0146] Step 304: Taking user A as an example, user A sends the signature obfuscation shard obfuscation factor pa_r, the private key shard obfuscation factor da_r, and the signature obfuscation shard obfuscation factor ka_r to user B, and user B sends them to user A in the same way.

[0147] Step 305, taking user A as an example, user A uses the signature one-time pad sharding left parameter pa_s and the signature one-time pad sharding confusion factor pb_r from B to generate the signature one-time pad temporary factor p_ra=pa_s+pb_r. B generates p_rb in the same way (note that p_ra+p_rb=pa+pb).

[0148] Step 306, taking user A as an example, user A uses the private key sharding left parameter da_s and the private key sharding confusion factor db_r from B to generate a private key sharding temporary factor d_ra=da_s+db_r, and B generates d_rb in the same way (note that d_ra+d_rb=da+db).

[0149] Step 307, taking user A as an example, user A uses the signature obfuscation fragment left parameter ka_s and the signature obfuscation fragment obfuscation factor kb_r from B to generate the signature obfuscation fragment temporary factor k_ra=ka_s+kb_r, and B generates k_rb in the same way (note that k_ra+k_rb=ka+kb).

[0150] Step 401, Exchange C randomly generates a 256-bit right signature and left parameter confusion first factor i_l, a right signature and left parameter confusion second factor u_l, and a right signature and left parameter confusion third factor o_l=i_l*u_l.

[0151] Step 402: Exchange C randomly generates a 256-bit right signature and right parameter confusion first factor i_r, a right signature and right parameter confusion second factor u_r, and a right signature and right parameter confusion third factor o_r=i_r*u_r.

[0152] Step 403, Exchange C generates the first, second and third factors A and B of the right signature left parameter confusion by confusing the first, second and third factors i_l, u_l and o_l of the right signature left parameter, and distributes them to users A and B. The generation process is as follows: i_l = i_l_a + i_l_b, u_l = u_l_a + u_l_b, o_l = o_l_a + o_l_b, where the first, second and third factors A of the right signature left parameter confusion sent to A are i_l_a, u_l_a and o_l_a, and the same is true for part B (it can be understood that there is an i_1, and a random mask r1 is used to cover i_1, and i_1_l and i_1_r are obtained, and the covered part has the same length as the mask).

[0153] Step 404, Exchange C generates the first, second and third factors A and B of the right signature and right parameter confusion by confusing the first, second and third factors i_r, u_r and o_r of the right signature and right parameter, and distributes them to users A and B. The generation process is as follows: i_r = i_r_a + i_r_b, u_r = u_r_a + u_r_b, o_r = o_r_a + o_r_b, where the first, second and third factors A of the right signature and right parameter confusion sent to A are i_r_a, u_r_a and o_r_a, and the same is true for part B.

[0154] Step 501: User A uses the private key sharding temporary factor d_ra to generate a private key sharding offset temporary factor d_ra_1=d_ra+1.

[0155] Step 502: User A uses the private key shard offset temporary factor d_ra_1 and the right signature left parameter obfuscated first factor i_l_a to generate the A party right signature obfuscated first shard left parameter epsilon_a_l=d_ra_1-i_l_a.

[0156] Step 503: User A uses the signature one-time pad temporary factor p_ra and the right signature left parameter to confuse the second factor u_l_a, and generates the right signature of party A to confuse the first fragment right parameter epsilon_a_r=p_ra-u_l_a.

[0157] Step 504: User A sends the right signature obfuscated first fragment left parameter epsilon_a_l and the right signature obfuscated first fragment right parameter epsilon_a_r to B.

[0158] Step 505: User B uses the private key shard temporary factor d_rb and the right signature left parameter to confuse the first factor i_l_b, and generates the B party right signature to confuse the first shard left parameter epsilon_b_l=d_rb-i_l_b.

[0159] Step 506: User B uses the signature one-time pad temporary factor p_rb and the right signature left parameter to confuse the second factor u_l_b, and generates the right signature of party A to confuse the first fragment right parameter epsilon_a_b=p_rb-u_l_b.

[0160] Step 507: User B sends the right signature obfuscated first fragment left parameter epsilon_b_l and the right signature obfuscated first fragment right parameter epsilon_b_r to A.

[0161] Step 508: A and B generate a right signature obfuscated first fragment left parameter summary parameter epsilon_l=epsilon_a_l+epsilon_b_l, and a right signature obfuscated first fragment right parameter summary parameter epsilon_r=epsilon_a_r+epsilon_b_r.

[0162] Step 509: Taking user A as an example, user A generates the right signature left factor s_left_a=o_l_a+u_l_a*epsilon_l+i_l_a*epsilon_r+epsilon_l*epsilon_r, and B generates s_left_b in the same way.

[0163] Step 601, taking user A as an example, user A uses the private key sharding temporary factor d_ra, the signature confusion sharding temporary factor k_ra and the left signature r to generate the right signature temporary offset factor ran_r_a = k_ra-r*d_ra. Similarly, user B generates ran_r_b.

[0164] Step 602: User A uses the right signature temporary offset factor ran_r_a and the right signature right parameter to confuse the first factor A part i_r_a, and generates the A party right signature obfuscated second fragment left parameter delta_a_l=ran_r_a-i_r_a. Similarly, B generates delta_b_l.

[0165] Step 603: User A uses the signature one-time pad temporary factor p_ra and the right signature right parameter to confuse the second factor A part u_r_a, and generates the right signature of party A to confuse the second fragment right parameter delta_a_r=p_ra-u_r_a (note that they are different random numbers here). Similarly, B generates delta_b_r.

[0166] Step 604: User A sends the right signature obfuscated second fragment left parameter delta_a_l and the right signature obfuscated second fragment right parameter delta_a_r to B, and similarly, B sends it to A.

[0167] Step 605: A and B generate a right signature obfuscated second fragment left parameter summary parameter delta_l=delta_a_l+delta_b_l, and a right signature obfuscated second fragment right parameter summary parameter delta_r=delta_a_r+delta_b_r.

[0168] Step 606: Taking user A as an example, user A generates a right signature right factor s_right_a=o_r_a+u_r_a*delta_l+i_r_a*delta_r+delta_l*delta_r, and B generates s_right_b in the same way.

[0169] Step 701: Users A and B send the right signature right factors s_right_a and s_right_b and the right signature left factors s_left_a and s_left_b to exchange C.

[0170] Step 702: Exchange C generates a right signature left factor summary s_left=s_left_a+s_left_b, and a right signature right factor summary s_right=s_right_a+s_right_b.

[0171] Step 703: Exchange C uses the right signature left factor summary s_left, the right signature right factor summary and the right signature right factor summary s_right to generate a right signature s=s_left^{-1}*s_right, where ^{-1} is the inverse.

[0172] Step 704: Exchange C uses the left signature r and the right signature s to assemble the signature data signature = (r, s). Steps 301-704 are Figure 7 The process of generating signature fragment 2 in .

[0173] Step 705: Exchange C sends the signature and transaction m to the blockchain. Figure 7 The process of summarizing signatures.

[0174] Step 801: The blockchain uses the public key Pk jointly managed by A and B to verify the signature and transaction m according to the existing SM2 verification method. If the verification is successful, the transaction is successful, otherwise, the transaction is rejected.

[0175] On the one hand, compared with the current MPC wallet design, this solution introduces a neutral third party. The signature process is coordinated by the third party, which improves system efficiency and protects user key security while ensuring that the third party cannot obtain key information. The third party in the above example is an exchange, but in actual applications it can be any other party that is unrelated to the participants.

[0176] On the other hand, this solution improves the current interaction protocol of the MPC wallet, reduces the number of communication rounds and the amount of communication data (the existing interaction requires at least 4 rounds, and this solution can do two rounds, that is, 4 rounds, the amount of interactive data is still small, only requires the interaction of 256-bit random numbers, while the existing solution requires at least several k of data to be interacted), and improves the transmission speed. This solution does not require complex zero-knowledge proofs, and a new MPC wallet protocol is designed based on a third party. The solution no longer relies on public key cryptography construction, has low communication overhead, and fast computing speed.

[0177] It should be noted that although the steps of the method in the present application are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0178] The following introduces an apparatus embodiment of the present application, which can be used to execute the transaction signature method in the above-mentioned embodiment of the present application. Figure 8 The structure block diagram of the transaction signature device provided in the embodiment of the present application is schematically shown. Figure 8 As shown, the transaction signature device provided in the embodiment of the present application includes:

[0179] The obfuscated credential calculation module 810 is used to perform elliptic curve point multiplication calculation on the randomly generated signature obfuscated fragments of preset length according to the elliptic curve public parameters to obtain the obfuscated public credential, and to summarize the obfuscated public credentials of all transaction participants to obtain the obfuscated credential;

[0180] A left signature generation module 820, configured to generate a left signature of the transaction information according to the obfuscated credential, the transaction information and the elliptic curve public parameters;

[0181] The temporary factor calculation module 830 is used to generate the sharding left parameter corresponding to each sharding parameter based on each sharding parameter and its corresponding confusion factor, and obtain the temporary factor corresponding to each sharding parameter according to the sum of the sharding left parameter corresponding to each sharding parameter and the confusion factor corresponding to each sharding parameter in other transaction participants; each sharding parameter is a randomly generated parameter with a length of the preset length, and the confusion factor is randomly generated data with a length of the preset length;

[0182] The obfuscation parameter acquisition module 840 is used to acquire a randomly generated obfuscation parameter group, wherein the number of obfuscation parameters included in the obfuscation parameter group is the same as the total number of the slice parameters, and the length of the obfuscation parameters included in the obfuscation parameter group is the preset length;

[0183] A right signature generation module 850, configured to generate a right signature of the transaction information according to the temporary factors corresponding to each shard parameter, the obfuscation parameter group and the left signature;

[0184] The signature combination module 860 is used to combine the left signature and the right signature to obtain signature data of the transaction information, and the signature data is used to verify the transaction information.

[0185] In one embodiment of the present application, the left signature generation module 820 is specifically used for:

[0186] Calculating the elliptic curve public parameters based on a cryptographic hash algorithm to obtain a signature credential factor;

[0187] Concatenate the signature credential factor and the transaction information to obtain a credential secret parameter;

[0188] Extracting the horizontal coordinate of the obfuscated credential, and calculating the data sum of the horizontal coordinate and the credential secret parameter;

[0189] The data and the modulus parameter in the elliptic curve public parameter are modulo each other to obtain the left signature of the transaction information.

[0190] In one embodiment of the present application, the left signature generation module 820 is specifically used for:

[0191] Randomly generate a private key fragment of the preset length;

[0192] Performing an elliptic curve point multiplication operation on the private key shard and the base point in the elliptic curve public parameter to obtain a public key shard;

[0193] Performing elliptic curve point addition operations on the public key shards and the public key shards of other transaction participants to obtain a public key;

[0194] The elliptic curve public parameters, preset data and the public key are spliced ​​to obtain spliced ​​data, and the spliced ​​data is calculated based on the cryptographic hash algorithm to obtain the signature credential factor.

[0195] In one embodiment of the present application, the sharding parameters include: one-time signature sharding, private key sharding, and signature obfuscation sharding; the temporary factor calculation module 830 is specifically used to:

[0196] Subtract the signature-once-passive sharding confusion factor from the signature-once-passive sharding to obtain the signature-once-passive sharding left parameter;

[0197] Subtract the private key shard confusion factor from the private key shard to obtain the private key shard left parameter;

[0198] The signature obfuscation fragment obfuscation factor is subtracted from the signature obfuscation fragment to obtain the signature obfuscation fragment left parameter.

[0199] In one embodiment of the present application, the temporary factor calculation module 830 is specifically used to:

[0200] Obtain a one-time pad temporary factor for the signature according to the sum of the left parameter of the one-time pad shard and the confusion factor of the one-time pad shards of other participants;

[0201] Obtain a temporary factor for a private key shard based on the sum of the private key shard left parameter and the private key shard confusion factor of other participants;

[0202] The signature obfuscation slice temporary factor is obtained according to the sum of the signature obfuscation slice left parameter and the signature obfuscation slice obfuscation factors of other participants.

[0203] In one embodiment of the present application, the obfuscation parameter acquisition module 840 is specifically used to:

[0204] Randomly generate a right signature left parameter obfuscated total parameter and a right signature right parameter obfuscated total parameter of the preset length;

[0205] According to the number of transaction participants, dividing the right signature left parameter obfuscated parameter into a plurality of right signature left parameter obfuscated parameters, and dividing the right signature right parameter obfuscated parameter into a plurality of right signature right parameter obfuscated parameters;

[0206] The obfuscated parameter group is obtained according to the right-signature-left-parameter obfuscated parameters and the right-signature-right-parameter obfuscated parameters corresponding to the transaction participants.

[0207] In one embodiment of the present application, the right signature generation module 850 includes:

[0208] A right signature left factor generating unit, used to generate a right signature left factor of the transaction information according to the temporary factors corresponding to each shard parameter and the obfuscation parameter group;

[0209] A right signature right factor generating unit, used to generate a right signature right factor of the transaction information according to the temporary factors corresponding to each shard parameter and the left signature;

[0210] The summarizing unit is used to summarize the right signature left factor and the right signature right factor to obtain the right signature of the transaction information.

[0211] In one embodiment of the present application, the temporary factors corresponding to the various sharding parameters include the signature one-time pad sharding temporary factor and the private key sharding temporary factor; the obfuscation parameter group includes the first part of the right signature left parameter obfuscated first factor, the first part of the right signature left parameter obfuscated second factor, and the first part of the right signature left parameter obfuscated third factor;

[0212] The right signature left factor generation unit is specifically used for:

[0213] The private key sharding temporary factor is increased by a set value to obtain a private key sharding offset temporary factor;

[0214] Subtract the first part of the right signature left parameter obfuscated first factor from the private key shard offset temporary factor to obtain the right signature obfuscated first shard left parameter;

[0215] Subtract the first part of the second factor of the right signature left parameter obfuscation from the signature one-time pad shard temporary factor to obtain the right signature obfuscated first shard right parameter;

[0216] Summarize the right signatures of all transaction participants and the left parameters of the first shard to obtain the right signature and the left parameters of the first shard summary parameter, and summarize the right signatures of all transaction participants and the right parameters of the first shard to obtain the right signature and the right parameters of the first shard summary parameter;

[0217] The right signature obfuscated first slice right parameter is obtained according to the product of the first part of the second factor of the right signature left parameter obfuscation and the right signature obfuscated first slice left parameter summary parameter, the product of the first part of the right signature left parameter obfuscation first factor and the right signature obfuscated first slice right parameter summary parameter, the product of the right signature obfuscated first slice left parameter summary parameter and the right signature obfuscated first slice right parameter summary parameter, and the sum of the right signature left parameter obfuscation third factor.

[0218] In one embodiment of the present application, the temporary factors corresponding to the various sharding parameters include a signature one-time pad temporary factor, a private key sharding temporary factor, and a signature obfuscation sharding temporary factor; the obfuscation parameter group includes the first part of the right signature right parameter obfuscated first factor, the first part of the right signature right parameter obfuscated second factor, and the first part of the right signature right parameter obfuscated third factor;

[0219] The right signature right factor generation unit is specifically used for:

[0220] Subtract the product of the private key sharding temporary factor and the left signature from the signature obfuscation sharding temporary factor to obtain a right signature temporary offset factor;

[0221] Subtract the first part of the right signature right parameter obfuscated first factor from the right signature temporary offset factor to obtain the right signature obfuscated second fragment left parameter;

[0222] Subtract the first part of the right signature right parameter obfuscated second factor from the signature one-time pad temporary factor to obtain the right signature obfuscated second fragment right parameter;

[0223] Aggregate the right-signature-obfuscated second fragment left parameter with the right-signature-obfuscated second fragment left parameter of other transaction participants to obtain a right-signature-obfuscated second fragment left parameter summary parameter, and aggregate the right-signature-obfuscated second fragment right parameter with the right-signature-obfuscated second fragment right parameter of other transaction participants to obtain a right-signature-obfuscated second fragment right parameter summary parameter;

[0224] The right signature right factor of the transaction information is obtained according to the product of the first part of the right signature right parameter obfuscated second factor and the right signature obfuscated second shard left parameter summary parameter, the product of the first part of the right signature right parameter obfuscated first factor and the right signature obfuscated second shard right parameter summary parameter, the product of the right signature obfuscated second shard left parameter summary parameter and the right signature obfuscated second shard right parameter summary parameter, and the right signature right parameter obfuscated third factor.

[0225] In one embodiment of the present application, the aggregation unit is specifically used for:

[0226] Calculate the sum of the right signature left factor and the right signature left factors of other transaction participants to obtain a summary sum of the right signature left factors;

[0227] Calculate the sum of the right signature right factor and the right signature right factors of other transaction participants to obtain the summary sum of the right signature right factors;

[0228] The left factors of the right signature are aggregated and inverted, and then aggregated and multiplied with the right factors of the right signature to obtain the right signature of the transaction information.

[0229] The specific details of the transaction signature device provided in each embodiment of the present application have been described in detail in the corresponding method embodiment and will not be repeated here.

[0230] Fig. 9 The structure block diagram of a computer system for implementing an electronic device according to an embodiment of the present application is schematically shown.

[0231] It should be noted that Fig. 9 The computer system 900 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0232] like Fig. 9 As shown, the computer system 900 includes a central processing unit 901 (CPU), which can perform various appropriate actions and processes according to the program stored in the read-only memory 902 (ROM) or the program loaded from the storage part 908 to the random access memory 903 (RAM). Various programs and data required for system operation are also stored in the random access memory 903. The central processing unit 901, the read-only memory 902 and the random access memory 903 are connected to each other through a bus 904. An input / output interface 905 (Input / Output interface, i.e., I / O interface) is also connected to the bus 904.

[0233] The following components are connected to the input / output interface 905: an input section 906 including a keyboard, a mouse, etc.; an output section 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, a modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 910 as needed so that a computer program read therefrom is installed into the storage section 908 as needed.

[0234] In particular, according to an embodiment of the present application, the process described in each method flow chart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer readable medium, and the computer program contains a program code for executing the method shown in the flow chart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 909, and / or installed from the removable medium 911. When the computer program is executed by the central processor 901, various functions defined in the system of the present application are executed.

[0235] It should be noted that the computer-readable medium shown in the embodiment of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by an instruction execution system, device or device or used in combination with it. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0236] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the above-mentioned module, program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0237] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0238] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the implementation methods of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation methods of the present application.

[0239] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary technical means in the art that are not disclosed in the present application.

[0240] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A transaction signature method, characterized in that: Applied to a transaction participant, the method comprises: Perform elliptic curve point multiplication on the randomly generated signature obfuscated fragments of preset length according to the elliptic curve public parameters to obtain an obfuscated public certificate, and summarize the obfuscated public certificates of all transaction participants to obtain an obfuscated certificate; Generate a left signature of the transaction information according to the obfuscated credential, the transaction information and the elliptic curve public parameters; Based on each sharding parameter and its corresponding confusion factor, a sharding left parameter corresponding to each sharding parameter is generated, and according to the sum of the sharding left parameter corresponding to each sharding parameter and the confusion factor corresponding to each sharding parameter in other transaction participants, a temporary factor corresponding to each sharding parameter is obtained; each sharding parameter is a randomly generated parameter with a length of the preset length, and the confusion factor is randomly generated data with a length of the preset length; Obtaining a randomly generated obfuscation parameter group, wherein the number of obfuscation parameters included in the obfuscation parameter group is the same as the total number of the slice parameters, and the length of the obfuscation parameters included in the obfuscation parameter group is the preset length; Generate a right signature of the transaction information according to the temporary factors corresponding to each shard parameter, the obfuscation parameter group and the left signature; The left signature and the right signature are combined to obtain signature data of the transaction information, and the signature data is used to verify the transaction information.

2. The transaction signature method according to claim 1, characterized in that: Generating a left signature of the transaction information according to the obfuscated credential, the transaction information and the elliptic curve public parameter, including: Calculating the elliptic curve public parameters based on a cryptographic hash algorithm to obtain a signature credential factor; Concatenate the signature credential factor and the transaction information to obtain a credential secret parameter; Extracting the horizontal coordinate of the obfuscated credential, and calculating the data sum of the horizontal coordinate and the credential secret parameter; The data and the modulus parameter in the elliptic curve public parameter are modulo each other to obtain the left signature of the transaction information.

3. The transaction signature method according to claim 2, characterized in that: The elliptic curve public parameters are calculated based on a cryptographic hash algorithm to obtain a signature credential factor, including: Randomly generate a private key fragment of the preset length; Performing an elliptic curve point multiplication operation on the private key shard and the base point in the elliptic curve public parameter to obtain a public key shard; Performing elliptic curve point addition operations on the public key shards and the public key shards of other transaction participants to obtain a public key; The elliptic curve public parameters, preset data and the public key are spliced ​​to obtain spliced ​​data, and the spliced ​​data is calculated based on the cryptographic hash algorithm to obtain the signature credential factor.

4. The transaction signature method according to claim 1, characterized in that: The sharding parameters include: one-time signature sharding, private key sharding and signature obfuscation sharding; based on the sharding parameters and their corresponding obfuscation factors, the sharding left parameters corresponding to the sharding parameters are generated, including: Subtract the signature-once-passive sharding confusion factor from the signature-once-passive sharding to obtain the signature-once-passive sharding left parameter; Subtract the private key shard confusion factor from the private key shard to obtain the private key shard left parameter; The signature obfuscation fragment obfuscation factor is subtracted from the signature obfuscation fragment to obtain the signature obfuscation fragment left parameter.

5. The transaction signature method according to claim 4, characterized in that: According to the sum of the shard left parameters corresponding to each shard parameter and the confusion factors corresponding to each shard parameter in other transaction participants, the temporary factors corresponding to each shard parameter are obtained, including: Obtain a one-time pad temporary factor for the signature according to the sum of the left parameter of the one-time pad shard and the confusion factor of the one-time pad shards of other participants; Obtain a temporary factor for a private key shard based on the sum of the private key shard left parameter and the private key shard confusion factor of other participants; The signature obfuscation slice temporary factor is obtained according to the sum of the signature obfuscation slice left parameter and the signature obfuscation slice obfuscation factors of other participants.

6. The transaction signature method according to claim 1, characterized in that: Get a randomly generated obfuscation parameter group, including: Randomly generate a right signature left parameter obfuscated total parameter and a right signature right parameter obfuscated total parameter of the preset length; According to the number of transaction participants, dividing the right-signature-left-parameter obfuscated parameter into a plurality of right-signature-left-parameter obfuscated parameters, and dividing the right-signature-right-parameter obfuscated parameter into a plurality of right-signature-right-parameter obfuscated parameters; The obfuscated parameter group is obtained according to the right-signature-left-parameter obfuscated parameters and the right-signature-right-parameter obfuscated parameters corresponding to the transaction participants.

7. The transaction signature method according to claim 1, characterized in that: Generating a right signature of the transaction information according to the temporary factors corresponding to each shard parameter, the obfuscation parameter group and the left signature, including: Generate a right signature left factor of the transaction information according to the temporary factors corresponding to each shard parameter and the obfuscation parameter group; Generate the right signature right factor of the transaction information according to the temporary factors corresponding to each shard parameter and the left signature; The right signature left factor and the right signature right factor are aggregated to obtain the right signature of the transaction information.

8. The transaction signature method according to claim 6, characterized in that: The temporary factors corresponding to the various sharding parameters include the signature one-time pad sharding temporary factor and the private key sharding temporary factor; the obfuscation parameter group includes the first part of the right signature left parameter obfuscated first factor, the first part of the right signature left parameter obfuscated second factor, and the first part of the right signature left parameter obfuscated third factor; The right signature left factor of the transaction information is generated according to the temporary factors corresponding to each shard parameter and the obfuscation parameter group, including: The private key sharding temporary factor is increased by a set value to obtain a private key sharding offset temporary factor; Subtract the first part of the right signature left parameter obfuscated first factor from the private key shard offset temporary factor to obtain the right signature obfuscated first shard left parameter; Subtract the first part of the second factor of the right signature left parameter obfuscation from the signature one-time pad shard temporary factor to obtain the right signature obfuscated first shard right parameter; Summarize the left parameters of the first shard of the right signatures of all transaction participants to obtain the right signature obfuscated first shard left parameter summary parameter, and summarize the right parameters of the first shard of the right signatures of all transaction participants to obtain the right signature obfuscated first shard right parameter summary parameter; The right signature obfuscated first slice right parameter is obtained according to the product of the first part of the second factor of the right signature left parameter obfuscation and the right signature obfuscated first slice left parameter summary parameter, the product of the first part of the right signature left parameter obfuscation first factor and the right signature obfuscated first slice right parameter summary parameter, the product of the right signature obfuscated first slice left parameter summary parameter and the right signature obfuscated first slice right parameter summary parameter, and the sum of the right signature left parameter obfuscation third factor.

9. The transaction signature method according to claim 6, characterized in that: The temporary factors corresponding to the slice parameters include the signature one-time pad temporary factor, the private key slice temporary factor and the signature obfuscation slice temporary factor; the obfuscation parameter group includes the first part of the right signature right parameter obfuscation first factor, the first part of the right signature right parameter obfuscation second factor and the first part of the right signature right parameter obfuscation third factor; Generate the right signature right factor of the transaction information according to the temporary factors corresponding to each shard parameter and the left signature, including: Subtract the product of the private key sharding temporary factor and the left signature from the signature obfuscation sharding temporary factor to obtain a right signature temporary offset factor; Subtract the first part of the right signature right parameter obfuscated first factor from the right signature temporary offset factor to obtain the right signature obfuscated second fragment left parameter; Subtract the first part of the right signature right parameter obfuscated second factor from the signature one-time pad temporary factor to obtain the right signature obfuscated second fragment right parameter; Aggregate the right-signature-obfuscated second fragment left parameter with the right-signature-obfuscated second fragment left parameter of other transaction participants to obtain a right-signature-obfuscated second fragment left parameter summary parameter, and aggregate the right-signature-obfuscated second fragment right parameter with the right-signature-obfuscated second fragment right parameter of other transaction participants to obtain a right-signature-obfuscated second fragment right parameter summary parameter; The right signature right factor of the transaction information is obtained according to the product of the first part of the right signature right parameter obfuscated second factor and the right signature obfuscated second shard left parameter summary parameter, the product of the first part of the right signature right parameter obfuscated first factor and the right signature obfuscated second shard right parameter summary parameter, the product of the right signature obfuscated second shard left parameter summary parameter and the right signature obfuscated second shard right parameter summary parameter, and the right signature right parameter obfuscated third factor.

10. The transaction signature method according to claim 6, characterized in that: The right signature left factor and the right signature right factor are aggregated to obtain the right signature of the transaction information, including: Calculate the sum of the right signature left factor and the right signature left factors of other transaction participants to obtain a summary sum of the right signature left factors; Calculate the sum of the right signature right factor and the right signature right factors of other transaction participants to obtain the summary sum of the right signature right factors; The left factors of the right signature are aggregated and inverted, and then aggregated and multiplied with the right factors of the right signature to obtain the right signature of the transaction information.

Images