Data transaction security and privacy protection method based on zero-knowledge proof smart contract

Abstract

The present invention relates to a data transaction security and privacy protection method based on a zero-knowledge proof smart contract, comprising: initializing blockchain parameters; a seller and a buyer registering their privacy identities with a trusted regulatory agency; the seller generating a zero-knowledge proof of the ownership relationship of the data to be sold and a data ownership proof contract, uploading {α, #imgabs0#T1, sign1} to the chain, and obtaining an on-chain address; the seller generating a zero-knowledge proof of a contract for preventing processability attacks, and verifying it based on the on-chain information, and publishing information about the data to be sold after passing the verification; the buyer requesting the seller to purchase the data, and the buyer generating a zero-knowledge proof of a data ownership privacy transfer proof contract based on the new ownership relationship calculated by the seller, and verifying it, obtaining a ciphertext storage address of the purchased data, and uploading {α, #imgabs1#T2, AddrM new ,addr id , sign2} on the chain. The present invention has better security and privacy features.

Description

Technical Field

[0001] The present invention relates to the technical field of data security and privacy protection, and in particular to a data transaction security and privacy protection method based on zero-knowledge proof smart contracts. Background Art

[0002] The data trading market plays an important role in data transactions. It can provide data trading participants with services such as data hosting, transaction matching, and demand matching, helping data providers and data consumers to complete data transactions quickly and efficiently. The security and privacy protection of data transactions should meet the following requirements:

[0003] (1) Identity privacy protection: The true identities of the data owner and buyer are private and secure, and the data transaction process will not disclose the true identity information of either party.

[0004] (2) Data privacy protection: Data should not be stored and circulated in the trading market in plain text.

[0005] (3) Protection of data ownership: Data transactions should include the transfer of data ownership, and data ownership should be confirmed and traceable throughout the data lifecycle to protect the rights and interests of data owners. In addition, data ownership is usually bound to identity. To be compatible with identity privacy protection, the confirmation and tracing of data ownership should not reveal the identity of the owner and purchaser (privacy confirmation and tracing).

[0006] (4) Privacy protection of commercial activities: Except for the data owner and the data buyer, no one can know to whom the ownership of the data is transferred after the transaction.

[0007] (5) The transaction process is secure and reliable: Transaction services should be open and transparent, and be traceable, auditable and controllable.

[0008] In recent years, various security and privacy protection methods have been proposed to ensure the security and privacy of data transactions. For example, homomorphic encryption and signature verification mechanisms protect the privacy of consumers' bids and identities during data transactions. Ring signatures and similarity learning are also used to protect the identity privacy of participants. However, these traditional methods are mostly based on centralized architectures, making it difficult to ensure decentralized, secure, transparent transactions and traceability of actions and ownership. Therefore, blockchain-based decentralized data transaction security and privacy protection systems have also been proposed, such as the secure data transaction ecosystem based on blockchain and Software Guard Extensions (SGX). This system places data processing operations within open and transparent blockchain smart contracts. To protect the security of the original data, the Ethereum Virtual Machine (EVM) that executes the smart contracts is placed in the SGX environment. Privacy-preserving computing ensures the privacy of the transaction process. Buyers cannot directly access the original data and only receive processed results.

[0009] Although existing decentralized solutions have improved security and privacy protection compared to centralized secure and private transaction solutions, no research has fully considered the above five challenges. Summary of the Invention

[0010] The purpose of the present invention is to provide a data transaction security and privacy protection method based on zero-knowledge proof smart contracts, introduce zero-knowledge proof smart contracts that can be executed on the chain, and combine Merkle Tree Proof of Reserves (MTPR), proxy re-encryption, and an unalterable and traceable blockchain distributed ledger to construct a data transaction security and privacy protection method based on zero-knowledge proof smart contracts.

[0011] To achieve the above object, the present invention provides the following solutions:

[0012] Data transaction security and privacy protection methods based on zero-knowledge proof smart contracts include:

[0013] Initialize blockchain parameters;

[0014] The seller and buyer request to register their private identity with a trusted regulatory body. The trusted regulatory body verifies the private identity and signs the verified private identity and returns it to the seller and buyer.

[0015] The seller generates a zero-knowledge proof of the ownership of the data to be sold and a data ownership proof contract, encrypts and stores the data to be sold, and obtains a ciphertext hash address. The seller submits the zero-knowledge proof of the data ownership proof contract and the ciphertext hash address to the trusted regulatory agency for verification. After verification, the first target information is uploaded to the chain and the chain address is obtained;

[0016] The seller generates a zero-knowledge proof of the contract to prevent machinability attacks and requests the data market to publish the information of the data to be sold. The data market verifies the zero-knowledge proof of the contract to prevent machinability attacks based on the first target information on the chain. After the verification is passed, the data market publishes the information of the data to be sold.

[0017] The buyer requests the seller to purchase data. The buyer generates a zero-knowledge proof of the data ownership privacy transfer proof contract based on the new ownership relationship calculated by the seller. The trusted regulatory agency verifies the zero-knowledge proof of the data ownership privacy transfer proof contract. After the verification is passed, the purchase data is encrypted and stored, the ciphertext storage address of the purchase data is obtained, and the second target information is put on the chain, where the first target information is The second target information is α is the unique identifier of the original data, i.e. the data to be sold m, Data ownership R α As the root of the Merkle hash tree constructed as a leaf node, T1 is the current timestamp registered on the data chain, sign1 is The signature of addr id is the on-chain address, The root of the Merkle hash tree calculated after the seller changes the data ownership to the buyer, sign2 is 's signature.

[0018] Optionally, the seller requests a trusted regulatory agency to register a private identity, and the trusted regulatory agency verifies the private identity including:

[0019] The seller generates a seller private key and a seller public key;

[0020] The seller generates a seller random number and a random number for preventing processability attacks, and calculates a hash value of the seller's private identity and the random number for preventing processability attacks;

[0021] The seller's private identity is used as a public input, the seller's private key and the seller's random number are used as private inputs, and a zero-knowledge proof of the seller's private identity proof contract is generated based on the proof key;

[0022] The seller submits the seller's public key, the seller's random number, the zero-knowledge proof of the seller's private identity certification contract, and the hash value of the random number that prevents processability attacks to the trusted regulatory agency to request registration of the private identity;

[0023] The trusted regulatory agency proves that the seller is the holder of the seller's public key and the seller's random number based on the zero-knowledge proof of the seller's private identity proof contract.

[0024] Optionally, the seller generates a zero-knowledge proof of ownership of the data to be sold and a data ownership proof contract, including:

[0025] The seller obtains a unique identifier of the data to be sold by performing multiple hash value calculations on the data to be sold;

[0026] Calculate the hash value of the unique identifier of the data to be sold and the private identity of the seller to obtain the ownership relationship;

[0027] Constructing a Merkle Hash tree with the ownership relationship as the leaf node, and calculating the root of the Merkle Hash tree and the auxiliary authentication information of the leaf node;

[0028] The seller's private identity, the root of the Merkle hash tree and the unique identifier of the data to be sold are used as public inputs, and the seller's private key, the seller's random number, the auxiliary authentication information of the leaf node, the root of the Merkle hash tree and the hash value of the data to be sold are used as private inputs, and a zero-knowledge proof of the data ownership proof contract is generated based on the proof key.

[0029] Optionally, encrypting and storing the data to be sold, and obtaining a ciphertext hash address includes:

[0030] Perform proxy re-encryption on the seller's private key and the seller's public key to generate the seller's re-encrypted private key and public key;

[0031] The sales data is encrypted using the seller's re-encryption public key to obtain a ciphertext and store it in a distributed storage system to obtain the ciphertext hash address.

[0032] Optionally, the seller generates a zero-knowledge proof of the contract to prevent processability attacks, including:

[0033] The seller will use the seller's private identity, the root of the Merkle hash tree, the unique identifier of the data to be sold and the hash value of the random number to prevent machinability attacks as public inputs, and the seller's private key, the seller's random number, the auxiliary authentication information of the leaf node, the ownership relationship, the random number to prevent machinability attacks and the hash value of the data to be sold as private inputs, and generate a zero-knowledge proof of the contract to prevent machinability attacks based on the proof key.

[0034] Optionally, the data market verifies the zero-knowledge proof of the contract for preventing processability attacks based on the first target information on the chain, including:

[0035] The data market extracts the root of the Merkle hash tree and the unique identifier of the data to be sold from the zero-knowledge proof of the processability attack prevention contract, searches for the first target information corresponding to the latest timestamp on the chain, and verifies the validity of sign1 using the public key of the trusted regulatory agency;

[0036] After the verification is passed, the trusted regulatory agency calls the zero-knowledge proof of the contract for preventing processability attacks to verify that the seller is the holder of the seller's private identity and the unique identifier of the data to be sold.

[0037] Optionally, the buyer requesting the seller to purchase data includes:

[0038] The buyer's private identity is used as a public input, the buyer's private key and the buyer's random number are used as private inputs, and a zero-knowledge proof of the buyer's private identity proof contract is generated based on the proof key;

[0039] The buyer's private key and public key are proxy-re-encrypted, and the buyer sends the proxy-re-encrypted buyer's public key, the zero-knowledge proof of the buyer's private identity certification contract, and the signature of the buyer's private identity to the seller, requesting to purchase the data;

[0040] The seller calls the zero-knowledge proof of the privacy identity certification contract and uses the public key of the trusted regulatory agency to verify the validity of the signature of the buyer's privacy identity, verifying that the buyer is the holder of a privacy identity registered with the trusted regulatory agency.

[0041] Optionally, the buyer generates a zero-knowledge proof of the data ownership privacy transfer proof contract based on the new ownership relationship calculated by the seller, including:

[0042] The seller calculates the new ownership relationship based on the private identity of the buyer and the hash value of the unique identifier of the data to be sold, and calculates a new Merkle tree root based on the new ownership relationship and the auxiliary authentication information of the leaf node;

[0043] The seller sends the new ownership relationship, the new Merkle tree root and the auxiliary authentication information of the leaf node to the buyer;

[0044] The buyer takes the root of the Merkle hash tree, the new Merkle root, the seller's private identity and the unique identifier of the data to be sold as public input, and takes the buyer's private identity, the seller's private key, the seller's random number, the auxiliary authentication information of the leaf node, the ownership relationship, the new ownership relationship and the hash value of the data to be sold as private input, and generates a zero-knowledge proof of the data ownership privacy transfer proof contract based on the proof key.

[0045] Optionally, the trusted regulatory agency verifies the zero-knowledge proof of the data ownership privacy transfer proof contract, and encrypts and stores the purchased data after the verification is passed, including:

[0046] The seller generates a proxy re-encryption key based on the seller's re-encryption private key and the buyer's re-encryption public key;

[0047] The seller sends the zero-knowledge proof of the data ownership privacy transfer proof contract and the proxy re-encryption key to the trusted regulatory agency. The trusted regulatory agency invokes the zero-knowledge proof of the data ownership privacy transfer proof contract to verify the seller's privacy identity and the holder of the unique identifier of the data to be sold. At the same time, it verifies whether the seller transfers the ownership of the original data to the buyer without revealing the buyer's privacy identity, and generates a new ownership relationship.

[0048] After the verification is passed, the trusted regulatory agency obtains the ciphertext corresponding to the unique identifier of the data to be sold from the distributed storage system based on the ciphertext hash address;

[0049] The ciphertext is converted into a new ciphertext using the proxy re-encryption key, stored in a distributed storage system, and a new ciphertext hash address is obtained.

[0050] Optionally, the second target information is uploaded to the chain to form an evidence chain for ownership tracing, which is used for ownership tracing and auditing.

[0051] The beneficial effects of the present invention are as follows: the present invention provides a decentralized data transaction security and privacy protection method based on zero-knowledge proof, proxy re-encryption, and blockchain technology, aiming to address issues such as identity privacy leakage of participants in data transactions, privacy leakage of transaction data, difficulty in confirming and tracing ownership of transaction data, privacy leakage of transaction business behavior, and lack of trust in the transaction process. First, the present invention utilizes the one-way and collision-resistant properties of hash functions and the Merkle tree reserve proof's ability to effectively manage a large number of leaf nodes and prove existence. It constructs identity privacy proof, ownership privacy confirmation, and ownership privacy transfer smart contracts based on the Groth16 zero-knowledge proof algorithm. Based on these open and transparent smart contracts, it achieves on-chain identity privacy protection, ownership privacy confirmation, and transaction business privacy protection, ensuring the security and trustworthiness of the transaction process. Second, the present invention introduces proxy re-encryption into the data transaction process, and combined with the immutable and traceable characteristics of the blockchain distributed ledger, encrypts the transaction data and constructs a tracking evidence chain for related private ownership information, achieving privacy protection of transaction data and tracing of ownership. Thirdly, the present invention considers the problem of processability attacks on the Groth16 zero-knowledge proof algorithm, constructs a smart contract that resists processability attacks, avoids the occurrence of processability attacks in the process of confirming ownership privacy, and further ensures data transaction and privacy security (compared to the current research on zero-knowledge proof using Groth16, this invention considers the problem of processability attacks for the first time and has better security). Finally, the present invention proves that the proposed method meets the requirements of identity privacy protection, transaction data privacy protection, transaction data ownership protection, transaction business behavior privacy protection, and transaction process security and reliability, and evaluates that the method has low on-chain computing overhead and storage overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0053] Figure 1 This is a flow chart of a data transaction security and privacy protection method based on a zero-knowledge proof smart contract according to an embodiment of the present invention;

[0054] Figure 2 A statistical graph of gas consumption for different smart contracts deployed in an embodiment of the present invention;

[0055] Figure 3 This is a statistical chart of the execution time of different smart contracts in an embodiment of the present invention;

[0056] Figure 4 A statistical chart of gas consumption for different smart contracts executed in an embodiment of the present invention;

[0057] Figure 5 This is an on-chain storage cost graph of the ownership tracking evidence chain according to an embodiment of the present invention;

[0058] Figure 6 A comparison chart of the execution time consumed by two transactions according to an embodiment of the present invention;

[0059] Figure 7 A comparison chart of smart contract execution consumption between the method according to an embodiment of the present invention and two existing methods;

[0060] Figure 8 A comparison chart of smart contract execution time between the method according to an embodiment of the present invention and two existing methods;

[0061] Figure 9 This is a flowchart of Zokrates completing zero-knowledge proof in an embodiment of the present invention. DETAILED DESCRIPTION

[0062] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0063] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0064] This embodiment provides a data transaction security and privacy protection method based on zero-knowledge proof smart contracts, including:

[0065] Initialize blockchain parameters;

[0066] The seller and buyer request to register their private identity with the trusted regulatory body. The trusted regulatory body verifies the private identity and signs and returns the verified private identity to the seller and buyer.

[0067] The seller generates a zero-knowledge proof of ownership of the data to be sold and a data ownership proof contract, encrypts and stores the data to be sold, and obtains a ciphertext hash address. The seller submits the zero-knowledge proof of the data ownership proof contract and the ciphertext hash address to a trusted regulatory agency for verification. After verification, the first target information is uploaded to the chain and the on-chain address is obtained.

[0068] The seller generates a zero-knowledge proof for the contract that prevents machinability attacks and requests the data market to publish information about the data to be sold. The data market verifies the zero-knowledge proof of the contract based on the first target information on the chain. After verification, the data market publishes the information about the data to be sold.

[0069] The buyer requests the seller to purchase data. The buyer generates a zero-knowledge proof of the data ownership privacy transfer proof contract based on the new ownership relationship calculated by the seller. The trusted regulatory agency verifies the zero-knowledge proof of the data ownership privacy transfer proof contract. After the verification is passed, the purchased data is encrypted and stored, the ciphertext storage address of the purchased data is obtained, and the second target information is put on the chain. Among them, the first target information is The second target information is α is the unique identifier of the original data, i.e. the data to be sold m, R α As the root of the Merkle hash tree constructed as a leaf node, T1 is the current timestamp registered on the data chain, sign1 is The signature of addr id is the on-chain address, The root of the Merkle hash tree calculated after the seller changes the data ownership to the buyer, sign2 is 's signature.

[0070] Specifically, the method proposed in this embodiment includes: 4 entity roles, blockchain smart contracts, data ownership tracking evidence chain, InterPlanetary File System IPFS, and data ownership management Merkle hash tree.

[0071] Entity roles:

[0072] (1) Seller: The seller is the provider of data and will sell data through the data trading market. To protect identity privacy, the seller will hide the real identity through zero-knowledge proof; to protect data privacy, the seller will encrypt the data using proxy re-encryption; to protect data ownership, the seller will manage data ownership through Merkle hash tree, and combine zero-knowledge proof and blockchain distributed ledger to confirm and trace the ownership privately; to protect commercial privacy, the seller will use zero-knowledge proof to transfer data ownership privately while hiding the identity of the data buyer.

[0073] (2) Buyers: Buyers are data demanders who use the data market to discover and purchase data. Buyers also use zero-knowledge proofs to hide their true identities and conduct transactions based on their private identities. In addition, after obtaining ownership of the data, buyers can also become sellers and sell the purchased data through the data market.

[0074] (3) Trusted Regulatory Agency: This embodiment assumes that the trusted regulatory agency is an honest and trustworthy authority. It will serve as a trust root, sign and endorse the privacy traceability information, and store the signed and endorsed information in an immutable blockchain distributed ledger. To achieve privacy traceability and the security and trustworthiness (regulatory) of the transaction process, the trusted regulatory agency can trace and audit the privacy identities of the seller and buyer, the previous transfer of data ownership (the current ownership transfer is unknown to others except the seller and buyer), etc.

[0075] (4) Data Market: The data market mainly publishes data description information for sellers and matches the required data for buyers. It does not participate in direct data transactions. Operations related to data transactions and ownership transfers are completed in an open and transparent blockchain to ensure the security and reliability of transactions.

[0076] Blockchain Smart Contracts:

[0077] This embodiment will be based on Figure 1 The four smart contracts shown here complete the on-chain public trusted verification of zero-knowledge proofs. The five smart contracts are generated by the arithmetic circuit constraint equations shown in Algorithms 2 to 5. The specific contracts include:

[0078] (1) Private identity proof contract PriIDHolderSc. This contract can prove the holder of the private identity (private public key) without revealing the private key. The corresponding constraint equation is Algorithm 2.

[0079] (2) Data ownership proof contract PriOwnerSc. This contract can prove the private identity (private public key) and the owner of the data (privacy confirmation of data) without revealing the private key and data ownership related authentication information (ownership management Merkle hash tree auxiliary authentication information). The corresponding constraint equation is Algorithm 3.

[0080] (3) Data ownership privacy transfer proof contract PriAuthorizeSc. This contract can prove that data ownership has been transferred to the buyer without revealing the buyer's privacy identity (private transfer of data ownership, protecting the privacy of commercial behavior). Its corresponding constraint equation is Algorithm 4.

[0081] (4) Preventing processability attacks on the contract PriOwner1Sc. This contract is used to prevent processability attacks on the Groth16 zero-knowledge proof. Because for the Groth16 zero-knowledge proof algorithm, although it meets zero-knowledge, completeness and reliability, there is a processability attack, that is, an attacker who has seen a valid zero-knowledge proof π can forge a different, but still valid zero-knowledge proof π'. In other words, if a zero-knowledge proof needs to be verified more than twice in the smart contract, a processability attack may occur during the verification process. Since this embodiment requires two verifications of the ownership of the same data, this embodiment constructs a zero-knowledge proof smart contract with different public inputs from the data ownership proof contract PriOwnerSc to prevent processability attacks.

[0082] InterPlanetary File System (IPFS): To ensure data security and privacy, all transaction data in this embodiment will be stored in ciphertext (proxy-re-encrypted ciphertext) on the distributed InterPlanetary File System (IPFS), and the ciphertext hash address will be obtained. At the same time, the ciphertext hash address will be stored in the blockchain distributed ledger by a trusted regulatory agency to ensure data credibility.

[0083] Data ownership management Merkle hash tree:

[0084] In this embodiment, data ownership is represented by the unique identifier α of the data and the privacy identity (privacy public key) of the data owner pk pri-Seller Binding relationship R α =h(pk pri ||α). At the same time, the binding relationship will be used as a leaf node to construct a data ownership management Merkle hash tree. Based on this structure, each seller can create a Merkle hash tree to manage data ownership and do not disclose the specific binding relationship R α and auxiliary authentication information In the case of data ownership transfer, it proves that the data is owned by the holder. On the other hand, after the ownership of the data is transferred, the binding relationship will change. Bα =h(pk Bpri ||α), but auxiliary authentication information unchanged, at this time, it is necessary to use the new binding relationship and auxiliary authentication information Calculate the new tree root and complete the proof of data ownership.

[0085] Furthermore, the seller requests the trusted regulatory agency to register the private identity. The trusted regulatory agency verifies the private identity by:

[0086] The seller generates a seller private key and a seller public key;

[0087] The seller generates a seller random number and a random number to prevent processability attacks, and calculates the hash value of the seller's private identity and the random number to prevent processability attacks;

[0088] The seller's private identity is used as public input, the seller's private key and the seller's random number are used as private input, and based on the proof, the key generates a zero-knowledge proof of the seller's private identity proof contract;

[0089] The seller submits the seller's public key, the seller's random number, the zero-knowledge proof of the seller's privacy identity certification contract, and the hash value of the random number to prevent machinability attacks to the trusted regulatory agency to request registration of the privacy identity;

[0090] The trusted regulatory agency proves that the seller is the holder of the seller's public key and the seller's random number based on the zero-knowledge proof of the seller's private identity contract.

[0091] Specifically, all sellers and buyers who intend to participate in data sales and purchases need to register their privacy identities with a trusted regulatory agency. pri-Seller ,pk pri-Buyer The trusted regulatory agency will verify the private identity and sign the verified private identity. Re (pk pri-Seller ),sig Re (pk pri-Buyer ), and then returns it to the seller and buyer to indicate that the private identity registration is successful. This embodiment assumes that the regulatory agency is trustworthy and knows the private identity pk pri-Seller ,pk pri-Buyer Corresponding real identity pk Seller ,pk Buyer , for ownership tracing and auditing, etc. However, trusted regulatory agencies cannot know to whom the current seller has transferred the data ownership, thus protecting the privacy of commercial activities.

[0092] Furthermore, the seller generates a zero-knowledge proof of ownership of the data to be sold and the data ownership proof contract, including:

[0093] The seller performs multiple hash calculations on the data to be sold to obtain a unique identifier for the data to be sold;

[0094] The unique identifier of the data to be sold and the seller's private identity are hashed to obtain the ownership relationship;

[0095] Construct a Merkle hash tree with ownership relationships as leaf nodes, and calculate the root of the Merkle hash tree and auxiliary authentication information of the leaf nodes;

[0096] The seller's private identity, the root of the Merkle hash tree, and the unique identifier of the data to be sold are used as public inputs, and the seller's private key, the seller's random number, the auxiliary authentication information of the leaf node, the root of the Merkle hash tree, and the hash value of the data to be sold are used as private inputs. A zero-knowledge proof of data ownership proof contract is generated based on the proof key.

[0097] In this embodiment, the data seller generates the ownership relationship R of the data m to be sold. α and zero-knowledge proof of data ownership π Owner (This zero-knowledge proof can prove that it is a private identity pk without revealing the real identity pri-Seller and data ownership R α The Merkle tree reserve proof algorithm is shown in Algorithm 1 in Table 1.

[0098] Table 1

[0099]

[0100] Furthermore, the data to be sold is encrypted and stored, and the ciphertext hash address is obtained including:

[0101] Perform proxy re-encryption on the seller's private key and the seller's public key to generate the seller's re-encrypted private key and public key;

[0102] The seller's re-encryption public key is used to encrypt the sales data, obtain the ciphertext and store it in the distributed storage system, and obtain the ciphertext hash address.

[0103] In this embodiment, the seller uses the proxy to re-encrypt the public key Ppk seller Encrypt the data to obtain the ciphertext M, store the data ciphertext M in IPFS, and obtain the IPFS storage address AddrM. The seller submits πOwner and AddrM to the trusted regulatory agency to prove the ownership relationship R α The owner of the property and requests the trusted regulatory agency to provide key information proving ownership The blockchain registration provides a basis for the credible proof of ownership in the subsequent data sales. After the trusted regulatory agency verifies the validity of the πOwner, it obtains the current timestamp T1 and Sign sign1, and On the chain, get The on-chain address addr id .

[0104] Furthermore, the seller generates a zero-knowledge proof to prevent the contract from being attacked by processability, including:

[0105] The seller will use the seller's private identity, the root of the Merkle hash tree, the unique identifier of the data to be sold, and the hash value of the random number to prevent processability attacks as public inputs, and the seller's private key, the seller's random number, the auxiliary authentication information of the leaf node, the ownership relationship, the random number to prevent processability attacks, and the hash value of the data to be sold as private inputs, and generate a zero-knowledge proof of the contract to prevent processability attacks based on the proof key.

[0106] In this embodiment, the seller generates a zero-knowledge proof of ownership of the data 1Owner (π Owner and π 1Owner Has the same effect, but π 1Owner A public input parameter η is added to prevent machinability attacks)

[0107] Furthermore, the data market is based on the Verification of the zero-knowledge proof of the contract against processability attacks includes:

[0108] The data market extracts the root of the Merkle hash tree and the unique identifier of the data to be sold from the zero-knowledge proof of the contract to prevent processability attacks, and searches for the latest timestamp corresponding to the data on the chain. Use the public key of the trusted regulatory agency to verify the validity of sign1;

[0109] After the verification is passed, the trusted regulatory agency calls the zero-knowledge proof of the contract to prevent processability attacks to verify that the seller is the holder of the seller's private identity and the unique identifier of the data to be sold.

[0110] In this embodiment, the data market is requested to publish information about the data m to be sold (the plain text of data m is not disclosed, and the main information is published). Verify π 1Owner If the verification is successful, the data market will release the information that the seller intends to sell data m.

[0111] Furthermore, the buyer's request to the seller for purchase data includes:

[0112] The buyer's private identity is used as public input, the buyer's private key and the buyer's random number are used as private input, and a zero-knowledge proof of the buyer's private identity proof contract is generated based on the proof key;

[0113] The buyer's private key and public key are re-encrypted by proxy. The buyer sends the re-encrypted public key, the zero-knowledge proof of the buyer's privacy identity proof contract, and the signature of the buyer's privacy identity to the seller, requesting to purchase the data.

[0114] The seller calls the zero-knowledge proof of the privacy identity certification contract and uses the regulatory authority to verify the validity of the signature of the buyer's privacy identity, verifying that the buyer is the holder of the privacy identity registered with a trusted regulatory authority.

[0115] In this embodiment, the buyer matches the data to be purchased with the corresponding seller from the data market. The buyer proves to the seller that his privacy identity has been registered with a trusted regulatory agency and submits his proxy re-encryption public key Ppk Buyer , request the seller to transfer the privacy of data ownership (the ownership transfer will not disclose the privacy identity of the buyer pk pri-Buyer ).

[0116] Furthermore, the buyer generates a zero-knowledge proof of data ownership privacy transfer contract based on the new ownership relationship calculated by the seller, including:

[0117] The seller calculates a new ownership relationship based on the buyer's private identity and the hash value of the unique identifier of the data to be sold, and calculates a new Merkle tree root based on the new ownership relationship and the auxiliary authentication information of the leaf node;

[0118] The seller sends the new ownership relationship, the new Merkle tree root, and the auxiliary authentication information of the leaf nodes to the buyer;

[0119] The buyer takes the root of the Merkle hash tree, the new Merkle root, the seller's private identity and the unique identifier of the data to be sold as public input, and takes the buyer's private identity, the seller's private key, the seller's random number, the auxiliary authentication information of the leaf node, the ownership relationship, the new ownership relationship and the hash value of the data to be sold as private input, and generates a zero-knowledge proof of the data ownership privacy transfer proof contract based on the proof key.

[0120] In this embodiment, the seller is based on the buyer's private identity pk pri-Buyer , calculate the new ownership relationship R Bα , and generate zero-knowledge proof of ownership privacy transfer π Authri (π Authri Can pk without revealing the buyer's privacy identity pri-Buyer In the case of data ownership transfer, the data ownership has been transferred, achieving the purpose of data ownership privacy transfer), and requesting the trusted regulatory agency to have key information to prove the new ownership relationship On-chain, and based on its proxy re-encrypted private key Psk Seller and the buyer's public key Ppk Buyer Generate a proxy re-encryption key ProxyKey and send it to the trusted regulatory agency, requesting the trusted regulatory agency to perform proxy re-encryption on the data ciphertext.

[0121] Furthermore, the trusted regulatory agency verifies the zero-knowledge proof of the data ownership privacy transfer proof contract. After verification, the purchased data is encrypted and stored, including:

[0122] The seller generates a proxy re-encryption key based on the seller's re-encryption private key and the buyer's re-encryption public key;

[0123] The seller sends the zero-knowledge proof of the data ownership privacy transfer proof contract and the proxy re-encryption key to the trusted regulatory agency. The trusted regulatory agency calls the zero-knowledge proof of the data ownership privacy transfer proof contract to verify the seller's privacy identity and the holder of the unique identifier of the data to be sold. At the same time, it verifies whether the seller transfers the ownership of the original data to the buyer without revealing the buyer's privacy identity and generates a new ownership relationship.

[0124] After verification, the trusted regulatory agency obtains the ciphertext corresponding to the unique identifier of the data to be sold from the distributed storage system based on the ciphertext hash address;

[0125] The proxy re-encryption key is used to convert the ciphertext into a new ciphertext, which is stored in the distributed storage system and the new ciphertext hash address is obtained.

[0126] Further, After being put on the chain, it forms an evidence chain for tracing ownership Used for ownership tracing and auditing.

[0127] In this embodiment, the trusted regulatory agency verifies π Authri After the validity of the data is verified, the data ciphertext is re-encrypted to generate the re-encrypted ciphertext M new And store Mnew in IPFS and obtain the IPFS address AddrM new The trusted supervisory authority obtains the current timestamp T2 and Signature sign2, Stored in the blockchain distributed ledger, forming a chain of evidence for ownership tracing It is convenient for ownership tracing and auditing. After the buyer obtains the privacy transfer of ownership, he can query AddrM on the chain. new , get the re-encrypted ciphertext M new , and based on its proxy re-encrypted private key Psk Buyer Decrypt M new Obtain plaintext m. The buyer obtains two hash values ​​of plaintext m and compares the results with α. If they are the same, it means that the correct privacy authorization has been obtained.

[0128] Example:

[0129] The key symbols and descriptions involved in this embodiment are shown in Table 2.

[0130] Table 2

[0131]

[0132]

[0133]

[0134] The data transaction security and privacy protection methods based on zero-knowledge proof smart contracts specifically include:

[0135] 1. Initialization:

[0136] First, construct the zero-knowledge proof arithmetic circuit constraint equations for Algorithms 2 through 5. The zero-knowledge proof arithmetic circuit constraint equations for the smart contracts PriIDHolderSc in Algorithm 2, PriOwnerSc in Algorithm 3, PriAuthorizeSc in Algorithm 4, and PriOwner1Sc in Algorithm 5 are shown in Table 3-6. Initialize and generate the smart contracts PriIDHolderSc, PriOwnerSc, PriAuthorizeSc, and PriOwner1Sc. Next, execute the "setup" operation to generate four different Proving Keys and Verification Keys. Finally, generate four zero-knowledge proof smart contracts PriIDHolderSc, PriOwnerSc, PriAuthorizeSc, and PriOwner1Sc based on the Verification Key. Finally, deploy the smart contracts and distribute the Proving Keys to the relevant participants.

[0137] Table 3

[0138]

[0139] Table 4

[0140]

[0141]

[0142] Table 5

[0143]

[0144] Table 6

[0145]

[0146]

[0147] 2. Private identity registration:

[0148] Step 1: First, the seller generates a private key sk Seller and public key pk Seller =h(sk Seller ), the public key pk Seller As the only real identity; second, the seller generates a random number δ Seller and β, calculate the private identity (private public key) pk pri-Seller =h(pk seller ||δ Seller ) and η=h(β), where η will be used to prevent the machinability attack (see Algorithm 5 for details); third, the seller uses pk pri-Seller is the common input, (sk Seller ,δ Seller ) is the privacy input, based on Algorithm 2 and the received ProvingKey, execute Figure 9 The “Proof” operation in generates the zero-knowledge proof π of the seller’s privacy identity proof contract PriIDH ={A PriDH ,B PriDH ,C PriDH ,Public Inputs=pk pri-seller}; Fourth, the seller submits pk to a trusted authority Seller ,δ Seller ,π PriIDH ,ηRequest to register a private digital identity.

[0149] Figure 9 It shows how to use Zokrates to generate zero-knowledge proofs and verify smart contracts, and finally complete the zero-knowledge proof verification process:

[0150] (1) Use Zokrates’ Domain-Specific Language (DSL) to construct the arithmetic circuit constraint equation Z(PrivateInputs, PublicInputs) of the problem to be proved, where PrivateInputs is the private input that cannot be made public, and PublicInputs is the public input that can be made public;

[0151] (2) Use Zokrates to perform compilation, compile(Z), and convert Z(PrivateInputs, PublicInputs) into an arithmetic circuit AC.

[0152] (3) Execute, Setup, convert the arithmetic circuit into a quadratic arithmetic program QAP, and obtain the public reference string CRS, where the public reference string CRS includes two parts: Verificationkey and Provingkey. Verificationkey={V α ,V β ,V γ ,V δ ,V γ_abc}, where V α = α G, V β = β H, V γ = γ H, V δ = δ H.

[0153] (4) The verifier obtains the Verification key in the public reference string CRS and uses Zokrates to generate the Ethereum blockchain verification smart contract, VerifyContract, which uses Ethereum's precompiled elliptic curve libraries EIP196 and EIP197 to implement elliptic curve bilinear pairing.

[0154] (5) The prover obtains the Proving key and takes the private input Private Inputs and the public input Public Inputs as input parameters, and performs the Prove operation to generate a zero-knowledge proof, π = {A1, B1, C1, Public Inputs}, where A1 = AG, B1 = BH, C1 = CG, and Public Inputs is the public input.

[0155] (6) The prover submits the zero-knowledge proof π = {A1, B1, C1, Public Inputs} to the verifier. The verifier calls the smart contract VerifyContract to complete the verification of the zero-knowledge proof π = {A1, B1, C1, Public Inputs} on the chain in an open, transparent and privacy-preserving manner.

[0156] Step 2: First, the trusted regulatory agency calls the smart contract PriIDHolderSc(π PriIDH ), proves that the seller is pk Seller ,δ Seller Second, credible regulatory agencies have a role to play in pk pri-Seller Digital signature sig Re (pk pri-Seller ) and returns the signature value to the seller.

[0157] The buyer will also get pk based on this process pri-Buyer and sig Re (pk pri-Buyer ). The buyer generates a private key sk Buyer and public key pk Buyer =h(sk Buyer ), the public key pk Buyer As the only real identity; second, the buyer generates a random number δ Buyer and β, calculate the private identity (private public key) pk pri-Buyer =h(pk Buyer ||δ Buyer ) and η = h(β), where η will be used to prevent machinability attacks (see Algorithm 5 for details); third, the buyer uses pk pri-Buyer is the common input, (sk Buyer ,δ Buyer ) is the privacy input, based on Algorithm 2 and the received ProvingKey, execute Figure 9 The "Proof" operation in the code generates a zero-knowledge proof π' of the buyer's private identity proof contract. PriIDH ={A PriDH ,B PriDH ,C PriDH ,PublicInputs=pk pri-Buyer}; Fourth, the buyer submits the pk to a trusted authority Buyer ,δ Buyer ,π PriIDH ,ηRequest to register a private digital identity.

[0158] 3. On-chain registration of data:

[0159] Step 1: First, the seller obtains the hash value α=h(h(m)) twice for the data m and uses α as the unique identifier of the data. The seller generates the private key and public key (Psk seller , Ppk seller ), using the public key Ppk seller Encrypt m to get the ciphertext M, store M in IPFS, and obtain the hash address AddrM of M; second, the seller calculates the ownership binding relationship R of the data α =h(pk pri-Seller ||α); Third, the seller uses R α Construct a Merkle hash tree for the leaf nodes and calculate the root and auxiliary authentication information of leaf nodes Fourth, the seller For public input, For privacy input, based on Algorithm 3 and the received ProvingKey, execute Figure 9The "Proof" operation in generates a zero-knowledge proof Fifth, the seller sends AddrM,π Owne Send a request to a trusted regulatory agency to register key information proving data ownership on the chain, providing a basis for credible proof of ownership in subsequent data sales.

[0160] Step 2: First, the trusted regulatory agency saves AddrM and calls the smart contract PriOwnerSc(πOwne) to verify that the seller is the holder of the private identity (private public key) and data ownership; second, the trusted regulatory agency obtains the data from π Owne Extract α, and get the current timestamp T1, and find The digital signature sign1 is used to Go to the chain and get the address addr on the chain id .

[0161] 4. Sale of Data:

[0162] Step 1: First, the seller For public input, For privacy input, based on Algorithm 5 and the received Proving Key, execute Figure 9 The "Proof" operation in generates a zero-knowledge proof To prove it is a private identity pk pri-Seller and the holder of data α, while preventing access to π Owner Malicious users can carry out processability attacks (π Owner and π 1Owner There is a clear difference between the public inputs of 1Owner and a description of the data to the sales platform, requesting the sales platform to sell the data externally.

[0163] Step 2: First, the data market starts from π 1Owner Extraction of α, and search the chain for the transaction corresponding to the latest timestamp Then the public key of the trusted regulatory agency is used to verify the validity of sign1; secondly, after sign1 is verified, the trusted regulatory agency calls the smart contract PriOwner1Sc(π 1Owner ), verify that the seller is the private identity pk pri-Seller and the holder of data α. Third, the data market releases the description of the data to the outside world.

[0164] 5. Privacy transfer of purchased data and data ownership:

[0165] Step 1: First, the buyer matches the description of the data to be purchased in the data market and obtains a secure communication channel with the seller. pri-Buyer is the common input, (sk Buyer ,δ Buyer ) is the privacy input, based on Algorithm 2 and the received Proving Key, execute Figure 9 The "Proof" operation in generates the zero-knowledge proof π' of the buyer's privacy identity proof contract PriIDH ={A PriDH ,B PriDH ,C PriDH ,Public Inputs=pk pri-Buyer}; Second, the buyer generates the private key and public key (Psk Buyer , Ppk Buyer ); Third, the buyer will Ppk Buyer 、π' PriIDH and sig Re (pk pri-Buyer ) is sent to the seller to request the purchase of data and obtain a private transfer of ownership.

[0166] Step 2: First, the seller calls the smart contract PriIDHolderSc(π' PriIDH ), and use the public key of the trusted regulatory agency to verify sig Re (pk pri-Buyer ) to verify that the buyer is the holder of a private identity that has been registered with a trusted regulatory agency; second, the seller calculates the new ownership relationship R Bα =h(pk pri-Buyer ||α), and based on R Bα and auxiliary authentication information Compute the new Merkle root Third, the seller will R Bα 、 Send to the buyer; Fourth, the seller As a common input, For privacy input, based on Algorithm 4 and the received Proving Key, execute Figure 9 The “Proof” operation in generates zero-knowledge proof π Authri , to prove that the seller is the private identity pk pri-Seller and the owner of data α, without revealing the buyer’s privacy identity pk pri-Buyer In the case of , the ownership of data α is transferred to the buyer, and the ownership relationship after the transfer becomes R Bα; Fifth, the seller uses his agent to re-encrypt the private key Psk Seller and the buyer's public key Ppk Buyer Generate the proxy re-encryption key ProxyKey; Sixth, the seller will π Authri The data is sent to the trusted regulatory agency with the ProxyKey, requesting that the key information of the privacy authorization be uploaded to the chain, providing a basis for the credible proof of ownership when the data is subsequently sold again.

[0167] Step 3: First, the trusted regulatory agency calls the smart contract PriAuthorizeSc(π Authri ), verify whether the seller is the private identity pk pri-Seller and the holder of data α, and verify whether the seller is not revealing the buyer’s privacy identity pk pri-Buyer In the case of , the ownership of data α is transferred to the buyer, and the ownership relationship after the transfer becomes R Bα ; Second, the trusted regulator reads the ciphertext M corresponding to α from IPFS based on the previously stored AddrM, and uses the proxy key ProxyKey to convert M into M new , then M new Deposit into IPFS and obtain the address AddrM new The trusted supervisory authority obtains the latest timestamp T2 and Digitally sign sign2, and then Deposit it into the blockchain distributed ledger and obtain the on-chain address addr2 id , where addr id yes The on-chain address indicates that both transactions are for the transfer of ownership of the same data.

[0168] Step 4: First, after the buyer obtains privacy authorization, he uses an anonymous blockchain account to query the transaction on the chain. Second, the buyer based on the queried AddrM new , retrieve the ciphertext M from IPFS new , using its proxy re-encrypted private key Psk Buyer Decrypt M new , obtain the plaintext m of the digital content; third, the buyer obtains two hash values ​​of the plaintext m and compares the results with α. If they are the same, it means that the correct privacy authorization has been obtained.

[0169] On the other hand, after the buyer obtains the plaintext of the data, he can sell the data to other buyers according to the above steps "(4) Sale of data" and "(5) Purchase of data and privacy transfer of data ownership", and append new privacy authorization records on the chain to form a data ownership tracking evidence chain.

[0170] Based on the Groth16 zero - knowledge proof algorithm, this embodiment constructs a zero - knowledge proof for an on - chain zero - knowledge proof contract that protects identity privacy, data ownership, and business behavior privacy. Combining proxy re - encryption with the tamper - proof and traceable blockchain distributed ledger technology, it constructs a data privacy protection and ownership traceability solution to comprehensively address the above - mentioned security and privacy issues. Secondly, in the process of constructing the zero - knowledge proof scheme, this embodiment considers the malleability attack problem of the Groth16 algorithm and constructs a specific smart contract to prevent the occurrence of malleability attacks, further ensuring the security of data transactions. The method of this embodiment can achieve the following security goals: data privacy protection, security of zero - knowledge proof, identity privacy of data owners and data purchasers, protection of data ownership, privacy protection of business behavior, and security and trustworthiness of the transaction process.

[0171] First of all, the data in this embodiment is encrypted through proxy re - encryption throughout the entire transfer process. Except for the data seller and purchaser, no one can obtain the plaintext of the data during the transfer process. Therefore, the method of this embodiment meets the data privacy protection requirement.

[0172] Secondly, the achievement of security goals other than data privacy protection can be reduced to the solution of the malleability attack of the Groth16 algorithm; the zero - knowledge property, completeness, and soundness of the Groth16 zero - knowledge proof algorithm; the one - wayness and collision - resistance property of the Sha256 hash algorithm; and the honesty and trustworthiness of the trusted regulatory agency.

[0173] This embodiment selects 3 representative research schemes from related works and conducts a qualitative comparison with the scheme to be constructed in this embodiment to illustrate that the scheme of this embodiment has better performance in terms of security and privacy protection and can effectively address the 5 challenges mentioned in the introduction section. Table 7 shows the comparison results, where √: has this feature, 乄: partially has this feature, ×: does not have this feature. As can be seen from Table 7, the scheme of this embodiment fully considers the 5 challenge problems and has better security and privacy characteristics.

[0174] Table 7

[0175]

[0176] To evaluate the relevant indicators of smart contracts and distributed ledgers, this embodiment created an Ubuntu virtual machine on a computer with an i7-8550U processor and 16GB of memory, and deployed the Ganache Ethereum test network on it. Then, Zokrates was used to generate the smart contracts corresponding to Algorithms 2 to 5 of this embodiment, and Remix was used to deploy different smart contracts to the Ganache Ethereum test network to complete the indicator testing through the test network.

[0177] First, since the zero-knowledge proof in this embodiment is based on the Zokrates structure, it includes the generation of off-chain zero-knowledge proofs, the generation of off-chain verification smart contracts, the deployment of on-chain zero-knowledge proof smart contracts, and the verification of on-chain zero-knowledge proof smart contracts. Off-chain operations do not affect the performance of the system, so the zero-knowledge proof mainly evaluates the deployment and verification of on-chain zero-knowledge smart contracts.

[0178] For the deployment of smart contracts, the main focus is on evaluating the amount of gas consumed when deploying different smart contracts to the Ethereum blockchain. Algorithms 2 to 5 of this embodiment will generate four smart contracts PriIDHolderSc, PriOwnerSc, PriAuthorizeSc, and PriOwner1Sc respectively, while Algorithms 3 to 5 all include Merkle tree reserve proofs. in Data ownership R α Merkle auxiliary authentication information, when the number of data ownership is 4, The number of hash values ​​contained in is 2, that is, as the number of ownership in the leaf node increases, the size of the auxiliary authentication information will increase. The relationship between the two is N = [log2 (n) ], where N is the number of hash values ​​contained in the auxiliary authentication information, [X] is the rounding symbol, and n is the number of leaf nodes. In other words, when evaluating the gas consumption when deploying different smart contracts, the number of leaf nodes needs to be considered. Therefore, this embodiment tests the gas consumption of the four smart contracts PriIDHolderSc, PriOwnerSc, PriAuthorizeSc, and PriOwner1Sc when deployed to the Ethereum private chain with different numbers of leaf nodes. In order to make the evaluation more meaningful, this embodiment uses formula (1) to convert the gas consumption into the consumption of Ether ETH in the Ethereum public chain, where the gas price in the public chain used is the median price of 10Gwei in October 2024. Figure 2 The test results of this embodiment are shown. As can be seen from the figure, as the number of leaf nodes n in the horizontal axis is n={2 3 ,2 5 ,2 7 ,2 9 ,211 ,2 13 ,2 15 ,2 17 ,2 19}, the deployment cost of each smart contract in the vertical axis remains almost unchanged, and the ETH consumed is also small. Therefore, the deployment cost of the smart contract will not be affected by the number of leaf nodes in the Merkle tree reserve proof. The above reason is mainly due to the auxiliary authentication information in Algorithms 3 to 5. It is mainly used as the privacy input of the algorithm. From the formula of the Groth16 zero-knowledge proof algorithm described in this embodiment, it can be seen that the privacy input will be accumulated into different numerical variables, and the smart contract ultimately implements bilinear pairing. The numerical variables used for pairing are the accumulated values ​​of the privacy input and the public input, so they will not be affected by the number of leaf nodes.

[0179] ETH=Gas used *Gas price (1)

[0180] For the execution of smart contracts, it is necessary to evaluate the execution time and the gas consumption of the execution. Figure 2 ,This embodiment also evaluates the smart contract execution time and ,gas consumption under different leaf nodes. Figure 3 is the execution time of the smart contract. As the number of leaf nodes increases, the execution time of each smart contract remains basically unchanged, and the execution time is no more than 0.7 seconds. Figure 4 The gas consumption for smart contract execution, as the number of leaf nodes increases, the gas consumption of each smart contract remains basically unchanged, and the consumed ETH is also relatively small.

[0181] Secondly, the operational evaluation of the distributed ledger in this embodiment mainly considers the on-chain storage overhead and transaction time overhead of the ownership tracking evidence chain. Regarding storage overhead, a new data transaction will store data in the distributed ledger as follows: where α and is the output of the SHA256 hash algorithm, which is 32 bytes long. T1 and T2 are timestamps with a length of 4 bytes. new The hash address of IPFS has a default length of 32 bytes. id is the Ethereum chain transaction address, which is 20 bytes long. sign1 and sign2 are digital signature algorithms based on the secp256k1 elliptic curve, which are 64 bytes long. Therefore, the chain storage overhead for completing a new data transaction is 316 bytes. In addition, for multiple transactions of the same data, each transaction is Append a new one based on Each newly appended data size is 184 bytes. Based on the above, this embodiment tests the storage overhead of different data quantities and multiple transactions of the same data. The test results are as follows: Figure 5 As shown, it is obvious that as the number of data (left) and the number of transactions (right) on the horizontal axis increase, the on-chain storage overhead shown on the vertical axis will increase, but the increase is still small.

[0182] Regarding the on-chain time overhead, the ownership tracking evidence chain includes two types of transactions: and The former has an on-chain storage overhead of 132 bytes, while the latter has an overhead of 184 bytes. Therefore, this embodiment tests the execution time of the two transactions under different numbers of transactions. The test results are as follows: Figure 6 As shown, it is obvious that as the number of transactions increases, the transaction time remains basically unchanged, and the average transaction time is about 0.24 seconds.

[0183] Table 7 provides a qualitative comparison. The comparison results show that the method proposed in this embodiment has better privacy and security features, especially in terms of privacy protection of commercial activities. This embodiment ensures that no one except the data owner and the data buyer can know to whom the ownership of the data is transferred after the transaction, and the transaction is completed in an open and transparent blockchain. In addition, for quantitative comparison, since smart contracts are the core of achieving security and privacy protection, this embodiment compares the deployment and execution costs of all smart contracts with those of prior art 1 (AlsharifA, Nabil MA blockchain-based medical data marketplace with trustless fair exchange and access control[C] / / GLOBECOM 2020-2020IEEE Global Communications Conference.IEEE, 2020:1-6) and prior art 2 (Gupta P, Dedeoglu V, Kanhere SS, et al. TrailChain: Traceability of data ownership across blockchain-enabled multiple marketplaces[J]. Journal of Network and Computer Applications, 2022, 203:103389.). The specific comparison results are as follows. Figure 7As shown in Figure 2, since different articles contain different smart contracts, this embodiment gives the total consumption of smart contracts. Figure 6-7 It can be seen that in addition to having better security and privacy features, the solution of this embodiment has less deployment and execution consumption than the solutions of prior art 1 and prior art 2.

[0184] on the other hand, Figure 8 The figure shows a comparison of the smart contract execution time of this embodiment scheme with that of prior art 1 and prior art 2. As can be seen from the figure, although the execution time of this method is longer than that of prior art 1, this method has better security and privacy protection features.

[0185] The embodiments described above are merely descriptions of preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Without departing from the spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by persons skilled in the art should fall within the scope of protection defined by the claims of the present invention.

Claims

1. A data transaction security and privacy protection method based on zero-knowledge proof smart contracts, characterized by: include: Initialize blockchain parameters; The seller and buyer request to register their private identity with a trusted regulatory body. The trusted regulatory body verifies the private identity and signs the verified private identity and returns it to the seller and buyer. The seller generates a zero-knowledge proof of the ownership of the data to be sold and a data ownership proof contract, encrypts and stores the data to be sold, and obtains a ciphertext hash address. The seller submits the zero-knowledge proof of the data ownership proof contract and the ciphertext hash address to the trusted regulatory agency for verification. After verification, the first target information is uploaded to the chain and the chain address is obtained; The seller generates a zero-knowledge proof of ownership of the data to be sold and a data ownership proof contract, including: The seller obtains a unique identifier of the data to be sold by performing multiple hash value calculations on the data to be sold; Obtaining the ownership relationship by hashing the unique identifier of the data to be sold and the seller's private identity; Constructing a Merkle Hash tree with the ownership relationship as the leaf node, and calculating the root of the Merkle Hash tree and the auxiliary authentication information of the leaf node; The seller's private identity, the root of the Merkle hash tree, and the unique identifier of the data to be sold are used as public inputs, and the seller's private key, the seller's random number, the auxiliary authentication information of the leaf node, the root of the Merkle hash tree, and the hash value of the data to be sold are used as private inputs, and a zero-knowledge proof of the data ownership proof contract is generated based on the proof key; The seller generates a zero-knowledge proof of the contract to prevent machinability attacks and requests the data market to publish the information of the data to be sold. The data market verifies the zero-knowledge proof of the contract to prevent machinability attacks based on the first target information on the chain. After the verification is passed, the data market publishes the information of the data to be sold. The zero-knowledge proof generated by the seller to prevent the processability attack contract includes: The seller uses the seller's private identity, the root of the Merkle hash tree, the unique identifier of the data to be sold, and the hash value of the random number to prevent machinability attacks as public inputs, and uses the seller's private key, the seller's random number, the auxiliary authentication information of the leaf node, the ownership relationship, the random number to prevent machinability attacks, and the hash value of the data to be sold as private inputs to generate a zero-knowledge proof of the machinability attack prevention contract based on the proof key; The buyer requests the seller to purchase data. The buyer generates a zero-knowledge proof of the data ownership privacy transfer proof contract based on the new ownership relationship calculated by the seller. The trusted regulatory agency verifies the zero-knowledge proof of the data ownership privacy transfer proof contract. After the verification is passed, the purchase data is encrypted and stored, the ciphertext storage address of the purchase data is obtained, and the second target information is put on the chain, where the first target information is The second target information is α is the unique identifier of the original data, i.e. the data to be sold m, Data ownership R α As the root of the Merkle hash tree constructed as a leaf node, T1 is the current timestamp registered on the data chain, sign1 is The signature of addr id is the on-chain address, The root of the Merkle hash tree calculated after the seller changes the data ownership to the buyer, sign2 is The signature of T2 is the current timestamp obtained by the trusted regulatory agency, and AddrM new is the IPFS address; The buyer generates a zero-knowledge proof of the data ownership privacy transfer proof contract based on the new ownership relationship calculated by the seller, including: The seller calculates the new ownership relationship based on the buyer's private identity and the hash value of the unique identifier of the data to be sold, and calculates a new Merkle tree root based on the new ownership relationship and the auxiliary authentication information of the leaf node; The seller sends the new ownership relationship, the new Merkle tree root and the auxiliary authentication information of the leaf node to the buyer; The buyer takes the root of the Merkle hash tree, the new Merkle root, the seller's private identity and the unique identifier of the data to be sold as public input, and takes the buyer's private identity, the seller's private key, the seller's random number, the auxiliary authentication information of the leaf node, the ownership relationship, the new ownership relationship and the hash value of the data to be sold as private input, and generates a zero-knowledge proof of the data ownership privacy transfer proof contract based on the proof key.

2. The data transaction security and privacy protection method based on zero-knowledge proof smart contract according to claim 1 is characterized in that: The seller requests a trusted regulatory agency to register a private identity. The trusted regulatory agency verifies the private identity by: The seller generates a seller private key and a seller public key; The seller generates a seller random number and a random number for preventing processability attacks, and calculates a hash value of the seller's private identity and the random number for preventing processability attacks; The seller's private identity is used as a public input, the seller's private key and the seller's random number are used as private inputs, and a zero-knowledge proof of the seller's private identity proof contract is generated based on the proof key; The seller submits the seller's public key, the seller's random number, the zero-knowledge proof of the seller's private identity certification contract, and the hash value of the random number that prevents processability attacks to the trusted regulatory agency to request registration of the private identity; The trusted regulatory agency proves that the seller is the holder of the seller's public key and the seller's random number based on the zero-knowledge proof of the seller's private identity proof contract.

3. The data transaction security and privacy protection method based on zero-knowledge proof smart contract according to claim 2 is characterized in that: Encrypting and storing the data to be sold, and obtaining the ciphertext hash address includes: Perform proxy re-encryption on the seller's private key and the seller's public key to generate the seller's re-encrypted private key and public key; The sales data is encrypted using the seller's re-encryption public key to obtain a ciphertext and store it in a distributed storage system to obtain the ciphertext hash address.

4. The data transaction security and privacy protection method based on zero-knowledge proof smart contract according to claim 1 is characterized in that: The data market verifies the zero-knowledge proof of the contract for preventing processability attacks based on the first target information on the chain, including: The data market extracts the root of the Merkle hash tree and the unique identifier of the data to be sold from the zero-knowledge proof of the processability attack prevention contract, searches for the first target information corresponding to the latest timestamp on the chain, and verifies the validity of sign1 using the public key of the trusted regulatory agency; After the verification is passed, the trusted regulatory agency calls the zero-knowledge proof of the contract for preventing processability attacks to verify that the seller is the holder of the seller's private identity and the unique identifier of the data to be sold.

5. The data transaction security and privacy protection method based on zero-knowledge proof smart contract according to claim 3 is characterized in that: The buyer requests the seller to purchase data including: The buyer's private identity is used as a public input, the buyer's private key and the buyer's random number are used as private inputs, and a zero-knowledge proof of the buyer's private identity proof contract is generated based on the proof key; The buyer's private key and public key are proxy-re-encrypted, and the buyer sends the proxy-re-encrypted buyer's public key, the zero-knowledge proof of the buyer's private identity certification contract, and the signature of the buyer's private identity to the seller, requesting to purchase the data; The seller calls the zero-knowledge proof of the privacy identity certification contract and uses the public key of the trusted regulatory agency to verify the validity of the signature of the buyer's privacy identity, verifying that the buyer is the holder of the privacy identity registered with the trusted regulatory agency.

6. The data transaction security and privacy protection method based on zero-knowledge proof smart contract according to claim 5 is characterized in that: The trusted regulatory agency verifies the zero-knowledge proof of the data ownership privacy transfer proof contract, and encrypts and stores the purchased data after the verification is passed, including: The seller generates a proxy re-encryption key based on the seller's re-encryption private key and the buyer's re-encryption public key; The seller sends the zero-knowledge proof of the data ownership privacy transfer proof contract and the proxy re-encryption key to the trusted regulatory agency. The trusted regulatory agency invokes the zero-knowledge proof of the data ownership privacy transfer proof contract to verify the seller's privacy identity and the holder of the unique identifier of the data to be sold. At the same time, it verifies whether the seller transfers the ownership of the original data to the buyer without revealing the buyer's privacy identity, and generates a new ownership relationship. After the verification is passed, the trusted regulatory agency obtains the ciphertext corresponding to the unique identifier of the data to be sold from the distributed storage system based on the ciphertext hash address; The ciphertext is converted into a new ciphertext using the proxy re-encryption key, stored in a distributed storage system, and a new ciphertext hash address is obtained.

7. The data transaction security and privacy protection method based on zero-knowledge proof smart contract according to claim 1 is characterized in that: After the second target information is uploaded to the chain, an evidence chain of ownership tracing is formed, which is used for ownership tracing and auditing.

Images