A method and system for monitoring stealth addresses suitable for blockchain threshold wallets

Abstract

The application provides a concealed address supervision method and system suitable for a blockchain threshold wallet, and comprises the following steps: a receiver and a sender respectively acquire a public and private key pair of their own wallet; the receiver registers according to the public and private key pair of the own wallet to obtain a pseudonym and auxiliary information corresponding to the pseudonym for generating a concealed address; the sender initiates a transaction, and after the transaction is chained, a corresponding supervision information of a sub-wallet participating in the transaction is sent to a supervision party and an offline sub-wallet; and the supervision party supervises the supervision information. The application can derive a concealed address for a receiver without knowing the public key of the receiver, and only at least t honest sub-wallets can cooperate to reveal the public key of the receiver, so that the link relationship can be prevented from being leaked by a malicious sub-wallet, and the threshold wallet can trace back to the past transactions in necessary cases.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and more specifically, to a method and system for monitoring hidden addresses applicable to threshold wallets on blockchains. In particular, it relates to a method for enhancing the privacy of hidden addresses applicable to threshold wallets on blockchains and a corresponding monitoring method. Background Art

[0002] Unlike traditional wallets, which are controlled by a single user, threshold wallets can be considered to be controlled by n users. Each user holds a sub-wallet, which contains a shard of the threshold wallet's public and private key pair. Using threshold signature technology, any of the t sub-wallets can generate a digital signature verifiable by the threshold wallet's public key. Furthermore, the paper Kondi Y, Magri B, Orlandi C, et al. (Refresh when you wake up: Proactive threshold wallets with offline devices [C] / / 2021 IEEE Symposium on Security and Privacy (SP). IEEE, 2021: 608-625) proposes that some threshold signature algorithms can be split into two phases: a pre-signature and a final signature. The pre-signature phase obtains a random number used in the final signature phase. The pre-signature phase requires the participation of at least t sub-wallets. Assuming the set of participating sub-wallets is T, then the final signature phase also requires the participation of at least t sub-wallets from T.

[0003] Stealth addresses are a classic privacy protection scheme in blockchain. The sender of a transaction can derive a new public key for the recipient based on the recipient's public key without interacting with the recipient. This derived public key is the stealth address. When a stealth address is used as the recipient's address, all users other than the sender and receiver are unaware that the stealth address was derived from the recipient's public key.

[0004] Threshold wallets are widely used for their security, while shielded addresses are a classic privacy protection solution. The combination of the two is increasingly used in various scenarios. Shielded addresses make the recipient's address in a transaction visible only to the sender and recipient. However, when a threshold wallet acts as the sender, because it consists of multiple sub-wallets, some sub-wallets may behave uncontrollably, leaking the recipient's address and refusing to cooperate with regulatory oversight.

[0005] Therefore, the market needs a hidden address supervision method and system suitable for blockchain threshold wallets that can prevent malicious sub-wallets from leaking link relationships and enable threshold wallets to trace past transactions when necessary. Summary of the Invention

[0006] In view of the defects in the prior art, the purpose of the present invention is to provide a hidden address supervision method and system suitable for blockchain threshold wallets.

[0007] According to the present invention, a hidden address supervision method applicable to a blockchain threshold wallet is provided, comprising:

[0008] Step S1: The receiver and sender obtain the public and private key pairs of their own wallets respectively;

[0009] Step S2: The recipient registers the public and private key pair of their own wallet and obtains a pseudonym and auxiliary information corresponding to the pseudonym for generating a hidden address;

[0010] Step S3: The sender initiates a transaction. After the transaction is uploaded to the blockchain, the sub-wallets participating in the transaction send the corresponding regulatory information to the regulator and the offline sub-wallet.

[0011] Step S4: The supervisor supervises the supervisory information.

[0012] Preferably, the sender as a threshold wallet includes n sub-wallets, by running SubWalletKeyGen(ID s ) Get the sender's public key pk s , and the public key pk s and private key sk s n fragments, recorded as the sender's public and private key fragments P i , as follows:

[0013] P i =(pk s,i ,sk s,i ),i∈[1,n]

[0014] The receiver runs KeyGen(ID r ) to obtain the recipient's public and private key pair (pk r ,sk r ), that is, ((pvk r ,svk r ),(psk r ,ssk r ));

[0015] Among them, pvk r Indicates that the receiver retrieves the public key, svk r Indicates that the receiver retrieves the private key, psk r Indicates the recipient's spending public key, ssk r Indicates the recipient spends the private key, ID s The sender's ID r The recipient's identifier.

[0016] Preferably, step S2 includes the following sub-steps:

[0017] Step S2.1: The receiver masks its own public key and obtains the masked public key mpk r and sending the masked public key to the service provider;

[0018] Step S2.2: The server receives the recipient's masked public key mpk r After that, a unique pseudonym cn is randomly generated and sent to the recipient;

[0019] Step S2.3: The service provider obtains the auxiliary information (pai, ai) for generating the concealed address corresponding to the pseudonym according to the AIGen algorithm and the recipient's masked public key. i ), where pai represents public auxiliary information, ai represents private auxiliary information, i = 1, 2, ... n, and n represents the number of private auxiliary information.

[0020] Preferably, the masking process includes partially masking the recipient's public key;

[0021] Partial masking refers to masking only the recipient's spending public key psk in the recipient's public key r , as follows:

[0022] mpk r =(pvk r ,mpsk r )

[0023] Among them, mpk r Indicates that the receiver masks the public key, mpsk r Indicates the recipient's masked spending public key, pvk r Indicates that the receiver retrieves the public key.

[0024] Preferably, the AIGen algorithm is as follows:

[0025] AIGen(mpk)→(pai,{ai i} i∈[1,n] ), input masked public key mpk, output 1 public auxiliary information and n private auxiliary information;

[0026] The AIGen algorithm actually masks the retrieval public key pvk and then shards the masking factor, while the masked spending public key mpsk remains unchanged. The masked retrieval public key pvk and masked spending public key mpsk are both part of the public auxiliary information pai, and the shards of the masking factor are part of the private auxiliary information ai.

[0027] Preferably, step S3 includes the following sub-steps:

[0028] Step S3.1: the receiver sends the pseudonym cn to the t sub-wallets participating in the transaction;

[0029] Step S3.2: the t sub-wallets participating in the transaction execute ThSign R to obtain a random number R;

[0030] Step S3.3: the t sub-wallets participating in the transaction request the service provider for the auxiliary information corresponding to the pseudonym cn, and the service provider returns the auxiliary information to the corresponding sub-wallet, i.e., ai i is returned to the i-th sub-wallet;

[0031] Step S3.4: the t sub-wallets participating in the transaction randomly select one sub-wallet m according to the public auxiliary information pai in the auxiliary information, and run the PSAGen algorithm to obtain a stealth address sa and a proof π;

[0032] Step S3.5: among the t sub-wallets, except for the sub-wallet m, the other sub-wallets judge whether the generation of the stealth address sa is correct according to the stealth address sa, the proof π and the public auxiliary information pai by the PSAVerify algorithm, if yes, output 1 and execute Step S3.6; if not, output 0; 1 represents derivation from pai, and 0 represents not derivation from pai;

[0033] Step S3.6: the t sub-wallets participating in the transaction execute the Bind algorithm to bind the random number R and the pseudonym cn to obtain a binding proof π (R,cn) ;

[0034] Step S3.7: the t sub-wallets participating in the transaction organize transaction information according to the stealth address and execute the ThSign σ algorithm to obtain a digital signature for the transaction information, which contains R but does not contain cn;

[0035] Step S3.8: after the digital signature is correctly generated, the t sub-wallets participating in the transaction upload the transaction to the chain, and send the supervision information corresponding to each sub-wallet to each offline sub-wallet and the supervision party respectively;

[0036] The supervision information includes the random number R, the pseudonym cn and the binding proof π (R,cn) , i.e., (R, cn, π (R,cn) ).

[0037] Preferably, the PSAGen algorithm and the PSAVerify algorithm are as follows:

[0038] PSAGen(pai)→(sa, π)

[0039] PSA Verify(sa, n, pai)→0 / 1

[0040] The PSA Gen algorithm inputs a masking public key and public auxiliary information pai, and outputs a stealth address sa and corresponding evidence n;

[0041] The PSA Verify algorithm inputs a stealth address sa, evidence n and public auxiliary information pai, and outputs 1 if sa is obtained by running PSA Gen with pai, otherwise outputs 0;

[0042] The Bind algorithm is as follows:

[0043] The Bind algorithm inputs binding messages m1, m2 and public and private key pairs of at least t honest sub-wallets, and outputs a binding proof The Bind algorithm is executed by t sub-wallets P1, P2,..., Pt participating in the transaction t Interactively.

[0044] Preferably, the step S4 comprises the following sub-steps:

[0045] Step S4.1: The supervisor receives supervision information and looks up transaction information containing the random number R on the blockchain;

[0046] Step S4.2: Perform the BindVerify algorithm to verify the transaction information, and after verification, obtain the partial masked receiver public key corresponding to the pseudonym cn from the service provider, i.e. the receiver masked public key mpk r ;

[0047] Step S4.3: Record the receiver search public key pvk r in the receiver masked public key mpk r , and obtain the corresponding receiver public key pk r through the receiver search public key pvk r .

[0048] Preferably, it further comprises a step of obtaining a receiver pseudonym by an offline sub-wallet:

[0049] After the offline sub-wallet goes online, i.e. enters a state that can participate in transactions, if the offline sub-wallet receives supervision information (R', cn', n' (R′,cn′) ) from any of the t sub-wallets participating in the transaction, the offline sub-wallet will request the public auxiliary information corresponding to cn' and the private auxiliary information it should have from the service provider by performing steps S4.1 to S4.3.

[0050] According to the invention, a stealth address supervision system suitable for a blockchain threshold wallet is provided, comprising:

[0051] Module M1: The receiver and sender obtain the public and private key pairs of their own wallets respectively;

[0052] Module M2: The recipient registers the public and private key pair of their own wallet and obtains a pseudonym and auxiliary information corresponding to the pseudonym for generating a hidden address;

[0053] Module M3: The sender initiates a transaction. After the transaction is uploaded to the blockchain, the sub-wallets involved in the transaction send the corresponding regulatory information to the regulator and the offline sub-wallet.

[0054] Module M4: The supervisor supervises the supervisory information.

[0055] Compared with the prior art, the present invention has the following beneficial effects:

[0056] 1. This invention enables the threshold wallet to derive a stealth address for the recipient without knowing the recipient's public key. The recipient's public key can only be revealed with the cooperation of at least t honest sub-wallets. This can prevent malicious sub-wallets from leaking link relationships and enable the threshold wallet to trace past transactions when necessary.

[0057] 2. The present invention enables the supervisor to obtain the recipient's public key corresponding to the hidden address, and actively report the recipient's information through the threshold wallet to restore the recipient's public key. At the same time, the supervisor can identify the correct information from t-1 incorrect information and 1 correct information.

[0058] 3. The present invention uses the AIGen algorithm to generate auxiliary information for stealth addresses, so that stealth addresses can be generated without the need for interaction between the sender and the receiver, and privacy is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Other features, objects and advantages of the present invention will become more apparent upon reading the detailed description of non-limiting embodiments with reference to the following drawings:

[0060] Figure 1 It is a schematic flow chart of the working method of the present invention. DETAILED DESCRIPTION

[0061] The present invention will be described in detail below with reference to specific embodiments. The following examples will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those skilled in the art, several changes and improvements can be made without departing from the scope of the present invention. These all fall within the scope of protection of the present invention.

[0062] The present invention includes a sender, a receiver, a service provider, and a regulator. The service provider is defined as not colluding with the sender's dishonest sub-wallet and being honest to the regulator.

[0063] According to the present invention, a hidden address supervision method suitable for a blockchain threshold wallet is provided. Figure 1 Shown, including:

[0064] Step S1: The receiver and sender obtain the public and private key pairs of their own wallets. The sender as a threshold wallet includes P1, P2, ..., P n These n sub-wallets, ID s The sender's ID r The receiver's identity identifier. Specifically, the n sub-wallets in the sender run SubWalletKeyGen(ID s ) Get the sender's public key pk s , and the public key pk s and private key sk s The n shards are recorded as the public and private key shards P of the threshold wallet i , as follows:

[0065] P i =(pk s,i ,sk s,i ),i∈[1,n]

[0066] The receiver runs KeyGen(ID r ) to obtain a public-private key pair (pk r ,sk r ), that is, ((pvk r ,svk r ),(psk r ,ssk r )). Among them, pvk r Indicates that the receiver retrieves the public key, svk r Indicates that the receiver retrieves the private key, psk r Indicates the recipient's spending public key, ssk rRepresents the recipient's spending private key. The SubWalletKeyGen algorithm takes a user identifier (ID) as input and outputs a public key (pk) and n shards of it and the private key (sk). This algorithm is run by n sub-wallet users to obtain the threshold wallet's public and private key shards. The KeyGen algorithm takes a user identifier (ID) as input and outputs a public-private key pair (pk, sk). The public key (pk) consists of a retrieval public key and a spending public key pair (pvk, psk), and the private key consists of a retrieval private key and a spending private key pair (svk, ssk). The KeyGen algorithm is run by the recipient to obtain a public-private key pair that can be used with a stealth address.

[0067] Step S2: The recipient registers the public and private key pair of their own wallet and obtains a pseudonym and auxiliary information corresponding to the pseudonym for generating a hidden address. Step S2 includes the following sub-steps:

[0068] Step S2.1: The receiver masks its own public key and obtains the masked public key mpk r The masking process includes partially masking the recipient's public key, and the partial masking means only masking the recipient's spending public key psk r , as follows:

[0069] mpk r =(pvk r ,mpsk r )

[0070] Among them, mpsk r Indicates that the recipient masks the spending public key. The purpose of masking in this step is for the sender. The service party itself can know the recipient's public key before masking. However, because the generation (sender) and detection (receiver) of the stealth address both require the spending public key psk, and the spending public key psk cannot be known by the sender.

[0071] Step S2.2: The server receives the recipient's masked public key mpk r After that, a unique pseudonym cn is randomly generated and sent to the recipient.

[0072] Step S2.3: The service provider obtains the auxiliary information (pai, ai) for generating the concealed address corresponding to the pseudonym according to the AIGen algorithm and the recipient's masked public key. i), where pai represents public auxiliary information, ai represents private auxiliary information, i=1, 2,…n, and n represents the number of private auxiliary information. The function of the AIGen algorithm is actually to mask the retrieval public key pvk and then shard it, while the masked spending public key mpsk remains unchanged. That is to say, the retrieval public key pvk is masked first, and then the masking factor is sharded. The masked retrieval public key pvk and masked spending public key mpsk are both part of the public auxiliary information pai, and the sharding of the masking factor is part of the private auxiliary information ai. Then, the subsequent generation of the hidden address is equivalent to being based on the masked pvk and mpsk. This method of masking first and then sharding the masking factor can make the hidden address generate without the need for interaction between the sender and the receiver, and improves privacy. The AIGen algorithm is as follows: AIGen(mpk)→(pai,{ai i} i∈[1,n] ), input the masked public key mpk, and output 1 public auxiliary information and n private auxiliary information.

[0073] Step S3: The sender initiates a transaction. After the transaction is uploaded to the blockchain, the sub-wallets participating in the transaction send the corresponding regulatory information to the regulator and the offline sub-wallet. Assume that the sub-wallets participating in the transaction are P1, P2, ..., P t , other sub-wallets are offline, i.e. they do not participate in this transaction. Step S3 includes the following sub-steps:

[0074] Step S3.1: The receiver sends the pseudonym cn that has been registered with the service provider to the t sub-wallets P1, P2, ..., P involved in the transaction. t .

[0075] Step S3.2: t sub-wallets P1, P2, ..., P participating in the transaction t Execute ThSign R The algorithm obtains a random number R. Among them, ThSign R The algorithm is as follows:

[0076] ThSign R ({(pk i ,sk i )} i∈T,|T|＞t-1 )→(R,{state i} i∈T,|T|＞t-1 )

[0077] Input at least t public and private key pairs, and output a public random number R and the private state information state of each sub-wallet. i ,This algorithm is the pre-signature phase, which is interactively run by at least t sub-wallets of the threshold wallet, with the purpose of generating random numbers for the formal signing phase.

[0078] Step S3.3: t sub-wallets P1, P2, ..., P participating in the transaction t Request the auxiliary information corresponding to the pseudonym cn from the service provider, and the service provider returns the auxiliary information to the corresponding sub-wallet, i.e. i Return to the i-th sub-wallet.

[0079] Step S3.4: t sub-wallets P1, P2, ..., P participating in the transaction t , based on the public auxiliary information pai in the auxiliary information, randomly select a sub-wallet m and run the PSAGen algorithm to obtain a hidden address sa and a proof π. Among the t sub-wallets, the other sub-wallets except sub-wallet m use the PSAVerify algorithm to determine whether the generation of the hidden address sa is correct, that is, whether it is derived from pai. If so, output 1 and execute step S3.5; if not, output 0. The PSAGen and PSAVerify algorithms are as follows:

[0080] PSAGen(pai)→(sa,π)

[0081] PSAVerify(sa,π,pai)→0 / 1

[0082] The PSAGen algorithm inputs the masked public key public auxiliary information pai and outputs the hidden address sa and the corresponding evidence π.

[0083] The PSAVerify algorithm inputs the hidden address sa, evidence π and public auxiliary information pai. When sa is obtained by running PSAGen on pai, it outputs 1, otherwise it outputs 0.

[0084] Step S3.5: After the shielded address is correctly generated, the t sub-wallets P1, P2, ..., P t Execute the Bind algorithm to bind the random number R and the pseudonym cn to obtain the binding evidence π (R,cn) , as follows:

[0085] Bind(R,cn,{(pk s,i ,sk s,i )} i∈[1,t] )→π (R,cn)

[0086] The Bind algorithm is as follows: Input binding message m1, m2 and at least t honest sub-wallets' public and private key pairs, output binding proof The algorithm consists of P1, P2, ..., P t Run interactively.

[0087] Step S3.6: After R and cn are correctly bound, the t sub-wallets P1, P2, ..., P t Organize transaction information based on shielded addresses and execute ThSign σ The algorithm obtains a digital signature for the transaction information, which contains R but does not contain cn. σ The algorithm is as follows:

[0088] ThSign σ (m,R,{(state i ,pk i ,sk i )} i∈T,|T|＞t-1 )→σ, input message m, random number R and at least t public-private key pair shards and corresponding state information, output digital signature σ, this algorithm is the formal stage, and is interactively run by at least t sub-wallets of the threshold wallet to generate digital signatures for transaction information.

[0089] The validity of digitally signed transaction information can also be verified using the ThVerify algorithm. The ThVerify algorithm is as follows: ThVerify(m,σ,pk)→0 / 1: The algorithm takes as input a message signature pair (m,σ) and a public key pk, and outputs 1 if the signature is valid, and 0 otherwise. This algorithm can be run by any user to confirm the validity of transaction information.

[0090] Step S3.7: After the digital signature is correctly generated, the t sub-wallets P1, P2, ..., P t The transaction is put on the chain, and the supervision information corresponding to each sub-wallet is sent to each offline sub-wallet and regulator. The supervision information includes the random number R, the pseudonym cn and the binding evidence π (R,cn) , that is (R,cn,π (R,cn) ).

[0091] Step S4: The supervisor supervises the supervisory information. Step S4 includes the following sub-steps:

[0092] Step S4.1: The supervisor receives the supervisory information and searches for transaction information containing the random number R on the blockchain.

[0093] Step S4.2: Execute the BindVerify algorithm to verify the transaction information. After the verification is passed, obtain the partially masked public key of the recipient corresponding to the pseudonym cn from the service provider, that is, the recipient masked public key mpk r Among them, the BindVerify algorithm is as follows:

[0094]

[0095] Input binding message m1, m2 and binding proof When the binding is valid, 1 is output, and when it is invalid, 0 is output. The algorithm is run by the offline sub-wallet and the regulator.

[0096] Step S4.3: Record the recipient's masked public key mpk r The receiver retrieves the public key pvk r , retrieve the public key pvk by the receiver r Get the corresponding recipient public key pk r .

[0097] Specifically, after the supervisor receives the message (R′,cn′,π′ (R′,cn′) ), the supervisor will search for transaction information containing R' on the blockchain. After the supervisor finds the transaction information containing R', the supervisor will execute BindVerify(R',cn',π' (R′,cn′) ). In BindVerify(R′,cn′,π′ (R′,cn′) ) returns 1, that is, R' and cn' are correctly bound, the supervisor will obtain the partially masked public key of the recipient corresponding to cn' from the service provider. After the supervisor obtains the partially masked public key of the recipient, it will record the pvk r , through pvk r You can find the recipient's public key pk r .

[0098] The hidden address supervision method for the blockchain threshold wallet of the present invention also includes a step of obtaining a pseudonym of the recipient by the offline sub-wallet. After the offline sub-wallet goes online, that is, enters a state where it can participate in transactions, if the offline sub-wallet receives t sub-wallets P1, P2, ..., P from participating transactions, t Regulatory information of any sub-wallet (R′, cn′, π′ (R′,cn′) ), the offline sub-wallet will search for transaction information containing random numbers on the blockchain. After the offline sub-wallet finds the transaction information containing R′, the offline sub-wallet will execute BindVerify(R′,cn′,π′ (R′,cn′) ). In BindVerify(R′,cn′,π′ (R′,cn′) ) returns 1, that is, R′ and cn′ are correctly bound. The offline sub-wallet will request the public auxiliary information corresponding to cn′ and the private auxiliary information it deserves from the service provider.

[0099] Step S4 and the offline sub-wallet obtaining the recipient pseudonym step can ensure that all sub-wallets can obtain their own private auxiliary information, which also ensures that all honest sub-wallets can obtain their own private auxiliary information. t honest sub-wallets reveal the recipient's public key, and any t honest sub-wallets can execute RKeyGen(pai,{ai i} i∈T,|T|＞t-1 ) to obtain the recipient's pvk r , thus through pvk r Find the recipient's public key pk r .

[0100] Furthermore, the hidden address supervision method applicable to the blockchain threshold wallet of the present invention is described in detail as follows through experiments:

[0101] The experiments were conducted on a laptop equipped with an Intel(R) Core(TM) ,i5-10210U CPU 1.60GHz and 16GB of memory, and the ,programming language used was Rust.

[0102] The algorithms in steps S1 through S4 above were implemented using ECDSA, and the most widely used threshold signature scheme, also based on ECDSA, was used as a benchmark for comparison. This invention primarily adds a receiver registration phase, a server auxiliary information generation phase, and a sender recovery phase for the receiver's public key. Experimental results show that the computational cost of these phases averages only 7.5% of that of the threshold signature phase, demonstrating the complete practicality of this invention. The experimental results are shown in the figure below, measured in milliseconds:

[0103]

[0104] The purpose of this invention is to ensure that when a threshold wallet, acting as the sender, uses stealth address technology to generate a stealth address for a recipient, all sub-wallets will know the recipient's public key corresponding to the stealth address. A malicious sub-wallet could leak this correspondence, thereby compromising the recipient's privacy. In this case, the threshold wallet should derive the stealth address for the recipient without knowing the recipient's public key, and only reveal the recipient's public key when at least t honest sub-wallets cooperate. This prevents malicious sub-wallets from leaking the link relationship and allows the threshold wallet to trace past transactions if necessary. To ensure that the regulator can obtain the recipient's public key corresponding to the stealth address, the threshold wallet must proactively report the recipient's information to the regulator, which can then use this information to recover the recipient's public key. Honest sub-wallets will send correct information, but dishonest sub-wallets may send incorrect information, thus necessitating the regulation of this information.

[0105] Specifically, the present invention aims to enable a sender's threshold wallet to derive a shielded address for a recipient's public key without knowing the recipient's public key. Any t honest sub-wallets collaborating can reveal the recipient's public key corresponding to the shielded address. Given t-1 incorrect messages and 1 correct message, a supervisor can identify the correct message. Based on the correct message, the recipient's public key can be recovered.

[0106] The present invention also provides a hidden address supervision system applicable to a blockchain threshold wallet. The hidden address supervision system applicable to a blockchain threshold wallet can be implemented by executing the process steps of the hidden address supervision method applicable to the blockchain threshold wallet. That is, those skilled in the art can understand the hidden address supervision method applicable to the blockchain threshold wallet as a preferred implementation of the hidden address supervision system applicable to the blockchain threshold wallet.

[0107] According to the present invention, a hidden address supervision system applicable to a blockchain threshold wallet is provided, comprising:

[0108] Module M1: The receiver and sender obtain the public and private key pairs of their own wallets respectively; the sender, as a threshold wallet, includes n sub-wallets, and runs SubWalletKeyGen(ID s ) Get the sender's public key pk s , and the public key pk s and n fragments of the private key sk, recorded as the sender's public and private key fragments P i , as follows: P i =(pk s,i ,sk s,i ),i∈[1,n] The receiver runs KeyGen(ID r ) to obtain the recipient's public and private key pair (pk r ,sk r ), that is, ((pvk r ,svk r ),(psk r ,ssk r )); Among them, pvk r Indicates that the receiver retrieves the public key, svk r Indicates that the receiver retrieves the private key, psk r Indicates the recipient's spending public key, ssk r Indicates the recipient spends the private key, ID s The sender's ID r The recipient's identifier.

[0109] Module M2: The recipient registers according to the public and private key pair of his own wallet and obtains a pseudonym and auxiliary information corresponding to the pseudonym for generating a hidden address; the module M2 includes the following submodules: Module M2.1: The recipient masks his own public key and obtains the masked public key mpk r And send the masked public key to the service party; Module M2.2: The service party receives the recipient's masked public key mpk r After that, a unique pseudonym cn is randomly generated and sent to the recipient; Module M2.3: The service party obtains the auxiliary information (pai, ai) corresponding to the pseudonym for concealed address generation according to the AIGen algorithm and the recipient's masked public key. i ), where pai represents public auxiliary information, ai represents private auxiliary information, i = 1, 2, ... n, and n represents the number of private auxiliary information.

[0110] The masking process includes partially masking the recipient's public key; the partial masking means that only the recipient's spending public key psk in the recipient's public key is masked. r , as follows: mpk r =(pvk r ,mpsk r )Among them, mpk r Indicates that the receiver masks the public key, mpsk r Indicates the recipient's masked spending public key, pvk r Indicates that the receiver retrieves the public key. The AIGen algorithm is as follows: AIGen(mpk)→(pai,{ai i} i∈[1,n] ), input the masked public key mpk, and output 1 public auxiliary information and n private auxiliary information; the AIGen algorithm actually masks the retrieval public key pvk and then shards the masking factor, while the masked spending public key mpsk remains unchanged. The masked retrieval public key pvk and masked spending public key mpsk are both part of the public auxiliary information pai, and the shards of the masking factor are part of the private auxiliary information ai.

[0111] Module M3: The sender initiates a transaction. After the transaction is put on the chain, the sub-wallets participating in the transaction send the corresponding regulatory information to the regulator and the offline sub-wallet. The module M3 includes the following sub-modules: Module M3.1: The receiver sends the pseudonym cn to the t sub-wallets participating in the transaction; Module M3.2: The t sub-wallets participating in the transaction trigger ThSign R The algorithm obtains the random number R; Module M3.3: The t sub-wallets participating in the transaction request the auxiliary information corresponding to the pseudonym cn from the service provider, and the service provider returns the auxiliary information to the corresponding sub-wallet, i.e., ai iReturned to the i-th sub-wallet); Module M3.4: The t sub-wallets participating in the transaction arbitrarily select a sub-wallet m based on the public auxiliary information pai in the auxiliary information to run the PSAGen algorithm to obtain a hidden address sa and a evidence π; Module M3.5: Among the t sub-wallets, the other sub-wallets except sub-wallet m use the PSAVerify algorithm to determine whether the generation of the hidden address sa is correct based on the hidden address sa, evidence π and public auxiliary information pai. If so, output 1 and trigger module M3.6; if not, output 0; 1 indicates that it is derived from the pai operation, and 0 indicates that it is not derived from the pai operation; Module M3.6: The t sub-wallets participating in the transaction trigger the Bind algorithm to bind the random number R and the pseudonym cn to obtain the binding evidence π (R,cn) Module M3.7: The t sub-wallets involved in the transaction organize transaction information according to the hidden address and trigger ThSign σ The algorithm obtains a digital signature for the transaction information, which contains R but not cn. Module M3.8: After the digital signature is correctly generated, the t sub-wallets participating in the transaction will upload the transaction to the chain and send the corresponding regulatory information of each sub-wallet to each offline sub-wallet and the regulator. The regulatory information includes the random number R, the pseudonym cn, and the binding evidence π. (R,cn) , that is (R,cn,π (R,cn) ).

[0112] The PSAGen algorithm and PSAVerify algorithm are as follows:

[0113] PSAGen(pai)→(sa,π),PSAVerify(sa,π,pai)→0 / 1

[0114] The PSAGen algorithm takes as input the masked public key public auxiliary information pai and outputs the hidden address sa and the corresponding evidence π. The PSAVerify algorithm takes as input the hidden address sa, evidence π and public auxiliary information pai and outputs 1 if sa is obtained by running PSAGen on pai, otherwise it outputs 0.

[0115] The Bind algorithm is as follows: Input binding message m1, m2 and at least t honest sub-wallets' public and private key pairs, output binding proof The Bind algorithm is composed of t sub-wallets P1, P2, ..., P t Run interactively.

[0116] Module M4: The supervisor supervises the supervisory information. Module M4 includes the following submodules: Module M4.1: The supervisor receives the supervisory information and searches for transaction information containing the random number R on the blockchain; Module M4.2: Triggers the BindVerify algorithm to verify the transaction information. After verification, the supervisor obtains the partially masked public key of the recipient corresponding to the pseudonym cn from the service provider, i.e., the recipient's masked public key mpk r ; Module M4.3: Record the recipient's masked public key mpk r The receiver retrieves the public key pvk r , retrieve the public key pvk by the receiver r Get the corresponding recipient public key pk r .

[0117] It also includes an offline sub-wallet to obtain the recipient pseudonym module: after the offline sub-wallet goes online, that is, enters the state where it can participate in transactions, if the offline sub-wallet receives the regulatory information (R′, cn′, π′) from any of the t sub-wallets participating in the transaction, (R′,cn′) ), the offline sub-wallet will trigger modules M4.1 to M4.3 to request the public auxiliary information corresponding to cn′ and the private auxiliary information it deserves from the service provider.

[0118] Those skilled in the art will appreciate that, in addition to implementing the system and its various devices, modules, and units provided by the present invention in purely computer-readable program code, it is entirely possible to implement the same functions of the system and its various devices, modules, and units provided by the present invention in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system and its various devices, modules, and units provided by the present invention can be considered a hardware component, and the devices, modules, and units included therein for implementing various functions can also be considered as structures within the hardware component; the devices, modules, and units for implementing various functions can also be considered as both software modules implementing the method and structures within the hardware component.

[0119] The above describes specific embodiments of the present invention. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art may make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. The embodiments of this application and the features in the embodiments may be combined with each other in any manner unless there is a conflict.

Claims

1. A hidden address supervision method applicable to a blockchain threshold wallet, characterized in that: include: Step S1: The receiver and sender obtain the public and private key pairs of their own wallets respectively; Step S2: The recipient registers the public and private key pair of their own wallet and obtains a pseudonym and auxiliary information corresponding to the pseudonym for generating a hidden address; Step S3: The sender initiates a transaction. After the transaction is uploaded to the blockchain, the sub-wallets participating in the transaction send the corresponding regulatory information to the regulator and the offline sub-wallet. Step S4: The supervisor supervises the supervisory information; The step S3 includes the following sub-steps: Step S3.1: The recipient sends the pseudonym cn to the t sub-wallets involved in the transaction; Step S3.2: The t sub-wallets involved in the transaction execute ThSign R The algorithm obtains a random number R; Step S3.3: The t sub-wallets participating in the transaction request the auxiliary information corresponding to the pseudonym cn from the service provider, and the service provider returns the auxiliary information to the corresponding sub-wallets; Step S3.4: The t sub-wallets participating in the transaction randomly select a sub-wallet m based on the public auxiliary information pai in the auxiliary information and run the PSAGen algorithm to obtain a hidden address sa and a piece of evidence π; Step S3.5: Among the t sub-wallets, the other sub-wallets except sub-wallet m use the PSAVerify algorithm to determine whether the generation of the hidden address sa is correct based on the hidden address sa, evidence π and public auxiliary information pai. If so, output 1 and execute step S3.6; if not, output 0; 1 indicates that it is derived from pai, and 0 indicates that it is not derived from pai. Step S3.6: The t sub-wallets participating in the transaction execute the Bind algorithm to bind the random number R and the pseudonym cn to obtain the binding evidence π (R,cn) ; Step S3.7: The t sub-wallets involved in the transaction organize the transaction information according to the hidden address and execute ThSign σ The algorithm obtains a digital signature for the transaction information, which contains R but not cn; Step S3.8: After the digital signature is correctly generated, the t sub-wallets involved in the transaction will upload the transaction to the blockchain and send the corresponding regulatory information of each sub-wallet to each offline sub-wallet and the regulator. The regulatory information includes the random number R, the pseudonym cn and the binding evidence π (R,cn) , that is (R,cn,π (R,cn) ).

2. The hidden address supervision method for a blockchain threshold wallet according to claim 1 is characterized in that: The sender acts as a threshold wallet including n sub-wallets, and runs SubWalletKeyGen(ID s ) Get the sender's public key pk s , and the public key pk s and private key sk s n fragments, recorded as the sender's public and private key fragments P i , as follows: P i =(pk s,i ,sk s,i ),i∈[1,n] The receiver runs KeyGen(ID r ) to obtain the recipient's public and private key pair (pk r ,sk r ), that is, ((pvk r ,svk r ),(psk r ,ssk r )); Among them, pvk r Indicates that the receiver retrieves the public key, svk r Indicates that the receiver retrieves the private key, psk r Indicates the recipient's spending public key, ssk r Indicates the recipient spends the private key, ID s The sender's ID r The recipient's identifier.

3. The hidden address supervision method for blockchain threshold wallet according to claim 1 is characterized in that: The step S2 includes the following sub-steps: Step S2.1: The receiver masks its own public key and obtains the masked public key mpk r and sending the masked public key to the service provider; Step S2.2: The server receives the recipient's masked public key mpk r After that, a unique pseudonym cn is randomly generated and sent to the recipient; Step S2.3: The service provider obtains the auxiliary information (pai, ai) for generating the concealed address corresponding to the pseudonym according to the AIGen algorithm and the recipient's masked public key. i ), where pai represents public auxiliary information, ai represents private auxiliary information, i = 1, 2, ... n, and n represents the number of private auxiliary information.

4. The hidden address supervision method for a blockchain threshold wallet according to claim 3 is characterized in that: The masking process includes partially masking the recipient's public key; The partial masking refers to masking only the recipient's spending public key psk in the recipient's public key r , as follows: mpk r =(pvk r ,mpsk r ) Among them, mpk r Indicates that the receiver masks the public key, mpsk r Indicates the recipient's masked spending public key, pvk r Indicates that the receiver retrieves the public key.

5. The hidden address supervision method for blockchain threshold wallet according to claim 3 is characterized in that: The AIGen algorithm is as follows: AIGen(mpk)→(pai,{ai i } i∈[1,n] ), input masked public key mpk, output 1 public auxiliary information and n private auxiliary information; The AIGen algorithm actually masks the retrieval public key pvk and then shards the masking factor, while the masked spending public key mpsk remains unchanged. The masked retrieval public key pvk and masked spending public key mpsk are both part of the public auxiliary information pai, and the shards of the masking factor are part of the private auxiliary information ai.

6. The hidden address supervision method for a blockchain threshold wallet according to claim 1 is characterized in that: The PSAGen algorithm and PSAVerify algorithm are as follows: PSAGen(pai)→(sa,π) PSAVerify(sa,π,pai)→0 / 1 The PSAGen algorithm inputs the masked public key public auxiliary information pai and outputs the hidden address sa and the corresponding evidence π; The PSAVerify algorithm inputs the hidden address sa, evidence π and public auxiliary information pai. When sa is obtained by running PSAGen on pai, it outputs 1, otherwise it outputs 0; The Bind algorithm is as follows: Input binding message m1, m2 and at least t honest sub-wallets' public and private key pairs, output binding proof The Bind algorithm is composed of t sub-wallets P1, P2, ..., P t Run interactively.

7. The hidden address supervision method for blockchain threshold wallet according to claim 1 is characterized in that: The step S4 includes the following sub-steps: Step S4.1: The supervisor receives the supervisory information and searches the blockchain for transaction information containing the random number R; Step S4.2: Execute the BindVerify algorithm to verify the transaction information. After the verification is passed, obtain the partially masked public key of the recipient corresponding to the pseudonym cn from the service provider, that is, the recipient masked public key mpk r ; Step S4.3: Record the recipient's masked public key mpk r The receiver retrieves the public key pvk r , retrieve the public key pvk by the receiver r Get the corresponding recipient public key pk r .

8. The hidden address supervision method for blockchain threshold wallet according to claim 1 is characterized in that: It also includes the steps for the offline sub-wallet to obtain the recipient's pseudonym: After the offline sub-wallet goes online, that is, enters the state where it can participate in transactions, if the offline sub-wallet receives regulatory information (R′, cn′, π′) from any of the t sub-wallets participating in the transaction, (R′,cn′) ), the offline sub-wallet will request the public auxiliary information corresponding to cn′ and the private auxiliary information it deserves from the service provider by executing steps S4.1 to S4.

3.

9. A hidden address monitoring system suitable for blockchain threshold wallets, characterized in that: include: Module M1: The receiver and sender obtain the public and private key pairs of their own wallets respectively; Module M2: The recipient registers the public and private key pair of their own wallet and obtains a pseudonym and auxiliary information corresponding to the pseudonym for generating a hidden address; Module M3: The sender initiates a transaction. After the transaction is uploaded to the blockchain, the sub-wallets involved in the transaction send the corresponding regulatory information to the regulator and the offline sub-wallet. Module M4: The supervisor supervises the supervisory information; The module M3 includes the following submodules: Module M3.1: The recipient sends the pseudonym cn to the t sub-wallets involved in the transaction; Module M3.2: t sub-wallets participating in the transaction execute ThSign R The algorithm obtains a random number R; Module M3.3: The t sub-wallets participating in the transaction request the auxiliary information corresponding to the pseudonym cn from the service provider, and the service provider returns the auxiliary information to the corresponding sub-wallets; Module M3.4: The t sub-wallets participating in the transaction randomly select a sub-wallet m based on the public auxiliary information pai in the auxiliary information and run the PSAGen algorithm to obtain a hidden address sa and a proof π; Module M3.5: Among the t sub-wallets, the other sub-wallets except sub-wallet m use the PSAVerify algorithm to determine whether the generation of the hidden address sa is correct based on the hidden address sa, evidence π, and public auxiliary information pai. If so, output 1 and execute module M3.6; if not, output 0; 1 indicates that it is derived from pai, and 0 indicates that it is not derived from pai. Module M3.6: The t sub-wallets participating in the transaction execute the Bind algorithm to bind the random number R and the pseudonym cn to obtain the binding evidence π (R,cn) ; Module M3.7: The t sub-wallets involved in the transaction organize transaction information according to the hidden address and execute ThSign σ The algorithm obtains a digital signature for the transaction information, which contains R but not cn; Module M3.8: After the digital signature is correctly generated, the t sub-wallets involved in the transaction will upload the transaction to the blockchain and send the corresponding regulatory information of each sub-wallet to each offline sub-wallet and the regulator. The regulatory information includes the random number R, the pseudonym cn and the binding evidence π (R,cn) , that is (R,cn,π (R,cn) ).

10. The hidden address monitoring system for blockchain threshold wallet according to claim 9 is characterized in that: The sender acts as a threshold wallet including n sub-wallets, and runs SubWalletKeyGen(ID s ) Get the sender's public key pk s , and the public key pk s and private key sk s n fragments, recorded as the sender's public and private key fragments P i , as follows: P i =(pk s,i ,sk s,i ),i∈[1,n] The receiver runs KeyGen(ID r ) to obtain the recipient's public and private key pair (pk r ,sk r ), that is, ((pvk r ,svk r ),(psk r ,ssk r )); Among them, pvk r Indicates that the receiver retrieves the public key, svk r Indicates that the receiver retrieves the private key, psk r Indicates the recipient's spending public key, ssk r Indicates the recipient spends the private key, ID s The sender's ID r The recipient's identifier.

Images