Block chain identity anonymization method capable of being supervised by multiple parties

Abstract

The invention discloses a block chain identity anonymity method capable of being supervised by multiple parties, and the method comprises the steps: receiving a transaction sent by a sender, and the transaction comprises a one-time address, a plurality of identity ciphertexts, and a plurality of supervisible certificates; the one-time address is a target address generated by the sender according to a query public key and a decryption public key of the identity information certificate sent by the receiver; the identity ciphertext is obtained by encrypting a query public key and a decryption public key of a receiver by the sender through the public keys of the supervision parties; the multi-party supervision proof is obtained by the sender through calculation based on a one-time address calculation process, an identity ciphertext encryption process and an identity information certificate; the sender and the receiver register in the public key infrastructure to obtain an identity information certificate; and verifying the multi-party supervision proof, and if the verification is passed, confirming the transaction and executing the transaction. According to the method and the device, the anonymity of the identity and the non-linkability between the one-time addresses of the same identity are ensured.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a blockchain identity anonymity method that can be supervised by multiple parties. Background Art

[0002] In modern transactions, identity anonymization technology plays a vital role. This technology protects user privacy and security by encrypting and anonymizing the personal information of both parties to the transaction. It not only helps prevent identity theft and fraud, but also enhances user trust in the trading platform and promotes the smooth progress of transactions. In this way, identity anonymization technology provides a more secure and private environment for financial transactions.

[0003] The publication number CN114066449A "Blockchain User Identity Anonymity and Tracking Method and System with Multi-center Collaborative Supervision" sends the user's tag attributes and the user's identity to the registration center in the blockchain network to obtain a certificate, encrypts the user's tag attributes with the public key of the tracking center, and randomizes the certificate obtained from the registration center. According to the public and private key pairs used for transactions generated by the user, the encrypted user's tag attributes and the randomized certificate are combined to generate transactions and upload them to the blockchain. The tracking center can decrypt the identity information through the authorization center if the number of authorization centers that agree to decrypt is greater than the threshold value, thereby achieving the anonymity of the user's identity and the traceability of the transaction without increasing the burden on the system. However, in this way, transactions are still interacted with the account public key, which makes the transactions linkable, so that if the identity corresponding to a public key is obtained, then the identity information of the transactions corresponding to the public key can be identified. Summary of the invention

[0004] Based on this, in response to the above technical problems, a blockchain identity anonymity method that can be supervised by multiple parties is provided to solve the problem that transactions in the existing technology are linkable.

[0005] In a first aspect, a blockchain identity anonymity method capable of being supervised by multiple parties, the method comprising:

[0006] Receive a transaction sent by a sender, wherein the transaction includes: a one-time address, multiple identity ciphertexts, and a proof of multi-party supervision; the one-time address is a target address generated by the sender according to the query public key and decryption public key of the identity information certificate sent by the receiver; the identity ciphertext is obtained by the sender encrypting the query public key and decryption public key of the receiver with the public keys of each supervisor respectively; the proof of multi-party supervision is calculated by the sender based on the one-time address calculation process, the identity ciphertext encryption process, and the identity information certificate; the sender and the receiver are both registered in the public key infrastructure to obtain the identity information certificate;

[0007] Verify the multi-party supervision proof. If the verification is successful, confirm the transaction and execute the transaction. If the verification fails, refuse to execute the transaction.

[0008] In the above scheme, optionally, after confirming the transaction and executing the transaction, it also includes: responding to the recipient's instruction to obtain the one-time address, so that the recipient determines whether it matches the one-time address based on its own query public key, decryption public key and private key, and calculates the one-time private key if it matches so as to be able to process the result of executing the transaction.

[0009] In the above solution, optionally, the receiver determines whether the one-time address matches the one-time address based on its own query private key and decryption public key, including:

[0010] Calculate P′ based on the query private key and the public random number rG dec =P one -H(rP view )G;

[0011] Among them, s view rG=rP view ;

[0012] Then judge P′ dec Whether to match its own decryption public key.

[0013] In the above scheme, optionally, after confirming the transaction and executing the transaction, the method further includes: responding to the acquisition of the identity ciphertext by the supervisor, so that the supervisor uses the respective private keys to decrypt the received identity ciphertext for identity verification.

[0014] In the above solution, optionally, the one-time address is generated in the following manner:

[0015] Use the randomly generated random number r and the recipient's public key P view and the decryption public key P dec , calculate the one-time public key using the following formula:

[0016] P one =H(rP view )G+P dec

[0017] Among them, H refers to the hash function;

[0018] Use one-time public key P one The one-time address is calculated by the following formula:

[0019] A one =Address(P one )

[0020] Where Address() represents the function for calculating a one-time address.

[0021] In the above scheme, optionally, the regulatory proof is calculated in the following way:

[0022] Write a zk-STARK constraint that computes said one-time address;

[0023] Write a zk-STARK constraint for the identity ciphertext;

[0024] Write the zk-STARK constraint for the recipient’s identity certificate;

[0025] Set the zk-STARK public input to a one-time address and identity ciphertext, and the secret input to an identity certificate;

[0026] Perform calculations on the zk-STARK proof algorithm to obtain a controllable proof.

[0027] In the above solution, further optionally, verifying the multi-party supervisory proof includes:

[0028] Based on the provable zk-STARK constraints and public inputs, the zk-STARK verification algorithm is calculated to obtain a result of whether it is true or not.

[0029] In the above solution, optionally, the one-time private key is calculated by the following formula:

[0030] s one =H(rP view )+s dec

[0031] where s dec is the recipient's decryption private key.

[0032] In a second aspect, a computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of a blockchain identity anonymity method that can be supervised by multiple parties as described in the first aspect are implemented.

[0033] In a third aspect, a computer program product includes a computer program / instruction, which, when executed by a processor, implements the steps of a blockchain identity anonymity method that can be supervised by multiple parties as described in the first aspect above.

[0034] The present application has at least the following beneficial effects: In each transaction, the sender generates a one-time address based on the query public key and decryption public key of the receiver's identity information certificate. This address is used as the receiving target of the transaction. Since each transaction uses a different address, it is impossible to associate it with a specific individual through the address, thereby protecting the anonymity of the transaction. And the receiver's query public key and decryption public key are encrypted with the public keys of each regulator, so that only the corresponding regulator can decrypt this information, ensuring that the receiver's identity information cannot be read by others without the regulator's private key, thereby protecting the receiver's identity privacy, and at the same time calculating the encrypted identity ciphertext based on the multi-party supervision proof, ensuring that the regulator can effectively verify and decrypt the identity ciphertext. Thus, a transaction is generated based on a one-time address, multiple identity ciphertexts, and a multi-party supervision proof. The smart contract in the blockchain is a multi-party supervision proof. If the proof is established, it means that the identity ciphertext is correctly encrypted and the transaction can be confirmed. This step ensures the legitimacy of the transaction and protects the identity information of both parties from being disclosed. Therefore, the present application generates a one-time address for each transaction, thereby ensuring the anonymity of the identity and the unlinkability between one-time addresses of the same identity.

[0035] At the same time, the public key of the supervisor is used to encrypt the recipient's query public key and decryption public key to obtain the identity ciphertext, ensuring that multiple supervisors can independently decrypt the identity information and achieve independent supervision. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A flowchart of a blockchain identity anonymity method that can be supervised by multiple parties provided for one embodiment of the present application;

[0037] Figure 2 A detailed flow chart of a blockchain identity anonymity method that can be supervised by multiple parties, provided as an embodiment of the present application. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0039] Elliptic curve: An elliptic curve is a plane algebraic curve defined as satisfying the equation y 2 =x 3 +ax+b, where a and b are real constants. Elliptic curves are widely used in cryptography because of their computational difficulty in the elliptic curve discrete logarithm problem (ECDLP), which can provide efficient and secure encryption methods.

[0040] Public key: A public key is a public encryption key in a public key encryption system, used to encrypt messages or verify digital signatures. The public key is used in pairs with the corresponding private key, where the public key is public and the private key is kept secret, ensuring that only the person holding the private key can decrypt the information or generate a valid signature.

[0041] Private key: A private key is a secret key used to decrypt messages or generate digital signatures in a public key encryption system. It exists in pairs with the public key. The public key is public, while the private key must be kept strictly confidential. The security of the private key is critical because anyone who possesses the private key can decrypt information encrypted by the public key or forge a signature.

[0042] Address: An address is an identifier used in a blockchain system to receive digital assets, consisting of a string of letters and numbers. The process of generating an address usually starts with a public key generated by the user. First, the user generates a pair of keys: a private key and a public key. The public key is calculated from the private key using an elliptic curve cryptographic algorithm. The public key is then double-hashed (for example, first with SHA-256 and then with RIPEMD-160) to obtain a shorter hash value. Finally, this hash value is specifically encoded (such as Base58Check encoding) and prefixed to generate the final address. This address can be publicly used to receive digital assets, while the corresponding private key must be kept confidential to ensure the security of the transfer.

[0043] Hash function: A hash function is an algorithm that converts data input of arbitrary length into an output (hash value) of fixed length. Hash functions are one-way, that is, the original input cannot be reversed from the hash value, and the hash values ​​generated for different inputs are almost always different. It is widely used in data integrity verification, digital signatures, and cryptography.

[0044] zk-STARK and related concepts: zk-STARK (Zero-Knowledge Scalable Transparent Argument of Knowledge) is a zero-knowledge proof technology that allows a party to prove the authenticity of a certain knowledge or data without revealing any specific information. Zk-STARK is efficient, scalable and transparent, does not rely on trusted settings, and can provide fast verification in large-scale data and complex calculations. It has important applications in the fields of blockchain and privacy protection.

[0045] Constraints: A set of rules or conditions imposed on each state and transition between states in a computational process in order to verify the correctness of the computational process.

[0046] Public Input: Input data that is known to both parties and does not need to be hidden during the proof process. This data is usually used as the starting point of the calculation or the basis for verification.

[0047] Secret input: During the proof process, one party wishes to hide input data that the other party does not want to know. This data is usually sensitive information such as personal privacy or business secrets.

[0048] Proof Algorithm: A protocol that does not require a trusted setup. By arithmetizing the computation process and making polynomial commitments, it is possible to prove the correctness of the computation results to the verifier without leaking any private data.

[0049] Verification algorithm: Verify the correctness of the calculation process by performing a series of checks and calculations on the proof information provided by the prover, thereby ensuring that the prover has not cheated.

[0050] Smart Contract: A smart contract is a self-executing code deployed on the blockchain to automate and execute contract terms. It runs automatically when specific conditions are met without human intervention, thus ensuring the transparency and credibility of the contract. Smart contracts can handle functions such as asset transfer, automatic payment, and verification of conditions, and are widely used in finance, supply chain, insurance and other fields. Because it is based on blockchain technology, smart contracts are tamper-proof and irreversible, ensuring the security and reliability of contract execution.

[0051] Public Key Infrastructure: Public Key Infrastructure (PKI) is a framework for creating, managing, distributing, using, storing, and revoking digital certificates and public keys. By using encryption technology, public key infrastructure ensures the security of network communications and provides authentication, data integrity, and information confidentiality.

[0052] In one embodiment, Figure 1 and Figure 2 As shown, a blockchain identity anonymity method capable of multi-party supervision is provided, the method comprising:

[0053] Step S1: Receive a transaction sent by the sender, the transaction including: a one-time address, multiple identity ciphertexts and a multi-party supervisory certificate; the one-time address is a target address generated by the sender according to the query public key and decryption public key of the identity information certificate sent by the receiver; the identity ciphertext is obtained by the sender encrypting the query public key and decryption public key of the receiver with the public keys of each supervisor respectively; the multi-party supervisory certificate is calculated by the sender based on the one-time address calculation process, the identity ciphertext encryption process and the identity information certificate; the sender and the receiver are both registered in the public key infrastructure to obtain the identity information certificate;

[0054] Step S2: Verify the multi-party supervision certificate. If the verification is successful, confirm the transaction and execute it. If the verification fails, refuse to execute the transaction.

[0055] In this embodiment, first, public key infrastructure (PKI) registration and review: all participants must register in the public key infrastructure, which is responsible for reviewing the user's identity and issuing identity information certificates, including query public keys and decryption public keys.

[0056] Secondly, the receiver informs the sender of his identity certificate. The sender generates the receiver's one-time address based on the query public key and the decryption public key. This address will be used as the receiving target of the transaction to ensure the anonymity of the transaction.

[0057] Then, the sender encrypts the query public key and decryption public key of the receiver with the public keys of each supervisor, and the obtained multiple identity ciphertexts are associated with the corresponding supervisors. The encryption algorithm can use ElGamal encryption or DLIN encryption.

[0058] Finally, the sender calculates a multi-party supervisory proof based on the encrypted identity ciphertext. This proof is used to verify that the one-time address and the recipient's query public key and decryption public key are authentic and correspond to each other and hold a legal identity information certificate, ensuring that all supervisors can effectively verify and decrypt the identity ciphertext.

[0059] The sender initiates a transaction on the blockchain, and the target address is the one-time address generated previously. The transaction contains the following information: transaction content, encrypted identity ciphertext, and multi-party supervisory proof.

[0060] The on-chain contract verifies the multi-party supervisory proof. If the proof is established, it means that the identity ciphertext is correctly encrypted and the transaction can be confirmed. Otherwise, it means that the identity ciphertext or certificate is wrong and the transaction is rejected.

[0061] In the above-mentioned blockchain identity anonymity method that can be supervised by multiple parties, the present application generates a one-time address by the sender according to the query public key and decryption public key of the receiver's identity information certificate during each transaction. This address is used as the receiving target of the transaction. Since each transaction uses a different address, it is impossible to associate it with a specific individual through the address, thereby protecting the anonymity of the transaction. And the receiver's query public key and decryption public key are encrypted with the public keys of each supervisor respectively, so that only the corresponding supervisor can decrypt this information, ensuring that the receiver's identity information cannot be read by others without the supervisor's private key, thereby protecting the receiver's identity privacy, and at the same time calculating the multi-party supervisory proof based on the encrypted identity ciphertext to ensure that the supervisor can effectively verify and decrypt the identity ciphertext. Thus, a transaction is generated based on a one-time address, multiple identity ciphertexts, and a multi-party supervisory proof. The smart contract in the blockchain is a multi-party supervisory proof. If the proof is established, it means that the identity ciphertext is correctly encrypted and the transaction can be confirmed. This step ensures the legitimacy of the transaction and protects the identity information of both parties from being disclosed. Therefore, the present application generates a one-time address for each transaction, thereby ensuring the anonymity of the identity and the unlinkability between one-time addresses of the same identity.

[0062] At the same time, the public key of the supervisor is used to encrypt the recipient's query public key and decryption public key to obtain the identity ciphertext, ensuring that multiple supervisors can independently decrypt the identity information and achieve independent supervision.

[0063] In one embodiment, after confirming the transaction and executing the transaction, it also includes: responding to the recipient's instruction to obtain the one-time address, so that the recipient determines whether it matches the one-time address based on its own query public key, decryption public key and private key, and calculates the one-time private key if it matches so as to be able to process the result of executing the transaction.

[0064] In this embodiment, the receiver obtains the transaction information: after receiving the transaction, the receiver determines the matching relationship between his / her own key and the one-time address to confirm whether the one-time address belongs to him / her.

[0065] In one embodiment, the receiver determines whether the one-time address matches the receiver's query public key and decryption public key according to the following steps:

[0066] Calculate P′ based on the query private key and the public random number rG dec =P one -H(rP view )G;

[0067] Among them, s view rG=rP view ;

[0068] Then judge P′dec Whether to match its own decryption public key.

[0069] In one embodiment, after confirming the transaction and executing the transaction, the method further includes: responding to the acquisition of the identity ciphertext by the supervisor, so that the supervisor uses the respective private keys to decrypt the received identity ciphertext for identity verification.

[0070] When there is a regulatory requirement, each regulator can use its own private key to decrypt the received identity ciphertext.

[0071] In one embodiment, the one-time address is generated by:

[0072] The sender uses a randomly generated random number r and the receiver's public key P view and the decryption public key P dec , calculate the one-time public key using the following formula:

[0073] P one =H(rP view )G+P dec

[0074] Among them, H refers to the hash function;

[0075] Use a one-time public key P one The one-time address is calculated by the following formula:

[0076] A one =Address(P one )

[0077] Where Address() represents the function for calculating a one-time address.

[0078] In one embodiment, the supervisory proof is calculated in the following manner:

[0079] Write a zk-STARK constraint that computes said one-time address;

[0080] Write a zk-STARK constraint for the identity ciphertext;

[0081] Write the zk-STARK constraint for the recipient’s identity certificate;

[0082] Set the zk-STARK public input to a one-time address and identity ciphertext, and the secret input to an identity certificate;

[0083] Perform calculations on the zk-STARK proof algorithm to obtain a controllable proof.

[0084] In one embodiment, verifying the multi-party supervisory proof includes:

[0085] Based on the provable zk-STARK constraints and public inputs, the zk-STARK verification algorithm is calculated to obtain a result of whether it is true or not.

[0086] In one embodiment, the one-time private key is calculated by the following formula:

[0087] s one =H(rP view )+s dec

[0088] where s dec is the receiver's decryption private key, satisfying P dec =S dec G.

[0089] Therefore, this application generates a one-time address for the receiver through the sender, encrypts the receiver's identity with the public keys of each regulator to obtain the identity ciphertext, and calculates the multi-party supervisory proof of the receiver's identity ciphertext. The sender initiates a transaction to the one-time address on the blockchain, and provides the identity ciphertext and multi-party supervisory proof at the same time. The receiver can use the query key to determine whether the one-time address belongs to him, and the regulator can use their respective private keys to decrypt the identity. All relevant participants need to register with the public key infrastructure. The public key infrastructure reviews, registers and issues user identities and the corresponding query public keys and decryption public keys. It has the following advantages:

[0090] 1. The sender encrypts the recipient's identity and provides multiple parties with supervisory proof. As long as the identity supervisory proof is verified on the chain, the supervisor will be able to decrypt the true identity of the recipient.

[0091] 2. Support multiple regulators, and each regulator can independently decrypt the identity.

[0092] 3. Provide flexible supervision services, and configure corresponding supervision subject combinations for different identity subjects according to user needs. For example, you can configure the supervision mode of "Supervisor A + Supervisor B" for one subject, and the supervision mode of "Supervisor C + Supervisor D" for another subject.

[0093] In one embodiment, a computer device is provided, which may be a server. The computer device includes a processor, a memory, and a network interface connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, the above-mentioned blockchain identity anonymity method that can be supervised by multiple parties is implemented.

[0094] In one embodiment, a computer program product is also provided, including a computer program / instruction, wherein the computer program / instruction is used by a processor to perform all or part of the processes in the above-mentioned embodiment method.

[0095] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0096] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0097] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A blockchain identity anonymity method that can be supervised by multiple parties, characterized in that: The method comprises: Receive a transaction sent by a sender, wherein the transaction includes: a one-time address, multiple identity ciphertexts, and a proof of multi-party supervision; the one-time address is a target address generated by the sender according to the query public key and decryption public key of the identity information certificate sent by the receiver; the identity ciphertext is obtained by the sender encrypting the query public key and decryption public key of the receiver with the public keys of each supervisor respectively; the proof of multi-party supervision is calculated by the sender based on the one-time address calculation process, the identity ciphertext encryption process, and the identity information certificate; the sender and the receiver are both registered in the public key infrastructure to obtain the identity information certificate; Verify the multi-party supervision proof. If the verification is successful, confirm the transaction and execute the transaction. If the verification fails, refuse to execute the transaction.

2. The blockchain identity anonymity method capable of multi-party supervision according to claim 1, characterized in that: After confirming the transaction and executing the transaction, it also includes: responding to the recipient's instruction to obtain the one-time address, so that the recipient determines whether it matches the one-time address based on its own query public key, decryption public key and private key, and calculates the one-time private key if it matches so as to be able to process the result of executing the transaction.

3. The blockchain identity anonymity method capable of multi-party supervision according to claim 2 is characterized in that: The receiver determines whether the one-time address matches the one-time address based on its own query private key and decryption public key: Calculate P′ based on the query private key and the public random number rG dec =P one -H(rP view )G; Among them, s view rG=rP view ; Then judge P′ dec Whether to match its own decryption public key.

4. The blockchain identity anonymity method capable of multi-party supervision according to claim 1, characterized in that: After confirming the transaction and executing the transaction, the method further includes: responding to the acquisition of the identity ciphertext by the supervisor, so that the supervisor uses the respective private keys to decrypt the received identity ciphertext for identity authentication.

5. The blockchain identity anonymity method capable of multi-party supervision according to claim 1, characterized in that: The one-time address is generated in the following way: Use the randomly generated random number r and the recipient's public key P view and the decryption public key P dec , calculate the one-time public key using the following formula: P one =H(rP view )G+P dec Among them, H refers to the hash function; Use a one-time public key P one The one-time address is calculated by the following formula: A one =Address(P one ) Where Address() represents the function for calculating a one-time address.

6. The blockchain identity anonymity method capable of multi-party supervision according to claim 1, characterized in that: The regulatory proof is calculated in the following way: Write a zk-STARK constraint that computes said one-time address; Write a zk-STARK constraint for the identity ciphertext; Write the zk-STARK constraint for the recipient’s identity certificate; Set the zk-STARK public input to a one-time address and identity ciphertext, and the secret input to an identity certificate; Perform calculations on the zk-STARK proof algorithm to obtain a controllable proof.

7. The blockchain identity anonymity method capable of multi-party supervision according to claim 6, characterized in that: Verification of the multi-party supervisory proof includes: Based on the provable zk-STARK constraints and public inputs, the zk-STARK verification algorithm is calculated to obtain a result of whether it is true or not.

8. The blockchain identity anonymity method capable of multi-party supervision according to claim 1, characterized in that: The one-time private key is calculated by the following formula: s one =H(rP view )+s dec where s dec is the recipient's decryption private key.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images