A multi-party supervisable blockchain identity anonymous method

Abstract

The application discloses a multi-party supervisable blockchain identity anonymous method, which comprises the following steps: receiving a transaction sent by a sender, wherein the transaction comprises a one-time address, a plurality of identity ciphers and multi-party supervisable proofs; the one-time address is a target address generated by the sender according to a query public key and a decryption public key of an identity information certificate of a receiver; the identity cipher is obtained by encrypting the query public key and the decryption public key of the receiver with public keys of respective supervision parties; the multi-party supervisable proof is calculated by the sender based on a one-time address calculation process, an identity cipher encryption process and an identity information certificate; the sender and the receiver are registered in a public key infrastructure to obtain identity information certificates; the multi-party supervisable proof is verified, and if the verification is passed, the transaction is confirmed and executed. According to the application, the identity anonymity and the unlinkability between one-time addresses of the same identity are ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, in particular to a multi-party supervision enabled blockchain identity anonymity method. BACKGROUND

[0002] In modern transaction processes, identity information concealment technology plays a crucial role. This technology ensures that the personal information of both parties in a transaction is not disclosed through encryption and anonymization, thereby protecting user privacy and security. It not only helps to prevent identity theft and fraud, but also enhances user trust in the transaction platform, facilitating the smooth progress of transactions. In this way, identity information concealment technology provides a more secure and private environment for financial transactions.

[0003] The method and system for multi-center collaborative supervision of blockchain user identity anonymity and tracking disclosed in CN114066449A sends the label attribute of a user and the identity of the user to a registration center in a blockchain network to obtain a certificate, encrypts the label attribute of the user using the public key of a tracking center, randomizes the certificate obtained from the registration center, generates a transaction based on the public-private key pair generated by the user, combines the encrypted label attribute of the user and the randomized certificate, and uploads the transaction to the blockchain. The tracking center can decrypt the identity information if the number of authorized centers that agree to decrypt is greater than a threshold value through the authorized center, thereby achieving the anonymity of the user's identity and the traceability of the transaction without increasing the system burden. However, in this way, the transaction is still interacted with the account public key, which leads to the fact that the transaction can be linked, so if the identity corresponding to a certain public key is obtained, the identity information of the transaction corresponding to the public key can be identified. SUMMARY

[0004] Therefore, in view of the above technical problems, a multi-party supervision enabled blockchain identity anonymity method is provided to solve the problem of linkable transactions in the prior art.

[0005] In a first aspect, a multi-party supervision enabled blockchain identity anonymity method is provided, which includes:

[0006] receiving a transaction sent by a sender, the transaction including a one-time address, a plurality of identity ciphertexts, and a multi-party supervision enabled proof; the one-time address is a target address generated by the sender based on a query public key and a decryption public key of an identity information certificate sent by a receiver; the identity ciphertexts are obtained by the sender by encrypting the query public key and the decryption public key of the receiver with the public keys of each supervision party; the multi-party supervision enabled proof is calculated based on the one-time address calculation process, the identity ciphertext encryption process, and the identity information certificate; the sender and the receiver are registered in a public key infrastructure to obtain an identity information certificate;

[0007] Verify the multi-party supervision certificate. If the verification is successful, confirm the transaction and execute the transaction. If the verification fails, refuse to execute the transaction.

[0008] In the above scheme, optionally, after confirming the transaction and executing the transaction, the method further includes: responding to the recipient's instruction to obtain the one-time address, so that the recipient determines whether the one-time address matches the one-time address based on its own query public key, decryption public key and private key, and calculates the one-time private key if it matches so as to be able to process the result of executing the transaction.

[0009] In the above solution, optionally, the receiver determines whether the one-time address matches the one-time address based on its own query private key and decryption public key, including:

[0010] Calculate P′ based on the query private key and the public random number rG dec =P one -H(rP view )G;

[0011] Among them, s view rG=rP view ;

[0012] Then judge P′ dec Whether to match its own decryption public key.

[0013] In the above solution, optionally, after confirming the transaction and executing the transaction, the method further includes: responding to the supervisor's acquisition of the identity ciphertext, so that the supervisor uses the respective private keys to decrypt the received identity ciphertext for identity verification.

[0014] In the above solution, optionally, the one-time address is generated by:

[0015] Using a randomly generated random number r and the recipient's public key P view and the decryption public key P dec , calculate the one-time public key using the following formula:

[0016] P one =H(rP view )G+P dec

[0017] Here, H refers to the hash function;

[0018] Use the one-time public key P one The one-time address is calculated using the following formula:

[0019] A one =Address(P one )

[0020] wherein Address() represents a function of calculating a one-time address.

[0021] In the above scheme, optionally, the supervisable proof is calculated by the following way:

[0022] writing a zk-STARK constraint of calculating the one-time address;

[0023] writing a zk-STARK constraint of the identity ciphertext;

[0024] writing a zk-STARK constraint of the receiver identity information certificate;

[0025] setting a zk-STARK public input as the one-time address and the identity ciphertext, and setting a secret input as the identity information certificate;

[0026] performing a calculation of a zk-STARK proof algorithm to obtain the supervisable proof.

[0027] In the above scheme, further optionally, verifying the multi-party supervisable proof comprises:

[0028] performing a calculation of a zk-STARK verification algorithm according to the zk-STARK constraint and the public input of the supervisable proof to obtain a result of being true or not true.

[0029] In the above scheme, optionally, the one-time private key is calculated by the following formula:

[0030] s one = H(rP view ) + s dec

[0031] wherein s dec is a decryption private key of the receiver.

[0032] In a second aspect, a computer device comprises a memory and a processor, the memory stores a computer program, and the processor implements the steps of the multi-party supervisable blockchain identity anonymity method of the first aspect when executing the computer program.

[0033] In a third aspect, a computer program product comprises computer programs / instructions, which, when executed by a processor, implement the steps of the multi-party supervisable blockchain identity anonymity method of the first aspect.

[0034] The present application has at least the following beneficial effects: in each transaction, the sender generates a one-time address according to the query public key and the decryption public key of the identity information certificate of the receiver, which is used as the receiving target of the transaction. Since a different address is used for each transaction, it is impossible to associate a specific individual through the address, thereby protecting the anonymity of the transaction. The query public key and the decryption public key of the receiver are respectively encrypted with the public keys of the respective supervisory parties, so that only the corresponding supervisory party can decrypt the information, ensuring that the identity information of the receiver cannot be read by others without the private key of the supervisory party, thereby protecting the identity privacy of the receiver. At the same time, the multi-party supervisable proof is calculated based on the encrypted identity ciphertext, which ensures that the supervisory party can effectively verify and decrypt the identity ciphertext. Therefore, the transaction is generated according to the one-time address, the multiple identity ciphertexts, and the multi-party supervisable proof. If the proof is valid, it means that the identity ciphertext has been correctly encrypted, and the transaction can be confirmed. This step ensures the legality of the transaction and protects the identity information of both parties from being disclosed. Therefore, the present application generates a one-time address for each transaction, thereby ensuring the anonymity of the identity and the unlinkability between one-time addresses of the same identity.

[0035] The identity ciphertext obtained by encrypting the query public key and the decryption public key of the receiver with the public keys of the supervisory parties ensures that multiple supervisory parties can independently decrypt the identity information, thereby achieving independent supervision. BRIEF DESCRIPTION OF DRAWINGS

[0036] Figure 1 A flowchart of a multi-party supervisable blockchain identity anonymity method according to an embodiment of the present application is provided.

[0037] Figure 2 A detailed flowchart of a multi-party supervisable blockchain identity anonymity method according to an embodiment of the present application is provided. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0039] Elliptic curve: an elliptic curve is a plane algebraic curve defined as a set of points satisfying the equation y 2 = x 3 + ax + b, where a and b are real constants. Elliptic curves are widely used in the field of cryptography because of their computational difficulty in elliptic curve discrete logarithm problem (ECDLP), which can provide efficient and secure encryption means.

[0040] Public Key: In a public-key encryption system, the public key is a publicly available encryption key used to encrypt messages or verify digital signatures. The public key is paired with a private key, where the public key is public and the private key is kept secret, ensuring that only the person with the private key can decrypt the information or generate a valid signature.

[0041] Private Key: In a public-key encryption system, the private key is a secret key used to decrypt messages or generate digital signatures. It is paired with a public key, where the public key is public and the private key must be strictly kept secret. The security of the private key is crucial because anyone who possesses the private key can decrypt information encrypted with the public key or forge signatures.

[0042] Address: In a blockchain system, an address is an identifier used to receive digital assets, composed of a string of letters and numbers. The process of generating an address usually starts with a user-generated public key. First, the user generates a pair of keys: a private key and a public key. The public key is calculated from the private key using an elliptic curve encryption algorithm. Then, the public key is double-hashed (e.g., first using SHA-256, then using RIPEMD-160) to obtain a shorter hash value. Finally, the hash value is encoded in a specific way (such as Base58Check encoding) and prefixed to generate the final address. This address can be publicly used to receive digital assets, while the corresponding private key must be kept secret to ensure the security of the transaction.

[0043] Hash Function: A hash function is an algorithm that converts data of arbitrary length into a fixed-length output (hash value). Hash functions have one-way properties, meaning that it is impossible to deduce the original input from the hash value, and the hash values generated for different inputs are almost always different. It is widely used in data integrity verification, digital signatures, and cryptography.

[0044] zk-STARK and related concepts: zk-STARK (Zero-Knowledge Scalable Transparent Argument of Knowledge) is a zero-knowledge proof technology that allows one party to prove the authenticity of certain knowledge or data without revealing any specific information. Zk-STARK has the characteristics of high efficiency, scalability and transparency, does not rely on trusted settings, and can provide fast verification in large-scale data and complex calculations. It has important applications in the fields of blockchain and privacy protection.

[0045] Constraint: In order to verify the correctness of a computing process, a series of rules or conditions are imposed on each step of the computing process and the transition between states.

[0046] Public Input: In the proof process, both parties know and do not need to hide the input data, which is usually used as the starting point of the calculation or the basis for verification.

[0047] Secret input: In the proof process, one party wants to hide the input data that the other party does not want to know. These data are usually sensitive information such as personal privacy or business secrets.

[0048] Proof algorithm: A protocol without trusted setting, through the arithmetic and polynomial commitment of the calculation process, realizes the correctness of the calculation result to the verifier without revealing any private data.

[0049] Verification algorithm: Through a series of checks and calculations on the proof information provided by the prover, the correctness of the calculation process is verified, so as to ensure that the verifier does not cheat.

[0050] Smart contract: Smart contract is a self-executing code deployed on the blockchain, which is used to automate and execute contract terms. It automatically runs when certain conditions are met without human intervention, ensuring the transparency and credibility of the contract. Smart contract can handle asset transfer, automatic payment, condition verification and other functions, and is widely used in finance, supply chain, insurance and other fields. Because it is based on blockchain technology, smart contract has the characteristics of tamper resistance and irreversibility, ensuring the safety and reliability of contract execution.

[0051] Public key infrastructure: Public key infrastructure (PKI) is a set of frameworks for creating, managing, distributing, using, storing and revoking digital certificates and public keys. By using encryption technology, public key infrastructure ensures the security of network communication and provides identity verification, data integrity and information confidentiality.

[0052] In one embodiment, as shown in Figure 1 and Figure 2 , a multi-party supervised blockchain identity anonymous method is provided, which comprises:

[0053] Step S1: receiving a transaction sent by a sender, wherein the transaction includes: a one-time address, a plurality of identity ciphertexts and a multi-party supervisable proof; the one-time address is a target address generated by the sender according to the query public key and the decryption public key of the identity information certificate sent by the receiver; the identity ciphertext is obtained by encrypting the query public key and the decryption public key of the receiver with the public key of each supervisor; the multi-party supervisable proof is calculated based on the one-time address calculation process, the identity ciphertext encryption process and the identity information certificate; the sender and the receiver are registered in the public key infrastructure to obtain the identity information certificate;

[0054] Step S2: verifying the multi-party supervisable proof, if the verification is passed, confirming the transaction and executing the transaction, if the verification is not passed, refusing to execute the transaction.

[0055] In this embodiment, first, public key infrastructure (PKI) registration and verification: all participants must be registered in the public key infrastructure, which is responsible for verifying user identity and issuing identity information certificates, including query public key and decryption public key.

[0056] Second, the receiver informs the sender of its identity information certificate. The sender generates a one-time address for the receiver based on the query public key and decryption public key. This address will serve as the receiving target of the transaction, ensuring transaction anonymity.

[0057] Then, the sender encrypts the receiver's query public key and decryption public key with the public keys of the respective regulators to obtain multiple identity ciphertexts associated with the corresponding regulators. The encryption algorithm can use ElGamal encryption or DLIN encryption.

[0058] Finally, the sender calculates a multi-party supervisable proof based on the encrypted identity ciphertexts. This proof is used to verify that the one-time address and the receiver's query public key and decryption public key are truly corresponding and hold a legitimate identity information certificate, ensuring that all regulators can effectively verify and decrypt the identity ciphertexts.

[0059] The sender initiates a transaction on the blockchain, targeting the previously generated one-time address. The transaction includes the following information: transaction content, encrypted identity ciphertext, and multi-party supervisable proof.

[0060] The on-chain contract verifies the multi-party supervisable proof. If the proof is valid, it means that the identity ciphertexts have been correctly encrypted, and the transaction can be confirmed. Otherwise, it means that the identity ciphertexts or certificates are incorrect, and the transaction is rejected.

[0061] In the above multi-party supervisable blockchain identity anonymous method, the one-time address is generated by the sender according to the query public key and the decryption public key of the identity information certificate of the receiver each time the transaction is performed, and the one-time address is used as the receiving target of the transaction. Since a different address is used each time the transaction is performed, the address cannot be associated with a specific individual, thereby protecting the anonymity of the transaction. The query public key and the decryption public key of the receiver are respectively encrypted by the public keys of the respective supervision parties, so that only the corresponding supervision party can decrypt the information, ensuring that the identity information of the receiver cannot be read by others without the supervision party private key, thereby protecting the identity privacy of the receiver. Meanwhile, multi-party supervisable proof is calculated based on the encrypted identity ciphertext, ensuring that the supervision party can effectively verify and decrypt the identity ciphertext. Thus, the transaction is generated according to the one-time address, the multiple identity ciphertexts, and the multi-party supervisable proof. If the proof is valid, it means that the identity ciphertext is correctly encrypted, and the transaction can be confirmed. This step ensures the legality of the transaction and protects the identity information of the transaction parties from being disclosed. Thus, the one-time address is generated each time the transaction is performed, thereby ensuring the anonymity of the identity and the unlinkability between the one-time addresses of the same identity.

[0062] Meanwhile, the identity ciphertext obtained by encrypting the query public key and the decryption public key of the receiver using the public keys of the supervision parties ensures that the multiple supervision parties can independently decrypt the identity information, thereby achieving independent supervision.

[0063] In one embodiment, the confirming the transaction and performing the transaction further includes: in response to an acquisition instruction of the one-time address of the receiver, causing the receiver to determine whether the one-time address matches the query public key and the decryption public key of the receiver according to the private key, and calculating a one-time private key to process the result of performing the transaction in the case of matching.

[0064] In this embodiment, the receiver acquires transaction information: the receiver determines the matching relationship between the private key of the receiver and the one-time address after receiving the transaction, to confirm whether the one-time address belongs to the receiver.

[0065] In one embodiment, the receiver determines whether the one-time address matches the query public key and the decryption public key of the receiver according to the private key includes:

[0066] P' is calculated according to the query private key and the public random number rG dec = P one -H(rP view )G;

[0067] s view rG = rP view ;

[0068] P' is calculated according to the query private key and the public random number rGdec Whether to match its own decryption public key.

[0069] In one embodiment, after confirming and executing the transaction, the method further includes: responding to the supervisor's acquisition of the identity ciphertext, so that the supervisor uses the respective private keys to decrypt the received identity ciphertext for identity verification.

[0070] When there is a regulatory requirement, each regulator can use its own private key to decrypt the received identity ciphertext.

[0071] In one embodiment, the one-time address is generated by:

[0072] The sender uses a randomly generated random number r and the receiver's public key P view and the decryption public key P dec , calculate the one-time public key using the following formula:

[0073] P one =H(rP view )G+P dec

[0074] Here, H refers to the hash function;

[0075] Use the one-time public key P one The one-time address is calculated using the following formula:

[0076] A one =Address(P one )

[0077] Where Address() represents the function for calculating a one-time address.

[0078] In one embodiment, the supervisory proof is calculated as follows:

[0079] Write a zk-STARK constraint that computes said one-time address;

[0080] Write a zk-STARK constraint for the identity ciphertext;

[0081] Write the zk-STARK constraint for the recipient’s identity certificate;

[0082] Set the zk-STARK public input to a one-time address and identity ciphertext, and the secret input to the identity certificate;

[0083] Perform calculations using the zk-STARK proof algorithm to obtain a controllable proof.

[0084] In one embodiment, verifying the multi-party supervisory proof includes:

[0085] According to the zk-STARK constraint and the public input of the provable, the calculation of the zk-STARK verification algorithm is performed to obtain a result of being true or false.

[0086] In one embodiment, the one-time private key is calculated by the following formula:

[0087] s one = H(rP view ) + s dec

[0088] where s dec is the decryption private key of the receiver, satisfying P dec = S dec G.

[0089] Thus, the present application generates a one-time address of the receiver by the sender, encrypts the identity of the receiver with the public keys of each supervisor to obtain identity ciphertext, and calculates the multi-party provable of the identity ciphertext of the receiver. The sender initiates a transaction on the blockchain to the one-time address, while providing the identity ciphertext and the multi-party provable. The receiver can judge whether the one-time address belongs to himself by using the query key, and the supervisor can use the respective private key to decrypt the identity. The related parties need to be registered in the public key infrastructure. The public key infrastructure audits, registers and issues the user identity and the corresponding query public key and decryption public key. And has the following advantages:

[0090] 1. The sender encrypts the identity of the receiver while providing the multi-party provable. As long as the identity provable on the chain is verified, the supervisor must be able to decrypt the true identity of the receiver.

[0091] 2. Supports multiple supervisors, and each supervisor can independently decrypt the identity.

[0092] 3. Provides flexible supervision services, and can configure corresponding supervision subject combinations for different identity subjects according to user needs. For example, a supervision mode of "supervisor A + supervisor B" can be configured for a subject, and a supervision mode of "supervisor C + supervisor D" can be configured for another subject.

[0093] In one embodiment, a computer device is provided, which can be a server. The computer device comprises a processor, a memory and a network interface connected by a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is configured to communicate with an external terminal through a network connection. The computer program is executed by the processor to implement the above-mentioned multi-party supervised blockchain identity anonymization method.

[0094] In one embodiment, a computer program product is also provided, which comprises computer programs / instructions for implementing all or part of the above-mentioned embodiments.

[0095] It is understood by those skilled in the art that all or part of the above-mentioned embodiments can be implemented by a computer program to instruct the relevant hardware. The computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, it can include the flow of the above-mentioned embodiments. Any reference to memory, storage, database or other medium in the embodiments provided by the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0096] The technical features of the above embodiments can be combined in any way. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, but as long as the combination of the technical features does not exist, it should be considered as the scope of the present application.

[0097] The above-described embodiments are merely illustrative of several embodiments of the present application, which are described in more detail and in a specific manner, but should not be construed as limiting the scope of the patent. It should be noted that for those skilled in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application should be subject to the appended claims.

Claims

1. A blockchain identity anonymity method that can be supervised by multiple parties, characterized in that: The method comprises: Receive a transaction from the sender, which includes: a one-time address, multiple identity ciphertexts, and a multi-party supervisory proof; the one-time address is the target address generated by the sender based on the query public key and decryption public key of the receiver's identity information certificate; the identity ciphertext is obtained by the sender encrypting the receiver's query public key and decryption public key with the public keys of each supervisor; the multi-party supervisory proof is calculated by the sender based on the one-time address calculation process, the identity ciphertext encryption process, and the identity information certificate; both the sender and the receiver register with the public key infrastructure to obtain identity information certificates; Verify the multi-party supervision certificate. If the verification is successful, confirm the transaction and execute it. If the verification fails, refuse to execute the transaction. The regulatory proof is calculated as follows: Write a code to calculate the one-time address constraint; Writing the identity ciphertext constraint; Write the recipient's identity certificate constraint; Will The public input is set as a one-time address and identity ciphertext, and the secret input is set as the identity information certificate; conduct Prove the calculation of the algorithm and obtain a controllable proof.

2. The multi-party supervised blockchain identity anonymity method according to claim 1, characterized in that: The one-time address is generated in the following way: Use a randomly generated random number r and the recipient's public key and the decryption public key , calculate the one-time public key using the following formula: ， Here, H refers to the hash function; G represents the public base point on the elliptic curve; Using a one-time public key The one-time address is calculated using the following formula: ， in , which represents a function for calculating a one-time address.

3. The multi-party supervised blockchain identity anonymity method according to claim 2, characterized in that: After confirming and executing the transaction, the method further includes: responding to the recipient's instruction to obtain the one-time address, so that the recipient determines whether the one-time address matches the one-time address based on its own query private key and decryption public key, and calculates the one-time private key if it matches so as to process the result of executing the transaction.

4. The multi-party supervised blockchain identity anonymity method according to claim 3, characterized in that: The receiver determines whether the one-time address matches the one-time address based on its own query private key and decryption public key: According to the query private key and a public random number ,calculate ； in, ; Re-judge Whether to match its own decryption public key.

5. The multi-party supervised blockchain identity anonymity method according to claim 1, characterized in that: After confirming and executing the transaction, the method further includes: responding to the supervisor's acquisition of the identity ciphertext, so that the supervisor uses the respective private keys to decrypt the received identity ciphertext for identity authentication.

6. The multi-party supervised blockchain identity anonymity method according to claim 1, characterized in that: Verification of the multi-party supervisory proof includes: According to the regulatory proof Constraints and public input, Verify the calculation of the algorithm and obtain a valid or invalid result.

7. The multi-party supervised blockchain identity anonymity method according to claim 3, characterized in that: The one-time private key is calculated using the following formula: ， in is the recipient's decryption private key.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

9. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images