Block chain hidden amount transaction method and system capable of auditing and tracing

Abstract

The invention discloses a block chain hidden amount transaction method and system capable of auditing and tracing, and relates to the technical field of block chains. A transaction initiator generates a hidden amount commitment, a range proof, an amount ciphertext, a blinding factor ciphertext and a decryptable proof; packaging the hidden amount commitment, the range proof, the amount ciphertext, the blinding factor ciphertext and the decryptable proof into a transaction, and submitting the transaction to a pre-created block chain; a smart contract is deployed in the block chain, and the smart contract is used for verifying the range certification and the decryptable certification. The asset privacy can be ensured by hiding the amount commitment, and the legality of amount calculation can be ensured through application range proving; according to the method, an initiator is required to provide a decryptable proof to ensure that a receiver and a supervisor can independently know the transaction amount and a blinding factor, so that the auditing performance and the traceability of the transaction are realized, and a plurality of supervisors are supported to be flexibly arranged.

Description

Technical Field

[0001] The present application relates to the field of blockchain technology, and specifically to a blockchain hidden amount transaction method and system capable of audit and traceability. Background Art

[0002] With the rapid development of digital economy and blockchain technology, blockchain, as a decentralized and tamper-proof distributed ledger technology, is widely used in finance, logistics, supply chain management and other fields. The core advantage of blockchain is that it provides data transparency and transaction immutability, which can ensure the authenticity and security of transaction records. However, although blockchain technology performs well in many scenarios, in some specific applications, especially when it comes to privacy protection of transaction amounts, existing blockchain technology still faces the following challenges:

[0003] Privacy protection issues: All transaction data on the blockchain is open and transparent, and anyone can view transaction records and their details. For cases involving sensitive transaction amounts, this publicity may expose users' privacy information.

[0004] Audit and traceability issues: In some scenarios, especially in the financial field, there are high requirements for audit and traceability of transactions. Although the immutable nature of blockchain can ensure the authenticity of transaction records, when it comes to privacy protection, simply hiding the amount information may affect the validity and auditability of transaction records.

[0005] In order to solve the above problems, a method for hiding transaction amounts in a blockchain system, a computer-readable storage medium, and a blockchain system are disclosed in a patent document with publication number: CN 111709738A, which includes: the transaction initiator generates a session key pair, the transaction initiator generates an obfuscation key based on the transaction private key, the initiator address, and the receiver address to obfuscate the random blinding factor and the transaction amount to generate the initiator obfuscated data and the receiver obfuscated data, and writes the transaction public key, the initiator obfuscated data, and the receiver obfuscated data into the transaction information; the transaction user scans the transaction stored in the blockchain system to obtain the transaction public key, and obtains the obfuscation key based on the transaction user's own private key and the transaction public key to decrypt the initiator obfuscated data and the receiver obfuscated data to obtain the transaction amount, and judge whether the transaction amount is correct. In this way, the transaction amount is hidden and the user privacy is protected.

[0006] However, the on-chain consensus in this method cannot determine whether the change in the amount of assets is legal, and the recipient cannot guarantee that the commitment can be opened and supervise the amount hidden in the commitment. Summary of the invention

[0007] To this end, the present application provides a blockchain hidden amount transaction method and system that can be audited and traced to solve the problem that the on-chain consensus in the prior art cannot determine whether the change in the asset amount is legal, and the recipient cannot guarantee that the commitment can be opened and supervise the amount promised to be hidden.

[0008] In order to achieve the above objectives, this application provides the following technical solutions:

[0009] In a first aspect, a blockchain hidden amount transaction method capable of auditing and tracing is provided, the method being applied to a transaction initiator, comprising:

[0010] Step 1: Get the transaction amount and randomly generate a blinding factor;

[0011] Step 2: Generate a hidden amount commitment based on the transaction amount and the blinding factor;

[0012] Step 3: Generate a scope proof; the scope proof includes that the transaction amount is within the legal range and the amount of the initiator's assets after the transaction is completed is within the legal range;

[0013] Step 4: Encrypt the transaction amount and the blinding factor according to the recipient's public key and the specified supervisor's public key, and generate corresponding amount ciphertext and blinding factor ciphertext;

[0014] Step 5: Generate a decryptable proof; the decryptable proof is used to prove that the recipient and the regulator can use the private key to decrypt the amount ciphertext and the blinding factor ciphertext;

[0015] Step 6: Package the hidden amount commitment, the range proof, the amount ciphertext, the blinding factor ciphertext and the decryptable proof into a transaction and submit it to a pre-created blockchain; a smart contract is deployed in the blockchain, and the smart contract is used to verify the range proof and the decryptable proof.

[0016] Optionally, in step 2, the hidden amount commitment is generated by additive homomorphic commitment.

[0017] Optionally, in step 3, the range proof uses a Bulletproof algorithm.

[0018] Optionally, in step 4, the transaction amount and the blinding factor are encrypted using the Paillier algorithm or elliptic curve encryption.

[0019] Optionally, in step 5, the decryptable proof adopts zk-STARK or non-interactive Sigma protocol.

[0020] Optionally, in step 6, the recipient and the regulator will update the cumulative transaction amount and the cumulative blinding factor after verifying that the transaction is successful in the blockchain.

[0021] Second, a blockchain hidden amount transaction system capable of audit and traceability, including:

[0022] A hidden amount commitment generation module, used to obtain the transaction amount, randomly generate a blinding factor, and generate a hidden amount commitment according to the transaction amount and the blinding factor;

[0023] A range proof generation module, used to generate a range proof; the range proof includes that the transaction amount is within a legal range and the amount of the initiator's assets after the transaction is completed is within a legal range;

[0024] An encryption module, used to encrypt the transaction amount and the blinding factor according to the recipient's public key and the specified supervisor's public key, and generate corresponding amount ciphertext and blinding factor ciphertext;

[0025] A decryptable proof generation module, used to generate a decryptable proof; the decryptable proof is used to prove that the recipient and the regulator can use the private key to decrypt the amount ciphertext and the blinding factor ciphertext;

[0026] The packaging and uploading module is used to package the hidden amount commitment, the range proof, the amount ciphertext, the blinding factor ciphertext and the decryptable proof into a transaction and submit it to a pre-created blockchain; a smart contract is deployed in the blockchain, and the smart contract is used to verify the range proof and the decryptable proof.

[0027] In a third aspect, a computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, it implements the steps of a blockchain hidden amount transaction method that can be audited and traced.

[0028] In a fourth aspect, a computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements the steps of a blockchain hidden amount transaction method that can be audited and traced.

[0029] In a fifth aspect, a computer program product includes a computer program or instructions, which, when executed by a processor, implement the steps of a blockchain hidden amount transaction method that can be audited and traced.

[0030] Compared with the prior art, this application has at least the following beneficial effects:

[0031] The present application provides a blockchain hidden amount transaction method and system that can be audited and traced. The transaction initiator generates a hidden amount commitment, a range proof, an amount ciphertext, a blinding factor ciphertext, and a decryptable proof, and packages the hidden amount commitment, range proof, amount ciphertext, blinding factor ciphertext, and decryptable proof into a transaction and submits it to a pre-created blockchain; a smart contract is deployed in the blockchain, and the smart contract is used to verify the range proof and the decryptable proof. The hidden amount commitment can ensure the privacy of assets, and the use of the range proof can ensure the legality of the amount calculation; the initiator is required to provide a decryptable proof to ensure that the recipient and the regulator can independently know the transaction amount and blinding factor, thereby achieving the auditability and traceability of the transaction, and supporting the flexible setting of multiple regulators. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more intuitively illustrate the prior art and the present application, exemplary drawings are given below. It should be understood that the specific shapes and structures shown in the drawings should not generally be regarded as limiting conditions for implementing the present application; for example, those skilled in the art are capable of easily making conventional adjustments or further optimizations to the addition / reduction / attribution division, specific shapes, positional relationships, connection methods, dimensional ratios, etc. of certain units (components) based on the technical concepts and exemplary drawings disclosed in the present application.

[0033] Figure 1 A basic flow chart of a blockchain hidden amount transaction method capable of audit and traceability provided in Example 1 of the present application;

[0034] Figure 2 A flowchart of a method for determining a hidden amount transaction on a blockchain that can be audited and traced is provided in Example 1 of the present application. DETAILED DESCRIPTION

[0035] The present application is further described below in detail through specific embodiments in conjunction with the accompanying drawings.

[0036] In the description of this application: unless otherwise specified, the meaning of "plurality" is two or more. The terms "first", "second", "third", etc. in this application are intended to distinguish the objects referred to, and do not have special meanings in terms of technical connotations (for example, they should not be understood as emphasizing the importance or order, etc.). Expressions such as "including", "comprising", "having", etc. also mean "not limited to" (certain units, components, materials, steps, etc.).

[0037] The terms such as "upper", "lower", "left", "right", "middle", etc. cited in this application are usually used to indicate the general relative position relationship for the purpose of intuitive understanding by referring to the drawings, and are not absolute limitations on the position relationship in the actual product.

[0038] The present application provides a blockchain hidden amount transaction method and system capable of audit and traceability, the purpose of which is to use the blockchain account model and additive homomorphic commitment to record the hidden asset amount, use range proof to ensure the legality of the amount, use the amount ciphertext and blinding factor ciphertext and decryptable proof to ensure that the recipient and the regulator can know the transaction amount and blinding factor, and use the contract on the blockchain to verify the decryptable proof to ensure its legality.

[0039] Embodiment 1

[0040] See also Figure 1 and Figure 2 This embodiment provides a blockchain hidden amount transaction method capable of auditing and tracing, which is applied to the transaction initiator and includes:

[0041] S1: Get the transaction amount and randomly generate a blinding factor;

[0042] Specifically, the blinding factor is a random number in the Pedersen commitment, which plays a key role in hiding the original value, ensuring that the commitment cannot be changed, and enhancing security in the process of generating the commitment.

[0043] Pedersen commitment is a cryptographic technique that allows one party to commit to a value to another party without revealing the specific value. This commitment is immutable and verifiable, that is, the submitter cannot modify the committed value afterwards, and the verifier can confirm whether the submitted value is consistent with the previously committed value. This technology is widely used in scenarios that require privacy protection, such as blockchain.

[0044] S2: Generate a hidden amount commitment based on the transaction amount and blinding factor;

[0045] Specifically, the initiator generates a random blinding factor r, and then uses additive homomorphic commitment to generate the Pedersen commitment value of the hidden amount based on the transaction amount m: C = g m ·h r .

[0046] S3: Generate a range proof; the range proof includes that the transaction amount is within the legal range and that the amount of the initiator's assets after the transaction is completed is within the legal range;

[0047] Specifically, range proof is a zero-knowledge proof technology that allows one party (the prover) to prove to another party (the verifier) ​​that he knows a number and that the number is within a given range without revealing the specific value of the number. In other words, the prover can prove to the verifier that "I know a number, and this number is between 1 and 100", but at the same time will not reveal what the number is. This technology has a wide range of applications in protecting privacy and data security.

[0048] In this step, the initiator generates two zero-knowledge range proofs: proof 1) that the transaction amount m is within the legal range, and proof 2) that the initiator's asset amount is within the legal range after the transaction. This proof can ensure that the transaction amount and the initiator's asset amount are not negative and are within the set maximum value. The range proof can use the Bulletproof algorithm.

[0049] S4: Encrypt the transaction amount and blinding factor according to the recipient's public key and the specified supervisor's public key, and generate the corresponding amount ciphertext and blinding factor ciphertext;

[0050] Specifically, the public key refers to the encryption key disclosed in the public key encryption system, which is used to encrypt messages or verify digital signatures. The public key is used in pairs with the corresponding private key, where the public key is public and the private key is kept secret, ensuring that only the person holding the private key can decrypt the information or generate a valid signature.

[0051] The private key is a secret key used to decrypt messages or generate digital signatures in a public key encryption system. It exists in pairs with the public key. The public key is public, while the private key must be kept strictly confidential. The security of the private key is critical because anyone who possesses the private key can decrypt information encrypted by the public key or forge a signature.

[0052] In this step, the initiator uses the public key of the recipient and the specified supervisor to encrypt all amounts m and blinding factors r, and generates corresponding amount ciphertexts and blinding factor ciphertexts. Encryption can use the Paillier algorithm or elliptic curve.

[0053] An elliptic curve is a plane algebraic curve defined as satisfying the equation y 2 =x 3 +ax+b, where a and b are real constants. Elliptic curves are widely used in cryptography because of their computational difficulty in the elliptic curve discrete logarithm problem (ECDLP), which can provide efficient and secure encryption methods.

[0054] S5: Generate a decryptable proof; the decryptable proof is used to prove that the recipient and the regulator can use the private key to decrypt the amount ciphertext and the blinding factor ciphertext;

[0055] Specifically, in this step, the initiator generates a decryptable proof to prove that the recipient and the regulator can use their private key to decrypt the amount and blinding factor. The decryptable proof uses zk-STARK or non-interactive Sigma protocol.

[0056] zk-STARK (Zero-Knowledge Scalable Transparent Argument of Knowledge) is a zero-knowledge proof technology that allows a party to prove the authenticity of a piece of knowledge or data without revealing any specific information. zk-STARK is efficient, scalable, and transparent. It does not rely on trusted settings and can provide fast verification in large-scale data and complex calculations. It has important applications in the fields of blockchain and privacy protection, as follows:

[0057] Constraints: A set of rules or conditions imposed on each state and transition between states in a computational process in order to verify the correctness of the computational process.

[0058] Public Input: Input data that is known to both parties and does not need to be hidden during the proof process. This data is usually used as the starting point of the calculation or the basis for verification.

[0059] Secret input: During the proof process, one party wishes to hide input data that the other party does not want to know. This data is usually sensitive information such as personal privacy or business secrets.

[0060] Proof Algorithm: A protocol that does not require a trusted setup. By arithmetizing the computation process and making polynomial commitments, it is possible to prove the correctness of the computation results to the verifier without leaking any private data.

[0061] Verification algorithm: By performing a series of checks and calculations on the proof information provided by the prover, the correctness of the calculation process is verified to ensure that the prover has not cheated.

[0062] A hash function is an algorithm that converts data input of any length into an output (hash value) of fixed length. Hash functions are one-way, that is, the original input cannot be reversed from the hash value, and the hash values ​​generated for different inputs are almost always different. It is widely used in data integrity verification, digital signatures, and cryptography.

[0063] S6: Package the hidden amount commitment, range proof, amount ciphertext, blinding factor ciphertext and decryptability proof into a transaction and submit it to the pre-created blockchain; a smart contract is deployed in the blockchain, and the smart contract is used to verify the range proof and decryptability proof.

[0064] Specifically, a smart contract is a self-executing code deployed on the blockchain to automate and execute contract terms. It runs automatically when specific conditions are met without human intervention, thus ensuring the transparency and credibility of the contract. Smart contracts can handle functions such as asset transfer, automatic payment, and verification of conditions, and are widely used in finance, supply chain, insurance and other fields. Because it is based on blockchain technology, smart contracts are tamper-proof and irreversible, ensuring the security and reliability of contract execution.

[0065] In this step, the initiator packages the hidden amount commitment, range proof, amount ciphertext, blinding factor ciphertext and decryptability proof into a transaction and submits it to the pre-created blockchain; a special smart contract is deployed in the blockchain to record the commitment of the account amount in the blockchain state and verify the decryptability proof and range proof in the transaction. When a user creates a blockchain account, a public key and private key pair are generated, and the initial amount is issued to a specific account, and the commitment of the amount is recorded in the state.

[0066] When verifying a transaction, the smart contract on the blockchain automatically verifies the validity of the range proof to ensure that the change in amount is legal; the smart contract verifies the legitimacy of the decryptable proof to ensure that the recipient can decrypt the correct amount and blinding factor; if all verifications pass, the transaction is confirmed in the contract and the status of the relevant accounts is updated.

[0067] Decryption by the receiver: The receiver uses its private key to decrypt the received amount ciphertext and blinding factor ciphertext to obtain the actual transaction amount m and blinding factor r. The receiver updates its cumulative amount and cumulative blinding factor, which correspond to the receiver's commitment in the smart contract state.

[0068] Audit by the regulator: The regulator can audit the transaction amount and blinding factor when necessary to verify the legality and compliance of the transaction. The process is similar to the decryption of the recipient. It should be noted that the two parties to the transaction will agree with the regulator in advance and set the regulatory level and regulatory requirements for the current transaction, such as the composition of the current transaction regulatory agency.

[0069] The present embodiment provides an auditable and traceable blockchain hidden amount transaction method that hides account amounts through additive homomorphic commitment technology to ensure asset privacy; uses range proof to ensure the legality of amount calculation; requires the initiator to provide a decryptable proof to ensure that the recipient and the regulator can independently know the amount and blinding factor, thereby achieving the auditability and traceability of the transaction, and supports the flexible setting of multiple regulators; and adopts an account model to enhance the practicality of the system.

[0070] The auditable and traceable blockchain hidden amount transaction method provided in this embodiment uses an account model instead of the UTXO model adopted by other privacy blockchains, because the account model is more in line with the ecology of Web3 smart contracts; after the transaction amount and blinding factor are encrypted and uploaded to the chain, a decryptable proof is used to ensure that the recipient and the regulator can know the amount and the blinding factor, and the decryptable proof is verified by the contract on the blockchain to ensure its legitimacy.

[0071] The blockchain hidden amount transaction method provided in this embodiment supports multiple regulators and can flexibly select which transaction amounts and blinding factors can be decrypted by which regulators. For example, a "regulator A + regulator B" regulatory mode can be configured for a transaction, and a "regulator C + regulator D" regulatory mode can be configured for another transaction.

[0072] Embodiment 2

[0073] This embodiment provides a blockchain hidden amount transaction system capable of audit and traceability, including:

[0074] A hidden amount commitment generation module is used to obtain the transaction amount, randomly generate a blinding factor, and generate a hidden amount commitment based on the transaction amount and the blinding factor;

[0075] A range proof generation module, used to generate a range proof; the range proof includes that the transaction amount is within the legal range and the amount of the initiator's assets after the transaction is completed is within the legal range;

[0076] An encryption module, used to encrypt the transaction amount and blinding factor according to the recipient's public key and the specified supervisor's public key, and generate corresponding amount ciphertext and blinding factor ciphertext;

[0077] The decryptable proof generation module is used to generate a decryptable proof; the decryptable proof is used to prove that the recipient and the regulator can use the private key to decrypt the amount ciphertext and the blinding factor ciphertext;

[0078] The package upload module is used to package the hidden amount commitment, range proof, amount ciphertext, blinding factor ciphertext and decryptability proof into a transaction and submit it to the pre-created blockchain; a smart contract is deployed in the blockchain, and the smart contract is used to verify the range proof and decryptability proof.

[0079] For the specific implementation content of each module in a blockchain hidden amount transaction system that can be audited and traced, please refer to the above definition of a blockchain hidden amount transaction method that can be audited and traced, and will not be repeated here.

[0080] Embodiment 3

[0081] This embodiment provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of a blockchain hidden amount transaction method capable of audit and traceability are implemented.

[0082] Embodiment 4

[0083] This embodiment provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of a blockchain hidden amount transaction method capable of audit and traceability are implemented.

[0084] Embodiment 5

[0085] This embodiment provides a computer program product, including a computer program or instructions, which, when executed by a processor, implements the steps of a blockchain hidden amount transaction method that can be audited and traced.

[0086] The technical features of the above embodiments may be arbitrarily combined (as long as there is no contradiction in the combination of these technical features). To make the description concise, not all possible combinations of the technical features in the above embodiments are described; these embodiments that are not explicitly written should also be considered to be within the scope of this specification.

Claims

1. A blockchain hidden amount transaction method capable of audit and traceability, characterized in that: The method is applied to a transaction initiator, and includes: Step 1: Get the transaction amount and randomly generate a blinding factor; Step 2: Generate a hidden amount commitment based on the transaction amount and the blinding factor; Step 3: Generate a scope proof; the scope proof includes that the transaction amount is within the legal range and the amount of the initiator's assets after the transaction is completed is within the legal range; Step 4: Encrypt the transaction amount and the blinding factor according to the recipient's public key and the specified supervisor's public key, and generate corresponding amount ciphertext and blinding factor ciphertext; Step 5: Generate a decryptable proof; the decryptable proof is used to prove that the recipient and the regulator can use the private key to decrypt the amount ciphertext and the blinding factor ciphertext; Step 6: Package the hidden amount commitment, the range proof, the amount ciphertext, the blinding factor ciphertext and the decryptable proof into a transaction and submit it to a pre-created blockchain; a smart contract is deployed in the blockchain, and the smart contract is used to verify the range proof and the decryptable proof.

2. The auditable and traceable blockchain hidden amount transaction method according to claim 1 is characterized in that: In step 2, the hidden amount commitment is generated by additive homomorphic commitment.

3. The blockchain hidden amount transaction method capable of audit and traceability according to claim 1 is characterized in that: In step 3, the range proof uses the Bulletproof algorithm.

4. The blockchain hidden amount transaction method capable of audit and traceability according to claim 1 is characterized in that: In step 4, the transaction amount and the blinding factor are encrypted using the Paillier algorithm or elliptic curve encryption.

5. The blockchain hidden amount transaction method capable of audit and traceability according to claim 1 is characterized in that: In step 5, the decryptable proof uses zk-STARK or non-interactive Sigma protocol.

6. The auditable and traceable blockchain hidden amount transaction method according to claim 1 is characterized in that: In step 6, the recipient and the regulator will update the cumulative transaction amount and the cumulative blinding factor after verifying the transaction successfully in the blockchain.

7. A blockchain hidden amount transaction system capable of audit and traceability, characterized in that: include: A hidden amount commitment generation module, used to obtain the transaction amount, randomly generate a blinding factor, and generate a hidden amount commitment according to the transaction amount and the blinding factor; A range proof generation module, used to generate a range proof; the range proof includes that the transaction amount is within a legal range and the amount of the initiator's assets after the transaction is completed is within a legal range; An encryption module, used to encrypt the transaction amount and the blinding factor according to the recipient's public key and the specified supervisor's public key, and generate corresponding amount ciphertext and blinding factor ciphertext; A decryptable proof generation module, used to generate a decryptable proof; the decryptable proof is used to prove that the recipient and the regulator can use the private key to decrypt the amount ciphertext and the blinding factor ciphertext; The packaging and uploading module is used to package the hidden amount commitment, the range proof, the amount ciphertext, the blinding factor ciphertext and the decryptable proof into a transaction and submit it to a pre-created blockchain; a smart contract is deployed in the blockchain, and the smart contract is used to verify the range proof and the decryptable proof.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images