Privacy protection distributed transaction supervision method and system

Abstract

The invention belongs to the technical field of privacy protection. According to the privacy protection distributed transaction supervision method and system, a transaction initiator encrypts a transfer amount by using a homomorphic PKE and a public key pka of a supervisor to obtain a redundant encrypted transaction ciphertext, and the consistency of encrypted information and a real transaction is proved by using NIZK; the supervisor decrypts the encrypted transaction ciphertext by using the private key ska to obtain a transaction amount; the transaction initiator encrypts m by using the PKE and the public key pka of the supervisor to obtain an encrypted ciphertext, wherein lt; b, 2Ngt; the NIZK is equal to m, m is a result of encryption after the indication vector b is coded, and the consistency of the information and the real transaction is encrypted by using the NIZK; and the supervisor decrypts the encrypted ciphertext by using a private key ska to obtain a real participant of the transaction. According to the invention, strong privacy is ensured to be realized, and at the same time, penetrable supervision of a supervisor is carried out.

Description

Technical Field

[0001] The present invention relates to the field of privacy protection technology, and in particular to a supervision method and system for privacy-preserving distributed transactions. Background Art

[0002] The statements in this section merely provide background art related to the present invention and do not necessarily constitute prior art.

[0003] In blockchain-based distributed scenarios, transactions are usually broadcast in plain text and stored on blockchain ledgers, with Bitcoin and Ethereum being typical examples. Pioneering cryptocurrencies such as Bitcoin and Ethereum do not provide sufficient privacy. Analysts can obtain users’ transaction patterns and even infer users’ identity information and location information by analyzing transaction records. The privacy of cryptocurrencies can be divided into two properties: (1) confidentiality: third parties other than the two parties to the transaction cannot know the transaction amount; (2) anonymity: third parties other than the two parties to the transaction cannot know the identity information of the two parties to the transaction.

[0004] There are two main schemes for achieving confidentiality: one is based on commitment and the other is based on public key encryption. In the scheme based on commitment, the open value of the commitment must be transmitted to the recipient through an additional channel. If the recipient fails to open the commitment in a transaction, the entire account may be unusable in the future. Among the schemes based on public key encryption, the most commonly used is the ElGamal encryption scheme. The advantage of using the ElGamal encryption scheme is that the transaction amount can be decrypted from the ciphertext part. Unlike the scheme based on Pedersen commitment, which can directly call the Bulletproofs proof in a black box, the scheme based on public key encryption needs to consider and solve the problem of combining the ciphertext with the Bulletproofs proof.

[0005] Some researchers have proposed a new zero-knowledge proof scheme with logarithmic size, called any-out-of-many proof, which can prove the knowledge of any number of secrets in a public list. Unlike other partial knowledge proof protocols, the proof does not need to reveal the number of secrets. The protocol for privacy-enhanced cryptocurrency constructed based on this proof scheme has the highest level of anonymity compared to other similar protocols. However, for cryptocurrency, strong privacy is a double-edged sword. While using cryptographic technology to protect transaction privacy, it also brings huge challenges to regulatory audits, especially the anonymity feature that allows entities to deny their participation in a transaction to some extent, making it possible for some transactions to escape regulation. Summary of the invention

[0006] In order to address the deficiencies in the prior art, the present invention provides a method and system for supervising privacy-preserving distributed transactions. The supervisor can open any transaction without interacting with the user and grasp the real transaction topology, but cannot undermine the security of the user's account. The user's cryptocurrency assets are "visible but not movable", ensuring strong privacy while also being subject to penetrable supervision by the supervisor.

[0007] In order to achieve the above object, the present invention adopts the following technical solution:

[0008] In a first aspect, the present invention provides a method for supervising privacy-preserving distributed transactions.

[0009] A method for monitoring privacy-preserving distributed transactions, comprising the following process:

[0010] The transaction initiator uses homomorphic public key encryption and the regulator's public key to encrypt the transfer amount to obtain redundant secret transaction ciphertext, and uses a non-interactive zero-knowledge proof algorithm to prove the consistency of the encrypted information with the real transaction;

[0011] The regulator uses the regulator's private key to decrypt the encrypted transaction ciphertext and obtain the transaction amount;

[0012] The transaction initiator uses homomorphic public key encryption and the public key of the regulator to encrypt m to obtain an encrypted ciphertext, where m is the result of encrypting the indicator vector b after encoding it. A non-interactive zero-knowledge proof algorithm is used to prove the consistency of the encrypted information with the real transaction, where the indicator vector b is used to represent the relationship between the public key set and the corresponding private key;

[0013] The supervisor uses the supervisor's private key to decrypt the encrypted ciphertext to obtain the real participants in the transaction.

[0014] In a second aspect, the present invention provides a supervision system for privacy-preserving distributed transactions.

[0015] A privacy-preserving distributed transaction supervision system includes: a transaction initiator device, a supervisor device, and a transaction receiver device, wherein the transaction initiator device, the supervisor device, and the transaction receiver device are respectively connected to each other in communication;

[0016] The transaction initiator's device uses homomorphic public key encryption and the regulator's public key to encrypt the transfer amount to obtain redundant secret transaction ciphertext, and uses a non-interactive zero-knowledge proof algorithm to prove the consistency of the encrypted information with the real transaction;

[0017] The supervisor's device uses the supervisor's private key to decrypt the encrypted transaction ciphertext and obtain the transaction amount;

[0018] The transaction initiator device uses homomorphic public key encryption and the supervisor's public key to encrypt m to obtain an encrypted ciphertext, where m is the result of encrypting the indicator vector b after encoding it, and uses a non-interactive zero-knowledge proof algorithm to prove the consistency of the encrypted information with the real transaction, where the indicator vector b is used to represent the relationship between the public key set and the corresponding private key;

[0019] The supervisory device uses the supervisory private key to decrypt the encrypted ciphertext to obtain the real participants of the transaction.

[0020] Compared with the prior art, the present invention has the following beneficial effects:

[0021] The present invention innovatively proposes a supervision strategy for privacy-preserving distributed transactions, which not only protects the user's privacy - confidentiality and anonymity, but also allows transactions to be supervised by regulators. The regulators can open any transaction without interacting with the user and grasp the real transaction topology. The regulators can only supervise and do not have the user's private key, and cannot undermine the security of the user's account. The user's cryptocurrency assets are "visible but not movable", ensuring strong privacy while also being subject to penetrable supervision by the regulator.

[0022] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0024] Figure 1 A schematic diagram of a flow chart of a method for supervising privacy-preserving distributed transactions provided in Example 1 of the present invention;

[0025] Figure 2 A schematic diagram of a privacy-preserving distributed transaction supervision system provided in Example 2 of the present invention. DETAILED DESCRIPTION

[0026] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0027] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0028] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0029] Embodiment 1:

[0030] This paper designs a regulated privacy-preserving distributed transaction strategy for the UTXO (Unspent Transaction Output, an economic model for digital currency transactions) model, which can provide privacy to users while allowing regulators to implement efficient penetrating supervision. It mainly includes the following algorithms:

[0031] Setup(1 λ ): With safety parameter 1 λ As input, it outputs the system public parameter pp and secret parameter sp. This algorithm is only run once by the supervisor at the beginning of the system establishment. The generated public parameter pp is used as implicit input for all the following algorithms.

[0032] KeyGen(pp): takes the public parameter pp as input and outputs a key pair (pk, sk);

[0033] SerialGen(sk): takes the private key sk as input and outputs a serial number sn;

[0034] AccGen(pk,a): takes public key pk and amount a as input, uses amount a to mint coin C, and outputs account acc=(pk,C).

[0035] Receive(sk,acc): takes sk as input and outputs the amount a of coins in account acc;

[0036] Enter an account set acc R , the public key set pk of the recipient object t , the amount of money received by the recipient object amt T , the private key set sk corresponding to the real participant account in the account set, calls the AccGen algorithm with the public key set and amount of the recipient object as input, generates the account of the recipient object, and then outputs the transaction tx;

[0037] Verify(tx): takes transaction tx as input. If the verification is successful, it will output "1" to indicate that the transaction is valid. Otherwise, it will output "0" to indicate that the transaction is invalid.

[0038] Superverse(sp,tx): takes secret parameter sp and transaction tx as input, and outputs the real account involved in the transaction;

[0039] Users can generate their own public and private key pairs through the KeyGen algorithm, generate their own accounts through AccGen, and use the Spend algorithm to generate transactions.

[0040] Specifically in this implementation, the regulator generates its own public-private key pair through the KeyGen algorithm. The regulator's private key is used as the global regulatory private key, and the Superverse algorithm is used to supervise the transactions that have passed on the chain. The regulator can obtain the identity of the real transaction party and the transaction amount, that is, the real transaction topology (including the edge weights and corresponding amounts), but cannot undermine the security of the user's account.

[0041] In this implementation, the design idea of ​​the privacy protection mechanism is: use the public key encryption scheme (PKE) instead of the commitment scheme to achieve confidentiality, while also avoiding out-of-band transmission, that is, use homomorphic PKE to encrypt the transaction amount; place the real participating accounts in the anonymous account set, and use NIZK to prove the legitimacy of the transaction and the knowledge of the private keys of the real participating accounts, so as to achieve anonymity.

[0042] The any-out-of-many proof technology proposed by the researchers introduces a binary vector b to represent the relationship between the public key set and its corresponding private key, which is specifically expressed as follows:

[0043]

[0044] Where ck is the commitment key, P is a public commitment list generated by ck, and s represents the set of secrets corresponding to any k commitments in P, that is, i j Connecting subscript i in P to subscript j in s, naturally, the public key can be thought of as a special kind of commitment.

[0045] For easier explanation, the following example is given:

[0046] b=(0,1,0,1,0,0,0,0)(2);

[0047] P=(P1,[P2],P3,[P4],P5,P6,P7,P8)(3);

[0048] The binary vector b represents the commitment is a commitment to secrets s1 and s2, converting bit b i ∈b as the exponential part, calculate each commitment P i Index Proving knowledge of s naturally translates into proving that the equation holds. However, if we encode b and s directly and instantiate zkPoK, the proof size is linear and the value of k is also leaked. We can use the amortized technique. In simple terms, we use a random challenge Encode the secret value as an element on a domain The above equation can naturally be rewritten as in, In the proof process, it is also necessary to ensure that b is a binary vector, that is, b∈{0,1} N , which is equivalent to proving

[0049] like Figure 1 As shown in the figure, the design idea of ​​the supervision mechanism is as follows: S1: The transaction initiator uses the homomorphic PKE and the public key pk of the supervisor. a Encrypt the transfer amount to obtain redundant encrypted transaction ciphertext, and use NIZK to prove the consistency between the encrypted information and the real transaction; S2: The regulator can use the private key sk a Decrypt the secret transaction to obtain the transaction amount; S3: The transaction initiator uses PKE and the regulator’s public key pk a Encrypt m, where <b,2 N >=m, in simple terms, the indicator vector b is encoded and then encrypted, and the NIZK encryption information is used to ensure consistency with the real transaction; S4: The regulator can use the private key sk a Decrypt the ciphertext to obtain the real parties involved in the transaction.

[0050] The specific construction of the above algorithm includes the following processes:

[0051] Setup(1 λ ): With safety parameter safety parameter 1 λ For input, run pp pke ←PKE.Setup(1 λ ), (pk a ,sk a )←PKE.KeyGen(pp pke ), pp nizk ←NIZK.Setup(1 λ ), output public parameter pp = (pp pke ,pk a ,pp nizk ) and secret parameter sp = sk a ;

[0052] KeyGen(pp): Run PKE.KeyGen(pp) with the public parameter pp as input. pke )Generate a key pair (pk, sk).

[0053] AccGen(pk,a): takes public key pk and amount a as input, uses amount a to mint C, C←

[0054] PKE.Enc(pk,a;r), output account acc=(pk,C);

[0055] Receive(sk,acc): Take sk and acc as input, run a←PKE.Dec(sk,C) to output the amount of coins a in the account;

[0056] Enter an account set acc R , the public key set pk of the recipient object T , the amount of money received by the recipient object amt T , the private key set sk corresponding to the real participant account in the account set, generates and outputs the transaction according to the following steps:

[0057] (1) Call the AccGen algorithm with the public key set and amount of the recipient object as input to generate the account acc of the recipient object T ;

[0058] (2) Use PKE and the supervisory party’s key to encrypt the transaction amount and generate the ciphertext E i ;

[0059] (3) Use PKE and the public key of the supervisor to encrypt the identity indicator vector of the transaction participant and generate the ciphertext E l ;

[0060] (4) For evidence, run NIZK.Prove to generate π valid ,prove:

[0061] L valid The definition is as follows:

[0062]

[0063] (5) Output Transaction

[0064] Verify(tx,σ): takes transaction tx as input. If the verification is successful, the output is "1" to indicate that the transaction is valid. Otherwise, the output is "0" to indicate that the transaction is invalid.

[0065] Superverse(sp,tx): takes secret parameter sp and transaction tx as input, and resolves sp=sk a , run amt i ←PKE.Dec(sk a ,E v ), run b←PKE.Dec(sk a ,E l), output the real account participating in the transaction, and the amount of participation.

[0066] In terms of the selection of specific instantiations, the present invention uses the Twisted ElGamal PKE scheme as the instantiation scheme of the above-mentioned PKE. Twisted ElGamal PKE has the advantages of additive homomorphism and zero-knowledge proof friendliness.

[0067] Unlike ElGamal PKE, Twisted ElGamal randomly selects two generators g and h in the Setup phase, and the ciphertext of the encrypted message m is (pk r ,g r n m ), any-out-of-many proof technology requires proof When using Twisted ElGamal PKE instantiation, E l The ciphertext is (pk a r ,g r h m ),in <b,2 N >=m, and <b,2 N >=m, which coincides with the range proof idea in BulletProof. Since Twisted ElGamal PKE is friendly to zero-knowledge proof, the right half of the ciphertext can be regarded as a commitment, so the above protocol is naturally transformed into a range proof protocol.

[0068] Embodiment 2:

[0069] like Figure 2 As shown, this implementation method provides a supervision system for privacy-preserving distributed transactions, including: a transaction initiator device, a supervisory device and a transaction recipient device. The transaction initiator device, the supervisory device and the transaction recipient device are respectively connected to each other in communication. The specific supervision method is described in Example 1 and will not be repeated here.

[0070] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for supervising privacy-preserving distributed transactions, characterized in that: The process includes: The transaction initiator uses homomorphic public key encryption and the regulator's public key to encrypt the transfer amount to obtain redundant secret transaction ciphertext, and uses a non-interactive zero-knowledge proof algorithm to prove the consistency of the encrypted information with the real transaction; The regulator uses the regulator's private key to decrypt the encrypted transaction ciphertext and obtain the transaction amount; The transaction initiator uses homomorphic public key encryption and the public key of the regulator to encrypt m to obtain an encrypted ciphertext, where m is the result of encrypting the indicator vector b after encoding it. A non-interactive zero-knowledge proof algorithm is used to prove the consistency of the encrypted information with the real transaction, where the indicator vector b is used to represent the relationship between the public key set and the corresponding private key; The supervisor uses the supervisor's private key to decrypt the encrypted ciphertext to obtain the real participants in the transaction.

2. The method for supervising privacy-preserving distributed transactions according to claim 1, characterized in that: With safety parameter 1 λ For input, run pp pke ←PKE.Setup(1 λ ), (pk a ,sk a )←PKE.KeyGen(pp pke ), pp nizk ←NIZK.Setup(1 λ ), output public parameter pp = (pp pke ,pk a ,pp nizk ) and secret parameter sp = sk a ; Run PKE.KeyGen(pp) with the public parameter pp as input. pke )Generate a key pair (pk, sk); Take the public key pk and amount a as input, use amount a to mint C, C←PKE.Enc(pk,a;r), output account acc=(pk,C); Take sk and acc as input, run a←PKE.Dec(sk,C) to output the amount of coins a in the account; Enter an account set acc R , the public key set pk of the recipient object T 、The amount of money received by the recipient object amt T , the private key set sk corresponding to the real participant account in the account set, the public key set of the recipient object and the amount of money received by the recipient object amt T The AccGen algorithm is called as input to generate the account of the recipient object and then output the transaction tx.

3. The method for supervising privacy-preserving distributed transactions according to claim 2, characterized in that: Call the AccGen algorithm with the public key set and amount of the recipient object as input to generate the account acc of the recipient object T ; Use PKE and the regulator's key to encrypt the transaction amount and generate the ciphertext E i ; Use PKE and the public key of the supervisor to encrypt the identity indicator vector of the transaction participant and generate the ciphertext E l ; by For evidence, run NIZK.Prove to generate π valid ,prove L valid ; Output Transaction 4. The method for supervising privacy-preserving distributed transactions according to claim 3, characterized in that: Taking transaction tx as input, if the verification is passed, the output "1" represents that the transaction is valid, otherwise, the output "0" represents that the transaction is invalid.

5. The method for supervising privacy-preserving distributed transactions according to claim 3, characterized in that: Taking secret parameter sp and transaction tx as input, parse sp=sk a , run amt i ←PKE.Dec(sk a ,E v ), run b←PKE.Dec(sk a ,E l ), output the real account involved in the transaction and the amount involved.

6. A privacy-preserving distributed transaction supervision system, characterized in that: include: The transaction initiator device, the supervisor device and the transaction recipient device are respectively connected to each other in communication; The transaction initiator's device uses homomorphic public key encryption and the regulator's public key to encrypt the transfer amount to obtain redundant secret transaction ciphertext, and uses a non-interactive zero-knowledge proof algorithm to prove the consistency of the encrypted information with the real transaction; The supervisor's device uses the supervisor's private key to decrypt the encrypted transaction ciphertext and obtain the transaction amount; The transaction initiator device uses homomorphic public key encryption and the supervisor's public key to encrypt m to obtain an encrypted ciphertext, where m is the result of encrypting the indicator vector b after encoding it, and uses a non-interactive zero-knowledge proof algorithm to prove the consistency of the encrypted information with the real transaction, where the indicator vector b is used to represent the relationship between the public key set and the corresponding private key; The supervisory device uses the supervisory private key to decrypt the encrypted ciphertext to obtain the real participants of the transaction.

7. The privacy-preserving distributed transaction supervision system according to claim 6, characterized in that: With safety parameter 1 λ For input, run pp pke ←PKE.Setup(1 λ ), (pk a ,sk a )←PKE.KeyGen(pp pke ), pp nizk ←NIZK.Setup(1 λ ), output public parameter pp = (pp pke ,pk a ,pp nizk ) and secret parameter sp = sk a ; Run PKE.KeyGen(pp) with the public parameter pp as input. pke )Generate a key pair (pk, sk); Take the public key pk and amount a as input, use amount a to mint C, C←PKE.Enc(pk,a;r), output account acc=(pk,C); Take sk and acc as input, run a←PKE.Dec(sk,C) to output the amount of coins a in the account; Enter an account set acc R , the public key set pk of the recipient object T 、The amount of money received by the recipient object amt T , the private key set sk corresponding to the real participant account in the account set, the public key set of the recipient object and the amount of money received by the recipient object amt T The AccGen algorithm is called as input to generate the account of the recipient object and then output the transaction tx.

8. The privacy-preserving distributed transaction supervision system according to claim 7, characterized in that: Call the AccGen algorithm with the public key set and amount of the recipient object as input to generate the account acc of the recipient object T ; Use PKE and the supervisor's device key to encrypt the transaction amount and generate the ciphertext E i ; Use PKE and the public key of the supervisor's device to encrypt the identity indication vector of the transaction participant to generate the ciphertext E l ; by For evidence, run NIZK.Prove to generate π valid ,prove Output Transaction 9. The privacy-preserving distributed transaction supervision system according to claim 8, characterized in that: Taking transaction tx as input, if the verification is passed, the output "1" represents that the transaction is valid, otherwise, the output "0" represents that the transaction is invalid.

10. The privacy-preserving distributed transaction supervision system according to claim 8, characterized in that: Taking secret parameter sp and transaction tx as input, parse sp=sk a , run amt i ←PKE.Dec(sk a ,E v ), run b←PKE.Dec(sk a ,E l ), output the real account involved in the transaction and the amount involved.

Images