Private transaction method and device

Abstract

The embodiment of the invention provides a private transaction method and device, which are applied to the technical field of block chain application, and for reinforcement learning of any round, the method comprises the following steps: obtaining a transaction record and a transaction proof sent by a transaction initiator, the transaction record being determined by the transaction initiator based on a private transaction, and the transaction proof being determined by the transaction initiator based on the private transaction; the transaction record comprises transaction amount information, first proof information pointing to a transaction initiator and second proof information pointing to a transaction receiver; the address of at least one of the transaction initiator and the transaction receiver participating in the transaction is a private address; performing zero-knowledge proof verification on the transaction proof by calling the private transaction contract; and if the verification is passed, storing the transaction record in a transaction record set of the block chain and updating the total account amount of the private transaction contract. According to the method, all privacy transaction information is selectively hidden by utilizing a zero-knowledge proof technology, sensitive transaction details are ensured not to be leaked, and the privacy of the user is effectively protected while the legality of the privacy transaction is ensured.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of blockchain application technology, and in particular to a privacy transaction method and device. Background Art

[0002] The transaction information of early blockchain ledgers was completely open and transparent. Although this design ensures the verifiability of the system, it also brings serious privacy issues: anyone can track transaction history and view account balances, which is unacceptable to many users and businesses. Therefore, as people's demand for privacy increases, some blockchain projects focusing on privacy protection have emerged. The two most famous examples are:

[0003] 1. Monero: Uses ring signatures and stealth address technology to hide the identities of transaction participants and transaction amounts.

[0004] 2. Zcash: It uses zero-knowledge proof technology (zk-SNARKs) to allow users to initiate transactions, but the transaction information cannot be seen by people other than the transaction parties, thus protecting the privacy of the transaction.

[0005] These early privacy coin projects are all based on the UTXO model (Unspent Transaction Output Model). The UTXO model has some obvious disadvantages, including difficulty in implementing complex smart contracts, difficulty in expressing complex state transitions, and limited scalability: as the transaction volume increases, the UTXO set will expand rapidly, affecting system performance. These disadvantages have prompted researchers to begin to focus on privacy transaction solutions based on the account model. The account model makes it easier to implement complex smart contracts and is more in line with people's intuitive understanding of "accounts."

[0006] However, existing account model privacy schemes still have problems. They can usually only partially protect privacy, for example, only hiding the transaction amount but not completely hiding the sender and receiver's addresses. For example, some schemes protect privacy in a single transaction, but may still leak information through long-term analysis. This incomplete privacy protection may still cause serious problems in financial and commercial applications. Therefore, we need a scheme that can simultaneously hide the identity (address) and transaction amount of transaction participants, and protect the privacy of account balances and smart contract operations. Summary of the invention

[0007] The embodiments of the present application provide a privacy transaction method and apparatus, which are used to allow proof information to be verified by everyone during a privacy transaction while ensuring that the privacy transaction information is not leaked.

[0008] In a first aspect, an embodiment of the present application provides a privacy transaction method, including:

[0009] Obtaining a transaction record and a transaction proof sent by the transaction initiator, wherein the transaction record is determined by the transaction initiator based on the private transaction, and includes transaction amount information, first proof information pointing to the transaction initiator, and second proof information pointing to the transaction recipient; wherein the address of at least one of the transaction initiator and the transaction recipient participating in the transaction is a private address; the transaction proof is a zero-knowledge proof generated based on the transaction record, and the transaction proof is used to prove the legitimacy of the private transaction;

[0010] The transaction proof is verified by calling the privacy transaction contract with zero-knowledge proof; if the verification passes, the transaction record is saved in the transaction record set of the blockchain and the total account amount of the privacy transaction contract is updated.

[0011] This application uses zero-knowledge proof technology to selectively hide all transaction information, ensuring that sensitive transaction details are not leaked, effectively protecting the privacy of users, while ensuring the legality of transactions and maintaining the integrity and credibility of the system. It also allows the interaction between the privacy pool and the transparent pool through smart contracts, realizing the seamless conversion of privacy funds and transparent funds, providing users with more choices, and being able to flexibly switch transaction modes according to different scenarios, enhancing the compatibility and practicality of the blockchain transaction system.

[0012] Optionally, the address of the transaction initiator participating in the transaction is a transparent address, and the address of the transaction recipient participating in the transaction is a private address.

[0013] The transaction amount information is the transaction amount;

[0014] The first proof information is the transparent address of the transaction initiator;

[0015] The second proof information is generated by encrypting the private transaction based on the key derived by the transaction initiator through the private address of the transaction recipient; the private transaction includes the transaction amount and the derived address; the derived address is derived by the transaction initiator based on the private address of the transaction recipient.

[0016] Optionally, before verifying the transaction proof by zero-knowledge proof by calling the privacy transaction contract, the process further includes:

[0017] Obtaining a transaction signature for the transaction record sent by the transaction initiator;

[0018] Determine the legitimacy of the transaction signature by calling the transparent transaction contract;

[0019] The updating of the total account amount of the privacy transaction contract includes:

[0020] By calling the transparent transaction contract, the account balance indicated by the transparent address of the transaction initiator is reduced by the transaction amount, and the total account balance of the privacy transaction contract is increased by the transaction amount.

[0021] Optionally, the private transaction further includes a random seed, and the transaction record further includes a commitment of the private transaction, and the commitment of the private transaction is generated by the random seed and the private transaction;

[0022] The step of saving the transaction record to a transaction record set of the blockchain includes:

[0023] The commitment record in the transaction record of the private transaction is saved in the commitment Merkle tree in the transaction record set of the blockchain.

[0024] Optionally, the private transaction further includes a random identifier for identifying the private transaction;

[0025] The transaction recipient is used to obtain the transaction record from the transaction record set, decrypt the second proof information in the transaction record and determine that the random identifier in the decryption result is legal, and then locally increase the account amount indicated by the private address of the transaction recipient by the transaction amount.

[0026] Optionally, the transaction proof is a zero-knowledge proof generated based on the transaction record, including:

[0027] The transaction proof is generated through the public parameters of the zero-knowledge proof, the commitment of the latest private transaction in the Merkle tree at the time of initiation of the private transaction, and the transaction record.

[0028] Optionally, the address of the transaction initiator participating in the transaction is a private address, and the address of the transaction recipient participating in the transaction is a transparent address.

[0029] The transaction amount information is the transaction amount;

[0030] The first proof information is generated by the transaction initiator according to at least one historical private transaction; the total amount in the historical private transaction is not less than the transaction amount;

[0031] The second proof information is the transparent address of the transaction recipient;

[0032] The transaction record and the transaction proof are sent by the transaction initiator through a temporary address, and the temporary address is generated based on the private key of the transaction initiator.

[0033] Optionally, the historical privacy transaction further includes a derived address, a random seed, and a random identifier for identifying the historical privacy transaction;

[0034] The first proof information is generated by the transaction initiator according to at least one historical private transaction, and includes:

[0035] Generate a commitment for each historical private transaction based on the random seed of each historical private transaction;

[0036] Based on the random identifier of each historical privacy transaction and the commitment of each historical privacy transaction, generate a usage identifier for each historical privacy transaction, where the usage identifier is used to indicate whether the historical privacy transaction has been used;

[0037] The first proof information is a usage identifier of the at least one historical private transaction.

[0038] Optionally, the step of saving the transaction record to a transaction record set of a blockchain includes:

[0039] The usage identifier of the at least one historical privacy transaction is placed into the used identifier set in the transaction record set on the chain.

[0040] Optionally, updating the total account balance of the privacy transaction contract includes:

[0041] Reduce the total account balance of the private transaction contract by the transaction amount.

[0042] Optionally, after obtaining the transaction record from the transaction record set, the transaction recipient determines that the transparent address exists in the transaction record, and locally reduces the account balance indicated by the transparent address of the transaction recipient by the transaction amount.

[0043] Optionally, the address of the transaction initiator participating in the transaction is a private address, and the address of the transaction recipient participating in the transaction is a private address.

[0044] The transaction amount information is obtained by encrypting the transaction amount by the transaction initiator;

[0045] The first proof information is generated by the transaction initiator according to at least one historical private transaction; the total amount in the historical private transaction is not less than the transaction amount;

[0046] The second proof information is generated by encrypting the private transaction based on the key derived by the transaction initiator through the private address of the transaction recipient; the private transaction includes the transaction amount and the derived address; the derived address is derived by the transaction initiator based on the private address of the transaction recipient.

[0047] Optionally, the historical private transaction further includes a derived address, a random seed, and a random identifier for identifying the private transaction;

[0048] The first proof information is generated by the transaction initiator according to at least one historical private transaction, and includes:

[0049] Generate a commitment for each historical private transaction based on the random seed of each historical private transaction;

[0050] Based on the random identifier of each historical privacy transaction and the commitment of each historical privacy transaction, generate a usage identifier for each historical privacy transaction, where the usage identifier is used to indicate whether the historical privacy transaction has been used;

[0051] The first proof information is a usage identifier of the at least one historical private transaction.

[0052] Optionally, the private transaction further includes a random seed, and the transaction record further includes a commitment of the private transaction, and the commitment of the private transaction is generated by the random seed and the private transaction;

[0053] The step of saving the transaction record to a transaction record set of the blockchain includes:

[0054] Saving the commitment record in the transaction record of the private transaction into a commitment Merkle tree in the transaction record set of the blockchain;

[0055] The usage identifier of the at least one historical privacy transaction is placed into the used identifier set in the transaction record set on the chain.

[0056] Optionally, the private transaction further includes a random identifier for identifying the private transaction;

[0057] The transaction recipient is used to obtain the transaction record from the transaction record set, decrypt the second proof information in the transaction record and determine that the random identifier in the decryption result is legal, and then locally increase the account amount indicated by the private address of the transaction recipient by the transaction amount.

[0058] In a second aspect, an embodiment of the present application provides a privacy transaction device, including:

[0059] An acquisition module is used to acquire a transaction record and a transaction proof sent by a transaction initiator, wherein the transaction record is determined by the transaction initiator based on a private transaction, and the transaction record includes transaction amount information, first proof information pointing to the transaction initiator, and second proof information pointing to the transaction recipient; wherein the address of at least one of the transaction initiator and the transaction recipient participating in the transaction is a private address; the transaction proof is a zero-knowledge proof generated based on the transaction record, and the transaction proof is used to prove the legitimacy of the private transaction;

[0060] The processing module is used to verify the zero-knowledge proof of the transaction proof by calling the privacy transaction contract; if the verification is successful, the transaction record is saved in the transaction record set of the blockchain and the total account amount of the privacy transaction contract is updated.

[0061] Beneficial effects:

[0062] Optionally, the acquisition module is specifically used for:

[0063] The address of the transaction initiator participating in the transaction is a transparent address, and the address of the transaction recipient participating in the transaction is a private address.

[0064] The transaction amount information is the transaction amount;

[0065] The first proof information is the transparent address of the transaction initiator;

[0066] The second proof information is generated by encrypting the private transaction based on the key derived by the transaction initiator through the private address of the transaction recipient; the private transaction includes the transaction amount and the derived address; the derived address is derived by the transaction initiator based on the private address of the transaction recipient.

[0067] Optionally, the acquisition module is specifically used for:

[0068] Obtaining a transaction signature for the transaction record sent by the transaction initiator;

[0069] Determine the legitimacy of the transaction signature by calling the transparent transaction contract;

[0070] The updating of the total account amount of the privacy transaction contract includes:

[0071] By calling the transparent transaction contract, the account balance indicated by the transparent address of the transaction initiator is reduced by the transaction amount, and the total account balance of the privacy transaction contract is increased by the transaction amount.

[0072] Optionally, the acquisition module is specifically used for:

[0073] The private transaction further includes a random seed, and the transaction record further includes a commitment of the private transaction, where the commitment of the private transaction is generated by the random seed and the private transaction;

[0074] The step of saving the transaction record to a transaction record set of the blockchain includes:

[0075] The commitment record in the transaction record of the private transaction is saved in the commitment Merkle tree in the transaction record set of the blockchain.

[0076] Optionally, the acquisition module is specifically used for:

[0077] The private transaction also includes a random identifier for identifying the private transaction;

[0078] The transaction recipient is used to obtain the transaction record from the transaction record set, decrypt the second proof information in the transaction record and determine that the random identifier in the decryption result is legal, and then locally increase the account amount indicated by the private address of the transaction recipient by the transaction amount.

[0079] Optionally, the processing module is used to:

[0080] The transaction proof is a zero-knowledge proof generated based on the transaction record, including:

[0081] The transaction proof is generated through the public parameters of the zero-knowledge proof, the commitment of the latest private transaction in the Merkle tree at the time of initiation of the private transaction, and the transaction record.

[0082] Optionally, the acquisition module is used to:

[0083] The address of the transaction initiator participating in the transaction is a private address, and the address of the transaction recipient participating in the transaction is a transparent address.

[0084] The transaction amount information is the transaction amount;

[0085] The first proof information is generated by the transaction initiator according to at least one historical private transaction; the total amount in the historical private transaction is not less than the transaction amount;

[0086] The second proof information is the transparent address of the transaction recipient;

[0087] The transaction record and the transaction proof are sent by the transaction initiator through a temporary address, and the temporary address is generated based on the private key of the transaction initiator.

[0088] Optionally, the processing module is used to:

[0089] The historical privacy transaction also includes a derived address, a random seed, and a random identifier for identifying the historical privacy transaction;

[0090] The first proof information is generated by the transaction initiator according to at least one historical private transaction, and includes:

[0091] Generate a commitment for each historical private transaction based on the random seed of each historical private transaction;

[0092] Based on the random identifier of each historical privacy transaction and the commitment of each historical privacy transaction, generate a usage identifier for each historical privacy transaction, where the usage identifier is used to indicate whether the historical privacy transaction has been used;

[0093] The first proof information is a usage identifier of the at least one historical private transaction.

[0094] Optionally, the processing module is used to:

[0095] The usage identifier of the at least one historical privacy transaction is placed into the used identifier set in the transaction record set on the chain.

[0096] Optionally, the processing module is used to:

[0097] Reduce the total account balance of the private transaction contract by the transaction amount.

[0098] Optionally, the processing module is used to:

[0099] The transaction recipient is used to obtain the transaction record from the transaction record set, determine that the transparent address exists in the transaction record, and locally reduce the account amount indicated by the transparent address of the transaction recipient by the transaction amount.

[0100] Optionally, the acquisition module is used to:

[0101] The address of the transaction initiator participating in the transaction is a private address, and the address of the transaction recipient participating in the transaction is a private address.

[0102] The transaction amount information is obtained by encrypting the transaction amount by the transaction initiator;

[0103] The first proof information is generated by the transaction initiator according to at least one historical private transaction; the total amount in the historical private transaction is not less than the transaction amount;

[0104] The second proof information is generated by encrypting the private transaction based on the key derived by the transaction initiator through the private address of the transaction recipient; the private transaction includes the transaction amount and the derived address; the derived address is derived by the transaction initiator based on the private address of the transaction recipient.

[0105] Optionally, the acquisition module is used to:

[0106] The historical privacy transaction also includes a derived address, a random seed, and a random identifier for identifying the privacy transaction;

[0107] The first proof information is generated by the transaction initiator according to at least one historical private transaction, and includes:

[0108] Generate a commitment for each historical private transaction based on the random seed of each historical private transaction;

[0109] Based on the random identifier of each historical privacy transaction and the commitment of each historical privacy transaction, generate a usage identifier for each historical privacy transaction, where the usage identifier is used to indicate whether the historical privacy transaction has been used;

[0110] The first proof information is a usage identifier of the at least one historical private transaction.

[0111] Optionally, the acquisition module is used to:

[0112] The private transaction further includes a random seed, and the transaction record further includes a commitment of the private transaction, where the commitment of the private transaction is generated by the random seed and the private transaction;

[0113] The step of saving the transaction record to a transaction record set of the blockchain includes:

[0114] Saving the commitment record in the transaction record of the private transaction into a commitment Merkle tree in the transaction record set of the blockchain;

[0115] The usage identifier of the at least one historical privacy transaction is placed into the used identifier set in the transaction record set on the chain.

[0116] Optionally, the acquisition module is used to:

[0117] The private transaction also includes a random identifier for identifying the private transaction;

[0118] The transaction recipient is used to obtain the transaction record from the transaction record set, decrypt the second proof information in the transaction record and determine that the random identifier in the decryption result is legal, and then locally increase the account amount indicated by the private address of the transaction recipient by the transaction amount.

[0119] In a third aspect, an embodiment of the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes any of the privacy transaction methods described in the first aspect.

[0120] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium storing a computer program executable by a computer device. When the program runs on the computer device, the computer device executes any of the privacy transaction methods described in the first aspect above.

[0121] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program / instruction, which, when executed by a processor, implements any of the privacy transaction methods described in the first aspect above. BRIEF DESCRIPTION OF THE DRAWINGS

[0122] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0123] Figure 1 A schematic diagram of the structure of a privacy transaction system provided in an embodiment of the present application;

[0124] Figure 2 A flowchart of a privacy transaction method provided in an embodiment of the present application;

[0125] Figure 3 A flowchart of a privacy transaction method provided in an embodiment of the present application;

[0126] Figure 4 A flowchart of a privacy transaction method provided in an embodiment of the present application;

[0127] Figure 5 A flowchart of a privacy transaction method provided in an embodiment of the present application;

[0128] Figure 6 A schematic diagram of a privacy transaction device provided in an embodiment of the present application;

[0129] Figure 7A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0130] In order to make the purpose, technical solution and beneficial effects of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0131] The following are explanations of the terms used in this application:

[0132] Zero-knowledge proof is a cryptographic method that allows one party (the prover) to prove to another party (the verifier) ​​that a "statement" is true and correct without revealing any information about the statement other than the fact that the statement is true. This technology allows the prover to prove that he knows a secret or information that satisfies certain conditions without revealing the specific content of the secret to the verifier. The significance of this technology lies in the ability to achieve multiple application scenarios such as identity authentication and asset proof while protecting privacy, and is particularly suitable for decentralized systems such as blockchain. An effective zero-knowledge proof system needs to meet three properties: completeness, soundness, and zero-knowledge. This proof system allows the prover to convince the verifier of the authenticity of a statement without revealing secret information.

[0133] Zero-knowledge succinct non-interactive argument of knowledge (zk-SNARKs): is a special implementation of zero-knowledge proof technology, which is characterized by "succinct" and "non-interactive" characteristics. "Succinct" refers to the proof size generated by the prover is less than the linear level, and the verification time is also very small, regardless of the length of the statement to be proved. "Non-interactive" means that the prover only needs to generate the proof once and then send it to the verifier to complete the protocol process, without the need for multiple back-and-forth interactions between the two. We assume that there is a zk-SNARKs proof system, the public parameter pp is obtained through the initial trusted setup Setup(1^λ), the prover uses the public parameter pp, the public input s and the secret information (witness) w to generate the proof π=Prove(pp,s,w), the verifier uses the public parameter pp, the public input s and the proof π to verify, and obtains the result v=Verify(pp,s,π), v=1 or 0, representing the verification passed or failed.

[0134] The Account Model is a blockchain ledger structure that represents the state of the blockchain ledger as a set of accounts and their corresponding states. Each account has a unique address and associated state information, including balances, smart contract codes, etc. This model allows the system to directly operate on accounts, such as transferring money, executing smart contracts, etc., which will cause changes in account states. This structure enables the blockchain to work like a traditional bank account system without relying on transaction information for state changes, while being decentralized, transparent, and tamper-proof. This model simplifies the implementation of complex transactions on the blockchain and is suitable for application scenarios that require frequent state updates, such as decentralized finance (DeFi) and smart contract platforms.

[0135] There are still problems with the account model privacy schemes in the prior art. Usually, privacy can only be partially protected, for example, only the transaction amount is hidden, but the addresses of the sender and the receiver cannot be completely hidden. For example, some schemes protect privacy in a single transaction, but may still leak information through long-term analysis. This incomplete privacy protection may still cause serious problems in financial and commercial applications. Therefore, we need a scheme that can simultaneously hide the identity (address) and transaction amount of the transaction participants, and protect the privacy operations of the account balance and smart contracts.

[0136] like Figure 1 As shown, a privacy transaction system provided by the present application specifically includes a transaction initiator 101, a transaction recipient 102 and a blockchain 103. The blockchain 103 includes multiple blockchain nodes 104. A privacy transaction contract and a transparent account smart contract are deployed on the blockchain. The smart contract is like an automatically executed agreement that defines the rules and conditions of the transaction. For example, in a simple commodity sales contract, terms such as commodity price, delivery method, and payment method are specified. The total amount of the privacy accounts of all transaction initiators 101 and transaction recipients 102 related to the privacy transaction contract is stored on the privacy transaction contract; the transparent address of each transaction initiator 101 and each transaction recipient 102 and the amount of the public transparent account corresponding to the address are stored on the transparent smart contract. The transaction initiator 101 and the transaction recipient 102 automatically process the transaction by calling the pre-written code in the privacy transaction contract and / or the transparent account smart contract through the blockchain node 104.

[0137] Since this application is aimed at transactions between the transaction initiator and the transaction receiver, it mainly involves four situations, namely, the address of the transaction initiator participating in the transaction is a transparent address, and the address of the transaction receiver participating in the transaction is a transparent address; the address of the transaction initiator participating in the transaction is a transparent address, and the address of the transaction receiver participating in the transaction is a private address; the address of the transaction initiator participating in the transaction is a private address, and the address of the transaction receiver participating in the transaction is a transparent address; the address of the transaction initiator participating in the transaction is a private address, and the address of the transaction receiver participating in the transaction is a private address. Among them, except that the transaction from transparent address to transparent address is directly completed by the transparent account smart contract, the other three situations all involve the transaction process of the private address. The process of these three private transactions is elaborated in detail below.

[0138] like Figure 2 As shown, a privacy transaction method provided by this application is applicable to blockchain nodes and specifically includes the following steps:

[0139] Step S201, obtaining the transaction record and transaction proof sent by the transaction initiator. The transaction record is determined by the transaction initiator based on the private transaction, and includes the transaction amount information, the first proof information pointing to the transaction initiator, and the second proof information pointing to the transaction recipient. Among them, the address of at least one of the transaction initiator and the transaction recipient participating in the transaction is a private address; the transaction proof is a zero-knowledge proof generated based on the transaction record, and the transaction proof is used to prove the legitimacy of the private transaction;

[0140] Specifically, the transaction initiator initiates a transaction request to generate a transaction record. The transaction initiator generates a transaction record locally. The transaction record includes first proof information and second proof information. The first proof information is used to indicate that the transaction was initiated by the transaction initiator, and the second proof information is used to indicate that the transaction was received by the transaction receiver. The transaction initiator sends the transaction request to the node in the blockchain network. The node on the blockchain network needs to verify whether the transaction request complies with the rules of the blockchain network. Therefore, the transaction initiator also needs to generate a zero-knowledge proof based on the transaction record. The transaction proof is used by the nodes on the blockchain network to prove the legitimacy of the private transaction.

[0141] Step S202, verify the zero-knowledge proof of the transaction proof by calling the privacy transaction contract; if the verification passes, save the transaction record to the transaction record set of the blockchain and update the total account amount of the privacy transaction contract.

[0142] Specifically, the nodes on the blockchain network verify the legitimacy of the privacy transaction contract by calling it, and specifically verify the transaction proof through zero-knowledge proof. When the verification passes, it proves that the transaction is a legal transaction, and saves the transaction record to the transaction record set of the blockchain, and updates the total account amount in the privacy transaction contract based on the transaction amount information in the transaction record.

[0143] This application uses zero-knowledge proof technology to selectively hide all transaction information, ensuring that sensitive transaction details are not leaked, effectively protecting the privacy of users, while ensuring the legality of transactions and maintaining the integrity and credibility of the system. It also allows the interaction between the privacy pool and the transparent pool through smart contracts, realizing the seamless conversion of privacy funds and transparent funds, providing users with more choices, and being able to flexibly switch transaction modes according to different scenarios, enhancing the compatibility and practicality of the blockchain transaction system.

[0144] The following introduces the first case. The address of the transaction initiator participating in the transaction is a transparent address, and the address of the transaction recipient participating in the transaction is a private address.

[0145] The transaction amount information is the transaction amount; the first proof information is the transparent address of the transaction initiator; the second proof information is generated by encrypting the private transaction based on the key derived by the transaction initiator through the private address of the transaction recipient; the private transaction includes the transaction amount and the derived address; the derived address is derived by the transaction initiator based on the private address of the transaction recipient. Each private transaction will derive a one-time address for this transaction based on the address of the recipient to enhance privacy.

[0146] Before verifying the zero-knowledge proof of the transaction proof by calling the privacy transaction contract, it also includes: obtaining the transaction signature for the transaction record sent by the transaction initiator; determining the legitimacy of the transaction signature by calling the transparent transaction contract; updating the total account amount of the privacy transaction contract, including: by calling the transparent transaction contract, reducing the account amount indicated by the transparent address of the transaction initiator by the transaction amount, and increasing the total account amount of the privacy transaction contract by the transaction amount.

[0147] The private transaction also includes a random seed, and the transaction record also includes a commitment to the private transaction, which is generated by the random seed and the private transaction; saving the transaction record in the transaction record set of the blockchain includes: saving the commitment record in the transaction record of the private transaction in the commitment Merkle tree in the transaction record set of the blockchain.

[0148] The private transaction also includes a random identifier for identifying the private transaction; after the transaction recipient obtains the transaction record from the transaction record set, after decrypting the second proof information in the transaction record and determining that the random identifier in the decryption result is legal, the account amount indicated by the private address of the transaction recipient is increased locally by the transaction amount.

[0149] The transaction proof is a zero-knowledge proof generated based on the transaction record, including: generating the transaction proof through the public parameters of the zero-knowledge proof, the commitment to the latest private transaction in the Merkle tree at the time of initiation of the private transaction, and the transaction record.

[0150] For example, the transaction recipient Alice uses a transparent address to transfer 100 yuan to Bob's private address. Figure 3 The privacy transaction method flow chart shown in the figure also includes transparent contracts and privacy transaction contracts in the transaction process. The transparent contract Erc20 and the privacy transaction contract 0xHiddenTransfer are used to illustrate the above transaction process. It should be noted that the address of the Erc20 transparent account smart contract on the blockchain is 0xErc20. The contract stores the addresses of each user including Alice and Bob and the corresponding public transparent account amounts, and also stores 0xHiddenTransfer and its corresponding total privacy account amount. The blockchain node saves a commitment Merkle tree CMT and a used identifier set UID on the blockchain.

[0151] The transaction process specifically includes the following steps:

[0152] Phase 1: Alice calls the private key sk_a corresponding to the transparent address 0xAlice to generate a zero-knowledge proof transfer request;

[0153] Step 301, Alice obtains Bob's private address zBob offline by some means, and derives Bob's address bound to this transaction based on the address. (d^b,pk_d^b) represents the generated derived address. Each private transaction will derive a one-time address for this transaction based on the recipient's address to enhance privacy.

[0154] Step 302: Alice generates a private transaction to Bob based on the transfer amount of 100 and Bob's address, denoted as ptx_b, where ptx_b:(d^b,pk_d^b,m,p,\psi,rcm), where m represents the amount of 100, p and \psi are random identifiers of this transaction, which can prove the uniqueness of the transaction when Bob uses ptx_b later; rcm is the random seed used to generate the commitment of this transaction.

[0155] Step 303: Alice uses the commitment algorithm (PTXCommit) to calculate the commitment cm_b of ptx_b based on the random seed rcm. The algorithm is expressed as cm_b = PTXCommit (ptx_b), and uses bob's private address zBob and the randomly generated auxiliary information enc_info to calculate the key symKey_b, and uses the key to symmetrically encrypt ptx_b to obtain the symmetrically encrypted ciphertext enc (ptx_b);

[0156] Step 304, Alice generates a transaction record record according to her transparent address 0xAlice and the above information, record = (amount 100, 0xAlice, cm_b, enc(ptx_b), enc_info), and uses the zk-snarks algorithm halo2 to generate a proof of the record π = Prove(pp, s, record) according to the transaction record record, where the input pp is a public parameter fixed by the algorithm, and s is public information on the chain, for example, the committed Merkle tree CMT of the previous private transaction; the zero-knowledge proof π can prove the legitimacy of the private transaction, where legitimacy means that the transaction record conforms to the prescribed format, the account address is legal, and the amount is valid.

[0157] Step 305: Alice generates an authorization signature for the transaction record record based on her private key sk_a, recorded as SpendAuthSig, and packages the transaction record record, zero-knowledge proof π and signature SpendAuthSig and sends them to the Erc20 contract;

[0158] Phase 2: Interaction between Erc20 contract and privacy transaction contract

[0159] Step 306. After receiving the packaged transaction, the Erc20 contract first verifies the signature SpendAuthSig to confirm that it is initiated by Alice. After the verification is passed, the 0xHiddenTransfer privacy contract address is called to verify π;

[0160] Step 307, the privacy contract 0xHiddenTransfer uses the zk-snarks verification algorithm to verify the legitimacy of the transaction record v = Verify (pp, s, π), and returns the result v to the Erc20 contract. If v = 1, it means the verification is successful, and the blockchain node will put the commitment cm_b into the commitment tree CMT on the chain to record the transaction;

[0161] Step 308, the Erc20 contract receives the verification result v. If the verification is successful, the account balance corresponding to the 0xAlice address is reduced by 100, and the total account balance of the 0xHiddenTransfer contract is increased by 100;

[0162] Phase 3: Bob obtains transaction information

[0163] Step 309, after Bob finds the public transaction record record on the 0xHiddenTransfer contract, he cannot directly know that the recipient of the transaction record record is himself. Bob needs to generate the key symKey_b based on his private address zBob and the decryption information enc_info in the transaction record record, and try to decrypt enc(ptx_b) to obtain the transaction information ptx_b, then save the transaction information locally and update his private amount plus 100. In this step, in fact, all nodes will try to decrypt the encrypted ciphertext enc(ptx_b), but only Bob can successfully decrypt it.

[0164] The second case is introduced below: the address of the transaction initiator participating in the transaction is a private address, and the address of the transaction recipient participating in the transaction is a transparent address.

[0165] The transaction amount information is the transaction amount; the first proof information is generated by the transaction initiator based on at least one historical privacy transaction; the total amount in the historical privacy transactions is not less than the transaction amount; the second proof information is the transparent address of the transaction recipient; the transaction record and transaction proof are sent by the transaction initiator through a temporary address, and the temporary address is generated based on the private key of the transaction initiator.

[0166] The historical privacy transaction also includes a derived address, a random seed, and a random identifier for identifying the historical privacy transaction; the first proof information is generated by the transaction initiator based on at least one historical privacy transaction, including: generating a commitment for each historical privacy transaction based on the random seed of each historical privacy transaction; generating a usage identifier for each historical privacy transaction based on the random identifier of each historical privacy transaction and the commitment of each historical privacy transaction, and the usage identifier is used to characterize whether the historical privacy transaction has been used; the first proof information is a usage identifier for at least one historical privacy transaction.

[0167] Saving the transaction record to a transaction record set of a blockchain includes: placing a usage identifier of at least one historical privacy transaction into a used identifier set in the transaction record set on the chain.

[0168] Update the total account balance of the privacy transaction contract, including: reducing the total account balance of the privacy transaction contract by the transaction amount.

[0169] After obtaining the transaction record from the transaction record set, the transaction recipient determines that a transparent address exists in the transaction record, and locally reduces the account amount indicated by the transparent address of the transaction recipient by the transaction amount.

[0170] For example, the transaction recipient Alice uses a private address to transfer 100 yuan to Bob's transparent address. Figure 4 The privacy transaction method flow chart shown in the figure also includes transparent contracts and privacy transaction contracts in the transaction process. The transparent contract Erc20 and the privacy transaction contract 0xHiddenTransfer are used to illustrate the above transaction process. It should be noted that the address of the Erc20 transparent account smart contract on the blockchain is 0xErc20. The contract stores the addresses of each user including Alice and Bob and the corresponding public transparent account amounts, and also stores 0xHiddenTransfer and its corresponding total privacy account amount. The blockchain node saves a commitment Merkle tree CMT and a used identifier set UID on the blockchain. It specifically includes the following steps:

[0171] Phase 1: Alice calls the private key sk_a corresponding to the privacy address zAlice to generate a zero-knowledge proof transfer request;

[0172] Step 401, Alice directly obtains Bob's transparent address 0xBob through the chain, and derives a temporary address Taddress based on zAlice's private key sk_a. The temporary address is a one-time address to enhance privacy;

[0173] Step 402: Alice searches for n private transactions in which other people previously transferred funds to Alice's private address locally, and represents these transactions as ptx_a-1, ptx_a-2....ptx_a-n, where ptx_a-i:(d^ai,pk_d^ai,v_i,p_a-i,\psi_a-i,rcm_a-i), i=1,2,...,n; the amounts of these private transactions vary, and the transaction whose total amount is equal to 100 needs to be gathered from the n private transactions, represented as m=m_1+m_2+...m_n;

[0174] Step 403: Alice calculates the used identifier uid_i=DeriveNullifiernk(p_a-i,\psi_a-i,cm_a-i) of each ptx_a-i, where DeriveNullifiernk is a random identifier generation algorithm, and cm_a is the commitment PTXCommit(ptx_a-i) of ptx_a-i.

[0175] Step 404: Alice generates a transaction record record = (amount 100, random identifier uid_1, uid_2, ..., uid_n, 0xBob), and uses the zk-snarks algorithm halo2 to generate a proof of the record π = Prove (pp, s, record), where s contains the random identifier set UID of previously used private transactions, which indicates that the transactions in the set have been used, thus preventing the reuse of a private transaction.

[0176] Step 405: Generate the authorization signature SpendAuthSig for the transaction according to the temporary address Taddress, and package the transaction record record, proof π and signature and send them to the Erc20 contract with the temporary address Taddress;

[0177] Phase 2: Interaction between Erc20 contract and privacy transaction contract

[0178] Step 406: After receiving the packaged transaction, the Erc20 contract needs to verify the correctness of the signature and then call the 0xHiddenTransfer privacy contract address to verify the proof π;

[0179] Step 407, the 0xHiddenTransfer privacy contract verifies the legitimacy of the transaction record using the halo2 verification algorithm v=Verify(pp,s,π), and returns the result v to the Erc20 contract. If the verification passes, the blockchain node will put all uid_1, uid_2,..., uid_n into the UID set on the chain, indicating that these transactions have been used;

[0180] Step 408, Erc20 contract receives the verification result v. If the verification is successful, the account balance corresponding to the 0xBob address is increased by 100, and the total account balance of the 0xHiddenTransfer contract is reduced by 100; Alice locally reduces her privacy account by 100 yuan. It should be noted that the total account balance of the 0xHiddenTransfer contract is reduced by 100, and only Alice knows that Alice's privacy account is reduced by 100 yuan, and other nodes cannot know it.

[0181] Phase 3: Bob obtains transaction information

[0182] Step 409: After Bob checks the transaction record and finds the receiving address 0xBob, he saves the information locally and increases the amount by 100 locally.

[0183] The third case is introduced below: the address of the transaction initiator participating in the transaction is a private address, and the address of the transaction recipient participating in the transaction is a private address.

[0184] The transaction amount information is obtained by encrypting the transaction amount by the transaction initiator; the first proof information is generated by the transaction initiator based on at least one historical private transaction; the total amount in the historical private transactions is not less than the transaction amount; the second proof information is generated by encrypting the private transaction based on the key derived by the transaction initiator through the private address of the transaction recipient; the private transaction includes the transaction amount and the derived address; the derived address is derived by the transaction initiator based on the private address of the transaction recipient.

[0185] The historical privacy transaction also includes a derived address, a random seed, and a random identifier for identifying the privacy transaction; the first proof information is generated by the transaction initiator based on at least one historical privacy transaction, including: generating a commitment for each historical privacy transaction based on the random seed of each historical privacy transaction; generating a usage identifier for each historical privacy transaction based on the random identifier of each historical privacy transaction and the commitment of each historical privacy transaction, and the usage identifier is used to characterize whether the historical privacy transaction has been used; the first proof information is a usage identifier for at least one historical privacy transaction.

[0186] The privacy transaction also includes a random seed, and the transaction record also includes a commitment to the privacy transaction, which is generated by the random seed and the privacy transaction; the transaction record is saved in the transaction record set of the blockchain, including: saving the commitment record in the transaction record of the privacy transaction in the commitment Merkle tree in the transaction record set of the blockchain; putting the usage identifier of at least one historical privacy transaction into the used identifier set in the transaction record set on the chain.

[0187] The private transaction also includes a random identifier for identifying the private transaction; after the transaction recipient obtains the transaction record from the transaction record set, after decrypting the second proof information in the transaction record and determining that the random identifier in the decryption result is legal, the account amount indicated by the private address of the transaction recipient is increased locally by the transaction amount.

[0188] For example, the transaction recipient Alice uses a private address to transfer 100 yuan to Bob's private address. Figure 5The privacy transaction method flow chart shown in the figure also includes transparent contracts and privacy transaction contracts in the transaction process. The transparent contract Erc20 and the privacy transaction contract 0xHiddenTransfer are used to illustrate the above transaction process. It should be noted that the address of the Erc20 transparent account smart contract on the blockchain is 0xErc20. The contract stores the addresses of each user including Alice and Bob and the corresponding public transparent account amounts, and also stores 0xHiddenTransfer and its corresponding total privacy account amount. The blockchain node saves a commitment Merkle tree CMT and a used identifier set UID on the blockchain. The transaction process specifically includes the following steps:

[0189] Phase 1: Alice calls the private key sk_a corresponding to the privacy address zAlice to generate a zero-knowledge proof transfer request.

[0190] Step 501: Alice obtains Bob's private address zBob offline in some way, and derives a derived address (d^b, pk_d^b) based on the address. Each private transaction will derive a one-time address for this transaction based on the recipient's address in order to enhance privacy.

[0191] Step 502, Alice searches for n private transactions in which other people previously transferred money to Alice's private address locally, and represents these transactions as ptx_a-1, ptx_a-2....ptx_a-n, where ptx_a-i: (d^ai, pk_d^ai, v_i, p_a-i, \psi_a-i, rcm_a-i), i = 1, 2,..., n; transactions with a total amount m equal to 100 need to be collected from n private transactions, represented as m = m_1 + m_2 +...m_n. Alice calculates the used identifier uid_i = DeriveNullifiernk (p_a-i, \psi_a-i, cm_a-i) of each ptx_a-i, where DeriveNullifiernk is a random identifier generation algorithm, and cm_a is the commitment PTXCommit (ptx_a-i) of ptx_a-i;

[0192] Step 503, Alice generates a private transaction ptx_b:(d^b,pk_d^b,m,p_b,\psi_b,rcm_b) to send to Bob based on the transfer amount 100 and the generated derived address of Bob (d^b,pk_d^b), where m represents the amount 100, p_b and \psi_b are random identifiers of this transaction; rcm_b is the random seed used to generate the commitment of this transaction. Alice uses the commitment algorithm to calculate the commitment cm_b=PTXCommit(ptx_b) of ptx_b based on the random seed rcm_b, and uses Bob's private address zBob and the randomly generated auxiliary information enc_info to calculate the key symKey_b, and uses the key to symmetric encrypt ptx_b, and the ciphertext is enc(ptx_b);

[0193] Step 504, Alice uses the Peserdon Commitment Algorithm to calculate the Peserdon Commitment CV of the amount 100, and inputs the above information to generate a transaction record record = (cv, uid_1, uid_2, ..., uid_n, cm_b, enc(ptx_b), enc_info), and uses the zk-snarks algorithm halo2 to generate the proof of the record π = Prove(pp, s, record), where s contains CMT and UID.

[0194] Step 505: Alice derives a temporary address Taddress based on zAlice's private key sk_a, and generates a signature SpendAuthSig for the transaction with the temporary address. Alice packages the transaction record record, π and signature and sends them to the 0xHiddenTransfer privacy contract;

[0195] Phase 2: 0xHiddenTransfer privacy contract verifies zkp

[0196] Step 506, the 0xHiddenTransfer privacy contract verifies the correctness of the authorization signature SpendAuthSig and the legitimacy of the transaction record v=Verify(pp,s,π). If the verification passes, uid_1, uid_2,..., uid_n are put into the UID set on the chain, and cm_b is put into CMT;

[0197] Phase 3: Bob obtains transaction information

[0198] Step 507, Bob generates the key symKey_b based on his private address zBob and the decryption information enc_info in the transaction record record, and tries to decrypt enc(ptx_b) to obtain the transaction information ptx_b, then saves the transaction information locally and updates his private amount by adding 100. In this step, in fact, all nodes will try to decrypt the encrypted ciphertext enc(ptx_b), but only Bob can successfully decrypt it.

[0199] like Figure 6 As shown, a privacy transaction device 600 is provided for an embodiment of the present application, including:

[0200] The acquisition module 601 is used to acquire the transaction record and transaction proof sent by the transaction initiator, wherein the transaction record is determined by the transaction initiator based on the private transaction, and the transaction record includes transaction amount information, first proof information pointing to the transaction initiator, and second proof information pointing to the transaction recipient; wherein the address of at least one of the transaction initiator and the transaction recipient participating in the transaction is a private address; the transaction proof is a zero-knowledge proof generated based on the transaction record, and the transaction proof is used to prove the legitimacy of the private transaction;

[0201] Processing module 602 is used to verify the zero-knowledge proof of the transaction proof by calling the privacy transaction contract; if the verification is successful, the transaction record is saved in the transaction record set of the blockchain and the total account amount of the privacy transaction contract is updated.

[0202] This application uses zero-knowledge proof technology to selectively hide all transaction information, ensuring that sensitive transaction details are not leaked, effectively protecting the privacy of users, while ensuring the legality of transactions and maintaining the integrity and credibility of the system. It also allows the interaction between the privacy pool and the transparent pool through smart contracts, realizing the seamless conversion of privacy funds and transparent funds, providing users with more choices, and being able to flexibly switch transaction modes according to different scenarios, enhancing the compatibility and practicality of the blockchain transaction system.

[0203] Optionally, the acquisition module 601 is specifically used for:

[0204] The address of the transaction initiator participating in the transaction is a transparent address, and the address of the transaction recipient participating in the transaction is a private address.

[0205] The transaction amount information is the transaction amount;

[0206] The first proof information is the transparent address of the transaction initiator;

[0207] The second proof information is generated by encrypting the private transaction based on the key derived by the transaction initiator through the private address of the transaction recipient; the private transaction includes the transaction amount and the derived address; the derived address is derived by the transaction initiator based on the private address of the transaction recipient.

[0208] Optionally, the acquisition module 601 is specifically used for:

[0209] Obtaining a transaction signature for the transaction record sent by the transaction initiator;

[0210] Determine the legitimacy of the transaction signature by calling the transparent transaction contract;

[0211] The updating of the total account amount of the privacy transaction contract includes:

[0212] By calling the transparent transaction contract, the account balance indicated by the transparent address of the transaction initiator is reduced by the transaction amount, and the total account balance of the privacy transaction contract is increased by the transaction amount.

[0213] Optionally, the acquisition module 601 is specifically used for:

[0214] The private transaction further includes a random seed, and the transaction record further includes a commitment of the private transaction, where the commitment of the private transaction is generated by the random seed and the private transaction;

[0215] The step of saving the transaction record to a transaction record set of the blockchain includes:

[0216] The commitment record in the transaction record of the private transaction is saved in the commitment Merkle tree in the transaction record set of the blockchain.

[0217] Optionally, the acquisition module 601 is specifically used for:

[0218] The private transaction also includes a random identifier for identifying the private transaction;

[0219] The transaction recipient is used to obtain the transaction record from the transaction record set, decrypt the second proof information in the transaction record and determine that the random identifier in the decryption result is legal, and then locally increase the account amount indicated by the private address of the transaction recipient by the transaction amount.

[0220] Optionally, the processing module 602 is used to:

[0221] The transaction proof is a zero-knowledge proof generated based on the transaction record, including:

[0222] The transaction proof is generated through the public parameters of the zero-knowledge proof, the commitment of the latest private transaction in the Merkle tree at the time of initiation of the private transaction, and the transaction record.

[0223] Optionally, the acquisition module 601 is used to:

[0224] The address of the transaction initiator participating in the transaction is a private address, and the address of the transaction recipient participating in the transaction is a transparent address.

[0225] The transaction amount information is the transaction amount;

[0226] The first proof information is generated by the transaction initiator according to at least one historical private transaction; the total amount in the historical private transaction is not less than the transaction amount;

[0227] The second proof information is the transparent address of the transaction recipient;

[0228] The transaction record and the transaction proof are sent by the transaction initiator through a temporary address, and the temporary address is generated based on the private key of the transaction initiator.

[0229] Optionally, the processing module 602 is used to:

[0230] The historical privacy transaction also includes a derived address, a random seed, and a random identifier for identifying the historical privacy transaction;

[0231] The first proof information is generated by the transaction initiator according to at least one historical private transaction, and includes:

[0232] Generate a commitment for each historical private transaction based on the random seed of each historical private transaction;

[0233] Based on the random identifier of each historical privacy transaction and the commitment of each historical privacy transaction, generate a usage identifier for each historical privacy transaction, where the usage identifier is used to indicate whether the historical privacy transaction has been used;

[0234] The first proof information is a usage identifier of the at least one historical private transaction.

[0235] Optionally, the processing module 602 is used to:

[0236] The usage identifier of the at least one historical privacy transaction is placed into the used identifier set in the transaction record set on the chain.

[0237] Optionally, the processing module 602 is used to:

[0238] Reduce the total account balance of the private transaction contract by the transaction amount.

[0239] Optionally, the processing module 602 is used to:

[0240] The transaction recipient is used to obtain the transaction record from the transaction record set, determine that the transparent address exists in the transaction record, and locally reduce the account amount indicated by the transparent address of the transaction recipient by the transaction amount.

[0241] Optionally, the acquisition module 601 is used to:

[0242] The address of the transaction initiator participating in the transaction is a private address, and the address of the transaction recipient participating in the transaction is a private address.

[0243] The transaction amount information is obtained by encrypting the transaction amount by the transaction initiator;

[0244] The first proof information is generated by the transaction initiator according to at least one historical private transaction; the total amount in the historical private transaction is not less than the transaction amount;

[0245] The second proof information is generated by encrypting the private transaction based on the key derived by the transaction initiator through the private address of the transaction recipient; the private transaction includes the transaction amount and the derived address; the derived address is derived by the transaction initiator based on the private address of the transaction recipient.

[0246] Optionally, the acquisition module 601 is used to:

[0247] The historical privacy transaction also includes a derived address, a random seed, and a random identifier for identifying the privacy transaction;

[0248] The first proof information is generated by the transaction initiator according to at least one historical private transaction, and includes:

[0249] Generate a commitment for each historical private transaction based on the random seed of each historical private transaction;

[0250] Based on the random identifier of each historical privacy transaction and the commitment of each historical privacy transaction, generate a usage identifier for each historical privacy transaction, where the usage identifier is used to indicate whether the historical privacy transaction has been used;

[0251] The first proof information is a usage identifier of the at least one historical private transaction.

[0252] Optionally, the acquisition module 601 is used to:

[0253] The private transaction further includes a random seed, and the transaction record further includes a commitment of the private transaction, where the commitment of the private transaction is generated by the random seed and the private transaction;

[0254] The step of saving the transaction record to a transaction record set of the blockchain includes:

[0255] Saving the commitment record in the transaction record of the private transaction into a commitment Merkle tree in the transaction record set of the blockchain;

[0256] The usage identifier of the at least one historical privacy transaction is placed into the used identifier set in the transaction record set on the chain.

[0257] Optionally, the acquisition module 601 is used to:

[0258] The private transaction also includes a random identifier for identifying the private transaction;

[0259] The transaction recipient is used to obtain the transaction record from the transaction record set, decrypt the second proof information in the transaction record and determine that the random identifier in the decryption result is legal, and then locally increase the account amount indicated by the private address of the transaction recipient by the transaction amount.

[0260] Based on the same technical concept, the embodiment of the present application provides a computer device, the computer device is as follows: Figure 7 As shown, it includes at least one processor 701 and a memory 702 connected to the at least one processor. The specific connection medium between the processor 701 and the memory 702 is not limited in the embodiment of the present application. Figure 7 For example, the processor 701 and the memory 702 are connected via a bus. The bus can be divided into an address bus, a data bus, a control bus, etc.

[0261] In the embodiment of the present application, the memory 702 stores instructions that can be executed by at least one processor 701. The at least one processor 701 can execute the steps of the above-mentioned privacy transaction method by executing the instructions stored in the memory 702.

[0262] Among them, the processor 701 is the control center of the computer device, which can use various interfaces and lines to connect various parts of the computer device, and by running or executing instructions stored in the memory 702 and calling the data stored in the memory 702, it is used to allow the proof information to be verified by everyone during the privacy transaction, while ensuring that the privacy transaction information is not leaked. Optionally, the processor 701 may include one or more processing units, and the processor 701 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 701. In some embodiments, the processor 701 and the memory 702 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on independent chips.

[0263] Processor 701 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware processor for execution, or can be executed by a combination of hardware and software modules in the processor.

[0264] The memory 702 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 702 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 702 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer device, but is not limited thereto. The memory 702 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0265] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program that can be executed by a computer device. When the program runs on the computer device, the computer device executes the steps of the above-mentioned privacy transaction method.

[0266] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0267] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0268] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0269] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0270] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A privacy transaction method, characterized in that: The method is applicable to a blockchain node, including: Obtaining a transaction record and a transaction proof sent by the transaction initiator, wherein the transaction record is determined by the transaction initiator based on the private transaction, and includes transaction amount information, first proof information pointing to the transaction initiator, and second proof information pointing to the transaction recipient; wherein the address of at least one of the transaction initiator and the transaction recipient participating in the transaction is a private address; the transaction proof is a zero-knowledge proof generated based on the transaction record, and the transaction proof is used to prove the legitimacy of the private transaction; The transaction proof is verified by calling the privacy transaction contract with zero-knowledge proof; if the verification passes, the transaction record is saved in the transaction record set of the blockchain and the total account amount of the privacy transaction contract is updated.

2. The method according to claim 1, characterized in that The address of the transaction initiator participating in the transaction is a transparent address, and the address of the transaction recipient participating in the transaction is a private address. The transaction amount information is the transaction amount; The first proof information is the transparent address of the transaction initiator; The second proof information is generated by encrypting the private transaction based on the key derived by the transaction initiator through the private address of the transaction recipient; the private transaction includes the transaction amount and the derived address; the derived address is derived by the transaction initiator based on the private address of the transaction recipient.

3. The method according to claim 2, characterized in that Before verifying the zero-knowledge proof of the transaction proof by calling the privacy transaction contract, it also includes: Obtaining a transaction signature for the transaction record sent by the transaction initiator; Determine the legitimacy of the transaction signature by calling the transparent transaction contract; The updating of the total account amount of the privacy transaction contract includes: By calling the transparent transaction contract, the account balance indicated by the transparent address of the transaction initiator is reduced by the transaction amount, and the total account balance of the privacy transaction contract is increased by the transaction amount.

4. The method according to claim 2, characterized in that The private transaction further includes a random seed, and the transaction record further includes a commitment of the private transaction, where the commitment of the private transaction is generated by the random seed and the private transaction; The step of saving the transaction record to a transaction record set of the blockchain includes: The commitment record in the transaction record of the private transaction is saved in the commitment Merkle tree in the transaction record set of the blockchain.

5. The method according to claim 2, characterized in that The private transaction also includes a random identifier for identifying the private transaction; The transaction recipient is used to obtain the transaction record from the transaction record set, decrypt the second proof information in the transaction record and determine that the random identifier in the decryption result is legal, and then locally increase the account amount indicated by the private address of the transaction recipient by the transaction amount.

6. The method according to claim 2, characterized in that The transaction proof is a zero-knowledge proof generated based on the transaction record, including: The transaction proof is generated through the public parameters of the zero-knowledge proof, the commitment of the latest private transaction in the Merkle tree at the time of initiation of the private transaction, and the transaction record.

7. The method according to claim 1, characterized in that The address of the transaction initiator participating in the transaction is a private address, and the address of the transaction recipient participating in the transaction is a transparent address. The transaction amount information is the transaction amount; The first proof information is generated by the transaction initiator according to at least one historical private transaction; the total amount in the historical private transaction is not less than the transaction amount; The second proof information is the transparent address of the transaction recipient; The transaction record and the transaction proof are sent by the transaction initiator through a temporary address, and the temporary address is generated based on the private key of the transaction initiator.

8. The method according to claim 7, characterized in that The historical privacy transaction also includes a derived address, a random seed, and a random identifier for identifying the historical privacy transaction; The first proof information is generated by the transaction initiator according to at least one historical private transaction, and includes: Generate a commitment for each historical private transaction based on the random seed of each historical private transaction; Based on the random identifier of each historical privacy transaction and the commitment of each historical privacy transaction, generate a usage identifier for each historical privacy transaction, where the usage identifier is used to indicate whether the historical privacy transaction has been used; The first proof information is a usage identifier of the at least one historical private transaction.

9. The method according to claim 8, characterized in that The step of saving the transaction record to a transaction record set of the blockchain includes: The usage identifier of the at least one historical privacy transaction is placed into the used identifier set in the transaction record set on the chain.

10. The method according to claim 7, characterized in that The updating of the total account amount of the privacy transaction contract includes: Reduce the total account balance of the privacy transaction contract by the transaction amount.

11. The method according to claim 7, characterized in that Also includes: The transaction recipient is used to obtain the transaction record from the transaction record set, determine that the transparent address exists in the transaction record, and locally reduce the account amount indicated by the transparent address of the transaction recipient by the transaction amount.

12. The method according to claim 1, characterized in that The address of the transaction initiator participating in the transaction is a private address, and the address of the transaction recipient participating in the transaction is a private address. The transaction amount information is obtained by encrypting the transaction amount by the transaction initiator; The first proof information is generated by the transaction initiator according to at least one historical private transaction; the total amount in the historical private transaction is not less than the transaction amount; The second proof information is generated by encrypting the private transaction based on the key derived by the transaction initiator through the private address of the transaction recipient; the private transaction includes the transaction amount and the derived address; the derived address is derived by the transaction initiator based on the private address of the transaction recipient.

13. The method according to claim 12, characterized in that The historical privacy transaction also includes a derived address, a random seed, and a random identifier for identifying the privacy transaction; The first proof information is generated by the transaction initiator according to at least one historical private transaction, and includes: Generate a commitment for each historical private transaction based on the random seed of each historical private transaction; Based on the random identifier of each historical privacy transaction and the commitment of each historical privacy transaction, generate a usage identifier for each historical privacy transaction, where the usage identifier is used to indicate whether the historical privacy transaction has been used; The first proof information is a usage identifier of the at least one historical private transaction.

14. The method according to claim 12, characterized in that The private transaction further includes a random seed, and the transaction record further includes a commitment of the private transaction, where the commitment of the private transaction is generated by the random seed and the private transaction; The step of saving the transaction record to a transaction record set of the blockchain includes: Saving the commitment record in the transaction record of the private transaction into a commitment Merkle tree in the transaction record set of the blockchain; The usage identifier of the at least one historical privacy transaction is placed into the used identifier set in the transaction record set on the chain.

15. The method according to claim 12, characterized in that The private transaction also includes a random identifier for identifying the private transaction; The transaction recipient is used to obtain the transaction record from the transaction record set, decrypt the second proof information in the transaction record and determine that the random identifier in the decryption result is legal, and then locally increase the account amount indicated by the private address of the transaction recipient by the transaction amount.

16. A private transaction device, characterized in that: include: An acquisition module is used to acquire a transaction record and a transaction proof sent by a transaction initiator, wherein the transaction record is determined by the transaction initiator based on a private transaction, and the transaction record includes transaction amount information, first proof information pointing to the transaction initiator, and second proof information pointing to the transaction recipient; wherein the address of at least one of the transaction initiator and the transaction recipient participating in the transaction is a private address; the transaction proof is a zero-knowledge proof generated based on the transaction record, and the transaction proof is used to prove the legitimacy of the private transaction; The processing module is used to verify the zero-knowledge proof of the transaction proof by calling the privacy transaction contract; if the verification is successful, the transaction record is saved in the transaction record set of the blockchain and the total account amount of the privacy transaction contract is updated.

17. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of any one of the methods of claims 1 to 15 are implemented.

18. A computer-readable storage medium, characterized in that: It stores a computer program executable by a computer device. When the program is run on the computer device, the computer device executes the steps of any method described in claims 1 to 15.

19. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of any method described in claims 1 to 15 are implemented.

Images