Privacy-protection multi-path crowd funding method under script-free chain

Abstract

The invention aims to provide a privacy-protection multi-path crowd funding method under a script-free chain. The method comprises the following steps: an authorization center generates public and private keys and secret shares according to crowd funding project information; the authorization center sends the public key and the secret share to each intentional investor; the intentional investor generates a ciphertext according to the secret share and the public key; and the project initiator unlocks the ciphertext according to the private key. According to the method, the problem of wormhole attack can be solved, and compared with the original HTLC, the method is safer; and the method can be realized only through ECDSA without special scripts, so that the compatibility of the method and the indistinguishability of on-chain transactions are ensured, and anonymity is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of cryptography, and in particular to a privacy-protected scriptless off-chain multi-path crowdfunding method. Background Art

[0002] Crowdfunding, as an emerging fund-raising method of "Internet + Finance", is based on the Internet platform and has great significance in promoting economic development. Investors make judgments and investments based on the relevant information released by the crowdfunding platform. As a third-party central institution, the platform helps connect investors and initiators, accelerating the cooperation between the two parties. However, the single management structure makes it easy for the platform to become a target of malicious attacks by hackers, which may lead to user data leakage, privacy infringement, and even fund theft. Once the platform encounters operating problems, bankruptcy, or improper internal operations, users' investments are likely to face serious losses. This emphasizes the need for decentralized crowdfunding platforms to provide a safer, transparent, and disintermediate crowdfunding experience to ensure that the rights and interests of users and project parties are effectively protected.

[0003] The decentralization and security of blockchain need to be guaranteed by consensus mechanism, and the structure of blockchain itself, such as block size, greatly limits the throughput and speed of its transactions, which is also called "scalability" in blockchain. It is precisely because Bitcoin transactions are processed by expensive distributed consensus protocols run between miners, which leads to limited transaction throughput while ensuring decentralization and security, making transaction confirmation very slow (Bitcoin can only conduct about 7 transactions per second), and it cannot be deeply popularized in actual applications. Payment channels are established between two parties, which forces the sender to establish a channel with every possible recipient, and the funds locked in the channel cannot be used elsewhere. The Payment Channel Network (PCN) provides a solution to this problem, making payments along the channel path in a multi-hop manner (consider PCN as a graph, where nodes are users and edges are payment channels), which completes the payment between any two nodes through path connection. Lightning Network is the most widely used and effective PCN, which uses hash time lock (HTLC) to complete a secure and privacy-preserving multi-hop payment protocol. However, this solution is expensive and takes a long time to pledge. Moreover, hash time lock requires special scripting language and cannot be compatible with all chains. It requires a large amount of data (about 5MB) to be exchanged between users on the payment path. And there are security risks in HTLC: 1. Wormhole attack, which allows attackers to steal fees from honest intermediaries on the same payment path; 2. Unlinkability or anonymity, which will expose the existence of malicious users in the complete path and cause transaction failure; 3. HTLC requires special scripting language construction, and transactions will be different from normal on-chain transactions. Summary of the invention

[0004] The purpose of the present invention is to provide a privacy-preserving scriptless off-chain multi-path crowdfunding method, which can solve the problem of wormhole attacks and is safer than the original HTLC; and only needs to be implemented through ECDSA, without the need for special scripts, thereby ensuring its compatibility and the indistinguishability of on-chain transactions and achieving anonymity.

[0005] A privacy-preserving scriptless off-chain multi-path crowdfunding method, including:

[0006] The authorization center generates public and private keys and secret shares based on the crowdfunding project information;

[0007] The authorization center sends the public key and the secret share to each potential investor;

[0008] The potential investor generates ciphertext based on the secret share and public key;

[0009] The project initiator unlocks the ciphertext based on the private key.

[0010] Preferably, the authorization center generates public and private keys and secret shares according to the crowdfunding project information, including:

[0011] The authorization center inputs the security parameter λ, outputs the public-private key pair (pk, sk) and publishes the public key pk, and selects x∈Z p And calculate h = g x , private key sk = x, public key p = (G, p, g, h), where G is a cyclic group of order prime number p, and g is the generator.

[0012] Preferably, the authorization center sends the public key and the secret share to each potential investor including:

[0013] The authorization center sets the threshold (t,n), inputs the private key sk and the public parameter pp, and outputs the key share sk i and the corresponding commitment coefficient c for verification i , where i = 1,…,n;

[0014] Randomly select t different non-zero elements a0, a1, ... a in the finite field GF(p) t-1 ;

[0015] Construct a t-1 order polynomial: f(x) = a0+a1x+...a t-1 x t-1 , where a0 = x, i.e. f(0) = x, calculate the secret share s i =f(x i ) and commitment

[0016] Preferably, the potential investor generates a ciphertext based on the secret share and the public key, including:

[0017] The sender uses the public key pk and parameters generated by the authorization center Output ciphertext K, randomly select r∈Zp, and calculate the ciphertext K of message m i =(c1,c2)=(g r ,m·h r ).

[0018] Preferably, the project initiator unlocks the ciphertext according to the private key including:

[0019] Input from potential investor S i The key share sk i and the corresponding commitment coefficient c i Verify the correctness of the shared shares, that is, verify the equation If it is correct, output 1, otherwise output 0;

[0020] Input the key share sk received from the intended investor i , when the number of shares received is greater than t, the key sk is reconstructed. For any t points (xi,si), construct

[0021] Run the reconstructed key sk on the ciphertext K i Decrypt and calculate the path parameters

[0022] Preferably, after the project initiator unlocks the ciphertext according to the private key, the intended investor also makes payment, specifically:

[0023] The anonymous multi-hop lock mechanism based on ECDSA is used to complete the multi-hop payment with the project initiator and the intended investor as the path endpoint nodes:

[0024] Generate the key in the payment path process;

[0025] Generate the parameters required for all nodes in the multi-hop payment path;

[0026] Lock the ciphertext sent by the potential investor;

[0027] Unlock the ciphertext sent by the potential investor.

[0028] Preferably, the key in the process of generating the payment path includes:

[0029] Random Selection Calculate Q = x i ·G, where G is a cyclic group of order prime number q, Z q is a subset of G, where Q and x i They are the public and private keys of ECDSA (ski ,pk i ); Randomly select As the private key sk i =x i share, making satisfy

[0030] Generate a public-private key pair right Encrypted to get ciphertext c i ;

[0031] make

[0032] (SK i ,PK i ) is returned to user U i , (SK i+1 ,PK i ) is returned to user U i+1 .

[0033] Preferably, the parameters required for generating all nodes in the multi-hop payment path include:

[0034] Randomly select n values:

[0035] Calculation yields Y0=y0·G,Y i =Y i-1 +y i ·G,i∈[1,n-1],

[0036] set up The value of

[0037] Will Return to user U0, Send to U n ,Will Send to U i , where i∈[1,n-1];

[0038] UserU i By proving that π i Verify Is it correct, among which

[0039] Preferably, the ciphertext sent by the locking potential investor includes:

[0040] For User U i , randomly selected Calculation shows that R0 = r0·G, R0′ = r0·Y i , generate proof π0 = Prove NIZK (st0,r0), where

[0041] For User U i+1 , randomly selected Calculation shows that R1 = r1·G, R1′ = r1·Y i , generate proof π1 = Prove NIZK (st1,r1), Generate Commit(dcom,com)←Commit(λ,(R1,R1′,π1));

[0042] UserU i Send (R0, R0′, π0) to user U i+1 , user U i+1 Send com to U i ;

[0043] UserU i+1 After verifying that π0 is correct: calculate the elliptic curve point R = (r x ,r y )=r1·R0′, randomly selected Hash the message m to get H(m), and use Paillier's homomorphic property to calculate the ciphertext Send (dcom, R1, R1′, π1, c′) to user U i ;

[0044] UserU i After verifying the commitment and proving that π1 is correct: decrypt the ciphertext c′ to obtain Calculate the elliptic curve point R = (r x ,r y )=r1·R0′, verify that s·R1 and If the verification is successful, then calculate And s i ′Send to user U i+1 , q is a random prime number;

[0045] UserU i+1 Verifications i ′·r1·R0′ and Is it consistent?

[0046] Verification is successful, let r i =r x , return To user U i ,return To user U i+1 .

[0047] Preferably, the ciphertext sent by the unlocking intended investor includes:

[0048] Enter the open key k i and Release the lock and get the opening key k of the previous jump i-1 ;

[0049] For User U n , calculate k n-1 =(r n-1 ,s n-1 ),in

[0050] For User U i ,i∈[1,n-1]: calculate k i-1 =(r i-1 ,s i-1 ),in

[0051] The beneficial effects of the present invention are: 1. The present invention adopts an anonymous multi-hop lock mechanism based on ECDSA to complete multi-hop payment based on the PCN path method, avoiding the problem of wormhole attack in multi-hop payment, while ensuring script compatibility so that transactions are indistinguishable on the chain; 2. The present invention introduces a threshold encryption scheme to meet the threshold atomicity to achieve practical application in crowdfunding scenarios, that is, for the entire crowdfunding transaction, if the investment in the crowdfunding transaction reaches the bottom line funding target, the recipient will receive the investment funds and count it as a crowdfunding success. If the investment funds do not meet the required requirements, all funds will be returned to each investor, and the recipient will not receive any transfers, which is a crowdfunding failure. Under this premise, if there is a situation where an intermediate node refuses to pay (for example, disconnection) in the multi-hop payment path constructed by the investor and the recipient, it will not affect the result of the entire crowdfunding transaction; 3. The investment amount participating in the crowdfunding of the present invention is a fixed value, so that the transfer between each path cannot be distinguished by the amount, and the intermediate node cannot determine which path the transaction belongs to, providing a certain degree of unlinkability; the scheme introduces the key share secretly shared by the authorization center to avoid collusion between crowdfunding investors to secretly deceive the recipient. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0053] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0054] Figure 1 This is a flow chart of a privacy-preserving scriptless off-chain multi-path crowdfunding method of the present invention;

[0055] Figure 2 This is a schematic diagram of the anonymous multi-hop lock mechanism of the present invention;

[0056] Figure 3 Creating a flow chart for the transaction path of the present invention;

[0057] Figure 4 A schematic diagram showing a comparison of transaction fees of the present invention;

[0058] Figure 5 This is a schematic diagram of the structure of a privacy-protected scriptless off-chain multi-path crowdfunding system of the present invention. DETAILED DESCRIPTION

[0059] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0060] It should be noted that all directional indications in the embodiments of the present invention (such as up, down, left, right, front, back, etc.) are only used to explain the relative position relationship, movement status, etc. between the components under a certain specific posture (as shown in the accompanying drawings). If the specific posture changes, the directional indication will also change accordingly.

[0061] In addition, the descriptions of "first", "second", etc. in the present invention are only used for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0062] In the current environment where "Internet + Application" is becoming increasingly popular, financial technology is constantly improving, and blockchain

[0063] The combination of blockchain and crowdfunding not only solves the high threshold and low efficiency of the traditional crowdfunding financing model, but also provides more reliable guarantees for transactions compared to centralized third-party platforms. Taking ICO, the most widely used financing method of blockchain today, as an example, the actual functional requirements in crowdfunding are briefly described. ICO operates in the form of smart contracts, which will set a minimum limit for crowdfunding funds for the project initiator. If the minimum funding target is not reached within a certain period of time, the fundraising will end in failure, and the smart contract will automatically execute the relevant code to return the investor's funds; if the investment exceeds the bottom line, the goal is achieved, and the smart contract will automatically stop the deployment to complete the transfer and end subsequent transactions. However, this scenario still needs to be improved. For example, if the initiator is liquidated during the crowdfunding process, the investors who have already participated in it will not be able to recover their funds. In addition, the emergence of the blockchain ICO project The DAO in 2016 set off a huge upsurge. The community members are completely autonomous and run through smart contracts, becoming the largest crowdfunding project at the time. In less than a month, the amount of financing reached 160 million US dollars, and announced to the world the arrival of the era of smart contracts. However, only one month later, hackers attacked by calling the "recursive call" vulnerability on The DAO, which not only caused huge property losses, but also directly affected the ecology of Ethereum due to the large size of the project. Based on this, more and more research tends to use restricted scripting languages ​​to complete various applications. These blockchains that only support restricted scripting languages ​​have their irreplaceable advantages: higher security, simple design and use, and lower maintenance costs.

[0064] Lightning Network is the most widely used and effective PCN, which uses hash time lock (HTLC) to complete a secure and privacy-preserving multi-hop payment protocol. However, this solution is expensive and takes a long time to pledge. Moreover, hash time lock requires special scripting language and cannot be compatible with all chains. It requires a large amount of data (about 5MB) to be exchanged between users on the payment path. And there are security risks in HTLC: 1. Wormhole attack, which allows attackers to steal fees from honest intermediaries on the same payment path; 2. Unlinkability or anonymity, which will expose the existence of malicious users in the complete path and cause transaction failure; 3. HTLC requires special scripting language construction, and transactions will be different from normal on-chain transactions.

[0065] The present invention adopts an anonymous multi-hop lock mechanism based on ECDSA to complete multi-hop payment based on the PCN path mode, avoiding the problem of wormhole attack in multi-hop payment, and ensuring script compatibility so that transactions are indistinguishable on the chain; the present invention introduces a threshold encryption scheme to meet the threshold atomicity to realize the practical application of crowdfunding scenarios, that is, for the entire crowdfunding transaction, if the investment of the crowdfunding transaction reaches the bottom line amount of funds, the recipient will receive the investment funds and count as crowdfunding success. If the investment funds do not meet the required requirements, the funds are all returned to each investor, and the recipient will not receive any transfer, which is a crowdfunding failure. Under this premise, if there is a situation where an intermediate node refuses to pay (such as disconnection) in the multi-hop payment path constructed by the investor and the recipient, it does not affect the result of the entire crowdfunding transaction; the investment amount participating in the crowdfunding of the present invention is a fixed value, so that the transfer between each path cannot be distinguished by the amount, so that the intermediate node cannot determine which path this transaction specifically belongs to, providing a certain degree of unlinkability; the scheme introduces the key share of the secret sharing of the authorization center to avoid collusion between crowdfunding investors to secretly deceive the recipient.

[0066] Example 1

[0067] A privacy-preserving scriptless off-chain multi-path crowdfunding method, reference Figure 1 and Figure 3 ,include:

[0068] S100, the authorization center generates public and private keys and secret shares based on the crowdfunding project information;

[0069] S200, the authorization center sends the public key and secret share to each potential investor;

[0070] S300, the potential investor generates a ciphertext based on the secret share and the public key;

[0071] S400, the project initiator unlocks the ciphertext according to the private key.

[0072] The present invention introduces an authorization center as a trusted third party and uses threshold decryption to implement a multi-path tree structure off-chain for crowdfunding transactions, thereby preventing possible dishonest behavior by the sender and the receiver. In the present invention, the crowdfunding initiator R initiates a crowdfunding project through the system platform. In addition to the description of the project information, the information released also includes the funds required for the project. The authorization center receives the project information through the system platform and uses a verifiable secret sharing scheme to generate a key (pk, sk) = KGen and a secret share (s i ,c i )=KeyShare. Interested investors connect to the project through the system platform, and the authorization center automatically allocates and sends the secret share s to them. iWith the public key pk. Within the time specified by the system, when the recipient receives shares from more than t investors, the complete private key sk=Combine can be reconstructed; if the crowdfunding requirement is not met within the time specified by the system and the private key cannot be reconstructed, the process will end directly and no further operations will be performed.

[0073] Preferably, S100, the authorization center generates public and private keys and secret shares according to the crowdfunding project information, including:

[0074] The authorization center inputs the security parameter λ, outputs the public-private key pair (pk, sk) and publishes the public key pk, and selects x∈Z p And calculate h = g x , private key sk = x, public key p = (G, p, g, h), where G is a cyclic group of order prime number p, and g is the generator.

[0075] Preferably, S200, the authorization center sends the public key and the secret share to each potential investor, including:

[0076] The authorization center sets the threshold (t,n), inputs the private key sk and the public parameter pp, and outputs the key share sk i and the corresponding commitment coefficient c for verification i , where i = 1,…,n;

[0077] Randomly select t different non-zero elements a0, a1, ... a in the finite field GF(p) t-1 ;

[0078] Construct a t-1 order polynomial: f(x) = a0+a1x+...a t-1 x t-1 , where a0 = x, i.e. f(0) = x, calculate the secret share s i =f(x i ) and commitment

[0079] Preferably, in S300, the potential investor generates a ciphertext according to the secret share and the public key, including:

[0080] The sender uses the public key pk and parameters generated by the authorization center Output ciphertext K i , randomly select r∈Zp, and calculate the ciphertext K of message m i =(c1,c2)=(g r ,m·h r ).

[0081] Preferably, in S400, the project initiator unlocks the ciphertext according to the private key, including:

[0082] Input from potential investor S iThe key share sk i and the corresponding commitment coefficient c i Verify the correctness of the shared shares, that is, verify the equation If it is correct, output 1, otherwise output 0;

[0083] Input the key share sk received from the intended investor i , when the number of shares received is greater than t, the key sk is reconstructed. For any t points (xi,si), construct

[0084] Run the reconstructed key sk on the ciphertext K i Decrypt and calculate the path parameters

[0085] For a multi-hop payment path Ψ i , the investor, as the sender of this path, calls U0 The algorithm generates parameters and sends them to each node in the path. U0 uses the public key pk published by the authorization center to authenticate the recipient U n The parameters are encrypted to obtain the ciphertext K i = Enc, and also transfers its own secret share s i The receiver asks the authorization center for the commitment coefficient c i , the sender's share is verified to be correct through the verification algorithm Verify. After verification, the path Ψ i The adjacent nodes on the left and right are running Algorithms and Algorithm construction path.

[0086] Preferably, reference Figure 2 , S400, after the project initiator unlocks the ciphertext according to the private key, it also includes S500, the intended investor makes payment, specifically:

[0087] The anonymous multi-hop lock mechanism based on ECDSA is used to complete the multi-hop payment with the project initiator and the intended investor as the path endpoint nodes:

[0088] S510, generating a key in the payment path process;

[0089] S520, generating the required parameters of all nodes in the multi-hop payment path;

[0090] S530, locking the ciphertext sent by the potential investor;

[0091] S540, unlocking the ciphertext sent by the potential investor.

[0092] The present invention introduces an anonymous multi-hop lock mechanism based on ECDSA to complete multi-hop payment with the receiver and the sender as the path endpoint nodes. i , the corresponding sender S i (i.e., U0 in the path) is the crowdfunding investor; the corresponding receiver R (i.e., U n ) is the initiator of the crowdfunding project. For the convenience of description, this section will take any of the paths {Ψ i Taking i∈[1,n] as an example, the construction and transaction process of its multi-hop payment path is introduced in detail. The process is consistent for the multi-hop payment paths of other investors.

[0093] The receiver uses the reconstructed private key sk to encrypt all established path ciphertexts K i Decrypt to get unlock parameters So as to obtain funds to complete the crowdfunding transaction. For each unlocked parameter The path i , each intermediate node in the path (excluding the receiver and sender) runs The algorithm releases the lock to complete the multi-hop payment in the path.

[0094] The key generation algorithm is composed of two adjacent nodes U in the path. i with U i+1 Run together, input security parameter λ, and output the public key PK of both parties i With their respective private keys SK i and SK i+1 , where (SK i ,PK i ) is returned to user U i , (SK i+1 ,PK i ) is returned to user U i+1 .

[0095] Preferably, S510, generating a key in the payment path process includes:

[0096] Random Selection Calculate Q = x i ·G, where G is a cyclic group of order prime number q, Z q is a subset of G, where Q and x i They are the public and private keys of ECDSA (sk i ,pk i ); Randomly select As the private key sk i =x i share, making satisfy

[0097] Generate a public-private key pair right Encrypted to get ciphertext c i ;

[0098] make

[0099] (SK i ,PK i ) is returned to user U i , (SK i+1 ,PK i ) is returned to user U i+1 .

[0100] The initialization algorithm is run by user U0 to generate the parameters required for multi-hop payment for all nodes, where for user U i∈[0,n] i return In addition, user U n You will also receive an additional parameter k n The specific process is as follows:

[0101] Preferably, S520, generating the parameters required for all nodes in the multi-hop payment path includes:

[0102] Randomly select n values:

[0103] Calculation yields Y0=y0·G,Y i =Y i-1 +y i ·G,i∈[1,n-1],

[0104] set up The value of

[0105] Will Return to user U0, Send to U n ,Will Send to U i , where i∈[1,n-1];

[0106] UserU i By proving that π i Verify Is it correct, among which

[0107] The locking algorithm consists of two adjacent users Ui with U i+1 Run together, input and Output To user U i , To user U i+1 , where l i Represents a lock. The specific process is as follows:

[0108] Preferably, S530, locking the ciphertext sent by the potential investor includes:

[0109] For User U i , randomly selected Calculation shows that R0 = r0·G, R0′ = r0·Y i , generate proof π0 = Prove NIZK (st0,r0), where

[0110] For User U i+1 , randomly selected Calculation shows that R1 = r1·G, R1′ = r1·Y i , generate proof π1 = Prove NIZK (st1,r1), Generate Commit(dcom,com)←Commit(λ,(R1,R1′,π1));

[0111] UserU i Send (R0, R0′, π0) to user U i+1 , user U i+1 Send com to U i ;

[0112] UserU i+1 After verifying that π0 is correct: calculate the elliptic curve point R = (r x ,r y )=r1·R0′, randomly selected Hash the message m to get H(m), and use Paillier's homomorphic property to calculate the ciphertext Send (dcom, R1, R1′, π1, c′) to user U i ;

[0113] UserU i After verifying the commitment and proving that π1 is correct: decrypt the ciphertext c′ to obtain Calculate the elliptic curve point R = (r x ,r y )=r1·R0′, verify that s·R1 and If the verification is successful, then calculate And s i ′Send to user U i+1 , q is a random prime number;

[0114] UserU i+1 Verifications i ′·r1·R0′ and Is it consistent?

[0115] Verification is successful, let r i =r x , return To user U i ,return To user U i+1 .

[0116] Unlocking algorithm, by user U i ,i∈[1,n] runs, inputs the open key k i and Release the lock and get the opening key k of the previous hop i-1 The specific process is as follows:

[0117] Preferably, S540, unlocking the ciphertext sent by the potential investor includes:

[0118] Enter the open key k i and Release the lock and get the opening key k of the previous jump i-1 ;

[0119] For User U n , calculate k n-1 =(r n-1 ,s n-1 ),in

[0120] For User U i ,i∈[1,n-1]: calculate k i-1 =(r i-1 ,s i-1 ),in

[0121] Figure 4The transaction fees generated by using the off-chain multi-hop payment method with different numbers of investors are compared with the transaction fees required for transactions on the chain. Compared with the traditional blockchain-based crowdfunding scheme, transactions conducted through multi-hop payment are completely executed off-chain and do not require any on-chain operations. However, in multi-hop payment, additional transaction fees need to be paid to the intermediate nodes as a reward for their help in completing the payment. Referring to the data in the current lightning network, the average transaction fee is about 1 satoshi. Taking the maximum value, that is, the maximum path length of 17 as the length of each path, each investor and the recipient will need an additional 15 satoshi transaction fee for transactions. It can be clearly seen from the figure that the transaction fee cost of off-chain multi-hop payment is almost negligible. The present invention has great advantages in terms of transaction fees compared to the prior art, far ahead of the transaction fees consumed by the prior art.

[0122] Figure 5 The system architecture diagram of the scheme of the present invention is shown in FIG. 1 , in which the crowdfunding initiator R releases the crowdfunding project through the system platform, and the project information also needs to include the funds required for crowdfunding; the authorization center generates a key pair and generates a secret share according to the project information (for example, the amount required for the project is 100, and the fixed amount for participating in the investment is 10, then the authorization center can generate a threshold of (10, 15) according to the actual situation, in which 10 is the minimum amount for successful crowdfunding, and only when this amount, i.e., 100, is it considered a successful crowdfunding; and 15 is the maximum limit, i.e., the financing amount of 150); the crowdfunding investors receive the crowdfunding project information through the system platform and decide whether to participate, and the authorization center will distribute secret shares to the participating investors and assist in encrypting the parameters of the required path; the investors use the secret shares and ciphertext distributed by the authorization center to interact with the project initiator through the off-chain to complete the establishment of the payment path, and finally the initiator completes the transaction by decrypting the combined secret shares.

[0123] The present invention adopts an anonymous multi-hop lock mechanism based on ECDSA to complete multi-hop payment based on the PCN path mode, avoiding the problem of wormhole attack in multi-hop payment, and ensuring script compatibility so that transactions are indistinguishable on the chain; the present invention introduces a threshold encryption scheme to meet the threshold atomicity to realize the practical application of crowdfunding scenarios, that is, for the entire crowdfunding transaction, if the investment of the crowdfunding transaction reaches the bottom line amount of funds, the recipient will receive the investment funds and count as crowdfunding success. If the investment funds do not meet the required requirements, the funds are all returned to each investor, and the recipient will not receive any transfer, which is a crowdfunding failure. Under this premise, if there is a situation where an intermediate node refuses to pay (such as disconnection) in the multi-hop payment path constructed by the investor and the recipient, it does not affect the result of the entire crowdfunding transaction; the investment amount participating in the crowdfunding of the present invention is a fixed value, so that the transfer between each path cannot be distinguished by the amount, so that the intermediate node cannot determine which path this transaction specifically belongs to, providing a certain degree of unlinkability; the scheme introduces the key share of the secret sharing of the authorization center to avoid collusion between crowdfunding investors to secretly deceive the recipient.

[0124] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A privacy-preserving scriptless off-chain multi-path crowdfunding method, characterized in that: include: The authorization center generates public and private keys and secret shares based on the crowdfunding project information; The authorization center sends the public key and the secret share to each potential investor; The potential investor generates ciphertext based on the secret share and public key; The project initiator unlocks the ciphertext based on the private key.

2. A privacy-preserving scriptless off-chain multi-path crowdfunding method according to claim 1, characterized in that: The authorization center generates public and private keys and secret shares according to the crowdfunding project information, including: The authorization center inputs the security parameter λ, outputs the public-private key pair (pk, sk) and publishes the public key pk, and selects x∈Z p And calculate h = g x , private key sk = x, public key p = (G, p, g, h), where G is a cyclic group of order prime number p, and g is the generator.

3. A privacy-preserving scriptless off-chain multi-path crowdfunding method according to claim 1, characterized in that: The authorization center sends the public key and the secret share to each potential investor including: The authorization center sets the threshold (t,n), inputs the private key sk and the public parameter pp, and outputs the key share sk i and the corresponding commitment coefficient c for verification i , where i = 1,…,n; Randomly select t different non-zero elements a0, a1, ... a in the finite field GF(p) t-1 ; Construct a t-1 order polynomial: f(x) = a0+a1x+...a t-1 x t-1 , where a0 = x, i.e. f(0) = x, calculate the secret share s i =f(x i ) and commitment 4. A privacy-preserving scriptless off-chain multi-path crowdfunding method according to claim 1, characterized in that: The potential investor generates ciphertext based on the secret share and the public key, including: The sender uses the public key pk and parameters generated by the authorization center Output ciphertext K i , randomly select r∈Zp, and calculate the ciphertext K of message m i =(c1,c2)=(g r ,m·h r ).

5. According to claim 1, a privacy-preserving scriptless off-chain multi-path crowdfunding method is characterized in that: The project initiator unlocks the ciphertext according to the private key including: Input from potential investor S i The key share sk i and the corresponding commitment coefficient c i Verify the correctness of the shared shares, that is, verify the equation If it is correct, output 1, otherwise output 0; Input the key share sk received from the intended investor i , when the number of shares received is greater than t, the key sk is reconstructed. For any t points (xi,si), construct Run the reconstructed key sk on the ciphertext K i Decrypt and calculate the path parameters 6. A privacy-preserving scriptless off-chain multi-path crowdfunding method according to claim 1, characterized in that: After the project initiator unlocks the ciphertext according to the private key, the intended investor also makes payment, specifically: The anonymous multi-hop lock mechanism based on ECDSA is used to complete the multi-hop payment with the project initiator and the intended investor as the path endpoint nodes: Generate the key in the payment path process; Generate the parameters required for all nodes in the multi-hop payment path; Lock the ciphertext sent by the potential investor; Unlock the ciphertext sent by the potential investor.

7. A privacy-preserving scriptless off-chain multi-path crowdfunding method according to claim 6, characterized in that: The keys in the process of generating the payment path include: Random Selection Calculate Q = x i ·G, where G is a cyclic group of order prime number q, Z q is a subset of G, where Q and x i They are the public and private keys of ECDSA (sk i ,pk i ); Randomly select As the private key sk i =x i share, making satisfy Generate a public-private key pair right Encrypted to get ciphertext c i ; make (SK i ,PK i ) is returned to user U i , (SK i+1 ,PK i ) is returned to user U i+1 .

8. A privacy-preserving scriptless off-chain multi-path crowdfunding method according to claim 7, characterized in that: The parameters required to generate all nodes in the multi-hop payment path include: Randomly select n values: Calculation yields Y0=y0·G,Y i =Y i-1 +y i ·G,i∈[1,n-1], set up The value of Will Return to user U0, Send to U n ,Will Send to U i , where i∈[1,n-1]; UserU i By proving that π i Verify Is it correct, among which 9. A privacy-preserving scriptless off-chain multi-path crowdfunding method according to claim 8, characterized in that: The ciphertext sent by the locking potential investor includes: For User U i , randomly selected Calculation shows that R0 = r0·G, R0′ = r0·Y i , generate proof π0 = Prove NIZK (st0,r0), where For User U i+1 , randomly selected Calculation shows that R1 = r1·G, R1′ = r1·Y i , generate proof π1 = Prove NIZK (st1,r1), Generate Commit(dcom,com)←Commit(λ,(R1,R1′,π1)); UserU i Send (R0, R0′, π0) to user U i+1 , user U i+1 Send com to U i ; UserU i+1 After verifying that π0 is correct: calculate the elliptic curve point R = (r x ,r y )=r1·R0′, randomly selected Hash the message m to get H(m), and use Paillier's homomorphic property to calculate the ciphertext Send (dcom, R1, R1′, π1, c′) to user U i ; UserU i After verifying the commitment and proving that π1 is correct: decrypt the ciphertext c′ to obtain Calculate the elliptic curve point R = (r x ,r y )=r1·R0′, verify that s·R1 and If the verification is successful, then calculate And s i ′Send to user U i+1 , q is a random prime number; UserU i+1 Verifications i ′·r1·R0′ and Is it consistent? Verification is successful, let r i =r x , return To user U i ,return To user U i+1 .

10. A privacy-preserving scriptless off-chain multi-path crowdfunding method according to claim 9, characterized in that: The ciphertext sent by the potential investor to unlock the system includes: Enter the open key k i and Release the lock and get the opening key k of the previous jump i-1 ; For User U n , calculate k n-1 =(r n-1 ,s n-1 ),in For User U i ,i∈[1,n-1]: calculate k i-1 =(r i-1 ,s i-1 ),in

Images