A privacy-protected off-chain multi-path crowdfunding method without scripts

Abstract

The purpose of this invention is to provide a privacy-preserving, script-free, off-chain multi-path crowdfunding method. This method includes: an authorization center generating public and private keys and secret shares based on crowdfunding project information; the authorization center sending the public key and the secret shares to each potential investor; potential investors generating ciphertext based on the secret shares and the public key; and the project initiator unlocking the ciphertext using the private key. This invention solves the problem of wormhole attacks, is more secure than the original HTLC, and only requires ECDSA, without special scripts, thus ensuring compatibility, the indistinguishability of on-chain transactions, and anonymity.

Description

Technical Field

[0001] This invention relates to the field of cryptography, specifically to a privacy-preserving, scriptless, off-chain multi-path crowdfunding method. Background Technology

[0002] Crowdfunding, as an emerging fundraising method combining "Internet + Finance," relies on internet platforms and plays a significant role in promoting economic development. Investors make investments based on information released by crowdfunding platforms. The platform, as a third-party central institution, helps connect investors and project initiators, accelerating their cooperation. However, its centralized management structure makes it vulnerable to malicious attacks by hackers, potentially leading to user data leaks, privacy violations, and even fund theft. Furthermore, if the platform experiences operational problems, bankruptcy, or internal misconduct, users' investments could face severe losses. This underscores the need for decentralized crowdfunding platforms to provide a safer, more transparent, and disintermediation-free crowdfunding experience, ensuring the effective protection of the rights and interests of both users and project owners.

[0003] The decentralization and security of blockchain rely on consensus mechanisms. However, the very structure of blockchain, such as block size, severely limits transaction throughput and speed. This is known as "scalability" in blockchain. Because Bitcoin transactions are processed through an expensive distributed consensus protocol run among miners, this limits transaction throughput while ensuring decentralization and security, resulting in very slow transaction confirmation (Bitcoin can only process about 7 transactions per second), hindering its widespread adoption in practical applications. Payment channels are established between two parties, forcing the sender to establish a channel with every possible recipient, and funds locked in the channel cannot be used elsewhere. Payment Channel Networks (PCNs) offer a solution to this problem by enabling payments along channel paths in a multi-hop manner (viewing a PCN as a graph where nodes are users and edges are payment channels), thus enabling payments between any two nodes connected by a path. The Lightning Network is currently the most widely used and effective PCN, utilizing Hash Time Locks (HTCLs) to achieve a secure and privacy-preserving multi-hop payment protocol. However, this solution is expensive, has long staking times, and HTCLs require specialized scripting languages, making them incompatible with all chains. It also requires the exchange of a large amount of data (approximately 5MB) between users along the payment path. Furthermore, HTCLs have security vulnerabilities: 1. Wormhole attacks, which allow attackers to steal fees from honest intermediaries along the same payment path; 2. Unlinkability or anonymity, which can expose malicious users along the entire path, leading to transaction failures; 3. HTCLs require specialized scripting languages ​​for construction, causing transactions to differ from normal on-chain transactions. Summary of the Invention

[0004] The purpose of this invention is to provide a privacy-preserving, script-free off-chain multi-path crowdfunding method that can solve the problem of wormhole attacks and is more secure than the original HTLC. Furthermore, it only requires ECDSA and does not need special scripts, thus ensuring its compatibility, the indistinguishability of on-chain transactions, and anonymity.

[0005] A privacy-preserving, script-free, off-chain multi-path crowdfunding method includes:

[0006] The authorization center generates public and private keys and secret shares based on the crowdfunding project information;

[0007] The authorization center sends the public key and the secret share to each potential investor;

[0008] Prospective investors generate ciphertext based on the secret share and the public key;

[0009] The project initiator unlocks the encrypted text using the private key.

[0010] Preferably, the authorization center generates public and private keys and secret shares based on crowdfunding project information, including:

[0011] The authorization center takes a security parameter λ as input, outputs a public-private key pair (pk, sk), and publishes the public key pk, selecting x∈Z. p And calculate h = g x Private key sk = x, public key p = (G, p, g, h), where G is a cyclic group of order p and g is a generator.

[0012] Preferably, the authorization center sending the public key and the secret share to each potential investor includes:

[0013] The authorization center sets a threshold (t, n), takes the private key sk and public parameter pp as input, and outputs the key share sk. i and the commitment coefficient c applied to verification i where i = 1, ..., n;

[0014] Randomly select t distinct non-zero elements a0, a1, ... a2 on the finite field GF(p). t-1 ;

[0015] Construct a polynomial of order t-1: f(x) = a0 + a1x + ... + a t-1 x t-1 Where a0 = x, i.e., f(0) = x, calculate the secret share s i =f(x) i ) and commitment

[0016] Preferably, the process by which the prospective investor generates ciphertext based on the secret share and the public key includes:

[0017] The sender uses the public key (pk) and parameters generated by the authorization center. Output ciphertext K, randomly select r∈Zp, and calculate the ciphertext K of message m. i =(c1,c2)=(g r ,m·h r ).

[0018] Preferably, the process by which the project initiator unlocks the ciphertext using a private key includes:

[0019] Input from prospective investor S i Key share sk i and the corresponding commitment coefficient c i Verify the correctness of the shared shares, i.e., verify the equation. If correct, output 1; otherwise, output 0.

[0020] Input the key share sk received from the potential investor. i When the number of received shares is greater than t, the key sk is reconstructed, and for any t points (xi, si), a key is constructed.

[0021] Run the reconstructed key sk on the ciphertext K i Decryption is performed to calculate the path parameters.

[0022] Preferably, after the project initiator unlocks the ciphertext using the private key, the process also includes payment from the intended investor, specifically:

[0023] An anonymous multi-hop locking mechanism based on ECDSA is used to complete multi-hop payments with the project initiator and the prospective investor as the endpoint nodes of the path:

[0024] The key used in generating the payment path;

[0025] Generate the required parameters for all nodes in a multi-hop payment path;

[0026] Locking in encrypted messages sent by potential investors;

[0027] Unlock the encrypted messages sent by potential investors.

[0028] Preferably, the key in the process of generating the payment path includes:

[0029] Random selection The calculation yields Q = x i ·G, where G is a cyclic group of order q, Z q A subset of G, where Q is the same as x. i These are the public and private keys of ECDSA (ski ,pk i Random selection As the private key sk i =x i The share, making satisfy

[0030] Generate public / private key pairs right Encryption yields ciphertext c i ;

[0031] make

[0032] (SK) i PK i Returned to user U i , (SK i+1 PK i Returned to user U i+1 .

[0033] Preferably, the parameters required for generating all nodes in the multi-hop payment path include:

[0034] Randomly select n values:

[0035] The calculation yields Y0 = y0·G,Y i =Y i-1 +y i ·G,i∈[1,n-1],

[0036] set up The value of , where

[0037] Will Return to user U0, Send to U n ,Will Send to U i where i∈[1,n-1];

[0038] User U i By proving π i Verification Is it correct?

[0039] Preferably, the encrypted message sent by the potential investor includes:

[0040] For user U i Random selection The calculations yield R0 = r0·G, R0′ = r0·Y. i Generate proof π0 = Prove NIZK (st0,r0), where,

[0041] For user U i+1 Random selection The calculations yield R1 = r1·G, R1′ = r1·Y. i Generate proof π1 = Prove NIZK (st1,r1), Generate a commitment (dcom,com) ← Commit(λ,(R1,R1′,π1));

[0042] User U i Send (R0,R0′,π0) to user U i+1 User U i+1 Send com to U i ;

[0043] User U i+1 After verifying that π0 is correct: the elliptic curve point R = (r x ,r y ) = r1·R0′, randomly selected H(m) is obtained by hashing message m, and the ciphertext is calculated using Paillier's homomorphic property. Send (dcom,R1,R1′,π1,c′) to user U i ;

[0044] User U i After verifying the commitment and proving the correctness of π1: decrypting the ciphertext c′ yields... Calculate the points R = (r) on the elliptic curve. x ,r y ) = r1·R0′, verify s·R1 and If they match, and the verification passes, then calculate. and s i ′Sent to user U i+1 q is a random prime number;

[0045] User U i+1 Verify s i ′·r1·R0′ and Are they consistent?

[0046] Verification successful, let r i =r x , return Give user U i ,return Give user U i+1 .

[0047] Preferably, the encrypted message sent by the prospective investor includes:

[0048] Enter the unlock key k i and Release the lock and obtain the open key k from the previous hop. i-1 ;

[0049] For user U n k was calculated n-1 =(r n-1 ,s n-1 ),in

[0050] For user U i ,i∈[1,n-1]: calculate k i-1 =(r i-1 ,s i-1 ),in

[0051] The beneficial effects of this invention are as follows: 1. This invention uses an anonymous multi-hop lock mechanism based on ECDSA to complete multi-hop payments based on the PCN path, avoiding the problem of wormhole attacks in multi-hop payments, while ensuring script compatibility so that transactions are indistinguishable on the blockchain; 2. This invention introduces a threshold encryption scheme to satisfy threshold atomicity to realize practical applications in crowdfunding scenarios. That is, for the entire crowdfunding transaction, if the investment in the crowdfunding transaction reaches the minimum funding target, the recipient will receive the investment funds and the crowdfunding is considered successful. If the investment funds do not meet the requirements, all funds will be returned to the respective investors, and the recipient will not receive any transfers; this is considered a crowdfunding failure. Under this premise, if there is a situation where an intermediate node in the multi-hop payment path constructed by the investor and the recipient refuses to pay (e.g., disconnection), it will not affect the result of the entire crowdfunding transaction; 3. The investment amount for crowdfunding in this invention is a fixed value, which makes it impossible to distinguish the transfer between each path by the amount, and makes it impossible for intermediate nodes to determine which path the transaction belongs to, thus providing a certain degree of unlinkability; The solution introduces a secret key share distributed by the authorization center to avoid collusion between crowdfunding investors to secretly deceive the recipient. Attached Figure Description

[0052] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0053] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0054] Figure 1 This is a flowchart of a privacy-preserving, scriptless, multi-path crowdfunding method according to the present invention.

[0055] Figure 2 This is a schematic diagram of the anonymous multi-hop lock mechanism of the present invention;

[0056] Figure 3 This is a schematic diagram of the transaction path creation process of the present invention;

[0057] Figure 4 This is a comparative diagram of transaction fee expenses for the present invention;

[0058] Figure 5 This is a schematic diagram of the structure of a privacy-preserving, scriptless, multi-path crowdfunding system according to the present invention. Detailed Implementation

[0059] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0060] It should be noted that all directional indications (such as up, down, left, right, front, back, etc.) in the embodiments of the present invention are only used to explain the relative positional relationship and movement of each component in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indication will also change accordingly.

[0061] Furthermore, the use of terms such as "first" and "second" in this invention is for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" and "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of the various embodiments can be combined with each other, but only on the basis of being achievable by those skilled in the art. When the combination of technical solutions is contradictory or impossible to implement, such a combination of technical solutions should be considered non-existent and not within the scope of protection claimed by this invention.

[0062] In the current environment of increasingly widespread "Internet+" applications, financial technology continues to advance, and blockchain...

[0063] The combination of blockchain and crowdfunding not only solves the problems of high barriers to entry and low efficiency in traditional crowdfunding financing models, but also provides more reliable guarantees for transactions compared to centralized third-party platforms. Taking the most widespread blockchain financing method, ICO, as an example, we can briefly describe the actual functional requirements of crowdfunding. ICOs operate using smart contracts, setting a minimum fundraising target for the project initiator. If the minimum fundraising target is not reached within a certain time, the fundraising fails, and the smart contract automatically executes the relevant code to return the investors' funds. If the investment exceeds the minimum amount, the target is achieved, and the smart contract automatically stops deployment, completes the transfer, and ends the subsequent transaction. However, this scenario still needs improvement. For example, if the initiator is liquidated during the crowdfunding process, investors who have already participated cannot recover their funds. In addition, the emergence of the blockchain ICO project The DAO in 2016 sparked a huge craze. This community was completely autonomous and operated through smart contracts, becoming the largest crowdfunding project at the time. In less than a month, The DAO raised a staggering $160 million, heralding the arrival of the smart contract era. However, just a month later, hackers exploited a vulnerability in The DAO's recursive calls, causing massive financial losses and directly impacting the Ethereum ecosystem due to the project's sheer size. As a result, increasing research is favoring restricted scripting languages ​​for various applications. These blockchains, supporting only restricted scripting languages, offer irreplaceable advantages: higher security, simpler design and use, and lower maintenance costs.

[0064] The Lightning Network is currently the most widely used and effective PCN, utilizing Hash Time Locks (HTCLs) to achieve a secure and privacy-preserving multi-hop payment protocol. However, this solution is expensive, has long staking times, and HTCLs require specialized scripting languages, making them incompatible with all chains. It also requires the exchange of a large amount of data (approximately 5MB) between users along the payment path. Furthermore, HTCLs have security vulnerabilities: 1. Wormhole attacks, which allow attackers to steal fees from honest intermediaries along the same payment path; 2. Unlinkability or anonymity, which can expose malicious users along the entire path, leading to transaction failures; 3. HTCLs require specialized scripting languages ​​for construction, causing transactions to differ from normal on-chain transactions.

[0065] This invention employs an anonymous multi-hop lock mechanism based on ECDSA to complete multi-hop payments using the PCN path method, avoiding wormhole attacks in multi-hop payments while ensuring script compatibility and making transactions indistinguishable on-chain. This invention introduces a threshold encryption scheme to satisfy threshold atomicity for practical application in crowdfunding scenarios. Specifically, for the entire crowdfunding transaction, if the investment reaches the minimum funding target, the recipient receives the investment funds, and the crowdfunding is considered successful. If the investment does not reach the required amount, all funds are returned to the investors, and the recipient receives no transfer; this is considered a crowdfunding failure. Under this premise, if an intermediate node in the multi-hop payment path constructed by the investor and recipient refuses to pay (e.g., goes offline), it does not affect the overall crowdfunding transaction result. The investment amount in this invention is a fixed value, making transfers between paths indistinguishable by amount, preventing intermediate nodes from determining which path the transaction belongs to, thus providing a degree of unlinkability. The scheme introduces a secret key share distributed by an authorization center to prevent collusion among crowdfunding investors to secretly deceive the recipient.

[0066] Example 1

[0067] A privacy-preserving, script-free, off-chain multi-path crowdfunding method, see reference. Figure 1 and Figure 3 ,include:

[0068] S100, the authorization center generates public and private keys and secret shares based on crowdfunding project information;

[0069] S200, the authorization center sends public keys and secret shares to each potential investor;

[0070] S300: Prospective investors generate ciphertext based on the secret share and the public key;

[0071] S400: The project initiator unlocks the ciphertext using the private key.

[0072] This invention introduces an authorization center as a trusted third party and employs threshold decryption to implement a tree-like structure for off-chain multi-path crowdfunding transactions, thereby preventing potential dishonest behavior by the sender and receiver. In this invention, the crowdfunding initiator R launches a crowdfunding project through the system platform, and the information released includes not only a description of the project but also the required funding. The authorization center receives the project information through the system platform and uses a verifiable secret sharing scheme to generate a key (pk, sk) = KGen and a secret share (s). i ,c i =KeyShare. Potential investors receive projects through the system platform, and the authorization center automatically allocates and sends them a secret share (s). iThe system compares the public key with the private key. Within the system's specified time, if the recipient receives more than t shares from investors, it can reconstruct the complete private key sk = Combine. However, if the required number of investors is not reached within the system's specified time and the private key cannot be reconstructed, the process ends directly without further action.

[0073] Preferably, in step S100, the authorization center generates public and private keys and secret shares based on the crowdfunding project information, including:

[0074] The authorization center takes a security parameter λ as input, outputs a public-private key pair (pk, sk), and publishes the public key pk, selecting x∈Z. p And calculate h = g x Private key sk = x, public key p = (G, p, g, h), where G is a cyclic group of order p and g is a generator.

[0075] Preferably, in step S200, the authorization center sends the public key and secret share to each potential investor, including:

[0076] The authorization center sets a threshold (t, n), takes the private key sk and public parameter pp as input, and outputs the key share sk. i and the commitment coefficient c applied to verification i where i = 1, ..., n;

[0077] Randomly select t distinct non-zero elements a0, a1, ... a2 on the finite field GF(p). t-1 ;

[0078] Construct a polynomial of order t-1: f(x) = a0 + a1x + ... + a t-1 x t-1 Where a0 = x, i.e., f(0) = x, calculate the secret share s i =f(x) i ) and commitment

[0079] Preferably, in step S300, the intended investor generates ciphertext based on the secret share and the public key, including:

[0080] The sender uses the public key (pk) and parameters generated by the authorization center. Output ciphertext K i Randomly select r∈Zp and calculate the ciphertext K of message m. i =(c1,c2)=(g r ,m·h r ).

[0081] Preferably, in S400, the project initiator unlocks the ciphertext using the private key, including:

[0082] Input from prospective investor S iKey share sk i and the corresponding commitment coefficient c i Verify the correctness of the shared shares, i.e., verify the equation. If correct, output 1; otherwise, output 0.

[0083] Input the key share sk received from the potential investor. i When the number of received shares is greater than t, the key sk is reconstructed, and for any t points (xi, si), a key is constructed.

[0084] Run the reconstructed key sk on the ciphertext K i Decryption is performed to calculate the path parameters.

[0085] For multi-hop payment paths Ψ i The investor, acting as the sender in this path, calls U0. The algorithm generates parameters and sends them to each node in the path. U0 uses the public key pk published by the authorization center to match the receiver U. n The parameters are encrypted to obtain ciphertext K. i =Enc, in addition, it will also give its own secret share s i Send them together to the recipient. The recipient requests the commitment coefficient c from the authorization center. i The sender's share is verified using the Verify algorithm. Once verified, the path Ψ... i Running the left and right adjacent nodes Algorithms and Algorithm construction path.

[0086] Preferably, refer to Figure 2 S400, after the project initiator unlocks the ciphertext using the private key, also includes S500, which is used by potential investors for payment, specifically:

[0087] An anonymous multi-hop locking mechanism based on ECDSA is used to complete multi-hop payments with the project initiator and the prospective investor as the endpoint nodes of the path:

[0088] S510, the key generated during the payment path process;

[0089] S520 generates the required parameters for all nodes in a multi-hop payment path;

[0090] S530, locks the encrypted messages sent by potential investors;

[0091] S540 unlocks encrypted messages sent by potential investors.

[0092] This invention introduces an anonymous multi-hop locking mechanism based on ECDSA to complete multi-hop payments with the receiver and sender as path endpoints. Specifically, for each path Ψ in the crowdfunding transaction... i The corresponding sender S i (i.e., U0 in the path) represents the crowdfunding investor; the corresponding recipient R (i.e., U in the path) n ) is the initiator of the crowdfunding project. For ease of description, this section will refer to any one of the paths {Ψ i Taking i∈[1,n] as an example, the construction and transaction process of its multi-hop payment path is described in detail. The process is the same for the multi-hop payment paths of other investors.

[0093] The receiver uses the reconstructed private key sk to ciphertext K of all established paths. i Decrypt to obtain the unlocking parameters This allows funds to be obtained to complete the crowdfunding transaction. For each unlocked parameter... Path Ψ i Each intermediate node in the path (excluding the receiver and sender) runs The algorithm releases the lock to complete the multi-hop payment in the path.

[0094] The key generation algorithm is based on the two adjacent user nodes U in the path. i with U i+1 The system operates collaboratively, taking the security parameter λ as input and outputting the public key PK of both parties. i With their respective private keys SK i and SK i+1 , of which (SK i PK i Returned to user U i , (SK i+1 PK i Returned to user U i+1 .

[0095] Preferably, in step S510, the key used in generating the payment path includes:

[0096] Random selection The calculation yields Q = x i ·G, where G is a cyclic group of order q, Z q A subset of G, where Q is the same as x. i These are the public and private keys of ECDSA (sk i ,pk i Random selection As the private key sk i =x i The share, making satisfy

[0097] Generate public / private key pairs right Encryption yields ciphertext c i ;

[0098] make

[0099] (SK) i PK i Returned to user U i , (SK i+1 PK i Returned to user U i+1 .

[0100] The initialization algorithm, run by user U0, generates the parameters required for multi-hop payments for all nodes, where for user U0, i∈[0,n]... i return In addition, user U n You will also receive the additional parameter k n The specific process is as follows:

[0101] Preferably, in step S520, the parameters required to generate all nodes in the multi-hop payment path include:

[0102] Randomly select n values:

[0103] The calculation yields Y0 = y0·G,Y i =Y i-1 +y i ·G,i∈[1,n-1],

[0104] set up The value of , where

[0105] Will Return to user U0, Send to U n ,Will Send to U i where i∈[1,n-1];

[0106] User U i By proving π i Verification Is it correct?

[0107] The locking algorithm is based on the two adjacent users Ui with U i+1 Running together, input and Output Give user U i , Give user U i+1 , where l i This represents a lock. The specific process is as follows:

[0108] Preferably, in step S530, the encrypted message sent by the potential investor includes:

[0109] For user U i Random selection The calculations yield R0 = r0·G, R0′ = r0·Y. i Generate proof π0 = Prove NIZK (st0,r0), where,

[0110] For user U i+1 Random selection The calculations yield R1 = r1·G, R1′ = r1·Y. i Generate proof π1 = Prove NIZK (st1,r1), Generate a commitment (dcom,com) ← Commit(λ,(R1,R1′,π1));

[0111] User U i Send (R0,R0′,π0) to user U i+1 User U i+1 Send com to U i ;

[0112] User U i+1 After verifying that π0 is correct: the elliptic curve point R = (r x ,r y ) = r1·R0′, randomly selected H(m) is obtained by hashing message m, and the ciphertext is calculated using Paillier's homomorphic property. Send (dcom,R1,R1′,π1,c′) to user U i ;

[0113] User U i After verifying the commitment and proving the correctness of π1: decrypting the ciphertext c′ yields... Calculate the points R = (r) on the elliptic curve. x ,r y ) = r1·R0′, verify s·R1 and If they match, and the verification passes, then calculate. and s i ′Sent to user U i+1 q is a random prime number;

[0114] User U i+1 Verify s i ′·r1·R0′ and Are they consistent?

[0115] Verification successful, let r i =r x , return Give user U i ,return Give user U i+1 .

[0116] The unlocking algorithm is determined by user U. i Run the program if i ∈ [1, n] and input the unlock key k. i and Release the lock and obtain the open key k from the previous hop. i-1 The specific process is as follows:

[0117] Preferably, in step S540, the encrypted message sent by the potential investor includes:

[0118] Enter the unlock key k i and Release the lock and obtain the open key k from the previous hop. i-1 ;

[0119] For user U n k was calculated n-1 =(r n-1 ,s n-1 ),in

[0120] For user U i ,i∈[1,n-1]: calculate k i-1 =(r i-1 ,s i-1 ),in

[0121] Figure 4This paper compares the transaction fees incurred by using off-chain multi-hop payments with those required for on-chain transactions, under varying numbers of investors. Compared to traditional blockchain-based crowdfunding schemes, transactions via multi-hop payments are executed entirely off-chain, requiring no on-chain operations. However, multi-hop payments incur additional transaction fees paid to intermediary nodes as compensation for their assistance in completing the payment. Based on current Lightning Network data, the average transaction fee is approximately 1 satoshi. Taking the maximum value, or the maximum path length of 17, as the length of each path, each transaction between an investor and a recipient requires an additional 15 satoshis. As clearly shown in the figure, the transaction fee cost of off-chain multi-hop payments is almost negligible. This invention offers a significant advantage in transaction fees compared to existing technologies, far exceeding the transaction fees incurred by existing technologies.

[0122] Figure 5 The system architecture diagram of this invention is as follows: the crowdfunding initiator R publishes the crowdfunding project through the system platform, and the project information must also include the funds required for crowdfunding; the authorization center generates a key pair and generates a secret share based on the project information (for example, if the required amount for the project is 100 and the fixed amount for participating investment is 10, then the authorization center can generate a threshold of (10, 15) according to the actual situation, where 10 is the minimum amount for successful crowdfunding, and only when this amount, i.e., 100, is the crowdfunding considered successful; while 15 is the maximum limit, i.e., the amount raised is 150); the crowdfunding investor receives the crowdfunding project information through the system platform and decides whether to participate. The authorization center will distribute secret shares to the participating investors and assist in encrypting and constructing the parameters of the required path; the investor uses the secret share and ciphertext distributed by the authorization center to complete the establishment of the payment path with the project initiator through off-chain interaction, and finally the initiator completes the transaction by merging the secret shares and decrypting.

[0123] This invention employs an anonymous multi-hop lock mechanism based on ECDSA to complete multi-hop payments using the PCN path method, avoiding wormhole attacks in multi-hop payments while ensuring script compatibility and making transactions indistinguishable on-chain. This invention introduces a threshold encryption scheme to satisfy threshold atomicity for practical application in crowdfunding scenarios. Specifically, for the entire crowdfunding transaction, if the investment reaches the minimum funding target, the recipient receives the investment funds, and the crowdfunding is considered successful. If the investment does not reach the required amount, all funds are returned to the investors, and the recipient receives no transfer; this is considered a crowdfunding failure. Under this premise, if an intermediate node in the multi-hop payment path constructed by the investor and recipient refuses to pay (e.g., goes offline), it does not affect the overall crowdfunding transaction result. The investment amount in this invention is a fixed value, making transfers between paths indistinguishable by amount, preventing intermediate nodes from determining which path the transaction belongs to, thus providing a degree of unlinkability. The scheme introduces a secret key share distributed by an authorization center to prevent collusion among crowdfunding investors to secretly deceive the recipient.

[0124] The above description is merely a specific embodiment of the present invention, enabling those skilled in the art to understand or implement the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the present invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A privacy-preserving, script-free, off-chain multi-path crowdfunding method, characterized in that, include: The authorization center generates public and private keys and secret shares based on the crowdfunding project information; The authorization center sends the public key and the secret share to each potential investor; Prospective investors generate ciphertext based on the secret share and the public key; The project initiator unlocks the ciphertext using the private key; The project initiator unlocks the ciphertext using the private key, including: Enter the private key share from the prospective investor. and the corresponding commitment coefficient Verify the correctness of the shared share; output 1 if correct, otherwise output 0; input the private key share received from the prospective investor. , A threshold is set for the authorization center when the number of received private key shares exceeds a certain threshold. At this time, the private key can be reconstructed. Run using the reconstructed key For ciphertext Decrypt the code and calculate the path parameters; The process includes the project initiator unlocking the encrypted text using the private key, followed by payment from potential investors, specifically: An anonymous multi-hop locking mechanism based on ECDSA is used to complete multi-hop payments with the project initiator and the prospective investor as the endpoint nodes of the path: The key used in generating the payment path; Generate the required parameters for all nodes in a multi-hop payment path; Locking in encrypted messages sent by potential investors; Unlock encrypted messages sent by potential investors.

2. The privacy-preserving, scriptless, off-chain multi-path crowdfunding method according to claim 1, characterized in that, The authorization center generates public and private keys and secret shares based on crowdfunding project information, including: Enter security parameters in the authorization center Output public / private key pair And publish the public key .

3. The privacy-preserving, script-free, off-chain multi-path crowdfunding method according to claim 1, characterized in that, The intended investor generates ciphertext based on the secret share and public key, including: The sender uses the public key generated by the authorization center. Encrypt the path parameters and output the ciphertext. .

Images