Conditional privacy protection transaction method in multi-chain block chain system based on UTXO

Abstract

The invention discloses a conditional privacy protection transaction method in a multi-chain block chain system based on UTXO. The conditional privacy protection transaction method comprises the steps of system initialization, user registration, virtual currency production, virtual currency payment, virtual currency receiving and suspicious transaction tracing. According to the invention, a hierarchical block chain system framework is expanded, parallel transaction processing across multiple block chains is realized, incompatible cryptocurrency is converted into new compatible cryptocurrency, and reverse conversion is also supported at the same time. Besides, the invention further provides a conditional privacy protection transaction method based on zero-knowledge proof, the user is allowed to carry out small-amount and low-frequency transactions under the condition that the identity and the specific transaction amount are not exposed, the real identity of large-amount and high-frequency transactions can also be revealed by a supervision mechanism, and the conditional privacy protection transaction method based on zero-knowledge proof has good safety characteristics and low calculation overhead.

Description

Technical Field

[0001] The present invention relates to blockchain and privacy protection technology, and in particular to a conditional privacy protection transaction method in a UTXO-based multi-chain blockchain system. Background Art

[0002] Blockchain technology has become a breakthrough technology widely used in many fields due to its decentralization, immutability, non-forgeability and no need for a trusted third party. Currently, blockchain technology faces two major problems: poor scalability and lack of supervision on privacy protection in cryptocurrency transactions. In order to solve the scalability and efficiency problems, scholars have proposed blockchain systems based on sharding technology, such as Pyramid, Fleetchain, Rapidchain, HIBEChain and OmniLedger. Among them, HIBEChain combines the sharding mechanism with layered multi-chain parallel processing of transactions, thereby improving the system throughput.

[0003] The above research has solved the scalability and efficiency problems to a certain extent. However, due to the anonymity of blockchain, cryptocurrency transactions still lack supervision in terms of privacy protection. At present, there are two main methods for recording blockchain transactions: account model and UTXO model. The account balance information in the account model may lead to privacy leakage, while the UTXO model has more advantages in privacy protection. Therefore, researchers have gradually turned their attention to privacy protection in the UTXO model. Although strong privacy protection provides users with a high level of data security, it also creates opportunities for criminals. Some criminals take advantage of the anonymity of the UTXO model blockchain to hide their true identities in illegal fund transfers, thereby circumventing traditional financial supervision. Therefore, it has become a top priority to regulate privacy protection and implement traceable privacy-preserving transaction schemes.

[0004] In recent years, many conditional privacy protection schemes for UTXO blockchains have emerged. However, most of these schemes are designed for single-chain systems, such as DCAP, PRCash, TRCT, and Traceable Monero. But the existing solutions for single-chain systems cannot be directly applied to multi-chain systems. Multi-chain systems may have some form of connection at the physical or logical level, while single-chain systems only involve a single blockchain. In a multi-chain system, intra-chain transactions or cross-chain transactions may be easily distinguished due to the information contained in the transaction. Attackers can infer sensitive information such as user identity or transaction habits by combining big data to analyze transaction types, resulting in privacy leakage. Therefore, it is necessary to design a conditional privacy protection transaction method in a UTXO-based multi-chain blockchain system. Summary of the invention

[0005] Purpose of the invention: The purpose of the present invention is to solve the deficiencies in the prior art and provide a conditional privacy protection transaction method in a multi-chain blockchain system based on UTXO.

[0006] Technical solution: A conditional privacy protection transaction method in a UTXO-based multi-chain blockchain system of the present invention comprises the following steps:

[0007] Step (1), first initialize the root blockchain, and then initialize each leaf blockchain independently;

[0008] Get the following parameters of the root blockchain: Hash function H: {0, 1} * →{0, 1} λ , Commitment scheme COM, Pseudo-random function PRF, Proof key and verification key in the registration phase Proof Key and Verification Key in the Coin Generation Phase Proof key and verification key in the payment phase

[0009] Each leaf blockchain has an independent regulatory agency with a regulatory threshold of (n, t). The regulators in the same regulatory agency obtain the regulatory public key pk through a key sharing scheme and determine the maximum total transaction amount N of the user's anonymous transaction within the time period T through negotiation. limit and the total frequency V limit ;

[0010] Step (2), user registration stage; the user first generates an identity certificate to obtain the user's unique identity ID and zero-knowledge proof π Register , private inputω Register , and then authenticated by any t regulators of the leaf blockchain;

[0011] Step (3), generating virtual currency c, includes the generation of currency production certificate and verification by the verification agency. The specific method is as follows:

[0012] The user first calculates and stores the one-time address addr, serial number cmsn and commitment cm of the virtual currency through random numbers ra and rs; then, the user generates a zero-knowledge proof π Produce , open input x Produce , and private input ω Produce ; Then the validator verifies the coin-producing transaction tx submitted by the user Produce If the verification is successful, the virtual currency commitment cm will be added to the leaf blockchain In the process, it is finally passed layer by layer to the root blockchain to form the root;

[0013] Step (4), the stage of paying virtual currency, includes the generation of payment certificate and verification by the verification agency. The specific method is as follows:

[0014] Step (4.1), assuming that the number of input virtual currency and output virtual currency of the payment transaction is 2, for k∈{1,2}, the user identity is id k The recipient of Calculate one-time addresses of virtual currencies and encrypted public key epk k , and the obtained epk k Send to payer

[0015] Step (4.2), Payee use Calculate sequence number and commitment Generate new virtual currency

[0016] Step (4.3), use The encrypted public key epk k right Encrypt and send the encrypted AES ciphertext Mh k and ECC ciphertext ch k Send to payer

[0017] Step (4.5) for the cumulative recipient Total transaction amount and total number of times Users need to accumulate v old To V old , and N old Accumulate 1 and update the counter at the same time to get the new counter number ctsn new and commitment ctm new ;

[0018] Step (4.6): To prevent the content of the payment transaction from being maliciously tampered with, the payee S signs the transaction data and obtains the signature σ Send =(ρ, τ);

[0019] Step (4.7): To prevent others from maliciously forging signatures, the recipient Bind signature public key pk sig and one-time addresses Get h1, h2;

[0020] Step (4.8), Payee Generate zero-knowledge proof π Send , open input x Send and private inputω Send, through zero-knowledge proof π Send To prove the payment transaction tx Send effectiveness and compliance;

[0021] Step (4.9), the validator receives the payment transaction tx Send After that, verify π Send and σ Send After the correctness of the query is verified, the Merkle tree and the sequence number set are updated;

[0022] Step (5), receiving virtual currency, the user's payment Decrypt the received ciphertext Mh to obtain the complete virtual currency c;

[0023] Step (6), tracing the suspicious transaction, and the regulatory agency restores the real user identity of the suspicious transaction.

[0024] Furthermore, in step (1), the root blockchain inputs the security parameter λ and selects an elliptic curve group of order q Points on the elliptic curve are defined in a finite field F p On, g is the group The generator of and define the hash function H: {0, 1} * →{0, 1} λ , define the commitment scheme COM and pseudo-random function PRF; then the root blockchain constructs the zero-knowledge proof circuit C Register , C Produce , C Send , using the key generation algorithm KeyGen(1 λ , C) obtain the certification key and verification key of the registration stage, coin production stage and coin payment stage;

[0025] The regulators of the same regulatory agency, where the regulatory threshold is (n, t), negotiate the regulatory public key pk through the secret sharing scheme as follows:

[0026] Step 1), regulator Reg i Have a unique ID i , choose a t-1 order polynomial f i (x) = a i0 +a i1 x+…+a i(t-1) x t-1 mod q; 1≤i≤n;

[0027] Step 2), Reg i Calculate f i (ID i ) and f i (ID j ), f i(ID j )Send to Reg j , and broadcast it among the supervisors of the leaf blockchain Where 1≤j≤n and j≠i, w=0,1,...,t-1;

[0028] Step (3), Reg j Receive {b sent by other n-1 supervisors iw}After verification Whether it is established to judge f i (ID j ) is valid, if not, reject f i (ID j ) and notify Reg i Recalculate and send;

[0029] Step 4) Reg i Receive f from other n-1 supervisors j (ID i ) then you can calculate your own personal regulatory private key Thus, we can calculate And broadcast pk among the regulators of the leaf blockchain i ;

[0030] Step 5) The regulator of the leaf blockchain can calculate the regulatory public key according to the Lagrange interpolation method. (in ), and disclose the supervision public key pk to the users of the leaf blockchain;

[0031] Finally, the regulator will disclose T, V to all users of the corresponding leaf blockchain. limit , N limit .

[0032] Furthermore, the specific process of user registration in step (2) is as follows:

[0033] Step (2.1), the user has a unique identity ID, select a random number

[0034] Step (2.2), the user calculates the initial counter sequence number ctsn=PRF(id||rt) and the initial counter commitment ctm0=COM(id||ctsn||V0||N0); where V0 represents the transaction amount paid by the user, and N0 represents the transaction frequency paid by the user;

[0035] Step (2.3), user generates zero-knowledge proof π Register , open input x Register =(id, ctm0), private input ωRegister =(rt,ctsn),π Register Prove the following two equations:

[0036] ctsn=PRF(id||rt); ctm0=COM(id||ctsn||0||0);

[0037] The user will Register , x Register Sent to any regulator Reg of the leaf blockchain j ;

[0038] Step (2.4), regulator Reg j Receive π sent by the user Register , x Register After that, first verify the zero-knowledge proof π Register The correctness of Register Correct, then continue to step (2.5); if π Register If it is incorrect, the authentication for the user will be refused;

[0039] Step (2.5), regulator Reg j The regulatory agency needs to sign the threshold for ctm0 and id to get σ ctm and σ id ;

[0040] Step (2.6), regulator Reg j (ctm0, σ ctm ) is sent to the validator, and σ id and σ ctm Send to user;

[0041] Step (2.7), the validator adds ctm0 to the Merkle tree T with the counter commitment ctm as the leaf node ctm middle;

[0042] Step (2.8), the user receives σ id and σ ctm Then verify the correctness of both.

[0043] Furthermore, in step (2.5), the regulator Reg j The detailed process of the regulatory agency for threshold signing for ctm0 and id is as follows:

[0044] Step 1), regulator Reg j Public disclosure of ctm0 within the regulatory body;

[0045] Step 2), other regulators Reg i Select random number calculate And D i Send to the regulator Reg j ;

[0046] Step 2), regulator Reg j Receive t-1 D i After that, t supervisors form a signature group

[0047] Step 3), regulator Reg j Calculate e0 = H(ctm0), l = X0-e0 mod q;

[0048] Step 4) Supervisor Calculate i =L(i)sk i l+d i mod q, and Internal disclosure i ;

[0049] Step 5), regulator Reg j Polymerization i , generate a signature

[0050] The step (2.8), user verification σ id and σ ctm The correctness process is as follows: the user calculates e0′=H(ctm0), X0′=l+e0′mod q, and uses the elliptic curve to calculate the corresponding Y0′ to obtain (X0′, Y0′); the user checks (X0′, Y0′)=g o / pk l Is it established? If it is established, it means the signature is correct. Otherwise, notify Reg j Recalculate.

[0051] Furthermore, the detailed process of step (3) is as follows:

[0052] Step (3.1), the user first pays the equivalent value of other types of virtual currency to the hosting pool; then the user selects a random number Calculate the one-time address of the virtual currency addr = PRF (id || ra), serial number cmsn = PRF (addr || rs), commitment cm = COM (addr || cmsn || rs || v);

[0053] Step (3.2), the user stores virtual currency c = (cm, addr, cmsn, rs, v) in the wallet; then generates zero-knowledge proof π Produce , open input x Produce=(cm, v), private input ω Produce =(id, addr, ra, rs, cmsn), π Mint Prove the following equations: addr = PRF(id||ra); cmsn = PRF(addr||rs); cm = COM(addr||cmsn||rs||v);

[0054] Step (3.4), after the above three equations are successfully verified, the user submits the coin-producing transaction tx to the validator Produce =(π Mint , x Mint ); the validator receives tx Produce After that, verify π Produce After verifying the correctness of the virtual currency commitment cm, add it to the leaf blockchain and send the chain's parent chain's validator Root;

[0055] Step (3.5), the parent chain validator collects the tree root sent by the child chain and uses the tree root as the parent chain The leaves of the chain construct a similar Merkle tree and send the new tree root to the parent chain of the parent chain, and pass it layer by layer to the root blockchain. In the middle, root is formed.

[0056] Furthermore, in step (4), the payee The method to calculate the one-time address and encrypted public key is: Select random number Calculating one-time addresses Choose a random number Choose a random number As the encrypted private key, calculate the encrypted public key

[0057] The recipient S selects a random number use of Calculate sequence number promise Generate new virtual currency

[0058] Payee use The encrypted public key epk k right The detailed method for encryption is: first use the AES key mh k right Encrypt and obtain Mh k ; Reuse The encrypted public key epk k To mhk Encrypt and select a random number calculate

[0059] User accumulated v old To V old , and N old Accumulate 1 and update the counter at the same time: Select Calculate the new counter number ctsn new =PRF(id||rt new ), new counter commitment ctm new =COM(id||ctsn new ||V new ||N new );

[0060] Payee Sign the transaction data, and let the data to be signed be

[0061] In the above formula, root ctm It is T ctm The root, root1, root2 are The extended Merkle tree The root, It is an old virtual currency Serial number, It is a new virtual currency The promise, pub It is public, which means converting a certain amount of money in the transaction into other types of cryptocurrencies such as Bitcoin. Users can also set v pub =0, info represents the conversion address of cryptocurrency such as Bitcoin wallet public key, ctsn old is the serial number of the old counter, ctm new is the commitment of the new counter, and the signing process is:

[0062] Step 1) Select sk sig , Calculate signature public key

[0063] Step 2) Calculate e = H (mu), (X, Y) = g ru , let ρ=X mod p, if ρ=0, reselect r u ;

[0064] Step 3) Calculate τ = rk -1 (e+sk sig*ρ) mod p, we can get the signature σ Send =(ρ, τ);

[0065] Payee Calculate h sig =H(pk sig ),

[0066] Bind signature public key pk sig With one-time addresses

[0067] x Send The expression is: Private Inputω Send The expression is:

[0068]

[0069] π Send The specific process of proving the correctness of the parameters is:

[0070] Step (a) Regarding old virtual currency π Send Prove the following statement:

[0071] root k =EMT(path k )

[0072]

[0073] Step (b) Regarding New Virtual Currency π Send Prove the following statement:

[0074]

[0075] Step (c), about tx Send The effectiveness of π Send Prove the following statement:

[0076]

[0077] v old =v new +v pub

[0078]

[0079] π Send The specific process of proving parameter compliance is:

[0080] Step (a), about tx SendCompliance, π Send Prove the following statement:

[0081] root ctm =MT(path ctm )

[0082] V new =V oldd +v old

[0083] N new =N old +1

[0084] ctsn old =PRF(id||rt old )

[0085] ctm old =COM(id||ctsn old ||V old ||N old )

[0086] ctsn new =PRF(id||rt new )

[0087] ctm new =COM(id||ctsn new ||V new ||N new )

[0088] Step (b), if tx Send The transaction amount and transaction frequency do not exceed the limit, π Send Prove the following statement: V new ∈[0,V limit ]; N new ∈[0,N limit ]; Submit coin transaction tx Send =(π Send , x Send ,info,pk sig , σ Send ); if the transaction amount or transaction frequency exceeds the limit, Use the supervisory public key pk pair (id||σ id ) is encrypted to obtain (Md, cd), and tid is added to x Send In (id, σ i d) Join ω Send and prove the following statement:

[0089] tid=H(id||σi d)

[0090] Submit coin transaction tx Send =(π Send , x Send ,info,pk sig , σ Send , Md, cd);

[0091] Ultimately, if the transaction meets regulatory criteria, the validator will ctm new Join T ctm In the old Add to the counter sequence number set and Join In Add to the virtual currency serial number collection; if the transaction does not meet regulatory standards, the validator sends tx Sen d d Give the regulator a way to trace its true identity.

[0092] Furthermore, the step (b) uses the supervisory public key pk to (id||σ id )The encryption process is:

[0093] Payee Use the AES key md pair (id||σ id ) is encrypted to obtain Md;

[0094] Use the regulatory public key pk to encrypt md and select a random number Calculate cd = (cd1, cd2) = (g rd ,md*pk rd ).

[0095] Furthermore, the verifier verifies σ Sen d d =(ρ, τ) is as follows:

[0096] calculate

[0097]

[0098] calculate

[0099] Finally, the verifier checks whether X′ is equal to ρ. If so, the signature is correct.

[0100] Furthermore, the specific process of receiving virtual currency in step (5) is as follows:

[0101] Step (5.1), After receiving the AES ciphertext Mh and ECC ciphertext ch, use the encrypted private key esk to decrypt Mh. The decryption process is:

[0102] calculate Get the AES key mh′; then use mh′ to perform AES decryption on Mh to obtain (cmsn||rs||v);

[0103] Step (5.2), Obtain virtual currency c = (cm, addr, cmsn, rs, v).

[0104] Furthermore, in step (6), any t regulators of the leaf blockchain trace the identity of the transaction that violates the regulatory criteria. The t regulators are hereinafter referred to as the regulatory team. The tracing process is:

[0105] Oversight Group Members calculate and in Internal broadcast ss i Reg i calculate Get the AES key md′; Reg i Use md′ to perform AES decryption on Md and obtain (id||σ id ), by verifying the signature σ id The effectiveness of Reg i Determine whether the user is a registered legitimate user.

[0106] Beneficial effects: The present invention has the following advantages:

[0107] (1) The present invention uses a one-time address and a one-time signature key. Even if an attacker intercepts a transaction, it is impossible to determine whether the payer of two transactions is the same person through the information in the transaction, thereby achieving the unlinkability of the transaction.

[0108] (2) The present invention introduces regulatory criteria to distinguish normal transactions from suspicious transactions. Zero-knowledge proof technology realizes the privacy protection of transaction identity and transaction amount, while ensuring that only small and low-frequency transactions can be conducted anonymously without consuming additional resources to detect suspicious transactions.

[0109] (3) The present invention uses formal security analysis to evaluate the security of the scheme. The results show that it can resist various types of attacks and has stronger security than other related schemes. In addition, performance analysis shows that the present invention has lower computational overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0110] Figure 1It is a system model diagram of the present invention;

[0111] Figure 2 A diagram showing the relationship between the time overhead and the system level in the initialization phase in one embodiment of the present invention;

[0112] Figure 3 A diagram showing the relationship between the time cost and system level of the payment phase in one embodiment of the present invention;

[0113] Figure 4 A graph showing the relationship between the time cost of the initialization phase and the depth of the Merkle tree in one embodiment of the present invention;

[0114] Figure 5 This is a graph showing the relationship between the time cost of the payment phase and the depth of the Merkle tree in one embodiment of the present invention;

[0115] Figure 6 This is a graph showing the relationship between the time cost of the initialization phase and the number of payees in one embodiment of the present invention;

[0116] Figure 7 This is a graph showing the relationship between the time cost of the payment stage and the number of payees in one embodiment of the present invention. DETAILED DESCRIPTION

[0117] The technical solution of the present invention is described in detail below, but the protection scope of the present invention is not limited to the embodiments.

[0118] For the UTXO model, the UTXO input of one transaction is the UTXO output of another transaction. An attacker may link the two transactions based on this feature. To solve this problem, we use Merkle tree proofs to hide the UTXO in the transaction, that is, the virtual currency. Users only need to prove that the virtual currency used for payment exists in the Merkle tree, without revealing which virtual currencies they are. We use zero-knowledge proof technology to hide the paths involved in the Merkle proof, and only the Merkle tree root is public. Considering the layered multi-chain architecture of the present invention, an attacker may judge whether a transaction is an intra-chain transaction or a cross-chain transaction based on the Merkle tree root. Therefore, we use an extended Merkle tree to achieve indistinguishability of transactions. In this case, the Merkle proofs of all virtual currencies only reveal the Merkle tree root of the root blockchain. In order to prevent double spending, we assign a corresponding serial number to each virtual currency, and users need to reveal the serial number when using virtual currency to prove that the virtual currency has not been used.

[0119] Since it is impossible to determine which virtual currencies are involved, and therefore the denomination of the virtual currencies, malicious attackers may exploit this vulnerability to launder money. To address this problem, we introduced regulatory guidelines to limit the total amount and frequency of transactions that users can make within a period of time. In addition, we assign counters to users to accumulate the amount and frequency of transactions. However, in this case, the counter of one transaction input is the counter of another transaction output. In order to achieve the unconnectability of transactions, we built a Merkle tree based on the counter. Since the counter cannot be used as an effective basis for distinguishing intra-chain transactions from cross-chain transactions, the conventional Merkle tree can meet the needs.

[0120] The present invention adopts a sharded, layered, multi-chain architecture to achieve system scalability. Figure 3 As shown in Figure 1, the non-leaf blockchains in the system are maintained separately by the verification agency, while the leaf blockchain system model mainly includes four entities, the leaf blockchain, the verification agency, the regulator, and the user. The leaf blockchain acts as a distributed ledger, recording the correct and compliant transactions submitted by the validator. The verification agency consists of multiple validators, responsible for verifying the correctness of the transaction, adding compliant transactions to the leaf blockchain, and submitting suspicious transactions to the regulator. The regulator consists of multiple regulators, responsible for negotiating and publicizing the parameters in the regulatory guidelines, and revealing the real user identity of suspicious transactions. The user is an entity with transaction needs.

[0121] In order to facilitate understanding of the technical solution of this embodiment, the meanings of the relevant variables are first explained, and the specific contents are shown in Table 1.

[0122] Table 1

[0123]

[0124]

[0125] The conditional privacy protection transaction method in the UTXO-based multi-chain blockchain system of this embodiment includes the following steps:

[0126] Step (1), first initialize the root blockchain, and then initialize each leaf blockchain independently;

[0127] Get the following parameters of the root blockchain: Hash function H: {0, 1} * →{0, 1} λ , Commitment scheme COM, Pseudo-random function PRF, Proof key and verification key in the registration phase Proof Key and Verification Key in the Coin Generation Phase Proof key and verification key in the payment phase

[0128] Each leaf blockchain has an independent regulatory agency with a regulatory threshold of (n, t). The regulators in the same regulatory agency obtain the regulatory public key pk through a key sharing scheme and determine the maximum total transaction amount N of the user's anonymous transaction within the time period T through negotiation. limit and the total frequency V limit ;

[0129] Step (2), user registration stage; the user first generates an identity certificate to obtain the user's unique identity ID and zero-knowledge proof π Register , private inputω Register , and then authenticated by any t regulators of the leaf blockchain;

[0130] Step (3), generating virtual currency c, includes the generation of currency production certificate and verification by the verification agency. The specific method is as follows:

[0131] The user first calculates and stores the one-time address addr, serial number cnsn and commitment cm of the virtual currency through random numbers ra and rs; then, the user generates a zero-knowledge proof π Produce , open input x Produce , and private input ω Produce ; Then the validator verifies the coin-producing transaction tx submitted by the user Produce If the verification is successful, the virtual currency commitment cm will be added to the leaf blockchain In the process, it is finally passed layer by layer to the root blockchain to form the root;

[0132] Step (4), the stage of paying virtual currency, includes the generation of payment certificate and verification by the verification agency. The specific method is as follows:

[0133] Step (4.1), assuming that the number of input virtual currency and output virtual currency of the payment transaction is 2, for k∈{1,2}, the user identity is id k The recipient of Calculate one-time addresses of virtual currencies and encrypted public key epk k , and the obtained epk k Send to payer

[0134] Step (4.2), Payee use Calculate sequence number and commitment Generate new virtual currency

[0135] Step (4.3), use The encrypted public key epkk right Encrypt and send the encrypted AES ciphertext Mh k and ECC ciphertext ch k Send to payer

[0136] Step (4.5) is the cumulative recipient Total transaction amount and total number of times Users need to accumulate v old To V old , and N old Accumulate 1 and update the counter at the same time to get the new counter number ctsn new and commitment ctm new ;

[0137] Step (4.6): To prevent the content of the payment transaction from being maliciously tampered with, the recipient Sign the transaction data and get the signature σ Send =(ρ, τ);

[0138] Step (4.7), to prevent others from maliciously forging signatures, the recipient Bind signature public key pk sig and one-time addresses Get h1, h2;

[0139] Step (4.8), Payee Generate zero-knowledge proof π Send , open input x Send and private inputω Send , through zero-knowledge proof π Send To prove the payment transaction tx Send effectiveness and compliance;

[0140] Step (4.9), the validator receives the payment transaction tx Send After that, verify π Send and σ Send After the correctness of the query is verified, the Merkle tree and the sequence number set are updated;

[0141] Step (5), receiving virtual currency, the user's payment Decrypt the received ciphertext Mh to obtain the complete virtual currency c;

[0142] Step (6), tracing the suspicious transaction, and the regulatory agency restores the real user identity of the suspicious transaction.

[0143] In the above step (1), the root blockchain inputs the security parameter λ and selects an elliptic curve group of order q Points on the elliptic curve are defined in a finite field F p On, g is the group The generator of and define the hash function H: {0, 1} * →{0, 1} λ , define the commitment scheme COM and pseudo-random function PRF; then the root blockchain constructs the zero-knowledge proof circuit C Register , C Produce , C Send , using the key generation algorithm KeyGen(1 λ , C) obtain the certification key and verification key of the registration stage, coin production stage and coin payment stage;

[0144] The regulators of the same regulatory agency, where the regulatory threshold is (n, t), negotiate the regulatory public key pk through the secret sharing scheme as follows:

[0145] Step 1), regulator Reg i Have a unique ID i , choose a t-1 order polynomial f i (x) = a i0 +a i1 x+…+a i(t-1) x t-1 mod q; where 1≤i≤n;

[0146] Step 2), Reg i Calculate f i (ID i ) and f i (ID j ), f i (ID j )Send to Reg j , and broadcast it among the supervisors of the leaf blockchain Where 1≤j≤n and j≠i, w=0,1,...,t-1;

[0147] Step (3), Reg j Receive {b sent by other n-1 supervisors iw}After verification Whether it is established to judge f i (ID j ) is valid, if not, reject f i (ID j ) and notify Reg i Recalculate and send;

[0148] Step 4) Reg i Receive f from other n-1 supervisors j (IDi ) then you can calculate your own personal regulatory private key Thus, we can calculate And broadcast pk among the regulators of the leaf blockchain i ;

[0149] Step 5) The regulator of the leaf blockchain can calculate the regulatory public key according to the Lagrange interpolation method. (in ), and disclose the supervision public key pk to the users of the leaf blockchain;

[0150] Finally, the regulator will disclose T, V to all users of the corresponding leaf blockchain. limit , N limit .

[0151] The specific process of user registration in step (2) above is as follows:

[0152] Step (2.1), the user has a unique identity ID, select a random number

[0153] Step (2.2), the user calculates the initial counter sequence number ctsn=PRF(id||rt) and the initial counter commitment ctm0=COM(id||ctsn||V0||N0); where V0 represents the transaction amount paid by the user, and N0 represents the transaction frequency paid by the user;

[0154] Step (2.3), user generates zero-knowledge proof π Register , open input x Register =(id, ctm0), private input ω Register =(rt,ctsn),π Register Prove the following two equations:

[0155] ctsn=PRF(id||rt); ctm0=COM(id||ctsn||0||0);

[0156] The user will Register , x Register Sent to any regulator Reg of the leaf blockchain j ;

[0157] Step (2.4), regulator Reg j Receive π sent by the user Register , x Register After that, first verify the zero-knowledge proof π Register The correctness of Register Correct, then continue to step (2.5); if π Register If it is incorrect, the authentication for the user will be refused;

[0158] Step (2.5), regulator Reg j The regulatory agency needs to sign the threshold for ctm0 and id to get σ ctm and σ id ;

[0159] Step (2.6), regulator Reg j (ctm0, σ ctm ) is sent to the validator, and σ id and σ ctm Send to user;

[0160] Step (2.7), the validator adds ctm0 to the Merkle tree T with the counter commitment ctm as the leaf node ctm middle;

[0161] Step (2.8), the user receives σ id and σ ctm Then verify the correctness of both.

[0162] The above step (2.5) regulator Reg j The detailed process of the regulatory agency for threshold signing for ctm0 and id is as follows:

[0163] Step 1), regulator Reg j Public disclosure of ctm0 within the regulatory body;

[0164] Step 2), other regulators Reg i Select random number calculate And D i Send to the regulator Reg j ;

[0165] Step 2), regulator Reg j Receive t-1 D i After that, t supervisors form a signature group

[0166] Step 3), regulator Reg j Calculate e0 = H(ctm0), l = X0-e0 mod q;

[0167] Step 4) Supervisor Calculate i =L(i)sk i l+d i mod q, and Internal disclosure i ;

[0168] Step 5), regulator Reg j Polymerization i , generate a signature

[0169] The step (2.8), user verification σ id and σ ctm The correctness process is as follows: the user calculates e0′=H(ctm0), X0′=l+e0′mod q, and uses the elliptic curve to calculate the corresponding Y0′ to obtain (X0′, Y0′); the user checks (X0′, Y0′)=g o / pk l Is it established? If it is established, it means the signature is correct. Otherwise, notify Reg j Recalculate.

[0170] The detailed process of the above step (3) is as follows:

[0171] Step (3.1), the user first pays the equivalent value of other types of virtual currency to the hosting pool; then the user selects a random number ra, Calculate the one-time address of the virtual currency addr = PRF (id || ra), serial number cmsn = PRF (addr || rs), commitment cm = COM (addr || cmsn || rs || v);

[0172] Step (3.2), the user stores virtual currency c = (cm, addr, cmsn, rs, v) in the wallet; then generates zero-knowledge proof π Produce , open input x Produce =(cm, v), private input ω Produ =(id, addr, ra, rs, cmsn), π Mint Prove the following equations: addr = PRF(id||rs); cmsn = PRF(addr||rs); cm = COM(addr||cmsn||rs||v);

[0173] Step (3.4), after the above three equations are successfully verified, the user submits the coin-producing transaction tx to the validator Produce =(π Mint , x Mint ); the validator receives tx Produce After that, verify π Produce After verifying the correctness of the virtual currency commitment cm, add it to the leaf blockchain and send the chain's parent chain's validator Root;

[0174] Step (3.5), the parent chain validator collects the tree root sent by the child chain and uses the tree root as the parent chain The leaves of the chain construct a similar Merkle tree and send the new tree root to the parent chain of the parent chain, and pass it layer by layer to the root blockchain. In the middle, root is formed.

[0175] Step (4) above: recipient The method to calculate the one-time address and encrypted public key is: Select random number Calculating one-time addresses Choose a random number Choose a random number As the encrypted private key, calculate the encrypted public key

[0176] Payee Select random number use of Calculate sequence number promise Generate new virtual currency

[0177] Payee use The encrypted public key epk k right The detailed method for encryption is: first use the AES key mh k right Encrypt and obtain Mh k ; Reuse The encrypted public key epk k To mh k Encrypt and select a random number calculate

[0178] User accumulated v old To V old , and N old Accumulate 1 and update the counter at the same time: Select Calculate the new counter number ctsn new =PRF(id||rt new ), new counter commitment ctm new =COM(id||ctsn new ||V new ||N new );

[0179] Payee Sign the transaction data, and let the data to be signed be

[0180] In the above formula, rootctm It is T ctm The root, root1, root2 are The extended Merkle tree The root, It is an old virtual currency Serial number, It is a new virtual currency The promise, pub It is public, which means converting a certain amount of money in the transaction into other types of cryptocurrencies such as Bitcoin. Users can also set v pub =0, info represents the conversion address of cryptocurrency such as Bitcoin wallet public key, ctsn old is the serial number of the old counter, ctm new is the commitment of the new counter, and the signing process is:

[0181] Step 1) Select sk sig , Calculate signature public key

[0182] Step 2) Calculate e = H (mu), (X, Y) = g ru , let ρ = X mod p, if ρ = 0, reselect ru;

[0183] Step 3) Calculate τ = rk -1 (e+sk sig *ρ) mod p, we can get the signature σ Send =(ρ, τ);

[0184] Payee Calculate h sig =H(pk sig ),

[0185] Bind signature public key pk sig With one-time addresses

[0186] x Send The expression is: Private Inputω Send The expression is:

[0187]

[0188] π Send The specific process of proving the correctness of the parameters is:

[0189] Step (a) Regarding old virtual currency π Send Prove the following statement:

[0190] root k =EMT(path k )

[0191]

[0192] Step (b) Regarding New Virtual Currency π Send Prove the following statement:

[0193]

[0194] Step (c), about tx Send The effectiveness of π Send Prove the following statement:

[0195]

[0196]

[0197] π Send The specific process of proving parameter compliance is:

[0198] Step (a), about tx Send Compliance, π Send Prove the following statement:

[0199] root ctm =MT(path ctm )

[0200] V new =V oldd +v old

[0201] N new =N old +1

[0202] ctsn old =PRF(id||rt old )

[0203] ctm old =COM(id||ctsn old ||V old ||N old )

[0204] ctsn new =PRF(id||rt new )

[0205] ctm new=COM(id||ctsn new ||V new ||N new )

[0206] Step (b), if tx Send The transaction amount and transaction frequency do not exceed the limit, π Send Prove the following statement: V new ∈[0,V limit ]; N new ∈[0,N limit ]; Submit coin transaction tx Send =(π Send , x Send ,info,pk sig , σ Sendd ); if the transaction amount or transaction frequency exceeds the limit, Use the supervisory public key pk pair (id||σ id ) is encrypted to obtain (Md, cd), and tid is added to x Send In (id, σ id ) Join Send and prove the following statement: tid=H(id||σ id );

[0207] Submit coin transaction tx Send =(π Send , x Send ,info,pk sig , σ Send , Md, cd);

[0208] Ultimately, if the transaction meets regulatory criteria, the validator will ctm new Join T ctm In the old Add to the counter sequence number set and Join In Add to the virtual currency serial number collection; if the transaction does not meet regulatory standards, the validator sends tx Send Give the regulator a way to trace its true identity.

[0209] The above step (b) uses the supervisory public key pk pair (id||σ id )The encryption process is:

[0210] Payee Use the AES key md pair (id||σ id ) is encrypted to obtain Md;

[0211] Use the regulatory public key pk to encrypt md and select a random number Calculate cd = (cd1, cd2) = (g rd ,md*pk rd ). 8. The conditional privacy protection transaction method in the UTXO-based multi-chain blockchain system according to claim 1, characterized in that the validator verifies σ Send =(ρ, τ) is as follows:

[0212] calculate

[0213]

[0214] calculate

[0215] Finally, the verifier checks whether X′ is equal to ρ. If so, the signature is correct.

[0216] The specific process of receiving virtual currency in step (5) above is as follows:

[0217] Step (5.1), After receiving the AES ciphertext Mh and ECC ciphertext ch, use the encrypted private key esk to decrypt Mh. The decryption process is:

[0218] calculate Get the AES key mh′; then use mh′ to perform AES decryption on Mh to obtain (cmsn||rs||v);

[0219] Step (5.2), Obtain virtual currency c = (cm, addr, cmsn, rs, v).

[0220] In step (6), any t regulators of the leaf blockchain trace the identity of transactions that violate the regulatory guidelines. Hereinafter, the t regulators are referred to as the regulatory team. The tracing process is:

[0221] Oversight Group Members calculate and in Internal broadcast ss i Reg i calculate Get the AES key md′; Reg i Use md′ to perform AES decryption on Md and obtain (id||σ id ), by verifying the signature σ id The effectiveness of Reg iDetermine whether the user is a registered legitimate user.

[0222] Example:

[0223] This example runs on a Windows operating system, and the computer is equipped with an Intel Core i7-11700K@2.50GHz and 16GB RAM. We use the circomlib library as the zero-knowledge proof library, the BLS12381 curve as the elliptic curve, and the SHA-512 hash function as the secure hash function. The identifiers and descriptions of each operation are shown in Table 2.

[0224] Table 2

[0225] Logo illustrate Logo illustrate <![CDATA[T genReg ]]> <![CDATA[Generate π at once Register Time of proof]]> <![CDATA[T h ]]> The time of a hash operation <![CDATA[T verReg ]]> <![CDATA[Verify π once Register Time of proof]]> <![CDATA[T ma ]]> Time for one module addition operation <![CDATA[T genMint ]]> <![CDATA[Generate π at once Mint Time of proof]]> <![CDATA[T mm ]]> The time of a modular multiplication operation <![CDATA[T verMint ]]> <![CDATA[Verify π once Mint Time of proof]]> <![CDATA[T pa ]]> One-click operation time <![CDATA[T genSend ]]> <![CDATA[Generate π at once Send Time of proof]]> <![CDATA[T pm ]]> The time of one point multiplication operation <![CDATA[T verSend ]]> <![CDATA[Verify π once Send Time of proof]]>

[0226] This embodiment analyzes and simulates the computational overhead of each stage.

[0227] During the initialization phase, the supervisor performs nt+t 2 -1 hash operation, 2nt+2t 2 -3n-t modular multiplication operations, nt-n point addition operations and nt+n+t point multiplication operations to calculate the key pair for threshold encryption and threshold signature.

[0228] During the registration phase, the regulator needs to verify π Register , and perform 2 hash operations, 2t+2 modular addition operations, 4 modular multiplication operations, 2t-2 point addition operations, and 2 point multiplication operations to sign ctm and id. The verifier needs to perform depth ctm hash operations to save ctm0 to T ctm The user needs to perform 4 hash operations, 2 modular addition operations, 2 point addition operations, and 4 point multiplication operations to generate registration information and generate π Register .

[0229] During the virtual currency production phase, the validator needs to verify π Mint , and depth coin Hash operations to save cm to In the example above, users need to perform 3 hash operations to generate virtual currency commitment and generate π Mint Regarding the payment of virtual currency, the validator needs to verify π Send , and coin in *depth coin +depth ctm +1 hash operation, 2 modular multiplication operations, 1 dot addition operation, 2 dot multiplication operations to check the validity of the transaction and save cm to In the example above, the user needs to generate π Send , and 2coinout +coin in +4 hash operations, 1 modular addition operation, 2 modular multiplication operations, coin out Click and add operation, 2coin out +2 dot multiplication operations. In addition, if the user's transaction amount or frequency exceeds the limit, 1 hash operation, 1 dot addition operation and 2 dot multiplication operations are required to attach their identity information.

[0230] In the stage of receiving virtual currency, the receiver needs to perform 1 point addition operation and 1 point multiplication operation to decrypt the ciphertext to obtain virtual currency. In the tracing stage, the regulator needs to perform 2 hash operations, t+1 modular addition operations, 2t modular multiplication operations, t+1 point addition operations, and 3 point multiplication operations to restore the user's true identity.

[0231] Table 3

[0232]

[0233]

[0234] In Table 3, n represents the number of regulators in the leaf blockchain, t represents the threshold of the regulator, and depth coin express Depth ctm Indicates T ctm Depth, coin in Indicates tx Send The amount of virtual currency entered, coin out Indicates tx Send The amount of virtual currency output in the transaction.

[0235] In this embodiment, the threshold (n, t) is set to (10, 7), the system level is 4, The depth is 6, T ctmThe depth is 10, and the number of input virtual currency and output virtual currency in the Send transaction is 1. In the initialization phase, the time cost of the regulator is 58.497s, in the registration phase, the time cost of the regulator is 0.549s, the time cost of the validator is 0.018ms, and the time cost of the user is 0.641s. In the virtual currency production phase, the time cost of the validator is 0.534s, and the time cost of the user is 0.654s. In the virtual currency payment phase, the time cost of the validator is 0.538s, the time cost of users who comply with regulatory guidelines is 1.119s, and the time cost of users who violate regulatory guidelines is 1.143s. In the virtual currency receiving phase, the time cost of the user is 0.197ms, and in the tracing phase, the time cost of the regulator is 0.652ms. Considering that initialization only needs to be performed once, we believe that its longer time cost is acceptable.

[0236] This embodiment also tests the time overhead of HyperMaze when the system level is 4 and the EMT depth is 6. In the setup algorithm, the time overhead of the verifier is 48.861s, in the convert algorithm, the time overhead of the verifier is 0.534s, and the time overhead of the user is 0.686s, in the Redeem algorithm, the time overhead of the verifier is 0.539s, and the time overhead of the user is 0.696s, in the Send algorithm, the time overhead of the verifier is 0.546s, and the time overhead of the user is 0.712s, and in the Receive algorithm, the time overhead of the verifier is 0.532s, and the time overhead of the user is 0.941s.

[0237] The Produce algorithm in the present invention is similar to the Send algorithm in HyperMaze, but the computational overhead of the technical solution of the present invention is much lower than that of the latter. We continue to lock other conditions, modify the system level to 2, 3, 4, 5, 6, and compare it with HyperMaze. The results of the initialization phase are as follows: Figure 2 As shown in Figure 2, the results of the payment phase are as follows: Figure 3 shown.

[0238] Similarly, locking other conditions, the depth of the extended Merkle tree is modified to 4, 6, 8, | 0, 12, and compared with HyperMaze. The results of the initialization phase are as follows: Figure 4 As shown in Figure 2, the results of the payment phase are as follows: Figure 5 shown.

[0239] The reason why the overhead of the present invention in the initialization phase is higher than that of HyperMaze is that the present invention needs to SendTwo circuits are generated, one for users who comply with regulatory guidelines, that is, they need to prove that the transaction amount and frequency are within the limit; the other is generated for users who violate regulatory guidelines, that is, they need to prove that the user has truthfully bound his or her identity.

[0240] The Send algorithm in the present invention is similar in function to the Receive algorithm in HyperMaze. The computational overhead of the present invention is slightly higher than that of HyperMaze because the present invention adds range detection for transaction amounts and frequencies, thereby enhancing the security of the system.

[0241] The Send algorithm in the present invention allows the payer to transfer virtual currency to multiple payees in one transaction at the same time, while the user in HyperMaze needs to initiate multiple transactions when transferring cryptocurrency to multiple payees. Therefore, when the number of payees increases, the time cost of the technical solution of the present invention is significantly better than that of HyperMaze. The results of the initialization phase are as follows: Figure 6 As shown in Figure 2, the results of the payment phase are as follows: Figure 7 shown.

Claims

1. A conditional privacy protection transaction method in a UTXO-based multi-chain blockchain system, characterized in that: The following steps are involved: Step (1), first initialize the root blockchain, and then initialize each leaf blockchain independently; Get the following parameters of the root blockchain: hash function H: {0,1} * →{0,1} λ , Commitment scheme COM, Pseudo-random function PRF, Proof key and verification key in the registration phase Proof Key and Verification Key in the Coin Generation Phase Proof key and verification key in the payment phase Each leaf blockchain has an independent regulatory agency with a regulatory threshold of (n, t). The regulators in the same regulatory agency obtain the regulatory public key pk through a key sharing scheme and determine the maximum total transaction amount N of the user's anonymous transaction within the time period T through negotiation. limit and the total frequency V limit ; Step (2), user registration stage; the user first generates an identity certificate to obtain the user's unique identity ID and zero-knowledge proof π Register , private inputω Register , and then authenticated by any t regulators of the leaf blockchain; Step (3), generating virtual currency c, includes the generation of currency production certificate and verification by the verification agency. The specific method is as follows: The user first calculates and stores the one-time address addr, serial number cmsn and commitment cm of the virtual currency through random numbers ra, rs; then, the user generates a zero-knowledge proof π Produce , open input x Produce , and private input ω Produce ; Then the validator verifies the coin-producing transaction tx submitted by the user Produce If the verification is successful, the virtual currency commitment cm will be added to the leaf blockchain In the process, it is finally passed layer by layer to the root blockchain to form the root; Step (4), the stage of paying virtual currency, includes the generation of payment certificate and verification by the verification agency. The specific method is as follows: Step (4.1), assuming that the number of input virtual currency and output virtual currency of the payment transaction is 2, for k∈{1,2}, the user identity is id k The recipient of Calculate one-time addresses of virtual currencies and encrypted public key epk k , and the obtained epk k Send to payer Step (4.2), Payee use Calculate sequence number and commitment Generate new virtual currency Step (4.3), use The encrypted public key epk k right Encrypt and send the encrypted AES ciphertext Mh k and ECC ciphertext ch k Send to payer Step (4.5) for the cumulative recipient Total transaction amount and total number of times Users need to accumulate v old To V old , and N old Accumulate 1 and update the counter at the same time to get the new counter number ctsn new and commitment ctm new ; Step (4.6): To prevent the content of the payment transaction from being maliciously tampered with, the recipient Sign the transaction data and get the signature σ Send =(ρ,τ); Step (4.7), to prevent others from maliciously forging signatures, the recipient Bind signature public key pk sig and one-time addresses Get h1,h2; Step (4.8), Payee Generate zero-knowledge proof π Send , open input x Send and private inputω Send , through zero-knowledge proof π Send To prove the payment transaction tx Send effectiveness and compliance; Step (4.9), the validator receives the payment transaction tx Send After that, verify π Send and σ Send After the correctness of the query is verified, the Merkle tree and the sequence number set are updated; Step (5), receiving virtual currency, the user's payment Decrypt the received ciphertext Mh to obtain the complete virtual currency c; Step (6), tracing the suspicious transaction, and the regulatory agency restores the real user identity of the suspicious transaction.

2. The conditional privacy protection transaction method in the UTXO-based multi-chain blockchain system according to claim 1, characterized in that: In step (1), the root blockchain inputs the security parameter λ and selects an elliptic curve group of order q Points on the elliptic curve are defined in a finite field F p On, g is the group The generator of and define the hash function H:{0,1} * →{0,1} λ , define the commitment scheme COM and pseudo-random function PRF; then the root blockchain constructs the zero-knowledge proof circuit C Register ,C Produce ,C Send , using the key generation algorithm KeyGen(1 λ ,C) Obtain the certification key and verification key of the registration stage, coin production stage and coin payment stage; The regulators of the same regulator, where the regulatory threshold is (n, t), negotiate the regulatory public key pk through the secret sharing scheme as follows: Step 1), regulator Reg i Have a unique ID i , choose a t-1 order polynomial f i (x) = a i0 +a i1 x+……+a i(t-1) x t-1 mod q; where 1≤i≤n; Step 2), Reg i Calculate f i (ID i ) and f i (ID j ), f i (ID j )Send to Reg j , and broadcast it among the supervisors of the leaf blockchain Where 1≤j≤n and j≠i, w=0,1,……,t-1; Step (3), Reg j Receive {b sent by other n-1 supervisors iw }After verification Whether it is established to judge f i (ID j ) is valid, if not, reject f i (ID j ) and notify Reg i Recalculate and send; Step 4) Reg i Receive f from other n-1 supervisors j (ID i ) then you can calculate your own personal regulatory private key Thus, we can calculate And broadcast pk among the regulators of the leaf blockchain i ; Step 5) The regulator of the leaf blockchain can calculate the regulatory public key according to the Lagrange interpolation method. (in ), and disclose the supervision public key pk to the users of the leaf blockchain; Finally, the regulator will disclose T, V to all users of the corresponding leaf blockchain. limit , N limit .

3. The conditional privacy protection transaction method in the UTXO-based multi-chain blockchain system according to claim 1, characterized in that: The specific process of user registration in step (2) is as follows: Step (2.1), the user has a unique identity ID, select a random number Step (2.2), the user calculates the initial counter sequence number ctsn=PRF(id||rt) and the initial counter commitment ctm0=COM(id||ctsn||V0||N0); where V0 represents the transaction amount paid by the user, and N0 represents the transaction frequency paid by the user; Step (2.3), user generates zero-knowledge proof π Register , open input x Register =(id, ctm0), private input ω Register =(rt,ctsn),π Register Prove the following two equations: ctsn=PRF(id¨rt); ctm0=COM(id¨ctsn¨0¨0); The user will Register , x Register Sent to any regulator Reg of the leaf blockchain j ; Step (2.4), regulator Reg j Receive π sent by the user Register , x Register After that, first verify the zero-knowledge proof π Register The correctness of Register Correct, then continue to step (2.5); if π Register If it is incorrect, the authentication for the user will be refused; Step (2.5), regulator Reg j The regulatory agency needs to sign the threshold for ctm0 and id to get σ ctm and σ id ; Step (2.6), regulator Reg j (ctm0, σ ctm ) is sent to the validator, and σ id and σ ctm Send to user; Step (2.7), the validator adds ctm0 to the Merkle tree T with the counter commitment ctm as the leaf node ctm middle; Step (2.8), the user receives σ id and σ ctm Then verify the correctness of both.

4. The conditional privacy protection transaction method in a UTXO-based multi-chain blockchain system according to claim 3, characterized in that: The step (2.5) regulator Reg j The detailed process of the regulatory agency for threshold signing for ctm0 and id is as follows: Step 1), regulator Reg j Public disclosure of ctm0 within the regulatory body; Step 2), other regulators Regi select random numbers calculate And D i Send to the regulator Reg j ; Step 2), regulator Reg j Receive t-1 D i After that, t supervisors form a signature group Step 3), regulator Reg j calculate l = X0-e0 mod q; Step 4) Supervisor Calculate i =L(i)sk i l+d i mod q, and Internal disclosure i ; Step 5), regulator Reg j Aggregation i , generate a signature The step (2.8), user verification σ id and σ ctm The correctness process is as follows: the user calculates e0′=H(ctm0), X0′=l+e0′mod q, and uses the elliptic curve to calculate the corresponding Y0′ to obtain (X0′, Y0′); the user checks (X0′, Y0′)=g o / pk l Is it established? If it is established, it means the signature is correct. Otherwise, notify Reg j Recalculate.

5. The conditional privacy protection transaction method in the UTXO-based multi-chain blockchain system according to claim 1, characterized in that: The detailed process of step (3) is as follows: Step (3.1), the user first pays the equivalent value of other types of virtual currency to the hosting pool; then the user selects a random number Calculate the one-time address of the virtual currency addr = PRF (id || ra), serial number cmsn = PRF (addr || rs), commitment cm = COM (addr || cmsn || rs || v); Step (3.2), the user stores virtual currency c = (cm, addr, cmsn, rs, v) in the wallet; then generates zero-knowledge proof π Produce , open input x Produce =(cm, v), private input ω Produce =(id,addr,ra,rs,cmsn),π Mint Prove the following equations: addr = PRF(id||ra); cmsn = PRF(addr||rs); cm = COM(addr||cmsn||rs||v); Step (3.4), after the above three equations are successfully verified, the user submits the coin-producing transaction tx to the validator Produce =(π Mint , x Mint ); the validator receives tx Produce After that, verify π Produce After verifying the correctness of the virtual currency commitment cm, add it to the leaf blockchain and send the chain's parent chain's validator Root; Step (3.5), the parent chain validator collects the tree root sent by the child chain and uses the tree root as the parent chain The leaves of the chain construct a similar Merkle tree and send the new tree root to the parent chain of the parent chain, and pass it layer by layer to the root blockchain. In the middle, root is formed.

6. The conditional privacy protection transaction method in a UTXO-based multi-chain blockchain system according to claim 1, characterized in that: Step (4) The recipient The method to calculate the one-time address and encrypted public key is: Select random number Calculating one-time addresses Choose a random number Choose a random number As the encrypted private key, calculate the encrypted public key Payee Select random number use of Calculate sequence number promise Generate new virtual currency Payee use The encrypted public key epk k right The detailed method for encryption is: first use the AES key mh k right Encrypt and obtain Mh k ; Reuse The encrypted public key epk k To mh k Encrypt and select a random number calculate User accumulated v old To V old , and N old Accumulate 1 and update the counter at the same time: Select Calculate the new counter number ctsn new =PRF(id||rt new ), new counter commitment ctm new =COM(id||ctsn new ||V new ||N new ); Payee Sign the transaction data, and let the data to be signed be In the above formula, root ctm It is T ctm The root, root1, root2 are The extended Merkle tree The root, It is an old virtual currency Serial number, It is a new virtual currency The promise, pub It is public, which means that a certain amount in the transaction is converted into other types of cryptocurrencies such as Bitcoin. Users can also set v pub =0, info represents the conversion address of cryptocurrency such as Bitcoin wallet public key, ctsn old is the serial number of the old counter, ctm new is the commitment of the new counter, and the signing process is: Step 1) choose Calculate signature public key Step 2) Calculate e = H (mu), (X, Y) = g ru , let ρ = X mod p, if ρ = 0, reselect ru; Step 3) Calculate τ = rk -1 (e+sk sig *ρ) mod p, we can get the signature σ Send =(ρ, τ); Payee Calculate h sig =H(pk sig ), Bind signature public key pk sig With one-time addresses x Send The expression is: Private Inputω Send The expression is: Tπ Send The specific process of proving the correctness of the parameters is: Step (a) Regarding old virtual currency π Send Prove the following statement: root k =EMT(path k ) Step (b) Regarding New Virtual Currency π Send Prove the following statement: Step (c), about tx Send The effectiveness of π Send Prove the following statement: v old =v new +v pub π Send The specific process of proving parameter compliance is: Step (a), about tx send Compliance, π Send Prove the following statement: root ctm =MT(path ctm ) V new =V old +v old N new =N old +1 ctsn old =PRF(id||rt old ) ctm old =COM(id||ctsn old ||V old ||N old ) ctsn new =PRF(id||rt new ) ctm new =COM(id||ctsn new ||V new ||N new ) Step (b), if tx Send The transaction amount and transaction frequency do not exceed the limit, π Send Prove the following statement: V new ∈[0,V limit ]; N new ∈[0,N limit ]; Submit coin transaction tx Send =(π Send , x Send ,info,pk sig , σ Send ); if the transaction amount or transaction frequency exceeds the limit, Use the supervisory public key pk pair (id||σ id ) is encrypted to obtain (Md, cd), and tid is added to x Send In (id, σ id ) Join Send and prove the following statement: tid=H(id||σ id ); Submit coin transaction tx Send =(π Send , x Send ,info,pk sig , σ Send , Md, cd); Ultimately, if the transaction meets regulatory criteria, the validator will ctm new Join T ctm In the old Add to the counter sequence number set and Join In Add to the virtual currency serial number collection; If the transaction does not meet regulatory criteria, the validator sends tx Send Give the regulator a way to trace its true identity.

7. The conditional privacy protection transaction method in the UTXO-based multi-chain blockchain system according to claim 5, characterized in that: The step (b) uses the supervisory public key pk to (id||σ id )The encryption process is: Payee Use the AES key md pair (id||σ id ) is encrypted to obtain Md; Use the regulatory public key pk to encrypt md and select a random number Calculate cd = (cd1, cd2) = (g rd ,md*pk rd ).

8. The conditional privacy protection transaction method in a UTXO-based multi-chain blockchain system according to claim 1, characterized in that: Validator Verification σ Send =(ρ, τ) is as follows: calculate calculate Finally, the verifier checks whether X′ is equal to ρ. If so, the signature is correct.

9. The conditional privacy protection transaction method in the UTXO-based multi-chain blockchain system according to claim 1, characterized in that: The specific process of receiving virtual currency in step (5) is as follows: Step (5.1), After receiving the AES ciphertext Mh and ECC ciphertext ch, use the encrypted private key esk to decrypt Mh. The decryption process is: calculate Get the AES key mh′; then use mh′ to perform AES decryption on Mh to obtain (cmsn||rs||v); Step (5.2), Obtain virtual currency c = (cm, addr, cmsn, rs, v).

10. The conditional privacy protection transaction method in a UTXO-based multi-chain blockchain system according to claim 1, characterized in that: In step (6), any t regulators of the leaf blockchain trace the identity of the transaction that violates the regulatory criteria. The t regulators are hereinafter referred to as the regulatory team. The tracing process is: Oversight Group Members calculate and in Internal broadcast ss i ;Reg calculation Get the AES key md′; Regi uses md′ to perform AES decryption on Md and obtain (id||σ id ), by verifying the signature σ id The effectiveness of Reg i Determine whether the user is a registered legitimate user.

Images