A method for implementing joint supervision of distributed anonymous transactions

Abstract

The application discloses a kind of distributed anonymous transaction methods for realizing joint supervision, specifically: system initialization is carried out: signature is generated for supervisor and supervisory public and private key, signature public key and supervisory public key are disclosed, and supervisory private key is sent to corresponding supervisor by multiple shares;User carries out identity authentication: user generates long-term public key, and uses real identity and long-term public key to register supervisor and obtain long-term certificate, user generates anonymous public key using long-term public key, and applies anonymous certificate to supervisor using anonymous public key;Transaction: transaction sender generates transaction using the anonymous public key of both parties of transaction, and sends transaction to verification node;Verification: after receiving transaction, verification node verifies the validity of transaction, and packs the transaction that passes verification into block and is chained.The application enhances the anonymity of user in the process of transaction, while avoiding the limitations that supervisor must verify, effectively dispersing supervisory power, preventing the concentration and abuse of power.

Description

Technical Field

[0001] This invention belongs to the field of blockchain, and in particular relates to a distributed anonymous transaction method for achieving joint supervision. Background Technology

[0002] Blockchain technology, with its core characteristics of decentralization, immutability, and high transparency, has rapidly attracted widespread attention and in-depth research from academia and industry since its initial conception. As a prominent application of blockchain technology, cryptocurrency has spawned a large and continuously expanding market. However, it faces numerous challenges in protecting user privacy and strengthening regulation.

[0003] First, many existing regulatory schemes rely on a single trusted third party for oversight, leading to an excessive concentration of power. In the absence of effective checks and balances, regulatory agencies may arbitrarily infringe upon users' privacy rights, accessing their private information without authorization, thus increasing the risk of data misuse and leakage. DAPCR has designed a mechanism for allocating regulatory authority, decomposing authority and assigning it to two independent entities. This design effectively reduces the risk of power abuse because neither entity can independently decode transaction content to access transaction privacy. However, this regulatory model also suffers from a single point of failure. If one entity fails, the entire regulatory function will malfunction.

[0004] Secondly, some anonymity schemes impose the additional requirement that regulators simultaneously fulfill regulatory responsibilities. When validating a user's identity, validators need to recover the long-term public key from the user's anonymous public key, and determine the user's identity based on the validity of the long-term public key. Only regulators have the right to recover the user's long-term public key, so they need to act as validators to complete the verification work. However, this setup may lead regulators to neglect their regulatory responsibilities in order to quickly obtain block rewards, thereby reducing the efficiency of monitoring and verifying transactions. More seriously, regulatory bodies acting as regulators may become prime targets for attackers, as they control transaction verification and block generation. This will make the system more vulnerable to targeted attacks such as Sybil attacks and bribery attacks, further exacerbating the system's security risks. Therefore, how to design an efficient, secure, and regulatory cryptocurrency system has become an urgent technical problem to be solved. Summary of the Invention

[0005] Purpose of the invention: In order to solve the problems existing in the prior art, the present invention provides a distributed anonymous transaction method for achieving joint supervision.

[0006] Technical solution: This invention discloses a distributed anonymous transaction method for achieving joint supervision, specifically as follows:

[0007] Initialization: Randomly select an elliptic curve and obtain the generator P and the order q of the elliptic curve;

[0008] Generate signature public-private key pairs (K) for regulators s ,k s ) and regulatory public-private key pairs (K R ,k R ); K s For the signing public key, k s For the signing private key, K R For the regulatory public key, k R The private key is for oversight; the public key for signing and the public key for oversight are public, and the private key for signing is k. s The private key is sent to each regulator via a secure channel; the regulator's private key is divided into n private key shares s. i And send it to the corresponding regulator, i = 1, 2, ..., n; n is the total number of regulators;

[0009] User registration: Before a user enters the system, a long-term public-private key pair (K,k) is generated for the user, where K is the long-term public key and k is the long-term private key; the supervisor applies for a long-term certificate for the user based on the user's ID and long-term public key, and adds it to the long-term certificate sequence;

[0010] Pre-transaction identity verification: based on (K,k) and K R An anonymous public key AK is generated for the user. The user sends the anonymous public key AK to the regulator. The regulator uses the anonymous public key AK to authenticate the user's identity. If the authentication is successful, the regulator uses the signing private key to generate an anonymous certificate for the anonymous public key AK.

[0011] Transaction authentication: The initiator of the transaction generates a transaction (tx) using their own anonymous public key and the anonymous public key of the transaction recipient, and puts the AK's anonymous certificate into the transaction tx. The transaction tx is then sent to the verification node. After receiving the transaction, the verification node verifies the validity of the transaction. If the verification passes, the transaction is packaged into a block and uploaded to the blockchain.

[0012] Furthermore, the relationship between the oversight public key and the oversight private key is as follows: K R =k R P, the relationship between the public key K and the private key k during the user registration phase is: K = kP.

[0013] Furthermore, in step 1, the Shamir threshold secret sharing algorithm is used to divide the supervisory private key into n private key shares s. i Specifically: Set a threshold value t, and select t-1 random numbers a1, a2, a3, ..., aq in the finite field GF(q). t-1 Then, the i-th private key share s is generated according to the following formula. i :

[0014] s i =(i,y i )

[0015] Among them, y i =k R +a1i+a2i 2 +…+a t-1 i t-1 (mod q).

[0016] Furthermore, regulators authenticate user identities using the anonymous public key AK, specifically as follows:

[0017] Step 1: Randomly select w hunters, and then randomly select one hunter from among the w hunters, denoted as Hunter R. main Regulator R main Determine if the user's long-term certificate is in the long-term certificate sequence. If it is, proceed to step 2 to continue authentication; otherwise, terminate authentication.

[0018] Step 2: Each supervisor calculates the verification code u separately. i’ :

[0019]

[0020] Where i' is the i'th regulator among w regulators, i' = 1, 2, ..., w, j represents the jth regulator among w regulators, B1 is an element in AK, B1 = bK, b is a random number selected in the finite field GF(q);

[0021] Step 3: w regulators will send their own verification codes u i’ Send to regulator R main Regulator R main Calculate the user's long-term public key K': K' = B2 - ∑u i’ Determine if K' and K are equal. If they are equal, authentication is successful; otherwise, authentication terminates. B2 is an element in AK, and B2 = bkK. R +K.

[0022] Furthermore, the method also includes tracking user identity. When regulator A discovers that a user has engaged in malicious transaction behavior, the regulator broadcasts this behavior to other regulators. When t regulators all determine that the user has engaged in malicious behavior, the t regulators calculate the corresponding verification code according to step 2 and send the verification code to regulator A. Regulator A calculates the user's long-term public key, then adds the user's long-term public key and ID to the blacklist, revokes the user's permissions, and sets the status of all of the user's certificates to invalid.

[0023] Furthermore, during the pre-transaction identity authentication, an anonymous public key AK is generated according to the following formula:

[0024] AK = (B1, B2)

[0025] Where B1 = bK, B2 = bkK R +K, where b is a random number selected in the finite field GF(q).

[0026] Furthermore, during the user registration phase, when regulators generate long-term certificates for users, they need to determine whether the user is on a blacklist based on the user's public key and ID. If the user is on a blacklist, the registration will be terminated.

[0027] Furthermore, transaction authentication involves verifying the validity of a transaction, including verifying the initiator of the transaction and verifying the transaction itself.

[0028] The verification of the initiator of the transaction specifically involves the verification node obtaining the anonymous certificate in the transaction and using the signing public key to verify the signing private key on the anonymous certificate.

[0029] Beneficial effects:

[0030] Efficient Verification: The two-layer certificate mechanism employed in this invention greatly simplifies the verification process for user identity legitimacy. Compared to traditional solutions, it eliminates the need for regulators, thereby improving regulatory efficiency, reducing the risk of system attacks, and preventing regulators from neglecting their regulatory responsibilities in pursuit of quick block rewards.

[0031] Joint oversight: This invention distributes oversight power through a secret sharing algorithm, ensuring that only joint action by oversight bodies that reach a threshold can restore a user's identity. This effectively prevents abuse of power and enhances the system's fairness and transparency.

[0032] Preventing single points of failure: By splitting the regulator's private key, even if some nodes fail, as long as the number of normal nodes exceeds a threshold, the system can still perform regulatory tasks normally, ensuring the stability and reliability of the system and ensuring that the real identity of malicious users can be recovered and they can be punished accordingly. Attached Figure Description

[0033] Figure 1 This is a flowchart of the present invention;

[0034] Figure 2 This is a schematic diagram of the two-layer certificate mechanism in this invention;

[0035] Figure 3 This is a schematic diagram of the joint supervision mechanism in this invention. Detailed Implementation

[0036] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0037] like Figure 1 As shown, the present invention specifically comprises:

[0038] The system initializes:

[0039] An elliptic curve is randomly selected for the regulator by a trusted third party, where P is the generator of the elliptic curve and q is the order of the elliptic curve.

[0040] Trusted third parties generate and distribute signed public-private key pairs, as well as regulate public-private key pairs.

[0041] Generating and distributing signature public-private key pairs for regulators includes: randomly generating signature public-private key pairs (K... s ,k s ), and sign the public key K s Make it public, and share the signing private key k s Send to various regulators via a trusted channel;

[0042] Generating and distributing regulatory public-private key pairs for regulators includes: randomly generating regulatory public-private key pairs (K... R ,k R ), where K R =k R P will supervise the public key K. R To publicly disclose the power of the regulators, the Shamir threshold secret sharing algorithm is used to divide the registrant's private key into n shares equal to the total number of regulators, thereby distributing the regulators' power. Specifically:

[0043] Set the threshold value to t, and select t-1 random numbers a1, a2, a3, ..., a... from the finite field GF(q). t-1 Construct the following inequality:

[0044] f(x) = k R +a1x+a2x 2 +…+a t-1 x t-1 (mod q)

[0045] The set of regulators is represented as {R1, R2, ..., R...} n}, calculate y i =f(i),s i =(i,y i (i∈n), the private key share s i Send to regulator R respectively i save.

[0046] Identity verification:

[0047] Before entering the system, users need to generate a long-term public-private key pair (K, k), where K represents the long-term public key and k represents the long-term private key; where K = kP; and send K and their real identity information ID to the regulator for registration.

[0048] After receiving a user's registration application, the regulator checks whether the user's K and ID are on the blacklist. If not, the regulator approves the application, generates a long-term certificate for the user, and sends the long-term certificate to the user, indicating that the user has obtained access to the system. The regulator then adds the long-term certificate to the long-term certificate sequence.

[0049] like Figure 2 As shown, before a user wants to conduct a transaction, they need to use the registered long-term public key K and the regulator's public key K. R Generate an anonymous public key AK using random numbers; multiple AKs can be generated from the same K.

[0050] AK = (B1, B2)

[0051] Where B1 = bK, B2 = bkK R +K; b represents a random number selected in the finite field GF(q).

[0052] The user sends the AK to the regulator to apply for an anonymity certificate, specifically:

[0053] like Figure 3 As shown, w hunters are randomly selected, and then one hunter is randomly chosen from these w hunters, denoted as hunter R. main Regulator R main Determine if the user's long-term certificate is in the long-term certificate sequence; if not, terminate authentication; otherwise, continue authentication. Each of the w regulators calculates its own verification code. Where i' represents the i'-th hunter among w hunters, i' = 1, 2, ..., w, and j represents the j-th hunter among w hunters; the w hunters will calculate u i’ Send to R main R main Calculate B2-∑u i =B2-k R B1 = K'. The regulators check if K' is equal to K. If they are equal, the anonymous public key was indeed generated by K, and the verification is successful. Then, the regulators use the signing private key to generate an anonymous certificate for the anonymous public key AK.

[0054] trade:

[0055] Users conduct transactions using the anonymous public key generated during the authentication phase. The initiator of the transaction requests the anonymous public key from the recipient.

[0056] The transaction initiator generates the transaction (tx) using the anonymous public keys of both parties. The initiator then includes their own anonymous certificate in the transaction. Finally, the transaction is sent to the validator node.

[0057] Transaction verification

[0058] After receiving a transaction from a user, the verification node needs to verify the validity of the transaction, which is specifically divided into verifying the legitimacy of the user's identity in the transaction and verifying the validity of the transaction itself.

[0059] First, the legitimacy of the user's identity needs to be verified. The verification node obtains the anonymous certificate in the transaction and uses the signing public key to verify the validity of the certificate (verifying the signing private key in the anonymous certificate through the signing public key). If the verification passes, the validity of the transaction itself is verified; otherwise, the transaction is discarded.

[0060] Next, the validity of the transaction itself is verified, checking whether the transaction was generated correctly. This validity verification includes verifying the transaction format and whether the transaction initiator's account balance is sufficient.

[0061] Verified transactions will be packaged into blocks, and after PBFT consensus is reached by multiple regulators, they will be uploaded to the blockchain.

[0062] Tracking user identity

[0063] When regulator A in the blockchain discovers malicious behavior from a user (the initiator of a transaction) (this malicious behavior is pre-set, such as making a large transaction within a specified time, or dividing a large amount of currency into smaller amounts and distributing them to the transaction recipient within a short period), regulator A broadcasts this malicious behavior to other regulators. These other regulators verify the malicious user's illegal behavior. When more than t regulators have verified that the user has indeed engaged in malicious behavior, these regulators will jointly recover the user's true identity using their respective regulatory private key shares. Specifically, the participating regulators calculate their own verification code u. i’ The verification code is then sent to supervisor A. Supervisor A recovers the user's long-term public key, adds the malicious user's long-term public key K and ID to the blacklist, revokes the user's permissions, and sets all of the user's certificates to invalid.

[0064] It should also be noted that the various specific technical features described in the above embodiments can be combined in any suitable manner without contradiction. To avoid unnecessary repetition, the present invention will not describe the various possible combinations separately.

Claims

1. A method for achieving joint supervision of distributed anonymous transactions, characterized in that, Specifically: Initialization: Randomly select an elliptic curve, obtain the generator P of the elliptic curve and the order of the elliptic curve. ; Generate public-private key pairs for regulators to sign. and the regulation of public and private key pairs ; For the signature public key, For signing private key, For the supervision of public keys, The monitoring public key is used for oversight; the signing public key and the monitoring public key are made public, and the signing private key is used for oversight. The private key is sent to each regulator via a secure channel; the regulator's private key is then divided into n private key shares. And send it to the corresponding regulator, i=1,2,…,n; n is the total number of regulators; User registration: A long-term public-private key pair is generated for each user before they log into the system. , For long-term public keys, This is a long-term private key; the regulator applies for a long-term certificate for the user based on the user's ID and long-term public key, and adds it to the long-term certificate sequence; Pre-transaction identity verification: based on and Generate anonymous public keys for users The user will anonymously use the public key. Send it to the regulator, who then uses an anonymous public key. The user's identity is authenticated. If the authentication is successful, the regulator uses the signing private key as the anonymous public key. Generate an anonymous certificate; Transaction authentication: The initiator of the transaction uses their own anonymous public key and the anonymous public key of the transaction recipient to generate the transaction (tx), and then... The anonymous certificate is placed in the transaction (tx), and the transaction (tx) is sent to the verification node. After receiving the transaction, the verification node verifies the validity of the transaction. If the verification passes, the transaction is packaged into a block and uploaded to the blockchain. Regulators use anonymous public keys The specific steps for authenticating user identity are as follows: Step 1: Randomly select w hunters, and then randomly select one hunter from among these w hunters, denoted as the hunter. regulators Determine if the user's long-term certificate is in the long-term certificate sequence. If it is, proceed to step 2 to continue authentication; otherwise, terminate authentication. Step 2: Each regulator calculates the verification code separately. : ； in, The first of w regulators One regulator, j represents the first of w regulators. One regulator, for The elements in b is a random number selected in the finite field GF(q); Step 3: w regulators will send their own verification codes. Send to regulators regulators Calculate the user's long-term public key : ;judge Check if it is equal to K. If they are equal, the authentication is successful; otherwise, the authentication is terminated. for The elements in .

2. The distributed anonymous transaction method for achieving joint supervision according to claim 1, characterized in that, The relationship between the oversight public key and the oversight private key is as follows: Public key during user registration and private key The relationship between them is: .

3. The distributed anonymous transaction method for achieving joint supervision according to claim 1, characterized in that, In step 1, the Shamir threshold secret sharing algorithm is used to divide the supervisory private key into n private key shares. Specifically: set a threshold value t, and select t-1 random numbers in the finite field GF(q). Then, the i-th private key share is generated according to the following formula. : ； 。 4. A distributed anonymous transaction method for achieving joint supervision as described in claim 1, characterized in that... The method also includes tracking user identity. When regulator A discovers that a user has engaged in malicious transaction behavior, the regulator broadcasts this behavior to other regulators. When t regulators all determine that the user has engaged in malicious behavior, the t regulators calculate the corresponding verification code according to step 2 and send the verification code to regulator A. Regulator A calculates the user's long-term public key, then adds the user's long-term public key and ID to the blacklist, revokes the user's permissions, and sets the status of all of the user's certificates to invalid.

5. A distributed anonymous transaction method for achieving joint supervision according to claim 1, characterized in that... An anonymous public key is generated during pre-transaction identity verification according to the following formula. : ； in, , b is a random number selected in the finite field GF(q).

6. A distributed anonymous transaction method for achieving joint supervision according to claim 1, characterized in that, During the user registration process, when regulators generate long-term certificates for users, they need to determine whether the user is on a blacklist based on the user's public key and ID. If the user is on a blacklist, the registration will be terminated.

7. A distributed anonymous transaction method for achieving joint supervision according to claim 1, characterized in that... Transaction authentication is the verification of the validity of a transaction, which includes the verification of the initiator of the transaction and the verification of the transaction itself. The verification of the initiator of the transaction specifically involves the verification node obtaining the anonymous certificate in the transaction and using the signing public key to verify the signing private key on the anonymous certificate.

Images