On-chain transaction data privacy protection method based on zero knowledge proof

Abstract

The invention relates to the technical field of data processing, in particular to an on-chain transaction data privacy protection method based on zero knowledge proof. The method comprises the following steps: collecting transaction data and types thereof; after random values are generated for two transaction parties, a hash value of an account is obtained through a secret key conversion protocol in combination with the random values, and a transaction graph is formed by fund exchange between the hash value and the account parties; constructing transaction weights of the nodes based on a node relationship in the transaction graph, and obtaining transaction closeness coefficients of the two nodes in combination with the number of the nodes; obtaining an adjustment weight according to the difference between the transaction closeness coefficients of the current moment and the historical moment and the proportion of the transaction closeness coefficients of the individual transaction and the overall transaction at the current moment; and adjusting the information amount based on the adjustment weight to determine a polynomial so as to realize privacy protection. According to the application, the calculation complexity of zero-knowledge proof is reduced, and the efficiency of on-chain transaction is improved.

Description

Technical Field

[0001] This application relates to the technical field of data processing, and specifically relates to a method for protecting the privacy of on-chain transaction data based on zero-knowledge proof. Background Art

[0002] With the rapid development of blockchain technology, it has shown great application potential in many fields such as finance and supply chain management. One of the core features of blockchain is its decentralization and immutability, which provides a solid foundation for data security and transparency. However, this publicly transparent feature also brings privacy protection problems. Especially in the financial transaction scenario, users' transaction information is exposed to the public eye, which poses a serious threat to personal privacy. Therefore, various privacy protection methods have been tried to be introduced into the blockchain. Among them, zero-knowledge proof is a privacy protection method with good application prospects.

[0003] Zero-knowledge proof aims to ensure the privacy of data. It only allows one party to prove to another party that a certain statement is correct without revealing any additional information other than the correctness of the statement. Although this effectively protects users' privacy, it also brings great difficulties to the supervision of the transaction process. In the existing technology, during supervision, the trading parties need to encrypt the transaction details and generate a decryption key to send to the supervisor to ensure the supervision of the transaction process. However, these methods introduce additional confidentiality means on the basis of zero-knowledge proof, increasing the burden on the system and seriously affecting the transaction efficiency. The existence of these problems limits the wide application of zero-knowledge proof in actual on-chain transactions. Therefore, how to improve the transaction efficiency on the premise of ensuring on-chain data privacy and regulatory compliance has become an important research direction. Summary of the Invention

[0004] In order to solve the technical problem of efficient transactions while protecting privacy, this application provides a method for protecting the privacy of on-chain transaction data based on zero-knowledge proof. The specific technical solutions adopted are as follows: This application proposes a method for protecting the privacy of on-chain transaction data based on zero-knowledge proof. The method includes the following steps: Collect transaction data and its types; the transaction data includes accounts, transaction amounts, transaction times, and transaction frequencies. Generate random values for both trading parties, convert the random values into authentication values through a key exchange protocol; calculate the hash values of both trading parties according to the random values of both trading parties and corresponding different authentication values; use each hash value as a node to form a directed subgraph based on the positive or negative of the transaction amount; form a transaction graph by all directed subgraphs. In the transaction graph, all the nodes connected to each node form a transaction set; the transaction weight of each node in the transaction set is obtained according to the weight of the directed edge; the transaction closeness coefficient between two nodes is obtained based on the number of identical nodes in the two-node transaction sets and the transaction weights of the identical nodes. The adjusted weight of this transaction is obtained according to the ratio of the difference between the transaction closeness coefficients of the two nodes corresponding to this transaction at the current moment and in history to the transaction closeness coefficient of the two nodes corresponding to a transaction at the current moment among all transaction closeness coefficients. The information amount is adjusted based on the adjusted weight corresponding to each transaction; a polynomial commitment is generated using zero-knowledge proof based on the adjusted information amount, and the polynomial commitment is sent to the verifier for verification to achieve privacy protection.

[0005] In the above solution, this application first needs to notify the regulatory agency, and the regulatory agency calculates the adjusted weight, achieving two purposes. One is to achieve the supervision of transactions, and the other is that since the regulatory agency conducts verification based on the secrets shared by both trading parties, identity verification is achieved; then a transaction graph is generated according to the transaction situation among each account on the chain, and then the transaction closeness coefficient is calculated using the transaction graph, which helps to improve the regulatory ability of the regulatory agency for transactions and achieve the quantification of transaction situations, and the information amount of the subsequent zero-knowledge proof is adjusted according to the transaction situation; finally, the adjusted weight of the zero-knowledge proof is calculated to achieve the quantification of the adjustment of the zero-knowledge proof information amount. In this way, the regulatory agency's supervision of the on-chain transaction process is achieved, and the information amount of the zero-knowledge proof is adaptively adjusted according to the transaction situation and the closeness of the connection between the two trading parties, reducing the computational complexity of the zero-knowledge proof and improving the efficiency of on-chain transactions, thereby achieving an efficient and supervisable on-chain transaction data privacy protection method based on zero-knowledge proof.

[0006] In one embodiment, the method for obtaining the hash value is as follows: One of the accounts of the two trading parties is recorded as the target account, and the random value of the target account and the identity verification value of the other account are assigned to the target account. The hash value of the target account is obtained through the random value of the target account and the identity verification value of the other account by using a hash algorithm.

[0007] In one embodiment, the directed subgraph is a directed graph formed from one node of the two trading parties to the other node, and the direction is from the node with a positive transaction amount to the node with a negative transaction amount.

[0008] In one embodiment, the weight on the directed edge in the transaction graph is the total frequency of all transactions with the same transaction amount direction between the two accounts.

[0009] In one embodiment, in a transaction set, the sum of the weights of the directed edges between any node and the corresponding node of the transaction set is the transaction weight of the any node.

[0010] In one embodiment, the transaction tightness coefficient is positively correlated with the number of identical nodes and the transaction weights of the identical nodes in the transaction sets of two nodes respectively.

[0011] In one embodiment, the adjustment weight is positively correlated with the proportion of the transaction tightness coefficient of two nodes at the current moment in all transaction tightness coefficients, and negatively correlated with the difference between the transaction tightness coefficients of two nodes at the current moment and in history.

[0012] In one embodiment, the expression of the adjustment weight is: , , respectively represent the th and the th transaction tightness coefficients between two nodes corresponding to the represents the number of transactions generated at the current moment, represents the mean value of the transaction tightness coefficients of historical transactions between two nodes corresponding to the th transaction, is a normalization function, represents the adjustment weight of the zero-knowledge proof of the th transaction at the current moment.

[0013] In one embodiment, the method for adjusting the amount of information based on the adjustment weight corresponding to each transaction is: , represents the initial amount of information, represents the adjustment weight, represents the adjusted amount of information.

[0014] In one embodiment, the initial amount of information is the types of all transaction data: The beneficial effects of this application are: This application first needs to notify the regulatory agency, and the regulatory agency calculates the adjusted weight, achieving two purposes. One is to achieve the supervision of transactions, and the other is to achieve identity verification because the regulatory agency conducts verification based on the secrets shared by both parties to the transaction. Then, a transaction graph is generated based on the transaction situations among the accounts on the chain, and then the transaction tightness coefficient is calculated using the transaction graph, which helps to improve the regulatory agency's supervision ability of transactions and achieve the quantification of transaction situations. Subsequently, the adjusted weight of the zero-knowledge proof is calculated to achieve the quantification of the adjustment of the zero-knowledge proof information amount. In this way, the regulatory agency's supervision of the on-chain transaction process is achieved, and the zero-knowledge proof information amount is adaptively adjusted according to the transaction situations and the closeness of the connection between the two parties to the transaction, reducing the computational complexity of the zero-knowledge proof and improving the efficiency of on-chain transactions, thereby realizing an efficient and supervisable on-chain transaction data privacy protection method based on zero-knowledge proof. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] To more clearly illustrate the technical solutions and advantages in the embodiments of the present application or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0016] Figure 1 A flowchart of an on-chain transaction data privacy protection method based on zero-knowledge proof provided by an embodiment of the present application; Figure 2 A directed subgraph of a transaction. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0017] To further elaborate on the technical means and effects adopted by the present application to achieve the intended invention purpose, the following, in combination with the drawings and preferred embodiments, details the specific implementation manners, structures, features, and effects of an on-chain transaction data privacy protection method based on zero-knowledge proof proposed according to the present application. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. In addition, the specific features, structures, or characteristics in one or more embodiments can be combined in any suitable form.

[0018] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the technical field to which this application belongs.

[0019] An embodiment of an on-chain transaction data privacy protection method based on zero-knowledge proof: The following specifically describes the specific solution of a method for protecting the privacy of on-chain transaction data based on zero-knowledge proof in conjunction with the accompanying drawings.

[0020] Please refer to Figure 1 , which shows a flowchart of a method for protecting the privacy of on-chain transaction data based on zero-knowledge proof provided by an embodiment of the present application. The method includes the following steps: Step S001, collect transaction data and its types.

[0021] In the present application, the following entities are mainly involved in the method for protecting on-chain privacy data based on zero-knowledge proof: the regulatory agency, which is responsible for supervising the transaction process to avoid the occurrence of illegal transactions; the trading account, which is the entity conducting the transaction; the blockchain, which records all transaction data on the blockchain. However, for privacy protection, the corresponding transaction data is the information for transaction verification using zero-knowledge proof, and does not include any specific transaction data.

[0022] The regulatory agency obtains all transaction data from the blockchain. In this embodiment, it includes the account, transaction amount, transaction time, and transaction frequency. The unit of transaction time is seconds. Among them, the transaction amount is transformed into positive or negative according to the transaction type. When the transaction is a credit, the corresponding transaction amount is positive, and when the transaction is a debit, the corresponding transaction amount is negative. The positive or negative sign in front of the transaction amount only indicates the movement direction of the transaction amount, and does not represent the magnitude of the data value.

[0023] So far, all transaction data has been obtained.

[0024] Step S002, after generating random values for both trading parties, obtain the hash value of the account through the secret key conversion protocol in combination with the random values, and form a transaction graph with the fund transactions between the two parties of the account.

[0025] Zero-knowledge proof has shown great advantages in protecting the privacy of on-chain data in the blockchain, which can ensure the security of on-chain data, thus making up for the shortcomings of blockchain technology. However, when applying zero-knowledge proof to on-chain transactions, the high-security feature demonstrated by zero-knowledge proof has also become a shortcoming of this technology. From the perspective of transaction protection and supervision, it is necessary to supervise and verify on-chain transaction data to avoid the occurrence of illegal transactions. According to the characteristics of the blockchain, all operations need to be stored and publicly disclosed on the chain, and these supervision information will reveal some transaction details, resulting in a certain degree of privacy leakage of transaction data. In order to solve the supervision problem, the existing technology will introduce additional confidentiality means, but this has seriously affected the efficiency of on-chain transactions. Therefore, it is necessary to achieve efficient on-chain transactions.

[0026] First, the regulatory agency authenticates both parties to the transaction according to the Diffie-Hellman key exchange protocol, and then sends the random value and the authentication value to each account; each account constructs a hash value using the corresponding random value and authentication value, takes each account as a node, generates a transaction graph, and the value of the node in the transaction spectrum graph is the hash value of the corresponding account. The transaction amount movement direction between two nodes is used as the edge to construct a directed transaction graph; the transaction tightness coefficient between any two nodes is calculated using the transaction graph.

[0027] Specifically, in order to ensure that the regulatory agency can supervise the transaction process, the regulatory agency needs to be involved in the transaction process. Therefore, the regulatory agency is involved in the generation of the transaction graph, and the transaction process can be monitored through the transaction graph. So the regulatory agency generates random values for both parties to the transaction and generates authentication values according to the Diffie-Hellman key exchange protocol. The Diffie-Hellman key exchange protocol is a well-known technology and will not be elaborated in this embodiment.

[0028] For the transaction between any two accounts, the regulatory agency generates random values for the two accounts respectively, and obtains their authentication values through the key exchange protocol for the random values respectively. One account is recorded as the target account, and the random value of the target account and the authentication value of the other account are given to the target account, and a hash value is calculated based on the two as a node; through the positivity and negativity of the transaction amount, the transaction direction between the two accounts is obtained, and thus the directed subgraph of the two accounts in this transaction is obtained, as Figure 2 shown.

[0029] Preferably, in this embodiment, taking account u and account v as examples, the random values of the two are denoted as and , and the keys obtained by the two random values through the key exchange protocol are and , where is the generator of the finite cyclic group and its value is a constant; then the regulatory agency sends and to account , and sends and to account . For account u, calculate the hash value through and to get ; for account v, calculate the hash value through and to get . Figure 2 In, the directed edge from U to V represents that the transaction amount movement direction is from the account to transfer to the account , that is, the account makes an outgoing payment, and the account receives an incoming payment.

[0030] Furthermore, the regulatory agency obtains a directed sub-graph for each transaction from historical transaction data, merges the same nodes in all the directed sub-graphs, and the weight on the directed edge is the total frequency of all transactions with the same direction of the transaction amount movement between two accounts, thereby constituting a transaction graph of all on-chain transactions.

[0031] Thus far, the transaction graph composed of all transactions has been obtained.

[0032] Step S003: Construct the transaction weight of the nodes based on the node relationships in the transaction graph, and obtain the transaction closeness coefficient of two nodes in combination with the number of nodes.

[0033] Since the weakness of the Diffie-Hellman key exchange lies in its inability to resist man-in-the-middle attacks, and in this application, the Diffie-Hellman key exchange is used for the generation of the transaction graph without involving a man-in-the-middle, thus when subsequently using the Diffie-Hellman key exchange to verify the authenticity of the identities of the two trading parties, man-in-the-middle attacks can be avoided; and by using the parameters generated by the Diffie-Hellman key exchange to obfuscate the nodes of the transaction graph, privacy leakage of on-chain transaction data is also avoided.

[0034] For each node in the transaction graph, all the nodes connected to this node form the transaction set of this node, and the sum of the weights of the directed edges between any node in the transaction set and this node is the transaction weight of any node. The transaction weights of each node in the transaction set are obtained based on this method.

[0035] For example, for a node s, all the nodes connected to node s form the transaction set of node s, and the nodes in this transaction set have a transaction weight of the node which is the sum of the weights of the directed edges between it and node s.

[0036] For any two nodes, the transaction closeness coefficient of the two nodes is constituted by the number of nodes that are the same for the two nodes and the transaction weights of the same nodes. The transaction closeness coefficient is positively correlated with the number of nodes that are the same for the two nodes and the transaction weights of the same nodes respectively.

[0037] It should be noted that positive correlation means that when one variable increases, the other variable also increases, and the two variables change in the same direction. When one variable changes from large to small or from small to large, the other variable also changes from large to small or from small to large; the specific relationship is determined by the actual application, and this application does not make special restrictions.

[0038] Preferably, in this embodiment, the expression of the trading tightness coefficient is: : represents the trading tightness coefficient between nodes and node in the trading graph. , respectively represent the trading sets of nodes and node . represents the cardinality of the intersection of the trading sets of the two nodes , . represents the minimum value of the cardinalities of the trading sets of the two nodes , . represents the sum of the trading weights of the elements in the intersection of the trading sets of the two nodes , . represents the sum of the trading weights of all elements in the trading sets of the two nodes.

[0039] Among them, the trading tightness coefficient between two nodes is used to measure the tightness of the trading relationship between the two nodes. When the trading relationship between the two nodes is closer, the trading situations of the two nodes are more similar. The similarity of the trading situations can be obtained according to the proportion of the repeated elements in the trading sets of the two nodes. When there are more overlapping nodes with trading relationships between the two nodes, the connection between the two nodes is closer; secondly, when the trading weight of the corresponding trading nodes is larger, it indicates that the trading is more frequent and the corresponding connection is closer.

[0040] Thus, the trading tightness coefficients of any two nodes are obtained.

[0041] Step S004: Obtain the adjustment weight according to the difference in the trading tightness coefficients between the current moment and the historical moment and the proportion of the trading tightness coefficient of the individual trading to the overall trading at the current moment.

[0042] In the prior art, when using zero - knowledge proofs for privacy protection of on - chain transactions, since all transaction data must be kept non - public on the chain, zero - knowledge proofs need to be performed on all transaction data each time to ensure the authenticity of the identities of both trading parties, the non - deniability of transactions, and the security of the transaction process. When using zero - knowledge proofs, polynomial commitments often need to be constructed or hash function calculations need to be performed based on the information one has. The more information needs to be proven, the higher the computational complexity of zero - knowledge proofs, which leads to slower transaction efficiency. Therefore, the zero - knowledge proof process has a serious impact on transaction efficiency, especially in scenarios where frequent transactions are required, resulting in over - proof. Thus, certain adaptive adjustments need to be made to zero - knowledge proofs so that, while achieving regulatory functions, the efficiency of on - chain transactions can be improved simultaneously.

[0043] When the transaction tightness between two nodes is stronger, when these two nodes perform zero - knowledge proofs, the amount of information that needs to be proven can be relatively reduced, thereby improving the efficiency of on - chain transactions. At the same time, if the tightness of transactions between two nodes in historical transaction data is also stronger, when conducting transactions, it is more necessary to reduce the amount of information in zero - knowledge proofs, and at this time, the corresponding adjustment weight of zero - knowledge proofs is greater.

[0044] Based on the above analysis, for each transaction, the two nodes are obtained, and the adjustment weight of this transaction is obtained according to the proportion of the transaction tightness coefficient between the two nodes at the current moment in all transaction tightness coefficients and the difference between the transaction tightness coefficients between the two nodes at the current moment and in history. The adjustment weight is positively correlated with the proportion of the transaction tightness coefficient between the two nodes at the current moment in all transaction tightness coefficients, and negatively correlated with the difference between the transaction tightness coefficients between the two nodes at the current moment and in history.

[0045] It should be noted that negative correlation means that when one variable increases, the other variable decreases, and the change directions of the two variables are opposite. When one variable changes from large to small or from small to large, the other variable also changes from small to large or from large to small. The specific relationship is determined by actual applications, and this application does not make special restrictions.

[0046] Preferably, the expression of the adjustment weight is: , , respectively represent the transaction tightness coefficients between the two nodes corresponding to the th and the th transactions, represents the number of transactions generated at the current moment, represents the mean value of the transaction tightness coefficients of historical transactions between the two nodes corresponding to the th transaction, is a normalization function, represents the adjusted weight of the zero - knowledge proof of the th transaction at the current moment.

[0047] Thus, the adjusted weight of each transaction in the zero - knowledge proof is obtained.

[0048] Step S005: Determine a polynomial based on the adjusted weight - adjusted information amount to achieve privacy protection.

[0049] When the two trading parties conduct a transaction, they first send the secret shared through Diffie - Hellman key exchange to the regulatory agency. After the regulatory agency hashed the secret using a hash function, it can determine the specific transaction nodes in the transaction graph and calculate the transaction tightness coefficient of these two nodes; then calculate the adjusted weight of this transaction based on all transactions at the same time and send the adjusted weight to the corresponding node. After the corresponding node obtains the adjusted weight, it adjusts the information amount to be verified. In this embodiment, the information amount to be verified is transaction data, that is, the type of the verified transaction data is the information amount.

[0050] Adjust the information amount based on the adjusted weight corresponding to each transaction. The expression is: , represents the initial information amount, represents the adjusted weight, represents the adjusted information amount. In this embodiment, the initial information amount is the type of all transaction data.

[0051] After adjusting the information amount to be verified, the prover randomly selects information from all the transaction data to be verified, generates a polynomial commitment for these information using zero - knowledge proof, and sends the polynomial commitment to the verifier. When the verifier verifies and passes, a normal transaction can be carried out.

[0052] Thus, the data privacy protection of on - chain transactions is completed.

[0053] It should be noted that: the above - described embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

[0054] Each embodiment in this specification is described in a progressive manner. For the same or similar parts among the embodiments, reference can be made to each other, and the differences between each embodiment and other embodiments are emphasized respectively.

Claims

1. A method for protecting the privacy of on-chain transaction data based on zero-knowledge proof, characterized in that: The method comprises the following steps: Collect transaction data and its types; transaction data includes account, transaction amount, transaction time, and transaction number; Generate random values ​​for both parties of the transaction, and convert the random values ​​into authentication values ​​through the key exchange protocol; calculate the hash values ​​of both parties of the transaction based on the random values ​​of both parties of the transaction and the corresponding different authentication values; take each hash value as a node, and form a directed subgraph based on the positive and negative transaction amounts; form a transaction graph with all directed subgraphs; In the transaction graph, all nodes connected to each node form a transaction set; the transaction weight of each node in the transaction set is obtained according to the weight of the directed edge; the transaction closeness coefficient of the two nodes is obtained based on the number of identical nodes in the transaction sets of the two nodes and the transaction weights of the identical nodes; The adjustment weight of this transaction is obtained based on the difference between the transaction closeness coefficients of the two nodes corresponding to the transaction at the current moment and in history and the proportion of the transaction closeness coefficients of the two nodes corresponding to a transaction at the current moment in all transaction closeness coefficients; The amount of information is adjusted based on the adjustment weight corresponding to each transaction; a polynomial commitment is generated based on the adjusted amount of information using zero-knowledge proof, and the polynomial commitment is sent to the verifier for verification to achieve privacy protection.

2. A method for protecting the privacy of on-chain transaction data based on zero-knowledge proof as claimed in claim 1, characterized in that: The method for obtaining the hash value is: One of the accounts of the two transaction parties is recorded as the target account, the random value of the target account and the identity verification value of the other account are assigned to the target account, and the hash value of the target account is obtained through the random value of the target account and the identity verification value of the other account through a hash algorithm.

3. A method for protecting the privacy of on-chain transaction data based on zero-knowledge proof as claimed in claim 1, characterized in that: The directed subgraph is a directed graph formed from one node to another node of the transaction parties, and the direction is from the node with a positive transaction amount to the node with a negative transaction amount.

4. A method for protecting the privacy of on-chain transaction data based on zero-knowledge proof as claimed in claim 1, characterized in that: The weight of the directed edge in the transaction graph is the total frequency of all transactions with the same transaction amount in both accounts.

5. A method for protecting the privacy of on-chain transaction data based on zero-knowledge proof as claimed in claim 1, characterized in that: In a transaction set, the sum of the weights of directed edges between any node and the corresponding node in the transaction set is the transaction weight of the any node.

6. A method for protecting the privacy of on-chain transaction data based on zero-knowledge proof as claimed in claim 1, characterized in that: The transaction closeness coefficient is positively correlated with the number of identical nodes in two node transaction sets and the transaction weight of the identical nodes.

7. A method for protecting the privacy of on-chain transaction data based on zero-knowledge proof as claimed in claim 1, characterized in that: The adjustment weight is positively correlated with the proportion of the transaction closeness coefficient of the two nodes at the current moment in all transaction closeness coefficients, and is negatively correlated with the difference between the transaction closeness coefficients of the two nodes at the current moment and in history.

8. A method for protecting the privacy of on-chain transaction data based on zero-knowledge proof as claimed in claim 1, characterized in that: The expression for adjusting the weight is: , , Respectively represent , The transaction closeness coefficient between two nodes corresponding to a transaction, Indicates the number of transactions generated at the current moment. Indicates The average value of the transaction closeness coefficient of historical transactions between two nodes corresponding to transactions, is the normalization function, Indicates the current moment The adjusted weight of the zero-knowledge proof of each transaction.

9. The method for protecting the privacy of on-chain transaction data based on zero-knowledge proof as claimed in claim 1, characterized in that: The method for adjusting the amount of information based on the adjustment weight corresponding to each transaction is: , represents the initial information volume, represents the adjustment weight, Represents the amount of information after adjustment.

10. A method for protecting the privacy of on-chain transaction data based on zero-knowledge proof as claimed in claim 1, characterized in that: The initial amount of information is the types of all transaction data.

Images