Dynamic reputation-based editable and responsibility-traceable block chain method

Abstract

The invention relates to an editable and responsibility-traceable regional chain method based on dynamic reputation, relates to the field of block chains, and is used for solving the problem that a traditional block chain cannot modify illegal data and cannot track identity information of an editor, and the problem of contradiction between integrity of the chain and realization of correctness of data on the chain is solved. Comprising the steps of generating public parameters; generating a public key of the chameleon hash and a user key list; generating a chameleon hash value and a signature; verifying the hash value and the signature; recovering the chameleon hash private key; searching for chameleon hash collision and signing the chameleon hash collision; and an editor is traced. According to the method, a reputation mechanism and a responsibility investigation mechanism are introduced, after a user initiates a legal editing request, a member with the highest reputation of a committee is selected to edit block data, and the edited data is signed. And when the editing is doubted, the member can be tracked through the signature, so that the correctness of the block chain data and the identity tracking of the user are effectively ensured on the basis of not destroying the integrity of the original chain.

Description

Technical Field

[0001] The present invention relates to the field of blockchain, and particularly to an editable and accountable blockchain method based on dynamic reputation. Background Art

[0002] Since the advent of electronic currency in 2008, blockchain technology has attracted much attention. With the continuous development of blockchain technology, the immutability of traditional blockchain technology restricts the development of blockchain technology while ensuring security and trustworthiness. The application of chameleon hash function in blockchain solves this problem, but who will keep the private key of chameleon hash and who will be held accountable for the editor after modification have become new problems. In the prior art, Accenture has obtained a patent on editable blockchain technology, enabling all parties in the blockchain to edit the data on the chain in case of errors or fraud. In the prior art, Zhao Xiaoqi, Zhang Zhenghao, and Li Yong proposed an editable and accountable blockchain scheme based on technologies such as publicly verifiable secret sharing, zero-knowledge proof, and chameleon hash in the paper "An Editable and Accountable Blockchain Scheme". In the prior art, Wang Mengnan and Huang Jianhua proposed introducing a reputation mechanism into the blockchain to measure node behavior, encourage nodes to follow the protocol, and prevent malicious nodes from doing evil in the paper "A Reputation-Based Blockchain Sharding Consensus Scheme".

[0003] However, chameleon hash provides an important guarantee for the flexibility and editability of the blockchain. However, there is a balance problem between the distribution of its key private key and the accountability problem after editing. Therefore, it is urgent to solve the problems of reasonable distribution of the chameleon hash private key and tracking the identity of the editor in the blockchain, effectively ensuring the correctness of blockchain data and tracking the identity of users without destroying the integrity of the original chain. Summary of the Invention

[0004] The present invention provides an editable and accountable blockchain method based on dynamic reputation, which is used to solve the contradiction between the inability of traditional blockchain to modify illegal data, the inability to track the identity information of the editor, and the integrity of the chain and the correctness of the data on the chain.

[0005] The present invention provides an editable and accountable blockchain method based on dynamic reputation, including the following steps:

[0006] Step 100, generating public parameters pp;

[0007] Step 200, generating the reputation of user i and the number of secret shares η;

[0008] Step 300, generating the public key of chameleon hash and the list of user keys;

[0009] Step 400, generation of chameleon hash value and signature σ;

[0010] Step 500, verification of the hash value and signature σ;

[0011] Step 600, recovery of the chameleon hash private key;

[0012] Step 700, finding a chameleon hash collision and signing it with σ';

[0013] Step 800, holding the editor accountable.

[0014] In one implementation method, step 100 specifically includes the following steps:

[0015] Step S101, set the group |G 1 | = |G 2 | = |G T | = p, p ≥ q, where G 1 , G 2 's generators are g 1 , g 2 , 's generator is g;

[0016] Step S102, select a collision-resistant hash function H 1 : {0,1} * → G 1 , Set e: G 1 × G 2 → G T , are the parameters as described above.

[0017] In one implementation method, step 200 specifically includes the following steps:

[0018] Step S201, calculate the influence factor S of the reputation value of the consensus behavior t . k is the bias coefficient. The larger k is, the more the influence factor value of this round is biased towards the previous behavior; otherwise, more emphasis is placed on the current round behavior of the node. α is the reward coefficient, usually taking a small value to avoid too rapid growth of reputation. β is the penalty coefficient, taking a large value to ensure that malicious behavior can quickly lead to a decline in reputation. n represents the number of correct behaviors. m represents the number of malicious behaviors. φ t represents the mark of the normal behavior in this round (1 for normal, 0 for abnormal). represents the mark of the malicious behavior in this round (1 for malicious, 0 for normal); through the reputation calculation formula The sigmoid function shows a trend of first fast and then slow growth or decline from the initial state. When the influence factor S tWhen it approaches positive infinity or negative infinity, the change of the function value will tend to be gentle. Calculate the reputation value R of the output consensus behavior t :

[0019]

[0020] Step S202, calculate the reputation value GT(i) when the transaction occurs. At a certain time point t of node i, trace back Δt time forward. During the period from t - Δt to t, this node collaborates with other nodes to generate T i transactions, calculate the activity a(T i ) = arctan(T i -x) / π + 0.5, where x is the average value of transactions during this period The activity value range is (0, 1); introduce the time decay mechanism Weaken the influence ability of transactions with a relatively long time; the transaction feedback rating f(i) ∈ (0, 1) and the reputation value of user j f(n) represents the positive influence factor for identifying the reusability of transactions in different application scenarios; GT(0) represents the default reputation value when there is no transaction history;

[0021]

[0022] Step S303, calculate the reputation value of editing block data During the i-th editing behavior, verify that the user j of the editing behavior gives a feedback rating f(j) ∈ (-1, 1) for the editing behavior, representing the current reputation value of this user; k represents the weight coefficient of the current round of editing. We should pay attention to the current round of editing behavior and weaken the influence of the previous round of behavior, so k > 0.5; is the decay coefficient of the feedback rating of user j for this editing behavior, where t j represents the time required for user j to make a feedback rating from verifying the editing behavior. As the feedback time t j increases, the feedback decay coefficient becomes smaller and smaller, and the impact of untimely feedback on the reputation rating of the editor is smaller; λ is the time decay coefficient, and the user ratings with high reputation and timely feedback contribute more to the behavior of the editor; represents the reputation value of the edited blockchain calculated during the previous edit; represents the default reputation value when there is no editing behavior;

[0023]

[0024] Step S304, integrate the reputation values in the above three steps to generate the reputation of the user and the number of secret shares η. Input the reputation value R of the participating consensus behavior t , the reputation value GT(i) at the time of transaction generation, and the reputation value of editing block data Set the weight coefficients w 1 , w 2 , w 3 , and w 1 +w 2 +w 3 =1, and calculate the reputation value of the i-th user The calculation formula is:

[0025]

[0026] Step S305, calculate the number of secret shares η based on each reputation value. Suppose there are N members in the committee, and their reputation values are respectively Calculate the sum of the committee's reputation values Calculate the reputation ratio of each member Calculate the number of secret shares to be allocated according to the reputation ratio; η = [p i ×10×n], where [] is the floor function, and η should be the number of secrets allocated according to the proportion of the user's reputation value rep i U in the total sum of the committee's reputation values.

[0027] In an implementation method, step 300 specifically includes the following steps:

[0028] Step S301, input the public parameter λ, generate the public-private key pair of the user, and select Calculate The public-private key pair is denoted as

[0029] Step S302, based on the current member reputation list, select n users with higher reputation values to form a committee, and select k members with higher reputation in the committee to form a secret distribution node {U 1 , U 2 ,..., U k}, input the private keys of k members where i ∈ {1, 2,..., k}, and calculate the public key share of the chameleon hash of this node

[0030] Step S303, input the public key shares of the chameleon hash of k nodes Output pk CH , and calculate the public key of the chameleon hash where i ∈ {1, 2,..., k};

[0031] Step S304, input the respective private keys of k secret distribution nodes Each secret distribution node selects t random numbers Construct f i (x) = x i + a i,1 x + a i,2 x 2 +... + a i,t x t mod q polynomial, where i ∈ {1, 2,..., k};

[0032] Step S305, input polynomial f 1 (x), f 2 (x),..., f k (x), and the list of interpolation points {x 1 , x 2 ,..., x η} for each committee member, where the interpolation points should be on where η should be the user's credit value in the current state The proportion of the secret quantity allocated to the sum of the committee credit values, calculate η x 1 → f 1 (x 1 ), f 2 (x 1 ),..., f k (x 1 ), x 2 → f 1 (x 2 ), f 2 (x 2 ),..., f k (x 2 ),..., x η → f 1 (x η ), f 2 (x η ),..., f k (x η ), to obtain the list of secret shares {(x 1 , f 1 (x 1 ))), (x 2 , f 1 (x 2 ))),...,(x η , f 1 (x η ))),{(x 1 , f 2 (x 1 )),(x2 , f 2 (x 2 ),...,(x η , f 2 (x η ))},…,{(x 1 , f k (x 1 ),(x 2 , f k (x 2 ))},...,(x η , f k (x η ))}, and each sends the calculated share to this member of the committee;

[0033] Step S306, input the respective private keys of the secret distribution nodes Random number a i,1 , a i,2 ,..., a i,t , calculate and where i ∈ {1, 2,..., k}, j ∈ {1, 2,..., t}, and send the respective calculation results to the members of the committee;

[0034] Step S307, the committee member receives its own list of secret shares {{(x 1 , f 1 (x 1 )),(x 2 , f 1 (x 2 ))},…(x η , f 1 (x η ))},{(x 1 , f 2 (x 1 ),(x 2 , f 2 (x 2 ))},...,(x η , f 2 (x η ))},...,{(x 1 , f k (x 1 ),(x 2 , f k (x 2 ))},...,(x η , f k (x η ))}}, and the secret distribution node verifies the list Verify the correctness of the secret share of the node where \(i\in\{1,2,\cdots,k\}\), \(j\in\{1,2,\cdots,t\}\), \(\epsilon\in\{1,2,\cdots,\eta\}\), verify When the function values of a certain point are different, the committee members require the distribution node to recalculate the function value and submit it for verification until the correctness is guaranteed;

[0035] Step S308, input the list of secret shares whose correctness has been verified, and obtain the correct list of secret shares of the user Output the list of secret shares of the committee \(\{sk 1 ,sk 2 ,\cdots,sk n \}\).

[0036] In an implementation method, step 400 specifically includes the following steps:

[0037] Step S401, input the chameleon hash public key \(pk CH \), message \(m\in\{0,1\} * \), and output the hash value \(h\) and the random number \(r\). Randomly select a random number \(r\leftarrow G 1 \), calculate \(H 1 (m)\to G 1 \), calculate \(h = e(r,g 2 )e(H 1 (m),pk CH )\);

[0038] Step S402, input the public key of the user who generates the hash message \(m\in\{0,1\} * \), and the chameleon hash \(h\), and output the signature \(\sigma\). Select a random number calculate \(\gamma = g k \bmod q, output the signature \(\sigma = (\gamma,\delta)\).

[0039] In an implementation method, step 500 specifically includes the following steps:

[0040] Step S501, input the hash value \(h\), the chameleon hash public key \(pk CH \), message \(m\in\{0,1\} * \), the random number \(r\), the signature \(\sigma\), and the public key of the signature user and output 0 / 1. Calculate \(H 1 (m)\to G 1 \), if there is a chameleon hash \(h = e(r,g 2 )e(H 1 (m),pk CH )\to 1\), otherwise output 0. Calculate If there is Otherwise, output 0. When both outputs are 1, this step outputs 1; otherwise, it outputs 0.

[0041] In one implementation method, step 600 specifically includes the following steps:

[0042] Step S601: Input the node secret shares {sk 1 , sk 2 ,..., sk n}, and output the private key sk CH of the chameleon hash. The secret share list {sk t of the nodes whose reputation collected by the node with the highest reputation is greater than the reputation threshold rep 1 , sk 2 ,..., sk j}, where there are

[0043] When , the private key of the chameleon hash can be solved using the Lagrange interpolation method

[0044] In one implementation method, step 700 specifically includes the following steps:

[0045] Step S701: Input the random number r, the message m ∈ {0, 1} * and the new message m' ∈ {0, 1} * , the public key pk CH of the chameleon hash, and the private key sk CH , and output the random number r' and the hash value h'. Calculate y = H 1 (m)H 1 (m') -1 , calculate the new random number Calculate the chameleon hash value h' = e(r', g 2 )e(H 1 (m'), pk CH );

[0046] Step S702: Input the private key of the node with the highest reputation the message m' ∈ {0, 1} * , and the generated chameleon hash h', and output the signature σ'. Calculate Select a random number Calculate γ' = g k' mod q, Output σ' = (γ', δ').

[0047] In one implementation method, step 800 specifically includes the following steps:

[0048] Step S801: Input the old and new chameleon hash values h and h', the public key pk of the chameleon hash, a random number r', and a new message m' ∈ {0, 1} CH , and output 0 / 1. Calculate H * (m') → G 1 , and determine whether h = h' = e(r', g 1 )e(H 2 (m'), pk 1 ) → 1, otherwise output 0; CH

[0049] Step S802: Input the signature σ', a new message m' ∈ {0, 1}, the chameleon hash h', and the public key of the committee member * , and output the public key of a certain user After the output of the previous step is 1, calculate Calculate to obtain Find a suitable public key such that Output the public key of this user

[0050] Compared with the prior art, the advantages of the present invention are as follows: By setting up a dynamic committee to achieve key sharing, implementing accountability for editing behavior by signing the message after editing, and implementing a reputation mechanism to achieve feedback rating of user behavior. During the operation of the method, first generate public parameters pp; secondly, generate the reputation value, secret share number, chameleon hash public key, and user private key list of users respectively; then, generate chameleon hash values and signatures, and verify the correctness of the hash values and signatures; finally, find collisions, sign new messages, and hold the editor accountable based on the signature. In this process, based on the characteristics of the chameleon hash function, the reputation mechanism scores the behaviors of participating users, and members in the committee obtain different numbers of secret shares according to their reputation values, enabling the user with the highest reputation to collaborate with other users to modify the data on the chain. On the basis of not destroying the integrity of the original chain, the correctness of the blockchain data is effectively guaranteed. When there are doubts about the edited message, the identity information of the editor is traced. Thus, the problem of the contradiction between the traditional blockchain being unable to modify illegal data, unable to trace the identity information of the editor, and the integrity of the chain and the correctness of the data on the chain is solved. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The present invention will be described in more detail below based on embodiments and with reference to the drawings.

[0052] Figure 1 is a model diagram of the editable and accountable blockchain method based on dynamic reputation in the embodiment of the present invention.

[0053] Figure 2 ​​It is a method flow chart of an editable and accountable blockchain method based on dynamic reputation in an embodiment of the present invention; DETAILED DESCRIPTION

[0054] The present invention will be further described below in conjunction with the accompanying drawings.

[0055] It should be noted that the core function of hash function, as one of the basic components of cryptography, is to ensure the immutability and rapid verification of data. With the rapid development of blockchain technology and privacy computing, the one-way advantage of traditional hash functions in data solidification verification has become a technical bottleneck in scenarios that require data editability. To resolve this contradiction, researchers proposed an innovative solution of Chameleon Hash based on Krawczyk and Rabin in 1997. This technology introduces a trapdoor mechanism, allowing authorized users to modify the original data without changing the hash output value when holding secret information (trapdoor key), while ensuring that unauthorized users cannot detect or implement tampering. This feature makes Chameleon Hash show unique value in scenarios such as blockchain systems that require audit traceability and editable smart contracts. Although Chameleon Hash has made breakthroughs in balancing data security and flexibility, its trapdoor key management mechanism still faces potential security risks. How to achieve dynamic update and secure distribution of trapdoors has become an important challenge in current research.

[0056] Based on the existing chameleon hash function technology, Zhao Xiaoqi, Zhang Zhenghao and Li Yong proposed an editable and accountable blockchain solution based on publicly verifiable secret sharing, zero-knowledge proof, chameleon hash and other technologies in their paper "Editable and Accountable Blockchain Solution". The reputation mechanism is an identity attribute that can mark users with good behavior, so that users who participate in consensus and editing are more trustworthy members.

[0057] like Figure 1 As shown, the present invention provides an editable and accountable blockchain method based on dynamic reputation. The present invention includes editors, key distributors, edit requesters, transaction owners and dynamic committees.

[0058] First, a dynamic committee is formed by N users. The key distribution members generate public keys and distribute secret shares to other users based on their reputation. Secondly, the edit requester initiates a request to elect the member with the highest reputation as the editor. Users with high reputation and secret shares send their secret shares to the editor. Finally, the editor restores the key, completes the edit and signs. After a certain period of time or after an edit is completed, the reputation mechanism will update the reputation value for each user. Users with a reputation lower than the committee's reputation threshold will be removed from the committee, and users with high reputation will join this dynamic committee.

[0059] As shown Figure 2 in the figure, the present invention provides an editable blockchain method based on dynamic reputation, including the following steps:

[0060] Step 100, generation of public parameters pp;

[0061] Step 200, generation of the reputation of user i and the number of secret shares η;

[0062] Step 300, generation of the public key of the chameleon hash and the list of user keys;

[0063] Step 400, generation of the chameleon hash value and signature σ;

[0064] Step 500, verification of the hash value and signature σ;

[0065] Step 600, recovery of the chameleon hash private key;

[0066] Step 700, finding a chameleon hash collision and signing it with σ';

[0067] Step 800, holding the editor accountable.

[0068] According to the above steps, by setting up a dynamic committee to achieve key sharing, signing the message after editing to hold the editing behavior accountable, and using the reputation mechanism to achieve feedback rating of user behavior. During the operation of the method, first generate the public parameters pp; secondly, generate the reputation value, the number of secret shares, the chameleon hash public key and the list of user private keys of the user respectively; then, generate the chameleon hash value and signature, and verify the correctness of the hash value and signature; finally, find a collision, sign the new message, and hold the editor accountable based on the signature. In this process, based on the characteristics of the chameleon hash function, the behavior of participating users is scored through the reputation mechanism. The members in the committee obtain different numbers of secret shares according to their reputation values, so that the user with the highest reputation can cooperate with other users to modify the data on the chain. Without destroying the integrity of the original chain, the correctness of the blockchain data is effectively guaranteed. When there are doubts about the edited message, the identity information of the editor is held accountable. Thus, the problem of the contradiction between the traditional blockchain being unable to modify illegal data, unable to trace the identity information of the editor, and the integrity of the chain and the correctness of the data on the chain is solved.

[0069] Specifically, in one embodiment, step 100 initializes the algorithm to generate the public parameters of the scheme. Specifically, it includes the following steps:

[0070] Step S101, set the group |G 1 | = |G 2 | = |G T | = p, p ≥ q, where G 1 , G 2 The generators of 1 , g 2 , The generator of

[0071] Step S102, select a collision-resistant hash function H 1 : {0, 1} * → G 1 , Set e: G 1 × G 2 → G T , For the parameters described above.

[0072] Specifically, in one embodiment, step 200 generates a reputation value and the number of secret shares for the user. Specifically, it includes the following steps:

[0073] Step S201, calculate the influence factor S of the reputation value of the consensus behavior t . k is the bias coefficient. The larger k is, the more the influence factor value of this round is biased towards previous behaviors; otherwise, more emphasis is placed on the current-round behavior of the node. α is the reward coefficient, usually taking a small value to avoid too rapid growth of reputation. β is the penalty coefficient, taking a large value to ensure that malicious behavior can quickly lead to a decrease in reputation. n represents the number of correct behaviors. m represents the number of malicious behaviors. φ t Represents the mark of normal behavior in this round (1 for normal, 0 for abnormal). Represents the mark of malicious behavior in this round (1 for malicious, 0 for normal); through the reputation calculation formula The sigmoid function shows a trend of first fast and then slow growth or decrease starting from the initial state. When the influence factor S t tends to positive infinity or negative infinity, the change in the function value will tend to be flat. Calculate and output the reputation value R of the consensus behavior t ;

[0074]

[0075] Step S202, calculate the reputation value GT(i) when a transaction occurs. Node i at a certain time point t traces back Δt time forward. During the period from t - Δt to t, this node collaborates with other nodes to generate T i transactions. Calculate the activity a(T i ) of this node in the current time period = arctan(T i - x) / π + 0.5, where x is the average value of transactions during this period The activity value range is (0, 1); introduce the time decay mechanism Weaken the influence ability of transactions with a relatively long time; the transaction feedback rating f(i) ∈ (0, 1) and the credit value of user j f(n) represents the positive influence factor for identifying transaction reusability in different application scenarios; GT(0) represents the default credit value when there is no transaction history;

[0076]

[0077] Step S303, calculate the credit value of the edited block data During the i-th editing behavior, verify that the user j of the editing behavior has a feedback rating f(j) ∈ (-1, 1) for the editing behavior, which represents the current credit value of the user; k represents the weighting coefficient of the current round of editing. Attention should be paid to the current round of editing behavior and the influence of the previous round of behavior should be weakened, so k > 0.5; is the decay coefficient of the feedback rating of user j for this editing behavior, where t j represents the time required for user j to make a feedback rating from verifying the editing behavior. As the feedback time t j increases, the feedback decay coefficient becomes smaller and smaller, and the impact of untimely feedback on the credit rating of the editor is smaller; λ is the time decay coefficient, and the user scores with high credit value and timely feedback contribute more to the behavior of the editor; represents the credit value of the edited blockchain calculated during the previous edit; represents the default credit value when there is no editing behavior.

[0078]

[0079] Step S304, integrate the credit values in the above three steps to generate the credit of the user and the number of secret shares η. Input the credit value R t participating in the consensus behavior, the credit value GT(i) at the time of transaction generation, and the credit value of the edited block data Set the weight coefficients w 1 、w 2 、w 3 ,and w 1 +w 2 +w 3 =1, and calculate the credit value of the i-th user The calculation formula is:

[0080]

[0081] Step S305, calculate the number of secret shares η based on each credit value. Suppose there are N members in the committee, and their credit values are respectively Calculate the sum of the committee credit values Calculate the credibility ratio of each member Calculate the number of secret shares to be allocated according to the credibility ratio; η = [p i × 10 × N], where [] is the floor function, and η should be the credibility value rep of the user in the current state i U The number of secrets to be allocated according to the proportion of the user's credibility value in the total credibility value of the committee

[0082] Specifically, in one embodiment, step 300 generates a public key of the chameleon hash and a list of user keys. Specifically, it includes the following steps:

[0083] Step S301, input the public parameter λ, generate a public-private key pair for the user, and select Calculate The public-private key pair is denoted as

[0084] Step S302, based on the current member credibility list, select n users with higher credibility values to form a committee, and select k members with higher credibility in the committee to form secret distribution nodes {U 1 , U 2 ,..., U k}, input the private keys of the k members where i ∈ {1, 2,..., k}, and calculate the public key share of the chameleon hash of this node

[0085] Step S303, input the public key shares of the chameleon hash of the k nodes Output pk CH , and calculate the public key of the chameleon hash where i ∈ {1, 2,..., k};

[0086] Step S304, input the respective private keys of the k secret distribution nodes Each secret distribution node selects t random numbers Construct f i (x) = x i + a i,1 x + a i,2 x 2 +... + a i,t x t mod q polynomial, where i ∈ {1, 2,..., k};

[0087] Step S305, input the polynomials f 1 (x), f 2 (x),..., f k (x), and the interpolation point list {x 1 , x2 ,...,x η}, where the interpolation point should be where η should be the user's reputation value in the current state The number of secrets that should be allocated to the proportion of the total reputation of the committee is calculated to obtain η x 1 →f 1 (x 1 ),f 2 (x 1 ),...,f k (x 1 ),x 2 →f 1 (x 2 ),f 2 (x 2 ),...,f k (x 2 ),...,x η →f 1 (x η ),f 2 (x η ),...,f k (x η ), get the secret share list {(x 1 ,f 1 (x 1 )),(x 2 ,f 1 (x 2 )),...,(x η ,f 1 (x η ))},{(x 1 ,f 2 (x 1 )),(x 2 ,f 2 (x 2 )),...,(x η ,f 2 (x η ))},…,{(x 1 ,f k (x 1 )),(x 2 ,f k (x 2 )),...,(x η ,f k (x η ))} and each sends its calculated share to that Member of the Committee;

[0088] Step S306: Input the private keys of the secret distribution nodes Random number ai,1 , a i,2 ,..., a i,t , calculate and where \(i\in\{1, 2,\cdots, k\}\), \(j\in\{1, 2,\cdots, t\}\), and send the respective calculation results to the members of the committee;

[0089] Step S307, the committee members receive their own list of secret shares \(\{(x 1 , f 1 (x 1 ))), (x 2 , f 1 (x 2 )), \cdots (x η , f 1 (x η ))\}, \{(x 1 , f 2 (x 1 )), (x 2 , f 2 (x 2 )), \cdots, (x η , f 2 (x η ))\}, \cdots, \{(x 1 , f k (x 1 )), (x 2 , f k (x 2 )), \cdots, (x η , f k (x η ))\}\}, and the secret distribution node verifies the list Verify the correctness of the secret share of this node where \(i\in\{1, 2,\cdots, k\}\), \(j\in\{1, 2,\cdots, t\}\), \(\epsilon\in\{1, 2,\cdots, \eta\}\), verify When the function values at a certain point are different, the committee members require the distribution node to recalculate the function value and submit it for verification until the correctness is guaranteed;

[0090] Step S308, input the list of secret shares with verified share correctness to obtain the correct list of secret shares of the user Output the list of secret shares of the committee \(\{sk 1 , sk 2 , \cdots, sk n \}\).

[0091] Specifically, in one embodiment, step 400 generates a chameleon hash value and a signature. It specifically includes the following steps:

[0092] Step S401, input the chameleon hash public key pk CH , message m ∈ {0, 1} * , and output the hash value h and the random number r. Randomly select a random number r ← G 1 , calculate H 1 (m) → G 1 , calculate h = e(r, g 2 )e(H 1 (m), pk CH );

[0093] Step S402, input the public key of the user who generates the hash message m ∈ {0, 1} * , and the chameleon hash h, and output the signature σ. Select a random number calculate γ = g k mod q, output the signature σ = (γ, δ).

[0094] Specifically, in one embodiment, step 500 verifies the hash value and the signature. It specifically includes the following steps:

[0095] Step S501, input the hash value h, the chameleon hash public key pk CH , message m ∈ {0, 1} * , the random number r, the signature σ, and the public key of the signature user and output 0 / 1. Calculate H 1 (m) → G 1 , if there is a chameleon hash h = e(r, g 2 )e(H 1 (m), pk CH ) → 1, otherwise output 0. Calculate if there is otherwise output 0. When both outputs are 1, this step outputs 1, otherwise output 0.

[0096] Specifically, in one embodiment, step 600 recovers the chameleon hash private key. It specifically includes the following steps:

[0097] Step S601, input the node secret shares {sk 1 , sk 2 ,..., sk n}, and output the private key sk CH of the chameleon hash. The reputation of the committee nodes collected by the node with the highest reputation is greater than the reputation threshold rept The list of secret shares of the nodes {sk 1 , sk 2 ,..., sk j}, where there is When , the private key of the chameleon hash can be solved by using Lagrange interpolation

[0098] Specifically, in one embodiment, step 700 finds a chameleon hash collision and signs it. The specific steps are as follows:

[0099] Step S701, input a random number r, a message m ∈ {0, 1} * and a new message m' ∈ {0, 1} * , the public key pk of the chameleon hash CH , the private key sk CH , output a random number r', a hash value h'. Calculate y = H 1 (m)H 1 (m') -1 , calculate a new random number Calculate the chameleon hash value h' = e(r', g 2 )e(H 1 (m'), pk CH );

[0100] Step S702, input the private key of the node with the highest reputation the message m' ∈ {0, 1} * , the generated chameleon hash h', output the signature σ'. Calculate Select a random number Calculate γ' = g k' mod q, Output σ' = (γ', δ').

[0101] Specifically, in one embodiment, step 800 verifies the hash value and holds the editor accountable. The specific steps are as follows:

[0102] Step S801, input the old and new chameleon hash values h and h', the public key pk of the chameleon hash CH , the random number r', the new message m' ∈ {0, 1} * , output 0 / 1. Calculate H 1 (m') → G 1 , determine whether h = h' = e(r', g 2 )e(H 1 (m'), pk CH ) → 1, otherwise output 0;

[0103] Step S802, input signature σ', new message m' ∈ {0, 1} * , chameleon hash h', public keys of committee members Output the public key of a certain user After the output of the previous step is 1, calculate Calculate to obtain Find a suitable public key such that Output the public key of this user

[0104] As can be seen from the description of the above specific implementation manners: key sharing is achieved by setting up a dynamic committee, accountability for editing behavior is achieved by signing the message after editing, and a reputation mechanism is used to implement feedback rating of user behavior. During the running process of the method, first, public parameters pp are generated; second, the reputation value, secret share number, chameleon hash public key, and user private key list of the user are respectively generated; then, the chameleon hash value and signature are generated, and the correctness of the hash value and signature is verified; finally, a collision is found, the new message is signed, and the editor is held accountable according to the signature. In this process, based on the characteristics of the chameleon hash function, the behavior of participating users is scored through the reputation mechanism, and members in the committee obtain different numbers of secret shares according to their reputation values, so that the user with the highest reputation can cooperate with other users to modify the data on the chain. On the basis of not destroying the integrity of the original chain, the correctness of the blockchain data is effectively guaranteed. When there are doubts about the edited message, the identity information of the editor is traced. Thus, the problem of the contradiction between the traditional blockchain being unable to modify illegal data, unable to trace the identity information of the editor, the integrity of the chain, and the correctness of the data on the chain is solved. Although the present invention has been described with reference to the preferred embodiments, various improvements can be made to it and components therein can be replaced with equivalents without departing from the scope of the present invention. In particular, as long as there is no structural conflict, the technical features mentioned in each embodiment can be combined in any way. The present invention is not limited to the specific embodiments disclosed in the text, but includes all technical solutions falling within the scope of the claims.

[0105] Obviously, the above-described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the scope of protection of the present invention.

[0106] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should also be understood that when the terms "comprise" and / or "include" are used in this specification, they specify the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0107] It should be noted that the terms "first", "second", etc. in the description and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged under appropriate circumstances so that the embodiments of the present application described herein can be implemented in an order different from those illustrated or described herein.

[0108] The above are only the preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention can have various changes and modifications. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims

1. A blockchain method based on dynamic reputation that is editable and accountable, characterized in that: It includes the following steps: Step 100, generation of public parameter pp; Step 200, user i's reputation And the secret share number η is generated; Step 300, generation of Chameleon Hash public key and user key list; Step 400, chameleon hash value and signature σ are generated; Step 500, verifying the hash value and signature σ; Step 600, recovering the Chameleon hash private key; Step 700, find the chameleon hash collision and sign it σ'; Step 800, hold the editor accountable.

2. The editable and accountable blockchain method based on dynamic reputation according to claim 1 is characterized in that: The step 100 specifically includes the following steps: Step S101, set group |G1|=|G2|=|G T |=p, p≥q, where the generators of G1 and G2 are g1 and g2 respectively, The generator of is g; Step S102, select collision-resistant hash function H1: {0,1} * →G1, Set e:G1×G2→G T , are the parameters described above.

3. The editable and accountable blockchain method based on dynamic reputation according to claim 1 is characterized in that: The step 200 specifically includes the following steps: Step S201, calculate the influence factor S of the reputation value of the consensus behavior t ; Among them, k is the bias coefficient. The larger k is, the more the impact factor value of this round is biased towards the previous behavior; otherwise, the node's current round behavior is more important; α is the reward coefficient, which is usually taken as a small value to avoid too fast reputation growth; β is the penalty coefficient, which is taken as a large value to ensure that malicious behavior can quickly lead to a decline in reputation; n represents the number of correct behaviors; m represents the number of malicious behaviors; φ t A marker indicating normal behavior for this round; A mark indicating malicious behavior in this round; calculated through the reputation calculation formula The sigmoid function starts to grow or decrease from the initial state, showing a trend of first fast and then slow. t When it approaches positive infinity or negative infinity, the change of the function value will become flat, and the reputation value R of the consensus behavior is calculated and output. t ; Step S202, calculate the reputation value GT(i) when the transaction is generated, where node i is at a certain time point t, traces back to Δt time, and in the period from t-Δt to t, the node and other nodes jointly generate T i transactions, calculate the activity of the node in the current time period a(T i )=arctan(T i -x) / π+0.5, where x is the average value of transactions during this period of time The activity value range is (0,1); the time decay mechanism is introduced Weaken the influence of transactions that are farther away; transaction feedback rating f(i)∈(0,1) and user j’s reputation value f(n) represents the positive and biased influencing factor for transaction reusability identification in different application scenarios; GT(0) represents the default reputation value when there is no transaction history; Step S303, calculating the reputation value of the edited block data Among them, at the i-th editing behavior, the user j who verifies the editing behavior gives a feedback rating f(j)∈(-1,1), Indicates the current reputation value of the user; k indicates the weight coefficient of the current round of editing. The current round of editing behavior should be emphasized, and the influence of the previous round of behavior should be weakened, so k>0.5; is the attenuation coefficient of user j’s feedback rating on this editing behavior, where t j represents the time required for user j to verify the editing behavior and make feedback ratings. j As increases, the feedback attenuation coefficient becomes smaller and smaller, and the impact of untimely feedback on the editor's reputation rating becomes smaller; λ is the time attenuation coefficient, and the user rating with high reputation and timely feedback contributes more to the editor's behavior; Represents the reputation value of the edited blockchain calculated at the time of the last edit; Indicates the default reputation value when there is no editing behavior; Step S304: Integrate the reputation values ​​in the above three steps to generate the user's reputation And the number of secret shares η, where the reputation value R of the input consensus behavior t , the reputation value GT(i) when the transaction is generated, the reputation value of editing block data Set weight coefficients w1, w2, w3, and w1+w2+w3=1, and calculate the reputation value of the i-th user The calculation formula is: Step S305, calculate the number of secret shares η according to their respective reputation values; where, suppose there are N members in the committee, and their reputation values ​​are Calculate the sum of committee reputation Calculate the credit weight of each member The number of secret shares to be allocated is calculated based on the reputation ratio; η = [p i ×10×N], where [] is a rounding down symbol, and η should be the user's reputation value in the current state The number of secrets to which the weight of the committee's total reputation should be allocated.

4. The editable and accountable blockchain method based on dynamic reputation according to claim 1 is characterized in that: The step 300 specifically includes the following steps: Step S301, input the public parameter λ, generate the user's public and private key pair, select calculate The public and private key pair is denoted as Step S302: Based on the current member reputation list, select n users with higher reputation values ​​to form a committee, and select k members with higher reputation values ​​from the committee to form a secret distribution node {U1, U2, ..., U k }, enter the private keys of k members Where i∈{1,2,...,k}, calculate the public key share of the chameleon hash of the node Step S303: input the Chameleon hash public key shares of k nodes Output pk CH , calculate the public key of the Chameleon hash where i∈{1,2,...,k}; Step S304: input the private keys of k secret distribution nodes Each secret distribution node selects t random numbers Build f i (x) = x i +a i,1 x+a i,2 x 2 +...+a i,t x t modq polynomial, where i∈{1,2,...,k}; Step S305, input polynomials f1(x), f2(x), ..., f k (x), and a list of interpolation points {x1,x2,...,x η }, where the interpolation point should be where η should be the user's reputation value in the current state The number of secrets that should be allocated to the proportion of the total reputation of the committee is calculated to obtain η x1→f1(x1),f2(x1),...,f k (x1),x2→f1(x2),f2(x2),...,f k (x2),...,x η →f1(x η ),f2(x η ),...,f k (x η ), get the secret share list {(x1,f1(x1)),(x2,f1(x2)),...,(x η ,f1(x η ))},{(x1,f2(x1)),(x2,f2(x2)),...,(x η ,f2(x η ))},…,{(x1,f k (x1)),(x2,f k (x2)),...,(x η ,f k (x η ))} and each sends its calculated share to that Member of the Committee; Step S306: Input the private keys of the secret distribution nodes Random number a i,1 ,a i,2 ,...,a i,t ,calculate and Where i∈{1,2,...,k},j∈{1,2,...,t}, and the calculation results are sent to the members of the committee; Step S307: Committee members receive their own secret share lists {{(x1,f1(x1)),(x2,f1(x2)),…(x η ,f1(x η ))},{(x1,f2(x1)),(x2,f2(x2)),...,(x η ,f2(x η ))},...,{(x1,f k (x1)),(x2,f k (x2)),...,(x η ,f k (x η ))}}, Secret Distribution Node Verification List Verify the correctness of the node's secret share where i∈{1,2,...,k},j∈{1,2,...,t},ε∈{1,2,...,η}, verify When the function value of a certain point is different, the committee member requires the distribution node to recalculate the function value and submit it to them for verification until the correctness is guaranteed; Step S308: Input the secret share list whose correctness has been verified, and obtain the correct secret share list of the user. Output the committee's secret share list {sk1,sk2,...,sk n }.

5. The dynamic reputation-based editable and accountable blockchain method according to claim 1 is characterized in that: The step 400 specifically includes the following steps: Step S401, input Chameleon hash public key pk CH , message m∈{0,1} * , output hash value h and random number r, randomly select a random number r←G1, calculate H1(m)→G1, calculate h=e(r,g2)e(H1(m),pk CH ); Step S402: Enter the hashed public key of the user generating the Message m∈{0,1} * , and chameleon hash h, output signature σ; select random number calculate Output signature σ = (γ, δ).

6. The editable and accountable blockchain method based on dynamic reputation according to claim 1 is characterized in that: The step 500 specifically includes the following steps: Step S501, input hash value h, Chameleon hash public key pk CH , message m∈{0,1} * , random number r, signature σ, and the public key of the signing user Output 0 / 1; Calculate H1(m)→G1. If there is a chameleon hash h=e(r,g2)e(H1(m),pk CH )→1, otherwise output 0; calculation If you have Otherwise, the output is 0; when both outputs are 1, this step outputs 1, otherwise it outputs 0.

7. The editable and accountable blockchain method based on dynamic reputation according to claim 1 is characterized in that: The step 600 specifically includes the following steps: Step S601, input node secret shares {sk1, sk2, ..., sk n }, output the private key sk of Chameleon hash CH ; The reputation of the committee nodes collected by the node with the highest reputation is greater than the reputation threshold rep t The secret share list of nodes {sk1,sk2,...,sk j }, among which when When , the Lagrange interpolation method can be used to solve the private key of Chameleon Hash 8. The method for an editable and accountable blockchain based on dynamic reputation according to claim 1, characterized in that: The step 700 specifically includes the following steps: Step S701, input random number r, message m∈{0,1} * and new message m'∈{0,1} * , Chameleon hashed public key pk CH , private key sk CH , output random number r', hash value h'; calculate y = H1(m)H1(m') -1 , calculate a new random number Calculate the chameleon hash value h'=e(r',g2)e(H1(m'),pk CH ); Step S702: Enter the private key of the node with the highest reputation Message m'∈{0,1} * , generate the chameleon hash h', output signature σ'; calculate Select random number Calculate γ' = g k' modq, Output σ'=(γ',δ').

9. The dynamic reputation-based editable and accountable blockchain method according to claim 1, characterized in that: The step 800 specifically includes the following steps: Step S801, input the new and old Chameleon hash values ​​h and h', and the Chameleon hash public key pk CH , random number r', new message m'∈{0,1} * , output 0 / 1, calculate H1(m')→G1, judge h=h'=e(r',g2)e(H1(m'),pk CH )→1, otherwise output 0; Step S802, input signature σ', new message m'∈{0,1} * , Chameleon hash h', committee member public key Output a user's public key After the output of the previous step is 1, calculate Calculated Find a suitable public key so that Output the user's public key

Images