Decentralized traceable ring signature method and system based on blockchain

Abstract

This invention belongs to the field of information security technology, specifically to a decentralized traceable ring signature method and system based on blockchain. The method comprises: S1, generating global parameters through a system initializer and generating key pairs for the signing user and the tracer group; S2, constructing and generating a traceable ring signature based on the key pairs generated in step S1 for the signing user and the tracer group; S3, when the identity of the signer needs to be revealed, tracers who meet a set threshold submit key shares, jointly restore traceability, and locate the true signing user based on the traceable ring signature. This invention is more secure, reliable, transparent, and conforms to the principle of decentralization, while also ensuring the anonymity of user data processing.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and specifically relates to a decentralized traceable ring signature method and system based on blockchain. Background Art

[0002] With the rise of distributed ledger technology (DLT), user information security protection has become a basic and critical requirement.

[0003] Ring signature (RS) technology has emerged to prove membership or execute actions without revealing specific identities. Ring signatures allow a signer to select a set of user public keys, including their own (called a "ring"), and generate a signature for a message. Verifiers can be confident that the signature was indeed generated by a member of the ring, but they cannot determine which member it was.

[0004] While ring signatures provide effective anonymity, their inherent unlinkability (i.e., the inability to distinguish between different ring signatures of the same user) makes it difficult to prevent users from abusing their anonymity. To address this issue, the concept of traceable ring signatures (TRS) was proposed, aiming to strike a balance between anonymity and accountability. The core idea of ​​traditional TRS is that under normal circumstances, signatures remain anonymous; however, if the same signer signs multiple times under specific conditions (such as for the same event or using the same constraint identifier), these signatures become detectably linkable, allowing anyone to trace the signer's specific identity.

[0005] Traceable ring signatures introduce a "tag" associated with the signing event. When a user performs a ring signature, a value bound to the signature is generated based on their private key and the tag. If the same user uses the same tag to sign different messages, the generated signatures will be linkable, exposing duplicate signing behavior. This scheme provides a theoretical basis for achieving accountability in scenarios where the frequency or scope of anonymous actions needs to be controlled, such as limiting each voter to only one anonymous vote. It also formally defines the security properties of anonymity and traceability under the random oracle model.

[0006] In recent years, existing traceability ring signature schemes have successfully addressed, to a certain extent, the potential abuse issues associated with pure anonymity in digital interactions. By introducing "tags," limiting the number of signatures, or incorporating specific cryptographic constructs, researchers have achieved the ability to link or identify duplicate signatures or malicious behavior that meet specific conditions while protecting the anonymity of regular user data processing or behavior. However, most existing traceability schemes often rely on a centralized architecture to implement traceability permissions. Specifically, there is usually one or a few pre-defined trusted entities or authorized centers with special permissions, such as a private key generation center (PKG), a designated supervisor, or a system administrator. This entity holds the master traceability key used to reveal the signer's identity or link signatures. When the pre-defined traceability conditions are met, this centralized entity exclusively performs identity traceability operations.

[0007] First, the traceability of the entire system is entirely dependent on the availability and stability of a single central entity. If this central entity fails to function properly due to technical failure, cyberattack, operational disruption, or policy reasons, the traceability function of the entire system will be completely paralyzed. This means that when traceability is required to curb malicious behavior or meet compliance requirements, the system may lose its critical accountability capabilities, which is unacceptable for a system that requires high reliability.

[0008] Furthermore, this model requires all system participants to place extremely high, even absolute, trust in the central traceability entity. This entity holds the ultimate authority to reveal the user's anonymous identity, which can pose a risk of abuse. More importantly, this excessive concentration of trust and decision-making power runs counter to the core principles of blockchain and decentralized systems: trustlessness and decentralization, weakening the decentralized nature of the system.

[0009] Under a centralized traceability mechanism, the security of the master traceability key becomes a critical weakness in the entire system's information security protection. Once this single key is leaked or cracked due to external hacking, internal personnel negligence, or other reasons, the attacker can use this key to indiscriminately and massively crack all signatures in the system that meet the traceability requirements, tracing and exposing the real identities of a large number of users. This poses a significant risk in data processing systems with extremely high security requirements.

[0010] In summary, the centralized traceability mechanism commonly used in existing traceable ring signature schemes inherently introduces a series of serious issues, including single points of failure, trust bottlenecks, the risk of abuse of decision-making power, and systemic security information collapse caused by key leaks. These shortcomings severely limit the applicability of existing TRS technology in building truly secure, reliable, trustworthy, and decentralized data processing systems.

[0011] Therefore, it is very important to design a blockchain-based decentralized traceable ring signature method and system that is more secure, reliable, transparent, and in line with the principle of decentralization, while ensuring the anonymity of user data processing. Summary of the Invention

[0012] The present invention aims to overcome a series of serious problems in the prior art, such as the centralized traceability mechanism commonly adopted in existing traceable ring signature schemes, which leads to single points of failure, trust bottlenecks, risks of abuse of decision-making power, and systemic security information collapse caused by key leakage. It provides a more secure, reliable, transparent and decentralized decentralized decentralized traceable ring signature method and system based on blockchain, which can ensure the anonymity of user data processing.

[0013] In order to achieve the above-mentioned object of the invention, the present invention adopts the following technical solutions:

[0014] The decentralized traceable ring signature method based on blockchain includes the following steps:

[0015] S1, according to the functions in the cryptographic protocol, set the system initializer, signing user and tracer group, and generate global parameters through the system initializer, and generate separate key pairs for the signing user and tracer group respectively;

[0016] S2: Based on the key pairs of the signing user and the tracer group generated in step S1, a traceable ring signature and the corresponding closed-loop verification process are constructed and generated based on the challenge-response mode of the hash chain;

[0017] S3, when there is a need to reveal the identity of the signer, tracers who reach the set threshold (threshold t) submit key shares, jointly restore the traceability, and at the same time adopt an algebraic verification traceability mechanism based on bilinear mapping and locate the real signing user according to the traceable ring signature.

[0018] Preferably, in step S1, the system initializer is responsible for generating global parameters and securely issuing the threshold key of the tracer group and the public-private key pair of each signing user;

[0019] The signing user is used to sign anonymously in any ring set, and is accompanied by a traceable link tag;

[0020] The tracer group includes tracers, and any subset of the tracer group that meets the threshold is used to jointly recover the traceability master private key and reveal the identity of the signer; the tracer group also includes a trusted aggregator, which is responsible for aggregating the traceability shares of the tracer group.

[0021] Preferably, step S1 includes the following steps:

[0022] Step S11: Global parameter generation. The specific process is as follows:

[0023] Choose a large prime number , and two cyclic groups 、 and target groups , are all prime order The multiplicative group of , and fix a bilinear map ; Satisfy any , , : ;parameter is a cyclic group Any element in is a cyclic group Any element in and yes Any element in Refers to large prime numbers The set of integers modulo , which contains all integers from 0 to integer;

[0024] make for A fixed generator of for A fixed generator of ;

[0025] Define two secure hash functions:

[0026] Map to , used to map messages, etc. to integers;

[0027] Map to , used to map arbitrary byte strings to group elements;

[0028] The global parameters are published as ;

[0029] Step S12: Generate the tracer group threshold key. The specific process is as follows:

[0030] Decentralize traceability Among the tracers, the threshold is set to , 1≤t≤n;

[0031] First, randomly select the traceable master private key , construct a random threshold polynomial for:

[0032] ;

[0033] parameter is A random number selected from When constructing a random threshold polynomial The random coefficients are selected from the A tracer, , The total number of tracers is calculated and securely sent as the corresponding key share ;

[0034] According to the properties of bilinear mapping, publish the global traceability public key , It is a pair generator With the master private key The value after exponentiation is set as the global traceable public key ; Each tracer discloses the verification value corresponding to its share , , It is a pair generator With the Tracer key share The value after the exponentiation operation is used to verify the Lagrange coefficient when reconstructing the traceable master private key;

[0035] Step S13: Generate a user key pair. The specific process is as follows:

[0036] Each signing user in the system You need to generate your own key pair; the signing user randomly selects , Is a signed user A randomly selected personal private key is then calculated and published as a public key. , Is a signed user According to its private key The calculated personal public key, Is to generate the element With the signing user's private key The value obtained by exponentiation operation; the public keys of all signing users are stored in a public registry and are used to form the ring set required for ring signature at any time.

[0037] Preferably, step S2 includes the following steps:

[0038] Step S21: construct a ring set. The specific process is as follows:

[0039] Set the signer's message Sign and select the public key set in the ring , where the signer's own public key , whose index in the collection is , The size of the ring chosen for the signers, that is, the number of signers in the ring;

[0040] Step S22: Generate a label. The specific process is as follows:

[0041] Bind signature event to generate tag, let tag , TX represents the data processing timestamp and data processing ID, Indicates connection;

[0042] Step S23: Calculate the link tag. The specific process is as follows:

[0043] The signer uses the private key Generate a link tag with the tag tag, which is used to detect duplicate signatures of the same private key. The link tag is ;

[0044] If the same signing user signs the same tag repeatedly, the corresponding The values ​​will remain consistent, making them linkable;

[0045] Step S24: random number generation. The specific process is as follows:

[0046] The signer is each Prepare random numbers using the public key:

[0047] ;parameter The signer is each member (index is s) in the ring except himself (index is s) )’s public key;

[0048] Among them, is the public key index of the current signer of Leave it for final calculation;

[0049] Select a random number for the current signer ;

[0050] Step S25: Calculate the hash challenge chain. The specific process is as follows:

[0051] In order to construct a ring signature, a set of chained challenge values ​​{ }: These values ​​start from an initial hash value based on the signer information Start, then for each other member of the ring ( ) The subsequent hash operations are iterated and calculated , ultimately ensuring that a closed verification loop is formed when the calculation returns to the signer itself; first arbitrarily select the initial value:

[0052] ;

[0053] parameter is the initial hash value in the chained hash challenge;

[0054] Then The positions are calculated in sequence:

[0055] ;

[0056] parameter This is the first in the ring members (when When recursion returns to When the closed-loop consistency condition is met, the specific value of the signer is determined , and the signer deciphers his own response value: , used to ensure loop closure, parameter In the calculation of the hash challenge chain, when the recursion is passed to The corresponding challenge hash value when the signer is in the position;

[0057] Step S26: Output the complete signature. The specific process is as follows:

[0058] The signer packages the following data to form a traceable ring signature :

[0059] ;

[0060] Among them, tag is bound to the signature context; As a link tag, it can realize homology signature detection; is a standard ring signature challenge / response pair;

[0061] Step S27: signature verification. The specific process is as follows:

[0062] During signature verification, according to the received ,Depend on and , through the equation , calculated recursively , and finally compare and the calculated Are they equal? ​​If they are equal, it means that a closed loop can be formed and the signature can be verified correctly.

[0063] Preferably, step S3 includes the following steps:

[0064] Step S31: Reconstruct the traceable master private key through Lagrange interpolation The specific process is as follows:

[0065] Each tracer Submit its share to the aggregator through a secure channel. The aggregator is the aggregation node collectively designated by the tracers, and obtains the collection ;

[0066] To prevent malicious tracers from submitting forged shares, each tracer Verify the corresponding public verification value Is it satisfied ; Among them, the index collection ;

[0067] For each tracer , calculate the corresponding Lagrange coefficient , and use the calculated Lagrange coefficient to reconstruct the master private key ;

[0068] The true traceable master private key is recovered in a secure environment;

[0069] Step S32: tracing the signer. The specific process is as follows:

[0070] Link tags in known signatures ;Reconstructed traceable master private key ; Candidate public key set ;in, ;

[0071] Calculate the median value ;

[0072] For each candidate index , through test comparison:

[0073] , Indicates testing or verifying whether both sides of an equation are equal;

[0074] Expand both sides of the equation to:

[0075] Left side ;

[0076] right side ;

[0077] When we find the equation that , that is, the real identity corresponding to the public key is traced back.

[0078] Preferably, the process of step S3 is completed jointly by any t tracers among the n tracers.

[0079] The present invention also provides a decentralized traceable ring signature system based on blockchain, including:

[0080] The system initialization and key distribution module is used to generate global parameters through the system initializer and generate separate key pairs for the signing user and tracer group respectively;

[0081] The traceable ring signature construction and generation module is used to construct and generate a traceable ring signature based on the key pairs of the generated signing user and the tracer group;

[0082] The threshold decentralized tracing module is used to enable tracers who have reached a set threshold to submit key shares when there is a need to reveal the identity of the signer, jointly restore the tracing capability, and locate the real signing user based on the traceable ring signature.

[0083] Compared with the existing technology, the present invention has the following advantages: (1) The innovation of the present invention lies in the innovative design of the traceability mechanism in the existing traceable ring signature system, which introduces and implements a decentralized traceability scheme based on threshold authorization; this core design solves many inherent defects of the traditional TRS scheme caused by relying on centralized traceability authority when applied to data processing scenarios with high security, high reliability and strong decentralization requirements; (2) The present invention proposes and designs an innovative traceability architecture in detail; the present invention no longer relies on a single traceability authority, but instead disperses the traceability authority and capabilities to a "tracer group" composed of multiple independent or semi-independent members; these members are verification nodes in the system, members of the licensed regulatory alliance, or other distributed entities with corresponding qualifications defined by the agreement; the final execution of any traceability operation cannot be unilaterally completed by any single member or a few members in the tracer group, and a preset number of tracer group members must jointly verify and approve a traceability request and collaborate to provide part of the traceability information or key share they hold in order to successfully activate and complete the entire traceability process; participation below the threshold will Unable to trigger effective tracing; (3) The present invention is a decentralized, multi-party threshold tracing mechanism; this mechanism eliminates single points of failure, and the system's tracing function no longer depends on the online and integrity of any single entity, but on the overall availability and majority decision-making of a distributed group; it disperses trust and decision-making power, and no tracer has absolute tracing decision-making power, effectively preventing the abuse of decision-making power; even if the credentials of some tracer members or the traceability information fragments they hold are compromised, as long as the threshold number for triggering tracing is not reached, the attacker cannot complete the illegal tracing of the user's identity, thereby enhancing the robustness of the entire system against malicious attacks and internal threats; (4) The data processing algorithm proposed by the present invention, which integrates the decentralized threshold tracing mechanism, shows unique advantages in practical applications; (5) The present invention provides a safe and practical solution for data processing algorithms based on traceable ring signatures through its unique decentralized threshold tracing architecture; this innovation provides a useful idea for solving the existing centralized tracing mechanism and lays a solid foundation for building a secure, reliable, efficient and truly decentralized anonymous or security information enhanced system in the future. BRIEF DESCRIPTION OF THE DRAWINGS

[0084] Figure 1 This is a flowchart of the decentralized traceable ring signature method based on blockchain in the present invention. DETAILED DESCRIPTION

[0085] To more clearly illustrate the embodiments of the present invention, specific embodiments of the present invention will be described below with reference to the accompanying drawings. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings and other embodiments can be obtained based on these drawings without inventive efforts.

[0086] like Figure 1 As shown, the present invention provides a decentralized traceable ring signature method based on blockchain, comprising the following steps:

[0087] 1. Generate global parameters through the system initializer, and generate separate key pairs for the signing user and tracer group;

[0088] 2. Based on the key pairs of the signing user and the tracer group generated in step 1, a traceable ring signature is constructed and generated;

[0089] 3. When the identity of the signer needs to be revealed, tracers who have reached a set threshold (threshold t) submit key shares, jointly restore the traceability, and locate the real signing user based on the traceable ring signature.

[0090] The solution of the present invention has three types of participants: the system initializer, responsible for generating global parameters and securely issuing the threshold key of the tracer group and the public-private key pairs of each signing user; the signing user, who anonymously signs within any ring set and attaches a traceable link label; the tracer group, composed of n nodes, any subset that meets the threshold t can jointly recover the traceability private key and reveal the identity of the signer. The tracer group also includes a trusted aggregator, responsible for aggregating the traceability share of the tracer group.

[0091] For step 1, the specific process includes the following:

[0092] 1-1, Global parameter generation, the specific process is as follows:

[0093] Choose a large prime number , and two cyclic groups 、 and target groups , are all prime order The multiplicative group of , and fix a bilinear map ; Satisfy any , , : ;parameter is a cyclic group Any element in is a cyclic group Any element in and yes Any element in Refers to large prime numbers The set of integers modulo , which contains all integers from 0 to integer;

[0094] make for A fixed generator of for A fixed generator of ;

[0095] Define two secure hash functions:

[0096] Map to , used to map messages, etc. to integers;

[0097] Map to , used to map arbitrary byte strings to group elements;

[0098] The global parameters are published as ;

[0099] 1-2, the tracer group threshold key is generated. The specific process is as follows:

[0100] Decentralize traceability Among the tracers, the threshold is set to , 1≤t≤n;

[0101] First, randomly select the traceable master private key , construct a random threshold polynomial for:

[0102] ;

[0103] parameter is A random number selected from When constructing a random threshold polynomial The random coefficients are selected from the A tracer, , The total number of tracers is calculated and securely sent as the corresponding key share ;

[0104] According to the properties of bilinear mapping, publish the global traceability public key , It is a pair generator With the master private key The value after exponentiation is set as the global traceable public key ; Each tracer discloses the verification value corresponding to its share , , It is a pair generator With the Tracer key share The value after the exponentiation operation is used to verify the Lagrange coefficient when reconstructing the traceable master private key;

[0105] 1-3, User key pair generation, the specific process is as follows:

[0106] Each signing user in the system You need to generate your own key pair; the signing user randomly selects , Is a signed user A randomly selected personal private key is then calculated and published as a public key. , Is a signed user According to its private key The calculated personal public key, Is to generate the element With the signing user's private key The value obtained by exponentiation operation; the public keys of all signing users are stored in a public registry and are used to form the ring set required for ring signature at any time.

[0107] For step 2, the specific process includes the following:

[0108] 2-1, build a ring set, the specific process is as follows:

[0109] Set the signer's message Sign and select the public key set in the ring , where the signer's own public key , whose index in the collection is ;

[0110] 2-2, Generate labels. The specific process is as follows:

[0111] Bind signature event to generate tag, let tag , TX represents the data processing timestamp and data processing ID, Indicates connection;

[0112] 2-3, calculate the link label, the specific process is as follows:

[0113] The signer uses the private key Generate a link tag with the tag tag, which is used to detect duplicate signatures of the same private key. The link tag is ;

[0114] If the same signing user signs the same tag repeatedly, the corresponding The values ​​will remain consistent, making them linkable;

[0115] 2-4, random number generation, the specific process is as follows:

[0116] The signer is each Prepare random numbers using the public key:

[0117] ;parameter The signer is each member (index is s) in the ring except himself (index is s) )’s public key;

[0118] Among them, is the public key index of the current signer of Leave it for final calculation;

[0119] Select a random number for the current signer ;

[0120] 2-5. Calculate the hash challenge chain. The specific process is as follows:

[0121] In order to construct a ring signature, a set of chained challenge values ​​{ }: These values ​​start from an initial hash value based on the signer information Start, then for each other member of the ring ( ) The subsequent hash operations are iterated and calculated , ultimately ensuring that a closed verification loop is formed when the calculation returns to the signer itself;

[0122] First, arbitrarily select the initial value:

[0123] ;

[0124] parameter is the initial hash value in the chained hash challenge;

[0125] Then The positions are calculated in sequence:

[0126] ;

[0127] parameter This is the first in the ring members (when When recursion returns to When the closed-loop consistency condition is met, the specific value of the signer is determined , and the signer deciphers his own response value: , used to ensure loop closure, parameter In the calculation of the hash challenge chain, when the recursion is passed to The corresponding challenge hash value when the signer is in the position;

[0128] 2-6, output the complete signature. The specific process is as follows:

[0129] The signer packages the following data to form a traceable ring signature :

[0130] ;

[0131] Among them, tag is bound to the signature context; As a link tag, it can realize homology signature detection; is a standard ring signature challenge / response pair;

[0132] 2-7, signature verification, the specific process is as follows:

[0133] During signature verification, according to the received ,Depend on and , through the equation , calculated recursively , and finally compare and the calculated Are they equal? ​​If they are equal, it means that a closed loop can be formed and the signature can be verified correctly.

[0134] For step 3, the specific process includes the following:

[0135] 3-1, Reconstructing the master private key through Lagrange interpolation The specific process is as follows:

[0136] Each tracer Submit its share to the aggregator through a secure channel. The aggregator is the aggregation node collectively designated by the tracers, and obtains the collection ;

[0137] To prevent malicious tracers from submitting forged shares, each tracer Verify the corresponding public verification value Is it satisfied ; Among them, the index collection ;

[0138] For each tracer , calculate the corresponding Lagrange coefficient , and use the calculated Lagrange coefficient to reconstruct the master private key ;

[0139] The true traceable master private key is recovered in a secure environment;

[0140] 3-2, Signer tracing, the specific process is as follows:

[0141] Link tags in known signatures ;Reconstructed traceable master private key ; Candidate public key set ;in, ;

[0142] Calculate the median value ;

[0143] For each candidate index , through test comparison:

[0144] , Indicates testing or verifying whether both sides of an equation are equal;

[0145] Expand both sides of the equation to:

[0146] Left side ;

[0147] right side ;

[0148] When we find the equation that , that is, the real identity corresponding to the public key is traced back.

[0149] The process of step 3 is completed jointly by any t of the n tracers.

[0150] In addition, the present invention also provides a decentralized traceable ring signature system based on blockchain, including:

[0151] The system initialization and key distribution module is used to generate global parameters through the system initializer and generate separate key pairs for the signing user and tracer group respectively;

[0152] The traceable ring signature construction and generation module is used to construct and generate a traceable ring signature based on the key pairs of the generated signing user and the tracer group;

[0153] The threshold decentralized tracing module is used to enable tracers who have reached a set threshold to submit key shares when there is a need to reveal the identity of the signer, jointly restore the tracing capability, and locate the real signing user based on the traceable ring signature.

[0154] Based on the technical solution of the present invention, the following case scenario is used to illustrate the implementation process of the present invention in practical application. The specific application implementation plan is as follows:

[0155] The present invention can be implemented as a protocol that ensures the anonymity of data processing on a blockchain while also providing decentralized traceability capabilities. First, system initialization and credential distribution occur. According to the method of the present invention, the system initializer establishes the basic security rules and general computing parameters required for the blockchain data processing environment. Subsequently, personal confidential data processing credentials and identity credentials are generated for each user participating in data processing. Simultaneously, a "traceability group" consisting of multiple independent members is established, responsible for executing traceability under specific conditions. The core confidential information used for traceability is broken down into multiple fragments and securely distributed to each member of the traceability group. The system specifies that a predetermined number of traceability group members must participate before these fragments can be merged and traceability enabled. Next, the user performs anonymous blockchain data processing. When a user initiates data processing, their public identity credentials are combined with the public credentials of other users on the blockchain to form a temporary "signatory set." Then, according to the method of the present invention, the user uses their confidential data processing credentials to perform special signature processing on information containing data processing details (such as amount, timestamp, data processing number, etc.). This signature verifies that the data processing originated from a specific individual in the "signatory set," but the specific identity cannot be identified by the outside world, thus ensuring the anonymity of user data processing. This signature also contains a special marker, allowing the backend system to detect duplicate or suspicious data processing by the same user without revealing their identity. Finally, decentralized tracing is performed when necessary. When an anonymous data transaction on the blockchain triggers a pre-set compliance tracing condition and is confirmed by legal procedures to require investigation, the decentralized tracing process is initiated. This requires joint authorization from a predetermined threshold of members in the "tracing group." These authorized members submit fragments of confidential information they maintain. After verifying and aggregating a sufficient number of fragments, the system restores full tracing capabilities. Subsequently, according to the method of the present invention, this restored tracing capability and the information in the original data transaction signature are combined with a series of matching verifications to accurately locate the true initiator of the suspicious data transaction from the "signatory set." The entire tracing process relies on multi-party participation, preventing a single institution from excessively exercising tracing decision-making power and aligning with the principle of decentralization. Through the above steps, this embodiment achieves anonymity protection of blockchain data processing and decentralized and controllable traceability under specific circumstances, thereby improving the security, transparency and user trust of the system.

[0156] This invention aims to propose a data processing algorithm based on decentralized traceable ring signatures. Its core is to introduce and implement a decentralized traceability solution. Unlike traditional traceability mechanisms that rely on a single authoritative authority, the traceability mechanism proposed in this invention distributes traceability authority to a group of independent tracers. The execution of any traceability operation is not unilaterally determined by any single tracer; instead, it requires the joint authorization and collaborative participation of a preset threshold number of members within the group. A single tracer, or a subset of tracers that does not meet the threshold, cannot independently initiate or complete a valid traceability process.

[0157] By implementing a decentralized traceability solution based on a group of tracers and threshold authorization, this invention aims to fundamentally address the pain points of existing technologies. This design significantly eliminates single points of failure, as the system's traceability capabilities no longer rely on the state of any single entity. By decentralizing traceability decision-making and execution rights, the risks of centralized trust and the potential for abuse of individual decision-making power are significantly reduced, better embodying the concept of decentralization. Regarding security, since traceability operations require the participation of multiple tracers, the threshold for resisting key leaks and malicious attacks is increased. Even if the credentials or key shares of some tracers are compromised, as long as the pre-set threshold is not reached, it will not pose a substantial threat to the entire system's traceability mechanism or user security information.

[0158] The algorithm proposed in this invention has significant value and application prospects in multiple practical application scenarios, especially in decentralized data processing and related activities that have high requirements for security information protection and controllable accountability. Through this solution, while protecting the security information of user data processing, a transparent and single-point manipulation-resistant traceability method can be provided for regulatory agencies or protocol governance parties. For example, if multiple reputable and geographically dispersed regulatory nodes or community representatives are included in the tracer group, a penetrating investigation of specific suspicious data processing can only be conducted when the nodes that reach the statutory threshold unanimously agree. This helps to maximize its decentralization and security information protection characteristics while meeting regulatory requirements.

[0159] The decentralized traceable data processing algorithm proposed in this invention is committed to providing a more secure, reliable, transparent and decentralized accountability framework while ensuring the anonymity of user data processing.

[0160] The above description is only a detailed description of the preferred embodiments and principles of the present invention. For ordinary technicians in this field, based on the ideas provided by the present invention, there may be changes in the specific implementation methods, and these changes should also be considered as the scope of protection of the present invention.

Claims

1. A decentralized traceable ring signature method based on blockchain, characterized by: The method includes the following steps: S1, according to the functions in the cryptographic protocol, set the system initializer, signing user and tracer group, and generate global parameters through the system initializer, and generate separate key pairs for the signing user and tracer group respectively; S2: Based on the key pairs of the signing user and the tracer group generated in step S1, a traceable ring signature and the corresponding closed-loop verification process are constructed and generated based on the challenge-response mode of the hash chain; S3: When the identity of the signer needs to be revealed, tracers who have reached a set threshold submit key shares, jointly restore the traceability, and use an algebraic verification traceability mechanism based on bilinear mapping to locate the real signer based on the traceable ring signature; In step S1, the system initializer is responsible for generating global parameters and securely issuing the threshold key of the tracer group and the public-private key pairs of each signing user; The signing user is used to sign anonymously in any ring set, and is accompanied by a traceable link tag; The tracer group includes n tracers, and any subset of the tracer group that meets the threshold is used to jointly recover the traceability master private key and reveal the identity of the signer; the tracer group also includes a trusted aggregator, which is responsible for aggregating the traceability shares of the tracer group; Step S1 includes the following steps: Step S11: Global parameter generation. The specific process is as follows: Choose a large prime number p and two cyclic groups and target groups They are all multiplicative groups of prime order p, and a bilinear map e is fixed: Satisfy any e(u a ,v b )=e(u,v) ab ; The parameter u is a cyclic group Any element in , parameter v is a cyclic group Any element in , parameters a and b are Any element in It refers to the set of integers modulo a large prime number p, which contains all integers from 0 to p-1; Let g1 be A fixed generator of g2 is A fixed generator of ; Define two secure hash functions: H1:{0,1} * Map to Used to map messages, etc. to integers; H2:{0,1} * Map to Used to map arbitrary byte strings to group elements; The global parameters are published as Step S12: Generate the tracer group threshold key. The specific process is as follows: Distribute the tracing authority among n tracers, and set the threshold as t, 1≤t≤n; First, randomly select the traceable master private key Construct a random threshold polynomial f(x); According to the properties of bilinear mapping, publish the global traceability public key The value after the power operation of the generator g1 and the master private key tsk is set as the global traceability public key tpk; each tracer publicly discloses the verification value corresponding to its share is the pairing of generator g2 and the key share tsk of the i-th tracer i The value after the exponentiation operation is used to verify the Lagrange coefficient when reconstructing the traceable master private key; Step S13: Generate a user key pair. The specific process is as follows: Each signing user l in the system needs to generate his own key pair; the signing user randomly selects sk l The signing user l randomly selects a personal private key, and then calculates the public key and makes it public pk l Is the signature user l according to his private key sk l The calculated personal public key, The generator g2 is combined with the signature user private key sk l The value obtained by exponentiation operation; the public keys of all signing users are stored in a public registry and are used to form the ring set required for ring signature at any time; Step S2 includes the following steps: Step S21: construct a ring set. The specific process is as follows: Suppose the signer wants to sign the message M and select the public key set in the ring The signer's own public key pk s , the index in the set is s, and L is the number of signers in the ring; Step S22: Generate a label. The specific process is as follows: Bind signature event to generate tag, let tag TX represents the combination of data processing timestamp and data processing ID, and || represents connection; Step S23: Calculate the link tag. The specific process is as follows: The signer uses the private key sk s Generate a link tag with the tag tag, which is used to detect duplicate signatures of the same private key. The link tag is If the same signing user signs the same tag repeatedly, the corresponding Y value will remain consistent, thus achieving linkability; Step S24: random number generation. The specific process is as follows: The signer prepares a random number for each public key in the ring with l≠s: Parameter r l It is a random number prepared by the signer for the public key of each member in the ring except himself; Step S25: Calculate the hash challenge chain. The specific process is as follows: Define a set of chained challenge values ​​{c l }; the chain challenge value {c l }From an initial hash value c based on the signer information s+1 Then, for each member l in the ring, the subsequent c is calculated by hashing iteratively. l+1 , ultimately ensuring that a closed verification loop is formed when the calculation returns to the signer itself; where l≠s; First, arbitrarily select the initial value: Parameter c s+1 is the initial hash value in the chained hash challenge; Then calculate the chain hash challenge value c for the position l≠s in sequence l+1 ; Parameter c l+1 is the chained hash challenge value calculated for the lth member in the ring, l≠s; when recursively returning to l=s, the closed-loop consistency condition is satisfied and the signer's specific value r is determined s , and the signer solves his own response value: r s =(xc s ·sk s ) mod p, used to ensure loop closure, parameter c s It is the challenge hash value when recursively passed to the signer at the position s-1 mod n in the calculation of the hash challenge chain; Step S26: Output the complete signature. The specific process is as follows: The signer packages the following data to form a traceable ring signature σ: σ=(tag,Y,c1,{r1,…,r L }); Among them, tag is bound to the signature context; Y is used as a link tag to implement homologous signature detection; {c l },{r l } is a standard ring signature challenge / response pair; Step S27: signature verification. The specific process is as follows: During signature verification, according to the received σ=(tag,Y,c1,{r1,…,r L }), by {r1,…,r L } and c1, by equation Recursive calculation yields {c′1,c2,…,c L }, and finally compare c1 with the calculated c ′ 1 are equal. If they are equal, it means that a closed loop can be formed and the signature can be verified correctly; Step S3 includes the following steps: Step S31: reconstruct the traceable master private key tsk through Lagrange interpolation. The specific process is as follows: Each tracer i submits his share to the aggregator through a secure channel. The aggregator is the aggregation node collectively designated by the tracers, and the collection is obtained. Verify the corresponding public verification value for each tracer i∈S Is it satisfied Among them, the index set S={i1,i2,…,i t }; For each tracer i∈S, calculate the corresponding Lagrange coefficient At the same time, the calculated Lagrange coefficient is used to reconstruct the master private key tsk=∑ i∈S λ i tsk i mod p; Step S32: tracing the signer. The specific process is as follows: Link tags in known signatures Reconstructed traceable master private key tsk; candidate public key set in, Calculate the median value For each candidate index j=1,…,n, compare by testing: Indicates testing or verifying whether both sides of an equation are equal; Expand both sides of the equation to: When j=s is found so that the equation holds, the true identity corresponding to the public key is traced back.

2. The decentralized traceable ring signature method based on blockchain according to claim 1, characterized in that: The process of step S3 is completed jointly by any t tracers among the n tracers.

3. A decentralized traceable ring signature system based on blockchain, used to implement the decentralized traceable ring signature method based on blockchain according to any one of claims 1-2, characterized in that: The blockchain-based decentralized traceable ring signature system includes: The system initialization and key distribution module is used to generate global parameters through the system initializer and generate separate key pairs for the signing user and tracer group respectively; The traceable ring signature construction and generation module is used to construct and generate a traceable ring signature based on the key pairs of the generated signing user and the tracer group; The threshold decentralized tracing module is used to enable tracers who have reached a set threshold to submit key shares when there is a need to reveal the identity of the signer, jointly restore the tracing capability, and locate the real signing user based on the traceable ring signature.

Images