Cross-chain multi-asset exchange method for privacy protection

Abstract

The invention discloses a cross-chain multi-asset exchange method for privacy protection, and belongs to the technical field of block chains, and the method comprises the steps: an oracle machine node generates a public-private key pair and issues a public key; the transaction user P2 generates a receiving address on n1 first block chains held by the P1 and sends the receiving address to the P1; the P1 and the P2 execute a key generation protocol to obtain public and private key shares; the P1 promises the secret key share and generates certification information, generates a receiving address on n2 second block chains held by the P2, and sends the receiving address to the P2; p2, executing a locking transaction after verification is valid; the P2 encrypts a withdrawal transaction signature and sends the withdrawal transaction signature to the P1; the payment transaction is executed on the first block chain after P1 verification; and the P1 receives the witness information of the P2 to complete asset exchange. If a special situation occurs, if the P1 does not execute payment transaction or does not receive witness information in time, the P1 and the P2 are still not subjected to loss. The method can reduce the number of transactions, enhances privacy and atomicity, and is suitable for a cross-chain transaction scene.

Description

Technical Field

[0001] The present invention belongs to the field of blockchain technology, and specifically relates to a privacy-preserving cross-chain multi-asset exchange method. Background Art

[0002] Blockchain and cross-chain technologies have become crucial for asset management. Some highly competitive cross-chain technology projects have tens of millions of registered users, accelerating the flow of assets across different blockchains.

[0003] Cross-chain asset exchange scenarios involve users trading asset ownership between different blockchains. Existing asset exchange technologies include third-party-based methods and on-chain lock-based methods. However, most of these methods only support asset exchanges between two blockchains, not between more than two blockchains.

[0004] Thyagarajan et al. proposed a method based on on-chain locking that supports asset exchange between two or more blockchains. This method introduces a shared address for each underlying blockchain. Transfer transactions for assets on this shared address require signatures from all address creators to be authenticated and executed. Two transacting users can transfer assets to corresponding addresses, completing the asset lock transaction. In this method, each user can withdraw the other party's locked assets through a withdrawal transaction and redeem their own locked assets through a redemption transaction, ensuring transaction atomicity. Unlinkability is ensured by assuming that the two users can secretly match transaction information. Furthermore, this method only requires on-chain signature verification, ensuring indistinguishability.

[0005] However, the above method still has the following problems: (1) It requires each underlying blockchain to execute two transactions, one is a lock transaction, and the other is a withdrawal or redemption transaction, resulting in large on-chain transaction fees; (2) It can only be effectively executed when the underlying blockchain uses two-party adapter signatures to verify the transaction, which limits its versatility. Summary of the Invention

[0006] To address the aforementioned issues in the prior art, the present invention provides a privacy-preserving cross-chain multi-asset exchange method. The technical issues addressed by the present invention are achieved through the following technical solutions:

[0007] The present invention provides a privacy-preserving cross-chain multi-asset exchange method, which is executed in cycles. Within each cycle, the method includes: an exchange establishment phase, an exchange locking phase, and an exchange completion phase. The exchange establishment phase includes:

[0008] Oracle Node O i Generate a public-private key pair and publish the public key, i represents the i-th oracle node;

[0009] The exchange locking phase includes:

[0010] Transaction user P2 generates a first receiving address on each of the n1 first blockchains where the assets held by transaction user P1 are located, and sends it to transaction user P1;

[0011] Transaction users P1 and P2, as participants, execute the key generation protocol and obtain the first public and private key shares and the second public and private key shares respectively;

[0012] Trading user P1 Make a commitment and generate proof information, and generate a second receiving address on the n2 second blockchains where the assets held by the transaction user P2 are located, and send the proof information and the second receiving address to the transaction user P2. Represents the signature key of the first second blockchain generated by the transaction user P1 in the first public-private key share;

[0013] When the transaction user P2 determines that the commitment is valid based on the proof information, the forced opening , and sign the lock transaction on the lth second blockchain, publish the lock transaction and its signature, and obtain a lock transaction identifier;

[0014] Transaction user P2 uses the public key to encrypt the second withdrawal transaction signature, obtains the ciphertext c, and proves π c Then, it is sent to the transaction user P1 together with the locked transaction identifier;

[0015] The exchange completion phase includes:

[0016] Transaction user P1 verifies the correctness of the ciphertext c and the locked transaction identifier. Once the verification is successful, it performs a payment transaction with transaction user P2 on the first blockchain, transfers the assets it holds to the first receiving address, signs the payment transaction, publishes the payment transaction and its signature, and sends the obtained payment transaction identifier to transaction user P2.

[0017] Transaction user P1 receives the witness information from transaction user P2. After verification, transaction user P2's assets are withdrawn from the joint asset address to the second receiving address, and a first withdrawal transaction signature is generated for the withdrawal transaction. The withdrawal transaction, the first withdrawal transaction signature, and the second withdrawal transaction signature are published to complete the asset exchange.

[0018] In one embodiment of the present invention, the transaction user P1 has corresponding addresses in n1 first blockchains. The transaction user P2 holds assets on the corresponding address of n2 second blockchains. The above assets are held, of which, and Located in the same group represents the elliptic curve group, g represents A generator in , q represents The number of elements in , n2 represents the number of second blockchains;

[0019] The steps for transaction users P1 and P2, as participants, to execute a key generation protocol and obtain first and second public and private key shares, respectively, include:

[0020] Transaction users P1 and P2 are participants in the group. Execute the key generation protocol and obtain the first public and private key shares respectively Second public and private key share Among them, sk 01 ,sk 02 Respectively represent the private key generation parameters held by transaction users P1 and P2, Respectively represent the signature keys of the lth second blockchain generated by transaction users P1 and P2, Respectively represent the verification key of the lth second blockchain generated by transaction user P1 and transaction user P2, pk l Indicates the joint asset address of the transaction user P1 and the transaction user P2 in the lth second blockchain.

[0021] In one embodiment of the present invention, transaction users P1 and P2 are participants in the group. Execute the key generation protocol and obtain the first public and private key shares respectively Second public and private key share After the steps, it also includes:

[0022] Transaction user P1 and transaction user P2 determine t, and T out , where t represents the preset number of valid signatures, Indicates the first timeout parameter, Represents the second timeout parameter, T out Indicates the preset start time of the exchange timeout phase.

[0023] In one embodiment of the present invention, the proof information includes: time difficulty T and (C T ,π T ), C T express Commitment, π T a certificate indicating the validity of the commitment;

[0024] When the transaction user P2 determines that the commitment is valid based on the proof information, the forced opening The steps of performing an operation, signing the lock transaction on the lth second blockchain, publishing the lock transaction and its signature, and obtaining a lock transaction identifier include:

[0025] Trading user P2 confirms that he has opened Is the time difficulty T within the preset range? If not, terminate the current cycle; if so, further determine (C T ,π T ) can be verify, Represents the verification key of the first second blockchain generated by the transaction user P1 in the first public-private key share;

[0026] If (C T ,π T ) can be Verify, then force open Otherwise, the current cycle is terminated;

[0027] Transaction user P2 utilization Locking transaction on the lth second blockchain Sign and get the locked transaction signature and will Publish to the lth second blockchain and obtain the locked transaction identifier of the lth second blockchain The address of the asset held by the transaction user P2 on the lth second blockchain The signing key, Represents the locked transaction on the lth second blockchain.

[0028] In one embodiment of the present invention, the transaction user P2 uses the public key to encrypt the second withdrawal transaction signature, obtains the ciphertext c, and proves π c Then, the step of sending the locked transaction identifier together with the locked transaction identifier to the transaction user P1 includes:

[0029] Transaction user P2 uses public key encryption The second withdrawal transaction signature Obtain ciphertext c and prove π c After that, the transaction identifier will be locked The ciphertext c and the proof π c Sent to trading user P1; Indicates that the transaction user P1 is at the joint asset address pk l The withdrawal transaction on the joint asset address pk l In the middle: transaction user P2 from the lth second blockchain transferred-in assets;

[0030] When transaction user P1 receives When the current time T x Is it satisfied If not, terminate the current cycle; if so, further determine the locked transaction identifier Whether it can be confirmed;

[0031] If the transaction identifier is locked If it cannot be confirmed, it means that the transaction user P2 has not transferred the assets on the lth second blockchain to the joint asset address pk l , terminate the current cycle; if the transaction identifier is locked Can be confirmed, it means that the transaction user P2 transfers the assets on the lth second blockchain to the joint asset address pk l , further use Verify the correctness of the ciphertext c;

[0032] If the ciphertext c is verified, the transaction will continue; otherwise, the current cycle will be terminated.

[0033] In one embodiment of the present invention, the transaction user P1 verifies the correctness of the ciphertext c and the locked transaction identifier. After the verification is passed, the transaction user P1 performs a payment transaction to the transaction user P2 on the first blockchain, transfers the held assets to the first receiving address, signs the payment transaction, publishes the payment transaction and its signature, and sends the obtained payment transaction identifier to the transaction user P2, including the following steps:

[0034] After the ciphertext c and the locked transaction identifier are verified, the transaction user P1 makes a payment transaction to the transaction user P2 on the jth first blockchain. Transfer the held assets to the first receiving address

[0035] use For the payment transaction Signature, generate payment transaction signature

[0036] Will Published to the jth first blockchain, obtain Payment transaction identifier

[0037] The payment transaction identifier Sent to transaction user P2 so that transaction user P2 receives the payment transaction identifier Then generate witness information.

[0038] In one embodiment of the present invention, transaction user P1 receives witness information from transaction user P2, withdraws transaction user P2's assets from the joint asset address to the second receiving address after verification, generates a first withdrawal transaction signature for the withdrawal transaction, and publishes the withdrawal transaction, the first withdrawal transaction signature, and the second withdrawal transaction signature to complete the asset exchange process, including:

[0039] If transaction user P1 If the witness information is not received, Sent to each oracle node, e cc Indicates a cross-chain event, cross-chain event e cc All withdrawal transactions on the joint asset address occur; conversely, transaction user P1 generates a witness based on the witness information from transaction user P2. The second withdrawal transaction signature Indicates that the transaction user P1 is at the joint asset address pk l Withdrawal transactions on;

[0040] Trading user P1 uses Verify the second withdrawal transaction signature

[0041] If the verification is successful, use right Sign and generate the first withdrawal transaction signature Will Published to the lth second blockchain; otherwise, Sent to each oracle node.

[0042] In one embodiment of the present invention, transaction user P1 generates a second withdrawal transaction signature based on the witness information from transaction user P2. The steps include:

[0043] If the second withdrawal transaction signature Through adapter signature verification, using the witness information and the proof π c Calculate the second withdrawal transaction signature

[0044] If the second withdrawal transaction signature Through BLS signature verification, the witness information is used as the second withdrawal transaction signature

[0045] In one embodiment of the present invention, After sending to each oracle node, it also includes:

[0046] Oracle Node O i Use private keys to control cross-chain eventscc Sign and generate a witness signature Sign the witness Sent to the transaction user P1;

[0047] Transaction user P1 from witness signature Select t valid signatures from the ciphertext c and the proof π c , calculate the second withdrawal transaction signature and use right Generate the first withdrawal transaction signature

[0048] Trading user P1 will Published to the lth second blockchain.

[0049] In one embodiment of the present invention, within each cycle, the method further comprises: an exchange timeout phase;

[0050] Transaction user P1 receives the witness information from transaction user P2. After verification, transaction user P2's assets are withdrawn from the joint asset address to the second receiving address, and a first withdrawal transaction signature is generated for the withdrawal transaction. The withdrawal transaction, the first withdrawal transaction signature, and the second withdrawal transaction signature are published. After completing the asset exchange steps, the exchange timeout phase includes:

[0051] Trading user P2 judges pk l Is there still a balance in the Redemption transactions Sign and get Further Published to the lth second blockchain, Respectively The first redemption transaction signature and the second redemption transaction signature.

[0052] Compared with the prior art, the present invention has the following beneficial effects:

[0053] (1) The privacy-preserving cross-chain multi-asset exchange method provided by the present invention supports multi-asset exchange scenarios. Compared with existing methods supporting such scenarios, it reduces the total number of required transactions and supports more transaction authentication signature types.

[0054] (2) The present invention introduces a timeout parameter and the exchange timeout phase starts at time T out , ensuring that trading user P1 has enough time to complete the asset exchange before the exchange timeout phase, and setting a π-based VTDThe redemption transaction of the scheme allows trading user P2 to keep the asset ownership unchanged when the asset exchange fails, realizing the atomicity of the asset exchange between trading users P1 and P2.

[0055] (3) The present invention introduces a witness information acquisition method for transaction user P1 to request transaction user P2 to respond, thereby avoiding the interaction between transaction user P1 and the oracle node when transaction user P2 attaches importance to privacy, maintaining unlinkability and indistinguishability, and reducing unnecessary off-chain overhead.

[0056] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 This is a schematic diagram of a model for cross-chain multi-asset exchange provided by an embodiment of the present invention;

[0058] Figure 2 This is a flow chart of a privacy-preserving cross-chain multi-asset exchange method provided by an embodiment of the present invention;

[0059] Figure 3 This is another flow chart of the privacy-preserving cross-chain multi-asset exchange method provided by an embodiment of the present invention;

[0060] Figure 4 It is a flowchart of transaction users P1 and P2 executing a key generation protocol provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0061] The present invention will be further described in detail below with reference to specific examples, but the embodiments of the present invention are not limited thereto.

[0062] To facilitate understanding, the application scenarios and related knowledge involved in the present invention are first explained here.

[0063] Figure 1 This is a schematic diagram of the cross-chain multi-asset exchange model provided by an embodiment of the present invention. Figure 1 In the privacy-preserving cross-chain multi-asset exchange method provided by the present invention, the transaction user P1 has the corresponding address of n1 first blockchains The number of holdings are The assets of the trading user P2 are the corresponding addresses of n2 second blockchains. The number of shares held is The two trading users need to exchange these assets.

[0064] The present invention introduces n oracle nodes ( i ) i∈[n], assisting transaction users P1 and P2 to complete the exchange, these oracle nodes transfer transaction user P1 Assets on It is considered as a cross-chain event for transaction user P2. The oracle node provides a signature for transaction user P1. Then transaction user P2 will The assets on P2 are transferred to P1. When the withdrawal transaction of trading user P1 is successfully published, it means that trading user P1 has received all the assets of P2, and this asset exchange is completed.

[0065] There are two threats in the above asset exchange process: (1) trading users P1 and P2 try to steal each other's currency; (2) the oracle node is curious and tries to connect trading users P1 and P2 to distinguish cross-chain transactions from intra-chain transactions.

[0066] The privacy-preserving cross-chain multi-asset exchange method provided by this invention involves a non-interactive zero-knowledge proof algorithm, a verifiable timed discrete logarithm algorithm, a digital signature algorithm, a joint key generation protocol, adapter signatures, and a verifiable witness encryption algorithm based on threshold signatures. These are described below.

[0067] (1) Non-interactive zero-knowledge proof algorithm

[0068] Non-interactive zero-knowledge proof algorithm π NIZK The process includes a setup algorithm, a proof algorithm, and a verification algorithm. The setup algorithm, Setup, generates a public reference string, crs, and a trapdoor, τ, from a difficult relation, R, where (crs, τ) ← Setup(R). The prover runs the proof algorithm, Prove, to obtain a proof, π, for a claim, x, where π ← Prove(crs, w, x), where (x, w) ∈ R. The proof, π, is verifiable, i.e., b:=Verify(crs, π, x). Specifically, if verification succeeds, the output is b = 1; otherwise, the output is b = 0.

[0069] (2) Verifiable Timed Discrete Logarithm

[0070] Verifiable Timed Discrete Logarithm Algorithm π VTD It includes the commitment algorithm Commit, the verification algorithm Verify, the opening algorithm Open and the forced opening algorithm ForceOp.

[0071] The committer runs the commitment algorithm Commit to generate an integer The time difficulty is the commitment and proof of T, that is, (C,π)←Commit(x,T).

[0072] The verifier runs the verification algorithm Verify to determine whether x is contained in C and H = g X, that is, b:=Verify(H,C,π). Specifically, if the verification is successful, the output is b=1, otherwise the output is b=0. H is sent by the committer to the verifier.

[0073] The committer can run the open algorithm Open at any time, that is, (x, r)←Open(C), where r is the implicit input information of the commitment algorithm Commit.

[0074] The verifier can only open C after running the forced opening algorithm ForceOp for T steps, that is, x←ForceOp(C).

[0075] (3) Digital Signature

[0076] Digital Signature Algorithm S It consists of three parts, namely the key generation algorithm KeyGen, the signature algorithm Sign and the signature verification algorithm Verify. Among them, (pk, sk)←KeyGen(1 λ ), (pk, sk) is the signature public and private key pair. For the message space For any message m in the ciphertext, a digital signature σ←Sign(sk,m) can be generated. σ can be publicly verified, i.e., b:=Verify(pk,m,σ). Specifically, if the verification passes, the output is b=1, otherwise the output is b=0.

[0077] (4) Joint Key Generation Protocol

[0078] Joint Key Generation Protocol PI JKG Generate public and private key shares and joint public key for two participants (such as transaction users P1 and P2). Known public parameters include Participants P1 and P2 cooperate to execute Π JKG The keys (sk1, pk2, pk) and (sk2, pk1, pk) can be obtained respectively. And for additive key sharing, For multiplicative key sharing,

[0079] (5) Adapter Signature

[0080] A difficult relation R and digital signature π S Adapter signature algorithm π AS It consists of 4 parts:

[0081] The signer executes the pre-signature algorithm to obtain the pre-signature of message m on statement Y0 Right now:

[0082]

[0083] Validators can publicly verify the execution of pre-verification algorithms Right now Specifically, if the verification is successful, b=1 is output, otherwise b=0 is output.

[0084] The signer uses the adaptation algorithm to input the witness y0 and The final signature σ can be obtained, that is

[0085] Any participant can obtain the witness y0 corresponding to Y0 under normal circumstances through the extraction algorithm, that is,

[0086] (6) Verifiable Witness Encryption Algorithm Based on Threshold Signature

[0087] The parameters are t, N, Verifiable Witness Encryption Algorithm Π Based on Threshold Signature VweTS Includes: S and witness signature Expressed as π VweTS :=(EncSig,VerEnc,DecSig).

[0088] The prover uses the EncSig algorithm to encrypt (m j ) j∈[M] The signature of the ciphertext c and the proof of encryption correctness π are obtained. c ,Right now:

[0089]

[0090] Any participant can publicly verify the encryption correctness of c through the VerEnc algorithm, that is, If the verification is successful, the output is b=1, otherwise the output is b=0.

[0091] Through the DecSig algorithm and t about A valid witness signature (Signed by generate, is a subset of size t of [N]), any participant can extract the valid signature of the j-th message, that is,

[0092] Figures 2-3 This is a flow chart of the privacy-preserving cross-chain multi-asset exchange method provided by an embodiment of the present invention. Figures 2-3As shown, the embodiment of the present invention provides a privacy-preserving cross-chain multi-asset exchange method, which is executed in cycles; each cycle can be divided into four stages, namely: exchange establishment stage (P1), exchange locking stage (P3), exchange completion stage (P4) and exchange timeout stage (P5), and during the execution of the above method, all parties can access the global clock function

[0093] The exchange establishment phase includes:

[0094] S1, Oracle node O i Generate a public-private key pair and publish the public key, i Represents the i-th oracle node.

[0095] Specifically, the oracle node O i Generate a public-private key pair and publish Respectively represent O i The generated public and private keys, i∈[n], n represents the number of oracle nodes.

[0096] The swap lock phase includes:

[0097] S2 and transaction user P2 each generate a first receiving address on the n1 first blockchains where the assets held by transaction user P1 are located, and send it to transaction user P1.

[0098] In this embodiment, transaction user P2 runs n1 times Π S .KeyGen algorithm, generates the first receiving address on the n1 first blockchains where the assets held by the trading user P1 are located Then the first receiving address Sent to trading user P1.

[0099] S3, transaction user P1 and transaction user P2, as participants, execute the key generation protocol and obtain the first public and private key shares and the second public and private key shares respectively.

[0100] It should be noted that in this embodiment, the transaction user P1 has the corresponding address of n1 first blockchains Holding assets on the corresponding address of transaction user P2 on n2 second blockchains The above assets are held, of which, and Located in the same group represents the elliptic curve group, g represents A generator in , q represents The number of elements in n2 represents the number of the second blockchain.

[0101] Specifically, in step S3, transaction users P1 and P2, as participants, Execute the key generation protocol and obtain the first public and private key shares respectively Second public and private key share Among them, sk 01 ,sk 02 Respectively represent the private key generation parameters held by transaction users P1 and P2, Respectively represent the signature keys of the lth second blockchain generated by transaction users P1 and P2, Respectively represent the verification key of the lth second blockchain generated by transaction user P1 and transaction user P2, pk l Indicates the joint asset address of transaction user P1 and transaction user P2 in the lth second blockchain.

[0102] Figure 4 This is a flowchart of the key generation protocol executed by transaction users P1 and P2 according to an embodiment of the present invention. Figure 4 When transaction users P1 and P2 execute the key generation protocol, transaction user P1 first randomly selects the private key generation parameter sk 01 , and use sk 01 Generate n2 signature keys and corresponding verification keys; then, transaction user P1 generates the corresponding proof of key validity and the hash value used as the commitment, and sends these hash values ​​to transaction user P2. After receiving the hash value, transaction user P2 randomly selects the private key generation parameter sk 02 , then use sk 02 Generate n2 signature keys and corresponding verification keys, and then generate corresponding proofs of the validity of the verification keys. These verification keys and proofs are sent to transaction user P1. If at least one of the verification keys received fails verification, transaction user P1 terminates the cooperation. Otherwise, it generates n2 joint asset addresses and sends its own verification key and proof to transaction user P2. If at least one of the hash values ​​or verification keys received fails verification, transaction user P2 terminates the cooperation. Otherwise, it generates n2 joint asset addresses. Finally, transaction user P1 and transaction user P2 respectively obtain and

[0103] Furthermore, after step S3, transaction user P1 and transaction user P2 need to determine t, and T out , where t represents the preset number of valid signatures, Indicates the first timeout parameter, Represents the second timeout parameter, T out Indicates the preset start time of the exchange timeout phase.

[0104] S4, trading user P1 Make a commitment and generate proof information, and generate a second receiving address on the n2 second blockchain where the assets held by the transaction user P2 are located, and send the proof information and the second receiving address to the transaction user P2. Indicates the signature key of the first second blockchain generated by the transaction user P1 in the first public-private key share.

[0105] For example, transaction user P1 uses Π VTD .Commit Using Π S The KeyGen algorithm generates a second receiving address on the n2 second blockchains where the assets held by the trading user P2 are located Proof information includes: time difficulty T and (C T ,π T ), C T express Commitment, π T Proof of the validity of a commitment.

[0106] S5. When the transaction user P2 determines that the commitment is valid based on the proof information, the forced opening The lock transaction on the lth second blockchain is signed, the lock transaction and its signature are published, and the lock transaction identifier is obtained.

[0107] First, trading user P2 confirms that he has opened Whether the time difficulty T is within the preset range, that is, after T steps of forced opening of VTD commitment, the transaction user P2 will transition to the exchange timeout stage instead of staying in the previous stage or entering the next cycle; if not, the current cycle is terminated; if so, further determination (C T ,π T ) can be verify, Represents the verification key of the first second blockchain generated by transaction user P1 in the first public-private key share.

[0108] If (C T ,π T ) can be Verify, then force open Otherwise, the current cycle is terminated.

[0109] Next, transaction user P2 uses Locking transaction on the lth second blockchain Sign and get the locked transaction signature and will Publish to the lth second blockchain and obtain the locked transaction identifier of the lth second blockchain The address of the asset held by the transaction user P2 on the lth second blockchain The signing key, Represents the locked transaction on the lth second blockchain.

[0110] S6. Transaction user P2 uses the public key to encrypt the second withdrawal transaction signature, obtains the ciphertext c, and proves π c Then, it is sent to transaction user P1 together with the locked transaction identifier.

[0111] Specifically, step S6 includes:

[0112] Transaction user P2 uses public key encryption The second withdrawal transaction signature Obtain ciphertext c and prove π c After that, the transaction identifier will be locked Ciphertext c and proof π c Sent to trading user P1; Indicates that the transaction user P1 is at the joint asset address pk l Withdrawal transaction on the joint asset address pk l In the middle: transaction user P2 from the lth second blockchain transferred-in assets;

[0113] When transaction user P1 receives When the current time T x Is it satisfied If not, terminate the current cycle; if so, further determine the locked transaction identifier Whether it can be confirmed;

[0114] If the transaction identifier is locked If it cannot be confirmed, it means that the transaction user P2 has not transferred the assets on the lth second blockchain to the joint asset address pk l , terminate the current cycle; if the transaction identifier is locked Can be confirmed, it means that the transaction user P2 transfers the assets on the lth second blockchain to the joint asset address pk l , further use Verify the correctness of the ciphertext c;

[0115] If the ciphertext c is verified, the transaction will continue; otherwise, the current cycle will be terminated.

[0116] The exchange completion phase includes:

[0117] S7. Transaction user P1 verifies the correctness of the ciphertext c and the locked transaction identifier. After the verification is passed, the transaction user P1 performs a payment transaction to the transaction user P2 on the first blockchain, transfers the assets held to the first receiving address, signs the payment transaction, publishes the payment transaction and its signature, and sends the obtained payment transaction identifier to transaction user P2.

[0118] Optionally, step S7 includes:

[0119] S71, after the ciphertext c and the locked transaction identifier are verified, the transaction user P1 makes a payment transaction to the transaction user P2 on the jth first blockchain. Transfer the held assets to the first receiving address.

[0120] S72, Utilization Payment transactions Signature, generate payment transaction signature

[0121] S73, will Published to the jth first blockchain, obtain Payment transaction identifier

[0122] S74. Payment transaction identifier Sent to transaction user P2 so that transaction user P2 receives the payment transaction identifier Then generate witness information.

[0123] S8. Transaction user P1 receives the witness information from transaction user P2. After verification, transaction user P2's assets are withdrawn from the joint asset address to the second receiving address, and the first withdrawal transaction signature is generated. The withdrawal transaction, the first withdrawal transaction signature, and the second withdrawal transaction signature are published to complete the asset exchange.

[0124] In this step, if the transaction user P1 If no witness information is received, Sent to each oracle node, e cc Indicates a cross-chain event, cross-chain event e cc All withdrawal transactions on the joint asset address occur; conversely, transaction user P1 generates a witness based on the witness information from transaction user P2. The second withdrawal transaction signature Indicates that the transaction user P1 is at the joint asset address pk l Withdrawal transactions on .

[0125] It should be noted that when When the relevant signature of is verified by the adapter signature, the witness information and proof π are used cCalculate the second withdrawal transaction signature Specifically, we can use the witness information and proof π c Pre-signed run Π in AS .Adapt algorithm to obtain the second withdrawal transaction signature On the other hand, when When the relevant signature passes the BLS signature verification, the witness information will be used as the second withdrawal transaction signature

[0126] Next, transaction user P1 uses Verify the second withdrawal transaction signature If the verification is successful, use right Sign and generate the first withdrawal transaction signature Will Published to the lth second blockchain; otherwise, Sent to each oracle node.

[0127] Furthermore, in step S7, After sending to each oracle node, it also includes:

[0128] Oracle node P i Use private keys to control cross-chain events cc Sign and generate a witness signature Sign the witness Sent to the transaction user P1;

[0129] Transaction user P1 from witness signature Select t valid signatures from the ciphertext c and prove π c , calculate the second withdrawal transaction signature and use right Generate the first withdrawal transaction signature

[0130] Trading user P1 will Published to the lth second blockchain.

[0131] Optionally, within each cycle, the above method further includes: an exchange timeout phase.

[0132] Transaction user P1 receives the witness information from transaction user P2. After verification, transaction user P2's assets are withdrawn from the joint asset address to the second receiving address, and the first withdrawal transaction signature is generated for the withdrawal transaction. The withdrawal transaction, the first withdrawal transaction signature, and the second withdrawal transaction signature are published. After completing the asset exchange steps, the exchange timeout phase includes:

[0133] Trading user P2 judges pk l Is there still a balance in the Redemption transactions Sign and get Further Published to the lth second blockchain, Respectively The first redemption transaction signature and the second redemption transaction signature.

[0134] in, H represents a hash function that maps any binary string to the set {0, 1, ..., q}, where q represents The number of elements in .

[0135] It can be seen from the above embodiments that the beneficial effects of the present invention are:

[0136] (1) The privacy-preserving cross-chain multi-asset exchange method provided by the present invention supports multi-asset exchange scenarios. Compared with existing methods supporting such scenarios, it reduces the total number of required transactions and supports more transaction authentication signature types.

[0137] (2) The present invention introduces a timeout parameter and the start time T of the exchange timeout phase out , ensuring that trading user P1 has enough time to complete the asset exchange before the exchange timeout phase, and setting a π-based VTD The redemption transaction of the scheme allows trading user P2 to keep the asset ownership unchanged when the asset exchange fails, realizing the atomicity of the asset exchange between trading users P1 and P2.

[0138] (3) The present invention introduces a witness information acquisition method for transaction user P1 to request transaction user P2 to respond, thereby avoiding the interaction between transaction user P1 and the oracle node when transaction user P2 attaches importance to privacy, maintaining unlinkability and indistinguishability, and reducing unnecessary off-chain overhead.

[0139] In the description of the present invention, the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of the technical features indicated. Therefore, a feature specified as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, "plurality" means two or more, unless otherwise specifically defined.

[0140] Descriptions with reference to the terms "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" mean that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described can be combined in any suitable manner in any one or more embodiments or examples. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification.

[0141] The above is a further detailed description of the present invention in conjunction with specific preferred embodiments, and the specific implementation of the present invention should not be considered to be limited to these descriptions. For those skilled in the art of the present invention, without departing from the concept of the present invention, several simple deductions or substitutions can be made, which should be considered to fall within the scope of protection of the present invention.

Claims

1. A privacy-preserving cross-chain multi-asset exchange method, characterized by: Execute in cycles; In each cycle, the method includes: an exchange establishment phase, an exchange locking phase, and an exchange completion phase; wherein the exchange establishment phase includes: Oracle Node O i Generate a public-private key pair and publish the public key, i represents the i-th oracle node; The exchange locking phase includes: Transaction user P2 generates a first receiving address on each of the n1 first blockchains where the assets held by transaction user P1 are located, and sends it to transaction user P1; Transaction users P1 and P2, as participants, execute the key generation protocol and obtain the first public and private key shares and the second public and private key shares respectively; Trading user P1 Make a commitment and generate proof information, and generate a second receiving address on the n2 second blockchains where the assets held by the transaction user P2 are located, and send the proof information and the second receiving address to the transaction user P2. Represents the signature key of the first second blockchain generated by the transaction user P1 in the first public-private key share; When the transaction user P2 determines that the commitment is valid based on the proof information, the forced opening , and sign the lock transaction on the lth second blockchain, publish the lock transaction and its signature, and obtain a lock transaction identifier; Transaction user P2 uses the public key to encrypt the second withdrawal transaction signature, obtains the ciphertext c, and proves π c Then, it is sent to the transaction user P1 together with the locked transaction identifier; The exchange completion phase includes: Transaction user P1 verifies the correctness of the ciphertext c and the locked transaction identifier. Once the verification is successful, it performs a payment transaction with transaction user P2 on the first blockchain, transfers the assets it holds to the first receiving address, signs the payment transaction, publishes the payment transaction and its signature, and sends the obtained payment transaction identifier to transaction user P2. Transaction user P1 receives the witness information from transaction user P2. After verification, transaction user P2's assets are withdrawn from the joint asset address to the second receiving address, and a first withdrawal transaction signature is generated for the withdrawal transaction. The withdrawal transaction, the first withdrawal transaction signature, and the second withdrawal transaction signature are published to complete the asset exchange.

2. The privacy-preserving cross-chain multi-asset exchange method according to claim 1, characterized in that: The corresponding address of the transaction user P1 in n1 first blockchains The transaction user P2 holds assets on the corresponding address of n2 second blockchains. The above assets are held, of which, and Located in the same group represents the elliptic curve group, g represents A generator in , q represents The number of elements in , n2 represents the number of second blockchains; The steps for transaction users P1 and P2, as participants, to execute a key generation protocol and obtain first and second public and private key shares, respectively, include: Transaction user P1 and transaction user n2 are participants in the group Execute the key generation protocol and obtain the first public and private key shares respectively Second public and private key share Among them, sk 01 ,sk 02 Respectively represent the private key generation parameters held by transaction users P1 and P2, Respectively represent the signature keys of the lth second blockchain generated by transaction users P1 and P2, Respectively represent the verification key of the lth second blockchain generated by transaction user P1 and transaction user P2, pk l Indicates the joint asset address of the transaction user P1 and the transaction user P2 in the lth second blockchain.

3. The privacy-preserving cross-chain multi-asset exchange method according to claim 2, characterized in that: Transaction users P1 and P2 are participants in the group. Execute the key generation protocol and obtain the first public and private key shares respectively Second public and private key share After the steps, it also includes: Transaction user P1 and transaction user P2 determine t, and T out , where t represents the preset number of valid signatures, Indicates the first timeout parameter, Represents the second timeout parameter, T out Indicates the preset start time of the exchange timeout phase.

4. The privacy-preserving cross-chain multi-asset exchange method according to claim 2, characterized in that: The proof information includes: time difficulty T and (C T ,π T ), C T express Commitment, π T a certificate indicating the validity of the commitment; When the transaction user P2 determines that the commitment is valid based on the proof information, the forced opening The steps of performing an operation, signing the lock transaction on the lth second blockchain, publishing the lock transaction and its signature, and obtaining a lock transaction identifier include: Trading user P2 confirms that he has opened Is the time difficulty T within the preset range? If not, terminate the current cycle; if so, further determine (C T ,π T ) can be verify, Represents the verification key of the first second blockchain generated by the transaction user P1 in the first public-private key share; If (C T ,π T ) can be Verify, then force open Otherwise, the current cycle is terminated; Transaction user P2 utilization Locking transaction on the lth second blockchain Sign and get the locked transaction signature and will Publish to the lth second blockchain and obtain the locked transaction identifier of the lth second blockchain The address of the asset held by the transaction user P2 on the lth second blockchain The signing key, Represents the locked transaction on the lth second blockchain.

5. The privacy-preserving cross-chain multi-asset exchange method according to claim 4, characterized in that: Transaction user P2 uses the public key to encrypt the second withdrawal transaction signature, obtains the ciphertext c, and proves π c Then, the step of sending the locked transaction identifier together with the locked transaction identifier to the transaction user P1 includes: Transaction user P2 uses public key encryption The second withdrawal transaction signature Obtain ciphertext c and prove π c After that, the transaction identifier will be locked The ciphertext c and the proof π c Sent to trading user P1; Indicates that the transaction user P1 is at the joint asset address pk l The withdrawal transaction on the joint asset address pk l In the middle: transaction user P2 from the lth second blockchain transferred-in assets; When transaction user P1 receives When the current time T x Is it satisfied If not, terminate the current cycle; if so, further determine the locked transaction identifier Whether it can be confirmed; If the transaction identifier is locked If it cannot be confirmed, it means that the transaction user P2 has not transferred the assets on the lth second blockchain to the joint asset address pk l , terminate the current cycle; if the transaction identifier is locked Can be confirmed, it means that the transaction user P2 transfers the assets on the lth second blockchain to the joint asset address pk l , further use Verify the correctness of the ciphertext c; If the ciphertext c is verified, the transaction will continue; otherwise, the current cycle will be terminated.

6. The privacy-preserving cross-chain multi-asset exchange method according to claim 5, characterized in that: The transaction user P1 verifies the correctness of the ciphertext c and the locked transaction identifier. After the verification is passed, the transaction user P1 performs a payment transaction to the transaction user P2 on the first blockchain, transfers the held assets to the first receiving address, signs the payment transaction, publishes the payment transaction and its signature, and sends the obtained payment transaction identifier to the transaction user P2, including the following steps: After the ciphertext c and the locked transaction identifier are verified, the transaction user P1 makes a payment transaction to the transaction user P2 on the jth first blockchain. Transfer the held assets to the first receiving address use For the payment transaction Signature, generate payment transaction signature Will Published to the jth first blockchain, obtain Payment transaction identifier The payment transaction identifier Sent to transaction user P2 so that transaction user P2 receives the payment transaction identifier Then generate witness information.

7. The privacy-preserving cross-chain multi-asset exchange method according to claim 5, characterized in that: Transaction user P1 receives the witness information from transaction user P2. After verification, transaction user P2's assets are withdrawn from the joint asset address to the second receiving address, and a first withdrawal transaction signature is generated for the withdrawal transaction. The withdrawal transaction, the first withdrawal transaction signature, and the second withdrawal transaction signature are published to complete the asset exchange process, including: If transaction user P1 If the witness information is not received, Sent to each oracle node, e cc Indicates a cross-chain event, cross-chain event e cc All withdrawal transactions on the joint asset address occur; conversely, transaction user P1 generates a witness based on the witness information from transaction user P2. The second withdrawal transaction signature Indicates that the transaction user P1 is at the joint asset address pk l Withdrawal transactions on; Trading user P1 uses Verify the second withdrawal transaction signature If the verification is successful, use right Sign and generate the first withdrawal transaction signature Will Published to the lth second blockchain; otherwise, Sent to each oracle node.

8. The privacy-preserving cross-chain multi-asset exchange method according to claim 7, characterized in that: Transaction user P1 generates a second withdrawal transaction signature based on the witness information from transaction user P2 The steps include: If the second withdrawal transaction signature Through adapter signature verification, using the witness information and the proof π c Calculate the second withdrawal transaction signature If the second withdrawal transaction signature Through BLS signature verification, the witness information is used as the second withdrawal transaction signature 9. The privacy-preserving cross-chain multi-asset exchange method according to claim 7, characterized in that: Will After sending to each oracle node, it also includes: Oracle Node O i Use private keys to control cross-chain events cc Sign and generate a witness signature Sign the witness Sent to the transaction user P1; Transaction user P1 from witness signature Select t valid signatures from the ciphertext c and the proof π c , calculate the second withdrawal transaction signature and use right Generate the first withdrawal transaction signature Trading user P1 will Published to the lth second blockchain.

10. The privacy-preserving cross-chain multi-asset exchange method according to claim 6 or 7, characterized in that: In each cycle, the method further comprises: an exchange timeout phase; Transaction user P1 receives the witness information from transaction user P2. After verification, transaction user P2's assets are withdrawn from the joint asset address to the second receiving address, and a first withdrawal transaction signature is generated for the withdrawal transaction. The withdrawal transaction, the first withdrawal transaction signature, and the second withdrawal transaction signature are published. After completing the asset exchange steps, the exchange timeout phase includes: Trading user P2 judges pk l Is there still a balance in the Redemption transactions Sign and get Further Published to the lth second blockchain, Respectively The first redemption transaction signature and the second redemption transaction signature.

Images