CN106911470B - A Privacy-enhancing Approach for Bitcoin Transactions - Google Patents

Abstract

A bit currency transaction privacy enhancement method comprises the following steps: 1. initializing, and outputting a system encryption and decryption and verification initial value; 2. calculating the total input amount; 3. encrypting each amount sent; 4, carrying out a verification process to ensure that the transaction value is always positive and ensure that the transaction input and output are equal; 5. after passing the verification, the data is sent, and the receiver decrypts the data; 6. the trade bill is published and confirmed all over the network. Through the steps, the complete design is carried out from the problems of the existing bitcoin system, and the problem of privacy disclosure of the quota exposure in the bitcoin system is solved; the method covers a bit currency system, a homomorphic encryption system and a commitment value to prove a plurality of cryptology primitives, applies methods in different fields to the actual problem of privacy enhancement, has encryption and decryption performance, homomorphic characteristics, zero knowledge characteristics, safety, high efficiency and compatibility, and realizes the smooth transaction process of the encrypted bit currency.

Description

A Privacy-enhancing Approach for Bitcoin Transactions

(1) Technical field:

The invention designs a privacy enhancement method for bitcoin transactions, which is used to protect the security of plaintext amounts in the process of bitcoin transactions. The scheme realizes the encryption and decryption operation of the amount through the additive homomorphic system, which ensures the privacy of the amount in the transmission process, and at the same time, through the commitment value proof, it guarantees that the hidden amount in the transaction is always positive and the total input and output are equal. This scheme belongs to the field of cryptography and cryptographic currency in information security.

(2) Technical background:

In 2008, Japanese programmer Satoshi Nakamoto designed and released a peer-to-peer decentralized digital currency, Bitcoin. The Bitcoin system proposes a new distributed model based on peer-to-peer, which removes the trusted central organization of traditional electronic money. The decentralization, immutability of information, wide dissemination of information, and anonymity of information exhibited by Bitcoin and the underlying blockchain technology have gradually attracted the attention and in-depth research of the academic and industrial circles.

The emergence and development of Bitcoin has led to the rise of a series of Internet currencies based on cryptography. According to different working principles, it can be roughly divided into three categories: PoW-based, PoS-based and PoW+PoS-based. POW (Proof of Work, Proof of Work) refers to how much currency you get, depending on the amount of work you contribute to mining. The better the computer performance, the more mines will be distributed to you. The currencies represented are: Bitcoin, Litecoin , Dogecoin, Zcash. POS (Proof of Stake, Proof of Stake) is a system of interest distribution based on the amount and time of currency you hold. In the POS mode, your "mining" income is proportional to your currency age, regardless of the computer's computing performance. , representing: BitShares, Smart Square Black Coin. The representatives based on PoW+PoS are: Ethereum, Peercoin. There are other currencies such as: Ripple, Stellar, and Futures.

The rise of Bitcoin and other electronic currencies has led to the widespread application of blockchain technology. In the era of blockchain 1.0, the underlying industrial structure formed with Bitcoin and other digital currencies as the core has formed mining machines, mining pools, and digital currencies. , payment wallet, exchange, digital currency gateway industry group and industry chain. In the era of blockchain 2.0, the focus of technology and applications has shifted from pure electronic currency to the application of the underlying technology blockchain technology, forming diversified, multi-style, and multi-scenario applications, with large spans of categories and industries and a high degree of independence . Asset verification, financial services, charity, media and community, research and investment, smart contracts, fair anti-counterfeiting, asset trading, bank settlement, e-commerce, social communication, Internet of Things, file storage, etc.

Aiming at the leakage of transaction privacy caused by the use of large-scale Bitcoin, the scheme uses the Paillier scheme of the homomorphic encryption scheme to encrypt the transmission of the plaintext transaction amount. The system was proposed by Pascal Paillier in 1999. The difficulty of the encryption system is based on the composite-order residual class difficulty problem, and it has the security against chosen plaintext attack under the standard model. The system has the property of addition homomorphism, so that the corresponding plaintext addition and subtraction operations are realized by multiplying the encrypted ciphertext. This property is used in the verification process without revealing privacy. In addition to the homomorphic properties, the system is also highly efficient, allowing the scheme to perform pre-computation and fast computation using the Chinese remainder theorem to satisfy the encryption and decryption steps within the Bitcoin transaction time.

After using the encryption system for encryption, the generated ciphertext will exist in each transaction order. In order to ensure that the plaintext hidden by the corresponding ciphertext satisfies the positive and equal requirements, the scheme uses the Proof of Commitment Value for verification. The method proposed by Wu Qianhong et al. in 2004 is used to prove that the commitment value is in a specific interval. This method guarantees a small expansion field under a relatively simple process, so that the secret amount can be maintained as a positive value verifiable. Proving that two commitment values are equal uses the idea of hash map value equality to verify that two commitment values contain the same secret without revealing the number of commitments. Both proof-of-commitment schemes have zero-knowledge properties, which ensure that the encrypted amount will not be leaked during the verification process.

(3) Contents of the invention:

1. Purpose: The purpose of the present invention is to propose a privacy enhancement method for Bitcoin transactions, so as to realize the privacy enhancement function of encrypting and hiding the plaintext of the original transaction amount during the transaction process. On the one hand, the scheme ensures that the encrypted ciphertext value protects the privacy of the trader well, and on the other hand, it also ensures that the hidden transaction value is always positive and the total number of transactions before and after is the same to meet the compatibility with the original bit system.

2. Technical solutions:

The method of the present invention is divided into six steps, and the six steps are distributed in the transaction layer and the verification layer in turn: 1) System initialization, generating an initial value. 2) Calculate the total input value of the transaction, that is, the total revenue of the order transaction and mining. 3) The system uses the receiver's public key to encrypt the transmission amount separately at the transaction layer, and at the same time at the verification layer uses the system public key to encrypt each amount of the same amount. 4) In the verification layer, verify whether the hidden amount is positive and whether the total input and output are equal. 5) After the verification layer passes the verification, the transaction layer sends the encrypted amount to the receiver, and the receiver decrypts it according to his own private key. 6) After the receiver checks that it is correct, broadcast the transaction order on the whole network and wait for confirmation.

2.1 Basic knowledge:

2.1.1 Bitcoin System

The Bitcoin system consists of three technical elements: transactions, consensus mechanisms, and distributed networks. These three technical elements also form the three-layer structure of Bitcoin and blockchain: transaction order, block, and blockchain. Bitcoin exists in the form of irreversible transaction orders. Each transaction order records the transaction data of several users, including transaction source and sending address, transaction amount, signature and other information. Each transaction ticket will have a special identifier generated by the SHA-256 hash algorithm to identify the transaction ticket. When each transaction order is completed, it must be broadcast to the whole network for confirmation. After each miner verifies the transaction order in the past period and finds a hash value whose first character is d consecutive zeros, a data block can be generated, and each data block is finally confirmed after six data blocks are generated. Cannot be changed. Immutable blocks of data form a chain structure, the blockchain. The generation of blocks is confirmed by the computing power of distributed network-wide nodes. The greater the computing power, the easier it is to find new blocks. However, due to the corresponding adjustment of the calculation difficulty, the corresponding calculation time is kept at about 10 minutes. Compared with the original electronic currency system, the Bitcoin system has the advantages of specific decentralization, unforgeability, public verifiability, and cryptographic security. After nearly 9 years of development, the system has proved its stability and scalability.

2.1.2 Paillier public key encryption system

The Paillier encryption system provides security against selected plaintext attacks under the standard model, with high encryption and decryption efficiency and the characteristics of adding homomorphism. The encryption and decryption steps of the system are as follows:

Generation: Let p and q be large prime numbers, g is the system generator, let n=pq, calculate λ=λ(n)=lcm(p-1,q-1), where the public key is (n,g), The private key is λ.

Encryption: c=g ^m ·rn mod ^{n 2} , where r is arbitrarily selected.

Decrypt:

Homomorphic property: Dec _sk (Enc _pk (m ₁ )·Enc _pk (m ₂ )modn ² )=m ₁ +m ₂ mod n.

2.1.3 Proof of Commitment Value

Proof of committed value is mainly used in the verification layer of the scheme. On the one hand, it solves the problem that the committed value is always positive, and on the other hand, it solves the characteristic that the input and output are guaranteed to be equal after the committed value is operated. In order to ensure that the encrypted privacy amount is always positive to prevent bitcoin theft, the scheme adopts the efficient proof method of commitment value in a specific range proposed by Wu Qianhong and others in 2004. The design steps of this method are relatively simple, and the expansion field is 1, so that the committed number can be limited to a specific interval. The scheme sets the lower bound to 0, which can prove that the committed number is positive. In order to ensure that the encrypted value as the output is consistent with the transaction input value, the scheme adopts the method of proving that the two commitment numbers are equal. The design idea of this scheme is simple. By hiding the secret value in the commitment value, adding a randomly selected value, and using whether the values of the two hash functions are equal to determine whether the value is consistent, the committed value can be proved to be consistent.

2.2 Contents of technical solutions

The present invention designs a method for enhancing the privacy of a bitcoin transaction. The method is implemented in six steps according to the process. The scheme structure is divided into two layers: a transaction layer and a verification layer, and the six steps are sequentially distributed in the two layers;

The present invention is a bitcoin transaction privacy enhancement method, and its operation steps are as follows:

Step 1: System initialization/KeyGen: generate security parameters for encryption and decryption operations and verification; the system inputs security parameters, outputs the generated public and private key pairs (pk _i ,ski ₎ for encryption and decryption operations, and outputs at the same time The public key pk _d used for verification, note that this public key has no paired private key;

Step 2: Calculate the total input value/Insum: Calculate the total input value of the transaction, that is, the total revenue of the order transaction and mining (there is no such revenue for non-initial blockchains); if the transaction list is used as a newly confirmed block, Then the transaction ticket will receive an additional 50 Bitcoin fee as a reward, and the total income is the sum of the operation of the part of the plaintext and the original ciphertext; if the transaction ticket is not the first order of the newly confirmed block, there is no additional income, and the total income is It is the value sent from the top order transaction;

Step 3: Encrypted item/Encrypt: The system uses the receiver's public key to encrypt the transmission amount separately at the transaction layer, and uses the system public key to encrypt each amount of the same amount at the verification layer; the encrypted amount at the transaction layer will be passed in the verification layer. Send to each recipient account, notice that the encrypted amount sent at the verification layer will enter the "dumb account", which has no private key, and the amount is discarded after verification;

Step 4: Verify item/Verify: Verify whether the hidden amount is a positive value and whether the total input and output are equal in the verification layer; the verification layer is divided into two steps, the first step is to prove the hidden value through the proof method of the commitment value in a specific interval. The amount is always positive; in the second step, two proof methods of equal commitment value are used to prove that the total number of hidden amounts before and after input and output is equal; when both steps are true, enter the sending link of the transaction layer;

Step 5: Decryption item/Decrypt: After the verification layer passes the verification, the transaction layer sends the encrypted amount to the receiver, and the receiver decrypts it according to his own private key; after the receiver checks that his received amount is correct, proceed to the next step. order transaction; the receiver's received value is the input value of the next order;

Step 6: Broadcast confirmation/Broadcast: that is, the receiver will broadcast the transaction order on the whole network and wait for confirmation after verification; the original plaintext information on the transaction order processed by this solution will be hidden as unreadable ciphertext, which ensures the transaction process. The only privacy that may be processed by analysis.

Among them, the "system initialization/KeyGen" described in step 1 is as follows:

The input of the system is the security parameter, and the output is the parameter used for encryption and decryption operations and verification; at the transaction layer, for each different recipient i, the system generates two large prime numbers p _i and q _i for each recipient. ; the receiver's private key is ski =λ _i , and the public key is pk _i =( _ni , _gi ), where _{ni = pi qi} ;

At the same time, at the verification layer, the system outputs the public key pk _d = (n _d , g _d ) of the “dumb account” used for verification, and notices that this public key has no paired private key; that is, the system account cannot perform any verification on the amount received. Operation; the system generates parameters V _α (g _α , h _α ) and V _β (g _β , h _β ) for verification.

Among them, in the "calculation of input total value/Insum" described in step 2, the calculation of input total value is divided into two cases for discussion, and the specific methods are as follows:

If the transaction ticket is used as a newly confirmed block, the transaction ticket will receive an additional 50 bitcoins as a reward (as of January 2017, it has now been halved to 25 bitcoins), and the total revenue is the plaintext of this part The sum of operations with the original ciphertext, expressed as

If the transaction order is not the first order of the newly confirmed block, there will be no additional income, and the total income is the value from the previous order transaction, which is expressed as

Among them, in the "encryption item/Encrypt" described in step 3, the encryption process is to encrypt the same amount at the transaction layer and the verification layer at the same time, and the specific method is as follows:

At the transaction layer, the scheme uses the public keys pk ₁ , pk ₂ ,...,pk _i of different receivers to encrypt the sent plaintext amounts m ₁ ,m ₂ ,...,m _i using the Paillier encryption system as c ₁ , c ₂ ,..., _ci , expressed as:

At the same time, in the verification layer, the scheme uses the same public key pk _d of the system to _encrypt the amount m ₁ , m ₂ ,..., mi sent by each transaction layer, which is expressed as:

The scheme sets random number r _d =h _β .

Among them, the "verification item/Verify" described in step 4, its verification layer is divided into two steps, the first step proves that the hidden amount is always positive through the proof method of the commitment value in a specific interval; the second step used The proof method that the two commitment values are equal proves that the total number of hidden amounts before and after input and output is equal; the specific method is as follows:

为了简化，使用E₀,E₁,E₂,E₃,F,V来代替E_i0,E_i1,E_i2,E_i3,F_i,V_i；For the first step, Verify-I, the scheme uses the proof that the commitment value is in a specific interval to ensure that the encrypted amount m _i is a positive value, and the sender Alice makes commitments for different receivers i respectively.

For simplicity, use E ₀ ,E ₁ ,E ₂ ,E ₃ ,F,V instead of E _i0 ,E _i1 ,E _i2 ,E _i3 ,Fi _{,V i ;}

1) Alice sets v=α ² y+ω>2 ^t+l+s+T , where α≠0,0<ω≤2 ^s+T is arbitrarily selected; set r ₃ -rα ² +r ₁ α+r ₂ ∈[-2 ^s n+1,...,2 ^s n-1], where r ₁ ,r ₂ ,r ₃ ∈[-2 ^s n+1,...,2 ^s n-1] are chosen arbitrarily ; then compute:

Alice sends (V, E ₂ , E ₃ , F) to the receiver;

2) The receiver calculates:

E ₁ =E ₀ (m _i ,r)/g ^a =g ^y h ^r mod n

3) Alice and the receiver each calculate:

where r ^* =-rα2 _- r1α- ^r2 _;

4) The receiver verifies the correctness of PK1, PK2, PK3, and whether v>2 ^t+l+s+T is satisfied, if satisfied, the receiver can be sure that x>a;

5) For each receiver mi, the scheme repeats steps 1)-4) to prove that _mi > 0 ( _i ={1,2,...,i});

The proof part will be repeated _i times for each receiver's mi, if any one of them fails, the transaction fails; if all are successful, the system passes, and continues to the next step of verification;

For the second step, Verify-II, the scheme uses the proof that the two commitment values are equal to ensure that the transaction output and input are consistent, that is, m=m ₁ +m ₂ +...+m _i =∑m _i ; now, Alice Make two promises as follows:

where r _α ∈{-2 ^s n+1,...,2 ^s n-1},r _β =n _d ∈{-2 ^s n+1,...,2 ^s n-1}; To a "dumb account" with the same amount, it needs to perform the following two steps:

1) The secret values hidden in the commitment values E and F are equal to m=∑m _i ;

2) The ciphertext H=Πc _id after the operation is equal to one of the commitments F;

In order to realize the above step 1), we prove as follows:

1. Alice randomly selects ω∈{1,...,2 ^i+t b-1},η _α ∈{1,...,2 ^l+t+s n-1},η _β ∈{1, ...,2 ^{l+t+ s} n-1}; then compute:

2. Alice calculates u=H(W _α ||W _β );

3. Alice calculates:

D=ω+um, D _α = η _α +ur _α , D _β =η _β +ur _β

And send (u, D, D _α , D _β ) to the "dumb account";

4. The "dumb account" tests whether u=u', where

If this part of the step verification is successful, proceed to the next part of the step verification:

1. The "dumb account" calculates the received ciphertext:

以及g_d＝g_β，是故：2. As can be seen from the above, we can arbitrarily select r _d =h _β in the encryption process, and arbitrarily select r _β =n _d in the verification process; and in the system initialization process, we set

and g _d =g _β , so:

3. Check whether H is equal to F, if not, the transaction fails, if it is, it passes, and the next step is performed;

To sum up the verification, when the steps of both parts are true, enter the sending link of the transaction layer.

Among them, in the "decryption item/Decrypt" described in step 5, after the certificate layer verification is passed, the transaction layer sends the encrypted amount c _i to the receiver, and the specific method is as follows:

The receiver _decrypts according to its own private key ski:

x∈S_n＝{u＜n²|x＝1 mod n}；in

x∈S _n ={u<n ² |x=1 mod n};

After the recipient checks that the received amount is correct, the transaction of the next order is continued; the received value of the recipient is the input value of the next order; it is worth noting that when the transaction is completed, the password in the "dumb account" The text amount will be discarded, which only acts as a bridge between the value of the verification layer and the value sent.

Among them, in the "broadcast confirmation/Broadcast" described in step 6, that is, after the receiver has verified that it is correct, the entire network broadcasts the transaction order and waits for confirmation. The specific method is as follows:

The original plaintext information on the transaction order processed by this scheme will be hidden as unreadable ciphertext, which ensures the privacy of the transaction process that may only be analyzed and processed; we can mark this transaction order as T _Alice , and this process is also applicable on any other single transaction.

Through the above steps, the Bitcoin privacy enhancement method proposed by the present invention has been discussed. The method is generated from the existing problems of the Bitcoin system, and then a complete design is carried out to solve the privacy of the amount exposed in the Bitcoin system. Leakage problem; this method covers several cryptographic primitives of Bitcoin system, homomorphic encryption system and commitment value proof, and applies methods from different fields to practical problems of privacy enhancement. According to its scheme design, this scheme has Encryption, homomorphic properties, zero-knowledge properties, security, efficiency, and compatibility; finally, this systematic approach realizes a smooth transaction process for encrypted bitcoins.

3. Advantages and efficacy:

The invention provides a privacy enhancement method for bitcoin transactions, which realizes the hidden function of the amount in the transaction under the condition of ensuring compatibility with the original bitcoin system, and ensures that the encrypted amount is always positive and the input and output are equal. . This method has 1) homomorphic properties, so that the system can perform addition and subtraction operations on the ciphertext. 2) Zero-knowledge feature, transmission and verification do not reveal any plaintext value. 3) Security, can resist different types of active and passive attacks. 4) Efficiency. Compared with solutions such as Zerocoin, it has less computational complexity, and can accelerate the algorithm through pre-computation and the Chinese remainder theorem. 5) Compatibility, compatible with the traditional Bitcoin system, can be transplanted into the original system.

(4) Description of drawings:

FIG. 1 is a flow chart of the method of the present invention.

The serial numbers, codes and symbols in the figure are explained as follows:

In the figure, Insum/Encrypt/Verify/Decrypt/Braodcast respectively represent steps 2-6, Transcation layer/Verification layer respectively represent the two layers of the system architecture, m ₁ , m ₂ ,..., m _i are sent to the receiver The amount of plaintext, c ₁ , c ₂ ,..., _{ci is the amount of encrypted ciphertext, (pk i ,} ski ₎ is the encrypted public-private key pair, Enc/Dec is the encryption and decryption process, and Dumb account is the verification The "dumb account" set at the time.

(5) Specific implementation methods

The present invention is a method for enhancing the privacy of a bitcoin transaction. The method is implemented in six steps according to the process, and the scheme structure is divided into two layers: a transaction layer and a verification layer. The system flow diagram of the method is shown in Figure 1. Combined with the flow chart, the specific implementation steps of the method are introduced as follows:

The present invention is a method for enhancing the privacy of bitcoin transactions, and the specific implementation steps of the method are as follows:

Step 1: System initialization/KeyGen: Input security parameters and output parameters for encryption and decryption operations and verification. At the transaction layer, for each different receiver i, the system generates two large prime numbers p _i and q _i for each receiver. The receiver's private key is ski =λ _i , and the public key is pk _i =( _ni , _gi ), where _{ni = pi qi} ;

At the same time in the verification layer, the system outputs the public key pk _d = (n _d , g _d ) of the "dumb account" used for verification, and notices that this public key has no paired private key. That is, the system account cannot operate on the amount received; the system generates parameters V _α (g _α , h _α ) and V _β (g _β , h _β ) for verification;

来确保操作后的密文可以成为承诺数；Note that since the "dumb account" and the commitment value proof are both in the verification layer, and their parameters are generated by the system, the scheme sets g _β =g _d and

To ensure that the ciphertext after the operation can become the committed number;

Step 2: Calculate the total input value/Insum: Calculate the total input value of the transaction, that is, the total revenue of placing orders and mining.

If the transaction ticket is used as a newly confirmed block, the transaction ticket will receive an additional 50 bitcoins as a reward (as of January 2017, it has now been halved to 25 bitcoins), and the total revenue is the plaintext of this part The sum of operations with the original ciphertext, expressed as

If the transaction order is not the first order of the newly confirmed block, there will be no additional income, and the total income is the value from the previous order transaction, which is expressed as

Step 3: Encrypted item/Encrypt: At the transaction layer, the scheme uses the public keys pk ₁ , pk ₂ , ..., p i of different receivers to encrypt the sent plaintext amounts m ₁ , m ₂ , ..., p _i using the Paillier encryption scheme .,m _i is c ₁ ,c ₂ ,..., _ci , expressed as:

At the same time, in the verification layer, the scheme uses the same public key pk _d of the system to _encrypt the amount m ₁ , m ₂ ,..., mi sent by each transaction layer, which is expressed as:

Wherein the scheme sets random number r _d =h _β ;

The common point of the two layers is that the same transaction amount mi is encrypted, the difference is that the transaction layer uses a different public key pk _i from the receiver _, and the verification layer uses the same public key pk _d from the system for implementing the Paillier scheme. The additive homomorphism property of . The inherently same amount m _i guarantees the correctness of the value obtained by the receiver after verification;

Step 4: Verify item/Verify: The system verifies whether the hidden amount is a positive value at the verification layer and whether the total input and output are equal. The verification layer is divided into two steps. The first step proves that the hidden amount is always a positive value through the proof method that the commitment value is in a specific interval; the second step uses two proof methods with equal commitment values to prove that the total number of hidden amounts before and after input and output is equal. ;

为了简化，使用E₀,E₁,E₂, E₃,F,V来代替E_i0,E_i1,E_i2,E_i3,F_i,V_i。For the first step, the scheme uses the proof that the commitment value is in a specific interval to ensure that the encrypted amount m _i is a positive value, and the sender Alice makes commitments for different receivers i respectively.

For simplicity, E ₀ ,E ₁ ,E ₂ ,E ₃ ,F,V are used instead of E _i0 ,E _i1 ,E _i2 ,E _i3 ,Fi _{,V i .}

1) Alice sets v=α ² y+ω>2 ^t+l+s+T , where α≠0,0<ω≤2 ^s+T is arbitrarily selected; set r ₃ -rα ² +r ₁ α+r ₂ ∈[-2 ^s n+1,...,2 ^s n-1], where r ₁ ,r ₂ ,r ₃ ∈[-2 ^s n+1,...,2 ^s n-1] are chosen arbitrarily ; then compute:

Alice sends (V, E ₂ , E ₃ , F) to the receiver;

2) The receiver calculates:

E ₁ =E ₀ (m _i ,r)/g ^a =g ^y h ^r mod n

3) Alice and the receiver each calculate:

where r ^* =-rα2 _- r1α- ^r2 _;

4) The receiver verifies the correctness of PK1, PK2, PK3, and whether v>2 ^t+l+s+T is satisfied, if satisfied, the receiver can be sure that x>a;

5) For each receiver mi, the scheme repeats steps 1-4 to prove that _mi > 0 ( _i ={1,2,...,i}).

The proof part will be repeated _i times for each receiver's mi, if any one of them fails, the transaction fails; if all of them are successful, the system returns 1 and continues the verification of the next step.

For the second step, the scheme uses a proof that the two commitment values are equal to ensure that the transaction output and input are consistent, ie m=m ₁ +m ₂ +...+m _i =∑m _i . Now, Alice makes two promises as follows:

where r _α ∈{-2 ^s n+1,...,2 ^s n-1},r _β =n _d ∈{-2 ^s n+1,...,2 ^s n-1}; To a "dumb account" with the same amount, it needs to perform the following two steps:

1) The secret values hidden in the commitment values E and F are equal to m=∑m _i ;

2) The ciphertext H=Πc _id after the operation is equal to one of the commitments F.

In order to realize the above step 1), we prove as follows:

1. Alice randomly selects ω∈{1,...,2 ^i+t b-1},η _α ∈{1,...,2 ^l+t+s n-1},η _β ∈{1, ...,2 ^{l+t+ s} n-1}; then compute:

2. Alice calculates u=H(W _α ||W _β );

3. Alice calculates:

D=ω+um, D _α = η _α +ur _α , D _β =η _β +ur _β

And send (u, D, D _α , D _β ) to the "dumb account";

4. The "dumb account" tests whether u=u', where

If this part of the step verification is successful, proceed to the next part of the step verification:

1. The "dumb account" calculates the received ciphertext:

以及g_d＝g_β，是故：2. As can be seen from the above, we can arbitrarily select r _d =h _β in the encryption process, and arbitrarily select r _β =n _d in the verification process; and in the system initialization process, we set

and g _d =g _β , so:

3. Check if H is equal to F, if not, the transaction fails, if it is, return 1 and go to the next step.

To sum up the verification, when the steps of both parts are true, enter the sending link of the transaction layer;

Step 5: Decryption item/ _Dcrypt : After the verification of the certificate layer is passed, the transaction layer sends the encrypted amount ci to the receiver, and the receiver decrypts it according to his own private key ski _:

x∈S_n＝{u＜n²|x＝1 mod n}；in

x∈S _n ={u<n ² |x=1 mod n};

After the recipient verifies that the received amount is correct, the transaction of the next order is continued. The receiver's received value is the input value of the next order. It is worth noting that when the transaction is completed, the amount of ciphertext in the "dumb account" will be discarded, and its role is only as a bridge to connect the value of the verification layer with the value sent;

Step 6: Broadcast confirmation/Broadcast: After the receiver checks that it is correct, broadcast the transaction order on the whole network and wait for confirmation. The original plaintext information on the transaction order processed by this scheme will be hidden as unreadable ciphertext, which ensures the privacy of the only possible analysis and processing of the transaction process. We can mark this transaction as T _Alice , and the same process applies to any other single transaction.

Claims (1)

1.A bit currency transaction privacy enhancement method is characterized by comprising the following steps: the operation steps are as follows:

step 1: system initialization/KeyGen: generating security parameters for encryption and decryption operation and verification; the system inputs security parameters and outputs a public key pk generated by encryption and decryption operation_iAnd the private key sk_iWhile outputting the public key pk for verification_dNote that this public key has no pairing private key;

step 2: calculate input total/Insum: calculating a total input value of the transaction, namely the total income of the single transaction and the mine digging; if the transaction sheet is used as a newly confirmed block, the transaction sheet obtains an extra 50-bit currency fee as a reward, and the total income is the sum of operations of the plaintext and the original ciphertext; if the transaction list is not the head list of the new confirmation block, no extra income exists, and the total income is the value transmitted by the last transaction;

and step 3: encrypted item/Encrypt: the system uses the public key of the receiver to encrypt the transmission amount respectively in the transaction layer, and uses the public key of the system to encrypt each amount of the same amount in the verification layer; the amount encrypted in the transaction layer is sent to each receiver account after passing through the verification layer, the encrypted amount sent in the verification layer is noticed to enter a 'dumb account', the dumb account is an account without a private key, and the amount is discarded after verification;

and 4, step 4: verification item/Verify: verifying whether the hidden amount is a positive value and whether the input and output total amounts are equal or not at a verification layer; the verification layer is divided into two steps, and in the first step, the concealed money amount is always proved to be a positive value through a proof method of the commitment value in a specific interval; secondly, the two proof methods with equal commitment values are used for proving that the total number before and after the input and the output of the hidden money amount is equal; when the two steps are true, entering a sending link of a transaction layer;

and 5: decryption item/decryption: after the verification of the verification layer is passed, the transaction layer sends the encrypted amount to a receiver, and the receiver decrypts the amount according to the private key of the receiver; after the receiver checks that the receiving amount of the receiver is correct, the next transaction is continued; the recipient's received value is the input value of the next order;

step 6: broadcast acknowledgement/Broadcast: after the receiver checks the transaction list without errors, the whole network broadcasting transaction list is carried out to wait for confirmation; original plaintext information on the processed transaction list is hidden into an unreadable ciphertext, so that the only privacy possibly analyzed and processed in the transaction process is ensured;

the "calculate total input value/enum" in step 2 is divided into two cases, which are as follows:

if the transaction order is used as a newly confirmed block, the transaction order will obtain an additional 50-bit currency fee as a reward, and the total income is the sum of the operation of the part of plaintext and the original ciphertext and is expressed as

If the transaction sheet is not the head sheet of the new confirmation block, no extra income is generated, and the total income is the value transmitted by the transaction of the previous order and is expressed as

The verification layer of the verification item/Verify in the step 4 is divided into two steps, and in the first step, the concealed money is always proved to be a positive value through a proof method of a commitment value in a specific interval; secondly, the total number before and after the input and the output of the hidden money amount is proved to be equal by two proving methods with equal commitment values; the specific method comprises the following steps:

for the first step, Verify-I, the scheme uses proof of commitment value in a certain interval to guarantee the encrypted amount m_iIf the value is positive, the sender Alice makes commitments respectively for different receivers i

For simplicity, use E₀,E₁,E₂,E₃F, V instead of E_i0,E_i1,E_i2,E_i3,F_i,V_i；

4.11) Alice sets v α²y+ω＞2^t+l+s+TWherein α is arbitrarily chosen not equal to 0, omega is more than 0 and less than or equal to 2^s+T；

Set r₃-rα²+r₁α+r₂∈[-2^sn+1,...,2^sn-1]，

Wherein r is arbitrarily selected₁,r₂,r₃∈[-2^sn+1,...,2^sn-1](ii) a Then, calculating:

alice sends (V, E)₂,E₃F) to the recipient;

4.12) receiver calculates:

E₁＝E₀(m_i,r)/g^a＝g^yh^rmod n

4.13) Alice and the receiver each calculate:

wherein r is^*＝-rα²-r₁α-r₂；

4.14) receiver verification of correctness of PK1, PK2, PK3, and whether v > 2 is satisfied^t+l+s+TIf so, the recipient is assured that x > a;

4.15) for each receiver m_iThe protocol can be demonstrated by repeating steps 4.11-4.14)

m_i＞0(i＝{1,2,...,i})；

The proof part will be for each recipient m_iRepeatedly performing i times if it isIf any one fails, the transaction fails; if all the verification steps are successful, the system passes and the verification of the next step is continued;

for the second step, Verify-II, the scheme uses proof that the two commitment values are equal to ensure that the transaction output inputs are consistent, i.e., m-m₁+m₂+...+m_i＝∑m_i(ii) a Alice now makes two commitments as follows:

wherein r is_α∈{-2^sn+1,...,2^sn-1},r_β＝n_d∈{-2^sn+1,...,2^sn-1 }; if a "dumb account" receiving the same amount wants to verify whether the amount of plaintext contained in the received ciphertext is equal to the value sent by Alice, it needs to perform the following two steps:

(1) secret value equal m- ∑ m hidden in commitment values E and F_i；

(2) The operated cipher text H ═ c_idEquals one of the commitments F;

in order to realize the above step (1), the following verification was made:

① Alice random selection

ω∈{1,...,2^i+tb-1},η_α∈{1,...,2^l+t+sn-1},η_β∈{1,...,2^l+t+sn-1 }; then, calculating:

② Alice calculates u-H (W)_α||W_β)；

③ Alice calculates:

D＝ω+um,D_α＝η_α+ur_α,D_β＝η_β+ur_β

and transmitting (u, D)_α,D_β) To "dumb account";

④ "dumb account" test if u ═ u', where

If the partial step is verified successfully, the following partial step is continued to prove that:

①, "dumb account" calculates the received ciphertext:

② As can be seen from the above, r is arbitrarily chosen during encryption_d＝h_βOptionally selecting r in the verification process_β＝n_d(ii) a And during system initialization, set up

And g_d＝g_βTherefore, the following steps are adopted:

③, checking whether H equals F, if not, the transaction fails, if yes, passing, and proceeding to the next step;

in conclusion, when the steps of the two parts are true, entering a sending link of a transaction layer;

wherein, the specific implementation of the "system initialization/KeyGen" in step 1 is as follows:

the input of the system is a safety parameter, and the output is a parameter for encryption and decryption operation and verification; at the transaction level, for each different recipient i, the system generates two large prime numbers p for each recipient_iAnd q is_i(ii) a The recipient private key is sk_i＝λ_iThe public key is pk_i＝(n_i,g_i) Wherein n is_i＝p_iq_i；

Meanwhile, at a verification layer, the system outputs a public key pk of 'dumb account' for verification_d＝(n_d,g_d) Note that this public key has no pairing private key; that is, the system account cannot operate on the received amount; system generation parameter V_α(g_α,h_α) And V_β(g_β,h_β) For verification;

in step 3, the encryption item/Encrypt is used to Encrypt the same amount at the transaction layer and the verification layer at the same time, and the specific implementation is as follows:

at the transaction level, the scheme uses the public keys pk of the different recipients₁,pk₂,...,pk_iEncrypting the transmitted plaintext amount m by using Paillier encryption system₁,m₂,...,m_iIs c₁,c₂,...,c_iExpressed as:

meanwhile, at the verification layer, the scheme uses the same public key pk of the system_dThe amount m to be sent by each of the transaction layers₁,m₂,...,m_iEncryption is performed, expressed as:

wherein the scheme sets a random number r_d＝h_β；

Wherein, after the 'decryption item/decryption' in the step 5 passes the authentication of the certificate layer, the transaction layer will encrypt the amount c_iSending to the receiver, which is implemented as follows:

the receiver follows the private key sk of the receiver_iAnd (3) decryption:

wherein

x∈S_n＝{u＜n²|x＝1modn}；

After the receiver checks that the receiving amount of the receiver is correct, the next transaction is continued; the recipient's received value is the input value of the next order; when the transaction is completed, the ciphertext amount in the 'dumb account' is discarded, and the ciphertext amount is only used as a bridge to enable the value of the verification layer to be linked with the sent value;

wherein, in step 6, the "Broadcast confirmation/Broadcast" is to perform the whole network Broadcast transaction ticket waiting confirmation after the receiver checks the receiver without error, and the specific implementation is as follows: original plaintext information on the processed transaction list is hidden into an unreadable ciphertext, so that the only privacy that can be analyzed and processed in the transaction process is ensured; marking the transaction order as T_AliceThe process is equally applicable to any other single transaction.

Images