CN115314352A - Privacy-enhanced fair blockchain leader election method and apparatus - Google Patents

Abstract

The application discloses a privacy-enhanced fair block chain leader election method and device, wherein the method comprises the following steps: generating a corresponding number of disposable public and private key pairs according to the maximum election ticket number of the election node and establishing a disposable public key set of the node; signing the disposable public keys in the disposable public key set one by one through a meta-private key of the election node to generate an election node commitment result, and establishing a disposable public key list according to the disposable public keys corresponding to the verified election node commitment result; calculating a linkable ring signature according to the one-time private key of the election node and the public key ring of the one-time public key list, and generating a vote of the election node according to the linkable ring signature; and calculating the votes passing the verification by using a preset random number to obtain vote sequencing, and selecting a leader node in the vote sequencing according to a preset node selection rule. Therefore, the contradiction problem between identity hiding of a leader before block output of the block chain and non-branching of block output of block chain determinacy is solved.

Description

Privacy-enhanced fair blockchain leader election method and device

technical field

This application relates to the technical field of information security, and in particular to a privacy-enhanced fair blockchain leader election method and device.

Background technique

Blockchain can be understood as a decentralized and distributed ledger for recording transactions. In recent years, blockchain has been widely used in financial applications and even extended to industrial applications. Due to the decentralized nature of the blockchain, an impossible triangle of decentralization-security-scalability is formed. The consensus mechanism is the core of solving the impossible triangle.

The consensus mechanism is the core technology of the blockchain, and the consensus protocol can ensure that all nodes agree on the unique order of additional records in the block. The consensus protocol ensures that in the blockchain, even if a node fails or is a malicious node, the nodes in the network can reach an agreement. In order to improve consensus efficiency, most consensus protocols will select a node in the committee that has the right to generate blocks, called the leader, and the emergence of the leader greatly reduces the direct communication between nodes in the blockchain. It has become a more mainstream committee configuration mode that other nodes in the committee vote.

Due to the rights and responsibilities of the leader, malicious nodes can gain more from attacking the leader than ordinary nodes. Since the working environment of the blockchain is mutual distrust between nodes, how to choose a fair and covert The leader becomes the key point, and the choice of the leader also needs to be unique to satisfy the non-forkable nature of the blockchain.

In the existing consensus mechanism, there are usually the following methods for leader election:

(1) Replace in accordance with the agreed numbering order

In the classic PBFT consensus mechanism, the master node plays the role of the leader, and the working period of the master node is called the current view. If there is a problem with the master node, it will jump to the next view according to the given node number, and the next The node acts as the master node, while saving the state of the current view.

The disadvantages of this scheme are:

a. The selection of the future master node is predictable for all nodes. Malicious nodes can continuously attack the future leader and cause continuous view conversion, making the system unable to work.

b. After the leader is predicted, a bribery attack can be carried out, that is, by bribing the leader to make the result of the block beneficial to oneself and destroy the fairness of the system.

In the HotStuff consensus protocol, the consensus runs in a pipelined manner. However, this method still has the problems of denial of service attacks and bribery attacks brought about by the predictable identity of the leader.

(2) PoX leader election

PoX leader election refers to a leader election that uses corresponding proofs, such as PoW, PoS, etc. PoW uses computing power to prove the leader's identity, and PoS uses the number of rights and interests to prove the leader's identity. The disadvantages of these schemes are as follows:

a. It will cause a waste of resources, and PoW will cause a lot of waste of computing power.

b. The leader is not unique, and the blockchain may fork.

c. There are still denial of service attacks and bribery attacks caused by predictable leader status.

d. Winner takes all, the node with more resources has always become the leader, which damages the decentralization property.

(3) Use distributed pseudo-random numbers for leader election

Many current blockchain projects use distributed pseudo-random numbers plus PoX mechanism for leader election, methods for generating distributed pseudo-random numbers such as VRF, PVSS, VDF, etc. These schemes, such as Algorand and Ouroboros praos, ensure that the identity of the leader cannot be predicted in advance, but because the method of threshold judgment needs to spend a lot of resources to ensure that the blockchain does not fork, the stability of the system decreases, and at the same time, the unpredictability of the identity introduces new security issues, such as malicious offline nodes that have obtained the right to generate blocks.

Contents of the invention

The present application provides a privacy-enhanced fair blockchain leader election method and device to solve the contradiction between the identity hiding of the leader before the block generation and the deterministic block generation of the blockchain without bifurcation.

The embodiment of the first aspect of the present application provides a privacy-enhanced fair blockchain leader election method, including the following steps: calculating the maximum number of election votes of the election node according to the mortgage amount of the election node, and calculating the maximum election votes of the election node according to the maximum election Generate a corresponding number of one-time public-private key pairs according to the number of votes and establish the one-time public key set of the election node; use the meta-private key of the election node to sign one by one the one-time public keys in the one-time public key set to generate all The election node commitment result, the election node commitment result is verified, and the one-time public key list is established according to the one-time public key corresponding to the election node commitment result that has passed the verification; the one-time public key list is generated according to the one-time public key list. The public key ring of the election node, calculate the linkable ring signature according to the one-time private key of the election node and the public key ring, generate the ballot of the election node according to the linkable ring signature, and verify the validity of the ballot performance; use the preset random number to calculate the votes that pass the verification to obtain the ranking of the votes, and select the leader node in the ranking of the votes according to the preset node selection rules.

Optionally, in an embodiment of the present application, the verifying the election node commitment result includes: verifying whether the election node commitment result satisfies a preset signature rule, and the election of the election node The node commitment result is less than the maximum number of votes of the election node.

Optionally, in an embodiment of the present application, the verifying the validity certificate of the ballot includes: verifying whether the public key image in the linkable ring signature exists in the current election stage, and if so, the The ballot is invalid, otherwise, verify whether there is a public key in the public key ring in the linkable ring signature that is not in the one-time public key list, if so, the ballot is invalid, otherwise, verify the public key in the linkable ring signature Whether the signature is valid, if the signature is invalid, the ballot is invalid, otherwise, the ballot is valid.

Optionally, in an embodiment of the present application, further comprising: generating the preset random number by using at least one of a hash function, a random number generator, a sequence cipher algorithm, and a verifiable random function.

Optionally, in an embodiment of the present application, the selecting a leader node in the ballot ranking according to a preset node selection rule includes: there is a position j such that the jth position in the ballot ranking is the request The vote of node i, then the requesting node i is the leader node of the jth time slot.

Optionally, in one embodiment of the present application, after selecting the leader node in the ballot sorting according to the preset node selection rules, it further includes: calculating the public key corresponding to the one-time private key of the leader node, verifying Whether the one-time private key of the leader node and the calculated public key image are equal to the public key image in the linkable ring signature of the leader node position in the ballot sorting, if they are equal, the identity of the leader node is legal, On the contrary, the identity of the leader node is illegal.

The embodiment of the second aspect of the present application provides a privacy-enhanced fair blockchain leader election device, including: a mortgage module, which is used to calculate the maximum number of election votes of the election node according to the mortgage amount of the election node, and according to the election node The maximum number of election votes generates a corresponding number of one-time public-private key pairs and establishes the one-time public key set of the election node; the one-time public key list establishment module is used to pair the one-time public key with the meta-private key of the election node. The one-time public key in the key set is signed one by one to generate the election node commitment result, the election node commitment result is verified, and the one-time public key is established according to the one-time public key corresponding to the election node commitment result that has passed the verification list; a ballot generating module, configured to generate the public key ring of the election node according to the one-time public key list, calculate the linkable ring signature according to the one-time private key of the election node and the public key ring, and calculate the linkable ring signature according to the one-time public key list The linkable ring signature generates the ballots of the election nodes, and verifies the validity of the ballots; the block generation module is used to calculate the ballots that pass the verification by using the preset random numbers, and obtain the sorting of the ballots, and select the ballots according to the preset nodes A rule selects a leader node in the order of votes.

Optionally, in one embodiment of the present application, it also includes: a random number generation module, configured to use at least one of a hash function, a random number generator, a sequence cipher algorithm, and a verifiable random function to generate the predetermined Set a random number.

Optionally, in an embodiment of the present application, the selecting a leader node in the ballot ranking according to a preset node selection rule includes: there is a position j such that the jth position in the ballot ranking is the request The vote of node i, then the requesting node i is the leader node of the jth time slot.

Optionally, in an embodiment of the present application, after the leader node is selected in the ballot sorting according to the preset node selection rules, it further includes: a leader verification module, configured to calculate the one-time The public key corresponding to the private key, verify whether the one-time private key of the leader node and the calculated public key image are equal to the public key image in the linkable ring signature of the leader node position in the ballot sorting, if they are equal, Then the identity of the leader node is legal; otherwise, the identity of the leader node is not legal.

In the privacy-enhanced fair blockchain leader election method and device of the embodiment of the present application, the nodes determine the number of votes that can participate in the election for the leader according to the amount of mortgage amount, and the nodes with more mortgage amount can vote in the leader election. The more votes, the greater the probability of becoming a leader. This scheme inherits the idea of PoS and ensures the fairness of the system election, so that the nodes that pay more will get higher returns, and at the same time avoid nodes that occupy more resources all the time. Become a leader, encourage honest nodes to invest funds to promote the development of the system, and increase the enthusiasm of each honest node to work. This election scheme also satisfies the concealment and uniqueness of the leader's identity, ensuring that there will be no forks in the blockchain due to the non-unique leader. Before the leader produces a block, other nodes cannot determine the identity of the leader, and malicious nodes cannot attack or corrupt the leader in advance. Nodes use one-time public and private keys to vote when voting, which is equivalent to multiple votes by multiple identities. One vote makes it more difficult for malicious nodes to attack and further enhances privacy. At the same time, the election scheme can guarantee the uniqueness of the leader's identity, and no two or more leaders will appear in the same round, so as to ensure that the blockchain will not fork due to the leader being not unique.

Additional aspects and advantages of the application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the application.

Description of drawings

The above and/or additional aspects and advantages of the present application will become apparent and easy to understand from the following description of the embodiments in conjunction with the accompanying drawings, wherein:

FIG. 1 is a flow chart of a privacy-enhanced fair blockchain leader election method provided according to an embodiment of the present application;

2 is a schematic diagram of the working process of a privacy-enhanced fair blockchain leader election method provided according to an embodiment of the present application;

FIG. 3 is an architecture diagram of a privacy-enhanced fair blockchain leader election method provided according to an embodiment of the present application;

FIG. 4 is an example diagram of a privacy-enhanced fair blockchain leader election device according to an embodiment of the present application.

Detailed ways

Embodiments of the present application are described in detail below, examples of which are shown in the drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below by referring to the figures are exemplary, and are intended to explain the present application, and should not be construed as limiting the present application.

This application mainly solves the following problems:

(1) The denial of service attack problem caused by the exposure of the leader's identity before the block chain is produced. If the identity of the leader of the blockchain round has been known by others before the block is produced, a denial of service attack may occur, that is, the attacker initiates a large number of connection requests to the leader, consuming the leader's network Resources or computing resources force the leader to go offline temporarily, making the leader unable to generate blocks and affecting the activity of the blockchain system.

(2) The problem of bribery attacks caused by the exposure of the leader's identity before the block chain is produced. The identity of the leader is exposed before the block is produced. Malicious nodes may bribe the leader to make the content of the block beneficial to themselves and destroy the fairness of the blockchain network.

Bribery can undermine the security of blockchain networks in two ways:

a. Change the order of transactions. The order of transactions in the blockchain has an impact on the results of transaction operations. For example, in an auction smart contract, assuming there are only 2 participants, participant A and participant B both bid 1 digital currency, A puts his bid ahead of B's bid by bribing the block producer, so that A bids for the lot;

b. Make certain transactions not included in the blockchain. For example, in an auction smart contract, assuming that there are only 2 participants, participant A bids 1 digital currency, participant B bids 2 digital currency, and A bids for 2 digital currencies through bribery. The blocker prevents B's bid from being included in the block, so that A bids for the lot at a lower price.

(3) The energy consumption and bifurcation problems generated by the consensus mechanism of the leader identity certificate with the block. The consensus mechanism of PoW type will cause huge energy consumption. Moreover, probabilistically generated leaders may have the problem of multiple leaders in the same round. This causes the content of the block to wait for a certain period of time before it can be confirmed, resulting in high latency in the blockchain system.

(4) Using cryptography schemes such as VRF or PVSS for the PoS consensus mechanism to select the leader lacks uniqueness. In PoS chains such as Ouroboros, Ouroboros praos, and Algorand, the probability of committee members becoming leaders is proportional to the amount they own, but the leaders elected by VRF or PVSS need to run complex consensus protocols again between nodes. The identity of the leader reaches a consensus, which reduces the stability of the system and makes the delay of block chain generation fluctuate greatly.

The privacy-enhanced fair blockchain leader election method and device of the embodiments of the present application are described below with reference to the accompanying drawings. Aiming at the problems mentioned above in the Background Technology Center, this application provides a privacy-enhanced fair blockchain leader election method, in which the identity hiding of the leader and the block The contradiction between chain deterministic block generation and non-forking, the use of token mortgages to solve the problem of sybil attacks in the blockchain, and the combination of one-time public key commitments and linkable ring signatures to avoid a large number of false deliveries by malicious nodes Denial of service attacks caused by tickets. Applied to the blockchain system, it can enhance the privacy of the leader and maintain the fairness of the blockchain system. Its privacy is reflected in the fact that every node that produces a block needs to generate a one-time identity, and only needs a one-time identity as the identity proof of the leader when producing a block; its fairness is reflected in determining the number of one-time identities generated according to the mortgage amount , a node with a higher mortgage amount has a greater probability of being selected.

Specifically, FIG. 1 is a flow chart of a privacy-enhanced fair blockchain leader election method provided according to an embodiment of the present application.

First of all, the system of this application is composed of a single chain, and the operation is carried out in epochs. The epoch has a unique number starting from 0, and e _i is used to represent the i-th epoch. There are s time slots (slots) in an era, and there is a leader in each time slot. The leader is responsible for packaging the transactions of this time slot and generating blocks. The system uses SK _i and PK _i to represent the i-th node’s Meta-private key and meta-public key, sk _i , pk _i represent the one-time private key and public key of the i-th node in the current era, respectively. In this blockchain, it is assumed that the meta-public key is used to identify the node.

Further, the system assumes that there is a leader in each slot, and a block is produced.

In the embodiment of the present application, the process of selecting the leader of each slot in em ₊₁ is used for illustration.

As shown in Figure 1, this privacy-enhanced fair blockchain leader election method includes the following steps:

In step S101, calculate the maximum number of election votes of the election node according to the mortgage amount of the election node, generate a corresponding number of one-time public-private key pairs according to the maximum number of election votes of the election node, and establish a one-time public key set of the election node.

Specifically, as shown in Figure 2, the mortgage and qualification confirmation are first carried out. Before the era e _m-2 , nodes need to mortgage a certain amount of tokens in order to compete for the right to generate blocks. The number of mortgage tokens will determine the number of votes. Denote the set of nodes that have staked e _m-2 before and have not redeemed them as STAKE _m-2 . In the subsequent mortgage module, a mortgage amount table is established for successful nodes to determine the maximum number of votes that nodes participating in the election can generate.

对选举节点承诺结果进行验证，根据验证通过的选举节点承诺结果对应的一次性公钥建立一次性公钥列表。In step S102, use the meta-private key of the election node to sign the one-time public keys in the one-time public key set one by one to generate the election node commitment result

The result of the election node commitment is verified, and a one-time public key list is established according to the one-time public key corresponding to the election node commitment result that has passed the verification.

Specifically, in era e _m-2 , the node that successfully participates in the mortgage first calculates the maximum number of votes that can be generated. Let the mortgage amount of node i be stake _i , and the threshold for successful mortgage in the mortgage module is T, then the node can submit The maximum number of votes for is:

一次性公私钥对的数量不超过节点所能提交的最大选票数，之后的

均代表时代e_m-2节点i的一次性公私钥，节点i对一次性公钥做出承诺，用元私钥签名后将

发出，发出承诺的数量等于节点预计投出的选票数，由当前slot领导者附加到区块中并上链。Node i generates a one-time public key set of the current era from the public and private keys according to the given algorithm

The number of one-time public-private key pairs does not exceed the maximum number of votes that the node can submit.

Both represent the one-time public and private key of node i in era e _m-2 , and node i makes a commitment to the one-time public key, and after signing with the meta-private key, it will

Issued, the number of issued commitments is equal to the number of votes expected to be cast by the node, which is appended to the block by the current slot leader and uploaded to the chain.

和上一个区块已收集到的一次性公钥，e_m-2中最后一个slot的领导者建立了参与领导者竞选的节点一次性公钥列表Apk。The leader collects all the current slots on the chain

Based on the one-time public key collected in the previous block, the leader of the last slot in em _-2 establishes the node one-time public key list Apk participating in the leader election.

Optionally, in one embodiment of the present application, verifying the election node commitment result includes: verifying whether the election node commitment result meets the preset signature rules, and the election node commitment result of the election node is less than the maximum number of votes of the election node .

In step S103, the public key ring of the election node is generated according to the one-time public key list, the linkable ring signature is calculated according to the one-time private key and public key ring of the election node, the ballot of the election node is generated according to the linkable ring signature, and the ballot is verified effectiveness.

不同的公钥列表对应于不同的安全性和计算复杂度，之后由公钥列表计算可链接环签名：Specifically, nodes in era e _m-1 choose their own public key list

Different public key lists correspond to different security and computational complexity, and then the linkable ring signature is calculated from the public key list:

中至少应该包括签名

公钥映像

以及环签名使用的环

由Apk中多于阈值数量的一次性公钥所组成，节点匿名公布选票

发送给当前slot的领导者，由领导者进行验证。

should include at least the signature

public key image

and the ring used by the ring signature

Consisting of more than a threshold number of one-time public keys in the Apk, nodes publish votes anonymously

Sent to the leader of the current slot for verification by the leader.

Further, RingSig is not necessarily a linkable ring signature algorithm in CryptoNote, but can be any linkable ring signature algorithm.

Optionally, in one embodiment of the present application, verifying the validity certificate of the ballot includes: verifying whether the public key image in the linkable ring signature exists in the current election stage, if so, the ballot is invalid; otherwise, verifying the linkable ring signature Whether there is a public key in the non-disposable public key list in the public key ring in the ring signature, if so, the vote is invalid, otherwise, verify whether the signature pair in the linkable ring signature is valid, if the signature is invalid, the vote is invalid, otherwise, the vote efficient.

是对于m-1的有效的签名；2)

中的

每一个都在Apk中；3)

之前没有被上链过。若以上三点均满足则选票为真，验证通过，将选票以特殊交易的形式上链，若验证不通过，上链后标记为无效。领导者收集当前slot经过验证的选票和上一区块中已经收集到的选票集合。e_m-1中最后一个slot的领导者收集到完整的选票列表。Specifically, the verification conditions include: 1)

is a valid signature for m-1; 2)

middle

Each one is in the Apk; 3)

It has not been chained before. If the above three points are met, the ballot is true, the verification is passed, and the ballot will be uploaded to the chain in the form of a special transaction. If the verification is not passed, it will be marked as invalid after being uploaded to the chain. The leader collects the verified votes for the current slot and the set of votes already collected in the previous block. The leader of the last slot in e _m-1 collects the full list of votes.

S104. Use the preset random number to calculate the votes that pass the verification to obtain the ranking of the votes, and select the leader node in the ranking of the votes according to the preset node selection rule.

其中H是哈希函数，并按照各个节点产生的最终选票order，将排序的结果上链，此处排序的结果的前s项(s为一个epoch中的slot的个数)就是e_m+1中的s个领导者。参与领导者选举的节点也可在本地验证排序结果是否正确。The random number r _m of era e _m is defined as r _m = H(m, rm _-1 , ρ), ρ is generated by aggregation of random numbers attached to each slot in the previous era, and the first slot in era e _m The leader uses the random number r _m of the era e _m and all the votes to calculate the final vote for sorting

Where H is a hash function, and according to the final vote order generated by each node, the sorted results are uploaded to the chain. The first s items of the sorted results here (s is the number of slots in an epoch) is em ₊₁ s leaders in . Nodes participating in leader election can also locally verify that the sorting results are correct.

The sorting of order is not necessarily from small to large, but also from large to small or any deterministic sorting method.

Optionally, in an embodiment of the present application, it also includes: generating a preset random number by using at least one of a hash function, a random number generator, a sequence cipher algorithm, and a verifiable random function.

The ρ in the era random number r _m is generated by the aggregation of random numbers attached to each block in em _-1 . These attached random numbers can be generated using VRF, Hash, or random number generators, sequence cipher algorithms or verifiable Verifiable random number generation methods such as random functions.

Optionally, in one embodiment of the present application, selecting the leader node in the ballot ranking according to the preset node selection rules includes: there is a position j such that the jth position in the ballot ranking is the vote of the requesting node i, then the requesting node i is the leader node of the jth time slot.

说明自己被选为第j个slot的领导者。此时，节点i在e_m+1的第j个slot中可以生成一个区块B_m+1，j，并在其中包含自己使用的对应该选票的一次性私钥

以供其他节点进行验证。Leader block generation and identity proof: In era e _m+1 , for node i, if there is a position j such that the jth position of the sorting result is the vote generated by itself

Explain that you have been selected as the leader of the jth slot. At this time, node i can generate a block B _{m+1, j} in the jth slot of e _m+1 , and include the one-time private key used by itself corresponding to the vote

for other nodes to verify.

Optionally, in one embodiment of the present application, after selecting the leader node in the ballot sorting according to the preset node selection rules, it also includes: calculating the public key corresponding to the one-time private key of the leader node, and verifying the one-time private key of the leader node. Whether the key and the calculated public key image are equal to the public key image in the linkable ring signature of the leader node position in the ballot ranking, if they are equal, the identity of the leader node is legal, otherwise, the identity of the leader node is not legal.

并计算对应的

并验证

和

所生成的公钥映像

是否与排序结果中的第j个位置的可链接环签名σ中的公钥映像I相等，如果相等，说明领导者身份合法，否则说明领导者身份不合法，丢弃区块。To verify the legitimacy of the identity of the block producer, other nodes extract the one-time private key from the block after receiving the block B _m+1,j

and calculate the corresponding

and verify

and

The generated public key image

Whether it is equal to the public key image I in the linkable ring signature σ of the jth position in the sorting result, if they are equal, it means that the identity of the leader is legal, otherwise it means that the identity of the leader is illegal, and the block is discarded.

As shown in Figure 3, the implementation device of the privacy-enhanced fair blockchain leader election method in the embodiment of this application is introduced. It mainly includes 6 modules, which are mortgage module, one-time public key list establishment module, and vote generation module, vote verification module, block generation module and leader verification module.

The mortgage module handles the mortgage request of the node:

1) No processing will be done for nodes that have not applied for redemption during the mortgage.

2) For nodes newly applying for mortgage in the current era, the mortgage module first verifies whether the mortgage amount is not greater than the current node balance, and if not, rejects the mortgage request.

3) Next, the mortgage module verifies whether the mortgage amount is not less than the mortgage threshold. If not, the mortgage request is rejected. The mortgage threshold should be a parameter given in advance by the mortgage module.

4) For mortgage requests that meet the conditions, the mortgage module deducts the corresponding mortgage amount from the node balance, and records the mortgage amount and the corresponding public key in the mortgage table.

When a node applies to redeem its mortgage amount, the mortgage module follows the following steps:

1) If the node has not been mortgaged, reject the request.

2) If the time slot corresponding to the node participating in the election has not yet arrived or the block produced has not been confirmed, the request will be marked as failed.

3) If the block corresponding to the block generation time slot of the node has been confirmed or the election fails, the mortgage amount will be added to the balance of the node, and the request will be marked as successful.

The specific workflow of the one-time public key establishment module is as follows:

1) Verify whether this node is in the process of staking, if not, it means that the election cannot be carried out, and the process ends.

承诺是否满足签名规则，且已知的该节点承诺数量小于抵押表中可算得的最大参选票数，若满足上述条件，领导者将一次性公钥打包进区块中，区块也包含上一个slot的一次性公钥承诺，否则丢弃上链请求。2) The leader of the current slot adopts PK _i verification

Whether the commitment meets the signature rules, and the known number of commitments of the node is less than the maximum number of votes that can be calculated in the mortgage table. If the above conditions are met, the leader packs the one-time public key into the block, and the block also contains the previous The one-time public key commitment of the slot, otherwise the uplink request is discarded.

3) If the slot is the last time slot, the leader will collect all the one-time public key commitments to form a list Apk and append it to the block.

The ballot generation module mainly completes the ballot generation work, and the workflow is as follows:

1) According to the Apk, the node can verify whether it is in the election list, if not, the process ends. If so, calculate your own maximum number of votes ticket _i .

组成环，环中的公钥可为大于最低阈值的任意值，最低阈值由选票生成模块给定，节点由选好的

和一次性私钥生成：2) Node selection public key list

To form a ring, the public key in the ring can be any value greater than the minimum threshold, the minimum threshold is given by the vote generation module, and the nodes are selected by

and one-time private key generation:

中包含了签名，公钥映像

以及

RingSig represents the linkability ring signature algorithm used in CryptoNote,

Contains the signature, public key image in

as well as

3) broadcast

The ballot verification module performs the following verifications on ballots:

1) Take out the public key image I in the signature σ, and judge whether the public key image I has appeared in the current epoch, and return invalid if it has appeared.

2) Take out the public key ring ring in the signature σ, and judge whether each public key in it is in the Apk, if not, return invalid.

3) Verify whether the signature part in the signature σ is correct, if not, return invalid.

4) Ballots that pass the above verification are valid ballots.

The block generation module includes transaction packaging, one-time public key collection, ballot collection, ballot sorting, and leader identity revealing functions:

1) There is no difference between transaction packaging and block generation of ordinary blockchains.

2) The block should contain the one-time public key corresponding to the chain on the slot, including the one-time public key in the block of the previous time slot, and the last block of the epoch establishes the one-time public key list Apk corresponding to the epoch.

3) The block should contain the votes for the corresponding slot on the chain, including the votes in the previous slot block. The votes that fail the verification are also on the chain but marked as invalid. The last block of the epoch establishes a set of votes corresponding to the epoch.

4) The first block corresponding to each epoch should contain the order of the corresponding epoch votes, sort according to the sorting method of the above embodiment, and upload the sorting results to the chain.

5) The block corresponding to each slot should contain the leader's own one-time private key ski for identity disclosure so that other nodes can verify.

The workflow of the block verification module is as follows:

For the jth block B m received in epoch e _{m , j}

1) Take out sk _i from the block, according to the ID in the jth position of the sorting result in the first block in epoch e _m-1 , verify whether the vote calculation result corresponds to it, if not, it means that the block is produced If the person is not the leader of the slot, the block is discarded.

2) For the ballots in the block, verify whether the verification of the ballot by the leader is correct, and whether the ballot contains all the ballots in the previous block. If the above conditions are not met, the block is discarded.

3) If this block is the first block in e _m , if it does not contain the sorting of the votes in e _m-1 , then discard the block. Otherwise, take out the sorting result and check H(σ, m, r _m ) to verify whether the sorting result is correct. If not, discard the block.

4) If no error occurs in the block during the above checking process, execute the block content.

According to the privacy-enhanced fair blockchain leader election method proposed in the embodiment of this application, it can solve the contradiction between the identity concealment of the leader before the blockchain and the deterministic block generation of the blockchain without bifurcation. Token mortgage solves the problem of sybil attack in the blockchain, and the combination of one-time public key commitment and linkability ring signature avoids denial of service attacks caused by malicious nodes delivering a large number of fake tickets. Applied to the blockchain system, it can enhance the privacy of the leader and maintain the fairness of the blockchain system. Its privacy is reflected in the fact that every node that produces a block needs to generate a one-time identity, and only needs a one-time identity as the identity proof of the leader when producing a block; its fairness is reflected in determining the number of one-time identities generated according to the mortgage amount , a node with a higher mortgage amount has a greater probability of being selected.

Next, the privacy-enhanced fair blockchain leader election device proposed according to the embodiment of the present application will be described with reference to the accompanying drawings.

Fig. 4 is a schematic block diagram of a privacy-enhanced fair blockchain leader election device according to an embodiment of the present application.

As shown in FIG. 4 , the privacy-enhanced fair blockchain leader election device 10 includes: a mortgage module 100 , a one-time public key list establishment module 200 , a ballot generation module 300 and a block generation module 400 .

Among them, the mortgage module 100 is used to calculate the maximum number of election votes of the election node according to the mortgage amount of the election node, generate a corresponding number of one-time public-private key pairs according to the maximum number of election votes of the election node, and establish a one-time public key set of the election node. The one-time public key list building module 200 is used to sign the one-time public keys in the one-time public key set one by one through the meta-private key of the election node to generate an election node commitment result, verify the election node commitment result, and pass the verification according to Create a one-time public key list with the one-time public key corresponding to the election node commitment result. The ballot generation module 300 is used to generate the public key ring of the election node according to the one-time public key list, calculate the linkable ring signature according to the one-time private key and the public key ring of the election node, and generate the ballot of the election node according to the linkable ring signature, Verify the validity of the ballot. The block generation module 400 is configured to use preset random numbers to calculate the votes that have passed the verification to obtain a ranking of votes, and select a leader node in the ranking of votes according to preset node selection rules.

Optionally, in the embodiment of the present application, it also includes: a random number generation module, which is used to generate a preset random number by using at least one of a hash function, a random number generator, a sequence cipher algorithm, and a verifiable random function .

Optionally, in the embodiment of the present application, selecting the leader node in the ballot ranking according to the preset node selection rules includes: there is a position j such that the jth position in the ballot ranking is the vote of the requesting node i, then the requesting node i is the leader node of the jth time slot.

Optionally, in the embodiment of the present application, after the leader node is selected in the ballot sorting according to the preset node selection rules, it also includes: a leader verification module, which is used to calculate the public key corresponding to the one-time private key of the leader node, Verify whether the one-time private key of the leader node and the calculated public key image are equal to the public key image in the linkable ring signature of the leader node position in the ballot ranking. If they are equal, the identity of the leader node is legal. Otherwise, the identity of the leader node illegal.

Optionally, in the embodiment of the present application, verifying the election node commitment result includes: verifying whether the election node commitment result meets the preset signature rules, and the election node commitment result of the election node is less than the maximum number of votes of the election node.

Optionally, in the embodiment of this application, verifying the validity certificate of the ballot includes: verifying whether the public key image in the linkable ring signature exists in the current election stage, if so, the ballot is invalid; otherwise, verifying that the linkable ring signature Whether there is a public key in the non-disposable public key list in the public key ring in the signature, if so, the vote is invalid, otherwise, verify whether the signature pair in the linkable ring signature is valid, if the signature is invalid, the vote is invalid, otherwise, the vote is valid .

In the embodiments of the present application, the ballot generation module may include the functions of the ballot verification module in the above embodiments.

It should be noted that the aforementioned explanations for the embodiment of the privacy-enhanced fair blockchain leader election method are also applicable to the privacy-enhanced fair blockchain leader election device of this embodiment, and will not be repeated here.

According to the privacy-enhanced fair blockchain leader election device proposed in the embodiment of the present application, it can solve the contradiction between the identity hiding of the leader before the block generation and the deterministic block generation of the blockchain without bifurcation. Token mortgage solves the problem of sybil attack in the blockchain, and the combination of one-time public key commitment and linkability ring signature avoids denial of service attacks caused by malicious nodes delivering a large number of fake tickets. Applied to the blockchain system, it can enhance the privacy of the leader and maintain the fairness of the blockchain system. Its privacy is reflected in the fact that every node that produces a block needs to generate a one-time identity, and only needs a one-time identity as the identity proof of the leader when producing a block; its fairness is reflected in determining the number of one-time identities generated according to the mortgage amount , a node with a higher mortgage amount has a greater probability of being selected.

In the description of this specification, descriptions referring to the terms "one embodiment", "some embodiments", "example", "specific examples", or "some examples" mean that specific features described in connection with the embodiment or example , structure, material or characteristic is included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms are not necessarily directed to the same embodiment or example. Moreover, the described specific features, structures, materials or characteristics may be combined in any one or N embodiments or examples in an appropriate manner. In addition, those skilled in the art can combine and combine different embodiments or examples and features of different embodiments or examples described in this specification without conflicting with each other.

In addition, the terms "first" and "second" are used for descriptive purposes only, and cannot be interpreted as indicating or implying relative importance or implicitly specifying the quantity of indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include at least one of these features. In the description of the present application, "N" means at least two, such as two, three, etc., unless otherwise specifically defined.

Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code comprising one or more executable instructions for implementing a custom logical function or step of a process , and the scope of preferred embodiments of the present application includes additional implementations in which functions may be performed out of the order shown or discussed, including in substantially simultaneous fashion or in reverse order depending on the functions involved, which shall It should be understood by those skilled in the art to which the embodiments of the present application belong.

It should be understood that each part of the present application may be realized by hardware, software, firmware or a combination thereof. In the above embodiments, the N steps or methods may be implemented by software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented by any one or a combination of the following techniques known in the art: a discrete Logic circuits, ASICs with suitable combinational logic gates, Programmable Gate Arrays (PGA), Field Programmable Gate Arrays (FPGA), etc.

Those of ordinary skill in the art can understand that all or part of the steps carried by the methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium. During execution, one or a combination of the steps of the method embodiments is included.

Claims (10)

1. A privacy-enhanced fair blockchain leader election method, characterized in that it comprises the following steps: Calculate the maximum number of election votes of the election node according to the mortgage amount of the election node, generate a corresponding number of one-time public-private key pairs according to the maximum number of election votes of the election node, and establish the one-time public key set of the election node; Use the meta-private key of the election node to sign the one-time public keys in the one-time public key set one by one to generate the election node commitment result, verify the election node commitment result, and The one-time public key corresponding to the promise result of the election node establishes a one-time public key list; Generate the public key ring of the election node according to the one-time public key list, calculate a linkable ring signature according to the one-time private key of the election node and the public key ring, and generate the linkable ring signature according to the linkable ring signature votes for election nodes, verifying the validity of said votes; The ballots that pass the verification are calculated by using preset random numbers to obtain a ranking of votes, and a leader node is selected in the ranking of votes according to preset node selection rules. 2. The method according to claim 1, wherein the verifying the result of the election node commitment comprises: Verifying whether the election node commitment result satisfies the preset signature rule, and the election node commitment result of the election node is less than the maximum number of votes of the election node. 3. The method according to claim 1, wherein the verification of the validity certificate of the ballot comprises: Verify whether the public key image in the linkable ring signature exists in the current election stage, if so, the ballot is invalid, otherwise, verify whether there is a non-disposable public key in the public key ring in the linkable ring signature The public key in the list, if yes, the vote is invalid, otherwise, verify whether the signature pair in the linkable ring signature is valid, if the signature is invalid, the vote is invalid, otherwise, the vote is valid. 4. The method according to claim 1, further comprising: Using at least one of a hash function, a random number generator, a sequence cipher algorithm, and a verifiable random function to generate the preset random number. 5. The method according to claim 1, wherein said selecting a leader node in said ballot ranking according to preset node selection rules comprises: There is a position j such that the jth position of the vote ranking is the vote of the requesting node i, then the requesting node i is the leader node of the jth time slot. 6. The method according to claim 1, characterized in that, after selecting a leader node in the ballot sorting according to preset node selection rules, the method further comprises: Calculate the public key corresponding to the one-time private key of the leader node, verify whether the one-time private key of the leader node and the calculated public key image are consistent with the linkable ring signature of the leader node position in the ballot ranking The public key images are equal, and if they are equal, the identity of the leader node is legal; otherwise, the identity of the leader node is not legal. 7. A privacy-enhanced fair blockchain leader election device, characterized in that it includes: The mortgage module is used to calculate the maximum number of election votes of the election node according to the mortgage amount of the election node, generate a corresponding number of one-time public-private key pairs according to the maximum number of election votes of the election node, and establish the one-time public key set of the election node ; The one-time public key list building module is used to sign the one-time public keys in the one-time public key set one by one through the meta-private key of the election node to generate the election node commitment result, and promise the election node The result is verified, and a one-time public key list is established according to the one-time public key corresponding to the result of the election node commitment that has passed the verification; A ballot generating module, configured to generate a public key ring of the election node according to the one-time public key list, calculate a linkable ring signature according to the one-time private key of the election node and the public key ring, and calculate a linkable ring signature according to the The link ring signature generates the ballot of the election node, and verifies the validity of the ballot; The block generation module is used to calculate the verified ballots by using preset random numbers to obtain a ranking of votes, and select a leader node in the ranking of votes according to preset node selection rules. 8. The device according to claim 7, further comprising: The random number generation module is used to generate the preset random number by using at least one of a hash function, a random number generator, a sequence cipher algorithm, and a verifiable random function. 9. The device according to claim 7, wherein the selecting a leader node in the ballot sorting according to preset node selection rules comprises: There is a position j such that the jth position of the vote ranking is the vote of the requesting node i, then the requesting node i is the leader node of the jth time slot. 10. The device according to claim 7, wherein after selecting the leader node in the ballot sorting according to the preset node selection rules, further comprising: The leader verification module is used to calculate the public key corresponding to the one-time private key of the leader node, and verify whether the one-time private key of the leader node and the calculated public key image are consistent with the position of the leader node in the ballot sorting The public key images in the linkable ring signatures of are equal, if they are equal, the identity of the leader node is legal, otherwise, the identity of the leader node is not legal.

Images