WO2021081866A1

WO2021081866A1 - Transaction method, device, and system based on account model, and storage medium

Info

Publication number: WO2021081866A1
Application number: PCT/CN2019/114586
Authority: WO
Inventors: 辛佳骏; 来鑫; 张骁; 李武璐
Original assignee: 深圳市网心科技有限公司
Priority date: 2019-10-31
Filing date: 2019-10-31
Publication date: 2021-05-06
Also published as: CN112771562A

Abstract

Provided are a transaction method, device, and system based on account model, and a storage medium. In this method, a plaintext account and a ciphertext account are set for each user based on the account model, and the transaction initiator node , performs encryption on the pending transaction amount based on the public key of the transaction receiver node and performs the commitment calculation to obtain the encrypted transaction information, subsequently, the transaction receiver node determines the real transaction information based on the information agreed with the transaction initiator node, and completes the transaction. Through initiating the ciphertext transaction by the above transaction initiator node, determining, by the transaction receiver node, the real transaction information based on the information agreed with the transaction initiator node, and completing the transaction, it can effectively avoid the leakage of transaction information between the two parties to the transaction, so as to achieve the purpose of ensuring that transaction information is not leaked when transactions are based on the account model.

Description

Transaction method, device, system and storage medium based on account model

Technical field

This application relates to the field of blockchain technology, and more specifically to a transaction method, device, system and storage medium based on an account model.

Background technique

In the existing blockchain technology, the account model is a commonly used transaction model. When a user conducts a transaction in the account model, the transaction process is similar to that of the user using a bank account to conduct a transaction. For example, when user Alice wants to send 10 amount of currency to user Bob, just subtract 10 from user Alice's account balance, and add 10 to user Bob's account balance.

In the existing blockchain transaction system based on the account model, in order to ensure the correctness of the transaction, each block has a consensus on the global state and the transactions in the block. Because, in the transaction process based on the account model, both parties of the transaction conduct the transaction in clear text, and during the transaction, the transaction amount of both parties is disclosed.

In summary, the existing blockchain transaction system based on the account model uses clear text for transactions, which not only easily leads to the problem of transaction information leakage, but also poses a threat to the privacy of both parties to the transaction to a large extent.

Summary of the invention

This application provides a transaction method, device, system and storage medium based on an account model, which are used to achieve the purpose of ensuring that transaction information is not leaked when transactions are conducted based on the account model.

In order to achieve the above objectives, this application provides the following technical solutions:

The first aspect of the embodiments of the present invention discloses a blockchain system based on an account model. The system includes a transaction initiator node, a transaction receiver node, and a coin mixer node, wherein:

The transaction initiator node is used to perform encryption and commitment calculation on the transaction amount based on the determined shared public key and random number to obtain encrypted transaction information, and the shared public key is received by the transaction initiator node based on the transaction Public key generation of the node;

The transaction receiver node is configured to determine whether the transaction information initiated by the transaction initiator node is on-chain based on the shared public key, and after determining the on-chain, send a currency mixing notification to the coin mixer node, And receive the mixed currency result fed back by the coin mixer node, and after determining that the mixed currency result meets expectations, perform a non-interactive zero-knowledge proof based on the mixed currency result, and determine that it has the transaction amount commitment in the transaction information and the transaction The initiator node randomly selects a random number, obtains the pending transaction amount in the transaction amount commitment, and updates its own account amount based on the pending transaction amount;

The coin mixing node is configured to perform a coin mixing operation based on the coin mixing notification, and send the obtained coin mixing result to the transaction receiver node.

The second aspect of the embodiments of the present invention discloses a transaction method based on an account model, which is suitable for a transaction initiator node, and the method includes:

The transaction initiator node determines the account amount commitment, the pending transaction amount, the public key and random number of the transaction receiver node, and performs the commitment calculation to obtain the transaction amount commitment, account balance commitment and shared public key;

The transaction initiator node uses the shared public key to encrypt the pending transaction amount to obtain the ciphertext;

The transaction initiator node performs range certification on the transaction amount commitment and the account balance commitment, and obtains the commitment scope certification, and the commitment scope certification is used to indicate that the amount in the transaction amount commitment and the account balance commitment is A positive number;

The transaction initiator node generates a confidential transaction based on the transaction amount commitment, the random public key, the ciphertext, and the scope proof of the commitment;

The transaction initiator node generates transaction information using the confidential transaction, handling fee information and signature, and sends the transaction information to the node of the blockchain system.

In a possible design, the transaction initiator node performs range certification on the account balance commitment and the account balance commitment, and obtains the commitment range certification, including:

The transaction initiator node uses the range certificate randomly generated when the blockchain system is initialized to perform range verification on the transaction amount commitment and the account balance commitment, and obtain the promised range certification.

The transaction initiator node uses the pre-obtained supervisor random number and the generators involved in the multi-party supervisable range certificate randomly generated when the blockchain system is initialized to prove the transaction amount commitment and the account balance commitment to obtain the scope of the commitment. prove;

Correspondingly, after the transaction information is sent to the node of the blockchain system, the block verifier node is allowed to obtain the transaction information including the promised range certificate, verify whether the promised range certificate is correct, and verify that the Whether the supervisor's random number signed by the supervisor node in the proof of the scope of the promise is correct, after the transaction information is put on the chain, the supervisor node is allowed to obtain the proof of the scope of the promise in the transaction information, and The scope of commitment proves the supervisor random number and related parameters signed by the supervisor node, so that the supervisor node can calculate whether the transaction amount in the transaction information is based on the supervisor nonce signed by the supervisor node and related parameters. correct.

The third aspect of the embodiments of the present invention discloses a transaction method based on an account model, which is suitable for a transaction receiver node, and the method includes:

The transaction receiver node determines the transaction information initiated by the agreed transaction initiator node based on the shared public key;

The transaction receiver node anonymously initiates a currency mixing notification for the transaction information to the currency mixing node, and the currency mixing notification includes the handling fee information in the transaction information, as well as the transaction receiver node and the transaction Part of the information shared between the initiator nodes;

The transaction receiver node receives the coin mixing result sent by the coin mixing node, and performs a non-interactive zero-knowledge proof based on the coin mixing result;

If it is determined that it has the transaction amount commitment in the transaction information, obtain the pending transaction amount in the transaction amount promise and the random number randomly selected by the transaction initiator node, and update the own account amount based on the pending transaction amount.

In a possible design, the transaction receiver node receives the currency mixing result sent by the currency mixer node, and performs a non-interactive zero-knowledge proof based on the currency mixing result, including:

The transaction receiver node performs a hash calculation on the current coin mixing result and the number of times of coin mixing according to the random number of the transaction initiator node obtained in advance to obtain a hash value;

Calculating the hash commitment corresponding to the hash value by the transaction receiver node;

The transaction receiver node performs a non-interactive zero-knowledge proof based on the hash commitment and the result of the coin mixing to obtain a first certificate and a second certificate. The first certificate is used to prove that the transaction receiver node is The owner of the current transaction, the second proof is used to prove that the number of times of coin mixing after this time of coin mixing is within the acceptance range of the number of coin mixing times of the transaction receiver node.

In a possible design, after the transaction receiver node determines the agreed transaction initiator node based on the shared public key, after the transaction information is initiated, the method further includes:

The transaction receiver node sets additional field information in the transaction information, and the additional field information is used to indicate the currency mixing sequence and currency mixing information of the currency mixer node during the currency mixing process.

In a possible design, after the transaction receiver node anonymously initiates a coin mixing notification of the transaction information to the coin mixer node, if the coin mixer node obtains the random mapping and the corresponding random mapping from the supervisor node in advance The relevant parameters of the coin mixing node make the verifiable shuffle calculation based on the random number selected randomly, the random mapping and the relevant parameters corresponding to the random mapping, to obtain the coin mixing proof, and send the coin mixing proof and the random mapping to the block verification The author node, so that the block verifier node verifies whether the mixed currency proof is correct, and verifies whether the signature of the supervisor node in the random mapping is correct.

The fourth aspect of the embodiments of the present invention discloses a transaction device based on an account model. The device includes a processor and a memory, and a program is stored in the memory. When the program is executed by the processor, the implementation of the present invention is achieved. Example of the transaction method disclosed in the second aspect.

The fifth aspect of the embodiments of the present invention discloses a transaction device based on an account model. The device includes a processor and a memory, and a program is stored in the memory. When the program is executed by the processor, the implementation is implemented as in the present invention. Example of the transaction method disclosed in the third aspect.

In a sixth aspect of the embodiments of the present invention, a computer-readable storage medium is disclosed. The computer-readable storage medium stores a transaction program, and the transaction program can be executed by one or more processors to realize the implementation of the present invention. For example, the transaction method disclosed in the second aspect, or to implement the transaction method disclosed in the third aspect of the embodiment of the present invention.

The seventh aspect of the embodiments of the present invention discloses a computer program product, which is characterized by including computer instructions, which when running on a computer, enables the computer to execute the transaction method disclosed in the second aspect of the embodiments of the present invention, or, Realize the transaction method disclosed in the third aspect of the embodiment of the present invention.

The eighth aspect of the embodiments of the present invention discloses a blockchain system based on an account model, which is characterized by including: a transaction initiator node, a block proposer node, a block validator node, a supervisor node, and a coin mixer Nodes and transaction receiver nodes;

The transaction initiator node includes the computer program product disclosed in the seventh aspect of the embodiment of the present invention, or includes a transaction initiator node having the transaction device disclosed in the fourth aspect of the embodiment of the present invention, and the transaction initiator is configured to The determined shared public key and random number are encrypted and promised to calculate the transaction amount to obtain encrypted transaction information, and the shared public key is generated by the transaction initiator node based on the public key of the transaction receiver node;

The block producer node is used to collect the transaction information, and after determining that the transaction information is correct, send the transaction information to the block verifier node;

The block verifier node is used to verify the received transaction information and the currency mixing result, confirm whether the transaction information and the currency mixing result are correct, and determine whether the transaction continues to be executed based on the verification result;

The supervisor node is used to provide a supervisor random number to the transaction initiator node and the block verifier node, the supervisor random number is signed by the supervisor node, and the verification of the transaction information and the verifier node Supervise the process and the result of the coin mixing node;

The transaction receiver node includes the computer program product disclosed in the seventh aspect of the embodiment of the present invention, or includes a transaction receiver node having the transaction device disclosed in the fifth aspect of the embodiment of the present invention, for determining based on the shared public key Whether the transaction information initiated by the transaction initiator node is on the chain or not, after determining the on-chain, send a coin mixing notification to the coin mixer node, and receive the coin mixing result fed back by the coin mixer node, and then determine whether the transaction information is on the chain. The result of the coin mixing meets expectations. Based on the result of the coin mixing, a non-interactive zero-knowledge proof is performed, and it is determined that it has the transaction amount commitment in the transaction information and the random number randomly selected by the transaction initiator node, and the transaction amount commitment is obtained. The pending transaction amount of and update his account amount based on the pending transaction amount;

The coin mixer node is configured to perform a coin mixing operation based on the coin mixing notification, and send the obtained coin mixing result to the transaction receiver node and the block validator node.

In a possible design, if the transaction initiator node obtains the supervisor's random number from the supervisor node in advance, during the commitment calculation process: the transaction initiator node is also used to obtain the The random number of the supervisor and the generator involved in the multi-party supervisable range certificate randomly generated when the blockchain system is initialized, the transaction amount commitment and the account balance commitment are certified, and the commitment scope certification is obtained;

Correspondingly,

The block verifier node is also used to obtain transaction information including the scope proof of the promise, verify whether the scope proof of the promise is correct, and verify that the supervisor node in the scope proof of the promise is signed Whether the random number of the supervisor is correct;

The supervisor node is also used to obtain the scope certificate of the promise in the transaction information after the transaction information is on the chain, and the supervisor random number and related signatures of the supervisor node in the scope certificate of the promise. And calculate whether the transaction amount in the transaction information is correct based on the supervisor random number signed by the supervisor node and related parameters.

In a possible design, if the coin mixer node obtains the random mapping and the related parameters corresponding to the random mapping from the supervisor node in advance, the coin mixer node is also used to After the coin is notified, based on the random number selected at random, the random mapping and the related parameters corresponding to the random mapping are subjected to a Verifiable Shuffle calculation to obtain a coin mixing certificate, and the coin mixing certificate and the random mapping are sent to the Block validator node;

The block verifier node is also used to verify whether the mixed currency proof is correct, and verify whether the signature of the supervisor node in the random mapping is correct.

In summary, the present invention provides a transaction method, device, system and storage medium based on an account model. In the embodiment of the present invention, a plaintext account and a ciphertext account are set for each user based on the account model, and the transaction initiator node treats the transaction amount, encrypts it based on the public key of the transaction receiver node, and calculates the promise after encryption. After the transaction information, the transaction receiver node determines the real transaction information based on the information agreed with the transaction initiator node, and completes the transaction. The ciphertext transaction is initiated by the transaction initiator node, and the transaction receiver node determines the real transaction information based on the information agreed with the transaction initiator node, and completes the transaction, which can effectively avoid the leakage of transaction information between the transaction parties, thereby Realize the purpose of ensuring that transaction information is not leaked when trading based on the account model.

Description of the drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only These are the embodiments of the present application. For those of ordinary skill in the art, other drawings can be obtained based on the provided drawings without creative work.

FIG. 1 is a schematic flowchart of a transaction method on the side of a transaction initiator node disclosed in an embodiment of the present invention;

2 is a schematic flowchart of a transaction method on the side of a block proposer node and a block verifier node disclosed in an embodiment of the present invention;

Fig. 3 is a schematic flowchart of a transaction method on the side of a transaction receiver node, a coin mixer node, and a block validator node disclosed in an embodiment of the present invention;

4 is a schematic diagram of a currency mixing operation disclosed in an embodiment of the present invention;

FIG. 5 is a schematic flow diagram of a supervision method on the side of a transaction initiator node, a block validator node, and a supervisor node disclosed in an embodiment of the present invention;

FIG. 6 is a schematic flow diagram of a supervision method on the side of a coin mixer node, a block validator node, and a supervisor node disclosed in an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of a transaction device based on an account model disclosed in an embodiment of the present invention;

8 is a schematic structural diagram of another transaction device based on an account model disclosed in an embodiment of the present invention;

Fig. 9 is a schematic structural diagram of a trading system based on an account model disclosed in an embodiment of the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of this application.

It can be known from the background technology that when a user conducts a transaction in an existing blockchain transaction system based on an account model, first of all, both parties to the transaction are public, and the transaction is conducted in a clear text manner. Secondly, in order to ensure the correctness of transactions, a consensus of the entire network is required. As a result, to a large extent the privacy of both parties to the transaction is threatened, which leads to the leakage of the identity and transaction information of both parties.

Therefore, in the embodiment of the present invention, the account model is used as a reference model, and two accounts, a plaintext account and a ciphertext account, are established for each user. In the actual transaction process, anonymous transactions are conducted based on ciphertext accounts, thereby protecting the identities and transaction content of both parties to the transaction, and realizing the purpose of not leaking the identities and transaction content of both parties to the transaction. The specific implementation is described by the following embodiments.

The following are technical terms of part of the blockchain used in the embodiments of the present invention.

Commitment (Commitment, C): The commitment algorithm hides a value in an encrypted ciphertext. The promiser can choose to decrypt the promised random number. Once a promise is issued, the promiser cannot use another random number to calculate the same promise calculation result, and must use the random number used when generating the promise.

Confidential Transaction (CT): Confidential Transaction is a cryptographic scheme proposed by Gregory Maxwell. Confidential transactions use the commitment algorithm to hide the transaction amount, so that only both parties to the transaction can see the transaction amount, while others cannot see the transaction amount, and both parties cannot forge the transaction amount.

Anonymous Confidential Transaction (ACT): An anonymous confidential transaction is based on a confidential transaction, so that the identities of both parties to the transaction cannot be discovered by anyone other than the two parties.

In the embodiment of the present invention, there may be six roles in the blockchain transaction system based on the account model, such as: transaction sender (TS), transaction receiver (TR), block proposer ( Block Proposer, BP, Block Verifier (BV), Shuffle Service Provider (SSP), and Regulator. But it is not limited to the 6 nodes mentioned above.

Both the transaction initiator node and the transaction receiver node can be executed by ordinary users, and each user can either initiate a transaction or receive a transaction.

The selection range of the block proposer node and the block validator node is determined by the consensus between the blocks. Under normal circumstances, it is considered that there is a block proposer node and multiple block validator nodes in a blockchain transaction system.

The block proposer node is used to collect all transactions initiated by the transaction initiator node within a preset time period, detect whether there is any problem with the transaction data, and send the transaction with no problem to the block validator node. If there is a coin mixer node in the blockchain trading system, and the coin mixer node performs the coin mixing operation, the block proposer node also needs to collect all the coin mixing results within the preset time period, and at the same time, detect the coin mixer If there is a problem with the result, send the mixed currency result without problem to the block validator node.

The block verifier node is used to verify the legitimacy of each transaction. And, verify the result of the mixed currency when the result of the mixed currency is received.

The currency mixer node is used to provide currency mixing services and collect a certain fee as income. Each transaction receiver node can independently choose any coin mixing node that it believes to perform any round of coin mixing services. We assume that a certain coin mixer node independently selected by any transaction receiver may record the coin mixing record of the transaction receiver node, but multiple coin mixer nodes selected by any transaction receiver node will not all participate in receiving the transaction. Conspiracy attacks on the privacy of the authors.

The supervisor node is one or more institutions. According to the consensus strategy tree, the transaction amount and currency mixing situation in the entire blockchain system can be supervised.

The embodiment of the invention discloses a block chain system using an account model as a reference model. During the initialization process of the blockchain system, the range certificate and the generators involved in the subsequent multi-party supervisable Bulletproof range certificate are randomly generated. The specific generation method is not limited in the embodiment of the present invention. It is only necessary to ensure that any two generations are generated. The logarithmic relationship between the elements are all unknown, that is, g, g ₁ ,..., g _n , h ∈ G, where,

It is the multiplication cyclic group.

In the blockchain system, based on the account model, two accounts are set up for each user in the blockchain system, a plaintext account and a ciphertext account. In the process of initializing the ciphertext account, the user randomly sets the private key and generates the public key corresponding to the private key.

For example: the private key of user Alice is x _A , and the public key of user Alice is

The private key of user Bob is x _B , and the public key of this user Bob is

In the blockchain system, each coin mixer node obtains the signed supervisor random number from the supervisor node in advance during the initialization process for subsequent verifiable shuffle.

The embodiment of the present invention provides a flowchart of a transaction method based on an account model. Based on the above-mentioned blockchain system, the transaction method specifically includes the following steps:

Specifically, FIG. 1 shows a schematic diagram of the transaction process on the side of the transaction initiator node, including: S101 to S106.

S101: The transaction initiator node confirms the account amount commitment

The transaction amount x ₁ and the public key pk _{B of the} transaction receiver node, and the transaction amount x _{1 is} used to perform the commitment calculation to obtain the transaction amount commitment C ₁ , and the public key pk _B and random public key of the transaction receiver node are used

Generate a shared public key key pair.

In S101, the account amount commitment of the transaction initiator node

Random public key

R ₀ _{is the first random number r 0} randomly selected by the transaction initiator node. In the account amount commitment

Is the amount in the transaction initiator’s account,

A random number randomly selected by the transaction initiator node.

For example, in the process of using the transaction amount x _{1 to} perform the commitment calculation, combined with the second random number r ₁ randomly selected when the transaction initiator node performs the commitment calculation, the transaction amount commitment is generated

For example, using the public key pk _B of the transaction receiver node and the random public key

Generate shared public key key

S102: The transaction initiator node uses the shared public key key pair as an encryption key _{to encrypt the transaction amount x 1} to obtain a ciphertext corresponding to the transaction amount.

For example, in S102, the transaction initiator node uses the shared public key

As the encryption key, the second random number r ₁ randomly selected by the transaction initiator node completes the encryption of the transaction amount x ₁ to obtain the ciphertext AES{x ₁ , r ₁ } corresponding to the transaction amount.

S103: The transaction initiator node calculates the account amount commitment

The difference between the transaction amount commitment C ₁ and the account balance commitment

In S103, the calculation process of account balance commitment is as follows:

S104: The transaction initiator node commits to the transaction amount C ₁ and the account balance commitment

Prove the scope and get the scope of commitment, the scope of commitment is used to indicate the transaction amount commitment C ₁ and the account balance commitment

The amount in is a positive number.

For example, in S104, the transaction initiator node promises C ₁ for the transaction amount and the account balance promise

Proof of scope. Optionally, the transaction initiator node can use the range certificate randomly generated when the blockchain system is initialized to commit to the transaction amount C ₁ and the account balance commitment

Prove the scope and get the promised scope proof

If the transaction initiator node obtains the supervisor nonce of the supervisor node in the blockchain system in advance, the supervisor nonce is signed by the supervisor node. Optionally, the transaction initiator node can also use the supervisor's random number and the generator involved in the multi-party supervisable range proof (Bulletproof) randomly generated when the blockchain system is initialized, to commit to the transaction amount C ₁ and account balance commitment

Prove the scope and get the promised scope proof

S105: The transaction initiator node promises C ₁ and a random public key based on the transaction amount

The ciphertext AES{x ₁ , r ₁ } and the promised range proof generate confidential transactions.

In S105, if the transaction initiator node adopts the range certificate randomly generated when the blockchain system is initialized, it promises C ₁ for the transaction amount and promises for the account balance

Prove the scope and get the promised scope proof

The confidential transaction obtained by executing S105 is:

If the transaction initiator node uses the supervisor's random number and the generator involved in the Bulletproof randomly generated when the blockchain system is initialized, it promises C ₁ for the transaction amount and the account balance promise

Prove the scope and get the promised scope proof

The confidential transaction obtained by executing S105 is:

S106: The transaction initiator node generates transaction information using the confidential transaction, handling fee information, and signature, and sends the transaction information to the node of the blockchain system.

In S106, the handling fee information can actually be regarded as the number of times Gas can be executed by the coin mixer node agreed by the recipient of the subsequent transaction.

Signature refers to the signature of the confidential transaction and fee information by the transaction initiator node, which is used to indicate that the confidential transaction and fee information with the signature is provided by the transaction initiator.

In specific implementation, the transaction initiator node attaches the fee information and signature in plain text. The transaction initiator node uses the plaintext and the confidential transaction obtained by executing S105 to generate transaction information, and sends the transaction information to the node of the blockchain system, and the block proposer node in the blockchain system collects it.

Figure 2 shows a schematic diagram of the transaction process on the side of the block proposer node and the block verifier node, including: S107 and S108.

S107: The block proposer node checks the collected transaction information initiated by the transaction initiator node, and after determining that there is no problem with the transaction information, sends the transaction information to the block verifier node.

It should be noted that the block proposer node will collect all transaction information and currency mixing results sent by the transaction initiator node to the node of the blockchain system within a preset period of time or at any time, and compare the collected transactions The information and the mixed currency result are checked to determine whether there is a problem with the transaction information and the mixed currency result. After determining that there is no problem, the transaction information and the mixed currency result are sent to the block verifier node.

In the process of implementing S107, the block proposer node will receive the transaction information initiated by the transaction initiator node this time, verify the transaction information, and send the transaction information to the district after confirming that the transaction information is correct. Block validator node.

S108: The block verifier node receives the transaction information sent by the block proposer node, and verifies whether the scope proof and signature of the commitment in the transaction information are correct, and if they are correct, the transaction information is put on the chain; if it is not correct, Then discard the transaction information.

In S108, the block verifier node first verifies the signature of the plaintext part of the transaction information to verify whether the signature belongs to the transaction initiator node that initiated the transaction, if not, discard the transaction information, if so, continue to verify the transaction information The amount of transaction information in the confidential transaction part of the transaction promises to be verified.

The verification of the transaction amount commitment C ₁ by the block validator node is mainly to check whether the transaction amount commitment C ₁ in the transaction information is

Legal elements in. The verification of the transaction amount commitment C ₁ by the block validator node can actually be realized based on the elliptic curve. As long as the verification transaction amount commitment C ₁ is non-zero on the elliptic curve, the transaction amount commitment C ₁ is considered

Legal elements in.

After verifying that the transaction amount commitment C _{1 is} correct, the block verifier node continues to verify the scope proof of the confidential transaction part of the transaction information, which is used to verify whether the scope proof of the transaction amount and the account balance is correct, that is, the promised The scope proof can correctly prove that the pending transaction amount and the account balance are positive.

If the promised scope proof is generated based on the supervisor's random number, the block verifier node needs to verify whether the supervisor's nonce related to the promised scope proof is signed by the corresponding supervisor node, and if so, determine the scope of the promise If the proof is correct, upload the transaction information to the UTXO transaction pool; if not, discard the transaction information.

It should be noted that each block verifier node must synchronize the supervisor node information and verify the correctness of the supervisor's public-private key pair through the strategy tree.

The strategy tree is used to store the supervisor strategy, and its specific form in the block includes but not limited to the Merkle Tree root and the MPT tree root. The strategy is determined by the consensus of the consensus node, and the strategy is reflected in each block, and can be updated by the consensus of the consensus node.

Figure 3 shows the transaction flow chart on the side of the transaction receiver node, the coin mixer node and the block verifier node, including S109 to S113.

S109: The transaction receiver node determines the transaction information initiated by the transaction initiator node based on the shared public key key pair.

It should be noted that during the initialization process, the transaction receiver node sets its own private key x _B and generates the public key corresponding to the private key

It should be further noted that the transaction receiver node and the transaction initiator node shared the public keys of both parties before the transaction, and the transaction receiver node also obtained the random public key randomly selected by the transaction initiator node in advance.

The second random number r ₁ and the third random number r ₂ .

In S109, the transaction receiver node is based on its own public key and a random public key randomly selected by the known transaction initiator node

The shared public key can be determined. When the transaction receiver finds that there is transaction information with the same shared public key in the UTXO transaction pool, it is determined that the transaction information with the transaction initiator node has been sent to the chain.

S110: The transaction receiver node initiates a currency mixing notification of the transaction information to the anonymously contacted currency mixing node.

In S110, the transaction receiver node informs the pre-appointed currency mixer node to mix the transaction information through an anonymous contact, and sends a currency mixing notification to the currency mixer node. The mixed currency notification includes the transaction fee information in the plaintext part of the transaction information, as well as part of the information shared between the transaction receiver node and the transaction initiator node.

The fee information is used to indicate the number of times the coin mixing node can perform coin mixing.

Optionally, the number of times Gas indicated by the fee information may be 0 times or more, which is not limited in the embodiment of the present invention, and the value depends on the transaction initiator node.

In the embodiment of the present invention, the number of coin mixer nodes that can be agreed upon by the transaction receiver node is not limited.

Optionally, the transaction receiver node can be a coin mixer node, or it can be agreed that two or more coin mixer nodes will mix the currency of the transaction information respectively.

_{S111: The currency mixer node performs a currency mixing operation on the transaction amount commitment C 1} in the transaction information based on the currency mixing notification and the handling fee information in the transaction information, to obtain the result of the currency mixing, and combine the currency mixing The result is sent to the transaction receiver node and the block proposer node.

In S111, based on the transaction fee information sent by the transaction receiver node and the information shared between some transaction receiver nodes and the transaction initiator node, the coin mixer node commits to the transaction amount C ₁ in the transaction information for multiple rounds Mixed currency.

It should be noted that in a round of coin mixing, there will be K transactions that will be verified by the coin mixer node for Verifiable Shuffle, and the result of the coin mixing will be submitted to the block validator node for verification, and the result of the coin mixing will be sent to The transaction initiator node performs calculations. Since there are K transactions involved in a round of currency mixing, other people can only determine that the transaction sent by the transaction sender node that performs the transaction with the transaction receiver node is one of the transactions, and cannot determine the specific one. Therefore, every All rounds of coin mixing have achieved k anonymity. After the coin mixing node performs n rounds of coin mixing for a transaction, k ⁿ anonymity can be realized.

As shown in Figure 4, there are k transactions involved in each currency mixing. These transactions are in the UTXO transaction pool and not necessarily from the same block. After the currency mixing is over, the UTXO transaction pool will be updated after the next consensus. Among them, k is the preset parameter of the blockchain system, which can be set at any time according to requirements. Optionally, different SSPs and different rounds of coin mixing can choose different k.

It should be further noted that a block can always contain mutually exclusive mixed currency results from multiple currency mixing nodes, that is, multiple currency mixing proofs in a block cannot contain the same transaction multiple times.

S112: The transaction receiver node judges whether the result of the coin mixing meets expectations, and performs a non-interactive zero-knowledge proof based on the result of the coin mixing, and determines that it has the transaction amount commitment C ₁ and the transaction initiator node in the transaction information Random number selected at random.

In S112, the transaction receiver node calculates the coin mixing result C′ ₁ obtained after the coin mixing and the number of coin mixing Gas′ after the coin mixing _{according to the third random number r 2 of the known transaction initiator node.}

Among them, the mixed currency result

The specific value of the number of coin mixing Gas' depends on the specific parameter settings of the transaction initiator node. Assuming that the initial number of coin mixing is 3, the number of coin mixing is reduced by 1. The result of mixing coins here is that C′ ₁ is the result of one coin mixing, and Gas′ is the value of the initial number of coin mixing minus 1.

In the specific implementation, the transaction receiver node first calculates hash ₁ = Hash(C′ ₁ ||Gas′), and maps _{hash 1 to}

for

Then calculate

Recalculate

And provide non-interactive zero-knowledge proof: Chaum-Pedersen (C′ ₁ , C _Hash ) and

among them,

Is the additive group of integer modulo p.

Chaum-Pedersen (C′ ₁ , C _Hash ) is used to prove that C′ ₁ and C _Hash promise the same ciphertext. In other words, it can be proved that the transaction receiver node is the owner of the transaction and can complete the transaction indicated by the transaction information.

It is used to prove that the number of coin mixing after this round of coin mixing is the number of coin mixing times that the transaction receiver node can accept.

The transaction receiver node sends {r ₂ , C _Hash , Chaum-Pedersen(C′ ₁ , C _Hash ),

} To the coin mixer node, the coin mixer node uses random numbers to confuse the original transaction UTXO and combine {C′ ₁ ,Gas′,C _Hash ,Chaum-Pedersen(C′ ₁ ,C _Hash ),

} As additional output.

The specific non-interactive zero-knowledge proof can be illustrated by the following example.

Suppose Alice has a secret x, and she uses two different sets of parameters {g ₁ , h ₁ } and {g ₂ , h ₂ } to calculate separately, and get

Among them, r ₁ and r ₂ are two random numbers. E and F are open to Bob. At this time, Alice wants to prove to Bob that E and F hide the same secret, and use the following non-interactive zero-knowledge proof process to prove it:

First, Alice generates random numbers ω, η ₁ , η ₂ , and then calculates:

Second, Alice generates a challenge: c=H(W ₁ ||W ₂ ), where H() represents a hash function.

Secondly, Alice calculates D=ω+cx, D ₁ =η ₁ +cr ₁ , D ₂ =η ₂ +cr ₂ , and sends (c, D, D ₁ , D ₂ ) to Bob as a proof.

Finally, Bob checks whether

If the verification passes, Bob confirms that E and F hide the same secret.

Assume that the coin mixer node is a computing service provider, and its public key is stable and unchanging, and it is always online. Optionally, the transaction receiver node can add an additional field to the UTXO transaction: Additional.

The Additional is used to specify the next currency mixing service provider and related currency mixing information. Take 2 rounds of coin mixing and two coin mixing nodes as an example:

First, the transaction receiver node selects random numbers r ₂ , r ₃ , and calculates the results C′ ₁ and C” ₁ after the coin mixing, and the number of coin mixing Gas′ and Gas” after two coin mixing.

among them,

Then, the transaction receiver node calculates hash ₂ =Hash(C" _B ||Gas"), and then calculates

with

And provide proof: Chaum-Pedersen (C″ ₁ , C _Hash2 ) and Chaum-Pedersen

The transaction receiver node generates a shared public key key by sharing the public key with the second coin mixer node

And calculate the ciphertext: {r ₃ , C _Hash2 , Chaum-Pedersen(C″ _B , C _Hash2 ),

}, and use the ciphertext and g ^γ as the information of the Additional field.

Then calculate:

hash ₁ = Hash(C′ _B ||Gas′||Additional), then calculate

And provide proof:

Chaum-Pedersen(C′ ₁ , C _Hash1 ),

The transaction receiver node generates and sends the ciphertext: {r ₂ , C _Hash1 , Chaum-Pedersen(C′ ₁ , C _Hash1 ),

} To the first coin mixing node, the first coin mixing node uses a random number r ₃ to obfuscate the old transaction UTXO and {C′ ₁ , Gas′, C _Hash , Chaum-Pedersen(C′ ₁ , C _Hash ),

Additional} as additional output.

The second coin mixing node uses the information provided in Additional to continue the next round of coin mixing services.

In a specific implementation, the receiver node determines its own transaction having the transaction information in a transaction amount committed transaction information after receiving the random _number and the transaction initiator node randomly selected C.

S113: Trading receiver node to acquire the amount of the transaction to be committed C ₁ in the transaction amount x _1, and be based on the transaction value x ₁ update their account amount.

In S113, the transaction receiver node receives the transaction information confirmed by itself through a transaction that receives UTXO. The transaction receiver node will send a special receiving transaction, which will be uploaded to the chain after block consensus, and the corresponding UTXO must be removed. the transaction, at this time, the receiver node transaction based on the transaction information in the transaction amount committed C _1, to determine the amount of the transaction to be committed to the transaction in the amount of C ₁ x _1, and be based on the transaction value x ₁ update their account amount .

S114: The block verifier node receives the coin mixing result sent by the coin mixer node for verification, and verifies whether the coin mixing result is correct and whether the coin mixing proof random number is signed by the supervisor node.

In the embodiment of the present invention, a ciphertext account is set for each user based on the account model, and the transaction initiator node treats the transaction amount, encrypts it based on the public key of the transaction receiver node, and promises to calculate the encrypted transaction information. And after being verified by the block verifier node, it is placed in the UTXO transaction pool, and then the transaction receiver node agrees that the currency mixer node will mix the currency, and if the currency mix reaches the expected situation, it proves that it has the current position. The amount and random number in the transaction, after completing the proof, receive the transaction information, and complete the update of the amount of your account. Initiating a ciphertext transaction through the above-mentioned transaction initiator node can effectively ensure that various transaction information is not leaked during the transaction process. The transaction receiver node determines the correct transaction information based on the mixed currency, thereby completing the transaction, which can effectively avoid the leakage of the identity information and transaction information of both parties to the transaction. Therefore, when transactions are performed based on the blockchain system based on the account model disclosed in the embodiments of the present invention, the user and transaction information can not be leaked during the transaction process, so that the blockchain system has confidentiality and anonymity. The characteristics of sex and supervisability.

Since the account model naturally supports smart contracts, this further enables the blockchain system to support smart contracts for confidential transactions.

Based on the transaction method based on the account model disclosed in the above embodiment of the present invention, in the transaction process, the supervisor in the blockchain system based on the account model disclosed in the embodiment of the present invention supervises the transaction process. The specific process is as follows Examples are described.

In the transaction process on the side of the transaction initiator node disclosed in Figure 1 above, the transaction initiator node can use the supervisor's random number and the multi-party supervisory range proof (Bulletproof) that is randomly generated when the blockchain system is initialized. Generator, commitment to transaction amount C ₁ and account balance commitment

Prove the scope and get the promised scope proof

Specifically, Figure 5 shows a schematic diagram of the supervision process on the side of the transaction initiator node, block validator node, and supervisor node, including the following steps:

S501: The supervisor node signs the random number S with a public and private key pair, and saves the signature and the random number S locally.

In S501,

among them,

s _L , s _R and ρ are also random numbers selected by the supervisor node,

Is the additive group of integer modulo p.

While the supervisor node saves the random number S, it also saves s _L , s _R and ρ.

Optionally, if there are multiple supervisor nodes, each supervisor node executes S501 and signs the random number S respectively.

S502: The transaction initiator node applies for a random number S from the supervisor node, and performs Bulletproof based on the obtained random number S signed by the supervisor node, and obtains the promised scope proof.

In S502, the transaction initiator node promises C ₁ and the account balance for the transaction amount.

Before proceeding with scope proof, apply for a random number S from the supervisor node. Optionally, if there are multiple supervisor nodes, the transaction initiator node can also apply for multiple random numbers S signed by different supervisor nodes and save them locally.

_{In the specific implementation, the transaction initiator node commits to the transaction amount C 1} and the account balance based on the random number signed by the supervisor node and the generator involved in the Bulletproof generated randomly by the blockchain system initialization.

Prove the scope and get the promised scope proof

S503: The transaction initiator node sends the transaction information including the scope proof of the commitment to the node of the blockchain system, which is obtained by the block verifier node.

In S503, the process for the specific transaction initiator node to generate the transaction information including the scope proof of the commitment can be referred to the description of S105 and S106 disclosed in Figure 1 above, which will not be repeated here.

S504: The block verifier node obtains the transaction information including the scope proof of the promise, verifies whether the scope proof of the promise is correct, and verifies whether the signature of the supervisor node in the scope proof of the promise is correct.

In S504, the block verifier node mainly verifies whether the promised range proof can correctly prove whether the pending transaction amount and account balance in the transaction information are positive. If it is a positive number, confirm that the scope of the commitment proves correct. If it is a non-positive number, it is determined that the scope of the commitment proved to be wrong.

In the blockchain system, the block verifier node will also synchronously receive the supervisor node information, so it can verify whether the supervisor node signature in the promised scope proof is correct.

In the specific implementation, after the block verifier node verifies the scope of the commitment in the transaction information, and the signature of the supervisor node is correct, the transaction information is put on the chain.

S505: After the transaction information is on the chain, the supervisor node obtains the proof of the scope of the promise in the transaction information, and the random number and parameters of the supervisor node signature in the proof of the scope of the promise, based on the random number and parameters of the supervisor node's signature Calculate whether the transaction amount in the transaction information is correct.

In S505, the parameters in the promised scope proof are:

The specific process of obtaining the parameters in the proof of the scope of the commitment is as follows:

If the transaction initiator node randomly selects a random number r and obtains the random number S signed by the supervisor node, the promised value v ∈ [0, 2 ⁿ -1], and the transaction promise C _v =g ^v h ^r .

The specific calculation process of Bulletproof is as follows:

The random number signed by the supervisor node

_{^{Wherein, a L ∈ {0,1} n}} st <a L ,2 n> = v,

The transaction initiator node sends A and S to the block validator node, and the block validator node randomly selects and replies

The block validator node performs calculations:

The block validator node sends the calculated T ₁ and T ₂ to the transaction initiator node, and the transaction initiator node randomly selects and replies

Bulletproof is used to prove that the value of a promise is ^{between [0,2 n} -1]. The transaction initiator node executes Bulletproof by using the obtained parameters, and obtains:

In the case that the supervisor node knows the random number signed by its supervisor node _{, the information in a L} can be derived from the parameter l, that is, v, which is the transaction amount in the transaction information, can be obtained to determine the transaction amount is it right or not.

In the transaction method based on the account model disclosed in the embodiment of the invention, by introducing a supervisor node, the transaction amount in the entire blockchain system can be supervised, so that the blockchain system has the characteristics of supervisability.

In the transaction process on the side of the transaction receiver node, the coin mixer node, and the block validator node disclosed in Figure 3 above, the supervisor node is also introduced to supervise the coin mixing process and the result of the coin mixing.

Specifically, Figure 6 shows a schematic diagram of the supervision process on the side of the coin mixer node, the supervisor node, and the block validator node, including the following steps:

S601: The supervisor node randomly selects a random mapping, signs the random mapping based on the public and private key pair, calculates related parameters and challenges corresponding to the random mapping, and signs the challenge x with the public and private keys.

In S601, the supervisor node randomly selects a random mapping π(). Optionally, if there are multiple supervisor nodes, multiple supervisor nodes jointly randomly select π().

Supervisor node calculation

Among them, i ∈ {1, k}.

Supervisor node calculation:

And x=Hash(C _A1 ||...||C _Au ). Among them, {r _A1 ,...,r _Au } are u random numbers randomly selected by the supervisor node.

The supervisor node uses the public and private key to sign the challenge x, and sends the signed challenge x to the coin mixer node that applies for random mapping.

S602: Before the coin mixing, the coin mixing node applies to the supervisor node for random mapping.

S603: The coin mixer node receives the random mapping sent by the supervisor node and the relevant parameters corresponding to the random mapping, and performs a verifiable shuffle calculation based on the random number selected at random, the random mapping and the relevant parameters corresponding to the random mapping, and obtains the proof of the coin mixing, and Send the mixed currency proof and random mapping to the block verifier node.

In S603, the coin mixer node is based on the random mapping obtained from the supervisor node, x=Hash(C _A1 ||...||C _Au ) and

Combine the random number {s ₁ ,…, s _u } randomly selected by itself, and calculate it to get:

y=Hash(C _B1 ||...||C _Bu )

z=Hash(C _B1 ||...||C _Bu ||y)

set up

And calculate:

The coin mixer node obtains the product proof based on the multi-party supervisable and provable confusion calculation:

The coin mixer node obtains the power proof based on the multi-party supervisable and provable confusion calculation:

S604: The block verifier node verifies whether the mixed currency proof is correct, and verifies whether the signature of the supervisor node in the random mapping is correct.

In S604, the block verifier node verifies whether the coin mixing proof can prove that the coin mixing sequence is carried out in a random mapping order, if it is, it is determined that the coin mixing proof is correct, if not, it is determined that the coin mixing proof is wrong.

Based on the above example, the specific method of verifying the order of mixing coins is:

verification

as well as

The legality of the elements is based on

with

Calculate C _-Z and

Finally, verify the product proof and the power proof. If the verifications are passed, it is determined that the currency mixing certificate can prove that the currency mixing sequence is carried out in the order of random mapping.

In the transaction method based on the account model disclosed in the embodiment of the invention, by introducing a supervisor node, it is possible to supervise the currency mixing process in the entire blockchain system, so that the blockchain system has the characteristics of supervisability.

Based on the transaction method based on the account model disclosed in the above embodiment of the present invention, the embodiment of the present invention also correspondingly discloses a transaction device based on the account model. As shown in FIG. 7, the transaction device is suitable for the transaction initiator node. The device includes:

The commitment calculation module 701 is used to determine the account amount commitment, the pending transaction amount, the public key and random number of the transaction receiver node, and perform the commitment calculation to obtain the transaction amount commitment, the account balance commitment, and the shared public key.

The encryption module 702 is configured to use the shared public key to encrypt the amount to be traded to obtain a ciphertext.

The certification module 703 is used to perform range certification on the account balance commitment and the account balance commitment, and obtain the commitment scope certification, and the commitment scope certification is used to indicate that the amount in the transaction amount commitment and the account balance commitment is A positive number.

Optionally, the certification module 703 is specifically used to: use a range certification randomly generated during the initialization of the blockchain system to perform range certification on the transaction amount commitment and the account balance commitment, and obtain the commitment range certification.

Optionally, the proof module 703 is specifically used to: use the pre-obtained supervisor random number and the generators involved in the multi-party supervisable Bulletproof scope proof that is randomly generated when the blockchain system is initialized, and promise the transaction amount and account Proof of the Bulletproof scope of the balance commitment is carried out, and the scope of the commitment is proved.

The transaction generation module 704 is configured to generate a confidential transaction based on the transaction amount commitment, a random public key, the ciphertext, and the scope proof of the commitment, and generate transaction information using the confidential transaction, fee information, and signature.

The sending module 705 is used to send the transaction information to the node of the blockchain system.

In the embodiment of the present invention, a plaintext account and a ciphertext account are set for each user based on the account model, and the transaction initiator node treats the transaction amount, encrypts it based on the public key of the transaction receiver node, and calculates the promise after encryption. After the transaction information, the transaction receiver node determines the real transaction information based on the information agreed with the transaction initiator node, and completes the transaction. The ciphertext transaction is initiated by the above transaction initiator node, and the transaction receiver node determines the real transaction information based on the information agreed with the transaction initiator node, and completes the transaction, which can effectively avoid the leakage of the identity information and transaction information of both parties to the transaction. In this way, the purpose of ensuring that users and transaction information are not leaked when transactions are based on the account model is realized, so that the blockchain system has the characteristics of confidentiality, anonymity and supervisability.

Based on the transaction method based on the account model disclosed in the above embodiment of the present invention, the embodiment of the present invention also correspondingly discloses a transaction device based on the account model. As shown in FIG. 8, the transaction device is suitable for the transaction initiator node. The device includes:

The determining module 801 is configured to determine the transaction information initiated by the agreed transaction initiator node based on the shared public key.

The currency mixing notification module 802 is used to anonymously initiate a currency mixing notification for the transaction information to the currency mixing node. The currency mixing notification includes the handling fee information in the transaction information, as well as the transaction receiver node and the transaction information. Part of the information shared between the transaction initiator nodes.

The update module 803 is configured to receive the result of the coin mixing sent by the coin mixing node, and perform a non-interactive zero-knowledge proof based on the result of the coin mixing. If it is determined that it has the transaction amount commitment in the transaction information, obtain the The amount to be traded in the transaction amount promise and a random number randomly selected by the transaction initiator node, and the account amount is updated based on the amount to be traded.

In the update module 803, for non-interactive zero-knowledge proof based on the result of the coin mixing, the update module 803 is specifically used to:

According to the pre-obtained random number of the transaction initiator node, perform a hash calculation on the current coin mixing result and the number of coin mixing to obtain a hash value, and calculate the hash commitment corresponding to the hash value, according to the A non-interactive zero-knowledge proof is performed on the hash commitment and the result of the coin mixing to obtain a first proof and a second proof. The first proof is used to prove that the transaction receiver node is the owner of the current transaction. The second proof is used to prove that the number of times of coin mixing after this time of coin mixing is within the accepted range of the number of times of coin mixing of the transaction receiver node.

Optionally, the transaction device also includes:

The setting module is used to set additional field information in the transaction information, and the additional field information is used to indicate the coin mixing order and coin mixing information of the coin mixing node during the coin mixing process.

In practical applications, the transaction initiator node can also be the transaction receiver node, and the transaction receiver node can also be the transaction initiator node. Therefore, the transaction devices disclosed in Figures 7 and 8 can exist in both the transaction initiator node and the transaction initiator node. In the transaction receiver node.

In the embodiment of the present invention, a plaintext account and a ciphertext account are set for each user based on the account model, and the transaction receiver node determines the encrypted transaction initiated by the transaction initiator node based on the information agreed with the transaction initiator node After the information is placed in the UTXO transaction pool, the transaction receiver node agrees that the currency mixer node will mix the currency, and if the currency mixing reaches the expectation, it proves that it has the amount and random number in the current transaction. After completing the proof, receive the transaction information and complete the update of the amount of your account. After the above transaction receiver node determines that the encrypted transaction information is the correct transaction information based on the mixed currency, the transaction is completed, which can effectively avoid the leakage of the identity information and transaction information of both parties to the transaction, so as to ensure that the transaction is based on the account model. The purpose of not leaking user and transaction information makes the blockchain system possess the characteristics of confidentiality, anonymity and supervisability.

Based on the transaction method and transaction device based on the account model disclosed in the above embodiment of the present invention, the embodiment of the present invention also discloses a blockchain system based on the account model.

As shown in FIG. 9, the blockchain system includes: a transaction initiator node 901, a block proposer node 902, a block validator node 903, a supervisor node 904, a coin mixer node 905, and a transaction receiver node 906.

The transaction initiator node 901 is used to agree with the transaction receiver node 906 on the shared public key and random number required for the transaction, and based on the shared public key and random number, the transaction amount is encrypted and the commitment calculation is performed to obtain encrypted transaction information .

The block proposer node 902 is used to collect transaction information in the current time period and perform a preliminary inspection on the transaction information. After determining that the transaction information is not problematic, the transaction information is sent to the block verifier node.

The block verifier node 903 is used to verify the received transaction information and the result of the currency mixing, confirm whether the transaction information and the result of the currency mixing are correct, and determine whether the transaction continues to be executed based on the verification result.

The supervisor node 904 is used to provide the supervisor nonce to the transaction initiator node 901 and the block verifier node 903, and the supervisor nonce is signed by the supervisor node.

The coin mixer node 905 is configured to perform a coin mixing operation based on the coin mixing notification from the transaction receiver node 906, and send the obtained coin mixing result to the block validator node node 903 and the transaction receiver node 906.

The transaction receiver node 906 is used to determine whether the transaction information of the transaction initiator node 901 is on the chain based on the shared public key agreed upon with the transaction initiator node 901, and after the transaction information is determined to be on the chain, send a currency mixing notification to the coin mixer node 905 , And receive the mixed currency result fed back by the coin mixer node 905, after determining that the mixed currency result meets expectations, perform a non-interactive zero-knowledge proof based on the mixed currency result, and determine that it has the transaction amount commitment and the transaction initiator node in the transaction information 901 A random number selected at random, obtains the pending transaction amount in the transaction amount commitment, and updates its account amount based on the pending transaction amount.

The embodiment of the present invention also provides a computer-readable storage medium, and a transaction program is stored on the computer-readable storage medium, and the transaction program can be executed by one or more processors to implement the foregoing transaction method.

The embodiment of the present invention also provides a computer program product, including computer instructions, which, when run on a computer, enables the computer to execute the transaction method disclosed in the foregoing embodiment of the present invention.

In summary, in the embodiment of the present invention, a plaintext account and a ciphertext account are set for each user based on the account model, and the transaction initiator node treats the transaction amount, and encrypts it based on the public key of the transaction receiver node. Commitment to calculate the encrypted transaction information, and place it in the UTXO transaction pool after being verified by the block validator node, and then the transaction receiver node agrees that the currency mixer node will mix the currency, and then the currency will be mixed to meet expectations In the case of, prove that you have the amount and random number in the current transaction, after completing the certification, receive the transaction information, and complete the update of your account amount. Through the above transaction initiator node to initiate a ciphertext transaction, the transaction receiver node determines the correct transaction information based on the mixed currency to complete the transaction, which can effectively avoid the leakage of the identity information and transaction information of both parties to the transaction, thereby realizing the transaction based on the account model At the same time, the purpose of ensuring that user and transaction information is not leaked makes the blockchain system have the characteristics of confidentiality, anonymity and supervisability.

In the above-mentioned embodiments, it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented by software, it can be implemented in the form of a computer program product in whole or in part.

The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and for related parts, please refer to the part of the description of the method embodiment. The system and system embodiments described above are merely illustrative, where the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, It can be located in one place, or it can be distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the objectives of the solutions of the embodiments. Those of ordinary skill in the art can understand and implement it without creative work.

Professionals may further realize that the units and algorithm steps of the examples described in the embodiments disclosed in this article can be implemented by electronic hardware, computer software, or a combination of both, in order to clearly illustrate the possibilities of hardware and software. Interchangeability, in the above description, the composition and steps of each example have been generally described in accordance with the function. Whether these functions are performed by hardware or software depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered as going beyond the scope of the present invention.

The foregoing description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be obvious to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown in this document, but should conform to the widest scope consistent with the principles and novel features disclosed in this document.

Claims

A blockchain system based on an account model, characterized in that the system includes a transaction initiator node, a transaction receiver node, and a coin mixer node, wherein:

The transaction initiator node is used to perform encryption and commitment calculation on the transaction amount based on the determined shared public key and random number to obtain encrypted transaction information, and the shared public key is received by the transaction initiator node based on the transaction Public key generation of the node;

The transaction receiver node is configured to determine whether the transaction information initiated by the transaction initiator node is on-chain based on the shared public key, and after determining the on-chain, send a currency mixing notification to the coin mixer node, And receive the mixed currency result fed back by the coin mixer node, and after determining that the mixed currency result meets expectations, perform a non-interactive zero-knowledge proof based on the mixed currency result, and determine that it has the transaction amount commitment in the transaction information and the transaction The initiator node randomly selects a random number, obtains the pending transaction amount in the transaction amount commitment, and updates its own account amount based on the pending transaction amount;

The coin mixing node is configured to perform a coin mixing operation based on the coin mixing notification, and send the obtained coin mixing result to the transaction receiver node.
A transaction method based on an account model, characterized in that it is suitable for a transaction initiator node, and the method includes:

The transaction initiator node determines the account amount commitment, the pending transaction amount, the public key and random number of the transaction receiver node, and performs the commitment calculation to obtain the transaction amount commitment, account balance commitment and shared public key;

The transaction initiator node uses the shared public key to encrypt the pending transaction amount to obtain the ciphertext;

The transaction initiator node performs range certification on the transaction amount commitment and the account balance commitment, and obtains the commitment scope certification, and the commitment scope certification is used to indicate that the amount in the transaction amount commitment and the account balance commitment is A positive number;

The transaction initiator node generates a confidential transaction based on the transaction amount commitment, the random public key, the ciphertext, and the scope proof of the commitment;

The transaction initiator node generates transaction information using the confidential transaction, handling fee information and signature, and sends the transaction information to the node of the blockchain system.
The method according to claim 2, characterized in that, the transaction initiator node performs range certification on the account balance commitment and the account balance commitment, and obtains the commitment range certification, including:

The transaction initiator node uses the range certificate randomly generated when the blockchain system is initialized to perform range verification on the transaction amount commitment and the account balance commitment, and obtain the promised range certification.
The method according to claim 2, wherein the transaction initiator node performs range certification on the account balance commitment and the account balance commitment, and obtains the commitment range certification, comprising:

The transaction initiator node uses the pre-obtained supervisor random number and the generators involved in the multi-party supervisable range certificate randomly generated when the blockchain system is initialized to prove the transaction amount commitment and the account balance commitment to obtain the scope of the commitment. prove;

Correspondingly, after the transaction information is sent to the node of the blockchain system, the block verifier node is allowed to obtain the transaction information including the promised range certificate, verify whether the promised range certificate is correct, and verify that the Whether the supervisor's random number signed by the supervisor node in the proof of the scope of the promise is correct, after the transaction information is put on the chain, the supervisor node is allowed to obtain the proof of the scope of the promise in the transaction information, and The scope of commitment proves the supervisor random number and related parameters signed by the supervisor node, so that the supervisor node can calculate whether the transaction amount in the transaction information is based on the supervisor nonce signed by the supervisor node and related parameters. correct.
A transaction method based on an account model, characterized in that it is suitable for a transaction receiver node, and the method includes:

The transaction receiver node determines the transaction information initiated by the agreed transaction initiator node based on the shared public key;

The transaction receiver node anonymously initiates a currency mixing notification for the transaction information to the currency mixing node, and the currency mixing notification includes the handling fee information in the transaction information, as well as the transaction receiver node and the transaction Part of the information shared between the initiator nodes;

The transaction receiver node receives the coin mixing result sent by the coin mixing node, and performs a non-interactive zero-knowledge proof based on the coin mixing result;

If it is determined that it has the transaction amount commitment in the transaction information, obtain the pending transaction amount in the transaction amount promise and the random number randomly selected by the transaction initiator node, and update the own account amount based on the pending transaction amount.
The method according to claim 5, wherein the transaction receiver node receives the currency mixing result sent by the currency mixing node, and performing non-interactive zero-knowledge proof based on the currency mixing result, comprising:

The transaction receiver node performs a hash calculation on the current coin mixing result and the number of times of coin mixing according to the random number of the transaction initiator node obtained in advance to obtain a hash value;

Calculating the hash commitment corresponding to the hash value by the transaction receiver node;

The transaction receiver node performs a non-interactive zero-knowledge proof based on the hash commitment and the result of the coin mixing to obtain a first certificate and a second certificate. The first certificate is used to prove that the transaction receiver node is The owner of the current transaction, the second proof is used to prove that the number of times of coin mixing after this time of coin mixing is within the acceptance range of the number of coin mixing times of the transaction receiver node.
The method according to claim 5, wherein after the transaction receiver node determines the transaction information initiated by the agreed transaction initiator node based on the shared public key, the method further comprises:

The transaction receiver node sets additional field information in the transaction information, and the additional field information is used to indicate the currency mixing sequence and currency mixing information of the currency mixer node during the currency mixing process.
The method according to claim 5, characterized in that, after the transaction receiver node anonymously initiates a coin mixing notification of the transaction information to the coin mixer node, if the coin mixer node obtains random information from the supervisor node in advance Mapping and the relevant parameters corresponding to the random mapping, so that the coin mixer node performs Verifiable Shuffle calculations based on the random number selected at random, the random mapping and the relevant parameters corresponding to the random mapping, to obtain the coin mixing proof, and the coin mixing proof and random mapping Send to the block verifier node, so that the block verifier node verifies whether the mixed currency proof is correct, and verifies whether the signature of the supervisor node in the random mapping is correct.
A transaction device based on an account model, characterized in that the device includes a processor and a memory, and a program is stored in the memory, and when the program is executed by the processor, the implementation is as in any one of claims 2 to 4 The transaction method described in the item.
A transaction device based on an account model, characterized in that the device includes a processor and a memory, and a program is stored in the memory, and when the program is executed by the processor, the implementation is as in any one of claims 5 to 8. The transaction method described in the item.
A computer-readable storage medium, characterized in that a transaction program is stored on the computer-readable storage medium, and the transaction program can be executed by one or more processors to implement the method described in claims 2 to 4 The transaction method, or, to implement the transaction method as described in claims 5 to 8.
A computer program product, characterized in that it includes computer instructions, which when run on a computer, enable the computer to execute the transaction method as claimed in claims 2 to 4, or to implement the transaction method as claimed in claims 5 to 8 Trading method.
A blockchain system based on an account model, which is characterized by including: a transaction initiator node, a block proposer node, a block validator node, a supervisor node, a coin mixer node, and a transaction receiver node;

The transaction initiator node includes the computer program product described in claim 12, or includes a transaction initiator node having the transaction device described in claim 9, and the transaction initiator is configured to share a public key based on a determination Encryption and commitment calculation of the transaction amount with a random number to obtain encrypted transaction information, and the shared public key is generated by the transaction initiator node based on the public key of the transaction receiver node;

The block producer node is used to collect the transaction information, and after determining that the transaction information is correct, send the transaction information to the block verifier node;

The block verifier node is used to verify the received transaction information and the currency mixing result, confirm whether the transaction information and the currency mixing result are correct, and determine whether the transaction continues to be executed based on the verification result;

The supervisor node is used to provide a supervisor random number to the transaction initiator node and the block verifier node, the supervisor random number is signed by the supervisor node, and the verification of the transaction information and the verifier node Supervise the process and the result of the coin mixing node;

The transaction receiver node includes the computer program product described in claim 12, or includes a transaction receiver node having the transaction device described in claim 10, configured to determine the transaction initiator based on the shared public key Whether the transaction information initiated by the node is on the chain, after the chain is determined, the coin mixing notification is sent to the coin mixer node, and the coin mixing result fed back by the coin mixing node is received. When determining the coin mixing result In line with expectations, perform a non-interactive zero-knowledge proof based on the result of the currency mixing, determine that it has the transaction amount commitment in the transaction information and the random number randomly selected by the transaction initiator node, and obtain the pending transaction in the transaction amount commitment Amount, and update your account amount based on the pending transaction amount;

The coin mixer node is configured to perform a coin mixing operation based on the coin mixing notification, and send the obtained coin mixing result to the transaction receiver node and the block validator node.
The system according to claim 13, wherein if the transaction initiator node obtains the supervisor random number from the supervisor node in advance, in the process of performing the commitment calculation: the transaction initiator node also uses Based on the pre-obtained supervisor random number and the generators involved in the multi-party supervisable range certificate randomly generated when the blockchain system is initialized, the transaction amount commitment and the account balance commitment are scoped to prove the scope of the commitment;

Correspondingly,

The block verifier node is also used to obtain transaction information including the scope proof of the promise, verify whether the scope proof of the promise is correct, and verify that the supervisor node in the scope proof of the promise is signed Whether the random number of the supervisor is correct;

The supervisor node is also used to obtain the scope certificate of the promise in the transaction information after the transaction information is on the chain, and the supervisor random number and related signatures of the supervisor node in the scope certificate of the promise. And calculate whether the transaction amount in the transaction information is correct based on the supervisor random number signed by the supervisor node and related parameters.
The system according to claim 13, wherein if the coin mixer node obtains the random mapping and related parameters corresponding to the random mapping from the supervisor node in advance, the coin mixer node is also used to After receiving the coin mixing notification, based on the randomly selected random number, the random mapping and the related parameters corresponding to the random mapping are subjected to Verifiable Shuffle calculation to obtain the coin mixing certificate, and the coin mixing certificate is combined with the random number. Send the mapping to the block verifier node;

The block verifier node is also used to verify whether the mixed currency proof is correct, and verify whether the signature of the supervisor node in the random mapping is correct.