WO2019071458A1

WO2019071458A1 - Method and system for tracking user public key in cryptocurrency conditions

Info

Publication number: WO2019071458A1
Application number: PCT/CN2017/105649
Authority: WO
Inventors: 张鹏; 喻建平; 任浩; 申屠青春
Original assignee: 深圳大学
Priority date: 2017-10-11
Filing date: 2017-10-11
Publication date: 2019-04-18

Abstract

Disclosed in the present invention are a method and a system for tracking a user public key in cryptocurrency conditions, the method comprising: a sending party client terminal acquires a receiving party public key and a tracking party public key, incorporates a sending party private key to generate a target key and a transaction key, and publishes same, the receiving party public key comprising a first public key and a second public key, and the first public key being obtained on the basis of a point on a predefined elliptic curve and the prime order of said point; the tracking party client terminal acquires the target key and the transaction key and incorporates a tracking party private key to recover the first public key of the receiving party. The generated target key and transaction key belong to a one-time public key and are random, so that each transaction is not connectable, and the tracking party client can recover the first public key of the receiving party and track the receiving party, thereby solving the technical problem of traditional transactions becoming a hotbed of criminal activity such as money laundering and extortion when using a one-time public key due to the lack of effective supervision.

Description

Method and system for conditional tracking user public key in cryptocurrency

Technical field

The present invention relates to domain information security technologies, and more particularly to a method and system for conditionally tracking a user's public key in a cryptocurrency.

Background technique

Digital cryptocurrency is an application form of blockchain. It is a digital currency trading platform developed on the basis of decoupling, open source, trust, collective maintenance, and reliable data. Bitcoin is one of the most successful digital cryptocurrencies, but since all transactions are public and any transaction can be traced to its originators and recipients, Bitcoin is not traceable and due to big data analysis, The application of data mining and other technologies, the user's relevance to the transaction is easy to expose, Bitcoin does not have non-connectability.

In order to achieve the untrackability and non-connectability of cryptocurrency, the CryptoNote protocol was proposed. The CryptoNote protocol uses a one-time public key technology to achieve non-connectability between users and transactions, and uses one-time ring signature technology to achieve untrackability of transactions. However, the characteristics of decentralization and complete anonymity make the transaction lack effective supervision. The cryptocurrency based on CryptoNote protocol is easy to become a hotbed of criminal activities such as money laundering and extortion.

Summary of the invention

The main object of the present invention is to provide a method and system for conditionally tracking a user's public key in a cryptocurrency, aiming at solving the problem of money laundering, extortion, etc. due to lack of effective supervision when using a one-time public key transaction in the prior art. Technical issues of the hotbed of criminal activity.

To achieve the above object, a first aspect of the present invention provides a method for conditionally tracking a user's public key in a cryptocurrency, the method comprising:

The sender client obtains the receiver public key and the tracking party public key respectively, and calculates the target key and the transaction key according to the sender private key selected by the sender, the receiver public key, and the tracking party public key, and attaches Disclosed in the transaction, the recipient public key includes a first public key and a second public key, and the first public key is obtained based on a point on a predefined elliptic curve and a recipient private key selected by the receiver;

The tracking party client obtains the target key and the transaction key, and recovers the location of the recipient public key according to the target key, the transaction key, and the tracking party private key selected by the tracking party. The first public key is described, so that the tracking party client uses the first public key obtained by the recovery to achieve tracking of the transaction destination.

To achieve the above object, a second aspect of the present invention provides a system for conditionally tracking a user's public key in a cryptocurrency, the system comprising:

The sender client is configured to obtain the receiver public key and the tracking party public key respectively, and calculate the target key and the transaction secret according to the sender private key selected by the sender, the receiver public key, and the tracking party public key. The key is additionally disclosed in the transaction, the recipient public key includes a first public key and a second public key, the first public key being a point based on a predefined elliptic curve and a recipient private key selected by the receiver owned;

a tracking party client, configured to acquire the target key and the transaction key, and recover the recipient public key according to the target key, the transaction key, and a tracking party private key selected by a tracking party The first public key in the tracking, so that the tracking party client uses the restored first public key to achieve tracking of the transaction destination.

The invention provides a method for conditionally tracking a user public key in a cryptocurrency, the method comprising: a sender client obtaining a receiver public key and a tracking party public key, and generating a target key and a transaction key in combination with the sender private key And publicly, the recipient public key includes a first public key and a second public key, and the first public key is obtained based on a point on a predefined elliptic curve and a recipient private key selected by the receiver, and the tracking client obtains The target key and the transaction key are combined with the tracking party private key to recover the first public key of the recipient. Generate The target key and the transaction key are one-time, so the sender and the receiver are based on a one-time public key transaction. Because the one-time public key is random, each transaction has non-connectability; and because the target key and The transaction key generation uses the tracking party public key and the receiver public key indirectly or directly, so the tracking party client can recover the first public key of the receiver by acquiring the target key and the transaction key, thereby tracking the reception. Fang, solves the technical problem of using a one-time public key transaction in traditional transactions because of the lack of effective supervision and easy to become a hotbed of criminal activities such as money laundering and extortion.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and those skilled in the art can obtain other drawings according to these drawings without any creative work.

1 is a schematic diagram of a transaction system in a first embodiment of the present invention;

2 is a schematic flow chart of a method for conditionally tracking a user public key in a cryptocurrency according to a second embodiment of the present invention;

3 is a schematic flowchart of a method for a conditionally trackable user public key in a cryptocurrency according to a third embodiment of the present invention;

FIG. 4 is a schematic structural diagram of a system for a conditionally trackable user public key in a cryptocurrency according to a fourth embodiment of the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the drawings in the embodiments of the present invention. The embodiments are merely a part of the embodiments of the invention, and not all of the embodiments. Based on the embodiments of the present invention, those obtained by those skilled in the art without creative efforts All other embodiments are within the scope of the invention.

Due to the lack of effective supervision when using one-time public key transactions in the prior art, it is easy to become a hotbed of criminal activities such as money laundering and extortion.

In order to solve the above technical problem, the present invention proposes a method and system for conditionally tracking a user's public key in a cryptocurrency, and the generated target key and transaction key are one-time, so the sender and the receiver are based on one-time For public key transactions, because the one-time public key is random, each transaction is not connectable; and because the target key and the transaction key are generated indirectly or directly using the tracking party public key and the receiver public key, the tracking party The client can recover the first public key of the receiver by acquiring the target key and the transaction key, thereby tracking the receiver, and solving the problem of using the one-time public key transaction in the traditional transaction due to lack of effective supervision, and easily becoming money laundering Technical issues of hotbeds such as extortion and criminal activities.

1 is a schematic diagram of a transaction system in a first embodiment of the present invention. The transaction system includes a sender, a receiver, and a tracker. For a more systematic understanding of the technical solution, the parameters used in the transaction system are summarized as follows. The table shows:

In the embodiment of the present invention, the transaction key (R _A , R _T ) and the recipient public key (A, A _T ) are composed of two parts. The transaction key (R _A , R _T ) is calculated by the sender client according to the formula R _A = rA, R _T = rT, R _A is the first transaction key, and R _T is the second transaction key. The receiver public key (A, A _T ) is divided into a receiver first public key A and a receiver second public key A _T . The target key P is calculated by the sender client according to the formula P=H(rA _T )G+A, and the one-time public key P′ is the receiver client according to the formula P′=H(aR _T )G+A To calculate, the one-time private key p is calculated by the receiver client according to the formula p=H(aR _T )+a. The meaning of all the parameters in the formula is as shown in the parameters in the table.

Based on the first embodiment, referring to FIG. 2, which is a schematic flowchart of a method for a conditionally trackable user public key in a cryptographic currency according to a second embodiment of the present invention, the method includes:

Step 201: The sender client obtains the receiver public key and the tracking party public key respectively, and calculates the target key and the transaction secret according to the sender private key selected by the sender, the receiver public key, and the tracking party public key. The key is additionally disclosed in the transaction, the recipient public key includes a first public key and a second public key, the first public key being a point based on a predefined elliptic curve and a recipient private key selected by the receiver owned;

As shown in FIG. 1, the tracking party client calculates and displays the tracking party public key T according to the tracking party private key t selected by the tracking party, and the receiving client obtains the tracking party public key T and calculates and receives the receiving party private key a. The public key (A, A _T ) is disclosed, and the sender client obtains the tracking party public key T and the receiver public key (A, A _T ), and combines the sender private key r to calculate the target key P and the transaction secret. The key (R _A , R _T ) is appended to the transaction.

The receiver public key (A, A _T ) disclosed by the receiver client includes two parts, which are respectively referred to as the receiver first public key A and the receiver second public key A _T . The first public key A of the receiver is obtained based on the point G on the predefined elliptic curve and the recipient private key a selected by the receiver, and the second public key A _T of the receiver is based on the tracking public key T and the receiving private Key a. Session key (R _A, R _T) comprises two parts sender client output, referred to as a first session key and the second session key R _A R _T. The first transaction key R _A is obtained based on the sender private key r and the recipient first public key A, and the second transaction key R _T is obtained based on the sender private key r and the tracking party public key T.

Step 202: The tracking client obtains the target key and the transaction key, and recovers the recipient public key according to the target key, the transaction key, and the tracking party private key selected by the tracking party. The first public key in the tracking, so that the tracking party client uses the restored first public key to achieve tracking of the transaction destination.

In an embodiment of the invention, the target key P and the transaction key (R _A , R _T ) are disclosed by the sender client in the transaction. The tracking party private key t is randomly selected by the party that is in the transaction to track the whereabouts of the transaction. The tracking party client obtains the target key P and the transaction key (R _A , R _T ) attached by the sender client in the transaction, and the tracking party private key t is calculated to obtain the recipient's first public key A, through which the receiving The first public key A is tracked to the recipient to track the whereabouts of the transaction.

In the embodiment of the present invention, the sender client obtains the receiver public key and the tracking party public key, generates a target key and a transaction key in combination with the sender private key, and exposes the tracking client to obtain the target key and the transaction secret. The key is combined with the tracking party private key to recover the first public key of the recipient. The generated target key and transaction key are one-time, so the sender and the receiver are based on one-time public key transactions. Because the one-time public key is random, each transaction has non-connectability; and because the target key The tracking party public key and the receiver public key are used indirectly or directly with the generation of the transaction key, so the tracking party client can recover the first public key of the receiver by acquiring the target key and the transaction key, thereby tracking The receiver has solved the technical problem of using a one-time public key transaction in traditional transactions because of the lack of effective supervision and easy to become a hotbed of criminal activities such as money laundering and extortion.

Based on the first embodiment, referring to FIG. 3, which is a schematic flowchart of a method for a conditionally trackable user public key in a cryptographic currency according to a third embodiment of the present invention, the method includes:

Step 301: The tracking party client obtains the tracking party public key by using the tracking party private key and discloses it;

Wherein, the tracking party public key T is based on a point G and a tracking party selected in advance on the elliptic curve. The tracking party private key t is calculated. Specifically, the tracking party public key is obtained according to the following formula:

T = tG.

Step 302: The receiving client obtains the tracking party public key, and obtains the receiving public key by using the receiving private key and the tracking party public key and discloses the public key;

The receiver public key (A, A _T ) includes two parts, namely, the receiver first public key A and the receiver second public key A _T . The first public key A of the receiver is obtained based on the point G defined in advance on the elliptic curve and the recipient private key a selected by the receiver. The second public key A _T of the receiver is based on the tracking party public key T and the receiver. The private key a is obtained. Specifically, the receiver public key (A, A _T ) is obtained by the following formula:

(A, A _T ) = (aG, aT).

Step 303: The sender client obtains the receiver public key and the tracking party public key respectively, and obtains the target key and the transaction key according to the preset formula.

In the embodiment of the present invention, the transaction key (R _A , R _T ) is composed of two parts, namely a first transaction key R _A and a second transaction key R _T , and the first transaction key R _A is based on sending The second transaction key R _T is obtained based on the sender private key r and the tracking party public key T, obtained by the party private key r and the recipient's first public key A. The target key P and the transaction key (R _A , R _T ) are obtained as follows:

P=H(rA _T )G+A,(R _A ,R _T )=(rA,rT)

Where H represents a predefined hash function, G represents a point on a predefined elliptic curve, and A _T represents the recipient's second public key.

Step 304: The sender client attaches the target key and the transaction key to the transaction and discloses it;

Step 305: The receiver client obtains the target key and the transaction key, calculates a one-time public key by using a preset formula, and determines whether the one-time public key is equal to the target key.

In the implementation of the present invention, the one-time public key P′ generated by the receiver client is used to determine whether the target key P disclosed by the sender client is equal, thereby determining whether the transaction is established. Specifically, the one-time public key P' can be obtained according to the following formula:

P'=H(aR _T )G+A

Where a ∈ [1, l-1], a represents the recipient private key, G represents a point on the predefined elliptic curve, l represents the prime order of the predefined point G, and H represents a predefined hash function, R _T represents the second transaction key in the transaction key, and A represents the recipient's first public key in the recipient public key.

In order to better understand whether the one-time public key P′ generated by the receiver client in the embodiment of the present invention is equal to the target key P disclosed by the sender client, in order to determine whether the transaction is established, the following one is performed without error on both sides of the transaction. Short deduction in the case of:

In the embodiment of the present invention, the target key disclosed by the sender client is P=H(rA _T )G+A, and the one-time public key generated by the receiver client is P′=H(aR _T )G+A. The specific judgment is:

P'=H(aR _T )G+A

=H(arT)G+A

=(raT)G+A

=H(rA _T )+A

=P

Where R _T =rT represents the second transaction key in the transaction key. A _T = aT, indicating the recipient's second public key in the recipient's public key. It can be concluded that in the case that there is no error in both parties of the transaction, the one-time public key P′ generated by the receiver client is equal to the target key P disclosed by the sender client, and the transaction is established. In the case of errors in both sides of the transaction, the parameters change, and the conclusions drawn are not equal, and the transaction is not established.

Step 306: If the one-time public key is equal to the target key, the receiving client calculates the one-time private key by using a preset formula, so that the receiver signs the transaction by using the one-time private key;

In the embodiment of the present invention, the receiver client calculates the one-time public key P′ by using the preset formula P′=H(aR _T )G+A and determines whether the one-time public key P′ is equal to the target key P. In the case of being judged to be equal, the receiving client generates a one-time private key p, which is used to sign the protocol. The one-time private key p is obtained by the following formula:

p=H(aR _T )+a

Where a ∈ [1, l-1], a represents the recipient private key, G represents a point on the predefined elliptic curve, l represents the prime order of the predefined point G, and R _T represents the second transaction key.

Step 307: The tracking party client obtains the target key and the transaction key, and uses the preset formula to recover the first public key in the recipient public key in combination with the tracking party private key.

In the embodiment of the present invention, the tracking client obtains the target key P and the transaction key (R _A , R _T ), and recovers the first public key A of the receiver in combination with the tracking private key t. Key A is part of the recipient's public key (A, A _T ), and the recipient's first public key A is used to enable the tracker to track the whereabouts of the transaction, ie, to the recipient. The tracking party client restores the recipient's first public key A according to the following formula:

A=PH(tR _A )G

Where G represents a point on a predefined elliptic curve, R _A represents the first transaction key, and H represents a predefined hash function.

In order to better understand the technical solution in the embodiment of the present invention, a tracking of the first public key A of the receiving party is resumed in the following:

A=PH(tR _A )G

=H(rA _T )+AH(tR _A )G

=H(raT)G+A-H(trA)G

=H(ratG)G+A-H(traG)G

=A

The target key disclosed by the sender client is P=H(rA _T )G+A, and R _A =rA is the first transaction secret in the transaction key (R _A , R _T ) disclosed by the sender client. Key, r denotes the sender's private key, A _T = aT denotes the receiver's second public key, A = aG denotes the receiver's first public key, T = tG denotes the tracking party's public key, t denotes the tracking party's private key, and a denotes Receiver private key, G represents a point on a predefined elliptic curve, and H represents a predefined hash function.

In the embodiment of the present invention, the target key and the transaction key generated by the sender client are one-time, so the sender and the receiver are based on the one-time public key transaction, and because the one-time public key is random, Each transaction is not connectable; the recipient signing the agreement uses the one-time private key generated by the receiving client to ensure the anonymity of the transaction; because the target key and the transaction key are generated indirectly or directly using the tracking party The public key and the recipient public key, so the tracking client can recover the first public key of the receiver by acquiring the target key and the transaction key, thereby tracking the recipient, and solving the one-time public key in the traditional transaction. Due to the lack of effective supervision during trading, it is easy to become a hotbed of criminal activities such as money laundering and extortion.

Please refer to FIG. 4 , which is a schematic structural diagram of a system for conditionally trackable user public key in a cryptocurrency according to a fourth embodiment of the present invention. The system includes a sender client 401, a receiver client 402, and a tracker client 403, the system including:

The tracking party client 403 is configured to obtain the tracking party public key by using the tracking party private key and disclose the public key;

The receiving client 402 is configured to obtain the tracking party public key, and obtain the receiving public key by using the receiving private key and the tracking party public key and disclose the public key;

The sender client 401 is configured to respectively obtain the receiver public key and the tracking party public key, and calculate the target key according to the sender private key selected by the sender, the receiver public key, and the tracking party public key, and attach the information to the transaction. ;

The receiving client 402 is further configured to acquire a target key and a transaction key, generate a one-time public key, and determine whether the generated one-time public key and the target key are equal. If the judgment is equal, generate a one-time private key. In order for the recipient to sign the agreement using the generated one-time private key;

The tracking party client 403 is further configured to acquire the target key and the transaction key, and recover the first public key in the recipient public key according to the target key, the transaction key, and the tracking party private key, so as to track the client 403. The tracking of the transaction destination is achieved by using the first public key obtained by the recovery.

In the embodiment of the present invention, the system is an interactive system, and the arrow indicates that a message disclosed by the client (including each public key, target key, and transaction key) can be acquired by another client. The target key and transaction key generated by the sender client are one-time, so the sender and receiver are the base. For one-time public key transactions, each transaction has non-connectability due to the randomness of the one-time public key; and the tracking party public key and the receiver public key are used indirectly or directly due to the generation of the target key and the transaction key. Therefore, the tracking client can recover the first public key of the receiver by acquiring the target key and the transaction key, thereby tracking the receiver, and solving the lack of effective supervision when using the one-time public key transaction in the traditional transaction. It is easy to become a hotbed of criminal activities such as money laundering and extortion.

It should be noted that the foregoing embodiments are merely preferred embodiments of the present invention, and are not intended to limit the invention, but those skilled in the art should understand that the present invention is not limited by the described order of actions. In accordance with the present invention, certain steps may be performed in other sequences or concurrently. Any modifications, equivalent substitutions and improvements made within the spirit and scope of the invention are intended to be included within the scope of the invention.

In the above embodiments, the descriptions of the various embodiments are all focused, and the parts that are not detailed in a certain embodiment can be referred to the related descriptions of other embodiments.

The above is a description of a method and a system for conditionally tracking a user's public key in a cryptocurrency provided by the present invention. For those skilled in the art, according to the idea of the embodiment of the present invention, the specific implementation manner and application range are In view of the above, the contents of this specification are not to be construed as limiting the invention.

Claims

A method for conditionally tracking a user's public key in a cryptographic currency, the method comprising:

The sender client obtains the receiver public key and the tracking party public key respectively, and calculates the target key and the transaction key according to the sender private key selected by the sender, the receiver public key, and the tracking party public key, and attaches Disclosed in the transaction, the recipient public key includes a first public key and a second public key, and the first public key is obtained based on a point on a predefined elliptic curve and a recipient private key selected by the receiver;

The tracking party client obtains the target key and the transaction key, and recovers the location of the recipient public key according to the target key, the transaction key, and the tracking party private key selected by the tracking party. The first public key is described, so that the tracking party client uses the first public key obtained by the recovery to achieve tracking of the transaction destination.
The method of claim 1 further comprising:

The tracking party client obtains the tracking party public key by using the tracking party private key and discloses the public key;

The recipient client obtains the tracking party public key, and obtains the recipient public key by using the receiver private key and the tracking party public key and discloses the public key;

The tracking party client obtains the tracking party public key according to the following formula:

T=tG

Where t ∈ [1, l-1], t represents the tracking party private key, G represents a point on a predefined elliptic curve, l represents a pre-defined prime order of the point G, and T represents the tracking Public key

The receiver client obtains the receiver public key according to the following formula:

(A, A T )=(aG, aT)

Where a ∈ [1, l-1], a represents the recipient private key, G represents a point on a predefined elliptic curve, l represents a pre-defined prime order of the point G, and T represents the tracking The party public key, (A, A T ) represents the recipient public key, A represents the first public key in the recipient public key, and A T represents the second public key in the recipient public key.
The method according to claim 1 or 2, wherein the sender client obtains the receiver public key and the tracking party public key respectively, according to the sender private key selected by the sender, the receiver public key, and The step of calculating the target key and the transaction key by the tracking party public key and attaching it to the transaction includes:

The sender client obtains the receiver public key and the tracking party public key respectively, and obtains the target key and the transaction key according to the following formula:

P=H(rA T )G+A,(R A ,R T )=(rA,rT)

Where r ∈ [1, l-1], r represents the sender private key, G represents a point on a predefined elliptic curve, l represents a pre-defined prime order of the point G, and T represents the tracking Party public key, H represents a predefined hash function, A represents the first public key in the recipient public key, A T represents the second public key in the recipient public key, and P represents the target secret a key, (R A , R T ) represents the transaction key, R A represents a first transaction key in the transaction key, and R T represents a second transaction key in the transaction key;

The sender client attaches the target key and the transaction key to the transaction and discloses it.
The method according to claim 1 or 2, wherein the tracking party client acquires the target key and the transaction key, and selects according to the target key, the transaction key and the tracking party The tracking party private key, the step of recovering the first public key in the recipient public key includes:

The tracker client acquires the target key and the transaction key, and combines the tracker private key to restore the first public key in the recipient public key by using the following formula:

A=PH(tR A )G

Where t ∈ [1, l-1], t represents the tracking party private key, G represents a point on a predefined elliptic curve, l represents a pre-defined prime order of the point G, and P represents the target secret The key, R A represents the first transaction key in the transaction key, H represents a predefined hash function, and A represents the first public key in the recipient public key.
The method according to claim 1 or 2, wherein the method further comprises:

The recipient client obtains the target key and the transaction key, calculates a one-time public key by using the following formula, and determines whether the one-time public key is equal to the target key:

P'=H(aR T )G+A

Where a ∈ [1, l-1], a represents the recipient private key, G represents a point on a predefined elliptic curve, l represents a pre-defined prime order of the point G, and H represents a predefined a hash function, R T represents a second transaction key in the transaction key, A represents a first public key in the recipient public key, and P′ represents the one-time public key;

If the one-time public key is equal to the target key, the recipient client calculates a one-time private key using the following formula, so that the recipient signs the transaction using the one-time private key:

p=H(aR T )+a

Where a ∈ [1, l-1], a represents the recipient private key, G represents a point on a predefined elliptic curve, l represents a pre-defined prime order of the point G, and p represents the reception A one-time private key when the party signs the agreement.
A system for conditionally tracking a user's public key in a cryptographic currency, characterized in that the system comprises:

The sender client is configured to obtain the receiver public key and the tracking party public key respectively, and calculate the target key and the transaction secret according to the sender private key selected by the sender, the receiver public key, and the tracking party public key. The key is additionally disclosed in the transaction, the recipient public key includes a first public key and a second public key, the first public key being a point based on a predefined elliptic curve and a recipient private key selected by the receiver owned;

a tracking party client, configured to acquire the target key and the transaction key, and recover the recipient public key according to the target key, the transaction key, and a tracking party private key selected by a tracking party The first public key in the tracking, so that the tracking party client uses the restored first public key to achieve tracking of the transaction destination.
The system of claim 6 wherein:

The tracking party client is further configured to obtain the tracking party public key by using the tracking party private key open;

a receiving client, configured to obtain the tracking party public key, and obtain the public key of the receiving party by using the recipient private key and the tracking public key;

The tracking party client obtains the tracking party public key according to the following formula:

T=tG

Where t ∈ [1, l-1], t represents the tracking party private key, G represents a point on a predefined elliptic curve, l represents a pre-defined prime order of the point G, and T represents the tracking Public key

The receiver client obtains the receiver public key according to the following formula:

(A, A T )=(aG, aT)

Where a ∈ [1, l-1], a represents the recipient private key, G represents a point on a predefined elliptic curve, l represents a pre-defined prime order of the point G, and T represents the tracking The party public key, (A, A T ) represents the recipient public key, A represents the first public key in the recipient public key, and A T represents the second public key in the recipient public key.
A system according to claim 6 or claim 7 wherein said sender client is further

Obtaining the receiver public key and the tracking party public key respectively, and obtaining the target key and the transaction key according to the following formula:

P=H(rA T )G+A,(R A ,R T )=(rA,rT)

Where r ∈ [1, l-1], r represents the sender private key, G represents a point on a predefined elliptic curve, l represents a pre-defined prime order of the point G, and T represents the tracking Party public key, H represents a predefined hash function, A represents the first public key in the recipient public key, A T represents the second public key in the recipient public key, and P represents the target secret a key, (R A , R T ) represents the transaction key, R A represents a first transaction key in the transaction key, and R T represents a second transaction key in the transaction key;

The target key and the transaction key are attached to the transaction and published.
The system according to claim 6 or 7, wherein the tracking party client is further configured to acquire the target key and the transaction key, and use the following formula to recover the The first public key in the recipient's public key:

A=PH(tR A )G

Where t ∈ [1, l-1], t represents the tracking party private key, G represents a point on a predefined elliptic curve, l represents a pre-defined prime order of the point G, and P represents the target secret The key, R A represents the first transaction key in the transaction key, H represents a predefined hash function, and A represents the first public key in the recipient public key.
A system according to claim 6 or claim 7 wherein:

The receiving client is further configured to acquire the target key and the transaction key, calculate a one-time public key by using the following formula, and determine whether the one-time public key is equal to the target key:

P'=H(aR T )G+A

Where a ∈ [1, l-1], a represents the recipient private key, G represents a point on a predefined elliptic curve, l represents a pre-defined prime order of the point G, and H represents a predefined a hash function, R T represents a second transaction key in the transaction key, A represents a first public key in the recipient public key, and P′ represents the one-time public key;

The receiving client is further configured to: if the one-time public key is equal to the target key, the receiving client calculates a one-time private key by using a formula, so that the receiving party uses the Sign the transaction with a one-time private key:

p=H(aR T )+a

Where a ∈ [1, l-1], a represents the recipient private key, G represents a point on a predefined elliptic curve, l represents a pre-defined prime order of the point G, and p represents the reception A one-time private key when the party signs the agreement.