CN111433800B - Transaction processing method and related equipment - Google Patents

Abstract

The application discloses a transaction processing method and related equipment, wherein a terminal can generate first signature information of transaction content according to credentials of a first account, and the transaction content is initiated by the first account; the terminal sends a transaction request message to the transaction processing equipment, and the transaction processing equipment returns a transaction response message to the terminal according to the transaction request message, wherein the transaction response message carries transaction result information; the terminal may send a transaction record message to the transaction processing device based on the transaction response message, which may instruct the transaction processing device to store the transaction record carried by the transaction record message onto a blockchain that maintains a distributed database of transaction records for the transaction processing device. Therefore, the embodiment of the invention can adopt the credentials of the first account to generate the front, and avoid the identity information leakage caused by adopting the long-term private key of the first account to generate the signature in the prior art, thereby protecting the anonymity of the first account.

Description

Transaction processing method and related equipment

Technical Field

The present application relates to the field of computer technology, and in particular to a transaction processing method and related equipment.

Background Art

Blockchain is a distributed database that stores an ordered list of records, which includes an ever-growing list of blocks, each of which includes a timestamp and a link to the previous block. The blockchain system including this blockchain consists of several consensus nodes, each of which stores a complete copy of the blockchain data and code. Consensus nodes can achieve consistency in blockchain data through a consensus algorithm.

In the blockchain system, transaction records are recorded in the form of blocks in the blockchain, and the transaction records cannot be unilaterally modified, thereby ensuring the characteristics of data that cannot be tampered with or forged. However, in the blockchain system, all consensus nodes store transaction records, and each transaction record includes the signature of the transaction content, the address of the recipient, and/or the transaction amount in the transaction content. Among them, the signature of the transaction content is generated using the sender's private key, so a third party who can obtain the transaction record needs to use the public key to verify it, and accordingly, the sender of the transaction record is identified.

However, in some business scenarios, for example, in the financial industry, many users do not want third parties other than the two parties to the transaction to know the transaction information they initiated. Therefore, the privacy protection of the sender in the blockchain system is an urgent problem to be solved.

Summary of the invention

The present application provides a transaction processing method and related equipment, which can protect the privacy of the sender who initiates the transaction in the blockchain transaction.

In a first aspect, the present application provides a transaction processing method, in which a terminal can generate first signature information of transaction content based on the credentials of a first account, the transaction content is initiated by the terminal based on the first account, and the credentials are generated for the first account by a transaction processing device that processes the transaction content; the terminal sends a transaction request message to the transaction processing device, the transaction request message includes the transaction content and the first signature information; the terminal receives a transaction response message returned by the transaction processing device, the transaction response message includes transaction result information generated by the transaction processing device according to the transaction content; the terminal sends a transaction record message to the transaction processing device according to the transaction response message, the transaction record message is used to instruct the transaction processing device to store the transaction record carried by the transaction record message on a blockchain, the blockchain being a distributed database in the transaction processing device that stores the transaction record, the transaction record includes the transaction content, the first signature information and the transaction result information.

Among them, the terminal is the device logged in by the first account; the first account is the party that initiates the transaction content, which can be called the payer or sender, etc.

It can be seen that the credentials of the first account are used in the present application to generate the signature information of the transaction content, avoiding the use of the long-term private key of the first account to generate the signature in the prior art, and also requiring a verification device, such as a transaction processing device, to verify the signature using a long-term public key, which causes the identity information of the first account to be leaked. In other words, the present application can protect the anonymity of the first account.

Among them, since the credentials of the first account are generated by the transaction processing device, once the terminal publishes the transaction record to the blockchain based on the first account, the first account cannot deny the transaction record. Therefore, this application can not only protect the privacy of the first account, but also retain the non-repudiation feature of the transaction record on the blockchain.

Among them, the terminal generates the first signature information of the transaction content according to the credentials of the first account, including: the terminal uses the private key of the first account, the credentials of the first account and the transaction content as inputs of the zero-knowledge proof algorithm to calculate the first signature information of the transaction content, and the private key includes a long-term private key or a one-time private key.

The transaction response message is returned when the transaction processing device verifies that the first verification result obtained by the transaction processing device for the transaction request message is passed; the transaction record is stored when the transaction processing device verifies that the second verification result obtained by the transaction processing device for the transaction record message is passed;

Wherein, both the first verification result and the second verification result include the verification result of the first signature information; the verification result of the first signature information is obtained by the transaction processing device through verification calculation based on its own public key and the verification parameters in the first signature information. Wherein, if the transaction processing device generates the credentials of the first account, the transaction processing device uses its own public key and the verification parameters in the first signature information to perform verification calculation to obtain the verification result of the first signature information. If the credentials of the first account are generated by the management device, the transaction processing device uses the public key of the management device and the verification parameters in the first signature information to perform verification calculation to obtain the verification result of the first signature information. It can be seen that this implementation method can avoid the leakage of the identity information of the first account caused by the use of the long-term public key corresponding to the long-term private key for verification calculation in the prior art.

In addition, in the first verification result, the verification result of the first signature information is used to indicate whether the first account is an account that can access the transaction processing device, or whether it is an account issued by the transaction processing device, or whether the first account has the authority to access the transaction processing device; in the second verification result, the verification result of the first signature information is used to indicate whether the first account has the authority to use the blockchain, that is, whether the transaction records related to the first account can be stored on the blockchain. Optionally, the role of the verification result of the first signature information can be associated with related operations after the verification is passed, which is not limited in this application.

In a possible implementation, the transaction content is initiated by the terminal for the second account based on the first account, that is, the second account can be called the recipient or payee of the transaction content, or the terminal logged in to the second account is the recipient of the transaction content, or the payee of the transaction amount in the transaction content. In this way, the terminal can generate a one-time public key of the second account based on the long-term public key of the second account; the terminal generates the second signature information of the transaction content based on the one-time public key of the second account and the certificate of the second account; wherein the one-time public key of the second account is the address of the second account; the certificate is generated using the private key of the certificate issuing device; the transaction request message and the transaction record include the one-time public key and the second signature information of the second account.

Correspondingly, the first verification result and the second verification result also include the verification result of the second signature information, and the verification result of the second signature information is obtained by verification calculation based on the one-time public key of the second account, the public key of the certificate issuing device and the verification parameters in the second signature information.

Similarly, in the first verification result, the verification result of the second signature information is used to indicate whether the second account is an account that can access the transaction processing device, or whether it is an account issued by the transaction processing device, or whether the second account has the authority to access the transaction processing device; in the second verification result, the verification result of the second signature information is used to indicate whether the second account has the authority to use the blockchain, that is, whether the transaction records related to the second account can be stored on the blockchain. Optionally, the role of the verification result of the second signature information can be associated with related operations after the verification is passed, which is not limited in this application.

It can be seen that in this implementation, the receiving address of the transaction content is a one-time public key, and a third party cannot identify the public key corresponding to the second account (i.e., the recipient) of the transaction content based on the receiving address; in addition, a third party such as a transaction processing device can also use the one-time public key, the public key of the certificate issuing device, and the verification parameters in the second signature information to perform verification calculations to obtain the verification result of the second signature information, and then, based on the verification result of the second signature information, the relevant permissions of the second account can be obtained, and privacy leakage caused by using the hash value of the long-term public key of the second account as the address in the prior art can be avoided.

In a possible implementation, the terminal can obtain the ciphertext of each input amount and the ciphertext of each output amount; the terminal calculates the ciphertext of the difference between the total input amount and the total output amount based on the ciphertext of each input amount and the ciphertext of each output amount; the terminal generates the third signature information of the transaction content based on the ciphertext of the difference; wherein the transaction request message and the transaction record also include the third signature information; the first verification result and the second verification result also include the verification result of the third signature information, and the verification result of the third signature information is obtained by the transaction processing device according to the verification parameters in the third signature information, the ciphertext of each input amount and the ciphertext of each output amount through verification calculation, and the verification result of the third signature information is used to indicate whether the total input amount is equal to the total output amount.

It can be seen that the transaction content of this application does not need to carry the plain text of each input amount and each output amount. The verifier, such as the transaction processing device, can verify whether the total input amount is equal to the total output amount based on the verification parameters in the third signature information, the ciphertext of each input amount and the ciphertext of each output amount, that is, know the correctness of the transaction. This helps to protect the privacy of the transaction amount.

The ciphertext of each input amount and the ciphertext of each output amount are obtained by using an additive homomorphic encryption algorithm. The additive homomorphic encryption algorithm refers to performing an addition process on the encrypted data to obtain an output, and decrypting this output, and the result is the same as the output result obtained by processing the unencrypted original data. Therefore, the terminal does not need plain text, but uses the ciphertext of each input amount and the ciphertext of each output amount to obtain the ciphertext of the total input amount and the ciphertext of the total output amount, and can also obtain the ciphertext of the difference between the total input amount and the total output amount.

It can be seen that the above possible implementations can protect the privacy of the first account (i.e., the payee or sender), the second account (payee or receiver), or the transaction amount. Therefore, in some other implementations, the terminal can set the privacy of any one or more of the payer, payee, and transaction amount according to the user's business needs. Accordingly, any one or more of the above three possible implementations can be used to achieve privacy protection.

In a possible implementation, the transaction content may include the ciphertext of each input amount and the ciphertext of each output amount; in addition, the encryption key of the ciphertext of each input amount and the ciphertext of each output amount is the public key of the third-party audit account.

In this way, the third-party audit account can use its own private key to decrypt the ciphertext of each input amount and the ciphertext of each output amount, which is conducive to the auditor with the third-party audit account to audit the transaction amount in the transaction content. Because the transaction content contains the ciphertext of the transaction amount, not the plaintext, and the ciphertext of the transaction amount is encrypted using the public key of the third-party audit account, therefore, in addition to the two parties to the transaction, only the auditor of the third-party audit account can see the transaction amount, which helps to protect the privacy of the transaction amount and facilitates the audit work of the auditor.

In a possible implementation, the terminal can generate the identifier of each input amount based on the one-time private key of the first account; the transaction request message and the transaction record also include the identifier of each input amount, and the identifier of each input amount is used to prevent the input amount from being consumed twice. For example, if a transaction record with the identifier T of the input amount already exists in the blockchain, when the transaction processing device verifies the transaction content and finds the identifier T of the input amount again, it can be determined as a secondary consumption and the verification fails. It can be seen that this implementation method can use the identifier of each input amount to prevent the secondary consumption of the input amount.

In a possible implementation, the terminal can also generate the fourth signature information of the transaction content according to the identification of each input amount, the transaction request message and the transaction record also include the fourth signature information, the first verification result and the second verification result also include the verification result of the fourth signature information, the verification result of the fourth signature information is obtained by the transaction processing device according to the identification of each input amount and the verification parameter in the fourth signature information, and the verification result of the fourth signature information is used to indicate whether the identification of each input amount is correct. It can be seen that if the identification of the input amount is incorrect, the verification result of the fourth signature information is also not passed, further avoiding the secondary consumption of the input amount.

In a possible implementation, the terminal can encrypt the one-time public key of the first account according to the public key of the third-party audit account to obtain the ciphertext of the one-time public key; accordingly, the transaction request message and the transaction record can also include the ciphertext of the one-time public key. In this way, the auditor with the third-party audit account can use his own private key to decrypt the ciphertext of the one-time public key to obtain the one-time public key, thereby obtaining the identity information of the first account, which is convenient for the auditor's audit. For example, the first transaction is initiated by account a, and the payee is account b; the second transaction is initiated by account b, and the payee is account c; after the auditor obtains the one-time public key of account b according to the implementation, the auditor can also obtain the first transaction in which account b participated according to the one-time public key of account b, and through the process of decrypting the one-time public key of account b generated by the terminal that logs in to account a in the first transaction, the long-term public key of account b can be obtained, and the identity information of account b can be obtained, so that account b can be audited. For another example, in combination with the implementation method below, the terminal of account a can use the public key of the third-party audit account to generate the ciphertext of the long-term public key of account b. The auditor can obtain the ciphertext of the long-term public key of account b, and thus can decrypt the long-term public key of account b to facilitate the audit of account b.

In a possible implementation, the terminal may also generate fifth signature information of the transaction content based on the ciphertext of the one-time public key obtained in the above implementation. Accordingly, the transaction request message and the transaction record also include the fifth signature information. The first verification result and the second verification result also include the verification result of the fifth signature information. The verification result of the fifth signature information is obtained by the transaction processing device through verification calculation based on the verification parameters in the fifth signature information. The verification result of the fifth signature information is used to indicate whether the ciphertext of the one-time public key of the first account is correct.

In a possible implementation, the terminal can also encrypt the long-term public key of the second account according to the public key of the third-party audit account to obtain the ciphertext of the long-term public key of the second account; accordingly, the transaction request message and the transaction record also include the ciphertext of the long-term public key. In this way, the auditor with the third-party audit account can use his own private key to decrypt the ciphertext of the long-term public key and obtain the long-term public key of the second account, thereby obtaining the identity information of the second account, which is convenient for the auditor's audit.

In a possible implementation, the terminal may also generate sixth signature information of the transaction content based on the ciphertext of the long-term public key of the second account; accordingly, the transaction request message and the transaction record also include the sixth signature information; the first verification result and the second verification result also include the verification result of the sixth signature information, and the verification result of the sixth signature information is obtained by the transaction processing device through verification calculation based on the verification parameters in the sixth signature information, and the verification result of the sixth signature information is used to indicate whether the ciphertext of the long-term public key of the second account is correct.

In one possible implementation, the terminal obtaining the credentials of the first account may include: the terminal sending a credential request message to a transaction processing device, the credential request message including the one-time public key of the first account and/or the ciphertext of the transaction amount of the first account; the terminal receiving a credential response message returned by the transaction processing device, the credential response message including the credentials of the first account, and the credentials of the first account are generated by the transaction processing device based on the one-time public key of the first account and/or the ciphertext of the transaction amount of the first account.

In one possible implementation, when the terminal applies for the credentials of the first account from the transaction processing device, it can also apply for the credentials of the second account, so that when the second account uses the transaction amount, it can directly use the credentials to protect its own anonymity. For example, the implementation method of the first aspect is used to protect the anonymity of the second account when it is used as a payment account.

That is to say, in the above implementation, the credential request message may also include the one-time public key of the second account and/or the ciphertext of the transaction amount of the second account; accordingly, the credential response message may also include the credential of the second account; the credential of the second account is generated by the management device according to the one-time public key of the first account and/or the ciphertext of the transaction amount of the first account, and the transaction request message and the transaction record also include the credential of the second account. Thus, it is convenient for the second account to protect its anonymity when using the transaction amount as a payment account.

In one possible implementation, the credentials of the second account may also be applied for by the second account itself. For example, before the second account uses the transaction amount, it applies for credentials from the management device. Specifically, it may include: the terminal logged in to the second account may send a credential request message to the management device, and the credential request message includes the one-time public key of the second account and/or the ciphertext of the transaction amount of the second account; and receive a credential response message returned by the management device, and the credential response message includes the credentials of the first account. The credentials of the first account are generated by the management device based on the one-time public key of the first account and/or the ciphertext of the transaction amount of the first account.

In a possible implementation, the first signature information, the second signature information, the third signature information, the fourth signature information, the fifth signature information or the sixth signature information may all be zero-knowledge proof signatures, that is, the method for generating the signature information may adopt a zero-knowledge proof algorithm. The zero-knowledge proof algorithm refers to a series of mathematical calculations performed by the prover on the useful information to be kept confidential to obtain a signature, and the signature is a series of verification parameters, and the series of verification parameters does not include the useful information to be kept confidential; the verifier may use the series of verification parameters to perform a series of verification calculations, and the prover's assertion on the useful information may be verified according to the results of the verification calculations, that is, whether the prover's assertion is correct, and usually the assertion is that the prover can obtain the useful information to be kept confidential. Therefore, the above-mentioned first signature information, second signature information, third signature information, fourth signature information, fifth signature information or sixth signature information can be authenticated using a zero-knowledge proof algorithm, and accordingly, a zero-knowledge proof algorithm can also be used for verification to obtain a verification result. Since the verification calculation process only needs to use the above-mentioned signature information and verification parameters, the leakage of useful information is avoided, thereby protecting the privacy of the first account, the second account, the transaction amount, etc. in the above-mentioned implementation methods.

In the second aspect, the present application also provides a transaction processing method, in which a transaction processing device receives a transaction request message sent by a terminal, the transaction request message includes transaction content and a first signature information, the transaction content is initiated by the terminal based on a first account, and the first signature information is generated by the terminal according to the credentials of the first account; the transaction processing device returns a transaction response message to the terminal according to the transaction request message, and the transaction response message includes transaction result information generated by the transaction processing device according to the transaction content; the transaction processing device receives a transaction record message sent by the terminal according to the transaction response message; the transaction processing device stores the transaction record carried in the transaction record message on a blockchain, which is a distributed database for storing the transaction record in the transaction processing party, and the transaction record includes the transaction content, the first signature information and the transaction result information.

In the present application, the first signature information is generated based on the credentials of the first account, avoiding the prior art of using the long-term private key of the first account to generate a signature, and also requiring a verification device, such as a transaction processing device, to use a long-term public key to verify the signature, resulting in the disclosure of the identity information of the first account. In other words, the present application can protect the anonymity of the first account.

Among them, before the transaction processing device returns a transaction response message to the terminal according to the transaction request message, the method also includes: the transaction processing device verifies the transaction request message to obtain a first verification result; when the first verification result is passed, the transaction processing device runs the transaction content to obtain transaction result information; the method also includes: the transaction processing device verifies the transaction record message to obtain a second verification result; when the second verification result is passed, the transaction processing device executes the step of storing the transaction record carried by the transaction record message on the blockchain.

The first verification result and the second verification result both include the verification result of the first signature information; the verification result of the first signature information is obtained by the transaction processing device using its own public key and the verification parameters in the first signature information for verification calculation. It can be seen that the transaction processing device can verify the first signature information of the transaction content based on its own public key, without having to use the public key of the first account for verification as in the prior art, thereby preventing a third party from knowing the public key of the first account, thereby protecting the privacy of the first account.

Among them, the transaction processing device verifies the first signature information of the transaction content, which may include: the transaction processing device performs verification calculations using a zero-knowledge proof algorithm based on the verification parameters in the first signature information and its own public key to obtain a verification result of the first signature information.

In one possible implementation, the transaction content is initiated by the terminal for the second account based on the first account, that is, the first account can be the account of the sender or payer of the transaction content, and the second account can be the account of the receiver or payee of the transaction content. The transaction request message and the transaction record may also include the second signature information and the one-time public key of the second account, wherein the one-time public key of the second account is the receiving address of the transaction content, or may also be referred to as the address of the receiver or payee of the transaction content. Correspondingly, the first verification result and the second verification result may also include the verification result of the second signature information, which is obtained by the transaction processing device through verification calculation based on the one-time public key of the second account, the public key of the certificate issuing device, and the verification parameters in the second signature information.

It can be seen that in this implementation, the receiving address of the transaction content is a one-time public key, and a third party cannot identify the public key corresponding to the second account of the transaction content based on the receiving address. In addition, the transaction processing device uses the receiving address to verify the second signature information to find out whether the second account has the conditions to store the transaction record on the blockchain, that is, to verify the access qualification of the second account. Compared with the prior art that uses the hash value of the long-term public key of the second account as the receiving address, this implementation can protect the privacy of the second account.

In a possible implementation, the transaction request message and the transaction record may also include third signature information, the ciphertext of each input amount, and the ciphertext of each output amount. Accordingly, the first verification result and the second verification result also include the verification result of the third signature information. The verification result of the third signature information is obtained by the transaction processing device through verification calculation based on the verification parameters in the third signature information, the ciphertext of each input amount, and the ciphertext of each output amount. The verification result of the third signature information is used to indicate whether the total input amount in the transaction record is equal to the total output amount.

It can be seen that the transaction content does not need to carry the plain text of each input amount and each output amount, and even the ciphertext of each input amount and each output amount is not needed in the transaction content. The verifier, such as the transaction processing device, can verify whether the total input amount is equal to the total output amount based on the third signature information, that is, know the correctness of the transaction. This helps to protect the privacy of the transaction amount.

In a possible implementation, the transaction content also includes the ciphertext of each input amount and the ciphertext of each output amount. In addition, the encryption key of the ciphertext of each input amount and the ciphertext of each output amount is the public key of the third-party audit account. In this way, the auditor with the third-party audit account can use his own private key to decrypt the ciphertext of each input amount and the ciphertext of each output amount to obtain the plaintext of each input amount and the plaintext of each output amount. Since the ciphertext is encrypted by the public key of the third-party audit account, only the private key of the third-party audit account can decrypt it, thereby helping to protect the privacy of the transaction amount while facilitating the audit of the auditor.

In a possible implementation, the transaction request message and the transaction record may also include the identifier of each input amount, and the identifier of each input amount is used to prevent the input amount from being consumed twice. For example, if a transaction record with the identifier T of the input amount already exists in the blockchain, when the transaction processing device verifies the transaction content and finds the identifier T of the input amount again, it can be determined that the input amount is a secondary consumption and the verification fails. It can be seen that this implementation method can use the identifier of each input amount to prevent the secondary consumption of the input amount.

In one possible implementation, the transaction request message and the transaction record also include fourth signature information. Accordingly, the first verification result and the second verification result also include a verification result of the fourth signature information. The verification result of the fourth signature information is obtained by the transaction processing device through verification calculation based on the identification of each input amount and the verification parameters in the fourth signature information. The verification result of the fourth signature information is used to indicate whether the identification of each input amount is correct. It can be seen that if the identification of the input amount is incorrect, the verification result of the fourth signature information is also not passed, thereby further avoiding secondary consumption of the input amount.

In a possible implementation, the transaction request message and the transaction record may also include the ciphertext of the one-time public key of the first account, wherein the encryption key of the ciphertext of the one-time public key of the first account is the public key of the third-party audit account. In this way, the auditor with the third-party audit account can use his own private key to decrypt the ciphertext of the one-time public key, obtain the one-time public key, and thus obtain the identity information of the first account, which is convenient for the auditor's audit.

In a possible implementation, the transaction request message and the transaction record may also include fifth signature information; accordingly, the first verification result and the second verification result also include a verification result of the fifth signature information, and the verification result of the fifth signature information is obtained by the transaction processing device through verification calculation based on the verification parameters in the fifth signature information, and the verification result of the fifth signature information is used to indicate whether the ciphertext of the one-time public key of the first account is correct.

In a possible implementation, the transaction request message and the transaction record also include the ciphertext of the long-term public key of the second account, wherein the encryption key of the ciphertext of the long-term public key of the second account is the public key of the third-party audit account. In this way, an auditor with a third-party audit account can use his own private key to decrypt the ciphertext of the long-term public key and obtain the long-term public key of the second account, thereby obtaining the identity information of the second account, which is convenient for the auditor's audit.

In a possible implementation, the transaction request message and the transaction record also include the sixth signature information; the first verification result and the second verification result also include the verification result of the sixth signature information, and the verification result of the sixth signature information is obtained by the transaction processing device through verification calculation based on the verification parameters in the sixth signature information, and the verification result of the sixth signature information is used to indicate whether the ciphertext of the long-term public key of the second account is correct.

In addition, the credentials of the first account can be generated through the following steps: the transaction processing device receives a credential request message sent by the terminal, the credential request message includes the one-time public key of the first account and/or the ciphertext of the transaction amount of the first account; the transaction processing device generates the credentials of the first account according to the credential request message; the transaction processing device sends a credential response message to the terminal, and the credential response message carries the credentials of the first account.

In a possible implementation, the terminal may apply for the credentials of the second account at the same time as applying for the credentials of the first account, so that the second account can directly use the credentials to protect its anonymity when using the transaction amount. That is, the credential request message also includes the one-time public key of the second account and/or the ciphertext of the transaction amount of the second account; the transaction processing device may also generate the credentials of the second account according to the credential request message, and the credential response message may also include the credentials of the second account; the transaction request message and the transaction record may also include the credentials of the second account.

In a possible implementation, the credentials of the second account may also be applied for by the second account itself. For example, before the second account uses the transaction amount, the credentials are applied for from the management device.

In one possible implementation, the first signature information, the second signature information, the third signature information, the fourth signature information, the fifth signature information or the sixth signature information may all be zero-knowledge proof signatures, that is, the signature information may be verified using a zero-knowledge proof algorithm, and the verification process only requires the signature information and system parameters to be used, thereby avoiding leakage of key information in the transaction, thereby protecting the privacy of the first account, the second account, the transaction amount, etc. in the above-mentioned implementations.

In a third aspect, the present application further provides a terminal having the function of implementing the terminal in the above implementation method. The function can be implemented by hardware, for example, including a processor and a transceiver, or can be implemented by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions, and the modules can be software and/or hardware.

In a fourth aspect, the present application further provides a transaction processing device, which has the function of implementing the transaction processing device in the above implementation method. The function can be implemented by hardware, for example, including a processor and a transceiver, or can be implemented by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions, and the modules can be software and/or hardware. The processor and transceiver can process messages sent by multiple terminals in the above implementation method and execute the transaction processing method described in the above implementation method.

In a fifth aspect, the present application further provides a transaction processing device, the transaction processing device comprising at least one endorsement module, a consensus module, a submission module and a management module;

The at least one endorsement module is configured to receive a transaction request message sent by a terminal, wherein the transaction request message includes transaction content and first signature information, wherein the transaction content is initiated by the terminal based on a first account, and the first signature information is generated by the terminal according to credentials of the first account;

The at least one endorsement module is also used to return a transaction response message to the terminal according to the transaction request message, and the transaction response message includes the transaction result information generated by the transaction processing device according to the transaction content; the consensus module is used to receive the transaction record message sent by the terminal according to the at least one transaction response message, and sort the transaction records carried by the transaction record message together with the transaction records received from other terminals according to the receiving time, generate a block including the transaction record, and submit the block to the submission module; the submission module is used to receive the block and store the transaction record in the form of the block on the blockchain; the management module of the transaction processing device is used to generate the credentials of the first account according to its own private key and the one-time public key of the first account and/or the ciphertext of the transaction amount.

In a sixth aspect, the present application also provides a transaction processing system, which may include a terminal and a transaction processing device. The terminal may execute the transaction processing method provided in the first aspect above, or any one or more of the possible implementations of the first aspect; the transaction processing device may execute the transaction processing method provided in the second aspect above, or any one or more of the possible implementations of the second aspect.

In the seventh aspect, the present application also provides a computer-readable storage medium, on which is stored a program code for implementing the transaction processing method provided in the first aspect, or any one or more of the possible implementations of the first aspect, and the program code contains execution instructions for running the transaction processing method provided in the first aspect, or any one of the possible implementations of the first aspect.

In an eighth aspect, the present application also provides a computer-readable storage medium, on which is stored a program code for implementing the transaction processing method provided in the second aspect, or any one or more of the possible implementations of the second aspect, and the program code contains execution instructions for running the transaction processing method provided in the second aspect, or any one of the possible implementations of the second aspect.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic diagram of the structure of a transaction processing system;

FIG2 is a flow chart of a transaction processing method provided by the blockchain system shown in FIG1 ;

FIG3A is a schematic diagram of the structure of a transaction processing system provided by an embodiment of the present invention;

3B is a schematic diagram of the structure of another transaction processing system provided by an embodiment of the present invention;

3C is a schematic diagram of the structure of another transaction processing system provided by an embodiment of the present invention;

3D is a schematic diagram of the structure of another transaction processing system provided by an embodiment of the present invention;

FIG4 is a flow chart of a transaction processing method provided by an embodiment of the present invention;

5 is a flow chart of another transaction processing method provided by an embodiment of the present invention;

6 is a flow chart of another transaction processing method provided by an embodiment of the present invention;

7 is a flow chart of another transaction processing method provided by an embodiment of the present invention;

FIG8 is a schematic diagram of a user interface provided by an embodiment of the present invention;

9 is a schematic diagram of the structure of a terminal provided by an embodiment of the present invention;

10 is a schematic diagram of the structure of a transaction processing device provided in an embodiment of the present invention;

11 is a schematic diagram of the structure of another transaction processing device provided in an embodiment of the present invention;

12 is a schematic diagram of the structure of a terminal provided in an embodiment of the present invention;

FIG. 13 is a schematic diagram of the structure of a transaction processing device provided in an embodiment of the present invention.

DETAILED DESCRIPTION

The technical solutions in the embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings in the embodiments of the present invention.

Currently, blockchain is a distributed database that includes a growing list of ordered records, called blocks, where each block includes transaction records sorted by time within a preset time period. Each block contains a timestamp when the block was generated and a link to the previous block.

The construction of blockchain is based on the transaction processing system. For example, please refer to Figure 1, which is a schematic diagram of the structure of a transaction processing system. The transaction processing system shown in Figure 1 includes a terminal, an endorsing peer, an ordering peer, and a committing peer. The terminal is a terminal for logging into a payment account. The terminal can also be called a payer or a sender, and can initiate a transaction. The endorsing node, the consensus node, and the committing node can be located in different servers, or in the same server, or can be deployed on a cloud platform to perform related functions. Therefore, the endorsing node, the consensus node, and the committing node are collectively referred to as a transaction processing system.

Among them, the terminal is used to initiate the transaction, and can obtain the transaction content, the signature for the transaction content, the address of the payee, and also has the payer's certificate and the payee's certificate.

The endorsement node is used to verify the transaction request message initiated by the payer, and when the verification is passed, it can simulate the transaction content, obtain the transaction result, and generate a signature for the transaction result. For example, the endorsement node can verify the payer's signature on the transaction content, the payer and payee's certificates, the payee's address, etc.

The consensus node is used to execute the consensus algorithm. In addition, the consensus node can obtain multiple transaction records submitted by multiple terminals, and sort the multiple transaction records according to the submission time to obtain an ordered list of transaction records. The ordered list of transaction records is called a block.

The submission node is used to verify the signature of the payer and the signature of the endorsement node in each transaction record in the block, and when the verification is passed, each transaction record in the block can be stored on the blockchain. For example, the submission node verifies whether each transaction record in the block meets the preset conditions. If the preset conditions are met, the verification is passed and the corresponding transaction record can be stored on the blockchain. Among them, the preset conditions can be: each transaction record must have at least ten signatures of endorsement nodes and corresponding transaction results, and the transaction results corresponding to each signature are consistent.

In addition, after the transaction record is stored on the blockchain, the payee can determine whether the payee in the transaction record is himself based on his own private key and the payee's address in the transaction record when receiving the payment.

For example, please refer to FIG. 2, which is a flow chart of a transaction processing method provided by the blockchain system shown in FIG. 1. The transaction processing method may include the following steps:

201. The terminal generates a signature of the transaction content using the private key of the payment account, obtains the certificates of the payment account and the receiving account, and generates a receiving address of the receiving account according to the public key of the receiving account;

The certificates of the withdrawal account and the receiving account are generated by the certificate authority based on the public keys of the payment account and the receiving account, and are used to verify whether the payment account and the receiving account are qualified to use the blockchain system, that is, whether they have access qualifications. The receiving account can verify whether the receiving address is itself by generating a hash value based on its own public key.

202. The terminal sends a transaction request message to at least one endorsing node;

203. Each of the at least one endorsing node may verify the transaction request message, and when the verification is passed, simulate the transaction content to obtain transaction result information;

204. Each of the at least one endorsing node returns a transaction response message to the terminal.

The transaction response message carries the corresponding transaction result information.

Wherein, each endorsing node verifying the transaction request message may include the following steps:

a. The endorsing node verifies the signature of the transaction content. That is, the endorsing node verifies the signature of the transaction content using the public key of the payment account. If the verification is successful, it indicates that the transaction was initiated by the payment account, thereby ensuring the non-repudiation of the payment account;

b. The endorsement node verifies the certificates of the payment account and the receiving account, that is, the endorsement node checks whether the certificates of the payment account and the receiving account are issued by the certificate authority CA. If so, it means that the payment account and the receiving account are qualified to execute transactions, that is, the payment account and the receiving account are qualified to enter;

c. The endorsement node verifies the payee's address. The payee's certificate is the payee's public key, so the hash value of the public key can be obtained to verify whether it is consistent with the payee's address. If it is consistent, the verification is successful, otherwise, the verification fails.

If a, b, and c are all verified, the endorsement node can simulate the transaction content and obtain the transaction result information. The transaction result information includes the transaction result and the signature of the transaction result generated by the endorsement node using its own private key.

For example, if the transaction content is that the payer pays a certain amount of transaction amount to the payee, the endorsement node simulates and runs the transaction content, and the transaction result obtained is that the amount owned by the payer is less than the amount, and the amount owned by the payee is more than the amount.

Among them, the terminal can send a transaction request message to multiple endorsement nodes at the same time, and accordingly, can obtain transaction response messages returned by multiple endorsement nodes. The terminal can obtain multiple signatures and corresponding multiple transaction results based on the multiple transaction response messages.

205. The terminal receives a transaction response message returned by at least one endorsement node, and sends a transaction record message to the consensus node.

The transaction record message carries a transaction record, which includes transaction content, a signature of the transaction content, certificates of a payment account and a payment receiving account, and at least one transaction result information.

206. The consensus node receives the transaction record message, sorts the transaction record carried by the transaction record message sent by the terminal and the transaction records sent by other terminals according to time, generates a block including an ordered transaction record list, and sends the block to the submission node;

207. The submitting node receives the block and verifies each transaction record in the block. When the verification is passed, the block is stored on the blockchain.

Among them, the method for submitting the node to verify each transaction record in the block is the same. Therefore, the transaction record in the transaction record message sent by the terminal is used as an example for explanation. The transaction record verification by the submitting node mainly includes: the submitting node verifies the signature of the transaction content according to the public key of the payment account; the submitting node verifies the signature of the corresponding transaction result according to the public key of the endorsement node; the submitting node verifies whether the transaction result information in the transaction record meets the preset conditions, for example, the preset condition is that there must be at least ten signatures of the endorsement nodes and the corresponding transaction results in the transaction record and the transaction results corresponding to each signature are consistent. In this way, when all verifications are passed, the submitting node can store the transaction record on the blockchain. Specifically, the transaction record is stored on the blockchain in the form of a block generated by the consensus node. The timestamp of the block is the time when the consensus node generates the block, and the link to the previous block in the block is the number determined according to the previous block.

It can be seen that in the transaction processing method shown in Figure 2, the signature of the transaction content is obtained based on the private key of the payment account. The verifier can use the public key of the payment account to verify the signature, and when the verification is passed, confirm that the transaction content is initiated by the payment account, thereby avoiding denial of the payment account.

Since the signature of the transaction content in the transaction processing method shown in Figure 2 is generated using the private key of the payment account, the verifier needs to know the public key of the payment account to verify the signature to prevent the payment account from denying the transaction content. This also means that in addition to the two parties to the transaction, any third party with the public key of the payment account can identify all transactions initiated by the payment account, and the identity anonymity of the payment account cannot be protected.

In addition, in Figure 2, the receiving address of the transaction content is the hash value of the public key of the payment account, and the verifier verifies the eligibility of the payment account to access the blockchain system based on the certificate of the payment account. As a result, once a third party knows the public key of the payment account, it can identify the transaction corresponding to the payment account, and the identity anonymity of the payment account cannot be protected.

In addition, in order for the verifier to verify whether the transaction amount is correct, the transaction content also needs to carry the transaction amount, so that the third party can know the transaction amount between the payment account and the receiving account. For example, whether the transaction input amount is equal to the transaction output amount, to avoid illegal transactions caused by the payment account having a transaction input amount less than the transaction output amount.

It can be seen from Figure 2 that in addition to the two parties to the transaction, third parties such as endorsement nodes, consensus nodes, and submission nodes need to know the public key of the payment account, the public key of the payment account, and the transaction content. Knowing the public keys of the payment account and the payment account is equivalent to knowing the identity information of the payer and the payee, which means that the privacy of the payer, the payee, and the transaction amount in the transaction cannot be protected.

In order to solve this problem, an embodiment of the present invention provides a transaction processing method, which can choose to protect the privacy of the payer, the payee and/or the transaction amount according to the business settings.

In order to facilitate understanding of the embodiments of the present invention, relevant concepts or terms are first explained.

In the embodiments of the present invention, a signature refers to a digital signature, or signature information of digital information, such as signature information or signature of transaction content; a digital signature is a common physical signature similar to that written on paper, which is implemented using technology in the field of public key cryptography and is a method for identifying digital information. A digital signature applies the one-way function principle used in the field of public key cryptography to generate a long-term public key and a long-term private key. Among them, a one-way function refers to a function whose forward operation is very simple and whose reverse operation is very difficult. A set of digital signatures usually defines two complementary operations, one for signing and the other for verification; for example, the signer can use the private key and digital information to calculate a function to generate a signature of the digital information; in the verification operation, the verifier can use the corresponding public key, the digital information and the signature to calculate to determine whether the signature is correct.

In the embodiment of the present invention, the first account is the account that initiates the transaction content, which can be called the payment account or payment account; the second account is the account for the transaction content initiated by the first account, that is, the second account can be the recipient of the transaction content, which can be called the receiving account; accordingly, the first account can also be called the receiving account in other transactions, and the second account can also be called the payment account. For ease of understanding, in the embodiment of the present invention, the first account is the payment account and the second account is the receiving account.

Correspondingly, the terminal for logging into the first account is the terminal in Figures 3A to 3D, which can be called a payment terminal; the terminal for logging into the second account can be called a payment terminal, which is not shown in Figures 3A to 3D.

Before executing the transaction processing method, the terminal can select the embodiment described in the present application to execute the corresponding transaction processing method according to the privacy protection method selected by the user of the first account on the terminal that logs in to the first account, such as choosing to protect the privacy of any one or more of the first account, the second account, and the transaction amount in the transaction content.

For example, please refer to FIG8, which is a user interface diagram provided by an embodiment of the present invention. As shown in FIG8, the diagram takes a mobile phone as an example. The payment account may include multiple accounts, from which the user selects the payment account to be used for this transaction through the input method of the terminal; the user can also enter the payee's payment account and the payment amount in the user interface through the input method of the terminal, and select the option that requires privacy protection in the user interface, as shown in FIG8, to select the privacy protection of the payment account. Optionally, in an embodiment of the present invention, the terminal receives the payment account entered in the user interface or the selected payment account, payment account, amount, and selected privacy protection option; the terminal performs the relevant operations in the following embodiments according to the selected privacy protection option to complete the payment process, that is, to complete the transaction process.

The optional embodiments are described in detail below.

Embodiment 1

In order to protect the privacy of the payment account, the embodiment of the present invention proposes a transaction processing method based on the transaction processing system shown in FIG. 3A or FIG. 3B, which can protect the privacy of the payment account. As shown in FIG. 3A or FIG. 3B, the transaction processing system includes at least one terminal and at least one transaction processing system. The at least one terminal can log in to at least one payment account respectively. In the embodiment of the present invention, the payment account can also be called the first account. In the transaction processing method, each terminal has the same processing process for the transaction initiated by the logged-in payment account. Each transaction processing system in at least one transaction processing system also has the same processing process for the transaction submitted by the terminal. Each transaction processing system can be maintained by a corresponding institution. For example, in the alliance chain scenario of the financial industry, each bank can maintain a transaction processing system to process the transaction submitted by the terminal logged in by the user account of the bank; wherein each transaction processing system includes at least one endorsement node, a consensus node and a submission node, and the at least one endorsement node, a consensus node and a submission node have the same functions as the endorsement node, the consensus node and the submission node in the blockchain system shown in FIG. 1 above.

In the transaction processing system shown in FIG3A, each transaction processing system may further include a management node Group Manager; in the transaction processing system shown in FIG3B, the endorsement node may further perform the function of the management node. That is, the management node may be a node independent of the transaction processing system, or may be combined with the certificate issuing node of the certificate authority into one node, or may be combined with the endorsement node in the transaction processing system into one node. The management node is used to generate credentials for the payment account to protect the identity privacy of the payment account.

In an embodiment of the present invention, each transaction processing system may be a server, which executes the functions of each node in the transaction processing system; each transaction processing system may also be multiple servers, for example, each node corresponds to a server to execute the corresponding function. Since in the embodiment of the present invention, the interaction between the endorsement node, the consensus node and the submission node in the transaction processing system is similar to that in the prior art, the embodiment of the present invention refers to the transaction processing system as a transaction processing device, and the transaction processing device executes the function of each node; accordingly, since the interaction process between each terminal and the transaction processing device is also the same, as shown in FIG3C, the transaction processing system shown in FIG3A is abstracted into a system including a terminal, a transaction processing device and a management device; accordingly, as shown in FIG3D, the transaction processing system shown in FIG3B is abstracted into a system including a terminal and a transaction processing device, wherein, in FIG3D, the transaction processing device can also execute the function of the management device to generate credentials for the payment account to protect the identity privacy of the payment account.

In addition, in the embodiment of the present invention, the payment account is collectively referred to as the second account, and the terminal that logs into the payment account may also be referred to as the payment party or the recipient.

In the embodiment of the present invention, when the terminal generates the signature information of the transaction content, it no longer uses the private key of the payment account, but uses the credential of the payment account to generate the signature information of the transaction content. In this way, even a third party with the public key of the payment account cannot recognize that the signature information is generated by the terminal logged in by the payment account; accordingly, when verifying the signature information of the transaction content, the verifier, such as the endorsement node and the submission node, no longer uses the public key of the payment account to verify, but uses the public key of the management device that generates the credential to verify, thereby preventing the public key of the payment account from being known by the verifier or any third party during the entire transaction processing process, and effectively protecting the privacy of the payment account.

For the convenience of subsequent description, the embodiment of the present invention refers to the signature information of the transaction content generated by the credentials of the payment account as the first signature information.

In an embodiment of the present invention, the terminal can send the content of the payment account that needs privacy protection to the management device, and the management device generates a credential for the payment account based on the content that needs privacy protection. For example, the management device generates a credential for the payment account based on the one-time public key of the payment account and/or the transaction amount owned.

Since the credential is issued by the management device for the payment account, once the payment account uses the credential to generate a signature for the transaction content, the transaction content cannot be denied. Thus, the privacy of the payment account can be protected while maintaining the non-repudiation of the transaction content.

In some embodiments, the terminal may obtain the credentials of the payment account by:

11) The terminal sends a credential request message to the management device, wherein the credential request message includes the one-time public key of the first account and/or the ciphertext of the transaction amount of the first account;

12) The terminal receives a credential response message returned by the management device, wherein the credential response message includes the credentials of the first account, and the credentials of the first account are generated by the management device based on the one-time public key of the first account and/or the ciphertext of the transaction amount of the first account.

For example, the terminal submits the one-time public key otpk _Alice of the payment account Alice to the management device. The management device generates the credential (A _Alice , x _Alice ) for Alice based on its own private key gsk=α and the random number x _Alice , where:

Among them, g ₁ , g ₂ and h are system parameters.

For another example, the terminal submits the amount C owned by the payment account Alice and the one-time public key otpk _Alice to the management device. The management device generates a credential (A _Alice , x _Alice ) for Alice based on its own private key gsk=α and the random number x _Alice , where:

Among them, g ₁ , g ₂ and h are system parameters.

For another example, the terminal only sends the amount C of the payment account to the management device. Then, in the credential generated by the management device for the payment account Alice, otpk _Alice is equal to 1.

The transaction processing method in the embodiment of the present invention is different from the transaction processing method shown in Figure 2 in that, in the embodiment of the present invention, the terminal generates the first signature information of the transaction content based on the credentials of the payment account, and accordingly, the transaction processing device verifies the transaction request message and obtains the first verification result; and the transaction processing device verifies the transaction record message and obtains the second verification result, the first verification result and the second verification result both include the verification result of the first signature information, and the verification result of the first signature information is obtained by the transaction processing device performing verification calculation based on the public key of the management device and the verification parameters in the first signature information.

In addition, in the first verification result, the verification result of the first signature information is used to indicate whether the first account is an account that can access the transaction processing device, or whether it is an account issued by the transaction processing device, or whether the first account has the authority to access the transaction processing device; in the second verification result, the verification result of the first signature information is used to indicate whether the first account has the authority to use the blockchain, that is, whether the transaction records related to the first account can be stored on the blockchain. Optionally, the role of the verification result of the first signature information can be associated with related operations after the verification is passed, which is not limited in this application.

Specifically, as shown in FIG4 , the transaction processing method according to the embodiment of the present invention may include the following steps:

S301. The terminal generates first signature information of transaction content according to the credentials of the first account, where the transaction content is initiated by the terminal based on the first account, and the credentials are generated for the first account by the management device using its own private key;

Among them, when the terminal generates the first signature information of the transaction content according to the credentials of the first account, it is also necessary to determine whether to generate the first signature information according to the one-time private key and credentials of the first account or the long-term private key and credentials of the second account based on whether the first account uses the address of the one-time public key or the address of the hash value of the long-term public key when receiving the transaction amount as the payee; that is, when the first account uses the address of the one-time public key when receiving the amount to be consumed as the payee, then when the first account consumes the amount as the payee, step S301 is for the terminal to generate the first signature information of the transaction content according to the one-time private key and credentials of the first account; when the first account uses the address of the hash value of the long-term public key when receiving the amount to be consumed as the payee, then when the first account consumes the amount as the payee, step S301 is for the terminal to generate the first signature information of the transaction content according to the long-term private key and credentials of the first account.

S302: The terminal sends a transaction request message to the transaction processing device, where the transaction request message includes the first signature information and the transaction content;

S303: The transaction processing device returns a transaction response message to the terminal according to the transaction request message, wherein the transaction response message includes the transaction result information;

There may be multiple transaction result information, and the multiple transaction result information may be obtained by simulating the transaction content by multiple endorsement nodes in the transaction processing device.

Among them, before the transaction processing device returns a transaction response message to the terminal according to the transaction request message, the method also includes: the transaction processing device verifies the transaction request message and obtains a first verification result; when the first verification result is passed, the transaction processing device runs the transaction content and obtains transaction result information.

S304, the terminal sends a transaction record message to the transaction processing device according to the transaction response message;

S305. The transaction processing device stores the transaction record carried by the transaction record message on the blockchain.

The transaction processing device verifies the transaction record message and obtains a second verification result; when the second verification result is passed, the transaction processing device executes step 305 to store the transaction record carried by the transaction record message on the blockchain.

The transaction record includes the transaction content, the first signature information and the transaction result information;

Among them, the first verification result and the second verification result both include the verification result of the first signature information, and the verification result of the first signature information is obtained by the transaction processing device through verification calculation based on the public key of the management device and the verification parameters in the first signature information.

It should be noted that although steps S301 to S305 do not mention the relevant processing steps for the second account and the transaction amount, in order to implement the transaction processing method, those skilled in the art can combine the relevant processing steps for the second account and the transaction amount described in the embodiment of the present invention or the relevant processing steps for the second account and the transaction amount in the prior art as shown in Figure 2 to verify the access qualifications of the second account, the correctness of the transaction amount and the access qualifications of the first account. For example, assuming that only the anonymity of the first account is protected, and the second account and the transaction amount are both processed using the prior art, then in addition to the first signature information generated by the terminal, the transaction content also needs to carry the plain text of the input amount and the plain text of the output amount so that the transaction processing device can verify the accuracy of the transaction; at the same time, the transaction content also needs to carry the certificate of the second account in the usual sense (that is, the long-term public key of the second account, which is different from the certificate that can perform zero-knowledge proof generated using the long-term public key of the second account in Example 2) so that the transaction processing device can verify the access qualifications of the second account. At the same time, the receiving address of the transaction content, that is, the address of the second account, is the hash value of the long-term public key of the second account. Therefore, the first verification result also includes the verification result of the transaction processing device on the transaction amount and the verification result of the certificate of the second account.

Among them, the access qualification of the first account or the access qualification of the second account is obtained according to the verification result of the first signature information or the second signature information. Specifically, the access qualification refers to whether the first account and the second account have the authority to use the blockchain, whether they can access the transaction processing device, or whether they are accounts issued by the transaction processing device, etc., which can be limited according to the relevant operations after the verification result is passed. For example, when the verification result of the first signature information is in the first verification result, the verification result of the first signature information is used to indicate whether the first account can access the transaction processing device; when the verification result of the first signature information is in the second verification result, the verification result of the first signature information is used to indicate whether the first account has the authority to use the blockchain.

In an embodiment of the present invention, the first signature information is a zero-knowledge proof signature, that is, the terminal can generate the first signature information of the transaction content using the zero-knowledge proof algorithm based on the credentials of the payment account. Correspondingly, the verifier, such as the transaction processing device, can use the public key gpk of the management device to verify the first signature information of the zero-knowledge proof. Among them, zero-knowledge proof means that the prover performs a series of mathematical calculations on the useful information to be kept confidential to obtain a signature, and the signature is a series of parameters, and the series of parameters does not include the useful information to be kept confidential; the verifier can use the series of parameters to perform a series of mathematical calculations, and the prover's assertion on the useful information can be verified according to the results of the mathematical calculations, that is, the prover's assertion is correct, which is usually the assertion that the prover can obtain the useful information to be kept confidential.

For example, when the transaction processing device passes the verification, the terminal's assertion about the first signature information can be trusted: the payment account has the credential issued by the management device and the one-time private key, that is, the payment account has access proof.

Among them, the expression of the zero-knowledge proof (Signature of knowledge, SoK) is:

SoK{(secret value)：“relations to proof”}(Message to sign);

In this expression, (secret value) is the prover's secret, for example, the payment account has a one-time private key and a credential issued by the management device for the payment account; "relations to proof" is the relationship to be proved, for example, the relationship or assertion to be proved is: the terminal can obtain the one-time private key of the payment account and the credential issued by the management device for the payment account; the part (Message to sign) is the file to be signed, for example, the file can be the transaction content initiated by the payment account; in the expression, all symbols that are not secrets of the prover are public values, for example, the terminal for logging into the payment account sets the anonymity of the payment account, but does not set the privacy of the receiving account and the transaction amount, then the relevant parameters about the receiving account and the transaction amount are all public; in addition, all parameters used in the zero-knowledge proof except the prover's secret can be public and can be included in the signature, such as system parameters can be included in the first signature information, collectively referred to as verification parameters.

For example, assuming that the payment account is Alice, and the amount Alice wants to spend this time is obtained from the address of her own one-time public key when Alice is the payee, the first signature information of this transaction needs to use Alice's one-time private key otsk _Alice , and the credential issued by the management device to Alice is (A _Alice , x _Alice ), where the credential is generated by the management device based on the ciphertext of the one-time public key of the first account and the transaction amount of the first account, and the public key of the management device Then the expression of the signature generated by the terminal for the transaction content using zero-knowledge proof is:

Among them, Tx1 is the transaction content to be signed; _g1 , _g2 and h are system parameters;

○ Randomly generate a, k _{, ra} , _rb , _rx , _rk∈Zp

○ Calculation:

○

○

○T＝e(f，otsk _Alice ),

○

○

○ Calculate c = H (param, gpk, S, K, T, R ₁ , R ₃ , Msg), param is the system parameter, Msg is the transaction content;

○z _k = r _k + ck,

○ _za ＝ _ra +ca，

○z _x = r _x + c x,

○z _b = r _b + c ax,

○First signature information = (S, K, T, c, _zk , _za , _zx , _zb )

Therefore, the transaction request message and transaction record message sent by the terminal to the transaction processing device only need to carry the first signature information generated by the zero-knowledge proof. The verifier can know through the first signature information that the terminal can obtain the one-time private key of the payment account and the credential issued by the group administrator for it, so as to verify that the payment account is eligible for access. And because the credential is generated by a trusted management device, the payment account can be prevented from denying the transaction content.

Accordingly, the transaction processing device uses the public key of the management device The first signature information generated by the above zero-knowledge proof is verified as follows:

○ After receiving the first signature information = (S, K, T, c, z _k , _za , z _x , z _b ), calculate:

■

■

If c=H(param, gpk, S, K, T, R ₁ , R ₃ , Msg), the verification is successful. That is, the first signature information is verified successfully, indicating that the first account has the conditions for storing the transaction record on the blockchain.

The function or mapping e is a bilinear pairing mapping. The mapping e: G ₁ ×G ₂ → _GT is called a bilinear pairing mapping if it satisfies the following conditions:

● Bilinearity: for any

●Non-degeneracy: e(g ₁ , g ₂ )≠1, where 1 refers to the identity element of _GT .

Among them, _G1 , _G2 and _GT are multiplicative groups of prime order p, _g1 is the generator of _G1 , and _g2 is the generator of _G2 . For a positive integer n, [n] represents the set of all positive integers not greater than n, that is, [n] = {1, 2, ..., n}, represents all non-zero residue classes modulo a positive integer p, that is

It can be seen that the embodiments of the present invention can prevent the verifier or other third party that can obtain the signature from using the public key disclosed by the payment account to identify the identity information of the payment account. At the same time, zero-knowledge proof can be used to enable the verifier and the third party to know that the payment account has access qualifications, and that the payment account has credentials issued by the management device so that the payment account cannot deny the corresponding transaction content.

Embodiment 2

If the transaction content is initiated by the first account for the second account, that is, when the transaction content involves both parties to the transaction, in order to protect the privacy of the second account, the embodiment of the present invention further proposes a transaction processing method based on the transaction processing system shown in Figures 3A to 3D, which can protect the privacy of the second account. Among them, in the transaction processing system shown in Figure 3A, each transaction processing system can also include a certificate issuing node of a certificate authority, and the certificate issuing node is used to issue a certificate for each payment account to generate the second signature information of the transaction content, that is, the certificate is different from the ordinary certificate, and the certificate does not need to be verified using a long-term public key. As described in the embodiment of the present invention, the certificate can be verified using a one-time public key, the public key of the certificate issuing device, and the signature information. Alternatively, based on the transaction processing system shown in Figure 3B, the endorsement node can also perform the function of the certificate issuing node, and is also used to issue the above-mentioned certificate to the user. Alternatively, the transaction processing system shown in Figure 3C also includes a certificate issuing device; or in the transaction processing system shown in Figure 3D, the transaction processing device also performs the function of a certificate issuing device, and the certificate issuing device can issue a certificate for the receiving account. The certificate is different from an ordinary certificate. Using this certificate, the terminal can generate a second signature information for the transaction content. The second signature information can protect the privacy of the receiving account, and at the same time enable the transaction processing device to verify whether the receiving account has the conditions to store the transaction record on the blockchain.

In the embodiment of the present invention, the payment terminal that logs in to the payment account applies for a certificate from a certificate authority (CA) device (or a transaction processing device, or a certificate issuing node), which may include the following steps:

21) The payment terminal sends a certificate application message to the CA device, and the certificate application message carries the long-term public key of the payment account and the proof of the long-term private key;

22) When the CA device verifies that the certificate application message is passed, it generates a certificate of the payment account according to the long-term public key of the payment account, and returns a certificate response message to the payment terminal, which carries the certificate of the payment account.

In this way, when the paying account initiates a transaction to the receiving account, the certificate of the receiving account can be obtained from the receiving terminal, and the second signature information of the transaction content can be generated using the certificate.

For example, the long-term public key of the receiving account Bob is Y _Bob , the private key cask of the CA device is β, and the public key capk is After the CA device verifies the certificate application message, it can generate a certificate for Bob for zero-knowledge proof (F _Bob , w _Bob ), where:

Among them, _h0 is the system parameter and w _Bob is randomly generated.

In addition, in an embodiment of the present invention, in order to protect the privacy of the payment account, in addition to generating a second signature information of the transaction content to verify the access qualification of the payment account, the one-time public key of the payment account can also be used as the transaction content or the address of the payee, instead of using the hash value of the long-term public key of the payment account in the prior art as the address of the transaction content, thereby avoiding the identity leakage of the payment account caused by the transaction processing device in the prior art needing to use the long-term public key of the payment account to verify the address of the payee.

In the embodiment of the present invention, the one-time public key of the payment account can be generated according to the long-term public key of the payment account, for example, the one-time public key generation PKeyGen() function is used to generate the one-time public key of the payment account.

That is, the terminal generates a one-time public key of the payment account, which may include: the terminal generates a PKeyGen() function according to the long-term public key and the one-time public key of the payment account, and calculates the one-time public key of the payment account.

For example, the long-term public key Y _Bob of the receiving account Bob is used as the input of the PKeyGen() function, and the output is Bob's one-time public key Among them, r _tx is a random number.

In addition, the terminal can also obtain the following information based on the system parameters g ₁ , g ₂ and r _tx The transaction content initiated by the payment account carries the R _tx , R′ _tx , which is used to calculate the one-time private key of the receiving account. When the receiving account initiates a transaction, for example, when consuming the transaction amount input from the payment account, the one-time private key can be used to protect the anonymity of the receiving account.

That is to say, when the user account is used as a receiving account, the parameters R _tx , R′ _tx can be obtained when calculating the one-time public key of the user account. In this way, when the user account needs to consume the transaction amount of this income, the parameters R _tx , R′ _tx can be used to generate a one-time private key. The one-time private key and the credentials generated by the management device can be used to generate the first signature information as described in Example 1 for the transaction content including the transaction amount, thereby ensuring the anonymity of the user account when used as a payment account.

The one-time private key of the payment account is generated by the terminal that logs into the payment account according to the long-term private key of the payment account and the above-mentioned parameter R′ _tx . For example, the input of the one-time private key generation SKeyGen() function is the long-term private key yBob of the payment account Bob and the parameter R′ _tx , that is, SKeyGen(R′ _tx , yBob), and the calculated one-time private key is

In addition, in the embodiment of the present invention, when the payment terminal uses the one-time public key of the payment account as the address of the payee, the payee, that is, the payment terminal that logs into the payment account, can confirm whether the payee is itself by checking the address, that is, checking the one-time public key. Specifically, the payment terminal can check the address of the payee in the transaction record through the one-time public key check PKeyCheck() function. For example, the payment terminal that logs into the payment account Bob uses R _tx in the transaction content, the one-time public key Otpk _Bob , and the long-term private key yBob as the input of the one-time public key check PKeyCheck() function. If That is, if the function output is 1, it indicates that the payee's address is Bob's address, which means that the payee of the transaction content is Bob; if the function output is 0, it indicates that the payee of the transaction content is not Bob.

In the embodiment of the present invention, the payment terminal uses the one-time public key of the payment account as the address of the transaction content, and also needs to generate the second signature information of the transaction content according to the one-time public key of the payment account and the certificate of the payment account. The verification result of the second signature information is used to indicate whether the payment account has the conditions to store the transaction content on the blockchain. The condition can be whether the long-term private key of the payment account has a corresponding certificate. Correspondingly, the second signature information cannot include the certificate of the payment account. Therefore, the embodiment of the present invention not only verifies the access qualification of the second account, but also protects the anonymity of the payment account.

That is, in order to protect the anonymity of the second account, as shown in FIG. 5 , the transaction processing method is different from the transaction processing method shown in FIG. 4 in that step 301 in FIG. 4 is replaced by steps 401-402, wherein:

401. The terminal generates a one-time public key of the second account according to the long-term public key of the second account;

402. The terminal generates second signature information of the transaction content according to the one-time public key of the second account and the certificate of the second account.

Among them, the certificate is generated based on the private key of the certificate issuing device; for example, it is generated according to the above steps 21) to 22); accordingly, the transaction request message and transaction record also include the one-time public key and second signature information of the second account, and the one-time public key of the second account is the address of the second account.

In addition, the first verification result and the second verification result also include a verification result of the second signature information, and the verification result of the second signature information is obtained by performing verification calculation based on the one-time public key of the second account, the public key of the certificate issuing device, and the verification parameters in the second signature information.

Optionally, when the verification result of the second signature information is in the first verification result, it is used to indicate that the second account has the authority to access the transaction processing device, that is, the transaction processing device can simulate the operation of the transaction content; when the verification result of the second signature information is in the second verification result, it is used to indicate that the second account has the authority to use the blockchain.

It should be noted that although steps S401 to S402 do not mention the relevant processing steps for the first account and the transaction amount, in order to implement the transaction processing method, those skilled in the art may combine the relevant processing steps for the first account and the transaction amount described in the embodiment of the present invention or the relevant processing steps for the first account and the transaction amount in the prior art as shown in FIG. 2 to verify the access qualifications of the second account, the correctness of the transaction amount and the access qualifications of the first account to complete the transaction processing process. For example, assuming that only the anonymity of the second account is protected, and the first account and the transaction amount are both processed using the prior art processing method, then in addition to the terminal generating the second signature information, the transaction content also needs to carry the plain text of the input amount and the plain text of the output amount so that the transaction processing device can verify the accuracy of the transaction; at the same time, the transaction content also needs to carry the certificate of the first account in the usual sense (that is, the long-term public key of the first account, which is different from the certificate used for zero-knowledge proof in Example 2) so that the transaction processing device can verify the access qualifications of the first account. At the same time, the terminal also needs to generate the first signature information of the transaction content based on the one-time private key or long-term private key of the first account, so that the first account cannot deny the transaction. Therefore, the first verification result also includes the verification result of the transaction processing device on the transaction amount and the verification result of the certificate of the first account. The first verification result and the second verification result also include the verification result of the first signature information.

In some embodiments, the second signature information is a zero-knowledge proof signature. For example, assuming that the second account is Bob, the expression for generating the second signature information is:

Specifically, the terminal obtains the one-time public key Otpk _Bob of the second account, the certificate (F _Bob , w _Bob ) and the public key capk of the CA device as follows: The calculation process of generating the second signature information includes:

○Randomly generate ρ, r _ω , r _τ , r _ρ , r _σ ∈Z _p

○ Calculation:

■

■

○ Calculate c = H (param, capk, θ, R ₂ , Msg), where param is the system parameter and Msg is the transaction content.

○Calculation

■ z _ω ＝ r _ω + c · w _Bob

■z _τ ＝r _τ +c/r _tx

■ _zρ ＝ _rρ +cρ

■ z _σ ＝ r _σ + cρw _Bob

○ Second signature information = (θ, c, z _ω , z _τ , z _ρ , z _σ )

Accordingly, the transaction processing device can use the public key of the CA device The address of the second account, i.e. the one-time public key Otpk _Bob of the second account, and the second signature information are verified and calculated as follows:

○After receiving the signature = (θ, c, z _ω , z _τ , z _ρ , z _σ ), calculate:

○ If c = H(param, capk, θ, R ₂ , Msg), the verification passes.

In addition, if only the anonymity of the second account is protected in the embodiment of the present invention, then in addition to the second signature information mentioned above, the transaction content also needs to use the long-term private key or one-time private key of the first account to generate the first signature information of the transaction content, so as to verify the access qualification of the first account. At this time, whether the first signature information is generated using the long-term private key of the first account or the one-time private key is based on whether the first account uses the address of the one-time public key or the hash value of the long-term public key when receiving the amount of the transaction as the payee. Correspondingly, if only the anonymity of the second account is protected, in order to verify the correctness of the transaction, the transaction content needs to carry the plain text of the transaction amount, so that the transaction processing device can use the transaction amount to verify the correctness of the transaction.

It can be seen that in the embodiment of the present invention, in order to protect the anonymity of the second account, the terminal that logs into the first account needs to generate a one-time public key of the second account based on the long-term public key of the second account, and use the one-time public key as the address of the transaction content; and generate the second signature information of the transaction content based on the one-time public key and the certificate of the second account, and the second signature information enables the verifier such as the transaction processing device to verify the access qualification of the second account, thereby, the verifier such as the transaction processing device can verify the access qualification of the second account without knowing the long-term public key of the second account, and the payee of the transaction content can know whether the payee is itself based on the one-time public key, thereby avoiding the public key of the second account being known by a third party other than the two parties to the transaction in the prior art, and protecting the anonymity of the second account.

In addition, while generating the one-time public key, the parameters of the one-time private key generation function and the one-time public key check function of the second account can also be obtained, and these two parameters are stored in the transaction content, so that when the second account receives the transaction content, the parameters of the one-time public key check function are used to check whether the address of the transaction content is itself. If it is itself, when consuming the transaction amount in the transaction content, the parameters of the one-time private key generation function and the credentials of the second account can be used to generate the signature information of the transaction content. That is to say, when the second account is a payment account and consumes the transaction amount, the parameters of the one-time private key generation function can be used to generate the one-time private key of the second account, and the one-time private key and the credentials can be used to generate the signature information of the transaction content. Therefore, as described in Example 1, the anonymity of the second account when it is used as a payment account is protected.

Embodiment 3

According to the business settings, in order to protect the privacy of the transaction amount in the transaction content, an embodiment of the present invention proposes a transaction processing method, in which a third signature information of the transaction content can be generated, and a verifier such as a transaction processing device can obtain whether the total transaction input amount is equal to the total transaction output amount based on the verification result of the third signature information, thereby ensuring the correctness of the transaction amount while not carrying the transaction amount in the transaction content.

In the embodiment of the present invention, as shown in FIG. 6 , the transaction processing method is different from the transaction processing method shown in FIG. 4 in that step 301 in FIG. 4 is replaced by steps 501-403, wherein:

501. The terminal determines the ciphertext of each input amount and the ciphertext of each output amount;

502. The terminal calculates the ciphertext of the difference between the total input amount and the total output amount based on the ciphertext of each input amount and the ciphertext of each output amount;

503. The terminal generates third signature information of the transaction content according to the ciphertext of the difference;

The transaction request message and the transaction record also include the third signature information; the first verification result and the second verification result also include the verification result of the third signature information, and the verification result of the third signature information is used to indicate whether the total input amount is equal to the total output amount.

It should be noted that, although steps S501 to S503 do not mention the relevant processing steps of the first account and the second account, in order to implement the transaction processing method, those skilled in the art can verify the access qualification of the second account, the correctness of the transaction amount, and the access qualification of the first account according to the relevant processing steps of the first account and the transaction amount described in the embodiment of the present invention or the relevant processing steps of the first account and the transaction amount as shown in Figure 2 in the prior art, to complete the transaction processing process. For example, assuming that only the anonymity of the transaction amount is protected, the first account and the second account are both processed using the processing method in the prior art. In addition to the third signature information generated by the terminal, the transaction content also needs to carry the certificates of the first account and the second account in the usual sense so that the transaction processing device can verify the access qualification of the first account and the second account. At the same time, the terminal also needs to generate the first signature information of the transaction content according to the one-time private key or long-term private key of the first account, so that the first account cannot deny the transaction; the terminal also needs to use the hash value of the long-term public key of the second account as the receiving address; therefore, the first verification result also includes the verification result of the transaction processing device on the certificates of the first account and the second account, and the first verification result and the second verification result also include the verification result of the first signature information.

The terminal can determine the ciphertext of each input amount and the ciphertext of each output amount by using an additive homomorphic encryption algorithm. The additive homomorphic encryption algorithm refers to performing arithmetic processing on the encrypted data to obtain an output, and decrypting this output. The result is the same as the output result obtained by processing the unencrypted original data by addition. Therefore, the terminal directly uses the ciphertext of each input amount and the ciphertext of each output amount to obtain the ciphertext of the total input amount and the ciphertext of the total output amount.

In some embodiments, the third signature information can also be a zero-knowledge proof signature, that is, the verifier such as the transaction processing device can perform zero-knowledge proof verification calculations based on the verification parameters in the third signature information, the ciphertext of each input amount, and the ciphertext of each output amount, and the correctness of the transaction can be known based on the calculation results. For example, assuming that the transaction input amounts are input1 and input2 respectively; the transaction output amounts are output1 and output2 respectively, and the ciphertexts of the transaction input amounts obtained by using the additive homomorphic encryption algorithm HEnc _pk () are C _i1 and C _i2 respectively, and the ciphertexts of the transaction output amounts obtained are C _o1 and C _o2 , then

C′＝C _i1 C _i2 /C _o1 C _o2 ＝HEnc _pk (0)

Then, the terminal can generate a signature of the zero-knowledge proof that "C' is a ciphertext encrypted with a plaintext of 0" as the third signature information.

For example, suppose the transaction initiated by the payer has an input amount and an output amount, that is, the payer and the payee are in a one-to-one relationship, the plaintext of the transaction input amount is _min , and the ciphertext is Among them, r _in is the random number encrypted by the payer; the plain text of the transaction output amount is m _out and the cipher text is Among them, r _out is the random number encrypted by the payer; then the expression when the third signature information is the signature of the zero-knowledge proof is:

Wherein, Tx1 is the transaction content to be signed, r′= _rin - _rout , and _g4 is the system parameter.

Specifically, the terminal may calculate the signature of the zero-knowledge proof by including the following calculation process:

○ Randomly generate r _rp ,∈Z _p

○ Calculation:

■

○ Calculate c=H(param, R ₁ , Msg), where param is the system parameter and Msg is the transaction content.

○Calculation

■z _rp = r _rp + cr′,

○ Third signature information = (c, z _rp )

The transaction processing device uses the ciphertext C _in of the input amount, the ciphertext C _out of the output amount and the third signature information in the transaction content to perform the following verification calculation:

○After receiving the third signature information = (c, z _rp ), calculate:

●

○ If c = H(param, R ₁ , Msg), the verification passes.

That is to say, when the third signature information is verified, the transaction processing device can know that the transaction amount is correct, thereby ensuring the correctness of the transaction.

It can be seen that in the embodiment of the present invention, the third signature information is used to ensure the correctness of the transaction, thereby avoiding the transaction amount being carried in the transaction request message and the transaction record, and protecting the privacy of the transaction amount.

The above-mentioned embodiments 1 to 3 respectively describe the transaction processing method described in the present application from three aspects: protecting the privacy of the payer, i.e., the first account, the payee, i.e., the second account, or the transaction amount.

In some embodiments, according to the business settings, the privacy of any one or more of the payer, i.e., the first account, the payee, i.e., the second account, and the transaction amount may also be selected, and the specific transaction processing method may correspondingly include the relevant steps and implementation methods in the above-mentioned embodiments 1 to 3. The embodiments of the present invention are not limited.

For example, in an embodiment of the present invention, if the terminal includes privacy protection of the first account or the second account in addition to protecting the privacy of the transaction amount, then the above-mentioned embodiment 1 and/or embodiment 2 can be used to perform related operations to achieve privacy protection of the transaction amount and the first account, or to achieve privacy protection of the transaction amount and the second account, or to achieve privacy protection of the transaction amount, the first account and the second account. Correspondingly, if the terminal only needs to protect the privacy of the transaction amount according to the input of the user interface shown in Figure 8, the first signature information of the transaction content can be generated by using the long-term private key or the one-time private key of the first account in the prior art, and the hash value of the long-term public key of the second account is used as the address of the second account. In other words, the privacy protection operation in the transaction processing method described in the embodiment of the present invention can be combined with the transaction processing method in the prior art to achieve privacy protection of the transaction amount, privacy protection of the transaction amount and the first account, privacy protection of the transaction amount and the second account, privacy protection of the first account and the second account, and privacy protection of the first account, the second account and the transaction amount, etc., and the above combination methods all belong to the protection scope of this application.

Implementation Method 4

In order to facilitate understanding of the above three invention points of the present application, the present application takes Example 4 as an example to elaborate on how to simultaneously protect the privacy of the first account, the second account and the transaction amount.

Please refer to FIG. 7, which is a flowchart of another transaction processing method provided by an embodiment of the present invention. In addition, for the convenience of explanation, the terminal for logging into the first account is called a payment terminal, the terminal for logging into the second account is called a payment terminal, the first account is called a payment account, and the second account is called a payment account. Based on the transaction processing system shown in FIG. 3C, the transaction processing method shown in FIG. 7 may include the following steps:

601. The terminal sends a credential request message to the management device;

The terminal is a terminal for logging into the first account. The credential request message includes a one-time public key of the first account and/or a ciphertext of the transaction amount of the first account. The one-time public key of the first account is when the first account is used as a payment account, the corresponding payment account is generated according to the long-term public key of the first account.

602. The management device generates a credential of the first account according to the one-time public key of the first account and/or the ciphertext of the transaction amount of the first account;

603. The management device returns a credential response message to the terminal;

The credential response message carries the credentials of the first account.

604. The terminal generates a one-time public key of the second account according to the long-term public key of the second account, and uses the one-time public key as a receiving address for the transaction content;

Among them, the terminal can generate a one-time public key of the second account according to the one-time public key generation function in Example 2, which will not be described in detail here.

605. The terminal determines the ciphertext of each input amount and the ciphertext of each output amount, and calculates the ciphertext of the difference between the total input amount and the total output amount based on the ciphertext of each input amount and the ciphertext of each output amount;

606. The terminal generates signature information of the transaction content according to the one-time private key and credential of the first account, the certificate of the second account, and the ciphertext of the difference between the total input amount and the total output amount.

That is to say, the signature information of the transaction content includes the first signature information, the second signature information and the third signature information in embodiments one to three.

607. The terminal sends a transaction request message to the transaction processing device. The transaction request message carries signature information of the transaction content, a one-time public key of the second account as a receiving address, and the transaction content.

The transaction content may include the parameters of the one-time private key generation function and the one-time public key check function obtained when the terminal generates the one-time public key of the second account. The terminal that logs into the second account can check whether the receiving address of the transaction content is itself based on the parameters of the first one-time public key check function and its own long-term private key; and when consuming the transaction amount of the transaction, it can generate the one-time private key of the second account based on the parameters of the one-time private key generation function and the long-term private key, and then use the one-time private key to generate the signature of the transaction content, thereby protecting the anonymity of the second account as a payment account.

In addition, the credentials of the second account can be applied for by the terminal that logs into the first account when applying for the credentials of the first account, and the credentials for the second account at the same time; or the credentials of the second account can be applied for by the terminal that logs into the second account when consuming the transaction amount of the transaction, which is not limited in the embodiment of the present invention.

In addition, compared with FIG. 3D , in the transaction processing system shown in FIG. 3C , the transaction processing method has more steps of interacting with the management device to generate credentials of the first account and/or the second account.

608. The transaction processing device verifies the transaction request message and obtains a first verification result. When the first verification result is passed, the transaction content is simulated and the transaction result information is obtained.

Among them, the transaction processing device may include at least one endorsement node. When each endorsement node verifies that the transaction request message is passed, it can simulate the transaction content, obtain the transaction result, and use its own private key to sign the transaction result. Therefore, the transaction result information includes the transaction result of at least one endorsement node and the corresponding signature.

609. The transaction processing device returns a transaction response message to the terminal, and the transaction response message carries the transaction result information;

610. The terminal sends a transaction record message to the transaction processing device; the transaction record carried in the transaction record message includes transaction content, signature information of the transaction content, transaction result of at least one endorsement node, and corresponding signature;

611. The transaction processing device receives the transaction record message, verifies the transaction record, obtains a second verification result, and stores the transaction record on the blockchain when the second verification result is passed.

In the embodiment of the present invention, as shown in FIG7, after the consensus node in the transaction processing device receives the transaction record message, it is also necessary to sort the transaction records received by other consensus nodes together according to the receiving time, generate a block including the transaction record of the first account, submit the transaction record in the form of a block to the submission node, and the submission node verifies the transaction record in the block, wherein the operation of the submission node to verify each transaction record is similar, so taking the transaction record initiated by the first account as an example, the second verification result includes the verification result of the signature information of the transaction content and the verification result of the signature information of the transaction result, wherein the verification result of the signature information of the transaction content is verified by the submission node according to the public key of the management device, the one-time public key of the second account, the public key of the CA device, and the verification parameters in the signature information. In addition, the second verification result also includes the verification result of whether the transaction result information meets the preset conditions, that is, the submission node also needs to verify whether the transaction result and the corresponding signature of at least one endorsement node meet the preset conditions, for example, the preset condition is that there must be at least ten signatures and corresponding transaction results of endorsement nodes in each transaction record and the transaction results corresponding to each signature are consistent.

The reason why the endorsement node runs the transaction content is called a simulation because the transaction results of multiple endorsement nodes are verified to be consistent in the submission node. Only then is the transaction result accepted and can it be called the actual transaction result. Therefore, before the submission node, it can be called the transaction result obtained by simulating the operation of the transaction content, which also ensures the accuracy of the transaction content operation.

For example, suppose the transaction initiated by the first account has an input amount and an output amount. The plaintext of the input amount is _min and the ciphertext is Among them, r _in is the random number encrypted by the payer; the plain text of the output amount is m _out and the cipher text is Among them, r _out is the random number encrypted by the payer; the terminal that logs in to the first account Alice uses the long-term public key Y _Bob of the second account Bob to generate Bob's one-time public key and a random number (R _tx , R' _tx ); the certificate of the second account Bob is (F _Bob , w _Bob ); the one-time private key of the first account Alice is otsk _Alice , and the credential issued by the management device to Alice is (A _Alice , x _Alice ), then when the signature information of the transaction content is a zero-knowledge proof signature, the zero-knowledge proof proves that "the first account has a one-time private key and a credential issued by the management device for it, the second account has a certificate corresponding to the long-term public key, and the ciphertext of the difference between the input amount and the output amount is a ciphertext encrypted with a plaintext of 0" The expression of the signature is:

SoK{(otsk _Alice , A _Alice , x _Alice , C _in , r′, F _Bob , w _Bob , r _tx ):

Wherein, Tx1 is the transaction content to be signed, r′= _rin - _rout , _g1 , _g2 and h are system parameters.

Specifically, the terminal may calculate the signature of the zero-knowledge proof by including the following calculation process:

○ Randomly generate a, k, ρ, r _a , r _b , r _x , r _k , r _t1 , r _t2 , r _ω , r _τ , r _ρ , r _σ ∈Z _p

○ Calculation:

■

■

■T＝e(f，otsk _Alice ),

■

■

○ Calculate c=H(param, gpk, S, K, T, θ, R ₁ , R ₂ , R ₃ , Msg), where param is the system parameter, Msg is the transaction content (including C _out ), and H is the hash function.

○Calculation

■z _k = r _k + ck,

■ _za ＝ _ra +ca，

■ z _x = r _x + c x,

■z _b = r _b + c ax,

■z _rp = r _rp + cr′,

■ z _ω ＝ r _ω + c · w _Bob

■z _τ ＝r _τ +c/r _tx

■ _zρ ＝ _rρ +cρ

■ z _σ ＝ r _σ + cρw _Bob

○Signature = (S, K, T, θ, c, z _k , z _a , z _x , z _b , z _rp , z _ω , z _τ , z _ρ , z _σ )

Accordingly, the transaction processing device uses the public key of the management device Public key of the CA device The one-time public key Otpk _Bob of the second account and the system parameters verifying the signature of the zero-knowledge proof may include the following calculation process:

●

●

●

○ If c = H(param, gpk, S, K, T, θ, R ₁ , R ₂ , R ₃ , Msg), the verification passes.

If the verification is successful, it means that the content proved by the signature of the zero-knowledge proof is correct, that is, the first account has a one-time private key and a credential issued by the management device, the second account has a certificate corresponding to the long-term public key, and the ciphertext of the difference between the input amount and the output amount is a ciphertext encrypted with a plaintext of 0; in other words, the verification result of the signature indicates that the first account and the second account have the conditions to use the blockchain and the transaction is correct.

It can be seen that the embodiment of the present invention generates signature information of the transaction content based on the one-time private key of the first account, the credential, the certificate of the second account and the ciphertext of the difference between the input amount and the output amount, so that the verification party such as the transaction processing device uses the signature information to verify the access qualifications of the first account and the second account, and uses the one-time public key of the second account as the receiving address of the transaction content. Compared with the prior art in which the transaction processing device needs to use the public key of the first account to verify the signature of the transaction content generated by the private key of the first account, the public key of the second account to verify the hash value of the long-term public key of the second account, and the specific transaction amount is required to verify the accuracy of the transaction, the embodiment of the present invention protects the privacy of the first account, the second account and the transaction amount.

In some possible implementations, in the above embodiments, the transaction content may also include the ciphertext of each input amount and the ciphertext of each output amount, and the encryption key of the ciphertext of each input amount and the ciphertext of each output amount is the public key of the third-party audit account. For example, in Embodiment 3 or 4, the terminal obtains the ciphertext of each input amount and the ciphertext of each output amount, and the ciphertext of each input amount and the ciphertext of each output amount can be obtained by using the additive homomorphic encryption algorithm and the public key of the third-party audit account. In this way, while protecting the privacy of the transaction amount, it is also convenient for the auditor to use the private key of the third-party audit account to decrypt the ciphertext of each input amount and the ciphertext of each output amount, thereby obtaining the plaintext of each input amount and the plaintext of each output amount, so as to facilitate the auditor's audit.

Optionally, if in the above-mentioned embodiment three or four, when there is no need to cooperate with the audit of the auditor, the encryption key of the additive homomorphic encryption algorithm can be a random number, then the ciphertext of each input amount and the ciphertext of each output amount will not be able to be decrypted, thereby ensuring the correctness of the transaction while achieving the privacy protection of the transaction amount.

In some possible implementations, the transaction processing method described in the above embodiment may also include the terminal generating an identifier of each input amount based on the one-time private key of the first account; the identifier of each input amount is used to prevent the input amount from being consumed twice. For example, if a transaction record with the identifier T of the input amount already exists in the blockchain, when the transaction processing device verifies the transaction content and finds the identifier T of the input amount, it can be determined as a secondary consumption and the verification fails. It can be seen that this implementation method can use the identifier of each input amount to prevent the secondary consumption of the input amount.

Furthermore, the transaction processing method described in the implementation may also include: the terminal generates the fourth signature information of the transaction content according to the identification of each input amount; wherein the transaction request message and the transaction record also include the fourth signature information and the identification of each input amount; the identification of each input amount is used to prevent the input amount from being consumed twice; the first verification result and the second verification result also include the verification result of the fourth signature information, the verification result of the fourth signature information is obtained by the transaction processing device according to the identification of each input amount and the verification parameters in the fourth signature information, and the verification result of the fourth signature information is used to indicate whether the identification of each input amount is correct. It can be seen that if the identification of the input amount is incorrect, the verification result of the fourth signature information is also not passed, further avoiding the secondary consumption of the input amount.

Among them, the fourth signature information can be a zero-knowledge proof signature. The terminal can calculate the fourth signature information of the transaction content based on the identification of each input amount and the zero-knowledge proof algorithm. Correspondingly, the transaction processing device can also use the zero-knowledge proof algorithm to verify the fourth signature information in the transaction request message and the transaction record.

In some possible implementations, the transaction processing method described in the above embodiment may further include: the terminal encrypts the one-time public key of the first account according to the public key of the third-party review account to obtain the ciphertext of the one-time public key of the first account, and the transaction request message and transaction record also include the ciphertext of the one-time public key of the first account. In this way, when the auditor audits the account that initiates the transaction, the private key of the third-party review account can be used to decrypt and obtain the one-time public key of the first account. Furthermore, the long-term public key of the first account can be obtained based on the one-time public key, so that the auditor can audit the first account.

Furthermore, the transaction processing method in this implementation may also include: the terminal generates fifth signature information of the transaction content based on the ciphertext of the one-time public key of the first account; accordingly, the transaction request message and the transaction record also include the fifth signature information, the first verification result and the second verification result also include the verification result of the fifth signature information, the verification result of the fifth signature information is obtained by the transaction processing device through verification calculation based on the verification parameters in the fifth signature information, and the verification result of the fifth signature information is used to indicate whether the ciphertext of the one-time public key of the first account is correct.

Among them, the fifth signature information can be a zero-knowledge proof signature. The terminal can calculate the fifth signature information of the transaction content based on the identification of each input amount and the zero-knowledge proof algorithm. Correspondingly, the transaction processing device can also use the zero-knowledge proof algorithm to verify the transaction request message and the fifth signature information in the transaction record.

In some possible implementations, the transaction processing method described in the above embodiment may also include: the terminal encrypts the long-term public key of the second account according to the public key of the third-party audit account to obtain the ciphertext of the long-term public key of the second account; accordingly, the transaction request message and the transaction record also include the ciphertext of the long-term public key. In this way, the auditor with the third-party audit account can use his own private key to decrypt the ciphertext of the long-term public key and obtain the long-term public key of the second account, thereby obtaining the identity information of the second account, which is convenient for the auditor's audit.

Furthermore, the transaction processing method in this implementation may also include: the terminal generates the sixth signature information of the transaction content based on the ciphertext of the long-term public key of the second account; accordingly, the transaction request message and the transaction record also include the sixth signature information; the first verification result and the second verification result also include the verification result of the sixth signature information, and the verification result of the sixth signature information is obtained by the transaction processing device through verification calculation based on the verification parameters in the sixth signature information, and the verification result of the sixth signature information is used to indicate whether the ciphertext of the long-term public key of the second account is correct.

Among them, the sixth signature information can be a zero-knowledge proof signature. The terminal can calculate the sixth signature information of the transaction content based on the identification of each input amount and the zero-knowledge proof algorithm. Correspondingly, the transaction processing device can also use the zero-knowledge proof algorithm to verify the sixth signature information in the transaction request message and the transaction record.

The above various optional embodiments and optional implementation methods respectively describe how to protect the privacy of the first account, how to protect the privacy of the second account, how to protect the privacy of the transaction amount in the transaction content, and how to cooperate with the auditor's audit in the transaction processing method provided by the embodiment of the present invention from the perspective of the interaction between the terminal for logging into the first account, the transaction processing device, the management device, and the certificate issuing device. It can be understood that in order to perform the above functions, the transaction processing device, the management device, and the certificate issuing device may include corresponding hardware results and/software modules. For example, the transaction processing device may include at least one endorsement node, a consensus node, and a submission node, etc. The endorsement node may also perform the function of the management device to generate credentials, and the management device and the certificate issuing device may also perform the corresponding functions by the same device. In short, it should be easy for those skilled in the art to realize that, in combination with the steps or units described in the embodiments or implementation methods disclosed herein, the present invention can be implemented in the form of hardware or a combination of security inspection and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

Please refer to Figure 9, which is a structural diagram of a terminal provided in an embodiment of the present invention. The terminal includes a processor 901, a memory 902 and a communication interface 903. The memory 902 is used to store program instructions, and the processor 901 is used to call the program instructions to perform the following operations.

The processor 901 is configured to generate first signature information of transaction content according to a credential of a first account, wherein the transaction content is initiated by the terminal based on the first account, and the credential is generated for the first account by a transaction processing device that processes the transaction content;

The communication interface 903 is used to send a transaction request message to the transaction processing device, where the transaction request message includes the first signature information and the transaction content;

The communication interface 903 is further used to receive a transaction response message returned by the transaction processing device, wherein the transaction response message includes transaction result information generated by the transaction processing device according to the transaction content;

The communicator 903 is also used to send a transaction record message to the transaction processing device according to the transaction response message, and the transaction record message is used to instruct the transaction processing device to store the transaction record on the blockchain, and the transaction record includes the transaction content, the first signature information and the transaction result information.

The processor generates first signature information of the transaction content according to the credentials of the first account, specifically:

The long-term private key/one-time private key of the first account, the credentials of the first account and the transaction content are used as inputs of the zero-knowledge proof algorithm to calculate the first signature information of the transaction content.

The transaction response message is returned when the transaction processing device verifies that the first verification result obtained by the transaction processing device for the transaction request message is passed; the transaction record is stored when the transaction processing device verifies that the second verification result obtained by the transaction processing device for the transaction record message is passed;

Wherein, both the first verification result and the second verification result include the verification result of the first signature information;

The verification result of the first signature information is obtained by the transaction processing device performing verification calculation based on its own public key and the verification parameters in the first signature information.

The transaction content is initiated by the terminal for the second account based on the first account, and the processor 901 is further configured to generate a one-time public key of the second account according to the long-term public key of the second account;

The processor 901 is further configured to generate second signature information of the transaction content according to the one-time public key of the second account and the certificate of the second account;

The certificate is generated according to the private key of the certificate issuing device; the transaction request message and the transaction record include the one-time public key of the second account and the second signature information, and the one-time public key of the second account is the address of the second account;

Among them, the first verification result and the second verification result also include the verification result of the second signature information, and the verification result of the second signature information is obtained by the transaction processing device based on the one-time public key of the second account, the public key of the certificate issuing device and the verification parameters in the second signature information.

In one possible implementation,

The processor 901 is further configured to calculate the ciphertext of the difference between the total input amount and the total output amount according to the ciphertext of each input amount and the ciphertext of each output amount in the transaction content;

The processor 901 is further configured to generate third signature information of the transaction content according to the ciphertext of the difference;

Wherein, the transaction request message and the transaction record also include the third signature information;

The first verification result and the second verification result also include the verification result of the third signature information. The verification result of the third signature information is obtained by the transaction processing device through verification calculation based on the verification parameters in the third signature information, the ciphertext of each input amount and the ciphertext of each output amount. The verification result of the third signature information is used to indicate whether the total input amount is equal to the total output amount.

In a possible implementation, the encryption key of the ciphertext of each input amount and the ciphertext of each output amount is the public key of the third-party audit account.

In a possible implementation, the processor is further configured to generate an identifier of each input amount according to the one-time private key of the first account;

The processor is further configured to generate fourth signature information of the transaction content according to the identifiers of the input amounts;

The transaction request message and the transaction record further include the fourth signature information and the identifiers of the input amounts;

The identifier of each input amount is used to prevent the input amount from being consumed twice;

The first verification result and the second verification result also include the verification result of the fourth signature information. The verification result of the fourth signature information is obtained by the transaction processing device through verification calculation based on the identification of each input amount and the verification parameters in the fourth signature information. The verification result of the fourth signature information is used to indicate whether the identification of each input amount is correct.

In a possible implementation, the processor 901 is further configured to encrypt the one-time public key of the first account according to the public key of the third-party review account to obtain a ciphertext of the one-time public key of the first account;

The processor 901 is further configured to generate fifth signature information of the transaction content according to the ciphertext of the one-time public key of the first account;

The transaction request message and the transaction record further include the fifth signature information and a ciphertext of the one-time public key of the first account;

The first verification result and the second verification result also include the verification result of the fifth signature information. The verification result of the fifth signature information is obtained by the transaction processing device performing verification calculation based on the verification parameters in the fifth signature information. The verification result of the fifth signature information is used to indicate whether the ciphertext of the one-time public key of the first account is correct.

In a possible implementation, the processor 901 is further configured to encrypt the long-term public key of the second account according to the public key of the third-party review account to obtain a ciphertext of the long-term public key of the second account;

The processor 901 is further configured to generate sixth signature information of the transaction content according to the ciphertext of the long-term public key of the second account;

The transaction request message and the transaction record further include the sixth signature information and the ciphertext of the long-term public key of the second account;

The first verification result and the second verification result also include the verification result of the sixth signature information. The verification result of the sixth signature information is obtained by the transaction processing device performing verification calculation based on the verification parameters in the sixth signature information. The verification result of the sixth signature information is used to indicate whether the ciphertext of the long-term public key of the second account is correct.

In a possible implementation, the communication interface 903 is further used to send a credential request message to the transaction processing device, wherein the credential request message includes the one-time public key of the first account and/or the ciphertext of the transaction amount of the first account;

The communication interface 903 is also used to receive a credential response message returned by the transaction processing device, wherein the credential response message includes the credentials of the first account, and the credentials of the first account are generated by the transaction processing device based on the one-time public key of the first account and/or the ciphertext of the transaction amount of the first account.

In one possible implementation, the credential request message also includes the one-time public key of the second account and/or the ciphertext of the transaction amount of the second account; the credential response message also includes the credentials of the second account; the credentials of the second account are generated by the transaction processing device based on the one-time public key of the first account and/or the ciphertext of the transaction amount of the first account; the transaction request message and the transaction record also include the credentials of the second account.

Please refer to FIG. 10 , which is a schematic diagram of the structure of a transaction processing device provided by an embodiment of the present invention. As shown in FIG. 10 , the transaction processing device may include at least one endorsement module 1001, a consensus module 1002, and a submission module 1003;

The at least one endorsement module 1001 is configured to receive a transaction request message sent by a terminal, wherein the transaction request message includes first signature information of a transaction content, and the transaction content is initiated by a first account;

The at least one endorsement module 1001 is further used to verify the transaction request message to obtain a first verification result, and when the first verification result is passed, simulate the transaction content to obtain transaction result information, and return a transaction response message carrying the transaction result information to the terminal;

The consensus module 1002 is used to receive the transaction record message sent by the terminal according to the at least one transaction response message, and sort the transaction record carried by the transaction record message and the transaction records received from other terminals according to the receiving time, generate a block including the transaction record, and submit the block to the submission module;

The submission module 1003 is used to receive the block, verify the transaction record in the block, obtain a second verification result, and when the second verification result is passed, store the transaction record in the form of the block on the blockchain;

The first verification result and the second verification result both include a verification result of the first signature information, the verification result of the first signature information is obtained by the transaction processing device according to the public key verification of the authorization endorsement module 10011 in the endorsement module, and is used to indicate whether the first account has the conditions for storing the transaction record on the blockchain;

The authorization endorsement module is used to generate the credentials of the first account according to its own private key, and the credentials of the first account are used to generate the first signature information.

Please refer to FIG. 11 , which is a schematic diagram of the structure of another transaction processing device provided by an embodiment of the present invention. As shown in FIG. 11 , the transaction processing device includes at least one endorsement module 1101, a consensus module 1102, a submission module 1103, and a management module 1104;

The at least one endorsement module 1101 is configured to receive a transaction request message sent by a terminal, wherein the transaction request message includes first signature information of a transaction content, and the transaction content is initiated by a first account;

The at least one endorsement module 1101 is further configured to verify the transaction request message to obtain a first verification result, and when the first verification result is passed, simulate the transaction content to obtain transaction result information, and return a transaction response message carrying the transaction result information to the terminal;

The consensus module 1102 is configured to receive a transaction record message sent by the terminal according to the at least one transaction response message, and sort the transaction record carried by the transaction record message and the transaction records received from other terminals according to the receiving time, generate a block including the transaction record, and submit the block to the submission module;

The submission module 1103 is used to receive the block, verify the transaction record in the block, obtain a second verification result, and when the second verification result is passed, store the transaction record in the form of the block on the blockchain;

The first verification result and the second verification result both include a verification result of the first signature information, the verification result of the first signature information is obtained by the transaction processing device according to the public key verification of the management module, and is used to indicate whether the first account has the conditions for storing the transaction record on the blockchain;

The management module 1104 is used to generate the credentials of the first account according to its own private key, and the credentials of the first account are used to generate the first signature information.

In addition, in the embodiment of the present invention, the transaction processing device described in Figures 10 and 11 can also call relevant modules to execute the processing process of the transaction processing device involved in Figures 4 to 7 and/or other processes used for the technology described in this application. For example, the management module or the authorization endorsement module in the transaction processing device executes relevant steps to generate credentials for the first account, etc.; at least one endorsement module and submission module verify the transaction request message and the relevant content in the transaction record, etc.

Please refer to Figure 12, which is a schematic diagram of the structure of a terminal provided by an embodiment of the present invention. The terminal shown in Figure 12 may be the terminal in Figures 3A-3D, 4 to 8, and the terminal may include a processor, a memory, a control circuit, an antenna, and an input-output device. The processor is mainly used to process the communication protocol and the communication data, and to control the entire terminal device, execute the software program, and process the data of the software program, such as to support the terminal device to perform the actions described in the above-mentioned transmission precoding matrix indication method embodiment. The memory is mainly used to store software programs and data, such as storing the credentials of the first account described in the above-mentioned embodiment, the long-term private key or the one-time private key of the first account, etc. The control circuit is mainly used for the conversion of the baseband signal and the radio frequency signal and the processing of the radio frequency signal. The control circuit and the antenna together can also be called a transceiver, which is mainly used to send and receive radio frequency signals in the form of electromagnetic waves. Input-output devices, such as touch screens, display screens, keyboards, etc., are mainly used to receive data input by users and output data to users.

When the terminal is turned on, the processor can read the software program in the storage unit, interpret and execute the instructions of the software program, and process the data of the software program. When data needs to be sent wirelessly, the processor performs baseband processing on the data to be sent, and outputs the baseband signal to the RF circuit. The RF circuit performs RF processing on the baseband signal and then sends the RF signal outward in the form of electromagnetic waves through the antenna. When data is sent to the terminal device, the RF circuit receives the RF signal through the antenna, converts the RF signal into a baseband signal, and outputs the baseband signal to the processor. The processor converts the baseband signal into data and processes the data.

Those skilled in the art will appreciate that, for ease of explanation, FIG. 12 shows only one memory and processor. In an actual terminal device, there may be multiple processors and memories. The memory may also be referred to as a storage medium or a storage device, etc., which is not limited in the embodiment of the present invention.

As an optional implementation, the processor may include a baseband processor and a central processor, the baseband processor is mainly used to process the communication protocol and communication data, and the central processor is mainly used to control the entire terminal device, execute the software program, and process the data of the software program. The processor in Figure 12 integrates the functions of the baseband processor and the central processor. Those skilled in the art will understand that the baseband processor and the central processor may also be independent processors, interconnected by technologies such as buses. Those skilled in the art will understand that the terminal device may include multiple baseband processors to adapt to different network formats, the terminal device may include multiple central processors to enhance its processing capabilities, and the various components of the terminal device may be connected through various buses. The baseband processor may also be described as a baseband processing circuit or a baseband processing chip. The central processor may also be described as a central processing circuit or a central processing chip. The function of processing the communication protocol and communication data may be built into the processor, or may be stored in the storage unit in the form of a software program, and the processor executes the software program to implement the baseband processing function.

Exemplarily, in an embodiment of the invention, an antenna with a transceiver function and a control circuit may be regarded as a transceiver unit 1201 of a terminal, and a processor with a processing function may be regarded as a processing unit 1202 of a terminal. As shown in FIG12 , the terminal includes a transceiver unit 1201 and a processing unit 1202. A transceiver unit may also be referred to as a transceiver, a transceiver, a transceiver device, etc. Optionally, a device for implementing a receiving function in the transceiver unit 1201 may be regarded as a receiving unit, and a device for implementing a transmitting function in the transceiver unit 1201 may be regarded as a transmitting unit, that is, the transceiver unit 1201 includes a receiving unit and a transmitting unit. Exemplarily, a receiving unit may also be referred to as a receiver, a receiver, a receiving circuit, etc., and a transmitting unit may be referred to as a transmitter, a transmitter, or a transmitting circuit, etc.

In an embodiment of the present invention, the transaction processing device may include a communication unit and a processing unit. The processing unit and the communication unit may be combined to perform the relevant operations performed by the transaction processing device in the above embodiment, or perform the relevant functions of at least one endorsement node, consensus node, and submission node, or may also perform the relevant functions of a management device, a certificate issuing device, etc.

Optionally, please refer to FIG. 13, which is a schematic diagram of the structure of a transaction processing device provided in an embodiment of the present invention, and the transaction processing device may include a processor 1301 and a memory 1302. The memory 1302 is used to store instructions, and the processor 1301 is used to execute the instructions stored in the memory 1302 to implement the steps and embodiments in the methods corresponding to FIGS. 4 to 8 above.

Furthermore, the transaction processing device may further include an input port 1304 and an output port 1305. Furthermore, the device may further include a bus system 1303, wherein the processor 1301, the memory 1302, and the communication interface 1304 may be connected via the bus system 1303.

The processor 1301 is used to execute the instructions stored in the memory 1302 to control the communication interface 1304 to receive signals and control the communication interface 1304 to send signals to complete the steps of the terminal in the above method. Among them, the communication interface 1304 can be the same or different physical entities. When they are the same physical entities, they can be collectively referred to as transceivers. The memory 1302 can be integrated in the processor 1301, or it can be set separately from the processor 1301.

As an implementation, the function of the communication interface 1304 may be implemented by a transceiver circuit or a dedicated transceiver chip. The processor 1301 may be implemented by a dedicated processing chip, a processing circuit, a processor or a general-purpose chip.

As another implementation method, it is possible to use a general-purpose computer to implement the terminal provided in the embodiment of the present application. That is, the program code that implements the functions of the processor 1301 and the communication interface 1304 is stored in the memory, and the general-purpose processor implements the functions of the processor 1301 and the communication interface 1304 by executing the code in the memory.

For the concepts, explanations, detailed descriptions and other steps involved in the device and related to the technical solutions provided in the embodiments of the present application, please refer to the descriptions of these contents in the aforementioned methods or other embodiments, which will not be repeated here.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Solid State Disk (SSD)), etc.

The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art who is familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims (34)

1. A transaction processing method, comprising:

the terminal generates first signature information of transaction content according to credentials of a first account, wherein the transaction content is initiated by the terminal based on the first account; the credentials are generated for the first account number by a transaction processing device that processes the transaction content;

the terminal sends a transaction request message to the transaction processing equipment, wherein the transaction request message comprises the first signature information and the transaction content;

the terminal receives a transaction response message returned by the transaction processing equipment, wherein the transaction response message comprises transaction result information generated by the transaction processing equipment according to the transaction content;

the terminal sends a transaction record message to the transaction processing equipment according to the transaction response message, wherein the transaction record message is used for indicating the transaction processing equipment to store a transaction record carried by the transaction record message on a blockchain, the blockchain is a distributed database for storing the transaction record in the transaction processing equipment, and the transaction record comprises the transaction content, the first signature information and the transaction result information.

2. The method of claim 1, wherein the terminal generates the first signature information of the transaction content from the credentials of the first account number, comprising:

the terminal takes a private key of a first account, credentials of the first account and transaction content as inputs of a zero knowledge proof algorithm, and calculates first signature information of the transaction content, wherein the private key comprises a long-term private key or a disposable private key.

3. The method of claim 2, wherein the transaction response message is returned when a first verification result obtained by the transaction processing device verifying the transaction request message is passed; the transaction record is stored when a second verification result obtained by the transaction processing device for verifying the transaction record message is passed;

wherein the first verification result and the second verification result both comprise verification results of the first signature information;

the verification result of the first signature information is obtained by the transaction processing equipment through verification calculation according to the public key of the transaction processing equipment and verification parameters in the first signature information.

4. A method according to claim 3, wherein the transaction content is initiated by the terminal for a second account based on the first account, the method further comprising:

The terminal generates a disposable public key of the second account according to the long-term public key of the second account;

the terminal generates second signature information of the transaction content according to the one-time public key of the second account and the certificate of the second account;

wherein the certificate is generated from a private key of a certificate issuing device; the transaction request message and the transaction record comprise a disposable public key of the second account and the second signature information, wherein the disposable public key of the second account is an address of the second account;

the first verification result and the second verification result further comprise verification results of the second signature information, and the verification results of the second signature information are obtained by verification calculation of the transaction processing equipment according to the one-time public key of the second account, the public key of the certificate issuing equipment and verification parameters in the second signature information.

5. The method according to claim 4, wherein the method further comprises:

the terminal calculates the ciphertext of the difference between the total input amount and the total output amount according to the ciphertext of each input amount and the ciphertext of each output amount in the transaction content;

The terminal generates third signature information of the transaction content according to the ciphertext of the difference value;

wherein the transaction request message and the transaction record further comprise the third signature information;

the first verification result and the second verification result further comprise verification results of the third signature information, the verification results of the third signature information are obtained by the transaction processing device through verification calculation according to verification parameters in the third signature information, ciphertext of each input amount and ciphertext of each output amount, and the verification results of the third signature information are used for indicating whether the total input amount is equal to the total output amount.

6. The method of claim 5, wherein the step of determining the position of the probe is performed,

and the encryption key of the ciphertext of each input amount is the public key of the third party audit account.

7. The method of claim 6, wherein the method further comprises:

the terminal generates an identifier of each input amount according to the one-time private key of the first account;

the terminal generates fourth signature information of the transaction content according to the identification of each input amount;

Wherein the transaction request message and the transaction record further comprise the fourth signature information and the identification of each input amount;

the identification of each input amount is used for preventing each input amount from being consumed for a second time;

the first verification result and the second verification result further comprise verification results of the fourth signature information, the verification results of the fourth signature information are obtained by verification calculation of the transaction processing equipment according to the identification of each input amount and verification parameters in the fourth signature information, and the verification results of the fourth signature information are used for indicating whether the identification of each input amount is correct or not.

8. The method of claim 6, wherein the method further comprises:

the terminal encrypts the disposable public key of the first account according to the public key of the third party audit account to obtain a ciphertext of the disposable public key of the first account;

the terminal generates fifth signature information of the transaction content according to the ciphertext of the disposable public key of the first account;

the transaction request message and the transaction record further comprise the fifth signature information and ciphertext of the disposable public key of the first account;

The first verification result and the second verification result further comprise verification results of the fifth signature information, the verification results of the fifth signature information are obtained by verification calculation of the transaction processing equipment according to verification parameters in the fifth signature information, and the verification results of the fifth signature information are used for indicating whether ciphertext of the disposable public key of the first account is correct or not.

9. The method of claim 6, wherein the method further comprises:

the terminal encrypts the long-term public key of the second account according to the public key of the third party audit account to obtain a ciphertext of the long-term public key of the second account;

the terminal generates sixth signature information of the transaction content according to the ciphertext of the long-term public key of the second account;

wherein the transaction request message and the transaction record further comprise the sixth signature information and ciphertext of the long-term public key of the second account;

the first verification result and the second verification result further comprise verification results of the sixth signature information, the verification results of the sixth signature information are obtained by the transaction processing device through verification calculation according to verification parameters in the sixth signature information, and the verification results of the sixth signature information are used for indicating whether ciphertext of the long-term public key of the second account is correct or not.

10. The method of claim 6, wherein the method further comprises:

the terminal sends a credential request message to the transaction processing equipment, wherein the credential request message comprises the one-time public key of the first account and/or ciphertext of transaction amount possessed by the first account;

the terminal receives a credential response message returned by the transaction processing device, wherein the credential response message comprises the credential of the first account, and the credential of the first account is generated by the transaction processing device according to the one-time public key of the first account and/or ciphertext of transaction amount possessed by the first account.

11. The method according to claim 10, wherein the credential request message further comprises a cryptogram of the transaction amount possessed by the one-time public key of the second account and/or the second account; the credential response message further comprises a credential of the second account; the credentials of the second account are generated by the transaction processing device according to the one-time public key of the first account and/or ciphertext of the transaction amount possessed by the first account; the transaction request message and the transaction record also comprise credentials of the second account.

12. A transaction processing method, comprising:

the method comprises the steps that transaction processing equipment receives a transaction request message sent by a terminal, wherein the transaction request message comprises transaction content and first signature information, the transaction content is initiated by the terminal based on a first account, and the first signature information is generated by the terminal according to credentials of the first account;

the transaction processing equipment returns a transaction response message to the terminal according to the transaction request message, wherein the transaction response message comprises transaction result information generated by the transaction processing equipment according to the transaction content;

the transaction processing equipment receives a transaction record message sent by the terminal according to the transaction response message;

the transaction processing equipment stores the transaction record carried in the transaction record message on a blockchain, wherein the blockchain is a distributed database for storing the transaction record in the transaction processing party, and the transaction record comprises the transaction content, the first signature information and the transaction result information.

13. The method of claim 12, wherein the step of determining the position of the probe is performed,

before the transaction processing device returns a transaction response message to the terminal according to the transaction request message, the method further comprises:

The transaction processing equipment verifies the transaction request message to obtain a first verification result;

when the first verification result is passed, the transaction processing equipment operates the transaction content to obtain transaction result information;

the method further comprises the steps of:

the transaction processing equipment verifies the transaction record message to obtain a second verification result;

when the second verification result is passed, the transaction processing device performs the step of storing the transaction record carried by the transaction record message on a blockchain.

14. The method of claim 13, wherein the first verification result and the second verification result each include a verification result of the first signature information;

the verification result of the first signature information is obtained by the transaction processing device through verification calculation by using the public key of the transaction processing device and verification parameters in the first signature information.

15. The method of claim 13 or 14, wherein the first account is transaction content initiated for a second account,

the transaction request message and the transaction record also comprise second signature information and a disposable public key of a second account;

The one-time public key of the second account is the address of the second account;

the first verification result and the second verification result further comprise verification results of the second signature information, and the verification results of the second signature information are obtained by verification calculation of the transaction processing equipment according to the disposable public key of the second account, the public key of the certificate issuing equipment and verification parameters in the second signature information.

16. The method of claim 15, wherein the step of determining the position of the probe is performed,

the transaction request message and the transaction record also comprise third signature information, ciphertext of each input amount and ciphertext of each output amount;

the first verification result and the second verification result further comprise verification results of the third signature information, the verification results of the third signature information are obtained by the transaction processing device through verification calculation according to verification parameters in the third signature information, ciphertext of each input amount and ciphertext of each output amount, and the verification results of the third signature information are used for indicating whether the total input amount in the transaction record is equal to the total output amount.

17. The method of claim 16, wherein the step of determining the position of the probe comprises,

And the encryption key of the ciphertext of each input amount is the public key of the third party audit account.

18. The method of claim 17, wherein the step of determining the position of the probe is performed,

the transaction request message and the transaction record also comprise fourth signature information and identifiers of the input amounts;

the first verification result and the second verification result further comprise verification results of the fourth signature information, the verification results of the fourth signature information are obtained by verification calculation of the transaction processing equipment according to the identification of each input amount and verification parameters in the fourth signature information, and the verification results of the fourth signature information are used for indicating whether the identification of each input amount is correct or not;

the identification of each of the input amounts is used to prevent secondary spending of each of the input amounts.

19. The method according to any one of claims 13 to 18, wherein,

the transaction request message and the transaction record also comprise fifth signature information and ciphertext of a disposable public key of the first account;

the first verification result and the second verification result further comprise verification results of the fifth signature information, the verification results of the fifth signature information are obtained by verification calculation of the transaction processing equipment according to verification parameters in the fifth signature information, and the verification results of the fifth signature information are used for indicating whether ciphertext of the disposable public key of the first account is correct or not;

And the encryption key of the ciphertext of the disposable public key of the first account is the public key of a third party audit account.

20. The method according to any one of claims 17 to 18, wherein,

the transaction request message and the transaction record also comprise sixth signature information and ciphertext of a long-term public key of the second account;

the first verification result and the second verification result further comprise verification results of the sixth signature information, the verification results of the sixth signature information are obtained by verification calculation of the transaction processing equipment according to verification parameters in the sixth signature information, and the verification results of the sixth signature information are used for indicating whether ciphertext of the long-term public key of the second account is correct or not;

and the encryption key of the ciphertext of the long-term public key of the second account is the public key of the third party audit account.

21. The method of claim 20, wherein the method further comprises:

the transaction processing equipment receives a credential request message sent by the terminal, wherein the credential request message comprises the one-time public key of the first account and/or ciphertext of transaction amount possessed by the first account;

The transaction processing equipment generates a credential of the first account according to the credential request message;

the transaction processing equipment sends a credential response message to the terminal, wherein the credential response message carries the credential of the first account.

22. The method of claim 21, wherein the credential request message further includes a cryptogram of a transaction amount possessed by the one-time public key of the second account and/or the second account; the credential response message further comprises a credential of the second account; the transaction request message and the transaction record further comprise the evidence of the second account, wherein the evidence of the second account is generated by the transaction processing equipment according to the one-time public key of the second account and/or ciphertext of the transaction amount possessed by the second account.

23. A transaction processing device, characterized in that the transaction processing device comprises at least one endorsement module, a consensus module, a submission module and a management module;

the at least one endorsement module is used for receiving a transaction request message sent by a terminal, wherein the transaction request message comprises transaction content and first signature information, the transaction content is initiated by the terminal based on a first account, and the first signature information is generated by the terminal according to the credentials of the first account;

The at least one endorsement module is further used for returning a transaction response message to the terminal according to the transaction request message, wherein the transaction response message comprises transaction result information generated by the transaction processing equipment according to the transaction content;

the consensus module is used for receiving a transaction record message sent by the terminal according to the at least one transaction response message, sequencing transaction records carried by the transaction record message and transaction records received from other terminals according to the receiving time, generating a block comprising the transaction records, and submitting the block to the submitting module;

the submitting module is used for receiving the block and storing the transaction record to a block chain in the form of the block;

the management module is used for generating the credentials of the first account according to the private key of the management module and the disposable public key of the first account and/or the ciphertext of the transaction amount.

24. A terminal, characterized in that the terminal comprises a processor and a communication interface,

the processor is used for generating first signature information of transaction content according to a credential of a first account, wherein the transaction content is initiated by the terminal based on the first account, and the credential is generated for the first account by transaction processing equipment for processing the transaction content;

The communication interface is used for sending a transaction request message to the transaction processing equipment, wherein the transaction request message comprises the first signature information and the transaction content;

the communication interface is further used for receiving a transaction response message returned by the transaction processing equipment, wherein the transaction response message comprises transaction result information generated by the transaction processing equipment according to the transaction content;

the communication interface is further configured to send a transaction record message to the transaction processing device according to the transaction response message, where the transaction record message is configured to instruct the transaction processing device to store the transaction record on a blockchain, and the transaction record includes the transaction content, the first signature information, and the transaction result information.

25. The terminal of claim 24, wherein the processor generates the first signature information of the transaction content according to the credentials of the first account number, specifically:

the method comprises the steps of taking a private key of a first account, credentials of the first account and transaction content as inputs of a zero knowledge proof algorithm, and calculating first signature information of the transaction content, wherein the private key comprises a long-term private key or a disposable private key.

26. The terminal according to claim 25, wherein the transaction response message is returned when a first verification result obtained by the transaction processing device verifying the transaction request message is passed; the transaction record is stored when a second verification result obtained by the transaction processing device for verifying the transaction record message is passed;

wherein the first verification result and the second verification result both comprise verification results of the first signature information;

the verification result of the first signature information is obtained by the transaction processing equipment through verification calculation according to the public key of the transaction processing equipment and verification parameters in the first signature information.

27. The terminal of claim 26, wherein the transaction content is initiated by the terminal for a second account based on the first account,

the processor is further configured to generate a one-time public key of the second account according to the long-term public key of the second account;

the processor is further configured to generate second signature information of the transaction content according to the one-time public key of the second account and the certificate of the second account;

wherein the certificate is generated from a private key of a certificate issuing device; the transaction request message and the transaction record comprise a disposable public key of the second account and the second signature information, wherein the disposable public key of the second account is an address of the second account;

The first verification result and the second verification result further comprise verification results of the second signature information, and the verification results of the second signature information are obtained by the transaction processing device through verification according to the one-time public key of the second account, the public key of the certificate issuing device and verification parameters in the second signature information.

28. The terminal of claim 27, wherein the terminal comprises a base station,

the processor is also used for calculating the ciphertext of the difference between the total input amount and the total output amount according to the ciphertext of each input amount and the ciphertext of each output amount in the transaction content;

the processor is further used for generating third signature information of the transaction content according to the ciphertext of the difference value;

wherein the transaction request message and the transaction record further comprise the third signature information;

the first verification result and the second verification result further comprise verification results of the third signature information, the verification results of the third signature information are obtained by the transaction processing device through verification calculation according to verification parameters in the third signature information, ciphertext of each input amount and ciphertext of each output amount, and the verification results of the third signature information are used for indicating whether the total input amount is equal to the total output amount.

29. The terminal of claim 28, wherein the terminal comprises a base station,

and the encryption key of the ciphertext of each input amount is the public key of the third party audit account.

30. The terminal of claim 29, wherein the terminal further comprises:

the processor is further configured to generate an identifier of each input amount according to the one-time private key of the first account;

the processor is further used for generating fourth signature information of the transaction content according to the identification of each input amount;

wherein the transaction request message and the transaction record further comprise the fourth signature information and the identification of each input amount;

the identification of each input amount is used for preventing each input amount from being consumed for a second time;

the first verification result and the second verification result further comprise verification results of the fourth signature information, the verification results of the fourth signature information are obtained by verification calculation of the transaction processing equipment according to the identification of each input amount and verification parameters in the fourth signature information, and the verification results of the fourth signature information are used for indicating whether the identification of each input amount is correct or not.

31. The terminal of claim 30, wherein the terminal comprises a base station,

the processor is further configured to encrypt the one-time public key of the first account according to a public key of the third party audit account, and obtain a ciphertext of the one-time public key of the first account;

the processor is further configured to generate fifth signature information of the transaction content according to the ciphertext of the one-time public key of the first account;

the transaction request message and the transaction record further comprise the fifth signature information and ciphertext of the disposable public key of the first account;

the first verification result and the second verification result further comprise verification results of the fifth signature information, the verification results of the fifth signature information are obtained by verification calculation of the transaction processing equipment according to verification parameters in the fifth signature information, and the verification results of the fifth signature information are used for indicating whether ciphertext of the disposable public key of the first account is correct or not.

32. The terminal of claim 31, wherein the terminal comprises a base station,

the processor is further configured to encrypt the long-term public key of the second account according to a public key of the third party audit account, and obtain a ciphertext of the long-term public key of the second account;

The processor is further configured to generate sixth signature information of the transaction content according to ciphertext of the long-term public key of the second account;

wherein the transaction request message and the transaction record further comprise the sixth signature information and ciphertext of the long-term public key of the second account;

the first verification result and the second verification result further comprise verification results of the sixth signature information, the verification results of the sixth signature information are obtained by the transaction processing device through verification calculation according to verification parameters in the sixth signature information, and the verification results of the sixth signature information are used for indicating whether ciphertext of the long-term public key of the second account is correct or not.

33. The terminal according to any of the claims 29 to 32, characterized in that,

the communication interface is further configured to send a credential request message to the transaction processing device, where the credential request message includes the one-time public key of the first account and/or a ciphertext of a transaction amount possessed by the first account;

the communication interface is further configured to receive a credential response message returned by the transaction processing device, where the credential response message includes a credential of the first account, and the credential of the first account is generated by the transaction processing device according to the one-time public key of the first account and/or a ciphertext of a transaction amount possessed by the first account.

34. The terminal of claim 33, wherein the credential request message further includes a cryptogram of a transaction amount possessed by the one-time public key of the second account and/or the second account; the credential response message further comprises a credential of the second account; the credentials of the second account are generated by the transaction processing device according to the one-time public key of the first account and/or ciphertext of the transaction amount possessed by the first account; the transaction request message and the transaction record also comprise credentials of the second account.