System and method for information protection

ES 2 833 552 T3

DESCRIPTION

System and method for the protection of information

Technical field

This disclosure generally refers to methods and devices for the protection of information.

Background

Privacy is important for communications and data transfers between various users. Without protection, users are exposed to the risk of identity theft, illegal transfer, or other potential losses. The risk is even higher when communications and transfers are implemented online, due to free access to information online.

Document D1 (US2016 / 0358165) discloses systems and methods for encrypting a traded amount in a blockchain ledger, while preserving the ability to verify the transaction. A concealment amount is added to an input value and an output value is generated and encrypted. Both the input value and the output value are within a range of values, where the sum of any two values ​​within the range does not exceed an overflow threshold. The sum of the encrypted input value and the encrypted output value can equal zero. Range tests associated with each of the input and output values ​​are generated. Range tests demonstrate that the input value and the output value are within the range of values, and each range test can be associated with a different public key. Each public key can be signed with a ring signature based on a public key of a recipient in the transaction.

Summary

Aspects of the invention are set forth in the appended claims. Various embodiments of the present disclosure include non-transient computer-readable systems, methods, and media for the protection of information.

According to one aspect, a computer-implemented method for information protection comprises: committing a transaction amount t of a transaction with a commitment scheme to obtain a transaction commitment value T, the commitment scheme comprising at least one transaction hiding factor r_t; encrypting a combination of the transaction hiding factor r_t and the transaction amount t with a public key PK_B of a recipient of the transaction; transmitting the transaction commitment value T and the encrypted combination to a recipient node associated with the recipient for the recipient node to verify the transaction; receiving a receiver signature SIGB representing that the receiving node has approved the transaction by signing the transaction with a private key SK_B of the receiver; approving the transaction by signing the transaction with a private key SK_A of the issuer to generate a SIGA signature of the issuer; and present the transaction approved by the sender and receiver to one or more nodes in a blockchain network so that one or more nodes verify the transaction through consensus verification, the transaction approved by the sender and receiver comprising the encrypted combination, the transaction commitment value T, the sender's signature SIGA and the receiver's signature SIGB.

In some examples, the public key PK_B is an asymmetric encryption key.

In some examples, the commitment scheme comprises a Pedersen commitment based at least on the transaction concealment factor r_t and the amount t of the transaction being a committed value.

In some examples, the combination of the transaction concealment factor r_t and the transaction quantity t comprises a concatenation of the transaction concealment factor r_t and the transaction quantity t.

In some examples, transmitting the transaction commitment value T and the encrypted combination to the receiving node associated with the receiver for the receiving node to verify the transaction comprises transmitting the transaction commitment value T and the encrypted combination to the receiving node associated with the receiver, make the receiver node: decrypt the encrypted combination with a private key SK_B of the receiver to obtain the hiding factor of the transaction r_t and the amount t of the transaction; and verifying the transaction based on at least the transaction commitment value T, the transaction concealment factor r_t, and the transaction amount t.

In some examples, having the receiving node verify the transaction based on at least the transaction commit value T, the transaction concealment factor r_t, and the transaction amount t comprises making the receiving node: in response to determine that the transaction commitment value T does not match the commitment scheme of the transaction quantity t based on the transaction concealment factor r_t, reject the transaction; and in response to determining that the transaction commitment value T matches the commitment scheme of the transaction quantity t based on the transaction concealment factor r_t, approving the transaction by signing the transaction with the recipient's private key SK_B to generate the SIGB signature of the

ES 2 833 552 T3 receiver.

In some examples, before transmitting the encrypted join to the receiver node associated with the receiver, the method further comprises: commit a change and the transaction with the commit scheme to obtain a change commit value Y, comprising the commit scheme at least one concealment factor change r_y, where the change y is one or more assets of a transaction issuer that are used for the transaction minus the amount t of the transaction; and encrypting another combination of the change concealment factor r_y and the change y with a public key PK_A from the issuer.

In some examples, where presenting the sender and receiver approved transaction to one or more nodes in a blockchain network for the one or more nodes to verify the transaction through consensus verification comprises: Present the transaction comprising the encrypted combination, the other encrypted combination, the transaction commitment value T, the exchange commitment value Y, the sender's signature SIGA and the receiver's signature SIGB to the one or more nodes in the network of blockchain for the one or more nodes to verify the transaction.

In some examples, present the transaction comprising the encrypted combination, the other encrypted combination, the transaction commitment value T, the exchange commitment value Y, the sender's signature SIGA, and the receiver's signature SIGB to the one or more nodes in the blockchain network for the one or more nodes to verify the transaction comprises: Present the transaction comprising the encrypted combination, the other encrypted combination, the transaction commitment value T, the exchange commitment value Y, the sender's signature SIGA and the receiver's signature SIGB to the one or more nodes in the network of blockchain, which causes the one or more nodes, in response to successfully verify the transaction, issue the amount t of the transaction to the receiver, eliminate the one or more assets used for the transaction and issue the exchange and the issuer.

In accordance with another aspect provided in the appended claims, a non-transient computer-readable storage medium stores instructions to be executed by a processor to cause the processor to perform the method step operations of any of the above method examples.

According to another aspect provided in the appended claims, a system for the protection of the information comprises a processor and a non-transient, computer-readable storage medium coupled to the processor, the storage medium stores instructions to be executed by the processor to make Have the system perform the method step operations of any of the previous method examples.

In some embodiments, the recipient's public key PK_B and the recipient's private key SK_B are asymmetric encryption keys.

According to another aspect provided in the appended claims, a computer-implemented method for information protection comprises: obtaining a transaction amount t of a transaction, a transaction concealment factor r_t, and a commitment value T of transaction, in which: the amount t of the transaction is committed to a commitment scheme by an issuer node associated with an issuer of the transaction to obtain the transaction commitment value T, the commitment scheme comprising at least the transaction concealment factor r_t; decrypting the combination obtained with a private key SK_B of a receiver of the transaction to obtain the hiding factor of the transaction r_t and the amount t of the transaction; verifying the transaction based on the obtained transaction amount t, the obtained transaction concealment factor r_t and the obtained transaction commitment value T; in response to the successful verification of the transaction, approving the transaction by signing the transaction with the private key SK_B and transmitting to the sending node a SIGB signature of the receiver that represents that the receiving node has approved the transaction for the issuer to approve the transaction by signing the transaction with a private key SK_A of the issuer to generate a SIGA signature of the sender and present the transaction approved by the sender and receiver to one or more nodes in a blockchain network for the one or more nodes to verify the transaction through consensus verification, the transaction approved by the issuer and receiver comprising the combination obtained, the transaction commitment T value, the issuer's signature SIGA and the receiver's SIGB signature.

In accordance with another aspect provided in the appended claims, a non-transient computer-readable storage medium stores instructions to be executed by a processor to cause the processor to perform the method step operations of any of the above method examples.

According to another aspect provided in the appended claims, a system for the protection of the information comprises a processor and a non-transient, computer-readable storage medium coupled to the processor, the storage medium stores instructions to be executed by the processor to make Have the system perform the method step operations of any of the previous method examples.

Brief description of the drawings

Certain features of various embodiments of the present technology are set forth with particularity in the

ES 2 833 552 T3 appended claims. A better understanding of the features and advantages of the technology will be obtained by referring to the following detailed description setting forth illustrative embodiments, in which the principles of the invention are used, and the accompanying drawings of which:

Figure 1 shows an example system for information protection, according to various embodiments.

Figure 2 illustrates example steps for transaction initiation and verification, in accordance with various embodiments.

Figure 3A illustrates a flow chart of an example method for information protection, in accordance with various embodiments.

Figure 3B illustrates a flow chart of an exemplary method for information protection, in accordance with various embodiments.

Figure 4A illustrates a flow chart of an example method for information protection, in accordance with various embodiments.

Figure 4B illustrates a flow chart of an example method for information protection, in accordance with various embodiments.

Figure 5 illustrates a block diagram of an exemplary computer system in which any of the embodiments described herein can be implemented.

Detailed description

Blockchain can be thought of as a decentralized database, commonly known as a distributed ledger because the operation is performed by multiple nodes (for example, computing devices) on a network. Any information can be written to the blockchain chain and saved or read from it. Anyone can set up a server and join the blockchain network to become a node. Any node can provide computing power to maintain the blockchain chain by performing complex calculations, such as hash calculation to add a block to a current blockchain and the added block can contain various types of data or information. The node that provided the computing power for the added block can be rewarded with a unit of value (for example, a unit of digital currency). Since the blockchain does not have a central node, each node is the same and contains the entire blockchain database.

Nodes are, for example, computing devices or large computing systems that support the blockchain network and keep it running smoothly. There are two types of nodes, full nodes and lightweight nodes. Full nodes maintain a complete copy of the blockchain chain. Full nodes on the blockchain network validate the transactions and the blocks they receive and transmit them to connected peers to provide consensus verification of transactions. Light nodes, on the other hand, only download a fraction of the blockchain chain. For example, thin nodes are used for digital currency transactions. A thin node will communicate with a full node when it wants to do a transaction.

This property of decentralization can help prevent the emergence of a management center in a controlled position. For example, the bitcoin blockchain is maintained by the network of communication nodes of the bitcoin software in the execution area. This disclosure uses one or more blockchain or digital currencies, such as bitcoin and Ethereum, as examples. A person of ordinary skill in the art should appreciate that the technical solutions disclosed in the present disclosure can be used or applied to other types of blockchain and digital currencies. That is, instead of banks, institutions, or administrators in the traditional sense, there are multiple intermediaries in the form of computer servers running bitcoin software. These computer servers form a network connected via the Internet, in which anyone can potentially join the network. The transactions arranged by the network can be of one form: user A wants to send Z bitcoins to user B, in which the transactions are transmitted to the network using readily available software applications. Computer servers function as bitcoin servers that can be used to validate these financial transactions, add a record of them to your copy of the ledger, and then transmit these ledger additions to other servers on the network.

The maintenance of the blockchain chain is known as mining, and those who perform such maintenance are rewarded with newly created bitcoins and transaction fees as mentioned above. For example, nodes can determine whether transactions are valid based on a set of rules that the blockchain network has agreed to. Miners can be located on any continent and process payments by verifying that each transaction is valid and adding it to the blockchain. Such verification is achieved through the consensus provided by a plurality of miners and assumes that there is no systematic collusion. In the end, all the data will be consistent, because the calculation must meet certain requirements to

ES 2 833 552 T3 will be valid and all nodes will be synchronized to ensure that the blockchain chain is consistent. Therefore, the data can be stored consistently in a distributed system of blockchain nodes.

Through the mining process, transactions, such as asset transfers, are verified and added to a growing chain of blocks on a blockchain by network nodes. When traversing the entire blockchain, verification can include, for example, whether the paying party has access to the asset being transferred, whether the asset has been spent before, whether the amount of the transfer is correct, etc. For example, in a hypothetical transaction (for example, a bitcoin transaction under a UTXO model (unspent transaction output), an Ethereum coin transaction under an Account / Balance model) signed by an issuer, the proposed transaction can be transmitted to the blockchain network for mining. A miner must check if the transaction is eligible to be executed according to the blockchain history. If the issuer's portfolio balance has sufficient funds according to the existing blockchain history, the transaction is considered valid and can be added to the block. Once verified, asset transfers can be included in the next block to be added to the blockchain.

A block is very similar to a database record. Each time data is written a block is created. These blocks are linked and protected by cryptography to become interconnected networks. Each block is connected to the previous block, which is also the origin of the blockchain name. Each block generally contains the cryptographic hash of the previous block, the generation time, and the actual data. For example, each block contains two parts: a block header to record the characteristic value of the current block, and a body to record the actual data (for example, transaction data). The blockchain is linked via the block headings. Each block header can contain multiple feature values, such as version, previous block hash, root node (Merkle root), timestamp, difficulty target, and nonce. The previous block hash contains not only the address of the previous block, but also the hash of the data within the previous block, which makes blockchain immutable. The nonce is a number that, when included, produces a hash with a specified number of leading zero bits.

For mining, the hash of the contents of the new block is fetched by a node. The nonce (for example, random string) is added to the hash to get a new string. A hash is performed on the new string again. The final hash is then compared to the difficulty goal (for example, a level) and it is determined whether the final hash is actually less than the difficulty goal or not. If not, the nonce is changed and the process repeats again. If so, the block is added to the chain and the public ledger is updated and alerted to the addition. The node responsible for the successful addition is rewarded with bitcoins, for example by adding a reward transaction to itself in the new block (known as coin base generation).

That is, for each output Y, if k is chosen from a distribution with high minentropy, it is not feasible to find an input x such that H (k | x) = Y, where K is the nonce, x is the hash of the block, Y is the difficulty target and I denotes concatenation. Because crypto hashes are essentially random, in the sense that their output cannot be predicted from their inputs, there is only one known way to find the nonce: try integers one after another, for example 1, then 2. , then 3, and so on, which can be known as brute force. The greater the number of leading zeros, the longer it will take on average to find a necessary Y nonce.In one example, the bitcoin system constantly adjusts the number of leading zeros, so that the average time to find a nonce is approximately ten minutes. In that way, as the processing capabilities of computer hardware increase over time, over the years, the bitcoin protocol will simply require more leading zero bits so that mining always takes about ten minutes to implement.

As described, the hash is an important cornerstone for the blockchain chain. The hashing algorithm can be understood as a function that compresses messages of any length into a digest of fixed-length messages. The most used are MD5 and SHA. In some embodiments, the hash length of the blockchain is 256 bits, which means that regardless of the original content, a 256-bit binary number is ultimately calculated. And the corresponding hash can be guaranteed to be unique as long as the original content is different. For example, the hash of the string 123 is a8fdc205a9f19cc1 c7507a60c4f01 b13d11d7fd0 (hexadecimal), which is 256 bits when converted to binary and only 123 has this hash. The hashing algorithm in the blockchain is irreversible, that is, the direct calculation is easy (from 123 to a8fdc205a9f19cc1c7507a60c4f01b1c7507a60c4f01b1 3d11d7fd0) and the reverse calculation cannot be performed even if all computing resources are exhausted. Therefore, the hash of each block in the blockchain is unique.

Also, if you change the content of the block, your hash will change. The block and the hash are in one-to-one correspondence, and the hash of each block is calculated specifically for the header of the block. That is, the feature values ​​of the block headers are connected to form a long string and then the hash for the string is computed. For example, Hash = SHA256 (block header) is a block hash calculation formula, SHA256 is a blockchain hashing algorithm applied to the block header. The hash is uniquely determined by the header of the block and not by the body of the block.

ES 2 833 552 T3

As mentioned above, the block header contains a large amount of content, including the current block hash and the previous block hash. This means that if the content of the current block changes, or if the hash of the previous block changes, a hash change will occur in the current block. If the hacker modifies a block, the hash of that block changes. For a subsequent block to connect to the modified block, the hacker must modify all subsequent blocks in turn, because the next block must contain the hash of the previous block. Otherwise, the modified block will be separated from the blockchain chain. For design reasons, hashing calculations are time consuming and it is almost impossible to modify multiple blocks in a short period of time unless the hacker has mastered more than 51% of the computing power of the entire network. Therefore, the blockchain chain ensures its own reliability, and once the data is written, it cannot be tampered with.

Once the miner finds the hash (i.e. an eligible signature or solution) for the new block, the miner broadcasts this signature to all other miners (nodes on the blockchain chain). Then other miners in turn check to see if that solution corresponds to the issuer lock problem (i.e. determine if the hash input actually results in that signature). If the solution is valid, the other miners will confirm the solution and agree that the new block can be added to the blockchain chain. Thus the consensus of the new bloc is reached. This is also known as proof of work. The block for which consensus has been reached can now be added to the blockchain and transmitted to all nodes on the network along with its signature. The nodes will accept the block and save it to their transaction data as long as the transactions within the block correctly correspond to the current balances of the portfolio (transaction history) at that time. Every time a new block is added on top of this block, the addition also counts as another confirmation for the previous blocks. For example, if a transaction is included in block 502 and the blockchain chain is 507 blocks long, it means that the transaction has five confirmations (corresponding to blocks 507 to 502). The more confirmations the transaction has, the more difficult it will be for attackers to modify it.

In some embodiments, an example blockchain asset system uses public key cryptography, in which two cryptographic keys, a public key and a private key, are generated. The public key can be thought of as an account number and the private key as ownership credentials. For example, a bitcoin wallet is a collection of public and private keys. Ownership of an asset (eg digital currency, cash asset, stocks, equity, bonds) associated with a certain asset address can be demonstrated with knowledge of the private key that belongs to the address. For example, bitcoin wallet software, sometimes referred to as bitcoin client software, allows a given user to transact with bitcoins. A wallet program generates and stores private keys and communicates with its peers on the bitcoin network. The public and private keys can be called asymmetric encryption keys (or asymmetric encryption keys).

In blockchain transactions, payers and payees are identified on the blockchain by their public cryptographic keys. For example, most contemporary bitcoin transfers are from one public key to a different public key. In practice, the hashes of these keys are used in the blockchain chain and are called bitcoin addresses. In principle, if a hypothetical attacker, person S could steal money from person A simply by adding transactions to the blockchain ledger as person A pays person S 100 bitcoins, using the bitcoin addresses of users instead of their names. The bitcoin protocol prevents this type of theft by requiring that each transfer be digitally signed with the payer's private key, and only signed transfers can be added to the blockchain ledger. Since Person S cannot forge Person A's signature, Person S cannot defraud Person A by adding an entry to the blockchain equivalent to Person A pays Person S 200 bitcoins. At the same time, anyone can verify the signature of person A using his / her public key and thus that he / she has authorized any transaction on the blockchain where he / she is the payer.

In the context of the bitcoin transaction, to transfer some bitcoins to user B, user A can build a record containing information about the transaction through a node. The record can be signed with User A's signing key (private key) and contains User A's public verification key and User B's public verification key. The signature is used to confirm that the transaction comes from the user and also prevents someone from tampering with it once it has been issued. The record included with another record that took place in the same time window in a new block can be transmitted to all nodes. Upon receiving the logs, the full nodes can work to embed the logs on the basis of all transactions that have ever taken place in the blockchain system, adding the new block to a previously accepted blockchain through the mining process described above and validate the added block against the consensus rules of the network.

The UTXO model (unspent transaction output) and the Account / Balance model are two example models for implementing blockchain transactions. UTXO is a blockchain object model. Under UTXO, assets are represented by unspent blockchain transaction outputs, which can be used as inputs to new transactions. For example, the asset of user A that is

ES 2 833 552 T3 will transfer may be in the form of UTXO. To spend (transact) the asset, User A must sign with the private key. Bitcoin is an example of a digital currency that uses the UTXO model. In the case of a valid blockchain transaction, the unspent outputs can be used for additional transactions. In some embodiments, only unspent outputs can be used in additional transactions to avoid double spending and fraud. For this reason, the inputs in a blockchain chain are removed when a transaction occurs, while at the same time, the outputs are created in the form of UTXO. These unspent transaction outputs can be used (by private key holders, for example people with digital currency wallets) for the purpose of future transactions.

The account / balance model (or account-based transaction model), on the other hand, tracks the balance of each account as a global status. An account balance is checked to make sure it is greater than or equal to the amount of the spending transaction. An example of how the account / balance model works in Ethereum is provided:

1. Alice gains 5 ethers through mining. It is recorded in the system that Alice has 5 ethers.

two. Alice wants to give Bob 1 ether, so the system will first deduct 1 ether from Alice's account, so Alice now has 4 ethers.

3. Then the system increases Bob's account by 1 ether. The system knows that Bob has 2 starting ethers, therefore Bob's balance increases to 3 ethers.

Ethereum record keeping can be like a bank. An analogy is using a debit / ATM card. The bank tracks how much money each debit card has, and when Bob needs to spend money, the bank checks his record to make sure Bob has enough balance before approving the transaction.

Since the blockchain and other similar ledgers are completely public, the blockchain itself has no privacy protection. The public nature of the P2P network means that, although those who use it are not identified by name, it is feasible to link transactions to people and companies. For example, in cross-border remittances or in the supply chain, the amount of the transaction has an extremely high level of privacy protection value, because with the information of the amount of the transaction, it is possible to deduce the location and the specific identities of the parties to the transaction. The object of the transaction can comprise, for example, money, unit of value, digital currency, contract, deed, medical record, customer detail, stocks, bonds, equity or any other asset that can be described in digital form. Although the UTXO model can provide anonymity to transaction amounts, for example through the Monero ring signature and Zcash zero-knowledge crypto, transaction amounts remain unprotected under the Account / Balance Model. Therefore, a technical issue addressed by this disclosure is how to protect information online, such as the privacy of transaction amounts. Such transactions may be under the Account / Balance Model.

Some existing technologies propose to use the Pedersen commitment scheme to encrypt the transaction amount and replace the account / balance model. Under the scheme, the issuer sends the transaction amount and a random number corresponding to Pedersen's commitment of the transaction amount to the payee through a secure channel off the blockchain. The payee checks if the random number matches the transaction commitment and performs local storage. For example, in the Account / Balance Model, an account can be treated as a portfolio (account) to hold assets that are aggregated but not merged. Each asset can correspond to a type of asset (for example, cryptocurrency) and the account balance is the sum of the asset values. Even assets of the same type are not merged. During the transaction, a recipient of an asset to be transferred can be specified and the corresponding asset can be removed from the portfolio to fund the transaction. The blockchain nodes verify that the payment wallet has enough asset (s) to cover the transaction, and then the nodes remove the transferred asset from the payment wallet and add a corresponding asset to the recipient's wallet. .

However, there are still limitations to such a scheme. First, the scheme requires the user to maintain a persistent storage locally to manage the random numbers and plaintext balances corresponding to the encrypted account balance, and the management implementation is complicated; second, storing hiding factors (e.g. random numbers) and plain text balances corresponding to the Pedersen asset on a single local node is prone to loss or corruption, while storing backing of Multiple nodes is difficult to perform due to frequent account balance change.

The systems and method presented in this disclosure can overcome the above limitations and achieve strong privacy protection for transaction amounts, asset values, and concealment factors in commitment schemes. To that end, public-private keys can be used to encrypt / decrypt random numbers and plaintext balances, thus providing convenient management. In addition, storing the encrypted information in blockchain ensures that the amounts of the transactions,

ES 2 833 552 T3 asset values ​​and concealment factors in commitment schemes are not easily lost or altered.

In some embodiments, a commitment scheme (for example, Pedersen commitment) can encrypt a certain value (for example, transaction amount, asset value, key parameter) as follows:

PC (a) = rxG + axH where r is a random concealment factor (alternatively called the concealment factor) providing concealment, G and H are the publicly agreed generators / base points of the elliptic curve and can be chosen randomly, a is the value of the commitment, PC (a) is the point on the curve used as a commitment and given to the counterparty, and H is another point on the curve. That is, G and H can be known parameters for the nodes. You can generate a generation of H I have no ace up my sleeve by hashing the base point G with a hash function that maps from point to point with H = Hash (G). H and G are the public parameters of the given system (for example, randomly generated points on an elliptical curve). Although the above provides an example of Pedersen's compromise in the form of an elliptical curve, various other forms of Pedersen's compromise or other compromise schemes may alternatively be used.

A compromise scheme keeps the data secret but commits the data so that the sender of the data cannot change it later. If a party only knows the commit value (for example, PC (a)), it cannot be determined which underlying data values ​​(for example, a) they have been committing to. Both the data (eg a) and the concealment factor (eg r) can be revealed later (eg by the initiating node) and a receiver (eg consensus node) of the commit can execute the commit and verify that the compromised data matches the disclosed data. The concealment factor is present because without one, someone could try to guess the data.

Engagement schemes are a way by which the issuer (committing party) commits to a security (for example, a) such that the promised security remains private but can be disclosed later when the committing party discloses a necessary parameter of the commitment process. Strong compromise schemes can hide information and be computationally binding. Hiding refers to the notion that a given value to and a compromise of that value PC (a) should not be related. That is, PC (a) should not disclose information about a. With PC (a), G, and H known, it is almost impossible to know a due to the random number r. A commitment scheme is binding if there is no plausible way that two different values ​​can result in the same commitment. A Pedersen compromise is perfectly hidden and computationally binding under the discrete logarithm assumption. Furthermore, with r, G, H, and PC (a) known, it is possible to verify PC (a) by determining if PC (a) = rxG + axH.

A Pedersen commit has an additional property: commits can be added and the sum of a set of commits is the same as a commit with the sum of the data (with a hiding factor set as the sum of the hiding factors): PC (ri, datai) + PC (r2, data2) == PC (ri + r2, datai + data2); PC (ri, datai) - PC (ri, datai) == 0. In other words, the commitment preserves the addition and the commutative property is applied, that is, the Pedersen commitment is additively homomorphic, since the underlying data can be manipulated mathematically as if it were not encrypted.

In one embodiment, a Pedersen compromise used to encrypt the input value can be constructed using elliptical curve points. Conventionally, an elliptic curve cryptography (ECC) public key is created by multiplying a generator for group (G) with the secret key (r): Pub = rG. The result can be serialized as a 33-byte array. ECC public keys can obey the homomorphic additive property mentioned above with respect to Pedersen commitments. That is: Pub1 + Pub2 = (r1 + r2 (mod n)) G.

The Pedersen compromise for the input value can be created by selecting an additional generator for the group (H, in the following equations) so that no one knows the discrete register of the second generator H with respect to the first generator G (or vice versa), which means that no one knows an x ​​such that rG = H. This can be achieved, for example, by using the cryptographic hash of G to choose H: H = to_point (SHA256 (ENCODE (G))).

Given the two generators G and H, an example commitment scheme for encrypting the input value can be defined as: commitment = rG + aH. Here, r can be the secret hiding factor and can be the input value that you commit to. Therefore, if a is committed, the commitment scheme described above can be obtained PC (a) = rxG + axH. Pedersen commitments are theoretically private information: for any commitment, there is some concealment factor that would make any amount match the commitment. Pedersen commitments can be computationally safe against false commitments, since the arbitrary mapping may not be computed.

The party (node) that committed the value can open the commitment by revealing the original value a and the factor r that completes the commitment equation. The party that wants to open the PC (a) value will recalculate the commitment to verify that the original shared value actually matches the initially received PC (a) commitment. For the

Therefore, the asset type information can be protected by assigning it to a unique serial number and then encrypting it by compromise of Pedersen. The random number r chosen when generating the commitment makes it almost impossible for anyone to infer the type of asset type committed according to the commitment value PC (a).

During transactions, the protection of information is important to ensure the privacy of the user and the amount of the transaction is a type of information that has lacked protection. Figure 1 shows an example system 100 for information protection, in accordance with various embodiments. As shown, a blockchain network can comprise a plurality of nodes (eg full nodes implemented on servers, computers, etc.). For some blockchain platforms (eg NEO), full nodes with a certain level of voting power may be called consensus nodes, which take responsibility for the verification of the transaction. In this disclosure, full nodes, consensus nodes, or other equivalent nodes can verify the transaction.

Also, as shown in Figure 1, user A and user B can use corresponding devices, such as laptops and mobile phones, which serve as lightweight nodes, to perform transactions. For example, User A may want to transact with User B by transferring some asset from User A's account to User B's account. User A and User B can use the corresponding devices installed with appropriate blockchain software for the transaction. User A's device can be called initiating node A that initiates a transaction with user B's device called receiving node B. Node A can access the blockchain chain through communication with node 1 and Node B can access the blockchain chain through communication with node. 2. For example, node A and node B can send transactions to the blockchain through node 1 and node 2 to request that the transactions be added to the blockchain. Outside of the blockchain chain, Node A and Node B may have other communication channels (for example, regular communication over the Internet without going through nodes 1 and 2).

Each of the nodes in Figure 1 may comprise a processor and a non-transient, computer-readable storage medium that stores instructions that the processor must execute to cause the node (e.g., the processor) to perform various stages of protection from the information described in this document. Each node can be installed with software (eg, a transaction program) and / or hardware (eg, cables, wireless connections) to communicate with other nodes and / or other devices. More details of the node hardware and software are described below with reference to Figure 5.

Figure 2 illustrates exemplary steps for transaction and verification between a sending node A, a receiving node B, and one or more verification nodes, in accordance with various embodiments. The operations presented below are intended to be illustrative. Depending on the implementation, the exemplary steps may include additional, fewer, or alternate steps performed in multiple orders or in parallel.

In various embodiments, the accounts of the parties to the transaction (sending user A and receiving user B) are configured for the Account / Balance model. User A and User B can take the following steps to carry out the transaction through one or more devices, such as their laptop, mobile phone, etc. Devices can be installed with appropriate software and hardware to perform the various stages. Each account can be associated with a private (secret key) -public cryptographic key pair. The private key can be indicated as SK = x, and the public key can be indicated as PK = xG, where G is a generator of the group. Each account can contain multiple assets, each denoted as: (V = PC (r, v), E (K, r, v)), where v represents the face value of the asset, V represents a Pedersen commitment of the face value v, r is a hiding factor (for example, a random number), PC () is a Pedersen compromise algorithm, E () is an encryption algorithm (for example, asymmetric key encryption algorithm), and K is an encryption key. In one example, each asset can be denoted as (V = PC (r, v), E (K, r || v)), where || represents concatenation. Each asset can also include information other than that listed, such as the asset's source of information.

In one example, before user A successfully transmits an amount t to user B in a blockchain verified transaction, the addresses and assets in A's account and B's account are as follows:

For the account of A (account A):

Address: (SK_A = a, PK_A = aG)

Assets A_1 to A_m respectively of values ​​a_1 to a_m are denoted as:

(A_1 = PC (r_ {a_1}, a_1), E (PK_A, r_ {a_1} || a_1)), (A_2 = PC (r_ {a_2}, a_2), E (PK_A, r_ {a_2} || a_2)),

ES 2 833 552 T3 (A_m = PC (r_ {a_m}, a_m), E (PK_A, r_ {a_m} || a_m))

For account B (account B):

Address: (SK_B = b, PK_B = bG)

Assets B_1 through B_n, respectively, of values ​​b_1 through b_n are reported as:

(B_1 = PC (r_ {b_1}, b_1), E (PK_B, r_ {b_1} || b_1)), (B_2 = PC (r_ {b_2}, b_2), E (PK_B, r_ {b_2} || b_2)), (B_n = PC (r_ {b_n}, b_n), E (PK_B, r_ {b_n} || b_n))

In some embodiments, key generation may be based on the ecp256k1 elliptical curve for each account in the Account / Balance model. For example, on Ethereum ecp256k1, any number between 1 and 2²⁵⁶-1 can be a valid SK private key. A good library generates a private key with sufficient randomness in mind. Ethereum requires the private key SK to be 256 bits long. The generation of the public key is done by the ECC cryptography group operation. To derive the public key PK, the private key can be multiplied by G. The multiplication used to derive the public key PK is ECC (Elliptic Curve Point Multiplication) multiplication, which is different from normal multiplication. G is the generator point which is one of the domain parameters of ECC cryptography. G can have a fixed value for ecp256k1. The address can be, for example, the last 20 bytes of the public key PK hash.

In some embodiments, in step 201, node A can initiate a transaction with node B. For example, user A and user B can negotiate an amount t of the transaction from account A of user A to account B of user B. Account A and account B may correspond to the portfolios described in this document. Account A may have one or more assets. The asset can comprise, for example, money, unit of value, digital currency, contract, deed, medical record, customer detail, stocks, bonds, stocks or any other asset that can be described in digital form. Account B may have one or more assets or no assets. Each asset can be associated with various blockchain information stored in blockchain blocks, comprising the blockchain information, for example, NoteType representing the type of asset, NotelD which represents the unique identification of the asset, commitment values ​​representing a commitment (eg Pedersen commitment) value of the asset, random number encryption and value of the asset, etc.

As described with respect to account A, in some embodiments, assets A_1 through A_m correspond, respectively, to the values ​​of assets a_1 through a_m and random numbers r_1 through r_m. Based on the random numbers r_1 through r_m, node A can commit the values ​​of the assets in account A to a commitment scheme (eg, Pedersen commitment) to obtain encrypted commitment values. For example, the encrypted compromise values ​​can be PC_1 through PC_m, where PC_i = PC (r_ {a_i}, a_i) = r_ {a_i} xG + a_ixH, where G and H are known parameters, and i is between 1 and m. In addition to the first field PC (...), each asset is also associated with a second field E (...) as described above. The second field E (...) can represent an encryption of the corresponding random number and the value of the asset encrypted with the key Pk_A. For example, the cipher can be E (PK_A, r_ {a_i} || a_i)). The PC (...) and E (...) of each asset can be inherited from previous transactions. The same mechanism can be applied to account B and its assets.

In some embodiments, to satisfy the amount t of the transaction, user A can use the private key SK_A to decrypt one or more value-added assets of at least account A. For example, node A can use the assets A_1, A_2, ..., A_k for this transaction, where k is less than or equal to m. The remaining assets A_k + 1, A_k + 2, ..., A_m of account A are unused. Consequently, node A can read the assets PC (r_ {a_1}, a_1), PC (r_ {a_2}, a_2), ..., PC (r_ {a_k}, a_k) of node 1. With the numbers random r_ {a_1}, r_ {a_2}, ..., r_ {a_k} known to node A, node A can decrypt the read assets PC (r_ {a_1}, a_1), PC (r_ {a_2}, a_2), ..., PC (r_ {a_k}, a_k) to obtain asset values ​​a_1, a_2, ..., a_k to ensure that the sum (a_1 + a_2 + ... + a_k) is not less than the amount t of the transaction. Different assets can be exchanged with each other within the account based on various rates.

In some embodiments, the amount of selected asset value in excess of t, if any, is set to y as change. For example, node A can determine the change y = (a_1 + a_2 + ... + a_k) - t. Node A can select random numbers r_t and r_y as hiding factors to generate Pedersen commitments for tey: T = PC (r_t, t), Y = PC (r_y, y). That is, node A can generate a random number r_t for t and a random number r_y for y. Node A can commit t and r_t to a commitment scheme to obtain the commitment value T = PC (r_t, t), and commit yy r_y to a commitment scheme to obtain the commitment value Y = PC (r_y,

ES 2 833 552 T3

Y).

Also, in some embodiments, node A can use user B's public key PK_B to encrypt (r_t || t), which provides encryption E (PK_B, r_t || t), and use the user's public key PK_A A to encrypt (r_y || y), which provides the encryption E (PK_A, r_y || y). Figure 3A and Figure 3B can follow this example. As an alternative to obtaining the encryption E (PK_B, r_t || t) by node A, user A can send r_t and t to node B along with the transaction information, causing node B to generate a second key to encrypt (r_t || t) with PK_B. Node B would send the encryption to Node A to allow Node A to verify. Figure 4A and Figure 4B can follow this example. Although concatenation is used in various examples in this disclosure, alternative combinations of inputs, outputs, or other parameters can be used for the encryption function or other operation.

Also, in some embodiments, node A can generate a RP rank test to test blockchain nodes whether the value of T = PC (r_t, t) and the value of Y = PC (r_y, y) are each within a valid range. For example, to have valid values ​​of T = PC (r_t, t), the amount t of the transaction can be within a valid range [0, 2ⁿ-1]; and to have valid values ​​of Y = PC (r_y, y), the change y can be within a valid range [0, 2ⁿ-1]. In one embodiment, node A may use the block test technique to generate the test of rank Rp related to (r_y, y, Y, r_t, t, T) for the blockchain nodes (e.g., nodes of consensus) to check at a later stage if the amount t of the transaction and the change y are within the valid range according to the range test. The rank test may comprise, for example, Bulletproofs, Borromean knot signature, etc.

In step 202, Node A can send the transaction information to Node B (for example, through a secure channel off the blockchain). The transaction information sent may comprise, for example, commitment value T = PC (r_t, t), commitment value Y = PC (r_y, y), encryption E (PK_B, r_t || t), encryption E (PK_A , r_y | | y), RP rank test etc. The commitment value Y = PC (r_y, y), the encryption E (PK_A, r_y || y), and the RP range test can be optional because Node B may not care about the change returned to account A. In some embodiments, transmission through the communication channel outside the blockchain can prevent transaction information from being recorded on the blockchain and prevent nodes other than issuing node A and the receiving node B obtain the transaction information. It may not be necessary to send E (PK_A, r_y || y) to node B, but it may be necessary in the future for user A to spend the change y, since the change must be returned to account A.

In step 203, the node B can check the random number r_t, the transaction amount t, and the commitment value T. In some embodiments, Node B can use the private key SK_B to decrypt the cipher E (PK_B, r_t || t) to obtain r_t || t. From r_t || t, node B can get r_t and t, and then check if r_t and t match T = PC (r_t, t). That is, the node B can check if the commitment value T = PC (r_t, t) is correct based on the random number r_t and the amount t of the transaction according to the Pedersen commitment algorithm. If the match / check fails, Node B can reject the transaction; and if the match / check is successful, node B can sign the transaction to reply to node A in step 204.

In step 204, node B can sign the transaction with user B's private key SK_B to generate a SIGB signature. The signature can follow a Digital Signature Algorithm (DSA) such as the Elliptical Curve Digital Signature Algorithm (ECDSA), whereby the recipient of the signature can verify the signature with the signer's public key to authenticate the signed data. The SIGB signature indicates that the receiving node B agrees with the transaction.

In step 205, node B can transmit the signed transaction back to node A with the signature SIGB.

In step 206, if SIGB is not verified successfully, node A can reject the transaction. If SIGB is verified successfully, Node A can sign the transaction with user A's private key SK_A to generate a SIGA signature. Similarly, the signature can follow the Digital Signature Algorithm (DSA). In one embodiment, node A can sign (E (PK_B, r_t || t); E (PK_A, r_y || y); Y; T; RP) with user A's private key SK_A to generate the SIGA signature.

At step 207, Node A can present the transaction to the blockchain, causing the nodes on the blockchain to verify the transaction and determine whether to add the transaction to the blockchain. In one embodiment, node A may present transaction (E (PK_B, r_t || t); E (PK_A, r_y || y); Y; T; r '; RP; SIGA; SIGB) to the string string of blocks through node 1 to execute the transaction. í = r_1 + ... + r_k - r_t - r_y. The transaction may comprise additional parameters, or it may not comprise all of the listed parameters. The transaction can be transmitted to one or more nodes (for example, consensus nodes) on the blockchain for verification. If the verification is successful, the transaction is added to the blockchain chain. If the verification fails, the transaction is rejected from being added to the blockchain.

In steps 208-213, one or more nodes (eg, consensus nodes) verify the signatures, proof of range, and other information of the submitted transaction. If the verification fails, the nodes reject the transaction. If the verification is successful, the nodes accept the transaction, update User A's account and User B's account separately.

ES 2 833 552 T3

In some embodiments, to execute the transaction, the transaction information can be verified by multiple blockchain nodes. The transaction information may comprise the TXID transaction address, signature (s), input and output. TXID can comprise the hash of the transaction content. The signatures may comprise sender and receiver cryptographic key signatures. The input may comprise an address of the issuer's blockchain account, one or more assets drawn from the issuer's blockchain account for the transaction, etc. The output may comprise an address of the recipient's account in the blockchain, the asset type (s) of the recipient's asset (s), the commitment value (s) of the recipient's asset (s). , etc. The input and the output can comprise indexed information in the form of a table. In some embodiments, the value of the NotelD value may be the TXID + an index of the asset in the output. The sender's public key PK_A can serve as the address for account A and the receiver's public key PK_B can serve as the address for account B.

In some embodiments, the one or more nodes in the blockchain can verify the presented transaction (E (PK_B, r_t || t); E (PK_A, r_y || y); Y; T; RP; FOLLOW; SIGB).

In step 208, the nodes can verify whether the transaction has been executed using an anti-double-spend mechanism or an anti-replay-attack mechanism. If the transaction has been executed, the nodes can reject the transaction; otherwise, the method can proceed to step 209.

In step 209, the nodes can verify the SIGA and SIGB signatures (eg, based on A's public key and B's public key respectively). If any of the signatures are incorrect, the nodes can reject the transaction; otherwise, the method may proceed to step 210.

In optional step 210, the nodes can verify whether the asset types are consistent. For example, nodes can check if the asset types in NoteType for A_1 to A_k are consistent with the asset type (s) of the transaction quantity t. If any of the asset types are inconsistent, the nodes can reject the transaction; otherwise, the method can proceed to step 211. In some embodiments, the original asset type in the portfolio may have been converted to another type based on an exchange rate and this step may be omitted.

In step 211, the nodes can check the rank test RP to validate the value of PC (r_t, t) and the value of PC (r_y, y). In one embodiment, the nodes can check the rank test RP to verify whether the transaction quantity t is not less than zero and the change y is not less than zero. If the verification fails, the nodes can reject the transaction; otherwise, the method may proceed to step 212.

In step 212, the nodes can verify whether the inputs and outputs of the transaction are consistent. In one embodiment, r 'may correspond to the asset value t' = a_1 + ... + a_k - t - y based on the homomorphic property, where r '= r_1 + ... + r_k - r_t - r_y. Since the input assets are a_1 a a_k and the output is t + y, t '= 0 when the input and the output are consistent: a_1 + ... a_k = t + y. Hence, the corresponding compromise value ar 'is PC (r', t ') = r'xG + t'xH = r'G. Since r '= r_1 + ... + r_k - r_t - r_y, the nodes can determine if the inputs and outputs are equal by checking if r'G is equal to PC_1 + ... + PC_k - T - Y corresponding to r_1 + ... + r_k - r_t - r_y. If r'G is equal to PC_1 + ... + PC_k - T - Y, the nodes can determine that the inputs and outputs of the transaction are consistent and proceed to the next stage; otherwise, the nodes can determine that the inputs and outputs of the transaction are inconsistent and reject the transaction.

In step 213, the nodes can verify if node A has the asset (s) used for the transaction. In one embodiment, the nodes can perform this verification based on information stored in the blockchain chain, such as information corresponding to account A. The information can comprise information from previous transactions of all assets. Therefore, the nodes can determine whether account A has the transaction asset for the transaction. If the determination is no, the nodes can reject the transaction; otherwise, the method can proceed to step 214.

In step 214, the nodes can update account A and account B. For example, the nodes can remove the transaction asset of quantity t from account A and add the same to account B. Based on the homomorphic property, since Y = PC (r_y, y) and node 1 knows r_y and can access the commitment value Y from the blockchain, node 1 can decrypt Y to get the asset value y and return it to the account A. Node 2 obtains in step 202 the random number r_t of node 1 and can obtain from the blockchain the commitment value T. Therefore, node 2 can decrypt T to obtain the value t of the asset and add the same to account B.

In one example, after the update of account A and account B, account A receives the change and in used assets A_1, A_2, ..., A_k and receives its unused assets A_k + 1, ... , A_m and account B receives the amount t of the transaction and receives its original assets B_1, B_2, ..., B_n. The assets in A's account and B's account are as follows:

For account A (account A), the updated assets are indicated as:

ES 2 833 552 T3 (Y = PC (r_y, y), E (PK_A, r_y || y)), (A_k + 1 = PC (r_ {a_k + 1}, a_k + 1), E (PK_A, r_ {a_k + 1} || a_k + 1)) (A_k + 2 = PC (r_ {a_k + 2}, a_k + 2), E (PK_A, r_ {a_k + 2} || a_k + 2)) (A_m = PC (r_ {a_m}, a_m), E (PK_A, r_ {a_m} || a_m))

For account B (account B), the updated assets are indicated as:

(B_1 = PC (r_ {b_1}, b_1), E (PK_B, r_ {b_1} || b_1)), (B_2 = PC (r_ {b_2}, b_2), E (PK_B, r_ {b_2} || b_2)), (B_n = PC (r_ {b_n}, b_n), E (PK_B, r_ {b_n} || b_n)), (T = PC (r_t, t), E (PK_B, r_t || t) )

Although the present disclosure uses node A / user A and node B / user B to illustrate the sender and receiver respectively, the sender and receiver can be the same node / user. For example, the y change of a transaction (total assets used in account A minus the transaction amount) can be sent back to the issuer of the transaction. Thus, the various steps performed by node B as described herein may alternatively be performed by node A.

FIG. 3A illustrates a flow chart of an exemplary method 300 for information protection, in accordance with various embodiments of the present disclosure. Method 300 can be implemented by one or more components (eg, node A, node 1, a combination of node A and node 1) of the system 100 of Figure 1. Method 300 may be implemented by a system or device (eg, computer, server) comprising a processor and a non-transient, computer-readable storage medium (eg, memory) that stores instructions to be executed by the processor to make have the system or device (eg, processor) perform method 300. The method 300 operations presented below are intended to be illustrative. Depending on the implementation, the example method 300 may include additional, fewer, or alternate steps performed in multiple orders or in parallel.

Block 301 comprises: committing a transaction amount t of a transaction with a commitment scheme to obtain a transaction commitment value T, the commitment scheme comprising at least one concealment factor of the transaction r_t. For example, as described above, T = PC (r_t, t). In some embodiments, the commitment scheme comprises a Pedersen commitment based at least on the transaction concealment factor r_t and the transaction amount t being a committed value.

Block 302 comprises: encrypting a combination of the transaction hiding factor r_t and the transaction amount t with a public key PK_B of a recipient of the transaction. For example, node A can use the key PK_B to encrypt (r_t || t), which provides the encryption E (PK_B, r_t || t). In some embodiments, the public key PK_B is an asymmetric encryption key. In some embodiments, the combination of the transaction concealment factor r_t and the transaction quantity t comprises a concatenation of the transaction concealment factor r_t and the transaction quantity t.

Block 303 comprises: transmitting the transaction commitment value T and the encrypted combination to a receiving node associated with the receiver so that the receiving node verifies the transaction (eg, causing the receiving node to verify the transaction). In some embodiments, transmitting the transaction commitment value T and the encrypted combination to the receiving node associated with the receiver for the receiving node to verify the transaction comprises transmitting the transaction commitment value T and the encrypted combination to the receiving node associated with the receiver, make the receiver node: decrypt the encrypted combination with a private key SK_B of the receiver to obtain the hiding factor of the transaction r_t and the amount t of the transaction; and verifying the transaction based on at least the transaction commitment value T, the transaction concealment factor r_t, and the transaction amount t. See, for example, step 203.

In some embodiments, having the receiving node verify the transaction based on at least the transaction commit value T, the transaction concealment factor r_t, and the transaction amount t comprises

ES 2 833 552 T3 make the receiving node: in response to determining that the transaction commitment value T does not match the commitment scheme of the transaction quantity t based on the transaction concealment factor r_t,, reject the transaction; and in response to determining that the transaction commitment value T matches the commitment scheme of the transaction quantity t based on the transaction concealment factor r_t, approving the transaction by signing the transaction with the recipient's private key SK_B to generate a SIGB receiver signature.

In some embodiments, before transmitting (block 304) the encrypted combination to the receiver node associated with the receiver, the method further comprises: commit a change and the transaction with the commit scheme to obtain a change commit value Y, the commit scheme comprising at least one change of the hiding factor r_y, where the change y is one or more assets of a issuer of the transaction used for the transaction minus the amount t of the transaction; and encrypting another combination of the change concealment factor r_y and the change y with a public key PK_A from the issuer. For example, node A can use the key PK_A to encrypt (r_y || y), which provides the encryption E (PK_A, r_y || y).

In some embodiments, the method further comprises: in response to receiving the receiver's signature SIGB, approving the transaction by signing the transaction with a sender's private key SK_A to generate a sender's signature SIGA; and presenting the transaction comprising the encrypted combination, the other encrypted combination, the transaction commitment value T, the exchange commitment value Y, the sender's SIGA signature and the receiver's SIGB signature to one or more nodes in a network of blockchain for one or more nodes to verify the transaction. More details have been described above with reference to steps 208-213.

In some embodiments, presenting the transaction comprising the encrypted combination, the other encrypted combination, the transaction commitment value T, the exchange commitment value Y, the sender's signature SIGA, and the receiver's signature SIGB to the one or more nodes in the blockchain network for the one or more nodes to verify the transaction comprises: Present the transaction comprising the encrypted combination, the other encrypted combination, the transaction commitment value T, the exchange commitment value Y, the sender's signature SIGA and the receiver's signature SIGB to the one or more nodes in the blockchain network, which causes the one or more nodes, in response to successfully verifying the transaction, to issue the amount t of the transaction to the receiver, eliminate the one or more assets used for the transaction and issue the exchange and the issuer. More details have been described above with reference to step 214.

Figure 3B illustrates a flow diagram of an exemplary method 400 for information protection, in accordance with various embodiments of the present disclosure. The method 400 can be implemented by one or more components (eg, node b, node 2, a combination of node B and node 2, etc.) of the system 100 of Figure 1. Method 400 may be implemented by a system or device (eg, computer, server) comprising a processor and a non-transient computer-readable storage medium (eg, memory) that stores instructions to be executed by the processor to make have the system or device (eg, processor) perform method 400. The method 400 operations presented below are intended to be illustrative. Depending on the implementation, the example method 400 may include additional, fewer, or alternate steps performed in multiple orders or in parallel.

Block 401 comprises: obtaining a combination of a transaction concealment factor r_t and an amount t of the transaction encrypted with a public key PK_B of a recipient of a transaction and obtaining a transaction commitment value T, in which: the amount t of the transaction is committed to a commitment scheme by an issuing node associated with a transaction issuer to obtain the transaction commitment value T, the commitment scheme comprising at least the transaction concealment factor r_t.

The block 402 comprises: decrypting the combination obtained with a private key SK_B of a receiver of the transaction to obtain the hiding factor of the transaction r_t and the amount t of the transaction. In some embodiments, the recipient's public key PK_B and the recipient's private key SK_B are asymmetric encryption keys.

Block 403 comprises: verifying the transaction based at least on the commitment value T of the transaction, the concealment factor of the transaction r_t and the amount t of the transaction.

As an alternative to encrypting the combination (r_t, t), such as (r_t || t) at node A, node A can transmit (r_t, t) to node B, making node B encrypt the combination (r_t, t ), as described below with reference to Figure 4A and Figure 4B. Other steps and descriptions from Figure 1 to Figure 3B can be applied similarly to Figure 4A and Figure 4B.

Figure 4A illustrates a flow chart of an exemplary method 440 for information protection, in accordance with various embodiments of the present disclosure. Method 440 can be implemented by one or more components (eg, node A, node 1, a combination of node A and node 1) of the system 100 of Figure 1. Method 440 may be implemented by a system or device (eg, computer, server) comprising a processor and a non-transient, computer-readable storage medium (eg, memory) that

ES 2 833 552 T3 stores instructions to be executed by the processor to cause the system or device (eg, processor) to perform method 440. The method 440 operations presented below are intended to be illustrative. Depending on the implementation, the example method 440 may include additional, fewer, or alternate steps performed in multiple orders or in parallel.

Block 441 comprises: committing a transaction amount t of a transaction with a commitment scheme to obtain a transaction commitment value T, the commitment scheme comprising at least one transaction concealment factor r_t.

Block 442 comprises: send transaction amount t, transaction concealment factor r_t, and transaction commitment value T to a receiving node associated with a transaction receiver for the receiving node to verify the transaction and encrypt the concealment factor of the transaction r_t and the amount t of the transaction with a public key PK_B of the receiver (for example, having the receiving node verify the transaction and encrypt the transaction hiding factor r_t and the transaction amount t with a public key PK_B from the receiver). For example, Node B can check if T = PC (r_t, t) and Node B can encrypt the combination with the public key PK_A to get E (pK_B, r_t || t).

Block 443 comprises: obtaining an encrypted combination (eg, E (PK_B, r_t || t)) of the transaction concealment factor r_t and the transaction amount t of the receiving node.

Block 444 comprises: transmitting the encrypted combination and the transaction commitment value T to a plurality of nodes in a blockchain chain for the plurality of nodes to verify the transaction (e.g., having the plurality of nodes verify the transaction).

Figure 4B illustrates a flow chart of an exemplary method 450 for information protection, in accordance with various embodiments of the present disclosure. Method 450 can be implemented by one or more components (eg, node b, node 2, a combination of node B and node 2, etc.) of the system 100 of Figure 1. Method 450 may be implemented by a system or device (eg, computer, server) comprising a processor and a non-transient, computer-readable storage medium (eg, memory) that stores instructions to be executed by the processor to make have the system or device (eg, processor) perform method 450. The method 450 operations presented below are intended to be illustrative. Depending on the implementation, the example method 450 may include additional, fewer, or alternate steps performed in multiple orders or in parallel.

Block 451 comprises: obtaining a transaction amount t of a transaction, a transaction concealment factor r_t, and a transaction commitment value T.

Block 452 comprises: verifying the transaction based on the obtained transaction amount t, the obtained transaction concealment factor r_t and the obtained transaction commitment value T.

Block 453 comprises: in response to the successful verification of the transaction, encrypting the transaction concealment factor r_t and the transaction quantity t with a public key PK_B of a recipient of the transaction to obtain an encrypted combination (for Example, E (PK_B, r_t || t)).

Block 454 comprises: transmitting the encrypted combination to an issuer node associated with an issuer of the transaction.

As shown, the privacy of the transaction amount can be protected by various improvements in information technology. For example, the account structure comprises one or more fields, such as a first field associated with Pedersen's commitment to the asset value (for example, the first field being PC (r_ {a_i}, a_i), i being between 1 ym) and a second field associated with the random number of Pedersen's commitment and the asset value (for example, the second field is E (...)). The first field and the second field are also used in the transaction stages and are stored on the blockchain.

For another example, an account's public-private key system (asymmetric cryptography) is reused to encrypt the random number of each Pedersen commitment and the corresponding asset value, and store the transaction, including encrypted random numbers and values. of assets on the blockchain chain. In this way, local management of such random numbers is avoided and security based on distributed and consistent blockchain storage is promoted. Therefore, the random number for the commitment can be stored effectively through the blockchain, without requiring an additional encryption system.

For yet another example, the range test is used to show that the pre-existing assets in the transaction are balanced with the new assets and the transaction, and that the value of each new asset is in a reasonable range. In addition, the parties to the transaction can transmit the committed random number and the value of the new asset to the receiver through a secure channel outside the blockchain to verify if the committed value matches the value of the transaction asset. .

ES 2 833 552 T3

As such, the random numbers of Pedersen commits can be conveniently managed, without the risk of corruption and without incurring an additional key management burden. Therefore, the privacy of the transaction can be fully protected and the transaction amounts can be kept secret.

The techniques described in this document are implemented using one or more special purpose computing devices. Special use computing devices can be desktop computing systems, server computing systems, portable computing systems, portable devices, network devices, or any other device or combination of devices that incorporates wired and / or program logic to implement the techniques. The computing device (s) are generally controlled and coordinated by the operating system software. Conventional operating systems control and schedule computer processes to run, perform memory management, provide file system, networking, I / O services, and provide user interface functionality, such as a graphical user interface (GUI), among other things.

Figure 5 is a block diagram illustrating a computer system 500 in which any of the embodiments described herein may be implemented. System 500 can be implemented in any of the nodes described herein and configured to perform the corresponding steps for information protection methods. Computer system 500 includes a bus 502 or other communication mechanism to communicate information, and one or more hardware processor (s) 504 coupled with bus 502 to process information. The hardware processor (s) 504 may be, for example, one or more general purpose microprocessors.

Computer system 500 also includes main memory 506, such as random access memory (RAM) or other dynamic storage device, coupled to bus 502 to store information and instructions to be executed by processor (s) 504. Main memory 506 It can also be used to store temporary variables or other intermediate information during the execution of instructions to be executed by the 504 processor (s). Such instructions, when stored on storage media accessible to the processor (s) 504, represent the computer system 500 on a special-use machine that is customized to perform the operations specified in the instructions. Computer system 500 further includes read-only memory (ROM) 508 or other static storage device coupled to bus 502 to store static information and instructions for the processor (s) 504. A storage device 510 is provided, such as a magnetic disk, an optical disk, or a USB memory drive (flash drive), etc. and is coupled to bus 502 to store information and instructions.

The computer system 500 may implement the techniques described herein using custom wired logic, one or more ASICs or FPGAs, firmware and / or program logic that, in combination with the computer system, causes or programs that the computer system 500 be a special purpose machine. In accordance with one embodiment, the operations, methods, and processes described herein are performed by computer system 500 in response to processor (s) 504 executing one or more sequences of one or more instructions contained in main memory 506. Such Instructions can be read into main memory 506 from another storage medium, such as storage device 510. Execution of the instruction sequences contained in main memory 506 causes the processor (s) 504 to perform the process steps described herein. In alternative embodiments, wireline circuitry may be used in place of or in combination with software instructions.

Main memory 506, ROM 508, and / or storage device 510 may include non-transient storage media. The term "non-transient means" and similar terms, as used herein, refer to means that store data and / or instructions that cause a machine to function in a specific way; the media excludes transient signals. Such non-transient media can comprise non-volatile media and / or volatile media. Non-volatile media includes, for example, optical or magnetic discs, such as storage device 510. Volatile media includes dynamic memory, such as main memory 506. Common forms of non-transient media include, for example, a floppy disk, a floppy disk, hard disk, solid state disk, magnetic tape, or any other magnetic data storage medium, a CD-ROM, any other media. optical data storage, any physical media with hole patterns, a RAM, a PROM and EPROM, a FLASH-EPROM, NVRAM, any other memory chip or cartridge, and network versions thereof.

Computer system 500 also includes a communication interface 518 coupled to bus 502. Network interface 518 provides a bidirectional data communication link to one or more network links that are connected to one or more local networks. For example, network interface 518 may be an integrated services digital network (ISDN) card, cable modem, satellite modem, or a modem to provide a data communication connection to a corresponding type of telephone line. As another example, network interface 518 may be a local area network (LAN) card to provide a data communication connection to a compatible LAN (or WAN component to communicate with a WAN). Wireless links can also be implemented. In any such implementation, network interface 518 sends and receives electrical, electromagnetic, or optical signals that carry digital data streams representing various types of information.

ES 2 833 552 T3

Computer system 500 can send messages and receive data, including program code, over the network (s), the network link, and the communication interface 518. In the Internet example, a server could transmit a requested code for an application program via the Internet, the ISP, the local network, and the network interface 518.

The received code may be executed by the processor (s) 504 as it is received and / or stored in the storage device 510 or other non-volatile storage for later execution.

Each of the processes, methods and algorithms described in the previous sections may be incorporated and fully or partially automated by code modules executed by one or more computer systems or computer processors comprising computer hardware. The processes and algorithms can be partially or fully implemented in application-specific circuits.

The various features and processes described above can be used independently of one another, or they can be combined in various ways. All possible combinations and sub-combinations are intended to be within the scope of the present disclosure. Also, certain method or process blocks may be omitted in some implementations. The methods and processes described herein are also not limited to any particular sequence and the blocks or states related thereto can be performed in other sequences that are appropriate. For example, the blocks or states described may be realized in an order other than that specifically disclosed or multiple blocks or states may be combined into a single block or state. The example blocks or states can be realized in series, in parallel, or in some other way. Blocks or states can be added to or removed from the disclosed example embodiments. The example systems and components described herein may be configured differently than described. For example, elements can be added, removed, or rearranged compared to the disclosed example embodiments.

The various operations of the example methods described herein can be performed, at least partially, by an algorithm. The algorithm may be comprised of program codes or instructions stored in a memory (eg, a non-transient, computer-readable storage medium described above). Said algorithm may comprise a machine learning algorithm. In some embodiments, a machine learning algorithm may not explicitly program computers to perform a function, but may learn from training data to model predictions that perform the function.

The various operations of the example methods described herein can be performed, at least partially, by one or more processors that are temporarily configured (eg, by software) or permanently configured to perform the relevant operations. Whether configured temporarily or permanently, such processors may be processor-implemented engines that operate to perform one or more operations or functions described herein.

Similarly, the methods described herein may be at least partially implemented with a processor, with a particular processor or processors being an example of hardware. For example, at least some of the operations in a method can be performed by one or more processors or engines implemented per processor. Furthermore, the one or more processors can also function to support the performance of relevant operations in a cloud computing environment or as a software as a service (SaaS). For example, at least some of the operations can be performed by a group of computers (such as machines that include processors), these operations being accessible through a network (for example, the Internet) and through one or more appropriate interfaces. (for example, an Application Program Interface (API)).

The performance of some of the operations can be distributed among the processors, which are not only located within a single machine, but are deployed on multiple machines. In some example embodiments, the processors or processor-implemented engines may be located in a single geographic location (eg, within a home environment, an office environment, or a server farm). In other example embodiments, the processors or engines implemented per processor may be distributed across multiple geographic locations.

Throughout this specification, multiple instances may implement described components, operations, or structures as a single instance. Although the individual operations of one or more methods are illustrated and described as separate operations, one or more of the individual operations can be performed simultaneously and nothing requires that the operations be performed in the illustrated order. The structures and functionality presented as separate components in the example configurations can be implemented as a combined structure or component. Similarly, structures and functionality presented as a single component can be implemented as separate components. These and other variations, modifications, additions and improvements are within the scope of the subject matter of this document.

ES 2 833 552 T3

Although a general description of subject matter has been described with reference to specific example embodiments, various modifications and changes can be made to these embodiments without departing from the broader scope of embodiments of the present disclosure. Such embodiments of subject matter may be referred to herein, individually or collectively, by the term invention merely for reasons of convenience and not intended to voluntarily limit the scope of the present application to any single disclosure or concept if In fact, more than one is revealed. The present detailed description is not to be construed in a limiting sense and the scope of various embodiments is defined only by the appended claims, together with the full range of equivalents to which such claims are entitled.