Block Verification Mechanism Based on Zero-Knowledge Proof in Blockchain

Since transactions in blockchain are based on public ledger verification,this raises security concerns about privacy protection.And it will cause the accumulation of data on the chain and resulting in the low efficiency of block verification,when the whole transaction on the chain is verified.In order to improve the efficiency and privacy protection of block data verification,this paper proposes an efficient block verification mechanism with privacy protection based on zeroknowledge proof(ZKP),which not only protects the privacy of users but also improves the speed of data block verification.There is no need to put the whole transaction on the chain when verifying block data.It just needs to generate the ZKP and root hash with the transaction information,then save them to the smart contract for verification.Moreover,the ZKP verification in smart contract is carried out to realize the privacy protection of the transaction and efficient verification of the block.When the data is validated,the buffer accepts the complete transaction,updates the transaction status in the cloud database,and packages up the chain.So,the ZKP strengthens the privacy protection ability of blockchain,and the smart contracts save the time cost of block verification.

Group Signature Based on Non-interactive Zero-Knowledge Proofs

Non-Interactive Zero-Knowledge(NIZK for short) proofs are fascinating and extremely useful in many security protocols. In this paper,a new group signature scheme,decisional linear assumption group signature(DLAGS for short) with NIZK proofs is proposed which can prove and sign the multiple values rather than individual bits based on DLIN assumption. DLAGS does not need to interact between the verifier and issuer,which can decrease the communication times and storage cost compared with the existing interactive group signature schemes. We prove and sign the blocks of messages instead of limiting the proved message to only one bit(0 or 1) in the conventional non-interactive zero-knowledge proof system,and we also prove that our scheme satisfy the property of anonymity,unlinkability and traceability. Finally,our scheme is compared with the other scheme(Benoitt's scheme) which is also based on the NIZK proofs system and the DLIN assumption,and the results show that our scheme requires fewer members of groups and computational times.

Privacy-preserving analytics for the securitization market: a zero-knowledge distributed ledger technology application

A zero-knowledge proof or protocol is a cryptographic technique for verifying private data without revealing it in its clear form.In this paper,we evaluate the potential for zero-knowledge distributed ledger technology to alleviate asymmetry of information in the asset-backed securitization market.To frame this inquiry,we conducted market data analyses,a review of prior literature,stakeholder interviews with investors,originators and security issuers and collaboration with blockchain engineers and researchers.We introduce a new system which could enable all market participants in the securitization lifecycle(e.g.investors,rating agencies,regulators and security issuers)to interact on a unique decentralized platform while maintaining the privacy of loan-level data,therefore providing the industry with timely analytics and performance data.Our platform is powered by zkLedger(Narula et al.2018),a zero-knowledge protocol developed by the MIT Media Lab and the first system that enables participants of a distributed ledger to run publicly verifiable analytics on masked data.

区块链隐私众包中的数据验证与可控匿名方案

针对隐私众包场景下出现的数据验证、匿名作恶检测和跨平台资源交互等需求,该文基于区块链技术,并结合零知识证明与环签名技术,提出一种联盟链架构下的隐私众包方案。该方案依靠零知识证明实现对加密数据的验证,依靠链接可撤销环签名改进方案实现工人身份的可控匿名,引入联盟链架构实现众包实体之间的资源交互。在完成众包完整流程的同时,实现隐私众包所需的数据保护与身份保护。安全性分析表明,该方案具有隐私性、可验证性、可控匿名性与公平性。实验结果验证了方案在效率与性能方面的有效性。

简短关联可编辑环签名及其区块链修正应用

关联可编辑环签名(LRRS)可提升区块链的匿名性,防止双花攻击,修正区块链数据,但其签名大小随环成员的增多而增大。针对该问题,结合已有LRRS和简短关联环签名方案,利用动态累加器对环成员的公钥进行累加计算,依据原知识证明签名(SPK)构造出新的SPK,提出简短LRRS(SLRRS)方案,基于该签名又提出新的区块链修正协议。在随机谕言机模型下,证明所提签名具有不可伪造性、匿名性、关联性。性能评估表明:随着环成员的增多,已有签名的大小在增大,而所提签名不变;同时此类签名所消耗的时间均在增多,而所提签名的时间增速较缓且最少。

格上身份基简短关联环签名及其电子投票应用

环签名具备匿名性,身份基环签名无需证书,关联环签名可避免用户重复签名,但这些签名占用空间多且效率低。针对这些问题,先输出公共参数和系统主密钥,再提取用户密钥,然后使用格上的累加器对环中公钥进行累加,并将知识证明签名推广至格上,构造出格上身份基简短关联环签名。对该签名的不可伪造性、关联性和匿名性进行了证明。对签名方案进行了性能分析与实验评估,结果表明,该签名节省了时间开销和存储空间。利用该签名及门限秘密共享技术,提出后量子的电子投票协议。

A Blockchain-Based Proxy Re-Encryption Scheme with Conditional Privacy Protection and Auditability

With the development of Internet of Things technology,intelligent door lock devices are widely used in the field of house leasing.In the traditional housing leasing scenario,problems of door lock information disclosure,tenant privacy disclosure and rental contract disputes frequently occur,and the security,fairness and auditability of the housing leasing transaction cannot be guaranteed.To solve the above problems,a blockchain-based proxy re-encryption scheme with conditional privacy protection and auditability is proposed.The scheme implements fine-grained access control of door lock data based on attribute encryption technology with policy hiding,and uses proxy re-encryption technology to achieve auditable supervision of door lock information transactions.Homomorphic encryption technology and zero-knowledge proof technology are introduced to ensure the confidentiality of housing rent information and the fairness of rent payment.To construct a decentralized housing lease transaction architecture,the scheme realizes the efficient collaboration between the door lock data ciphertext stored under the chain and the key information ciphertext on the chain based on the blockchain and InterPlanetary File System.Finally,the security proof and computing performance analysis of the proposed scheme are carried out.The results show that the scheme can resist the chosen plaintext attack and has low computational cost.

基于区块链的SDN多控制器安全认证研究

提出一种基于区块链的软件定义网络多控制器安全认证方案。在多控制器结构基础上设计了基于区块链的共识机制,以此解决单点故障及多控制器间数据不一致的问题。通过集成无密钥签名基础设施和工作量证明共识算法,提出一种签名验证机制,保障控制器与交换机间的通信免受恶意攻击。通过在仿真实验中对吞吐量、CPU使用率和响应时间等性能指标与单控制器模型进行对比,得出的评估结果表明:本方案具有较高的传输、计算能力,可扩展性和安全性高等优点,对SDN网络整体的安全具有十分重要的研究意义。

A Blockchain-Based Efficient Cross-Domain Authentication Scheme for Internet of Vehicles

The Internet of Vehicles(IoV)is extensively deployed in outdoor and open environments to effectively address traffic efficiency and safety issues by connecting vehicles to the network.However,due to the open and variable nature of its network topology,vehicles frequently engage in cross-domain interactions.During such processes,directly uploading sensitive information to roadside units for interaction may expose it to malicious tampering or interception by attackers,thus compromising the security of the cross-domain authentication process.Additionally,IoV imposes high real-time requirements,and existing cross-domain authentication schemes for IoV often encounter efficiency issues.To mitigate these challenges,we propose CAIoV,a blockchain-based efficient cross-domain authentication scheme for IoV.This scheme comprehensively integrates technologies such as zero-knowledge proofs,smart contracts,and Merkle hash tree structures.It divides the cross-domain process into anonymous cross-domain authentication and safe cross-domain authentication phases to ensure efficiency while maintaining a balance between efficiency and security.Finally,we evaluate the performance of CAIoV.Experimental results demonstrate that our proposed scheme reduces computational overhead by approximately 20%,communication overhead by around 10%,and storage overhead by nearly 30%.

A Fair and Trusted Trading Scheme for Medical Data Based on Smart Contracts

Data is regarded as a valuable asset,and sharing data is a prerequisite for fully exploiting the value of data.However,the current medical data sharing scheme lacks a fair incentive mechanism,and the authenticity of data cannot be guaranteed,resulting in low enthusiasm of participants.A fair and trusted medical data trading scheme based on smart contracts is proposed,which aims to encourage participants to be honest and improve their enthusiasm for participation.The scheme uses zero-knowledge range proof for trusted verification,verifies the authenticity of the patient’s data and the specific attributes of the data before the transaction,and realizes privacy protection.At the same time,the game pricing strategy selects the best revenue strategy for all parties involved and realizes the fairness and incentive of the transaction price.The smart contract is used to complete the verification and game bargaining process,and the blockchain is used as a distributed ledger to record the medical data transaction process to prevent data tampering and transaction denial.Finally,by deploying smart contracts on the Ethereum test network and conducting experiments and theoretical calculations,it is proved that the transaction scheme achieves trusted verification and fair bargaining while ensuring privacy protection in a decentralized environment.The experimental results show that the model improves the credibility and fairness of medical data transactions,maximizes social benefits,encourages more patients and medical institutions to participate in the circulation of medical data,and more fully taps the potential value of medical data.

A Cloud-Fog Enabled and Privacy-Preserving IoT Data Market Platform Based on Blockchain

The dynamic landscape of the Internet of Things(IoT)is set to revolutionize the pace of interaction among entities,ushering in a proliferation of applications characterized by heightened quality and diversity.Among the pivotal applications within the realm of IoT,as a significant example,the Smart Grid(SG)evolves into intricate networks of energy deployment marked by data integration.This evolution concurrently entails data interchange with other IoT entities.However,there are also several challenges including data-sharing overheads and the intricate establishment of trusted centers in the IoT ecosystem.In this paper,we introduce a hierarchical secure data-sharing platform empowered by cloud-fog integration.Furthermore,we propose a novel non-interactive zero-knowledge proof-based group authentication and key agreement protocol that supports one-to-many sharing sets of IoT data,especially SG data.The security formal verification tool shows that the proposed scheme can achieve mutual authentication and secure data sharing while protecting the privacy of data providers.Compared with previous IoT data sharing schemes,the proposed scheme has advantages in both computational and transmission efficiency,and has more superiority with the increasing volume of shared data or increasing number of participants.

基于属性的匿名凭证研究综述

近年来,为有效解决身份凭证出示的过程中存在的用户隐私信息泄露问题,学者们提出了匿名凭证系统。然而,传统匿名凭证容易提供过多非必要隐私信息,造成隐私泄露的风险。因此结合基于属性的签名,学者们提出了基于属性的匿名凭证。本文首先根据匿名凭证系统特性,将系统具体分为凭证颁发与凭证证明两个过程分别研究。其次,本文对每个过程所使用的算法结合现状研究并对比分析,根据具体结果针对不同使用情形提出建议,使得效果最优化。接着,综合分析几类具体的匿名凭证方案特性,进一步对比不同算法对凭证系统性能的影响。最后,对目前基于属性的匿名凭证已有研究提出所存在问题,并基于此对未来研究提出展望。

一种可快速验证的可聚合BLS签名方案

BLS签名是一种双线性映射友好椭圆曲线上的数字签名方案,它具有签名大小短、在聚合签名场景中验证高效、支持同态性与非交互聚合等优点.但由于需要进行双线性映射操作,单个BLS签名的验证算法相对较慢,这阻碍了其在区块链系统中进一步的应用.本文提出了一种BLS签名方案的变体—CPABLS,其主要优点如下:第一,将Chaum-Pedersen离散对数相等性证明纳入签名中,使得签名验证算法不再需要双线性映射操作,从而提升了验证速度;第二,在公钥聚合时只需对各个签名者的公钥简单求和,而无需进行大量的标量乘法操作;第三,相比于群G2,签名验证算法可在群G1中更快地进行哈希到曲线和聚合公钥检验操作.给出了该方案在聚合签名安全模型中的安全证明及原型实现,并进行了性能测试与效率评估.

量子算法对比特币区块链攻击的研究

以比特币为核心交易货币的区块链技术分布在一个去中心化的P2P网络中,近年来在如医疗、金融、智能制造等多个领域的市场中展现出了蓬勃的生机,极具发展前景.然而量子技术的不断发展进步对区块链的安全性能产生了极大的冲击.首先阐述比特币网络中PoW共识算法对哈希函数的依赖性和交易事务中数字签名ECDSA加密算法的工作原理,而后针对2类具有潜在威胁性的量子算法——Grover算法和Shor算法——对比特币区块链的攻击机制展开分析.得出结论:Grover算法可对PoW中的SHA256哈希函数进行快速求解,有望在未来完成攻破;Shor算法可通过ECDSA加密算法中的公钥信息推导出私钥,从而窃取交易成果.最后列举了几种改进算法以应对量子攻击.

A new lattice-based partially blind signature with more complete proof

Partially blind signatures are introduced on the basis of blind signatures,which not only retain the advantages of blind signatures,but also solve the contradiction between anonymity and controllability in blind signatures.With the development of quantum computing technology,it becomes more urgent to construct secure partially blind signature schemes in quantum environments.In this paper,we present a new partially blind signature scheme and prove the security under the Ring-SIS assumption in the random oracle model.To avoid the restart problem of signature schemes caused by rejection sampling,a large number of random numbers are sampled in advance,so that they only need to be re-selected at the current stage without terminating the whole signature process when the conditions are not met.In addition,the hash tree technology is used to reduce communication costs and improve interactive performance.In order to avoid the errors in the security proof of the previous scheme,our proof builds upon and extends the modular framework for blind signatures of Hauck et al.and the correctness,partial blindness,and one-more unforgeability of the scheme are proved in detail according to the properties of the linear hash function.

基于区块链和SM9数字签名的代理投票方案

随着互联网的普及,电子投票技术逐渐替代传统纸质投票技术。然而,传统的电子投票方案主要针对一人一票制来设计方案,在一些特殊的投票场景下,一人一票制投票方式不再适用。例如,投票者不具备专业知识却也需要投票的场景,投票者由于不能理解选举的内容而消极投票,造成选举结果不专业和不公正等问题。此外,传统的电子投票技术还存在选举过程不透明和选票不可验证等问题。针对上述问题,文章提出一种基于区块链和SM9数字签名的代理投票方案。该方案首先使用区块链技术解决选票的全局可验证问题,其次使用零知识范围证明技术解决恶意选票值的问题,然后利用基于椭圆曲线的改进ElGamal算法的同态性质实现选票加密和自计票功能,最后使用SM9数字签名算法和变色龙哈希函数设计的代理投票凭证实现投票权的转让过程。通过安全性分析,证明了文章所提方案满足鲁棒性、合法性、机密性、全局可验证性和公平性。理论分析和实验数据表明,文章所提方案性能良好,适用于需要专业知识场景下的选举。

Another ID-Based Proxy Signature Scheme and Its Extension

So fur, the security of many proxy signatures has seldom been considered in a formal way and most of them cannot satisfy nonepudiation. In this work, a novel ID-based （Identity-based） proxy signature scheme is proposed by combining the proxy signature with ID-based public cryptography, and they formalize the notion of security for ID-based proxy signature schemes. And show that the security of the proposed scheme is secure. Compured with other proxy signature schemes, it does not need a secure channel. Thus, it is particularly suitable for the unreliable network computation environment. Finally, they extend proposed scheme to a proxy multi-signature which has the following advantages （1） the size of proxy multi- signature is independent of the number of delegating users; （2） the computation cost of proxy multi-signature only need two Weil paring.

Policy-Based Group Signature Scheme from Lattice

Although the existing group signature schemes from lattice have been optimized for efficiency,the signing abilities of eachmember in the group are relatively single.It may not be suitable for complex applications.Inspired by the pioneering work of Bellare and Fuchsbauer,we present a primitive called policy-based group signature.In policy-based group signatures,group members can on behalf of the group to sign documents that meet their own policies,and the generated signatures will not leak the identity and policies of the signer.Moreover,the group administrator is allowed to reveal the identity of signer when a controversy occurs.Through the analysis of application scenarios,we concluded that the policy-based group signature needs to meet two essential security properties:simulatability and traceability.And we construct a scheme of policy-based group signature from lattice through techniques such as commitment,zero-knowledge proof,rejection sampling.The security of our scheme is proved to be reduced to the module short integer solution(MSIS)and module learning with errors(MLWE)hard assumptions.Furthermore,we make a performance comparison between our scheme and three lattice-based group signature schemes.The result shows that our scheme has more advantages in storage overhead and the sizes of key and signature are decreased roughly by 83.13%,46.01%,respectively,compared with other schemes.

区块链中可监管的身份隐私保护方案

在账本公开、多方共识情况下确保交易身份的隐私保护是区块链技术面临的主要挑战之一.目前公有链中基于匿名认证和交易混淆的身份隐私保护方案由于缺乏监管又难于在行业应用中推广.借鉴门罗币中的身份隐私保护方案,引入监管方的角色,基于一次性地址加密和零知识证明设计了可监管的交易接收方身份隐私保护方案;结合可链接环签名和可撤销环签名设计了可链接可撤销环签名方案,以实现基于自主混淆的可监管交易发送方身份隐私保护方案.基于上述方案,系统在保护交易方身份隐私的同时,还支持监管方可离线恢复交易参与方的真实身份,从而达到“可控匿名”的监管目的.分析和测试结果表明,方案设计的算法运算时间均为毫秒级,可满足区块链非高频交易场景下的性能需求.

一种改进的短签名云数据审计方案

随着物联网的发展,云存储数据产生了爆发式的增长,有效验证存储在云存储服务提供商上数据的完整性成为了一个重要问题。为解决已知的基于BLS短签名的数据完整性审计方案计算效率不高的问题,2019年ZHU等设计了基于ZSS短签名的数据完整性审计方案。但ZHU等的方案在挑战阶段生成的证据在运算上存在正确性问题,并且能对其进行重放攻击或者利用双线性映射特征进行攻击,从而通过第三方审计者的审计。通过改进挑战阶段证据的计算方法,优化验证阶段第三方审计者用于验证证据的双线性对等式,提出了优化的基于ZSS短签名的云数据审计方案。证明了改进后方案的正确性,弥补了原方案中存在的不足,同时分析了方案的安全性。改进的方案中不仅包括第三方审计者在内的攻击者无法恢复出用户数据,而且可以抵抗包括恶意云存储服务提供商在内的攻击者的重放攻击和伪造攻击。通过数值分析发现,计算开销变化不大,通信代价降低,比原方案提供了更好的计算准确性。