Traceability model based on improved witness mechanism

CAAI Transactions on Intelligence TechnologyVolume 7, Issue 3 p. 331-339 ORIGINAL RESEARCHOpen Access Traceability model based on improved witness mechanism Li Li, Corresponding Author Li Li 63451751@qq.com School of Information and Computer Engineering, Northeast Forestry University, Harbin, China Correspondence Li Li, School of Information and Computer Engineering, Northeast Forestry University, Harbin 150040, China. Email: 63451751@qq.comSearch for more papers by this authorTao Li, Tao Li orcid.org/0000-0001-7313-9431 School of Information and Computer Engineering, Northeast Forestry University, Harbin, ChinaSearch for more papers by this author Li Li, Corresponding Author Li Li 63451751@qq.com School of Information and Computer Engineering, Northeast Forestry University, Harbin, China Correspondence Li Li, School of Information and Computer Engineering, Northeast Forestry University, Harbin 150040, China. Email: 63451751@qq.comSearch for more papers by this authorTao Li, Tao Li orcid.org/0000-0001-7313-9431 School of Information and Computer Engineering, Northeast Forestry University, Harbin, ChinaSearch for more papers by this author First published: 13 July 2022 https://doi.org/10.1049/cit2.12124Citations: 1AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinked InRedditWechat Abstract Traceability system is one of the popular applications of graphic blockchains. However, there are centralisation problems and a long time for final consistency confirmation in the graphic blockchain. In addition, the blockchain system in the traceability application scenario has the problem of insufficient supervision. Therefore, a witness-based graphic blockchain consensus mechanism is proposed. In the consensus mechanism, a verifiable random function is used to screen the publishers of the unit; an SM2 threshold signature is used to sign the unit information to improve the non-repudiation of the traceability information uploaders to the unit information under the supervision of the witness. The improved consistency algorithm cancels the process of finding a stable main chain and makes relatively many nodes to participate in the consensus process. The experimental results show that the graphic blockchain using the improved witness mechanism can reduce the degree of centralisation, shorten the time for new units to reach consensus, and greatly ensure the security and scalability of the blockchain system. 1 INTRODUCTION With the development of information technology, modern service industries, such as e-commerce and finance, have developed rapidly and traceability applications have also developed vigorously. Traceability information stores product names, raw materials, production, and processing process, transportation, and other information in digital form. Traceability information can effectively help consumers master the details of the purchase and contribute to the efficient development of various industries. Storing traceability information through a traditional database will lead to high centralisation, which is not conducive to the maintenance of traceability information. In this regard, the characteristics of blockchain decentralisation, traceability, and non-tampering can meet the multi-layer requirements of traceability. As an emerging technology in recent years, blockchain technology [1] ensures decentralised point-to-point transactions without the participation of third parties through a new data structure, a distributed consensus mechanism, and its unique operation mechanism [2-4]. Based on the advantages of blockchain, a lot of researchers have put forward many blockchain schemes in information traceability. However, due to the performance limitations of the blockchain itself, most blockchain systems cannot provide high throughput and high scalability to meet the current processing requirements of large data volume or large transaction volume [5]. Existing research on blockchain-based traceability of wood crafts is still in the exploratory stage. Altaf Shaikh et al. [6] developed the Digital Art Blockchain trading system, which provides a transparent and traceable platform for both parties. Wang Ziyuan et al. [7] proposed ArtChain, a blockchain-based trading system that enables the registration of art assets, provenance, and traceability of trade history. Zhang Xiaotie et al. [8] proposed a system of agricultural product tracing using the PoW consensus mechanism. And Chen Fei et al. [9] proposed a system of food tracing using the PoW and PoS consensus mechanism. However, the above solutions still have the problem of low throughput when the data volume is large. And the supply chain of artworks is not traced safely. It means that the regulatory authorities cannot effectively supervise it. To solve the blockchain throughput problem, Yossi Gilad et al. [10] reduced the time of block consensus through the Algorand model. Byteball introduces a Directed Acyclic Graph (DAG) [11] structure into the blockchain system to improve system performance and scalability, but its witness mechanism is centralised. To solve the problem of the low performance of blockchain, a better way is to select the DAG blockchain. To address the centralisation issues, regulatory issues, and data security issues of traceability information in the blockchain system, the model in this paper proposes a consensus mechanism based on the DAG blockchain. This model uses the lottery algorithm to select the witness of units and reduce the centralisation of the blockchain. The blockchain realises the final consistency confirmation of units according to the unit level and the witness level. It can reduce the complexity of finding the only main chain in DAG as well as improve the throughput of the system; In addition, the regulatory authorities and units' publishers sign the SM2 threshold of the unit to improve the anti-repudiation of the traceability information. 2 RELATED WORK In this section, we summarise the preparatory work for this study, including DAG blockchains, consensus mechanisms, SM2 threshold signatures, and verifiable random functions. 2.1 DAG blockchain Using DAG as the underlying data structure of blockchain was first proposed by the NXT community in September 2013 [12]. Compared with the traditional blockchain, the graph blockchain innovates in the data layer and consensus layer. The graph blockchain changes the chain storage structure in the blockchain system into a DAG graph storage structure to solve the efficiency problem of the blockchain. A DAG is a directed data structure with a topological order. Due to the advantages of DAG topology, DAG is combined with the distributed ledger technology. The distributed ledger technology requires transactions to maintain a global order, and the DAG structure is suitable for preserving orderly information. The traditional blockchain connects coarse-grained blocks to form a single chain that cannot be tampered with. In the graphic blockchain, each transaction is the basic storage unit and the processing unit, which is equivalent to a fine-grained block. When a network node initiates a new transaction, the node creates a new transaction unit and needs to find two or more transactions in the network for verification. After the new unit validation unit is successful, the new unit only saves one transaction and the verified units' hash value. The verified units are parent units of the new transaction unit. The new unit points to its parent units through the saved hash values, and the DAG pattern blockchain is extended. The DAG data structure stores data in parallel. When the block packaging time remains unchanged, the blockchain network can package n blocks in parallel, which greatly improves the throughput efficiency and scalability of the blockchain. In this paper, units are used as the basic composition structure of the DAG blockchain. The DAG blockchain structure is shown in Figure 1. G is the creation unit, G is referenced by units A, B, and C, indicating that units A, B, and C have verified the legitimacy of creation unit G, and units D and E are unverified units, called tips. FIGURE 1Open in figure viewerPowerPoint Directed acyclic graph blockchain structure 2.2 Consensus (1) Pratic Byzantic Fault Torent (PBFT) [13, 14] was first applied in the distributed field to solve the consistency problem. The PBFT consensus mechanism requires that the number of all nodes be at least 3f + 1 (f is the number of fault nodes or evil nodes). Each block must be verified by at least 2f + 1 honest nodes. Each honest node confirms by signing that it has verified the legitimacy and effectiveness of transactions in the block. In the PBFT consensus mechanism, peer-to-peer (P2P) consensus synchronisation is required between nodes, which provides the final confirmation of the transaction. PBFT consensus does not have a bifurcation problem and has good resistance to double flower attacks. A PBFT protocol can avoid malicious attacks based on computing power, but the protocol communication overheads are high in its all-to-all message mode. (2) Witness consensus mechanism [15] is proposed in Byteball blockchain. When publishing transaction units, each user needs to specify 12 witnesses he/she trusts and write them into the witness list. Subsequently, a unit is selected as the best parent unit among the parent units of that unit based on the witnesses list. The path from the end unit in the DAG, back along the edge where the best parent unit is located until the creation unit, is called the main chain represented by that end unit. Depending on the density of the units issued by the witness, the consensus algorithm selects one of the main chains represented by different end units in the DAG as the system's main chain and determines the stability point on it. The units referenced by the stability point will get the confirmed index of the main chain and the transactions contained in these units will be confirmed. This consensus mechanism has some centralisation problems because it references 12 witnesses and the witnesses make unit releases. 2.3 SM2 threshold signature The SM2 threshold signature is a combination of the SM2 national cryptographic algorithm and gated cryptography [16]. The SM2 algorithm is a digital signature algorithm implemented using the elliptic curve, and its security is based on the elliptic curve discrete logarithm problem. The SM2 digital signature contains the signer's information in the preprocessing of the information to be signed by concatenating some information of the user itself and the parameters of the curve, the base point, and the public key point information of the user information. Gated cryptography [17] is based on secret sharing, and a gated secret sharing scheme can share a piece of secret information among several participants, and each secret computation requires the consent of multiple participants. The existing SM2 threshold signature scheme divides the user's private key into several copies and stores them in a distributed manner to avoid the risk that all private keys can be easily cracked by attackers. Thus, the SM2 threshold signature can improve the security and robustness of the algorithm. 2.4 Verifiable random function Verifiable random function (VRF) [18] is essentially a kind of pseudo-random function with a verification function for a specific input m and the private key sk of the input; VRF will output a random number v and a proof. The verifier can verify whether the random number is generated by the input through the three parts of the output random number, proof, and input. This process does not need to expose the private key of the input, so it is safe. VRF needs to satisfy three properties: verifiability, uniqueness, and pseudo-randomness. Verifiability means that v is the output corresponding to sk and m, which can be verified through proof. Certainty means that when sk and m are constant, the output v is also constant. Randomness means that the output v of VRF and a random number is indistinguishable from each other without a proof. After being proposed, verifiable random functions are generally used in key encapsulation, digital signature, and other fields. With the in-depth research on the blockchain technology in recent years, the characteristics of VRF make it begin to be applied in the design of consensus mechanisms. Yossi Gilad et al. combine verifiable random functions with the PBFT algorithm [19] in the Algorand. The VRF is used to select the block, and then a protocol similar to PBFT is used to vote through several rounds, and the voters in each round are also selected through the VRF. The consensus algorithm has high security and transaction speed. In 2016, the Dfinity [20] proposed by Timo Hanke et al. divided the nodes in the whole network into multiple groups of committees. Each member of the current committee responsible for block outgoing selects the block node using the VRF based on the boneh-lynn-shacham threshold signature algorithm [21] and then selects its next round of Committee responsible for block outgoing by the threshold relay technology [22] to achieve the purpose of generating blocks safely and quickly. It can be seen that the VRF has become an important tool for random selection of node identity in the non-interactive mode in the field of blockchain. 3 MODEL BUILDING In this section, we outline the traceability model based on the DAG blockchain, including data storage structure of units, SM2 threshold signature, and consensus mechanism. 3.1 Design of traceability mode In view of the low throughput of a single-blockchain and the multi-participant nature of the traceability system, the basic structure of the schematic blockchain used in the traceability model in this paper is transaction units. Each transaction unit expands the schematic blockchains according to the rules used by the parent and child. The interactive terminal of the model involves four organisations: manufacturers, market regulators, distributors, and consumers. Market regulators at all levels are witness nodes, store all information of the accounts, and achieve unit publishing and consistency confirmation. All witnesses form a witness list, which is maintained by all nodes in the blockchain. Manufacturer node and distributor node upload the source information. Consumer is a light node and queries the source information through an interactive terminal with the blockchain. The business logic diagram of the traceability model is shown in Figure 2. Each manufacturer sets a unique product number for each piece during production, which is used for uploading and querying the traceability information. Process 1 means that the manufacturer uploads the production information (including product number, product raw material information, processing information etc.), and the manufacturer node integrates the traceability information. In processes 2 and 3, units are generated through the units generation contract (due to different emphasis on innovation, the smart contract involved in this paper is not described in detail), and units are sent to the witness nodes. The uploading of the traceability information requires supervision by the regulatory department to ensure the non-repudiation of the information. Therefore, the witness nodes and manufacturers selected by the lottery algorithm carry out the SM2 threshold signature for the units. The SM2 threshold signature process is described in detail below. After that, the witness releases the unit to the DAG blockchain for consensus and completes the consistency confirmation in process 4. Process 5 means that the distributor uploads the circulation information according to the unique product number. Similarly, the witness and the information uploader jointly sign the threshold when uploading, and the witness releases the unit to the chain. Process 6 indicates that consumers can initiate a traceability information query request according to the product number. In addition, process 7 represents the relevant traceability information queried according to the product number in the DAG blockchain. Finally, process 8 indicates that the source information queried is integrated and returned to the consumer as a form. FIGURE 2Open in figure viewerPowerPoint Business logic diagram of the traceability model 3.2 Data storage structure of units Since a unit entering the DAG blockchain, it will be verified directly or indirectly by all connected units. If the content of the unit is to be modified, all the units that have verified it will need to be modified accordingly. The number of units to be modified will increase rapidly in a short time, making it impossible to modify the content of the unit. Units serve as the basic storage structure for this article's model, where the information contains the fields shown in Table 1. TABLE 1. Units data storage structure Field Type Signification Unit String The hash value of the unit Version String Protocol version number Parent_units String [ ] The hash value of parent units Address String Public key address of the information uploader Witness_address String Public key address of the witness Authors String Information of the SM2 threshold signature Message String Traceability information The following paper describes the fields in detail: (1) Unit: The hash value of the unit. Through the Hash256 operation on all other fields in the unit data structure, the value of a unit is obtained. (2) Version: Unit is parsed according to the version of the protocol. (3) Parent_units: Stores the hash value of the parent units verified by the unit. Parent_units indicates the reference relationship between the parent units and the unit. (4) Address: Trace the public key address of the information uploader. Through this public key address, the information uploader can be quickly confirmed. (5) Witness_address: Public key address of the witness indicates the witness who issued the unit and signed the unit. Witness_address is obtained by hashing the witness's address definition script (public key) and adding the check bit. (6) Authors: Authors represent the hash value of the parent unit verified by the unit, indicating the reference relationship between the parent unit and the unit. (7) Message: Message represents traceability information. Traceability information includes product number, product name, product raw materials, manufacturer information, circulation information etc. 3.3 SM2 threshold signature process Users send traceability information upload requests to the node through the client. The witness is selected according to the lottery algorithm, and witness node and user node sign the transaction unit in the SM2 threshold. Threshold cryptographic algorithms are usually expressed in the form (n, t), where n represents the number of participants, t is the threshold, and represents the minimum number of signers. The SM2 threshold signature scheme of (2, 2) is adopted in this model, and public parameters include (q, n, E, G), where q is a large prime number, E is an elliptic curve defined on the finite field Fq, and G is the base point on E. The SM2 threshold signature includes three parts: public key and private key share generation, threshold signature, and threshold decryption. The specific process of SM2 threshold signature is described as follows: 1) Public key and private key share generation: The user node and witness node generate random numbers d1 and d2, respectively, for d 1 , d 2 ∈ [ 1 , n − 1 ] $\left({d}_{1},{d}_{2}\in [1,n-1]\right)$ , where d1 is the private key component of the user node and d2 is the private key component of the witness node. The user node calculates the inverse element d 1 − 1 mod n ${d}_{1}^{-1}\mathrm{mod}n$ of d1 on Fq and calculates P 1 = d 1 − 1 G ${P}_{1}=\left[{d}_{1}^{-1}\right]G$ . The user node sends P1 to the witness node, and then the witness node receives P1. Then, the witness node calculates the inverse element d 2 − 1 mod n ${d}_{2}^{-1}\mathrm{mod}n$ of d2 on Fq and calculates P = d 2 − 1 P 1 − G $P=\left[{d}_{2}^{-1}\right]{P}_{1}-G$ , where P is the public key. 2) Threshold signature: The message to be signed is M, which includes Message. The process of threshold signature is as follows: (1) user node calculates M ′ = Z ‖ M ${M}^{\prime }=Z{\Vert}M$ and the message summary e = Hash M ′ $e=\text{Hash}\left({M}^{\prime }\right)$ and generates a random number k1, where k 1 ∈ [ 1 , n − 1 ] ${k}_{1}\in [1,n-1]$ . Then, the user node calculates Q1 = [k1]G. (2) user node sends e and Q1 to the witness node. The witness node generates a random number k2, where k 2 ∈ [ 1 , n − 1 ] ${k}_{2}\in [1,n-1]$ . Then, the witness node calculates Q2 = [k2]G. (3) witness node generates a random number k3, where k 3 ∈ [ 1 , n − 1 ] ${k}_{3}\in [1,n-1]$ , and calculates x 1 , y 1 = k 3 Q 1 + Q 2 $\left({x}_{1},{y}_{1}\right)=\left[{k}_{3}\right]{Q}_{1}+{Q}_{2}$ , r = x 1 + e mod n $r=\left({x}_{1}+e\right)\mathrm{mod}n$ . (4) If r ≠ 0, the witness node calculates r, s2, s3, where s 2 = d 2 ⋅ k 3 ${s}_{2}={d}_{2}\cdot {k}_{3}$ , s 2 = d 2 ⋅ r + k 2 mod n ${s}_{2}={d}_{2}\cdot \left(r+{k}_{2}\right)\mathrm{mod}n$ . Then, the witness node sends r, s2, and s3 to the user node. (5) user node calculates s = d 1 ⋅ k 1 ⋅ s 2 + d 1 ⋅ s 3 − r $s=\left({d}_{1}\cdot {k}_{1}\right)\cdot {s}_{2}+{d}_{1}\cdot {s}_{3}-r$ . If s ≠ 0 and s ≠ (n−r), then (r, s) is outputted as the signature result. 3) Threshold decryption: Set ciphertext to C = C 1 ‖ C 2 ‖ C 3 $C={C}_{1}{\Vert}{C}_{2}{\Vert}{C}_{3}$ , klen is the bit length of C2. The specific decryption process of ciphertext C is as follows: (1) user node changes the data type of C1 to a point on an elliptic curve and checks whether it is an infinite point on an elliptic curve. If it is not, the user node calculates T 1 = d 1 − 1 ⋅ C 1 ${T}_{1}={d}_{1}^{-1}\cdot {C}_{1}$ and sends T1 to the witness node. (2) witness node calculates T 2 = d 2 − 1 ⋅ T 1 ${T}_{2}={d}_{2}^{-1}\cdot {T}_{1}$ and then s sends T2 to the user node. (3) user node calculates (x2, y2) and t, where (x2, y2) = T2 − C1 and t = KDF x 2 ‖ y 2 , k len $t=\text{KDF}\left({x}_{2}{\Vert}{y}_{2},{k}_{\text{len}}\right)$ . If t = 0, exit with error. If t ≠ 0, get C2 from ciphertext. Then, the user node calculates M ′ = C 2 ⊕ t ${M}^{\prime }={C}_{2}\oplus t$ and u = Hash x 2 ‖ M ′ ‖ y 2 $u=\text{Hash}\left({x}_{2}{\Vert}{M}^{\prime }{\Vert}{y}_{2}\right)$ and gets C3 from ciphertext. If u = C3, then M ′ ${M}^{\prime }$ is outputted as a plaintext. 3.4 Consensus mechanism 3.4.1 Lottery algorithm The model in this paper adopts the lottery algorithm based on a verifiable function [23] to select the publisher of the unit from the witnesses. Regulatory authorities at all levels are used as witness nodes to form a relatively weak inequality before the node, but it greatly ensures security and scalability and facilitates the supervision of regulatory authorities. The input of the lottery algorithm is the user's private key sk, random seed seed, productId, threshold t, user weight w, and total weight W. The threshold determines the number of nodes selected as the unit publisher. Initial random seed is generated by the creation unit and updated with the generation of the unit. The user u who proposes the new unit also proposes the seed value used by the corresponding unit in the next stage, that is, < s e e d , π > ← V R F s k u s e e d r − 1 ‖ r $< seed,\pi > {\leftarrow}VR{F}_{s{k}_{u}}\left(see{d}_{r-1}{\Vert}r\right)$ and B ( k ; w , p ) = w k p k ( 1 − p ) w − k $B(k;w,p)=\left(\begin{array}{l}w\hfill \\ k\hfill \end{array}\right){p}^{k}{(1-p)}^{w-k}$ . Finally, the algorithm returns a hash value, π, and j, where π is a certificate. If j > 0, it indicates that the witness node is a candidate unit publishing node, and the witness is added to the witness candidate list. The specific algorithm is shown in Algorithm 1. Algorithm 1. Inputs: sk,seed,t,productId,w,W Output: <hash,π,j> <hash, π> ← V R F s k ( s e e d | | p r o d u c t I d ) $VR{F}_{sk}(seed\vert \vert productId)$ ; p ← t W $\frac{t}{W}$ ; i ← 0; while h a s h 2 h a s h L e n ∉ ∑ k = 0 j B ( k ; w , p ) , ∑ k = 0 j + 1 B ( k ; w , p ) do $\frac{hash}{{2}^{hashLen}}\notin \left[\sum\limits _{k=0}^{j}B(k;w,p),\sum\limits _{k=0}^{j+1}B(k;w,p)\right]\hspace*{.5em}\text{do}$ j++; return <hash, π, j>; Witness nodes selected according to Algorithm 1 send the public key addresses to the user node, and the user node verifies it. The verification algorithm is shown in Algorithm 2. Algorithm 2. VerifyDraws Inputs: pk,hash,π,seed,productId,w,W Output: j if V e r i f y V R F p k ( h a s h , π , s e e d | | p r o d u c t I d ) $\text{if}\hspace*{.5em}Verify\hspace*{.5em}VR{F}_{pk}(hash,\pi ,seed\vert \vert productId)$ then return 0; p ← t W $\frac{t}{W}$ ; j ← 0; while h a s h 2 h a s h L e n ∉ ∑ k = 0 j B ( k ; w , p ) , ∑ k = 0 j + 1 B ( k ; w , p ) do $\frac{hash}{{2}^{hashLen}}\notin \left[\sum\limits _{k=0}^{j}B(k;w,p),\sum\limits _{k=0}^{j+1}B(k;w,p)\right]\hspace*{.5em}\text{do}$ j++; return 0; In the end, the user node selects the witness node with the largest weight in the witness candidate list as the publishing node of the unit. If the weight is the same, select the witness node verified first. 3.4.2 Conformance confirmation The graphical blockchain of this model improves the witness consensus mechanism of Byteball. There is no unique main chain in this model. The search for the unique main chain will result in very high communication costs. This model completes the final consistency confirmation of the unit through the consensus of the witnesses on the main chain. The method used in this model does not need to find a unique main chain, only at least two-thirds of the witness nodes directly or indirectly validate the unidentified tips. The specific process is as follows: (1) Parameters description: I(v) represents the node that has issued unit v, W represents a collection of witness nodes, Tips represent unacknowledged units, level represents the unit level (the longest path from the current unit to the creation unit), and WL represents the witness level. (2) For v 0 ∈ Tips ${v}_{0}\in \text{Tips}$ , and one of the paths from g to v0 is P ( f ) = g , e , ... , f , v 0 $P(f)=\left(g,e,...,f,{v}_{0}\right)$ , f is the parent unit referenced by v0. If ∃ r ∈ P ( f ) $\exists r\in P(f)$ and I r ∈ W v 0 ${I}_{r}\in {W}_{v0}$ such that card ( S ) = ⌊ | W I ( v ) 2 | ⌋ + 1 $\text{card}(S)=\lfloor \vert \frac{{W}_{I(v)}}{2}\vert \rfloor +1$ , where S = I ( y ) | y ∈ r , e i , ... , f ∩ W I ( v ) $S=\left\{I(y)\vert y\in \left(r,{e}_{i},...,f\right)\right\}\cap {W}_{I(v)}$ , then the witness level of P(f) is WL P ( f ) = level r ${\text{WL}}_{P(f)}={\text{level}}_{r}$ . Otherwise, WL P ( f ) = level g = 0 ${\text{WL}}_{P(f)}={\text{level}}_{g}=0$ . (3) If u is a subunit of f, then WL u = max WL ( P ) | P = g , e 1 , e 2 , ... , e i − 1 , f , u ${\text{WL}}_{u}=\mathrm{max}\left\{\text{WL}(P)\vert P=\left(g,{e}_{1},{e}_{2},...,{e}_{i-1},f,u\right)\right\}$ . We can know from this that except Tips, each unit has a witness level. (4) For v ∈ V $v\in V$ and f ∈ Q ( v ) = u | u ∈ A , | W I ( u ) − W I ( v ) | ≤ 1 $f\in Q(v)=\left\{u\vert u\in A,\vert {W}_{I(u)}-{W}_{I(v)}\vert \le 1\right\}$ , where A is the parent units set of v. For ∀ u $\forall u$ , if WLf ≥ WLu, we call f is the best parent unit of v. (5) For u ∈ Tips $u\in \text{Tips}$ , if in path P = e 1 , e 2 , ... , e i − 1 , e i $P=\left({e}_{1},{e}_{2},...,{e}_{i-1},{e}_{i}\right)$ , where e1 is the creation unit and ei is the unit v. For k ∈ 1,2 , ... , i − 1 $k\in 1,2,...,i-1$ , if satisfies the condition that ek is the best parent unit of ek+1, we call path P is a main chain l. (6) If there is a main chain l = g , e 1 , ... , e h , ... , e i , u $l=\left(g,{e}_{1},...,{e}_{h},...,{e}_{i},u\right)$ , where u ∈ Tips $u\in \text{Tips}$ and v is the parent unit of eh. If v ∈ l $v\in l$ and WL ( l ) − WL e h ( v ) ≥ ⌊ 2 W 3 ⌋ $\text{WL}(l)-{\text{WL}}_{{e}_{h}}(v)\ge \lfloor \frac{2W}{3}\rfloor $ , | I ( t ) | t ∈ v , ... , e i , u ∩ W | ≥ 2 | W [ I ( v ) ] | $\vert \left\{I(t)\vert t\in \left(v,...,{e}_{i},u\right)\right\}\cap W\vert \ge 2\vert W[I(v)]\vert $ , we say that v is finalised. 4 EXPERIMENT AND ANALYSIS In this section, we give the functional analysis, security analysis, and performance analysis of the concrete scheme. 4.1 Functional ana