# Supervised Blockchain Anonymous Transaction Model Based on Certificateless Signcryption
## 5 Concrete Scheme
### Transaction Supervision  
The regulatory content of blockchain transactions encompasses transaction amounts and the authentic identity information of users. The CLSC_SAT model employs a multi-party collaboration framework for transaction supervision, where a primary regulator (MR) and \(n\) secondary regulators (\(SR_{i}\)) jointly oversee the entire transaction process to ensure transparency and compliance of all transactional data. The MR possesses a tracking key \(r\) and collaborates with \(SR_{i}\) to maintain the regulatory key \(\lambda\) through a threshold secret sharing scheme, enabling supervision of transaction content and identity tracing. The MR generates the regulatory key \(\lambda\) and distributes it to \(n\)\(SR_{i}\) by splitting \(\lambda\) into fragments \(\{\lambda_{1},\lambda_{2},\ldots,\lambda_{n}\}\) using a publicly verifiable threshold secret sharing scheme. During transactions, no single regulator, including the MR, can independently recover the key or conduct abnormal behavior tracing. The key distribution protocol is as follows:  
1. Supervision Key Distribution The MR selects a t \(-\) 1 degree polynomial \(f(x)=(\sum\limits_{i=0}^{t-1}a_{i}x^{i}modq)\) over \(Z_{q}^{*}\), sets \(a_{0}=\lambda\), and distributes the shared secret \(a_{i}=f(x_{i})\text{mod}q\) to \(SR_{i}(i=1,2,\ldots,n)\). The threshold value is t, satisfying \(1\leq t\leq n\leq q\). The MR computes and broadcasts the commitment \(c_{i}=g^{a_{i}}\in Z_{q}^{*},0\leq i\leq t-1\).
2. Supervision Key Verification Each \(SR_{i}\) verifies the validity of the received share by checking whether \(g^{a_{i}}=\prod\limits_{j=0}^{t-1}c_{j}^{i}modp_{i}(i=1,2,\ldots,n)\). If the equality fails, the share \(\alpha_{i}\) is deemed invalid.
3. Supervision Key Recovery When an abnormal transaction occurs, MR initiates a key recovery request to ensure that no less than \(t\) secondary regulator \(SR_{i}\) is involved. When the shared \(\lambda_{i}\) of all participating \(SR_{i}\) is verified as valid, \(SR_{i}\) uses the Lagrange polynomial interpolation method to calculate \(f(x)=\sum\limits_{i=1}^{t}a_{i}\prod\limits_{j=1,j\
eq i}^{t}\dfrac{x-x_{i}} {x_{i}-x_{j}}\) to obtain \(\lambda=f(0)\).  
When an abnormal transaction is detected, the main regulator (MR) initiates a key recovery request. No less than \(t\)\(SR_{i}\) recovers the regulatory key through the above process and calculates the transaction transfer amount:  
\[\begin{array}{ll}v^{\prime}_{0}&=L(c_{1}^{\lambda}\text{ mod }n^{2})\mu\text{ mod }n\\ &=L(g^{x_{0}}r_{1}^{n}\text{ mod }n^{2})\mu\text{ mod }n\end{array} \tag{12}\]  
Simultaneously, the MR retrieves the malicious user's \(EID_{i}\) and \(\alpha_{i}\) from the user anonymous identity traceability table EIDList (see Table 2). The MR uses the tracking private key \(r\) to compute \(RID_{i}=\alpha_{i}+rEID_{i,1}\) or \(RID_{i}=EID_{i,2}\oplus H(rEID_{i,1}||EID_{i,1}||M_{pub}\ ||VM_{i})\) to recover the malicious user's real identity \(RID_{i}\). This information is then uploaded to the smart contract to protect the legitimate rights and interests of other users. The supervision and tracing process is illustrated in Figure 2.