# Supervised Blockchain Anonymous Transaction Model Based on Certificateless Signcryption
## 5 Concrete Scheme  
### Specific Transaction Process  
Taking the example of [PERSON] paying a transaction amount \(v_{0}\) to [PERSON], before the transaction, the local account balances of [PERSON] and [PERSON] are \(v_{A}\) and \(v_{B}\), respectively. After the transaction, [PERSON]'s local account balance is updated to \(v^{\prime}_{A}=v_{A}-v_{0}\), and [PERSON]'s local account balance is updated to \(v^{\prime}_{B}=v_{B}+v_{0}\). To protect account privacy, the account balances of [PERSON] and [PERSON] are stored on the blockchain using Paillier homomorphic encryption, i.e., \(c_{A}=Enc_{PK_{R}}(v_{A})\) and \(c_{B}=Enc_{PK_{R}}(v_{B})\). The transaction model is shown in Figure 1.  
1. \(Setup(1^{k})\rightarrow(PP)\) : Algorithm 1 is invoked by the KGC and MR. Given the security parameter \(k\), select an elliptic curve addition cyclic group \(G\) of order \(q\), with P as the generator of \(G\). The KGC randomly selects \(s\in Z_{q}^{*}\) as the system master private key and computes \(P_{pub}=sP\) as the system master public key. The MR ran  
Figure 1: Transaction model. domly selects \(r\in Z_{q}^{*}\) as the tracing key and computes \(M_{pub}=rP\) as the tracing public key. The KGC and MR select five hash functions: \(H:G\times G\times G\times\{0,1\}^{*}\to Z_{q}^{*}\), \(H_{1}:\{0,1\}^{*}\times G\times G\to Z_{q}^{*}\), \(H_{2}:\{0,1\}^{*}\times G\times G\times G\to Z_{q}^{*}\), \(H_{3}:G\times\{0,1\}^{*}\times G\times G\to Z_{q}^{*}\), \(H_{4}:\{0,1\}^{*}\times\{0,1\}^{*}\times G\times G\times\{0,1\}^{*}\to Z_{q}^{*}\). The KGC publishes \(PP=\{G,q,P,P_{pub},M_{pub},\allowbreak H,H_{1},H_{2},H_{3},H_{4}\}\), where the system master private key \(s\) is secretly kept by the KGC, and \(r\) is secretly kept by the MR.  
1. \(\text{Input: }k\)  
Output: \(PP,s,r\)  
1. KGC selects an elliptic curve addition cyclic group \(G\) of order \(q\), with P as the generator of \(G\). 2. KGC selects \(s\in Z_{q}^{*}\) as the primary private key. 3. Calculate \(P_{pub}=sP\) as the system's main public key. 4. MR selects \(r\in Z_{q}^{*}\) as the tracking key. 5. Calculate \(M_{pub}=rP\) as the tracking public key. 6. KGC and MR Jointly define hash function:  
\(H:G\times G\times G\times\{0,1\}^{*}\to Z_{q}^{*}\);  
\(H_{1}:\{0,1\}^{*}\times G\times G\to Z_{q}^{*}\);  
\(H_{2}:\{0,1\}^{*}\times G\times G\times G\to Z_{q}^{*}\);  
\(H_{3}:G\times\{0,1\}^{*}\times G\times G\to Z_{q}^{*}\);  
\(H_{4}:\{0,1\}^{*}\times\{0,1\}^{*}\times G\times G\times\{0,1\}^{*}\to Z_{q}^{*}\). 7. KGC discloses security parameters: \(PP=\{G,q,P,P_{pub},M_{pub},H,H_{1},H_{2},H_{3},H_{4}\}\)  
8. KGC Keeps \(s\) in secret. 9. MR Keeps \(r\) in secret. 1. \(CreateAddr(EID_{i,1},\alpha_{i})\to addr_{i}\): Algorithm 2 is invoked by the transaction user and the regulatory authority. The transaction user randomly selects \(e_{i}\in Z_{q}^{*}\), computes the partial anonymous identity \(EID_{i,1}=e_{i}P\), and the identity index \(\alpha_{i}=e_{i}M_{pub}\oplus RID_{i}\). The user then sends \(\{\alpha_{i},EID_{i,1}\}\) to MR. Subsequently, MR computes \(RID_{i}=\alpha_{i}+rEID_{i,1}\) to retrieve the real identity of the transaction user, computes the partial anonymous identity \(EID_{i,2}=RID_{i}\oplus H(rEID_{i,1}||EID_{i,1}||M_{pub}||VM_{i})\), and generates the transaction user's anonymous identity address \(addr_{i}=EID_{i}=\{EID_{i,1},EID_{i,2}\}\), where \(VM_{i}\) represents the validity period of the anonymous identity. Send \(EID_{i}\) to KGC. Simultaneously, MR establishes a user anonymous identity traceability table EIDList, storing the user's anonymous identity identifier and identity index \(\alpha_{i}\). [PERSON] and [PERSON] randomly select \(v_{A}\in Z_{q}^{*}\) and \(v_{B}\in Z_{q}^{*}\), respectively, compute \(EID_{A,1}=e_{A}P\) and \(EID_{B,1}=e_{B}P\). MR then computes their respective anonymous identity addresses, \(addr_{A}=EID_{A}=\{EID_{A,1},EID_{A,2}\}\) and \(addr_{A}=EID_{A}=\{EID_{A,1},EID_{A,2}\}\). 1. \(\text{Input: }EP_{i,1},\alpha_{i}\)  
Output: \(addr_{i}\)  
1.