## 3 Proposed Method
### Process Design
#### 3.4.1. The Initialization Phase  
Initialization is primarily performed by the CA, which accepts the security parameter \(\lambda\). Let \(\mathbb{G}_{1}\) and \(\mathbb{G}_{2}\) be the additive cyclic group and the multiplicative cyclic group, \(\mathbf{G}\) be the elliptic curve group, \(\mathbf{G}\) be the generating element of the group \(\mathbf{G}\), \(\mathbf{H}\in\mathbf{G}\), and the discrete logarithm of \(\mathbf{H}\) is unknown. Choose two different generating elements \(P\) and \(q\) from \(\mathbb{G}_{1}\) and \(\mathbb{G}_{2}\), respectively, and choose the bilinear mapping \(e:\mathbb{G}_{1}\times\mathbb{G}_{1}\rightarrow\mathbb{G}_{2}\), two secure hash functions \(H_{1}:\,\{0,1\}^{*}\times\mathbb{G}_{1}\rightarrow\mathbb{Z}_{q}^{*}\) and \(H_{2}:\,\{0,1\}^{*}\times\mathbb{G}_{2}\rightarrow\mathbb{Z}_{q}^{*}\), and randomly choose \(s\in\mathbb{Z}_{q}^{*}\) as the private key \(sk_{\text{ca}}\) of the CA, and the public key \(pk_{\text{ca}}=sP\), \(sP\rightarrow\mathbb{G}_{1}\). Finally, the common parameter \(pp\) of the system is obtained :  
\[Gsetup\left(1^{\lambda}\right)\to pp \tag{1}\]  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Symbol** & **Meaning** \\ \hline (s\({}_{\text{a}}\), \(S_{\text{a}}\)) & The scan key pair of the recipient \\ (s\({}_{\text{b}}\), \(S_{\text{b}}\)) & The scan key pair of the sender \\ (b\({}_{\text{a}}\), \(B_{\text{a}}\)) & The spend key pair of the recipient \\ (b\({}_{\text{b}}\), \(B_{\text{b}}\)) & The spend key pair of the sender \\ \(note_{i}\) & The \(i\)-th note \\ \(T_{i}\) & The corresponding stealth address of the note \(note_{i}\) \\ \(t_{i}\) & The confirmation key corresponding to the stealth address \(T_{i}\) \\ (\(r_{i}\), \(R_{i}\)) & The temporary public–private key pair for the transaction \\  & corresponding to the note \(note_{i}\) \\ \(v_{i}\) & The value corresponding to the note \(note_{i}\) \\ \(c_{i}\) & The transaction shared key corresponding to the note \(note_{i}\) \\ \(C_{i}\) & Pedersen commitment to the amount \(v_{i}\) \\ \(\tau_{i}\) & Range proof for the amount \(v_{i}\) \\ \(h_{i}\) & The hash value corresponding to the note \(note_{i}\) \\ \hline \hline \end{tabular}
\end{table}
Table 1: Meaning of each symbol.  
Figure 2: Process of the BTPP method.  
where \(pp=(\lambda,\mathbb{G}_{1},\mathbb{G}_{2},e,P,q,pk_{\alpha},H_{1},H_{2})\). The system defines two large prime numbers \(p\) and \(a\), where \(p\) is a prime number, and \(a\) is a primitive root modulo \(p\). The transaction user provides unique identifier \(ID\) to the CA, and the CA generates the corresponding user key pair (\(pk\), \(sk\)) using the key generation algorithm _UserKenGen_:  
\[UserKeyGen(pp,pk_{\alpha},ID)\rightarrow(pk,sk) \tag{2}\]  
Suppose the public-private key pair of the transaction sender is \((pk_{\text{b}},sk_{\text{b}})\), the public-private key pair of the transaction receiver is \((pk_{\text{a}},sk_{\text{a}})\), and each transaction participant user publishes its public key \(pk\).  
The transaction user generates the dual key pairs, i.e., the scan key pair is (\(s\), \(S\)) and the spend key pair (\(b\), \(B\)), where \(S=s\cdot\)G, \(B=b\cdot\)G. Assume that the dual key pairs for the transaction sender are \((s_{\text{b}},S_{\text{b}})\) and \((b_{\text{b}},B_{\text{b}})\), and the dual key pairs for the transaction receiver are \((s_{\text{a}},S_{\text{a}})\) and \((b_{\text{a}},B_{\text{a}})\).