  By allowing users to obscure their transactions via including "mixins" (chaff
coins), ring signature schemes have been widely used to protect a sender's
identity of a transaction in privacy-preserving blockchain systems, like Monero
and Bytecoin. However, recent works point out that the existing ring signature
scheme is vulnerable to the "chain-reaction" analysis (i.e., the spent coin in
a given ring signature can be deduced through elimination). Especially, when
the diversity of mixins is low, the spent coin will have a high risk to be
detected. To overcome the weakness, the ring signature should be consisted of a
set of mixins with high diversity and produce observations having "similar"
distributions for any two coins. In this paper, we propose a notion, namely
$\epsilon$-coin-indistinguishability ($\epsilon$-CI), to formally define the
"similar" distribution guaranteed through a differential privacy scheme. Then,
we formally define the CI-aware mixins selection problem with disjoint-superset
constraint (CIA-MS-DS), which aims to find a mixin set that has maximal
diversity and satisfies the constraints of $\epsilon$-CI and the budget. In
CIA-MS-DS, each ring signature is either disjoint with or the superset of its
preceding ring signatures. We prove that CIA-MS-DS is NP-hard and thus
intractable. To solve the CIA-MS-DS problem, we propose two approximation
algorithms, namely the Progressive Algorithm and the Game Theoretic Algorithm,
with theoretic guarantees. Through extensive experiments on both real data sets
and synthetic data sets, we demonstrate the efficiency and the effectiveness of
our approaches.
