A loss-resistant and cloud-interventionable key storage method

Abstract

The present invention relates to a key storage method that is resistant to loss and can be intervened by the cloud, which is characterized by comprising the following steps: Step 1: The master client generates its own public and private key pair.<publickey,privatekey> ; Step 2, the main client splits the private key privatekey into two parts, Head and Body, and uploads the Head part to the cloud for storage; the cloud then establishes a database of the matching relationship between the main client's public key and the Head part of the private key; Step 3, the main client splits the body part of the private key into N parts, and then distributes the N shadows to the N auxiliary clients, and stipulates that the Body can only be restored if t auxiliary clients contribute their own saved shadows. The present invention solves the problem of cloud storage keys, excessive cloud responsibilities and risks, and also solves the problem of easy loss of client storage keys.

Description

Technical Field

[0001] The present invention belongs to the technical field of account transfer security, and in particular relates to a key storage method that is resistant to loss and can be intervened by the cloud. Background Art

[0002] In 2008, Satoshi Nakamoto published the famous paper "Bitcoin: A Peer-to-Peer Electronic Cash System", marking the official birth of blockchain technology. In order to support DAPP applications, Vitalik Buterin published the first version of the Ethereum white paper in 2013, introducing the concept of smart contracts. Since then, famous public chain platforms such as EoS and NEO, as well as alliance chain platforms such as Fabric, have been born. The development of these platforms has also given rise to the prosperity of DApp applications.

[0003] Early DApps were developed directly on the public chain, and later gradually adopted the BaaS architecture that is heavy on the cloud and light on the client. The cloud encapsulates blockchain technology into BaaS services and outputs them to various DApps. There is a key storage problem in the BaaS architecture. According to asymmetric cryptography, a pair of<publickey,privatekey> Key pair. This publickey is an address after some simple conversion, and the privatekey is extremely important, because the digital assets in this address are all protected by the privatekey. If the privatekey is stolen, the thief can transfer the assets in this address. If the privatekey is lost, the assets in this address can no longer be used, which is equivalent to being lost. Therefore, the storage and protection of the privatekey is an extremely important issue.

[0004] There are currently two popular ways to store privatekey: one is stored in the cloud, and the other is stored on the client. Figure 1 The following is the system framework for storing private keys in the cloud. If this method is used, all the private keys of each DApp registered user will be stored in the cloud. It is necessary to build and maintain a database in the cloud as shown in Table 1:

[0005] Table 1

[0006] DApp User ID (public key) User private key (ie privatekey) dapp1 id1_1 privatekey1_1 dapp1 id1_2 privatekey1_2 …… …… …… dapp2 id2_1 privatekey2_1 dapp2 id2_2 privatekey2_2 …… …… ……

[0007] like Figure 2 The specific workflow of the scheme shown is: when the client needs to perform a transfer operation, it needs to first request a private key from the cloud. When the client receives the private key returned by the cloud, it performs the transfer operation, and the private key is destroyed after use.

[0008] When using this method (storing private keys in the cloud), the cloud will have to bear great responsibility and take great risks, because it is equivalent to handing over all assets of all users to the cloud for storage. If the cloud is hacked and the private keys are leaked, it will cause property losses to all users. The cloud cannot afford this loss, so it is not recommended.

[0009] like Figure 3 The system framework in which the private key is stored on the client side is shown. If the private key is stored on the client side, it can indeed reduce the risk and responsibility of the cloud side. However, most customers are not professionals. It is easy for them to lose, damage or leak the private key due to carelessness when using dapp. The cloud side does not have a backup of the private key. Once it is damaged or lost, the user's assets will also be lost. Another drawback is that the cloud side cannot intervene in the user. The cloud side cannot intervene in any operation when the user performs any operation including transfer. In addition, it is not safe for the client to store the private key as a constant for a long time, which may be stolen by hackers or other forces.

[0010] Therefore, a proper storage method for private keys is needed to reduce the risks in the cloud and make it difficult for ordinary users to lose the keys while being able to be intervened by the cloud. Summary of the invention

[0011] In order to solve the above technical problems, the present invention provides a key storage method that is resistant to loss and can be intervened by the cloud.

[0012] In order to achieve the above object, the technical solution adopted by the present invention is as follows:

[0013] A key storage method that is resistant to loss and can be intervened by the cloud comprises the following steps:

[0014] Step 1: The master client generates its own public and private key pair using the key generation algorithm<publickey,privatekey> ;

[0015] Step 2: The master client uses secret splitting technology to split the private key into two parts, Head and Body, and uploads the Head part to the cloud for storage; the cloud then establishes a database of the matching relationship between the master client's public key and the Head part of the private key;

[0016] Step 3. The main client uses threshold secret sharing technology to split the body of the private key into N shadows, namely shadow1, shadow2, shadow3, ..., shadowN-1, shadowN; then distributes the N shadows to N auxiliary clients, and stipulates that the Body can be restored only if t auxiliary clients contribute their saved shadows, t≤N.

[0017] Furthermore, the key generation algorithm described in step 1 is an elliptic curve generation algorithm, which is as follows:

[0018] Given a large prime number p and its Galois field GF(p), define an elliptic curve E on this field: y 2 ≡x 3 +ax+bmodp, and specify x∈GF(p), y∈GF(p), a∈GF(p), b∈GF(p), then there will be a finite number of discrete points on it, plus the infinite point θ=(∞,∞), then the set Defining the point addition operation + of the elliptic curve on this set of points forms a cyclic group with an order of n, which must be a large prime number;

[0019] Point G is the generator of the point cyclic group on this elliptic curve; It is a cyclic multiplicative group of contraction residue class induced by prime number n;

[0020] The key generation algorithm is:

[0021] Step A: Pick a random number Then d is the private key privatekey;

[0022] Step B: Calculate point Q = dG, then point Q is the public key publickey.

[0023] Furthermore, the secret splitting technology described in step 2 can split the 256-bit private key into a 256-bit Head part and a 256-bit Body part. The specific method is as follows:

[0024] Step a: The master client generates a 256-bit random number, which is the Head part;

[0025] Step b: The master client calculates the Body based on the Head and privatekey; the formula is: Body = privatekey^Head; ^ is a bitwise XOR operation.

[0026] Furthermore, the threshold secret sharing technology described in step 3 is as follows:

[0027] Step 1) First, the primary client selects N and t according to its needs, where N represents the number of auxiliary clients it is willing to distribute shadows to, and t represents the minimum number of shadows required to restore the Body;

[0028] Step 2), then select a large prime number p and its Galois field GF(p), on which there is a corresponding contraction residue class cyclic multiplication group Pick a random number Remember M = Body, construct a two-variable first-order congruence equation y = (a t-1 x t-1 +a t-2 x t-2 +······+a2x 2 +a1x 1 +M)modP, this equation will determine a curve on a two-dimensional plane;

[0029] Step 3) Select N points (x1, y1), (x2, y2), ..., (x N ,y N ), so that 1≤i≤N; then a t-1 ,a t-2 ,······,a2,a1 are discarded, and (x1,y1) is sent as the first shadow shadow1 to auxiliary client 1, and (x2,y2) is sent as the second shadow shadow2 to auxiliary client 2, ······, (x N ,y N ) is sent to auxiliary client N as the Nth shadow shadowN, thus completing the threshold secret sharing algorithm and sharing the secret M with N auxiliary clients.

[0030] Furthermore, step 4 is also included. When the master client needs to use the private key, the mechanism workflow is started to restore the private key.

[0031] Furthermore, the workflow of the mechanism specifically includes the following steps:

[0032] Step (1), the primary client broadcasts to all N auxiliary clients to which it distributes shadow, requesting shadow;

[0033] Step (2), the main client monitors the replies of N auxiliary client users until it receives t replies from Shadow, t≤N, and then stops monitoring;

[0034] Step (3), the master client uses the received t shadows to restore the body using the inverse threshold secret sharing algorithm;

[0035] Step (4), the main client requests Head from the cloud;

[0036] Step (5), the cloud returns the Head corresponding to the master client to the master client;

[0037] Step (6): The master client uses the Head and Body parts to recover the private key Privatekey using the inverse secret splitting algorithm.

[0038] Furthermore, the inverse threshold secret sharing algorithm in step (3) is specifically:

[0039] After the main client retrieves t copies of shadow, it can write t linear equations with t variables. These t equations form a linear equation system with t variables. And this system of equations has one and only one solution; finding this solution can give a t-1 ,a t-2 ,······,a2,a1,M values, thereby restoring Body=M.

[0040] Furthermore, the reverse secret splitting algorithm described in step (6) can recover the privatekey based on the Body and Head;

[0041] The inverse secret splitting algorithm formula is:

[0042] Body^head=privatekey^Head^Head=privatekey^(Head^Head)=privatekey; ^ is a bitwise XOR operation.

[0043] Furthermore, in step 4, when the master client needs to use the private key, it uses the private key to transfer money, and also includes step 5, in which the master client uses the private key privatekey to sign offline, sends the signature string to the blockchain network, and the blockchain network confirms the legitimacy of the signature string, packages the signature data into the block, and completes the transfer process. The transfer process uses the transfer algorithm to complete the transfer transaction.

[0044] Compared with the prior art, the present invention has the following beneficial effects:

[0045] The present invention solves the problem of excessive cloud-side responsibility and risk in storing keys in the cloud, and also solves the problem of easy loss of keys stored on the client. The technical solution of the present invention can achieve the following invention purposes at the same time:

[0046] (1) The cloud does not store the user’s private keys, which eliminates the risks in the cloud and makes the cloud less responsible.

[0047] (2) The client does not store the user's private key, which makes the client more secure.

[0048] (3) The use of private keys requires interaction between the cloud and the client. This gives the cloud a certain degree of intervention in the client, that is, if the client wants to obtain the private key to perform operations such as transfers, it must obtain the cooperation of the cloud.

[0049] (4) It can resist loss to a certain extent, that is, the body of the user's private key is divided into N shadows and stored by N auxiliary clients, where N can be very large, such as 1000. If the threshold is set to t, for example, t = 3, then even if 997 copies are lost, as long as there are 3 key shadows left, the body of the private key can be restored. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 A system framework diagram for storing private keys in the cloud in the prior art;

[0051] Figure 2 The workflow of storing private keys in the cloud in the prior art;

[0052] Figure 3 This is a system framework diagram of storing private keys on the client in the prior art;

[0053] Figure 4 A flowchart of an embodiment of the present invention;

[0054] Figure 5 This is a schematic diagram of splitting a body into shadows in one embodiment of the present invention. DETAILED DESCRIPTION

[0055] The present invention is further described in detail below with reference to the embodiments.

[0056] Figure 4 An embodiment of a key storage method that is loss-resistant and cloud-interventionable according to the present invention is shown, and specifically includes the following steps:

[0057] Step 1: The master client generates its own public and private key pair using the key generation algorithm<publickey,privatekey> ;

[0058] Step 2: The master client uses secret splitting technology to split the private key privatekey into two parts, Head and Body, and uploads the Head part to the cloud for storage; the cloud then establishes a database of the matching relationship between the master client's public key and the private key Head part, see Table 2;

[0059] Table 2

[0060] DApp User ID (public key) User private keyhead dapp1 id1_1 Head1_1 dapp1 id1_2 Head1_2 …… …… …… dapp2 id2_1 Head2_1 dapp2 id2_2 Head2_2 …… …… ……

[0061] Step 3. The main client uses threshold secret sharing technology to split the body of the private key into N (for example, N=5) shadows, namely shadow1, shadow2, shadow3,..., shadowN-1, shadowN; then distributes the N shadows to N auxiliary clients, and stipulates that as long as t auxiliary clients contribute their own saved shadows, t≤N (for example, t=3), the Body can be restored.

[0062] As a preferred embodiment of a key storage method that is resistant to loss and cloud-interventionable of the present invention, the key generation algorithm described in step 1 adopts an elliptic curve generation algorithm, which is as follows:

[0063] Given a large prime number p and its Galois field GF(p), define an elliptic curve E:y over this field 2 ≡x 3 +ax+bmodp, and specify x∈GF(p), y∈GF(p), a∈GF(p), b∈GF(p), then there will be a finite number of discrete points on it, plus the infinite point θ=(∞,∞), then the set Defining the point addition operation + of the elliptic curve on this set of points forms a cyclic group with an order of n, which must be a large prime number;

[0064] Point G is the generator of the point cyclic group on this elliptic curve; It is a cyclic multiplicative group of contraction residue class induced by prime number n;

[0065] The key generation algorithm is:

[0066] Step A: Pick a random number Then d is the private key privatekey;

[0067] Step B: Calculate point Q = dG, then point Q is the public key publickey.

[0068] Furthermore, the elliptic curve is secp256k1, and the parameters are specified as follows:

[0069] p=FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFEFFFFFC2F

[0070] =2 256 -2 32 -2 9 -2 8 -2 7-2 6 -2 4 -1

[0071] a=00000000 00000000 00000000 00000000 00000000 00000000 0000000000000000

[0072] b=00000000 00000000 00000000 00000000 00000000 00000000 0000000000000007

[0073] G=02 79BE667E F9DCBBAC 55A06295 CE870B07 029BFCDB 2DCE28D9 59F2815B16F81798

[0074] n=FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8CD0364141

[0075] h=01

[0076] As a preferred embodiment of a key storage method that is resistant to loss and can be intervened by the cloud, the secret splitting technology described in step 2 can split the 256-bit private key into a 256-bit Head part and a 256-bit Body part. The specific method is as follows:

[0077] Step a: The master client generates a 256-bit random number, which is the Head part;

[0078] Step b: The master client calculates the Body based on the Head and privatekey, the formula is: Body = privatekey^Head;

[0079] ^ is the bitwise exclusive OR operation.

[0080] As a preferred embodiment of a key storage method that is resistant to loss and can be intervened by the cloud in the present invention, the threshold secret sharing technology in step 3 is specifically as follows:

[0081] Step 1), first the main client selects N and t according to its own needs, where N represents the number of auxiliary clients it is willing to distribute shadows to, and t represents the minimum number of shadows required to restore the Body, that is, the minimum number of shadows required to restore the Body;

[0082] Step 2), then select a large prime number p and its Galois field GF(p), on which there is a corresponding contraction residue class cyclic multiplication group Pick a random number Remember M = Body, construct a two-variable first-order congruence equation y = (a t-1 x t-1 +a t-2 x t-2 +······+a2x 2 +a1x 1 +M)modP, this equation will determine a curve on a two-dimensional plane;

[0083] Step 3) Select N points (x1, y1), (x2, y2), ..., (x N ,y N ), so that 1≤i≤N; then a t-1 ,a t-2 ,······,a2,a1 are discarded, and (x1,y1) is sent as the first shadow shadow1 to auxiliary client 1, and (x2,y2) is sent as the second shadow shadow2 to auxiliary client 2, ······, (x N ,y N ) is sent to auxiliary client N as the Nth shadow shadowN, thus completing the threshold secret sharing algorithm and sharing the secret M with N auxiliary clients.

[0084] As a further technical solution of the key storage method that is resistant to loss and can be intervened by the cloud of the present invention, it also includes step 4, when the main client needs to use the private key, the mechanism workflow is started to restore the private key.

[0085] Furthermore, the workflow of the mechanism specifically includes the following steps:

[0086] Step (1), the primary client broadcasts to all N (for example, N=5) secondary clients that distribute shadow to it, requesting shadow;

[0087] Step (2), the main client monitors the replies of N auxiliary client users until it receives t replies from Shadow, and stops monitoring when t≤N (for example, t=3);

[0088] Step (3), the master client uses the received t shadows to restore the body using the inverse threshold secret sharing algorithm;

[0089] Step (4), the main client requests Head from the cloud;

[0090] Step (5), the cloud returns the Head corresponding to the master client to the master client;

[0091] Step (6): The master client uses the Head and Body parts to recover the private key Privatekey using the inverse secret splitting algorithm.

[0092] The inverse threshold secret sharing algorithm in step (3) is specifically:

[0093] After the main client retrieves t copies of shadow, it can write t linear equations with t variables. These t equations form a linear equation system with t variables. And this system of equations has one and only one solution; finding this solution can give a t-1 ,a t-2 ,······,a2,a1,M values, thereby restoring Body=M.

[0094] Among them, the reverse secret splitting algorithm in step (6) can recover the privatekey according to the Body and Head; the reverse secret splitting algorithm formula is:

[0095] Body^head=privatekey^Head^Head=privatekey^(Head^Head)=privatekey; ^ is a bitwise XOR operation.

[0096] As a further technical solution of a key storage method that is resistant to loss and cloud-interventionable of the present invention, in step 4, when the main client needs to use the private key, it uses the private key to transfer money, and also includes step 5, in which the main client uses the private key privatekey to sign offline, sends the signature string to the blockchain network, and the blockchain network confirms the legitimacy of the signature string, packages the signature data into a block, and completes the transfer process. The transfer process uses a transfer algorithm to complete the transfer transaction.

[0097] Furthermore, the transfer algorithm is as follows:

[0098] Step ①: Given the address of the recipient and the amount of digital assets to be transferred, these information constitute the message M. Use the hash algorithm H to process M to obtain the summary e, that is, e = H (M), so that

[0099] Step 2: Randomly select Calculation point K = kG;

[0100] Step ③ Calculate r = x k modn=x kG modn, that is, r is the remainder of the horizontal coordinate of point K modulo n;

[0101] Step ④ Calculate k -1 modn;

[0102] Step 5: Calculate s=k -1 (e+rd)modn;

[0103] The master client's signature on the message M is (r, s). After completing this signature, the master client's digital assets will be transferred to the recipient's address.

[0104] From the above description, we can know that the private key in the present invention is stored separately, one part is placed in the cloud, and the other part is placed in the hands of N auxiliary clients. As long as t (t can be much smaller than N) of these N auxiliary clients are not lost, the key can be eventually recovered. Therefore, the present invention is a key storage solution that is resistant to loss to a large extent. Because the recovery of the key must interact with the cloud and obtain the cooperation of the cloud, the cloud has certain restrictive rights over the customer; therefore, the present invention solves the problem of excessive cloud responsibility and risk when storing keys in the cloud, and at the same time, it also solves the problem of easy loss of keys stored on the client.

[0105] The above-described embodiments are only preferred embodiments of the present invention, and are not exhaustive of the feasible implementations of the present invention. For those skilled in the art, any obvious changes made thereto without departing from the principles and spirit of the present invention should be considered to be included in the scope of protection of the claims of the present invention.

Claims

1. A key storage method that is resistant to loss and cloud-interventionable, characterized in that: The specific steps include: Step 1: The master client generates its own public and private key pair using the key generation algorithm<publickey,privatekey> ; Step 2: The master client uses secret splitting technology to split the private key into two parts, Head and Body, and uploads the Head part to the cloud for storage; the cloud then establishes a database of the matching relationship between the master client's public key and the Head part of the private key; Step 3. The main client uses threshold secret sharing technology to split the body of the private key into N shadows, namely shadow1, shadow2, shadow3, ..., shadowN-1, shadowN; then distributes the N shadows to N auxiliary clients, and stipulates that the body can be restored only if t auxiliary clients contribute their saved shadows, t≤N; Given a large prime number p and its Galois field GF(p), define an elliptic curve E:y over this field 2 ≡x 3 +ax+bmodp, and specify x∈GF(p), y∈GF(p), a∈GF(p), b∈GF(p), then there will be a finite number of discrete points on it, plus the infinite point θ=(∞,∞), then the set Defining the point addition operation + of the elliptic curve on this set of points forms a cyclic group with an order of n, which must be a large prime number; Point G is the generator of the point cyclic group on this elliptic curve; It is a cyclic multiplicative group of contraction residue class induced by prime number n; The key generation algorithm is: Step A: Pick a random number Then d is the private key privatekey; Step B, calculate point Q = dG, then point Q is the public key publickey; The secret splitting technology described in step 2 can split the 256-bit private key into a 256-bit Head part and a 256-bit Body part. The specific method is as follows: Step a: The master client generates a 256-bit random number, which is the Head part; Step b: The main client calculates the Body based on the Head and privatekey; the formula is: Body = privatekey ^ Head; ^ It is a bitwise XOR operation; The threshold secret sharing technology described in step 3 is as follows: Step 1) First, the primary client selects N and t according to its needs, where N represents the number of auxiliary clients it is willing to distribute shadows to, and t represents the minimum number of shadows required to restore the Body; Step 2), then select a large prime number p and its Galois field GF(p), on which there is a corresponding contraction residue class cyclic multiplication group Pick a random number Remember M = Body, construct a two-variable first-order congruence equation y = (a t-1 x t-1 +a t-2 x t-2 +······+a2x 2 +a1x 1 +M)modP, this equation will determine a curve on a two-dimensional plane; Step 3) Select N points (x1, y1), (x2, y2), ..., (x N ,y N ), so that 1≤i≤N; then a t-1 ,a t-2 ,······,a2,a1 are discarded, and (x1,y1) is sent as the first shadow shadow1 to auxiliary client 1, and (x2,y2) is sent as the second shadow shadow2 to auxiliary client 2, ······, (x N ,y N ) is sent to auxiliary client N as the Nth shadow shadowN, thus completing the threshold secret sharing algorithm and sharing the secret M with N auxiliary clients; It also includes step 4: when the master client needs to use the private key, it starts the mechanism workflow and restores the private key; The workflow of the mechanism specifically includes the following steps: Step (1), the primary client broadcasts to all N auxiliary clients to which it distributes shadow, requesting shadow; Step (2), the main client monitors the replies of N auxiliary client users until it receives t replies from Shadow, t≤N, and then stops monitoring; Step (3), the master client uses the received t shadows to restore the body using the inverse threshold secret sharing algorithm; Step (4), the main client requests Head from the cloud; Step (5), the cloud returns the Head corresponding to the master client to the master client; Step (6), the master client uses the Head and Body parts to recover the private key Privatekey using the inverse secret splitting algorithm; The inverse threshold secret sharing algorithm described in step (3) is specifically: After the main client retrieves t copies of shadow, it can write t linear equations with t variables. These t equations form a linear equation system with t variables. And this system of equations has one and only one solution; finding this solution can give a t-1 ,a t-2 ,······,a2,a1,M values, thus restoring Body=M; The reverse secret splitting algorithm described in step (6) can recover the privatekey based on the Body and Head; The formula of the inverse secret splitting algorithm is: Body ∧ head = privatekey ^ Head ∧ Head = privatekey ∧ (Head ^ Head) = privatekey; ^ is a bitwise XOR operation.

2. A loss-resistant and cloud-interventionable key storage method according to claim 1, characterized in that: When the master client needs to use the private key in step 4, it is when using the private key to transfer money, and it also includes step 5, the master client uses the private key privatekey to sign offline, sends the signature string to the blockchain network, the blockchain network confirms the legitimacy of the signature string, packages the signature data into the block, and completes the transfer process. The transfer process uses the transfer algorithm to complete the transfer transaction.

Images