Atomic solution method and system for cross-chain transaction security anchoring problem of block chain

Abstract

The invention provides an atomicity solution method and system for a block chain cross-chain transaction security anchoring problem, and the method comprises the steps: starting from each era, setting a witness committee at a receiving party block chain of a cross-chain exchange behavior, and keeping the right of the witness committee to redeem assets; according to the parameter data of the block chain, calculating a block chain security score and calculating a redemption difficulty; setting a current comment witness node as a part of an asset receiver to participate in the transaction through the smart contract; before the source chain sub-transaction reaches the security depth, monitoring the behavior of a transaction initiator through a witness node, and setting an attack judgment condition for a witness committee; and when the witness node triggers an attack judgment condition, dynamically adjusting the proportion of the witness nodes required by the redemption operation according to the redemption difficulty so as to realize asset redemption. According to the method, after the security difference between the block chains is fully considered, the atomicity condition which needs to be achieved by revoking the sub-transactions is formulated, and the defense of'roundabout attack 'can be completed by using relatively low computing resources.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to an atomic solution and system for the problem of secure anchoring of cross-chain transactions in blockchain. Background Art

[0002] Cross-chain technology is a key means to achieve blockchain interconnection. It can establish an information transmission bridge between originally independent blockchains and realize decentralized data sharing. However, since the technology is still in the research and development stage and there are many types of blockchains, existing cross-chain technologies may have security issues in practical applications. Although there are currently a variety of cross-chain technologies that can realize asset transfer, asset exchange and information interaction between blockchains, ensuring the atomicity of cross-chain transactions, the pursuit of strong atomicity will bring security issues. That is, the current cross-chain protocol only checks whether the transaction on the source chain is legal, and does not consider the security differences between the two blockchains of the cross-chain. This will cause the "security anchoring" problem: a malicious attack transaction cannot be directly successful on a high-security blockchain, but it can be indirectly achieved through the strong atomicity required by the cross-chain protocol. Even if the target chain security design and mechanism are higher than the source chain, the security issues of the source chain will affect the target chain, and ultimately cause the security of the multi-party blockchain to be lowered to the lowest security blockchain level in the entire cross-chain system.

[0003] The root cause of the "security anchoring" problem is that during cross-chain transactions, the cross-chain protocol only detects whether the transaction on the source chain is legal, without considering the security differences between the two parties in the cross-chain. This attack on the target blockchain using the cross-chain protocol is defined as a "circumvention attack". Currently, the mainstream cross-chain transaction protocol has no special prevention mechanism designed for this type of attack, which poses a potential security problem.

[0004] 1) The victims of "circumvention attacks" lack effective means to counter. In cross-chain transactions, due to the need for atomicity, it is necessary to ensure that the sub-transactions on both blockchains are successfully executed. However, if one of the blockchains is attacked, the illegal assets or operations on that chain may be "legally" circulated to other chains through the cross-chain protocol. In the current cross-chain solution, the victims of indirect attacks cannot effectively counter the illegal assets from other chains.

[0005] 2) In a cross-chain environment, the resource cost of canceling a single transaction is huge. The cross-chain environment is different from a single blockchain environment. On the one hand, due to the trust issues between the two blockchains, a lot of calculations are required to reach any cross-chain consensus; on the other hand, the occurrence of a roundabout attack means that a considerable number of nodes on one side of the cross-chain transaction are untrustworthy. Therefore, if a simple consensus strategy of canceling a single transaction is used to counter roundabout attacks, the computational and communication costs of the cross-chain process will be very high. Summary of the invention

[0006] In view of the above situation, the main purpose of the present invention is to propose an atomic solution and system for the problem of secure anchoring of cross-chain transactions in blockchains, so as to solve the above technical problems.

[0007] The present invention proposes an atomic solution to the problem of secure anchoring of cross-chain transactions in blockchains, and the method comprises the following steps:

[0008] Step 1: At the beginning of each epoch, a witness committee is established on the recipient blockchain of the cross-chain exchange behavior, and the witness committee retains the right to redeem the assets;

[0009] Step 2: Calculate the blockchain security score based on the blockchain parameter data, and calculate the redemption difficulty based on the blockchain security scores of both parties at the beginning of each epoch;

[0010] Step 3: The witness committee includes several witness nodes. Through the smart contract, the witness node of the current era is set to participate in the transaction as part of the asset recipient;

[0011] Step 4: Before the source chain transaction reaches the security depth, monitor the behavior of the transaction initiator through the witness node and set the attack judgment conditions for the witness committee;

[0012] Step 5. When the witness node triggers the attack judgment condition, the proportion of witness nodes required for the redemption operation is dynamically adjusted according to the redemption difficulty to achieve asset redemption.

[0013] The present invention also proposes an atomic solution system for the blockchain cross-chain transaction security anchoring problem, wherein the system applies the atomic solution method for the blockchain cross-chain transaction security anchoring problem as described above, and the system includes:

[0014] Attack identification and redemption operation module, used to:

[0015] At the beginning of each epoch, a witness committee is established on the receiving blockchain of the cross-chain exchange behavior, and the witness committee retains the right to redeem the assets;

[0016] The witness committee includes several witness nodes, and the witness nodes of the current era are set through smart contracts to participate in transactions as part of the asset recipient;

[0017] Before the source chain transaction reaches the security depth, the witness node monitors the behavior of the transaction initiator and sets attack judgment conditions for the witness committee;

[0018] Dynamic redemption difficulty adjustment module, used to:

[0019] Calculate the blockchain security score based on the blockchain's parameter data, and calculate the redemption difficulty based on the blockchain security scores of both parties at the beginning of each epoch;

[0020] When the witness node triggers the attack judgment condition, the proportion of witness nodes required for the redemption operation is dynamically adjusted according to the redemption difficulty to achieve asset redemption.

[0021] The present invention provides an effective "circumvention attack" defense method for cross-chain participants. After fully considering the security differences between blockchains, the atomicity conditions required to cancel sub-transactions are specifically formulated. This method can use lower computing resources to complete the defense against "circumvention attacks".

[0022] Compared with the prior art, the present invention has the following beneficial effects:

[0023] 1) Establish a witness committee and preset a contract so that the victim of the "indirect attack" can redeem the assets after the attack occurs. In order to block the "indirect attack", the present invention is based on the witness committee and integrates the idea of ​​distributed secret keys to extend the asset ownership from the two parties to the transaction to the entire witness committee. The witness committee will have the redemption qualification for the assets for a period of time. If no indirect attack occurs, the witness committee will automatically withdraw after the time is up. When the evidence of the indirect attack on the source chain is established, the witness committee will redeem the attacked assets to achieve the conditional atomicity of the transaction and effectively block the impact of the indirect attack on other chains.

[0024] 2) Combine the security score with the threshold signature characteristics to achieve dynamic and variable redemption operation difficulty, effectively reducing the overall algorithm overhead. If a simple consensus strategy of revoking a single transaction is used to solve the indirect attack, the computational overhead and communication overhead of the cross-chain process will be very high. Therefore, the present invention proposes a dynamic difficulty redemption optimization strategy and a blockchain security quantitative scoring method to provide an evaluation benchmark for cross-chain transaction security. Based on the security score, the variable threshold signature achievement conditions are utilized, and the security score is dynamically mapped to the redemption difficulty. The conditions for achieving the atomicity of transactions dynamically change for different blockchains, effectively reducing the blockchain cross-chain transaction resource overhead and redemption threshold.

[0025] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description or learned through embodiments of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 A flowchart of an atomic solution to the blockchain cross-chain transaction security anchoring problem proposed by the present invention;

[0027] Figure 2 This is a flow chart for realizing conditional atomicity of the present invention;

[0028] Figure 3This is a schematic diagram of the structure of the atomic solution system for the blockchain cross-chain transaction security anchoring problem proposed by the present invention;

[0029] Figure 4 Schematic diagram of atomic swaps being attacked indirect ways. DETAILED DESCRIPTION

[0030] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.

[0031] These and other aspects of the embodiments of the present invention will be apparent with reference to the following description and accompanying drawings. In these descriptions and accompanying drawings, some specific implementations of the embodiments of the present invention are specifically disclosed to represent some ways of implementing the principles of the embodiments of the present invention, but it should be understood that the scope of the embodiments of the present invention is not limited thereto.

[0032] See also Figure 1 and Figure 2 This embodiment provides an atomic solution to the problem of cross-chain transaction security anchoring in blockchains, and the method includes the following steps:

[0033] Step 1: At the beginning of each epoch, a witness committee is established on the recipient blockchain of the cross-chain exchange behavior, and the witness committee retains the right to redeem the assets;

[0034] In the blockchain system, epochs are often used to identify the duration of a series of operations. In view of the different block generation rates of different blockchains, in order to ensure the security and fairness of cross-chain committee elections, this paper chooses to define epochs based on a strategy based on fixed time intervals. At the beginning of each epoch, a witness committee election process will be triggered. The specific process of this step is as follows:

[0035] At the beginning of each epoch, all ordinary nodes are considered candidate nodes. In the subsequent stages, they will become candidate nodes based on the participants' active application or the system's recommendation based on historical performance and contribution.

[0036] After the candidate nodes are determined, the voting process will be initiated to select a number of candidate nodes with the highest number of votes to be included in the witness committee in proportion, and each node included in the witness committee will be called a witness node.

[0037] Step 2: Calculate the blockchain security score based on the blockchain parameter data, and calculate the redemption difficulty based on the blockchain security scores of both parties at the beginning of each epoch;

[0038] When quantifying security, it is necessary to define some indicators that affect the security of the blockchain. The manifestation of a roundabout attack on the source chain is generally a 51% attack, so the present invention selects the 51% attack cost as the main scoring indicator. In order to quantify the 51% attack cost, it is necessary to consider scoring parameters such as block size, number of nodes, stale block rate, propagation mechanism, and block speed.

[0039] When conducting a quantitative security assessment, the goal is to find an optimal weight distribution so that the blockchain security score reflects the real security of the blockchain to the greatest extent. This process includes normalization, feature extraction, and weight optimization distribution. First, all indicators are normalized to eliminate dimensional effects and magnitude differences.

[0040] The specific steps for calculating the blockchain security score in this step are as follows:

[0041] The attack cost of the indirect attack on the source chain is 51% as the main scoring indicator, and the block size, number of nodes, obsolete block rate, propagation mechanism and block speed of the blockchain are used as indicators of the scoring parameters. The indicators are normalized, and the corresponding process has the following relationship:

[0042]

[0043] Among them, X represents the original indicator value, μ and σ represent the mean and standard deviation of the corresponding indicator respectively;

[0044] Use gradient boosted decision tree (GBDT) or support vector machine (SVM) for feature extraction and weight assignment, where the decision tree training process has the following relationship:

[0045] F m (X) = F m-1 (X)+ηh m (X);

[0046] Among them, F m (X) represents the model of the mth step, F m-1 (X) represents the model of the m-1th step, η represents the learning rate, h m (X) represents the decision tree at step m;

[0047] The importance score of each feature given by the gradient-enhanced decision tree during the training process is used as the initial weight of the blockchain security score, and the blockchain security score is used as the output to obtain an optimal weight distribution, which is used as the blockchain security score.

[0048] The redemption key generation process in the present invention relies on the BLS signature algorithm based on bilinear mapping. Therefore, the specific steps for calculating the redemption difficulty in this step are as follows:

[0049] Define the ratio m / n of the threshold signature requirement as the range of redemption difficulty;

[0050] Calculate the difference in blockchain security scores between the two parties to the transaction, and then derive the redemption difficulty based on the preset mapping scheme. The corresponding process has the following relationship:

[0051]

[0052] Among them, D represents the redemption difficulty, S s represents the source chain score, S d represents the target chain score, f0 represents the set fault tolerance ratio, k represents the mapping sensitivity between the difference in blockchain security score and the redemption difficulty D. By adjusting the k parameter, the slope of the difficulty curve can be adjusted to adjust the mapping sensitivity, k∈N + , N + represents a set of positive integers, k1 represents a hyperparameter for adjusting the fault tolerance threshold, when the security scores of the two blockchains are similar or the source chain score S s Much higher than the target chain score S d , then the redemption difficulty is close to 1-f0; on the contrary, if the target chain security score S d Higher than the source chain score S s , then the redemption difficulty is close to 2 / 3.

[0053] Step 3: The witness committee includes several witness nodes, and the current epoch witness node is set through the smart contract to participate in the transaction as part of the asset recipient;

[0054] In step 3, the witness committee includes several witness nodes. During the transaction, the specific steps of setting the current epoch witness node as part of the asset recipient to participate in the transaction through the smart contract include the following:

[0055] For all witness nodes in the witness committee, a random number is selected as their respective secrets, corresponding to x1, x2, ..., x n ;

[0056] By combining various w i The secret generates a new committee public secret, and the corresponding process has the following relationship:

[0057] S w =G1(x1, x2, ..., x n );

[0058] Among them, S w represents a public secret, G1 represents a prime number p in order, and the generator is the multiplicative cyclic group of g1;

[0059] After the initial owner IO1 of the asset Aε1 on the L1 blockchain and the initial owner IO2 of the asset Aε2 on the L2 blockchain reach an exchange intention through off-chain negotiation, the initial owner IO2 in the high-security L2 blockchain first generates the initial owner IO2 collective secret. The corresponding relationship is as follows:

[0060] GS w =G2(J21, J22, ..., J2 i ), i = |J2|;

[0061] Among them, GS w Represents the collective secret of the initial owner IO2, J2 i represents the key fragment selected by any ordinary node on the L2 blockchain, G2 represents the order of a prime number p, and the generator is the multiplicative cyclic group of g2;

[0062] The initial owner IO2 collective secret GS w and Committee on Public Secrets w Mapping is performed to obtain the hash lock secret. When performing a hash operation on the Secret, the corresponding process has the following relationship:

[0063]

[0064] H = Hash (Secret);

[0065] Among them, Secret represents the lock in the cross-chain exchange process, H represents the mapping result of the hash function to Secret, Hash(·) represents the hash function, and G3 represents the third multiplication cycle group;

[0066] The initial owner IO2 deploys the smart contract SC2 to lock the asset Aε2 with the hash operation H and sets the expiration date to T. The corresponding process has the following relationship:

[0067]

[0068] in, Indicates a lock operation on the asset Aε2. The corresponding lock head is Hash(Secert), the key is Secert, the timeout parameter is T, ^ indicates the logical relationship "and", Expired(·) indicates the expiration parameter setting. If the set time is exceeded, the transaction will be directly invalidated. T indicates the set expiration period;

[0069] At the same time, the Witness Committee uses the collective secret GS w The asset Aε2 is also locked using the hash operation H. The corresponding process has the following relationship:

[0070]

[0071] The initial owner IO1 observes that the smart contract SC2 "lock" H = Hash (Secret) has been published, and publishes the smart contract SC1 that locks its own asset Aε1 for a period of T / 2. The corresponding process has the following relationship:

[0072]

[0073] in, Indicates a locking operation on the asset Aε1. Similarly, the lock is Hash(Secert), the key is Secert, and the timeout parameter is T / 2;

[0074] The initial owner IO2 uses the hash lock secret Secret to unlock the asset Aε1 on the L1 blockchain. The corresponding process has the following relationship:

[0075]

[0076] in, Indicates that the asset Aε1 is unlocked using the "key Secert";

[0077] At this point, the hash lock secret Secret is revealed, and the sub-transaction L1Aε1:{IO1}→{FO1} is completed. FO1 is the asset receiver of the L1 blockchain on the chain, where FO1 represents the final owner of the asset, and → represents the asset transfer operation;

[0078] The initial owner IO1 uses the public hash lock secret Secret to unlock the asset Aε2 on the L2 blockchain. The corresponding process has the following relationship:

[0079]

[0080] in, Indicates using the "Secert key" to unlock the asset AE2;

[0081] Sub-transaction L2Aε2: {IO2, w}→{FO2, w} is completed, FO2 is the asset recipient of the on-chain L2 blockchain, and the transaction is completed. Among them, FO1 represents the final owner of the asset, and w represents a non-specific witness node in the witness committee.

[0082] Step 4: Before the source chain transaction reaches the security depth, monitor the behavior of the transaction initiator through the witness node and set the attack judgment conditions for the witness committee;

[0083] like Figure 4As shown in the figure, the process of atomic swap being attacked indirectly is as follows. Specifically, assume that there are two blockchain networks L1 (Bitcoin) and L2 (Etherum). L1 has lower security, which means that a fork attack can be carried out on L1 with less computing resources, while L2 has higher security and requires a large amount of computing resources to carry out the same attack. There are two roles A (Attacker) and ordinary user C (Client) on L1 and L2 respectively, and they have accounts on the two chains respectively. First, A broadcasts an atomic cross-chain transaction application to the blockchain network, declaring that he wants to use the asset p on L1 to exchange the asset Q on L2 with other users.

[0084] Initially, A applied to the blockchain when the block height on L1 was h1, and then L2 received the transaction application when the block height was h2. When the block heights of L1 and L2 were h1+2 and h2+2 respectively, A successfully obtained the asset Q on L2, and C successfully obtained the ownership of the asset p. This cross-chain exchange transaction was successfully executed and written into the status databases of the two blockchains.

[0085] Subsequently, because A has the computing power resources to launch a fork attack on L1, after attacker A observes that both sub-transactions of the cross-chain exchange have successfully occurred, he uses his computing power advantage to directly launch an attack at the block height h1-1 of L1, forcibly changing the longest valid main chain of the source chain, causing the sub-transaction {P: A→C} that had originally occurred on L1 to disappear, and the attacker takes back the transferred assets.

[0086] From the above, it can be seen that when the transaction is completed and the sub-transaction is written to the L1 blockchain, but before reaching the security block depth of L1, the sub-transaction may still be revoked by an attack, and the assets on the L2 blockchain will be threatened. Therefore, the strategy of the present invention is to retain the witness committee's right to redeem the assets. Here, the definition of conditional atomicity and the attack judgment condition ε are first given.

[0087] Conditional atomicity is defined as the atomicity operation selection of transactions based on the degree of satisfaction of a set of predefined conditions during the execution of cross-blockchain transactions.

[0088] Specifically, when a roundabout attack occurs on the system, it manifests itself as a fork attack on the source chain. This fork attack must overwrite the sub-transaction that has already occurred on the L1 blockchain with a longer chain (potential v p ), so we can determine whether a fork attack has occurred by observing whether the current longest chain contains sub-transactions.

[0089] Therefore, before the source chain transaction reaches the security depth, this step monitors the behavior of the transaction initiator through the witness node and sets the attack judgment conditions for the witness committee, which specifically includes the following steps:

[0090] In the following, the sub-transaction Aε1: {IO1}→{FO1} is recorded as sub-transaction St1, and the sub-transaction Aε2: {IO2, w}→{FO2, w} is recorded as sub-transaction St2. The witness node Independently monitor whether the current longest chain of the L1 blockchain contains the sub-transaction St1. When the sub-transaction St1 does not reach the security depth of the L1 blockchain, and the longest chain of the L1 blockchain does not contain the sub-transaction St1, it is considered that St1 = v p It is a preparatory transaction for the roundabout attack, and the predefined conditions for achieving conditional atomicity are as follows:

[0091]

[0092] Among them, ε represents evidence. As long as this condition is met, the subsequent steps can be initiated to redeem the assets. Indicates the block height of the L1 blockchain, Indicates the blockchain height when the sub-transaction St1 occurs. Indicates the maximum security depth set by the L1 blockchain, Indicates the logical relationship "not", contains(·) represents the judgment function, which is used to determine whether the current longest chain of the L1 blockchain contains the sub-transaction St1. If it does, the output result is "yes", otherwise the output result is "no".

[0093] Step 5. When the witness node triggers the attack judgment condition, the proportion of witness nodes required for the redemption operation is dynamically adjusted according to the redemption difficulty to achieve asset redemption.

[0094] In order to ensure the credibility of evidence in the redemption phase, the witness committee needs to be of a certain size, which requires that the ratio when generating the aggregate signature needs to be set carefully. If the required ratio is too high, it will lead to a large system load and a low redemption success rate; if the required ratio is too low, there is a possibility that members of the witness committee and users will collude to launch attacks. In order to determine the appropriate redemption difficulty between two specific blockchains, the present invention introduces a blockchain security quantitative scoring mechanism, combined with the threshold signature characteristics, to achieve dynamic adjustment of the redemption difficulty.

[0095] Therefore, in this step, when the witness node triggers the attack judgment condition, the method of dynamically adjusting the proportion of witness nodes required for the redemption operation according to the redemption difficulty to achieve asset redemption specifically includes the following steps:

[0096] initialization:

[0097] Every time a new epoch begins, the witness committee will generate a round of public parameters, which are expressed as:

[0098] S = (w i |, G1, G2, G T, p, g1, g2, e, H);

[0099] Among them, |w i | represents the number of nodes in the current witness committee, G1 and G2 represent prime numbers of order p, and the generators are the multiplication cyclic groups of g1 and g2 respectively. T represents the cross product group based on G1 and G2, and e represents the bilinear function: G1×G2→G T The mapping method, H represents the hash function with the mapping range G1;

[0100] Key Generation:

[0101] The smart contract randomly selects the committee master private key and calculates the committee master public key. The corresponding process has the following relationship:

[0102] WMK = x;

[0103]

[0104] Among them, WMK represents the witness committee master private key, WPK represents the witness committee master public key, and x represents the random number selected by the smart contract. It means that the expected range of the result of exponential operation with generator g2 as base and x as power must fall within the G2 cyclic group;

[0105] Select Z p D|w on i |-1st order polynomial p, such that p(0) = x, where Z p Represents the set of all non-negative integers under modulo p operations, and calculates the private key and public key of each newly elected witness node. The corresponding process has the following relationship:

[0106] x i =p(i);

[0107]

[0108] Among them, xw i Represents the witness node w i The private key of vw i Represents the witness node w i , i represents the index of the witness node in the witness committee, and p(·) represents a polynomial;

[0109] The master public key and node public key set of the witness committee are then made public;

[0110] sign:

[0111] Any node in the witness committee can monitor the transaction status of the source chain St1. If the redemption conditions are met, the evidence will be broadcast in the committee. Other witness nodes will verify whether the evidence actually occurred. If it is true, the node will calculate the evidence to obtain the signature and broadcast it to all users. The process of obtaining the signature has the following relationship:

[0112]

[0113] Among them, σ i Indicates signature;

[0114] Signature of inspection form:

[0115] Witness Node w i Receive other nodes w j The signature σ j After that, the correctness of a single signature is calculated and verified. If the verification passes, it is stored in an array for recording. The process of calculating and verifying the correctness of a single signature has the following relationship:

[0116] e(σ j , g2) = e(H(ε), v j );

[0117] Verify threshold signature:

[0118] The witness node will receive D|w i | single signatures are aggregated to verify the complete threshold signature to calculate the threshold factor, and the complete threshold signature is calculated based on the threshold factor. The corresponding process has the following relationship:

[0119]

[0120]

[0121] in, represents the threshold factor obtained by the i-th witness node, σ represents the complete threshold signature, It represents the calculated value with the ith threshold factor as the power and the ith node signature as the base, which is the component of the final threshold signature. m represents the maximum total amount of verification signatures received by the node.

[0122] Verify by calculation whether there is at least D|w in the signature σ i | identical signatures. If the equation holds, it means that the evidence ε is valid, the redemption condition is met, and the atomicity requirement of the condition is met. The corresponding process has the following relationship:

[0123] e(σ,g2)=e(H(ε),MPK);

[0124] Where e(·) represents the maximum total amount of verification signatures received by the node;

[0125] redemption:

[0126] After the witness node verifies that the evidence ε is valid, it will send the witness node’s secret x i As the key fragment input to the G0 function of the smart contract SC2, if the G0 function collects all the key fragments x i Can get the original key of the hash lock in the Refund function w , successfully redeemed.

[0127] Further optimization, after the witness node verifies that the evidence ε is valid, the key fragment x i Input the G0 function of the smart contract SC2. If the G0 function collects all the key fragments x i Can get the original key of the hash lock in the Refund function w The specific steps for successful redemption include the following:

[0128] After receiving the evidence ε, other nodes in the witness committee first verify the evidence. The nodes can obtain the transaction information contained in the longest chain of the L1 blockchain through the blockchain browser; if the node w i If ε is confirmed to exist, then node w i The corresponding secret x i Input into the function G0 of the smart contract SC2 to generate the redemption key Key w , the generation process of the redemption key has the following relationship:

[0129]

[0130] Among them, Key w represents the redemption key, G0 represents the fourth multiplicative cyclic group;

[0131] Input the original hash value into the smart contract SC2. After verification, the smart contract will execute the redemption operation. The corresponding process has the following relationship:

[0132] Aε2: {FO2, W} → {IO2, W};

[0133] Among them, W stands for Witness Committee;

[0134] At this time, the sub-transaction St2 on the L2 blockchain is revoked, and the ownership of the asset Aε2 on the L2 blockchain is successfully returned to the control of the initial owner IO2 under the witness of the witness committee;

[0135] At this point, the conditional atomic transaction is achieved, and the two sub-transactions of the cross-chain exchange are not written into the blockchain, successfully blocking the impact of the indirect attack on the L2 blockchain.

[0136] In summary, the present invention adopts the idea of ​​conditional atomicity, establishes a witness committee on the receiving blockchain of the cross-chain exchange behavior, and sets the current epoch witness node through the smart contract to participate in the transaction as part of the asset receiver. Before the source chain transaction reaches the security depth, the witness node has the authority to monitor the behavior of the transaction initiator. If a fork attack is found, the witness node will apply to redeem the original assets of the target link recipient, so as to achieve the purpose of blocking the attack. The operation steps can be divided into four stages, namely the preparation stage, the locking stage, the unlocking stage and the redemption stage, as shown in the figure. Among them, the first three stages must be carried out for each cross-chain transaction. In these three stages, the transaction has strong atomicity, and the redemption stage is only started when a preparatory attack that is determined to have occurred on the source chain is detected. At this time, the transaction has conditional atomicity.

[0137] Please refer to Figure 3 This embodiment also provides a system for solving the atomicity problem of cross-chain transaction security anchoring in blockchain, wherein the system applies the atomicity solution method for the cross-chain transaction security anchoring problem in blockchain as described above, and the system includes:

[0138] Attack identification and redemption operation module, used to:

[0139] At the beginning of each epoch, a witness committee is established on the receiving blockchain of the cross-chain exchange behavior, and the witness committee retains the right to redeem the assets;

[0140] The witness committee includes several witness nodes, and the witness nodes of the current era are set through smart contracts to participate in transactions as part of the asset recipient;

[0141] Before the source chain transaction reaches the security depth, the witness node monitors the behavior of the transaction initiator and sets attack judgment conditions for the witness committee;

[0142] Dynamic redemption difficulty adjustment module, used to:

[0143] Calculate the blockchain security score based on the blockchain's parameter data, and calculate the redemption difficulty based on the blockchain security scores of both parties at the beginning of each epoch;

[0144] When the witness node triggers the attack judgment condition, the proportion of witness nodes required for the redemption operation is dynamically adjusted according to the redemption difficulty to achieve asset redemption.

[0145] From the above, it can be seen that the present invention is divided into two major modules. The upper part is the attack identification and redemption operation module, which includes environment initialization, contract deployment, intra-chain committee election, hash time lock exchange, attack detection and identification if an attack occurs, and finally redemption operation; the lower part is the dynamic difficulty adjustment module. In the algorithm process, the initial parameters are first obtained through the blockchain browser, and then GBDT feature extraction and SVM weight allocation are performed on these parameters respectively, so that the security score of the blockchain can be obtained, and the redemption strategy of dynamic difficulty can be realized through the mapping strategy.

[0146] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0147] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. An atomic solution to the problem of secure anchoring of cross-chain transactions in blockchain, characterized in that: The method comprises the following steps: Step 1: At the beginning of each epoch, a witness committee is established on the receiving blockchain of the cross-chain exchange behavior, and the witness committee retains the right to redeem the assets; Step 2: Calculate the blockchain security score based on the blockchain parameter data, and calculate the redemption difficulty based on the blockchain security scores of both parties at the beginning of each epoch; Step 3: The witness committee includes several witness nodes. Through the smart contract, the witness node of the current era is set to participate in the transaction as part of the asset recipient; Step 4: Before the source chain transaction reaches the security depth, monitor the behavior of the transaction initiator through the witness node and set the attack judgment conditions for the witness committee; Step 5. When the witness node triggers the attack judgment condition, the proportion of witness nodes required for the redemption operation is dynamically adjusted according to the redemption difficulty to achieve asset redemption.

2. The atomic solution to the blockchain cross-chain transaction security anchoring problem according to claim 1 is characterized in that: In step 1, the method of establishing a witness committee on the receiving blockchain of the cross-chain exchange behavior specifically includes the following steps: At the beginning of each epoch, all ordinary nodes are considered candidate nodes. In the subsequent stages, they will become candidate nodes based on the participants' active application or the system's recommendation based on historical performance and contribution. After the candidate nodes are determined, the voting process will be initiated to select a number of candidate nodes with the highest number of votes to be included in the witness committee in proportion, and each node included in the witness committee will be called a witness node.

3. The atomic solution to the blockchain cross-chain transaction security anchoring problem according to claim 2 is characterized in that: In step 2, the method for calculating the blockchain security score based on the parameter data of the blockchain specifically includes the following steps: The attack cost of the indirect attack on the source chain is 51% as the main scoring indicator, and the block size, number of nodes, obsolete block rate, propagation mechanism and block speed of the blockchain are used as indicators of the scoring parameters. The indicators are normalized, and the corresponding process has the following relationship: Among them, X represents the original indicator value, μ and σ represent the mean and standard deviation of the corresponding indicator respectively; Use gradient-enhanced decision trees or support vector machines to extract features and assign weights. The decision tree training process has the following relationship: F m (X)=F m-1 (X)+ηh m (X); Among them, F m (X) represents the model of the mth step, F m-1 (X) represents the model of the m-1th step, η represents the learning rate, h m (X) represents the decision tree at step m; The importance score of each feature given by the gradient-enhanced decision tree during the training process is used as the initial weight of the blockchain security score, and the blockchain security score is used as the output to obtain an optimal weight distribution, which is used as the blockchain security score.

4. The atomic solution to the blockchain cross-chain transaction security anchoring problem according to claim 3 is characterized in that: In step 2, the method for calculating the redemption difficulty based on the blockchain security scores of both parties to the transaction at the beginning of each epoch specifically includes the following steps: Define the ratio m / n of the threshold signature requirement as the range of redemption difficulty; Calculate the difference in blockchain security scores between the two parties to the transaction, and then derive the redemption difficulty based on the preset mapping scheme. The corresponding process has the following relationship: Among them, D represents the redemption difficulty, S s represents the source chain score, S d represents the target chain score, f0 represents the set fault tolerance ratio, k represents the mapping sensitivity between the difference in blockchain security score and the redemption difficulty D, k∈N + , N + represents a set of positive integers, k1 represents a hyperparameter for adjusting the fault tolerance threshold, when the security scores of the two blockchains are similar or the source chain score S s Much higher than the target chain score S d , then the redemption difficulty is close to 1-f0; on the contrary, if the target chain security score S d Higher than the source chain score S s , then the redemption difficulty is close to 2 / 3.

5. The atomic solution to the blockchain cross-chain transaction security anchoring problem according to claim 4 is characterized in that: In step 3, the witness committee includes several witness nodes. During the transaction, the specific steps of setting the current epoch witness node as part of the asset recipient to participate in the transaction through the smart contract include the following: For all witness nodes in the witness committee, a random number is selected as their respective secrets, corresponding to x1, x2, ..., x n ; By integrating various witness nodes w i The secret generates a new committee public secret, and the corresponding process has the following relationship: S w =G1(x1,x2,...,x n ); Among them, S w represents a public secret, G1 represents a prime number p in order, and the generator is the multiplicative cyclic group of g1; After the initial owner IO1 of the asset Aε1 on the L1 blockchain and the initial owner IO2 of the asset Aε2 on the L2 blockchain reach an exchange intention through off-chain negotiation, the initial owner IO2 in the high-security L2 blockchain first generates the initial owner IO2 collective secret. The corresponding relationship is as follows: GS w =G2(J21,J22,...,J2 i ),i=|J2|; Among them, GS w Represents the collective secret of the initial owner IO2, J2 i represents the key fragment selected by any ordinary node on the L2 blockchain, G2 represents the order of a prime number p, and the generator is the multiplicative cyclic group of g2; The initial owner IO2 collective secret GS w and Committee on Public Secrets w Mapping is performed to obtain the hash lock secret. When performing a hash operation on the Secret, the corresponding process has the following relationship: H = Hash (Secret); Among them, Secret represents the lock in the cross-chain exchange process, H represents the mapping result of the hash function to Secret, Hash(·) represents the hash function, and G3 represents the third multiplication cycle group; The initial owner IO2 deploys the smart contract SC2 to lock the asset Aε2 with the hash operation H and sets the expiration date to T. The corresponding process has the following relationship: in, Indicates that the asset Aε is locked. The corresponding lock is Hash(Secert), the key is Secert, the timeout parameter is T, ^ indicates the logical relationship "and", Expired(·) indicates the expiration parameter setting. If the set time is exceeded, the transaction will be directly invalidated. T indicates the set expiration period; At the same time, the Witness Committee uses the collective secret GS w The asset Aε2 is also locked using the hash operation H. The corresponding process has the following relationship: The initial owner IO1 observes that the smart contract SC2 "lock" H = Hash (Secret) has been published, and publishes the smart contract SC1 that locks its own asset Aε1 for a period of T / 2. The corresponding process has the following relationship: in, Indicates locking operation on asset Aε1; The initial owner IO2 uses the hash lock secret Secret to unlock the asset Aε1 on the L1 blockchain. The corresponding process has the following relationship: in, Indicates using the "key Secert" to unlock the asset Aε1; At this point, the hash lock secret Secret is revealed, and the sub-transaction L1Aε1:{IO1}→{FO1} is completed. FO1 is the asset receiver of the L1 blockchain on the chain, where FO1 represents the final owner of the asset, and → represents the asset transfer operation; The initial owner IO1 uses the public hash lock secret Secret to unlock the asset Aε2 on the L2 blockchain. The corresponding process has the following relationship: in, Indicates using "Secert" to unlock the asset AE2; Sub-transaction L2Aε2: {IO2, w}→{FO2, w} is completed, FO2 is the asset recipient of the on-chain L2 blockchain, and the transaction is completed. Among them, FO1 represents the final owner of the asset, and w represents a non-specific witness node in the witness committee.

6. The atomic solution to the blockchain cross-chain transaction security anchoring problem according to claim 5 is characterized in that: In step 4, before the source chain transaction reaches the security depth, the method of monitoring the behavior of the transaction initiator through the witness node and setting the attack judgment condition for the witness committee specifically includes the following steps: Sub-transaction Aε1: {IO1}→{FO1} is recorded as sub-transaction St1, and sub-transaction Aε2: {IO2, w}→{FO2, w} is recorded as sub-transaction St2. Independently monitor whether the current longest chain of the L1 blockchain contains the sub-transaction St1. When the sub-transaction St1 does not reach the security depth of the L1 blockchain, and the longest chain of the L1 blockchain does not contain the sub-transaction St1, it is considered that St1 = v p It is a preparatory transaction for the roundabout attack, and the predefined conditions for achieving conditional atomicity are as follows: Among them, ε represents evidence, Indicates the block height of the L1 blockchain, Indicates the blockchain height when the sub-transaction St1 occurs. Indicates the maximum security depth set by the L1 blockchain, Indicates the logical relationship "not", contains(·) indicates a judgment function, which is used to determine whether the current longest chain of the L1 blockchain contains the sub-transaction St1. If it does, the output result is "yes", otherwise the output result is "no".

7. The atomic solution to the blockchain cross-chain transaction security anchoring problem according to claim 6 is characterized in that: In step 5, when the witness node triggers the attack determination condition, the method of dynamically adjusting the proportion of witness nodes required for the redemption operation according to the redemption difficulty to achieve asset redemption specifically includes the following steps: Every time a new epoch begins, the witness committee will generate a round of public parameters, which are expressed as: Sη=(|w i |,G1,G2,G T ,p,g1,g2,e,H); Among them, |w i | represents the current number of witness committee nodes, G T represents the cross product group based on G1 and G2, and e represents the bilinear function: G1×G2→G T The mapping method, H represents the hash function with the mapping range G1; The smart contract randomly selects the committee master private key and calculates the committee master public key. The corresponding process has the following relationship: WMK = x; Among them, WMK represents the witness committee master private key, WPK represents the witness committee master public key, and x represents the random number selected by the smart contract. It means that the expected range of the result of exponential operation with generator g2 as base and x as power must fall within the G2 cyclic group; Select Z p D|w on i |-1st order polynomial p, such that p(0) = x, where Z p Represents the set of all non-negative integers under the modulo operation, and calculates the private key and public key of each newly elected witness node. The corresponding process has the following relationship: xw i =p(i); Among them, xw i Represents the witness node w i The private key of vw i Represents the witness node w i , i represents the index of the witness node in the witness committee, and P(·) represents a polynomial; The master public key and node public key set of the witness committee are then made public; Any node in the witness committee can monitor the transaction status of the source chain St1. If the redemption conditions are met, the evidence will be broadcast in the committee. Other witness nodes will verify whether the evidence actually occurred. If it is true, the node will calculate the evidence to obtain the signature and broadcast it to all users. The process of obtaining the signature has the following relationship: Among them, σ i Indicates signature; Witness Node w i Receive other nodes w j The signature σ j After that, the correctness of a single signature is calculated and verified. If the verification passes, it is stored in an array for recording. The process of calculating and verifying the correctness of a single signature has the following relationship: e{s j ,g2)=e(Hash(ε),v j ); The witness node will receive D|w i | single signatures are aggregated to verify the complete threshold signature to calculate the threshold factor, and the complete threshold signature is calculated based on the threshold factor. The corresponding process has the following relationship: in, represents the threshold factor obtained by the i-th witness node, σ represents the complete threshold signature, It represents the calculated value with the ith threshold factor as the power and the ith node signature as the base, which is the component of the final threshold signature. m represents the maximum total amount of verification signatures received by the node. Verify by calculation whether there is at least D|w in the signature σ i | identical signatures. If the equation holds, it means that the evidence ε is valid, the redemption condition is met, and the atomicity requirement of the condition is met. The corresponding process has the following relationship: e(σ,g2)=e(H(ε),MPK); Where e(·) represents the maximum total amount of verification signatures received by the node; After the witness node verifies that the evidence ε is valid, it will send the witness node’s secret x i As the key fragments, input into the G0 function of the smart contract SC2. If the G0 function collects all the key fragments, it can get the original key of the hash lock in the Refund function. w , successfully redeemed.

8. The atomic solution to the blockchain cross-chain transaction security anchoring problem according to claim 7 is characterized in that: After the witness node verifies that the evidence ε is valid, it will send the key fragment x i Input the G0 function of the smart contract SC2. If the G0 function collects all the key fragments x i Can get the original key of the hash lock in the Refund function w The specific steps for successful redemption include the following: After receiving the evidence ε, other nodes in the witness committee first verify the evidence. The node obtains the transaction information contained in the longest chain of the L1 blockchain through the blockchain browser. If the node w i If ε is confirmed to exist, then node w i The corresponding secret x i Input into the function G0 of the smart contract SC2 to generate the redemption key Key w , the generation process of the redemption key has the following relationship: Key w =G0(x1,x2,...,x n |Hash(St1)); Among them, Key w represents the redemption key, G0 represents the fourth multiplicative cyclic group; Input the original hash value into the smart contract SC2. After verification, the smart contract will execute the redemption operation. The corresponding process has the following relationship: Aε2: {FO2, W} → {IO2, W}; Among them, W stands for Witness Committee; At this time, the sub-transaction St2 on the L2 blockchain is revoked, and the ownership of the asset Aε2 on the L2 blockchain is successfully returned to the control of the initial owner IO2 under the witness of the witness committee; At this point, the conditional atomic transaction is achieved, and the two sub-transactions of the cross-chain exchange are not written into the blockchain, successfully blocking the impact of the indirect attack on the L2 blockchain.

9. A system for solving the atomicity problem of cross-chain transaction security anchoring in blockchain, characterized in that: The system applies the atomic solution to the blockchain cross-chain transaction security anchoring problem as described in any one of claims 1 to 8, and the system includes: Attack identification and redemption operation module, used to: At the beginning of each epoch, a witness committee is established on the receiving blockchain of the cross-chain exchange behavior, and the witness committee retains the right to redeem the assets; The witness committee includes several witness nodes, which are set through smart contracts to participate in transactions as part of the asset recipient in the current epoch. Before the source chain transaction reaches the security depth, the witness node monitors the behavior of the transaction initiator and sets attack judgment conditions for the witness committee; Dynamic redemption difficulty adjustment module, used to: Calculate the blockchain security score based on the blockchain's parameter data, and calculate the redemption difficulty based on the blockchain security scores of both parties at the beginning of each epoch; When the witness node triggers the attack judgment condition, the proportion of witness nodes required for the redemption operation is dynamically adjusted according to the redemption difficulty to achieve asset redemption.

Images