Digital asset decentralized management method and system

Abstract

The invention provides a digital asset decentralized management method and system, and the method comprises the steps: enabling legal members in a group to jointly participate in the generation of an initial authorization key according to a preset distributed key generation protocol, dividing the key into a plurality of fragments through a threshold key sharing scheme, and storing the fragments in different member nodes; after the consensus is reached, the member node reconstructs a complete authorization key according to the request content, signs the key by adopting an aggregation signature scheme, generates an authorization certificate, and returns the certificate to the request node; a key cache mechanism is introduced, a member node maintains a local cache and stores historical authorization keys in the latest period of time, when a new authorization request is processed, available keys are searched from the local cache, and the available keys are directly used if hit.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a method and system for decentralized management of digital assets. Background Art

[0002] In the decentralized anonymous management system of digital assets, in order to protect the privacy of traders while ensuring the legitimacy and consistency of transactions, the system introduces a dynamic authorization mechanism. This mechanism requires that transaction requests and confirmations within the group must obtain the signature of a timely updated authorization key, and the key is jointly generated and managed by all legal members through a secure distributed key generation protocol. However, this collective management authorization method faces many technical difficulties in the implementation process. First, the generation and update of keys require the participation of all members to reflect the collective will and prevent manipulation by a few people. However, the identity and permissions of members may change frequently, which requires that the keys can be quickly updated and replaced to adapt to the needs of dynamic changes in the group. Secondly, in order to prevent the keys from being abused by a single member, the keys are often divided into multiple fragments and stored in the hands of different members. Although this improves the security of the keys, it also increases the communication overhead and consistency risk when using the keys, affecting the authorization efficiency. Furthermore, although the frequent update of the keys can improve the security and robustness of the system, it may also reduce the transaction efficiency due to the introduction of additional communication overhead and synchronization delay. How to find the best balance between the security, availability and performance of the keys is a key issue that needs to be solved urgently. In short, how to design a robust and efficient decentralized digital asset management solution while protecting privacy and compliance, and maximize the availability and reliability of the system, is the core technical challenge facing the decentralized digital asset management system. Summary of the invention

[0003] The present invention provides a method for decentralized management of digital assets, which mainly includes:

[0004] According to the preset distributed key generation protocol, the legal members in the group jointly participate in generating the initial authorization key, and the threshold key sharing scheme is used to divide the key into multiple fragments, which are stored in different member nodes respectively;

[0005] Build a decentralized identity authentication and authority management mechanism through blockchain technology, map members' identity information and authority to the blockchain ledger, and use smart contracts to automatically manage members' joining, exiting, and authority changes;

[0006] When a member node receives a transaction request, it determines the legitimacy of the requester through identity authentication and authority verification. If the verification is successful, the request is broadcast to other member nodes. After receiving the request, other member nodes perform the same verification. If the preset confirmation threshold is reached, a consensus is reached on the request.

[0007] After reaching a consensus, the member nodes reconstruct the complete authorization key based on the request content, sign the key using the aggregate signature scheme, generate the authorization certificate, and return the certificate to the requesting node;

[0008] Introducing a key cache mechanism, where member nodes maintain a local cache to store historical authorization keys from the recent period. When processing a new authorization request, they search for available keys from the local cache and use them directly if a match is found.

[0009] Design a dynamic key update strategy, comprehensively consider the frequency of changes in group members and the concurrency of transaction requests, adjust the key update cycle, and during the update, the management node initiates a key negotiation request to generate new key fragments to replace the original fragments.

[0010] The present invention provides a decentralized digital asset management system, which mainly includes:

[0011] Distributed key generation module, used to generate initial authorization keys and split storage;

[0012] Blockchain identity authentication module, used to manage membership and permissions;

[0013] Consensus verification module, used to verify the legitimacy of requests and reach consensus;

[0014] An authorization credential generation module, used to reconstruct the key and generate the authorization credential;

[0015] Key cache module, used to maintain local key cache to improve efficiency;

[0016] The dynamic key update module is used to regularly update keys to ensure security.

[0017] The technical solution provided by the embodiment of the present invention may have the following beneficial effects:

[0018] The present invention discloses a method for decentralized management of digital assets. In view of the problems of key management and authority control in a distributed system, the present invention adopts the method of legal members in a group to jointly participate in generating an initial authorization key, and divides the key into multiple fragments and stores them in different nodes through a threshold key sharing scheme. Blockchain technology is used to build a decentralized identity authentication and authority management mechanism, and member identity and authority information are mapped to a blockchain account book. When a transaction request is received, the legitimacy of the request is determined through identity authentication and authority verification, and after reaching a consensus, the complete authorization key is reconstructed and an authorization credential is generated. A key caching mechanism is introduced to improve processing efficiency, and a dynamic key update strategy is designed to ensure security. The present invention realizes safe and efficient key management in a distributed environment, solves the single point failure risk of centralized key management, and improves the availability and scalability of the system. Automated member management and authority control are realized through blockchain and smart contracts, enhancing the security and auditability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 The present invention is a flowchart of a method for decentralized management of digital assets.

[0020] Figure 2 A schematic diagram of a digital asset decentralized management method and system of the present invention.

[0021] Figure 3 This is another schematic diagram of a digital asset decentralized management method and system of the present invention.

[0022] Figure 4 It is a structural schematic diagram of a digital asset decentralized management system of the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0024] like Figure 1-4 In this embodiment, a decentralized digital asset management system may specifically include:

[0025] Step S101, according to a preset distributed key generation protocol, legal members in the group jointly participate in generating an initial authorization key, and a threshold key sharing scheme is used to divide the key into multiple fragments, which are stored in different member nodes respectively.

[0026] Obtain a list of legal members in the group, verify the legitimacy of each member through digital signatures, and determine the identities of members participating in distributed key generation; according to the preset distributed key generation protocol, legal members who have passed identity authentication jointly participate in generating an initial authorization key; use the secret sharing algorithm in secure multi-party computing to split the generated initial authorization key to obtain multiple key fragments, and the number of fragments is determined according to a preset threshold value; distribute the key fragments to different member nodes through a secure communication protocol, and each node only stores one key fragment; on each member node, use an encryption algorithm to encrypt the received key fragments to obtain encrypted key fragments, and use a secure key management mechanism to store them; when the initial authorization key needs to be used, the authorized member node provides the key fragments it holds; through the threshold key recovery algorithm, combine the threshold number of key fragments to reconstruct the complete initial authorization key; verify the reconstructed initial authorization key and destroy it immediately after the key is used.

[0027] Specifically, first, the system needs to identify the legitimate participating members. This can be achieved through digital signatures, such as using the RSA algorithm. Each member has a pair of public and private keys, and uses the private key to sign his or her identity information. Other members can use the corresponding public key to verify the validity of the signature. This can effectively prevent imposters from mixing in. After the participants are determined, the initial authorization key can be generated. A commonly used method is the Diffie-Hellman key exchange protocol. Assume that there are three participants A, B, and C. They can each choose a private random number, and then conduct multiple rounds of interactions according to the protocol to negotiate the key negotiation algorithm and parameters used, such as the elliptic curve cryptography algorithm and curve parameters, to ensure the security and efficiency of the algorithm. Each party generates a pair of public and private keys, sends the public key to the other party, and retains the private key. The two parties use the other party's public key and their own private key to calculate a shared key material through the key negotiation algorithm, and finally obtain a common key. This process does not require any secret information to be shared in advance, and is very suitable for use in insecure networks. After the key is generated, it needs to be split to improve security. A typical method is Shamir's Secret Sharing. For example, the key can be divided into 5 parts, and the threshold value is set to 3. This means that as long as any 3 parts are collected, the complete key can be reconstructed, and less than 3 parts cannot obtain any valid information. In specific implementation, a random polynomial can be selected, the key can be embedded in the constant term, and the other coefficients can be randomly selected. Then different points are taken as key fragments. The distribution of key fragments needs to be carried out through a secure communication protocol. A common method is to use the TLS protocol. TLS can provide end-to-end encryption and identity authentication, effectively preventing man-in-the-middle attacks and eavesdropping. Each participant will only receive one key fragment, so that even if a single node is compromised, the complete key will not be leaked. After receiving the key fragment, each node needs to further encrypt it for protection. Symmetric encryption algorithms such as AES can be used, combined with secure key derivation functions such as PBKDF2. In this way, even if the attacker obtains the storage medium, the content of the key fragment cannot be directly read. Key management can use hardware security modules (HSM) to enhance security and store the encrypted key fragments in a physically isolated environment. When the initial authorization key is needed, the system will ask the authorized members to provide the key fragments they hold. Assuming the threshold value is 3, at least 3 members are required to participate in reconstructing the key. This mechanism can effectively prevent single point failure and internal collusion. The reconstruction process uses Lagrange interpolation to substitute the collected points into the polynomial equation, and the constant term is solved to obtain the original key. After the key is reconstructed, the system will verify it to ensure its correctness. One method is to compare it with the pre-stored key hash value. For example, the SHA-256 algorithm can be used to calculate the hash value of the key and compare it with the previously saved result. If it matches, the key reconstruction is successful.After the key is used, it must be securely erased from the memory immediately. Simply releasing the memory is not enough because the data may still remain. A safe practice is to overwrite the original memory area with random data multiple times before releasing it. This can effectively prevent memory residual attacks. This distributed key management scheme has multiple advantages. First, it improves the availability of the system. Even if some nodes fail, the system can continue to operate as long as a sufficient number of nodes are working properly. Second, it enhances security. An attacker needs to break into multiple nodes at the same time to obtain the complete key, which greatly increases the difficulty of attack. Finally, it provides flexible access control. By adjusting the threshold value, a balance can be achieved between security and availability. In practical applications, this technology can be used to protect high-value crypto assets, such as the private keys of digital currency wallets. By distributing the private keys on servers in multiple geographical locations, the risk of theft can be effectively reduced. At the same time, a reasonably set threshold value can ensure that users can still use their assets even if some servers are offline. This scheme not only ensures security, but also provides a good user experience.

[0028] Step S102, building a decentralized identity authentication and authority management mechanism through blockchain technology, mapping the identity information and authority of members to the blockchain ledger, and using smart contracts to automatically manage member joining, exiting and authority changes.

[0029] Obtain the identity information of the member, encrypt the identity information using a hash algorithm to obtain the member's digital identity; store the digital identity together with the member's public key information in the blockchain account book; based on the role-based access control model, associate the member's permission information with its digital identity and store it in the role-permission mapping table of the blockchain account book; build a smart contract to encapsulate member joining, exiting and permission change operations as smart contract functions; for transaction requests initiated by members, call the permission verification function of the smart contract to determine whether the requested operation is in line with the member's permission range based on the role-permission mapping table. If it is, the request is allowed to be executed, and the smart contract is triggered to automatically update the identity and permission information in the blockchain account book, otherwise the request is rejected; verify and confirm the identity authentication and permission management transactions initiated by members through the consensus mechanism of the blockchain, generate new blocks and add them to the blockchain, so as to achieve the immutability and traceability of transactions; set up an event monitoring mechanism in the smart contract, trigger corresponding events when the identity and permission of members change, and call the function of the smart contract to automatically update the identity and permission information in the blockchain account book to ensure real-time synchronization of data.

[0030] Specifically, implementing identity authentication and permission management in the blockchain system is the key to ensuring network security. First, the system needs to obtain the identity information of the members, such as name, ID number, etc. To protect privacy, hash algorithms such as SHA-256 can be used to encrypt this information and generate a unique digital identity. For example, hashing "Zhang San" and "330106199001011234" yields "7f83b1657ff1 fc53b92dc18148a1 d65dfc2d4b1fa3d677284addd200126d9069"

[0031] As its digital identity. This digital identity is stored in the blockchain ledger together with the member's public key (such as RSA public key) to form an identity-public key mapping. This not only protects the original identity information, but also facilitates subsequent identity authentication. The role-based access control model (RBAC) can be used to manage member permissions. The system associates predefined roles (such as administrators, ordinary users, etc.) with corresponding permission sets, and then binds the member's digital identity to a specific role. These relationships are stored in the role-permission mapping table of the blockchain ledger, ensuring the transparency and immutability of permission allocation. Smart contracts are the core of automated identity and permission management. Operations such as member joining, exiting, and permission changes can be encapsulated as functions of smart contracts. When a member initiates a transaction request, the system calls the permission verification function in the smart contract. This function determines whether the request meets the member's permission range based on the role-permission mapping table. If it meets the requirements, execution is allowed and the relevant information in the ledger is automatically updated; if it does not meet the requirements, the request is rejected. This mechanism not only ensures the compliance of the operation, but also improves the automation of the system. The consensus mechanism of blockchain (such as PoW, PoS, etc.) is used to verify and confirm transactions related to identity authentication and permission management. Consensus transactions are packaged into new blocks and added to the blockchain. This process ensures the immutability and traceability of transactions. For example, if someone attempts to tamper with the permission record of a member, other nodes can discover and reject this illegal operation by verifying the historical block. The event monitoring mechanism in the smart contract further enhances the real-time and automation of the system. When the identity or permission of a member changes, the corresponding event will be triggered. These events will call the update function in the smart contract to automatically synchronize the identity and permission information in the blockchain ledger. For example, when an ordinary user is promoted to an administrator, the system will automatically update its record in the role-permission mapping table to ensure that it immediately obtains the corresponding permissions. This identity authentication and permission management solution based on blockchain and smart contracts has multiple advantages. First, it improves the security of the system. Through hash algorithms and public key encryption, the original identity information of the user is effectively protected. Second, it enhances the transparency and auditability of the system. All identity and permission changes are recorded on the blockchain and can be traced and verified. Third, it improves management efficiency. The automatic execution of smart contracts reduces human intervention and reduces the risk of errors and fraud. Finally, it provides flexibility for future expansion. By modifying the smart contract, it is easy to adjust the permission strategy or add new functions.

[0032] Step S103, when a member node receives a transaction request, it determines the legitimacy of the requester through identity authentication and authority verification. If the verification passes, the request is broadcast to other member nodes; other member nodes perform the same verification after receiving the request, and if the preset confirmation threshold is reached, a consensus is reached on the request.

[0033] According to the pre-established identity authentication rules, the received transaction request is obtained; the identity information of the requester of the transaction request is verified by using digital signature technology to determine whether the identity of the requester is legal; if the identity of the requester is legal, the transaction request is verified according to the preset permission verification rules to determine whether the requester has the authority to initiate the transaction request; if the requester has the authority to initiate the transaction request, the transaction request is broadcast to other member nodes in the blockchain network; after receiving the broadcasted transaction request, other member nodes use the same identity authentication rules and permission verification rules as the initiating node to verify the transaction request, and count the number of nodes that have completed the verification and confirmation of the transaction request according to the preset confirmation threshold. When the number of confirmed nodes reaches the preset threshold, it is determined that a consensus has been reached on the transaction request, and the transaction request is marked as a consensus state; the transaction request that has reached a consensus is submitted to the blockchain network; using the preset consensus algorithm, the member nodes package and verify the transaction request to generate a new block; through the link pointer, the new block and the existing block form a chain structure to realize the permanent storage and tamper-proof of the transaction request data; the packaged new block is appended to the blockchain to complete the processing of the transaction request.

[0034] Specifically, when processing a transaction request in a blockchain network, it is first necessary to obtain the received transaction request according to the pre-established identity authentication rules. These rules may include checking the request format, verifying the timestamp, etc. For example, the system may require that all transaction requests must contain fields such as the sender address, the receiver address, the transaction amount, and the timestamp. Next, the legitimacy of the requester's identity is verified using digital signature technology. Digital signatures usually use asymmetric encryption algorithms such as RSA or elliptic curve algorithms. Suppose A initiates a transaction, he will use his private key to sign the transaction content. The system uses A's public key to verify the signature to ensure that the transaction is indeed initiated by A and has not been tampered with. If the identity authentication is passed, the system will determine whether the requester has the right to initiate the transaction according to the preset permission verification rules. This may involve checking the account balance, transaction limit, etc. For example, if A wants to transfer 100 tokens, the system will check whether her account has enough balance and whether it exceeds the daily transaction limit. After passing the identity and permission verification, the transaction request will be broadcast to other nodes in the network. Each receiving node will repeat the above verification process to ensure the legitimacy of the transaction. This multiple verification mechanism enhances the security and reliability of the system. The nodes in the network will count the number of nodes that have completed the verification and confirmed the transaction according to the preset confirmation threshold. This threshold may vary depending on the size of the network and security requirements. For example, in a network consisting of 100 nodes, at least 51 nodes may be required to confirm to reach a consensus. When the number of confirming nodes reaches the threshold, the transaction is marked as a consensus state. The transaction request that has reached consensus is then submitted to the blockchain network. The nodes in the network use a preset consensus algorithm (such as proof of work PoW or proof of stake PoS) to package and verify the transaction and generate a new block. Under the PoW mechanism, nodes compete for the right to package by solving complex mathematical problems; while in the PoS mechanism, nodes that hold more tokens or stake for a longer time are more likely to obtain the right to package. The newly generated block forms a chain structure with the existing blocks through link pointers to ensure the permanent storage and tamper-proof of data. Each block contains the hash value of the previous block, forming an irreversible chain. This structure makes it easy to detect any attempt to tamper with historical transactions. Finally, the new block is appended to the blockchain to complete the processing of the transaction request. This process not only ensures the irreversibility of transactions, but also improves the transparency and traceability of the entire system. Through this mechanism, the blockchain network can efficiently process transaction requests while ensuring the security and integrity of data.

[0035] Step S104, after reaching a consensus, the member node reconstructs a complete authorization key based on the request content, signs the key using an aggregate signature scheme, generates an authorization certificate, and returns the certificate to the requesting node.

[0036] According to the request content sent by the requesting node, obtain relevant information of the authorization key, including the key length and key purpose of the authorization key; according to the relevant information of the obtained authorization key, use the Shamir key splitting algorithm to split the authorization key into multiple key fragments, and each member node holds a key fragment; obtain the key fragments provided by each member node, and reconstruct the complete authorization key according to the Shamir key recovery algorithm; through the PBFT consensus mechanism in the blockchain network, the member nodes reach a consensus on the request content, and then use the BLS aggregate signature scheme, and each member node uses its own signature private key to jointly sign the reconstructed authorization key to confirm that the authorization key has been correctly distributed.

[0037] Specifically, in a blockchain network, the secure management of authorization keys is crucial. First, the requesting node sends a request containing information about the required authorization key. This information usually includes the key length and purpose. For example, a 2048-bit RSA key for digital signatures. After obtaining the key information, the system uses the Shamir key splitting algorithm to split the authorization key into multiple fragments. This method improves the security of the key because a single fragment cannot restore the complete key. Assuming there are 5 member nodes, the key can be split into 5 parts, with each node holding one. In this way, even if individual nodes are compromised, the overall key security can still be guaranteed. When the complete key is needed, the system collects the key fragments provided by each member node. Using the Shamir key recovery algorithm, the complete authorization key can be reconstructed from these fragments. This process is similar to a jigsaw puzzle. Only when a sufficient number of fragments (5 in this case) are correctly combined can the original image (i.e., the complete key) be restored. Next, the blockchain network uses the Practical Byzantine Fault Tolerance (PBFT) consensus mechanism to verify the legitimacy of the request content. PBFT can reach consensus even in the presence of a small number of malicious nodes, improving the fault tolerance of the system. For example, in a network of 10 nodes, even if 3 nodes fail or are attacked, the remaining 7 honest nodes can still reach a consensus decision. Once the PBFT consensus is reached, each member node will use the BLS (Boneh-Lynn-Shacham) aggregate signature scheme to jointly sign the reconstructed authorization key. BLS signatures are aggregatable and can compress multiple signatures into a single signature, greatly reducing storage and communication overhead. Assuming that 100 nodes participate in the signature, the traditional scheme may need to transmit and store 100 independent signatures, while the BLS scheme only needs one aggregate signature while ensuring the same security. This multiple protection mechanism not only ensures the secure distribution of authorization keys, but also improves the reliability and efficiency of the entire system. Through split storage, consensus verification and aggregate signatures, single point failures and potential malicious attacks are effectively prevented. At the same time, this method also improves the scalability of the system because the overhead of signature verification will not increase significantly even if the number of nodes increases. The whole process reflects the innovative application of blockchain technology in key management.

[0038] Step S105, introduce a key cache mechanism, whereby the member node maintains a local cache to store historical authorization keys in the recent period; when processing a new authorization request, an available key is searched from the local cache, and if a match is found, it is used directly.

[0039] Obtain the authorization request received by the member node, the authorization request includes the requested resource identifier, requester identity and request timestamp; according to the requested resource identifier, requester identity and request timestamp, search the local key cache of the member node for the historical authorization key that matches the authorization request, and the local key cache uses a hash table as the index structure; if a historical authorization key that matches the authorization request and has not expired is found in the local key cache, the historical authorization key is taken out from the local key cache and used for the current authorization request; if a historical authorization key that matches the authorization request is not found in the local key cache, or the historical authorization key found has expired, a key request is sent to the central node to obtain a new authorization key that matches the authorization request; the new authorization key obtained from the central node is stored in the local key cache, and the index structure of the hash table is updated; the cache capacity and cache strategy of the local key cache are dynamically adjusted according to the system load, the frequency and distribution of key requests.

[0040] Specifically, in the blockchain network, authorization key management is a key link. When a member node receives an authorization request, it first needs to parse the request content, including the resource identifier, requester identity, and timestamp. For example, a request may be "User A requested access to file XYZ at 10:00 on May 1, 2023." This information constitutes the unique identifier of the authorization request. In order to improve efficiency, the member node will maintain a key cache locally. This cache uses a hash table as an index structure to quickly find matching historical authorization keys. The key of the hash table can be a combination of request information, such as "A_XYZ_20230501100000", and the value is the corresponding authorization key. This structure can complete the search operation within the time complexity of O(1), greatly improving the system response speed. When a new authorization request is received, the node first searches in the local cache. If a matching and unexpired key is found, it can be used directly without communicating with the central node. This approach not only reduces the network load, but also improves the overall performance of the system. For example, if A frequently accesses file XYZ, his authorization key will be cached so that subsequent access requests can be processed quickly. However, if no matching key is found in the cache or the key has expired, the node needs to request a new authorization key from the central node. After obtaining the new key, the node will store it in the local cache and update the hash table index. In this way, the next time the same request is made, the key can be directly obtained from the cache. The system will also dynamically adjust the cache strategy according to actual conditions. For example, if it is observed that the access frequency of certain resources suddenly increases, the system may increase the cache time of the keys corresponding to these resources. On the contrary, for resources that have not been accessed for a long time, their keys may be removed from the cache to save space. In addition, the system may also adjust the cache capacity according to the overall load situation. During peak hours, the cache capacity may be increased to cope with more concurrent requests. This dynamic adjustment mechanism enables the system to strike a balance between efficiency and resource utilization. In this way, the system not only ensures the security of the authorization process, but also improves processing efficiency. The use of local cache reduces the dependence on the central node and improves the scalability and fault tolerance of the system. At the same time, the dynamic adjustment strategy ensures that the system can adapt to different load conditions and maintain good performance under various conditions.

[0041] Step S106, design a dynamic key update strategy, comprehensively consider the frequency of group member changes and transaction request concurrency factors, and adjust the key update cycle; during the update, the management node initiates a key negotiation request, generates new key fragments, and replaces the original fragments.

[0042] The frequency of member changes and transaction request concurrency data in the group are obtained, and the K-means clustering algorithm is used to perform cluster analysis on the data to obtain the key update cycle of different categories of groups; the management node and group members jointly generate new keys according to the key update cycle, and divide the new keys into multiple key fragments; through the Ethereum smart contract, multiple key fragments are distributed to each member in the group; after receiving the new key fragments, each member in the group replaces the original key fragments stored locally, and restores the new key fragments into a complete key to complete the key update; if the key update is not completed within the specified time, it is determined that the update has failed, and the key is rolled back to the previous version, and the next key update cycle is adjusted according to the reason for the failure; the updated key is used to encrypt the communication data in the group to ensure the security of data transmission.

[0043] Specifically, in blockchain networks, key management is essential to ensure communication security. In order to adapt to the needs of different groups, the system adopts a dynamic key update mechanism. First, the system collects data on the frequency of member changes and transaction request concurrency within the group. These data reflect the activity and security needs of the group. For example, a financial institution group that frequently conducts high-value transactions may have a large number of concurrent requests every day, while the members are relatively stable; in contrast, a social network group may have frequent member changes but low daily transaction volume. The system uses the K-means clustering algorithm to analyze this data, classify the groups into different categories, and determine the appropriate key update cycle for each category. In this scenario, the algorithm may classify the groups into three categories: high-frequency update, medium-frequency update, and low-frequency update. For example, a financial institution group may be classified as a high-frequency update, requiring daily key updates; while a social network group may be classified as a low-frequency update, and a monthly key update is sufficient. After determining the update cycle, the management node will initiate the key update process at the appropriate time. The generation of new keys is a collaborative process, in which the management node and group members participate together to ensure the randomness and security of the keys. The generated new key is then split into multiple key fragments. This practice is based on the principle of secret sharing and improves the security of the key. Even if a member's key fragment is leaked, the attacker cannot obtain the complete key. The distribution of key fragments takes advantage of the characteristics of Ethereum smart contracts. As a decentralized and tamper-proof program, smart contracts can safely distribute key fragments to group members. Each member can obtain their own key fragments through smart contracts, but cannot access the fragments of other members. This method not only ensures the security of the distribution process, but also provides traceability for subsequent audits. When group members receive new key fragments, they will immediately replace the old fragments stored locally. Subsequently, member nodes will try to combine the new key fragments to restore the complete key. This process requires collecting a sufficient number of fragments, usually using a threshold secret sharing scheme. For example, in a group with 10 members, at least 7 fragments may be required to restore the complete key. This mechanism not only ensures the security of the key, but also provides a certain degree of fault tolerance. The system also sets a time limit for key updates. If the update is not completed within the specified time, the system will determine that the update has failed and roll back to the previous version of the key. This mechanism ensures that the group can continue to operate normally even if problems occur during the update process. At the same time, the system will analyze the cause of the failure and adjust the next update cycle accordingly. For example, if the failure is caused by network latency, the system may extend the time window for the next update. After the key is successfully updated, all communication data within the group will be encrypted with the new key. This ensures that even if the old key is cracked, the attacker cannot decrypt the new communication content. The encryption process usually uses a symmetric encryption algorithm, such as AES, because of its efficiency and security.For particularly sensitive information, the system may use double encryption, that is, first encrypt with a symmetric key and then encrypt with an asymmetric key to provide additional security. The advantage of this dynamic key management mechanism lies in its adaptability and security. By analyzing group behavior, the system can provide the most suitable key update strategy for different types of groups. Frequent key updates increase the security of the system, while adjusting the update frequency according to actual needs balances security and efficiency. The decentralized storage of keys and the threshold reconstruction mechanism further enhance the robustness of the system, so that even if some nodes are compromised, the entire system can remain secure. At the same time, the use of smart contracts for key distribution not only ensures the transparency of the process, but also reduces the risk of centralized management. This mechanism provides a flexible, secure and efficient key management solution for blockchain networks.

[0044] The above are only preferred embodiments of one or more embodiments of this specification and are not intended to limit one or more embodiments of this specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of one or more embodiments of this specification should be included in the scope of protection of one or more embodiments of this specification.

Claims

1. A method for decentralized management of digital assets, characterized in that: Methods include: According to the preset distributed key generation protocol, the legal members in the group jointly participate in generating the initial authorization key, and the threshold key sharing scheme is used to divide the key into multiple fragments, which are stored in different member nodes respectively; Build a decentralized identity authentication and authority management mechanism through blockchain technology, map members' identity information and authority to the blockchain ledger, and use smart contracts to automatically manage members' joining, exiting, and authority changes; When a member node receives a transaction request, it determines the legitimacy of the requester through identity authentication and authority verification. If the verification is successful, the request is broadcast to other member nodes. After receiving the request, other member nodes perform the same verification. If the preset confirmation threshold is reached, a consensus is reached on the request. After reaching a consensus, the member nodes reconstruct the complete authorization key based on the request content, sign the key using the aggregate signature scheme, generate the authorization certificate, and return the certificate to the requesting node; Introducing a key cache mechanism, where member nodes maintain a local cache to store historical authorization keys from the recent period. When processing a new authorization request, they search for available keys from the local cache and use them directly if a match is found. Design a dynamic key update strategy, comprehensively consider the frequency of changes in group members and the concurrency of transaction requests, adjust the key update cycle, and during the update, the management node initiates a key negotiation request to generate new key fragments to replace the original fragments.

2. The method according to claim 1, characterized in that According to the preset distributed key generation protocol, the legal members in the group jointly participate in generating the initial authorization key, and the threshold key sharing scheme is used to divide the key into multiple fragments, which are stored in different member nodes respectively, including: Obtain a list of legal members in the group, verify the legitimacy of each member through digital signatures, and determine the identities of members participating in distributed key generation; According to the preset distributed key generation protocol, legitimate members who have passed identity authentication jointly participate in generating the initial authorization key; The generated initial authorization key is split using the secret sharing algorithm in secure multi-party computing to obtain multiple key fragments, and the number of fragments is determined according to a preset threshold value; The key fragments are distributed to different member nodes through a secure communication protocol, and each node stores only one key fragment; On each member node, an encryption algorithm is used to encrypt the received key fragments to obtain the encrypted key fragments, which are then stored using a secure key management mechanism. When the initial authorization key is needed, the authorized member node provides the key fragments it holds; Through the threshold key recovery algorithm, a threshold number of key fragments are combined to reconstruct the complete initial authorization key; The reconstructed initial authorization key is verified and destroyed immediately after use.

3. The method according to claim 1, characterized in that The decentralized identity authentication and authority management mechanism is constructed through blockchain technology, the identity information and authority of members are mapped to the blockchain ledger, and the smart contract is used to automatically manage the joining, exiting and authority changes of members, including: Obtain the member's identity information, encrypt the identity information using a hash algorithm, and obtain the member's digital identity; The digital identity is stored in the blockchain ledger together with the member’s public key information; The role-based access control model associates the member's permission information with their digital identity and stores it in the role-permission mapping table of the blockchain ledger; Build smart contracts and encapsulate member joining, exiting and permission change operations into smart contract functions; For transaction requests initiated by members, the permission verification function of the smart contract is called to determine whether the requested operation is within the member's permission range based on the role-permission mapping table. If it is, the request is allowed to be executed, and the smart contract is triggered to automatically update the identity and permission information in the blockchain ledger. Otherwise, the request is rejected. The identity authentication and rights management transactions initiated by members are verified and confirmed through the consensus mechanism of the blockchain, and new blocks are generated and added to the blockchain to achieve the immutability and traceability of transactions; An event monitoring mechanism is set up in the smart contract. When member identities and permissions change, corresponding events are triggered. The smart contract function is called to automatically update the identity and permission information in the blockchain ledger to ensure real-time synchronization of data.

4. The method according to claim 1, characterized in that When a member node receives a transaction request, it determines the legitimacy of the requester through identity authentication and authority verification. If the verification passes, it broadcasts the request to other member nodes; After receiving the request, other member nodes perform the same verification. If the preset confirmation threshold is reached, a consensus is reached on the request, including: Obtain received transaction requests according to pre-established identity authentication rules; Use digital signature technology to verify the identity information of the requester of the transaction request to determine whether the requester's identity is legal; If the requester's identity is legitimate, the transaction request is verified according to the preset authority verification rules to determine whether the requester has the authority to initiate the transaction request; If the requester has the authority to initiate a transaction request, the transaction request will be broadcast to other member nodes in the blockchain network; After receiving the broadcasted transaction request, other member nodes use the same identity authentication rules and permission verification rules as the initiating node to verify the transaction request, and count the number of nodes that have completed verification and confirmation of the transaction request according to the preset confirmation threshold. When the number of confirmed nodes reaches the preset threshold, it is determined that a consensus has been reached on the transaction request, and the transaction request is marked as a consensus state; Submit the consensus transaction request to the blockchain network; Using the preset consensus algorithm, member nodes package and verify transaction requests to generate new blocks; The new block and the existing block are linked together to form a chain structure through link pointers, so that the transaction request data can be permanently stored and tamper-proof. Append the packaged new block to the blockchain to complete the processing of the transaction request.

5. The method according to claim 1, characterized in that After reaching a consensus, the member node reconstructs the complete authorization key according to the request content, signs the key using the aggregate signature scheme, generates an authorization certificate, and returns the certificate to the requesting node, including: According to the request content sent by the requesting node, obtain relevant information of the authorization key, including the key length and key purpose of the authorization key; According to the obtained authorization key information, the Shamir key splitting algorithm is used to split the authorization key into multiple key fragments, and each member node holds one key fragment; Obtain the key fragments provided by each member node and reconstruct the complete authorization key according to the Shamir key recovery algorithm; Through the PBFT consensus mechanism in the blockchain network, the member nodes reach a consensus on the request content, and then adopt the BLS aggregate signature scheme. Each member node uses its own signature private key to jointly sign the reconstructed authorization key to confirm that the authorization key has been correctly distributed.

6. The method according to claim 1, characterized in that The key cache mechanism is introduced, and the member node maintains a local cache to store the historical authorization keys in the recent period; when processing a new authorization request, the available key is searched from the local cache, and if it is hit, it is directly used, including: Obtain the authorization request received by the member node, which includes the requested resource identifier, requester identity, and request timestamp; According to the requested resource identifier, requester identity and request timestamp, the historical authorization key matching the authorization request is searched in the local key cache of the member node. The local key cache uses a hash table as an index structure. If a historical authorization key that matches the authorization request and has not expired is found in the local key cache, the historical authorization key is taken out of the local key cache and used for the current authorization request; If the historical authorization key that matches the authorization request is not found in the local key cache, or the historical authorization key found has expired, a key request is sent to the central node to obtain a new authorization key that matches the authorization request; Store the new authorization key obtained from the central node into the local key cache and update the index structure of the hash table; Dynamically adjust the cache capacity and cache strategy of the local key cache based on the system load, frequency and distribution of key requests.

7. The method according to claim 1, characterized in that The dynamic key update strategy is designed to comprehensively consider the frequency of member changes in the group and the concurrency of transaction requests, and adjust the key update cycle; during the update, the management node initiates a key negotiation request to generate new key fragments to replace the original fragments, including: Obtain the member change frequency and transaction request concurrency data within the group, use the K-means clustering algorithm to perform cluster analysis on the data, and obtain the key update cycle of different categories of groups; The management node and group members jointly generate new keys according to the key update cycle, and divide the new keys into multiple key fragments; Through the Ethereum smart contract, multiple key fragments are distributed to each member in the group; After receiving the new key fragments, each member in the group replaces the original key fragments stored locally and restores the new key fragments into a complete key to complete the key update; If the key update is not completed within the specified time, it is considered as an update failure, and the previous version of the key is rolled back. The next key update cycle is adjusted according to the cause of the failure. The updated key is used to encrypt the communication data within the group to ensure the security of data transmission.

8. A decentralized digital asset management system, characterized in that: The system includes: Distributed key generation module, used to generate initial authorization keys and split storage; Blockchain identity authentication module, used to manage membership and permissions; Consensus verification module, used to verify the legitimacy of requests and reach consensus; An authorization credential generation module, used to reconstruct the key and generate the authorization credential; Key cache module, used to maintain local key cache to improve efficiency; The dynamic key update module is used to regularly update keys to ensure security.

Images