Randomization method and single secret leader election method

Abstract

The invention discloses a randomization method and a single secret leader election method, and belongs to the technical field of computer technology and information security. In order to solve the technical problems of unfair leader election and insufficient privacy caused by the fact that a decayed enemy can use a randomization process to interfere a system state, an approximately unique randomization component is constructed by using random factor commitment and hierarchical broadcast, and the component is used for driving a random shuffling process to generate a unique system state. A leader node is selected from the secret list based on the persistent random pointer and the system state is updated by the selected leader. According to the scheme, the consistency of randomization results and the approximate uniqueness of random factors can be realized, corruption opponents with any malicious behaviors can be resisted, and the fairness and privacy of election of a single secret leader can be ensured.

Description

Technical Field

[0001] This invention belongs to the fields of computer technology and information security technology, and specifically relates to randomization methods and methods for electing a single secret leader. Background Technology

[0002] Leader election (LE) is a crucial component in the implementation of distributed protocols, aiming to improve execution efficiency and enhance system security. Single Secret Leader Election (SSLE), a special variant of LE, guarantees the selection of a unique leader node from multiple participant nodes. Furthermore, it ensures that the elected node's identity remains unknown to other nodes until it actively discloses itself, thus achieving high privacy and enhanced security. However, existing SSLE implementations generally suffer from inefficiency and struggle to support lightweight deployments, severely limiting the real-world application and widespread adoption of the SSLE protocol.

[0003] To improve the output efficiency of the SSLE protocol, existing SSLE protocols utilize threshold fully homomorphic encryption and random shuffling to generate random secret data. This secret data is then packaged into the blockchain using blockchain technology, synchronizing it to all nodes in the distributed system. However, this chain-based SSLE mechanism faces several shortcomings: First, the novel but unstable chain structure allows different participants to use different secret data as the basis for election, thus failing to maintain the unique property of the SSLE protocol's output. Second, chain confirmation requires a certain delay, and the confirmation and usage time of secret data lack a necessary correlation, making it difficult to execute elections using a pre-defined scheme. However, as a fundamental component of distributed protocols, the SSLE protocol requires efficient and continuous random data output; therefore, chain-based solutions struggle to adapt to diverse deployment needs. Summary of the Invention

[0004] The purpose of this invention is to propose an approximately unique randomization method for resisting corrupted adversaries. This method, based on a hierarchical broadcast mechanism and random factor commitment technology, performs randomization processing on the system state, achieving both the uniqueness of the randomization result and the approximate uniqueness of the random factors. Each participant in the system pre-shares a set of random factors, using these random factors as seeds to randomize its local system state. The participant performing randomization generates new random factors while completing the state randomization, and transmits the randomization message and the updated random factors through hierarchical broadcast. Through this mechanism, the sustainability of the randomization process is ensured while maintaining the consistency of the randomization result.

[0005] Another objective of this invention is to provide a single-secret leader election method based on a unique state. This method uses a random shuffling component as the core of randomization and employs an approximately unique randomization method to construct a leader election protocol based on a unique state. The method integrates the identity information of the participants into a secret list and selects target elements from this list based on continuously generated random pointers, thereby determining the participant holding the corresponding secret as the leader node. This secret list serves as the key system state for electing the leader node. The selected leader node executes the approximately unique randomization method based on this state; other participants update their local states according to the execution results of the randomization method. This mechanism prevents corrupted nodes from interfering with the state updates of honest nodes through malicious behavior, thus ensuring the fairness and privacy of the election results.

[0006] To achieve the above objectives, the present invention adopts the following technical solution.

[0007] A randomization method includes the following steps: 1) Generate a commitment tuple Com based on a locally generated random number r and broadcast it; 2) Based on the commitment tuple Com and the local state information st, perform a randomization refresh process to obtain the randomized message m; 3) Perform the hierarchical broadcast process to verify, sign, and broadcast the signature set of the randomized message m. Determine the confidence level c based on the signature set and the revocation set, and output the randomized message m and its confidence level c.

[0008] Furthermore, in step 1), a commitment tuple Com is generated for the random number r using the Pederson commitment scheme.

[0009] Furthermore, the randomization refresh process in step 2) includes: (1) Randomize the local state st based on the random number r in the commitment tuple Com to generate a random state. ; (2) Based on random state Generate a non-interactive zero-knowledge proof π for proving the correctness of randomization processing; (3) Multiplication group of order q Random numbers are drawn from Generate new commitment tuples And generate a non-interactive zero-knowledge proof of the commitment tuple. ; (4) From random state Commitment tuple And prove π Construct a randomized message m.

[0010] Furthermore, the hierarchical broadcasting process in step 3) includes: (1) Initialize the confidence level c to 0 and broadcast the randomized message m; (2) Verify whether the random state in the randomized message m is calculated from the local state st and the random number r in the commitment tuple Com; (3) Sign the valid randomized message and send it to the randomization executor; (4) The randomized executor collects valid signatures to form a signature set Ω and broadcasts it; (5) If a participant has not received the signature set Ω and has already signed the message, then broadcast the revocation message and add it to the revocation set. ; (6) Based on the signature set Ω and the revocation set The magnitude relationship determines the confidence level c. Further, step (6) includes: if Then confidence level ,like, and Then confidence level , where n represents the total number of participants.

[0011] A method for electing a single, secret leader includes the following steps: 1) Perform system initialization operations, generate public-private key pairs, and based on the group The generator g generates identity commitments and forms a commitment list h, constructing the initial system state st; 2) When entering the predetermined round θ, send a coin toss request to the random beacon function according to the confidence level c output by the previous randomization process, obtain the global random number λ and update the confidence level c; 3) Update the local state st based on the updated confidence level c, and replace the local state with the random state from the previous round of randomization messages; 4) Determine the leader node based on the commitment list h and the global random number λ. If the participant is the leader, execute the commitment opening process and broadcast the identity certificate, and call the randomization method described in claim 1 to perform random permutation and exponential randomization on the system state and generate a randomized message; otherwise, only the leader node executes the hierarchical broadcast process in the randomization method.

[0012] Furthermore, in step 1), each participating party uses their private key to... Generate identity commitment values ​​and form a commitment list h.

[0013] Furthermore, in step 2), when the random beacon function receives no less than When a coin toss request is made, a random number λ is selected from the set of natural numbers less than n; the random number λ is broadcast for each participant to use to index the commitment list h.

[0014] Further, step 4) executing the commitment to open processing and broadcasting identity verification includes: (1) Obtain the target commitments determined by the random number λ in the commitment list h; (2) Invoke the promise-open algorithm to verify whether the promise can be opened with the local private key; (3) Generate non-interactive zero-knowledge proofs And broadcast it.

[0015] Furthermore, the random permutation and exponential randomization processes performed by the leader node in step 4) include: (1) Based on the random factor of the previous round, random permutation and exponential randomization are performed on the group generator g and the commitment list h to obtain the random state. ; (2) Draw new random number tuples to generate new random factor commitments; (3) Based on random state The new random factor commitment generates randomized messages, and the randomization process is completed by the leader node. The remaining non-leader participants only participate in the hierarchical broadcasting process of the above randomized messages.

[0016] Compared with the prior art, the present invention has at least the following advantages.

[0017] 1. This invention employs a randomization method based on random factor commitments to limit the ability of adversaries to corrupt while ensuring the privacy of the participants, thus preventing adversaries from exploiting the advantages of the randomized executor to attack honest participants.

[0018] 2. This invention addresses the publication and transmission of randomized messages by employing hierarchical broadcasting to complete delivery, eliminating the need for an additional proposal confirmation process. This enables each participating party to efficiently update its local state within a constant number of rounds and construct secure protocol components based on the updated state.

[0019] 3. This invention constructs a single secret leader election protocol framework based on random permutation, and combines it with an approximately unique randomization component. This framework can resist corrupting adversaries with arbitrary malicious behavior, ensure the consistency of system state between randomization operations, and enhance the uniqueness of the protocol output results. Specifically, it includes the following two aspects: 1) Construction of near-unique randomization components. This invention consists of a random factor commitment algorithm and a hierarchical broadcast algorithm. The random factor commitment causes the participants to perform randomization processing according to a predetermined and undisclosed random factor, and the hierarchical broadcast obtains the randomization message and its confidence level, thereby limiting the ability of corrupting adversaries to use randomization opportunities to launch attacks.

[0020] 2) Construction of a Continuous Single Secret Leader Election Protocol. This invention consists of a coin toss query process and a near-unique randomization component. Each participant performs a coin toss query based on the confidence level output by the near-unique randomization component, and determines the leader's identity based on the result returned by the coin toss query. The security of this protocol depends on the security of the near-unique randomization component. The protocol has the following properties: each participant has an equal probability of becoming the leader node; other participants cannot obtain the leader node's identity information before the leader node reveals its identity; and at most one leader node is elected after each round of execution. Attached Figure Description

[0021] Figure 1 This is an architecture diagram of a single secret leader election protocol based on a unique state. Detailed Implementation

[0022] To make the above features and advantages of the present invention more apparent and understandable, the technical solution of the present invention will be further described below through specific embodiments.

[0023] This embodiment provides a randomization method and a single secret leader election method based on the randomization method, such as... Figure 1 As shown, the overall scheme consists of random factor commitment, randomized refresh, and hierarchical broadcasting processes to achieve approximately consistent random state updates, and on this basis, to complete a unique and privacy-secure leader election.

[0024] I. Randomization methods.

[0025] This randomization method consists of participants generating local random factors, committing to the random factors, performing randomization calculations based on the commitments, and completing consensus propagation of randomized messages through a hierarchical broadcast protocol.

[0026] 1. Local random factor generation and commitment.

[0027] The participants first generate a local random number r, and then commit to the random number r using the Pederson commitment scheme, obtaining a commitment tuple Com. The participants store Com locally and broadcast it.

[0028] The Pederson commitment scheme includes the following algorithms: Input message m and random number r, output the promise value about m. ; Enter the commitment value and the random number r used for commitment, if If the commitment is made about m, output true; otherwise, output false.

[0029] In this method, a commitment is made to pre-bind the random seed required for subsequent randomization processes.

[0030] 2. Randomized message generation.

[0031] The participants perform a randomization process based on their local state st and the locally stored commitment tuple Com, generating a randomized message m. The specific process is as follows.

[0032] 1) Obtain the latest local state st, and use the random number r contained in the commitment tuple Com as the randomization factor to perform randomization calculation on the state st to obtain the randomization result. .

[0033] 2) Generate non-interactive zero-knowledge proofs π regarding the correctness of randomization operations.

[0034] 3) Multiplicative groups of order q Random numbers are randomly drawn from the middle. and to Generate new commitment tuples Simultaneously, it generates a non-interactive zero-knowledge proof that guarantees the correctness of computation. .

[0035] 4) Use randomized results ,promise Prove that π and Construct a randomized message m.

[0036] Randomization methods can be abstracted into the following interface: Input commitment Com and local state st, return randomized message m.

[0037] 3. Hierarchical broadcasting process.

[0038] The participating parties invoke a hierarchical broadcast protocol to propagate the randomized message m and determine its confidence level c. This process includes the following steps.

[0039] 1) Initialize confidence level And broadcast the randomized message m.

[0040] 2) If the randomized message contains a random state If the randomized message is calculated from the latest local state st and the random number r pre-bound in the commitment, then the randomized message is a valid message.

[0041] 3) Upon receiving a valid randomized message, each participant uses its private key to generate a signature σ for message m and sends it to the randomization executor. If σ is verified using the signer's public key, it is a valid signature.

[0042] 4) The randomized executor collects valid signatures σ from other participants and adds them to the set Ω; when the size of the set Ω reaches... ( When the total number of participants is represented, the randomized executor broadcast set Ω is used.

[0043] 5) If a participant has not received the set Ω broadcast by the randomization executor, but has signed the message m, then broadcast the revocation message. The participant who receives the revocation message adds it to the set. .

[0044] 6) If Then update the confidence level. Otherwise if Then update the confidence level. The final output tuple .

[0045] The hierarchical broadcasting process can be abstracted as follows: If the participant is the leader node, input a randomized message m; otherwise, input nothing. Output the message and the confidence level tuple. .

[0046] The randomization method described above, Random, consists of random factor commitment, randomization refresh RandGen, and graded broadcast GradeDelivery, and is applied to the subsequent single secret leader election protocol.

[0047] II. Method for electing a single secret leader.

[0048] The single secret leader election method consists of system initialization (Setup), leader election (Elect), and election result verification (VerifyElect) to achieve a unique, privacy-secure, and adversarial leader determination process. During system initialization, all participants store a list of identity information (h) in the form of Pederson commitments, and the system state is initialized as follows: , where g is the group The generator.

[0049] 1. System initialization Setup.

[0050] The participant nodes initialize the system, including the following processes.

[0051] 1) Participant nodes execute the signature initialization algorithm to generate a public-private key pair and broadcast the public key.

[0052] Signature schemes include: Input a random seed, return a public / private key pair. ; Input message m and private key sk, return signature; Input public key pk, message m and signature σ. If σ is valid, output true.

[0053] 2) Participants are group-based The generator g generates an identity commitment for the private key and broadcasts the identity commitment. All participants maintain a list h consisting of the identity commitments locally, forming the initial state of the system. .

[0054] 2. Proceed to the θth round of elections.

[0055] Participants enter election round θ and set a timer. Based on the confidence value of the previous round of approximately uniform randomization process, the ideal function of the random beacon is determined. Send coin toss request And initiate the θ round of elections.

[0056] Ideal function of random beacons Generate a globally public, verifiable random number λ for selecting list elements. This ideal function is achieved when no fewer than [number missing] [unclear text - likely related to a function or feature] are received. A number of participants from different parties After the request is made, λ is randomly selected from the set of natural numbers [n] less than n, and a response message is broadcast. If the above-mentioned number of requests is not reached, no response will be generated. The λ parameter, used as a system security parameter, is employed to perform index selection on the elements of the commitment list h.

[0057] The participating parties shall perform the following actions when entering the θth round of election.

[0058] 1) If the current confidence value Then it moves towards the ideal function Send coin toss request .

[0059] 2) If received from response message Then record .

[0060] 3) If the confidence value satisfies And received a response Then the confidence value will be updated to .

[0061] 3. Local status update.

[0062] If confidence value Then, the participating parties update their local state based on the randomized message broadcast by the leader in the previous round. This means replacing the state with a random state contained in the randomized message. .

[0063] 4. Leader identification and disclosure.

[0064] Participants based on the latest list of commitments The Middle The decision of whether a participant is the leader in this round depends on whether the commitment can be opened. If a participant can successfully open the commitment using the Open algorithm, it becomes the leader and discloses its identity; otherwise, it only participates in the hierarchical broadcast during the randomization process.

[0065] The process of a leader disclosing their identity includes the following steps.

[0066] 1) Based on random numbers Get The Middle [com]

[0067] 2) In state parameters Next, the Open algorithm is invoked to open the commitment and generate a non-interactive zero-knowledge proof. This is used to prove the correctness of the commitment to open.

[0068] Non-interactive zero-knowledge proof schemes include: Input the total number of participants n, and return the common random string crs; Input statement x and the evidence w required to prove it, output proof π; If the proof is valid, output true.

[0069] 3) The leader will prove The broadcast was sent to the other participants.

[0070] 5. Perform an approximately unique randomization process.

[0071] The leader node performs an approximately unique randomization process, as follows.

[0072] 1) The random number generated when the candidate was selected in the previous round. As a random factor, calculate the random state. ,in ,and Each element is arranged according to a family of random permutation functions The permutation function η is exponentially randomized, i.e. .

[0073] 2) Randomly select a new set of random number tuples Generate random numbers and commit .

[0074] 3) Complete the randomization message generation and work with other participants to complete an approximately consistent randomization process.

[0075] As illustrated in the above embodiments, in the Single Secret Leader Election Protocol, all participants simultaneously enter Round 0 after system initialization and run the entire protocol process at a consistent clock pace. The protocol progresses round by round. In each round, participants execute the election algorithm, and the elected leader node is responsible for executing the randomization method, broadcasting the generated randomized message and its election result. When other participants receive the relevant message from the leader node, they invoke the election result verification algorithm to verify the correctness of the leader's declaration and the correctness of the randomization method's execution, thereby enhancing the protocol's security against corrupting adversaries and ensuring the privacy and uniqueness of the election results.

[0076] The above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them. Those skilled in the art can modify or make equivalent substitutions to the technical solutions of the present invention. The scope of protection of the present invention should be determined by the claims.

Claims

1. A randomization method, characterized in that, Includes the following steps: 1) Generate a commitment tuple Com based on a locally generated random number r and broadcast it; 2) Based on the commitment tuple Com and the local state information st, perform a randomization refresh process to obtain the randomized message m; 3) Perform the hierarchical broadcast process to verify, sign, and broadcast the signature set of the randomized message m. Determine the confidence level c based on the signature set and the revocation set, and output the randomized message m and its confidence level c.

2. The randomization method as described in claim 1, characterized in that, In step 1), a commitment tuple Com is generated for the random number r using the Pederson commitment scheme.

3. The randomization method as described in claim 1, characterized in that, The randomization refresh process in step 2) includes: (1) Randomize the local state st based on the random number r in the commitment tuple Com to generate a random state. ; (2) Based on random state Generate a non-interactive zero-knowledge proof π for proving the correctness of randomization processing; (3) Multiplication group of order q Random numbers are drawn from Generate new commitment tuples And generate a non-interactive zero-knowledge proof of the commitment tuple. ; (4) From random state Commitment tuple And prove π Construct a randomized message m.

4. The randomization method as described in claim 1, characterized in that, The hierarchical broadcasting process in step 3) includes: (1) Initialize the confidence level c to 0 and broadcast the randomized message m; (2) Verify whether the random state in the randomized message m is calculated from the local state st and the random number r in the commitment tuple Com; (3) Sign the valid randomized message and send it to the randomization executor; (4) The randomized executor collects valid signatures to form a signature set Ω and broadcasts it; (5) If a participant has not received the signature set Ω and has already signed the message, then broadcast the revocation message and add it to the revocation set. ; (6) Based on the signature set Ω and the revocation set The size relationship determines the confidence level c.

5. The randomization method as described in claim 4, characterized in that, Step (6) includes: if Then confidence level ,like, and Then confidence level , where n represents the total number of participants.

6. A method for electing a single secret leader, characterized in that, Includes the following steps: 1) Perform system initialization operations, generate public-private key pairs, and based on the group The generator g generates identity commitments and forms a commitment list h, constructing the initial system state st; 2) When entering the predetermined round θ, send a coin toss request to the random beacon function according to the confidence level c output by the previous randomization process, obtain the global random number λ and update the confidence level c; 3) Update the local state st based on the updated confidence level c, and replace the local state with the random state from the previous round of randomization messages; 4) Determine the leader node based on the commitment list h and the global random number λ. If the participant is the leader, execute the commitment opening process and broadcast the identity certificate, and call the randomization method described in any one of claims 1 to 5 to perform random permutation and exponential randomization on the system state and generate a randomized message; otherwise, only the leader node executes the hierarchical broadcast process in the randomization method.

7. The method for electing a single secret leader as described in claim 1, characterized in that, In step 1), each participant uses their private key to... Generate identity commitment values ​​and form a commitment list h.

8. The method for electing a single secret leader as described in claim 1, characterized in that, In step 2), when the random beacon function receives no less than When a coin toss request is made, a random number λ is selected from the set of natural numbers less than n; the random number λ is broadcast for each participant to use to index the commitment list h.

9. The method for electing a single secret leader as described in claim 1, characterized in that, Step 4) Perform the commitment to open the process and broadcast the identity verification, including: (1) Obtain the target commitments determined by the random number λ in the commitment list h; (2) Invoke the promise-open algorithm to verify whether the promise can be opened with the local private key; (3) Generate non-interactive zero-knowledge proofs And broadcast it.

10. The method for electing a single secret leader as described in claim 1, characterized in that, Step 4) involves the random permutation and exponential randomization performed by the leader node, including: (1) Based on the random factor of the previous round, random permutation and exponential randomization are performed on the group generator g and the commitment list h to obtain the random state. ; (2) Draw new random number tuples to generate new random factor commitments; (3) Based on random state The new random factor commitment generates randomized messages, and the randomization process is completed by the leader node. The remaining non-leader participants only participate in the hierarchical broadcasting process of the above randomized messages.

Images