A Signature Method, Device, and Storage Medium for Cross-Chain Witness Transactions

Abstract

The present invention belongs to the field of computer technology, and in particular relates to a signing method, device and storage medium for cross-chain witness transactions. The solution of the present invention provides a remote signing service through a signature server, eliminating the need for witnesses to use witness private keys to sign locally, thus avoiding the possibility of private keys being leaked during private key signing. At the same time, hardware signing is performed in the form of an encryption card, further ensuring the security of the witness private key, without affecting the use of the witness, and eliminating the need for private key signing on a specific device. On the other hand, address filing is used in the use of the signature server, and only filed addresses can initiate signature requests, ensuring that the source of the signed transaction is reliable and preventing users from impersonating witnesses to obtain signatures.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a signing method, device, and storage medium for cross-chain witness transactions. Background Art

[0002] With the development of blockchain technology, the demand for cross-chain asset transfer in various blockchain systems is increasing. Typical cross-chain asset transfer schemes are as follows: when user A wants to transfer several assets, assets1, on blockchain A to blockchain B, the cross-chain contract of blockchain A locks assets1, and the repeater transmits the information that blockchain A has locked assets1 to blockchain B by sending a witness transaction. Blockchain B then issues assets2 to user A, which represents the same asset type and amount as assets1; when user A sends a transaction to blockchain B requesting the transfer of assets3 back to blockchain A, blockchain B burns assets3; the repeater transmits the information that blockchain B has burned assets3 to blockchain A by sending a witness transaction, and the cross-chain contract of blockchain A unlocks assets4, which represent the same asset type and amount as assets3, and transfers them to user A.

[0003] The relayer's private key is used only when connected to the network. If stolen, the user can falsely claim that blockchain B has burned asset 3 when blockchain B has not yet burned asset 3, thereby defrauding asset 4. This shows the dangers of having a relayer's private key stolen.

[0004] In the current environment, one of the main reasons why the relayer's private key is stolen is that the relayer needs to log in with the private key and then sign the witness transaction. At this time, the private key will be exposed in the computer memory, which will be at risk of being stolen. For example, if the computer equipment is insecure or monitored by hackers, the private key will be stolen when it is exposed in the computer memory.

[0005] Some coping methods have also emerged in the existing technology, including, for example, the Chinese patent publication number CN113191756A, and the patent name is a cross-chain asset security management method, computer equipment and storage medium patent. It sets a multi-signature supervision account and establishes a threshold for the amount of assets, and uses centralized services to monitor the assets locked in the cross-chain contract, so as to ensure the security of large assets and reduce the harm after the private key is stolen. However, this method is intended to reduce the loss after the private key is stolen. The risk of private key leakage during the private key signing process has not been eliminated, and the theft of the private key will still cause property loss. The best way should be to prevent the repeater private key from being stolen during the signing process. Some existing views propose the use of hardware An encryption card is used to sign the private key of the repeater to ensure that the private key will not be exposed in the computer's memory. However, the problem with using a hardware encryption card is that the repeater login must always be in the computer with the hardware encryption card installed. The repeater private key signature in the cross-chain transfer is essentially the witness in the repeater using its witness private key to sign the witness transaction. Usually there are multiple witnesses in the repeater, divided into several witness groups to witness the asset transfer between different blockchains. In this way, a hardware encryption card needs to be configured in the computer of each witness, and the witness can only log in on this device to witness the transaction signature. Obviously, the cost of the hardware encryption card for this solution is extremely high and the repeater login is restricted, which greatly reduces the convenience.

[0006] Therefore, there is an urgent need for a method or system that can protect the private keys of witnesses from being stolen when signing witness transactions to ensure the security of cross-chain assets, while also being convenient and not incurring high costs or excessive restrictions. Summary of the Invention

[0007] In order to solve the above problems, the present invention provides a signing method, device and storage medium for cross-chain witness transactions, which can ensure the security of the witness's witness private key while being convenient and not imposing excessive restrictions.

[0008] The present invention adopts the following technical solutions.

[0009] In a first aspect, the present invention provides a signing method for a cross-chain witness transaction, characterized in that it includes the following steps:

[0010] The first witness sends a signature request to the signature server through the user terminal; the signature server is used to provide remote witness private key signature services for the repeater's witness. The signature request includes a first index number and first transaction content. The first index number is pre-sent to the first witness by the signature server;

[0011] The signature server receives the signature request and obtains the sending address of the signature request;

[0012] The signature server verifies whether the sending address is the pre-set record address, and responds to the signature request if it is, otherwise rejects the signature request;

[0013] After the sending address verification passes, the signature server verifies the correspondence between the sending address and the first index number based on the mapping relationship between the first index set and the record address set. The mapping relationship between the first index set and the record address set is pre-configured by the signature server administrator. The first index number is an index in the first index set.

[0014] If the verification is successful, the first authorization code is obtained through the mapping relationship between the first index set and the authorization code set and the first index number;

[0015] The signature server inputs the first index number, the first authorization code, and the first transaction content into a signature module deployed within the signature server. The signature module verifies the first authorization code based on the mapping relationship between the first index set and the authorization code set according to the first index number and the first authorization code. If the verification is successful, the signature module invokes the corresponding first witness private key within the signature module based on the mapping relationship between the first index set and the witness private key set stored therein to sign the first transaction content and obtain a first signature result.

[0016] The signature server feeds back the first signature result to the client logged in by the first witness.

[0017] Preferably, the signature module is a hardware encryption card, which is configured with the first index set, witness private key set and authorization code set, and stored in a storage area of the hardware encryption card. The storage area also stores a mapping relationship between the first index set and the witness private key set, and a mapping relationship between the first index set and the authorization code set.

[0018] Preferably, the first index set can be called by the signature server, the authorization code set can be called and read and written by the signature server, and the witness private key set can only be called by the signature module.

[0019] Preferably, the signature server encrypts the first index number using an encryption algorithm when sending the first index number to the first witness in advance.

[0020] Preferably, the step of the signature server pre-sending the first index number to the first witness includes:

[0021] The signature server obtains the public key of the first witness;

[0022] The signing server randomly generates a first symmetric key, symmetrically encrypts the first index number using the first symmetric key to obtain a first symmetric encryption result, and sends the first symmetric encryption result to the client logged in by the first witness;

[0023] The signature server encrypts the first symmetric key using the public key of the first witness to obtain a first symmetric key ciphertext and sends it to the client logged in by the first witness;

[0024] The first witness receives the first symmetric encryption result and the first symmetric key ciphertext on the client;

[0025] The first witness decrypts the first symmetric key ciphertext using its private key to obtain the first symmetric key, and then decrypts the first symmetric encryption result using the first symmetric key to obtain the first index number.

[0026] In a second aspect, a computer device is provided, comprising one or more processors;

[0027] a memory for storing one or more programs,

[0028] When the one or more programs are executed by the one or more processors, the one or more processors are caused to perform the method as described in the first aspect above.

[0029] In a third aspect, a storage medium storing a computer program is provided, which, when executed by a processor, implements the method described in the first aspect above.

[0030] The beneficial effect of the present invention is that a remote signature service is provided through a signature server, and there is no need for a witness to use a witness private key to sign locally, thereby avoiding the possibility of the private key being leaked during private key signing. At the same time, hardware signing is performed in the form of an encryption card, which further ensures the security of the witness private key and does not affect the use of the witness. There is no need to perform private key signing on a specific device. On the other hand, the use of the signature server adopts the form of address filing, and only the filed address can initiate a signature request, thereby ensuring that the source of the signed transaction is reliable and avoiding users impersonating witnesses to obtain signatures. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 This is a flow chart of a cross-chain witness transaction signature method in Example 1 of the present invention;

[0032] Figure 2 This is a structural diagram of a computer device according to embodiment 2 of the present invention. DETAILED DESCRIPTION

[0033] The present invention will be further described in detail below in conjunction with specific embodiments and the accompanying drawings. Those of ordinary skill in the art will be able to implement the present invention based on these descriptions. In addition, the embodiments of the present invention involved in the following description are generally only embodiments of a part of the present invention, rather than all embodiments. Therefore, based on the embodiments in the present invention, all other embodiments obtained by those of ordinary skill in the art without making creative work should fall within the scope of protection of the present invention. It should be noted that, unless there is a conflict, the embodiments in this application and the features in the embodiments can be combined with each other. Unless otherwise specified, the methods briefly described in the embodiments of the present invention are methods mastered by those skilled in the art.

[0034] Example 1

[0035] This embodiment provides a signature method for a cross-chain witness transaction, including the following steps:

[0036] S1: The first witness sends a signature request to the signature server through the client. The signature server is used to provide remote witness private key signature services for the witness on the repeater. The signature request includes a first index number and first transaction content. The first index number is pre-sent to the first witness by the signature server. The signature server in this embodiment is deployed on the repeater. Essentially, the signature server can provide signature services for multiple repeaters. It can be deployed independently or within the repeater. Network isolation can also be set to reject some requests for server security.

[0037] S2: The signature server receives the signature request and obtains the sending address of the signature request. It is worth mentioning that, under normal circumstances, the interaction between the witness and the signature server here is encrypted communication, that is, the witness uses its private key to encrypt the information it sends. The witness private key here is different from the witness private key described in this application. The witness private key is dedicated to signing the witness transaction. The sending address here in this embodiment is obtained based on the private key signature of the first witness. Obtaining the corresponding address from the private key signature is a conventional technical authorization. The use of private key signature encryption for information interaction in the blockchain is also a common means, so it will not be repeated here. The designated address cannot be used, and the designated address cannot be used for identity verification.

[0038] S3: The signature server verifies whether the sending address is the pre-set filing address. If so, it responds to the signature request; otherwise, it rejects the signature request.

[0039] S4: After the sending address verification is passed, the signature server verifies the correspondence between the sending address and the first index number based on the mapping relationship between the first index set and the registered address set. The mapping relationship between the first index set and the registered address set is pre-configured by the signature server administrator, and the first index number is an index in the first index set.

[0040] S5: If the verification is successful, the first authorization code is obtained through the mapping relationship between the first index set and the authorization code set and the first index number.

[0041] S6: The signature server inputs the first index number, the first authorization code and the first transaction content into a signature module deployed in the signature server. The signature module verifies the first authorization code based on the mapping relationship between the first index set and the authorization code set according to the first index number and the first authorization code. If the verification is successful, the corresponding first witness private key is called in the signature module based on the mapping relationship between the first index set and the witness private key set stored therein to sign the first transaction content to obtain a first signature result.

[0042] S7: The signature server feeds back the first signature result to the user terminal logged in by the first witness.

[0043] Furthermore, the signature module is a hardware encryption card. The hardware encryption card is configured with the first index set, the witness private key set, and the authorization code set, which are stored in a storage area of the hardware encryption card. The storage area also stores a mapping relationship between the first index set and the witness private key set, as well as a mapping relationship between the first index set and the authorization code set. The advantage of using a hardware encryption card is that it can prevent the content within the encryption card from being leaked. Without authorization, the data in the hardware encryption card cannot be read, thus ensuring the security of the witness's witness private key.

[0044] Furthermore, the first index set is available for the signature server to call, the authorization code set is available for the signature server to call and read and write, and the witness private key set is available only for the signature module to call. The witness private key set is only available for the signature module to call, allowing the signature module to call the private keys in the witness private key set to complete the signature of the witness transaction only when a signature is required. At other times, the encryption card cannot perform any read or write operations on the witness private key set without authorization, ensuring the safety of the witness. The first index set and authorization code set are available for the signature server to call and read and write, facilitating the signature server to perform verification or data marking.

[0045] Furthermore, the signature server encrypts the first index number using an encryption algorithm when sending the first index number to the first witness in advance. Encrypting the first index number ensures the security of the first index number during transmission.

[0046] Furthermore, the step of the signature server pre-sending the first index number to the first witness includes:

[0047] The signature server obtains the public key of the first witness;

[0048] The signing server randomly generates a first symmetric key, symmetrically encrypts the first index number using the first symmetric key to obtain a first symmetric encryption result, and sends the first symmetric encryption result to the client logged in by the first witness;

[0049] The signature server encrypts the first symmetric key using the public key of the first witness to obtain a first symmetric key ciphertext and sends it to the client logged in by the first witness;

[0050] The first witness receives the first symmetric encryption result and the first symmetric key ciphertext on the client;

[0051] The first witness uses its private key to decrypt the first symmetric key ciphertext to obtain the first symmetric key, and then uses the first symmetric key to decrypt the first symmetric encryption result to obtain the first index number. This preferred solution provides a specific approach for encrypted transmission of the first index number, using a digital envelope to ensure the security of the first index number during transmission.

[0052] In the actual application of the witness transaction transmission process of the repeater, the repeater R using the method used in this embodiment is configured with N witnesses. The private keys of all witnesses are stored in the encryption card, which are recorded as private_Key_index_1...private_Key_index_n, and the corresponding index sets are recorded as index_1, index_2...index_n, and the authorization codes are set as pass_pin_index_1...pass_pin_index_n, and only the addresses are recorded as address_Key_index_1...address_Key_ind ex_n can access the corresponding witness private key, so the index index is used to correspond the witness address, authorization code and witness private key. Knowing the index, you can use the encryption card to sign the transaction in the signature server, and the witness in the repeater needs to be rotated. The original witness private key corresponds to the witness. In this solution, the witness private key can be generated by the encryption card and can only be called by the encryption card itself for signing. It cannot be output, read or modified. In this way, the witness private key will not be at risk of being stolen. When the witness is rotated, you only need to modify the correspondence between the address and the index index to achieve the modification of the witness without modifying the witness private key. The witness does not touch the witness private key, avoiding the occasional loss of the witness private key from the source.

[0053] Example 2

[0054] A computer device comprises: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the method described in Example 1.

[0055] A storage medium storing a computer program, which, when executed by a processor, implements the method described in the above embodiment 1.

[0056] Figure 2 A schematic diagram of the structure of a device provided in this embodiment.

[0057] like Figure 2 As shown, as another aspect, the present application also provides a computer device 500, including one or more central processing units (CPUs) 501, which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 502 or programs loaded from a storage portion 508 into a random access memory (RAM) 503. Various programs and data required for the operation of the device 500 are also stored in the RAM 503. The CPU 501, ROM 502, and RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0058] The following components are connected to the I / O interface 505: an input section 506 including a keyboard, a mouse, and the like; an output section 507 including devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and a speaker; a storage section 508 including a hard disk and the like; and a communication section 509 including a network interface card such as a LAN card or a modem. The communication section 509 performs communication processing via a network such as the Internet. A driver 510 is also connected to the I / O interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, and the like, is mounted on the driver 510 as needed, so that a computer program read therefrom can be installed into the storage section 508 as needed.

[0059] In particular, according to the embodiments disclosed herein, the method described in Embodiment 1 above can be implemented as a computer software program. For example, the embodiments disclosed herein include a computer program product comprising a computer program tangibly embodied on a machine-readable medium, the computer program comprising program code for executing the method described in any of the embodiments above. In such embodiments, the computer program can be downloaded and installed from a network via the communication portion 509 and / or installed from the removable medium 511.

[0060] As another aspect, the present application further provides a computer-readable storage medium, which may be the computer-readable storage medium included in the apparatus of the above-described embodiment, or a standalone computer-readable storage medium not incorporated into the apparatus. The computer-readable storage medium stores one or more programs, which are used by one or more processors to execute the method described in the present application.

[0061] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the prescribed logical functions. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the prescribed function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0062] The units or modules involved in the embodiments described in this application may be implemented in software or hardware. The units or modules described may also be provided in a processor. For example, each of the units may be a software program provided in a computer or mobile smart device, or a separately configured hardware device. The names of these units or modules do not, in certain circumstances, constitute limitations on the units or modules themselves.

[0063] The above description is merely a preferred embodiment of the present application and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but also encompasses other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the concept of this application. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A signature method for cross-chain witness transactions, characterized in that: The steps include: The first witness sends a signature request to the signature server through the client. The signature server is deployed on the repeater and is used to provide remote witness private key signature services for the witness of the repeater. The signature request includes a first index number and first transaction content. The first index number is pre-sent to the first witness by the signature server. The signature server receives the signature request and obtains the sending address of the signature request; The signature server verifies whether the sending address is the pre-set record address, and responds to the signature request if it is, otherwise rejects the signature request; After the sending address verification passes, the signature server verifies the correspondence between the sending address and the first index number based on the mapping relationship between the first index set and the record address set. The mapping relationship between the first index set and the record address set is pre-configured by the signature server administrator. The first index number is an index in the first index set. If the verification is successful, the first authorization code is obtained through the mapping relationship between the first index set and the authorization code set and the first index number; The signature server inputs the first index number, the first authorization code, and the first transaction content into a signature module deployed within the signature server. The signature module verifies the first authorization code based on the mapping relationship between the first index set and the authorization code set according to the first index number and the first authorization code. If the verification is successful, the signature module invokes the corresponding first witness private key within the signature module based on the mapping relationship between the first index set and the witness private key set stored therein to sign the first transaction content and obtain a first signature result. The signature server feeds back the first signature result to the client logged in by the first witness.

2. A cross-chain witness transaction signature method according to claim 1, characterized in that: The signature module is a hardware encryption card, which is configured with the first index set, witness private key set and authorization code set, and stored in the storage area of the hardware encryption card. The storage area also stores the mapping relationship between the first index set and the witness private key set, and the mapping relationship between the first index set and the authorization code set.

3. A cross-chain witness transaction signature method according to claim 1, characterized in that: The first index set can be called by the signature server, the authorization code set can be called and read and written by the signature server, and the witness private key set can only be called by the signature module.

4. A cross-chain witness transaction signature method according to claim 1, characterized in that: When the signature server sends the first index number to the first witness in advance, the encryption algorithm is used to encrypt the first index number.

5. A cross-chain witness transaction signature method according to claim 1, characterized in that: The step of the signature server sending the first index number to the first witness in advance includes: the signature server obtaining the public key of the first witness; The signing server randomly generates a first symmetric key, symmetrically encrypts the first index number using the first symmetric key to obtain a first symmetric encryption result, and sends the first symmetric encryption result to the client logged in by the first witness; The signature server encrypts the first symmetric key using the public key of the first witness to obtain a first symmetric key ciphertext and sends it to the client logged in by the first witness; The first witness receives the first symmetric encryption result and the first symmetric key ciphertext on the client; The first witness decrypts the first symmetric key ciphertext using its private key to obtain the first symmetric key, and then decrypts the first symmetric encryption result using the first symmetric key to obtain the first index number.

6. A computer device, characterized in that: one or more processors; a memory for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors are caused to perform the method according to any one of claims 1 to 5.

7. A storage medium storing a computer program, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images