A digital currency method and system based on witness

Abstract

The present invention discloses a witness-based digital currency method and system, the method comprising the following steps: S1, using an authentication method to implement authentication between a witness device and a witness service station; S2, an ordinary device acquires authentication parameters between the witness service station; S3, using an authentication method to implement authentication between the ordinary device and the witness service station. Beneficial effect: The present invention combines a hardware wallet with authentication parameters obtained from a witness, the authentication parameters are stored in the memory of the hardware wallet, and will be lost or destroyed regularly after power failure, so that in the extreme case of the hardware wallet being cracked, the security of the digital currency can still be guaranteed because the enemy cannot obtain the authentication parameters.

Description

Technical Field

[0001] The present invention relates to the field of communication security of witness authentication, and in particular to a witness-based digital currency method and system. Background Art

[0002] The core elements of the digital currency D-RMB system of the People's Bank of China are one currency, two types of libraries and three centers. One currency, namely "D-RMB" (DC / EP), referred to as D currency, specifically refers to a string of encrypted digital strings representing a specific amount signed by the central bank. Two types of libraries: the D-RMB issuance library and the bank library (central bank digital currency database, commercial bank digital currency database). Digital currency in the issuance library is the central bank's digital currency fund; digital currency in the bank library is the commercial bank's inventory of digital cash. Three centers: one is the registration center (recording the entire process of currency generation, circulation, counting and verification, and extinction); the other two are certification centers, namely CA certification center (based on the PKI system, centralized management of institutional and user certificates, such as CFCA) and IBC certification center [that is, the certification center established based on identity-based cryptographic technology (Identity-Based Cryptograph)]. Two tables can be designed in the registration center, one is the digital currency ownership registration table, which records the ownership of digital currency, and the other is the transaction flow table.

[0003] The D-RMB system is a hierarchical system, which is jointly built by the central bank and commercial banks. The central bank digital currency system is a computer system operated and maintained by the central bank or an institution designated by the central bank to process information about digital currency. Its main functions include being responsible for the issuance and verification monitoring of digital currency. The commercial bank digital currency system is a computer system operated and maintained by commercial banks or institutions designated by commercial banks to process information about digital currency. It performs various currency-related functions of existing banks, namely banking functions, mainly including being directly responsible for meeting various needs of providing digital currency circulation services to the society after applying for digital currency from the central bank.

[0004] There are still some problems with the existing technology:

[0005] 1. In the prior art, the keys in the hardware wallets are likely to be captured, disassembled and cracked. Once cracked, the security of the digital currency is threatened;

[0006] 2. In the prior art, once a hardware wallet is lost, it is possible to be used by someone else in your name;

[0007] 3. In the prior art, there is a need to audit the use of hardware wallets, such as recording the user end corresponding to the hardware wallet and its user information, but there is no solution yet. Summary of the invention

[0008] In response to the problems in the related technology, the present invention proposes a witness-based digital currency method and system to overcome the above-mentioned technical problems existing in the existing related technology.

[0009] To this end, the specific technical solution adopted by the present invention is as follows:

[0010] According to one aspect of the present invention, a witness-based digital currency method is provided, the method comprising the following steps:

[0011] S1. Use the authentication method to realize the authentication between the witness device and the witness service station;

[0012] S2. The common device obtains authentication parameters with the witness service station;

[0013] S3. Use an authentication method to implement authentication between the ordinary device and the witness service station.

[0014] Furthermore, the S1 uses the authentication method to implement authentication between the witness device and the witness service station, including the following steps:

[0015] S11, the witness device and the witness service station to which the witness hardware wallet belongs use digital certificates to perform HTTPS-style two-way authentication;

[0016] S12, the witness service station confirms the witness identity of the device end by comparing the witness hardware wallet identifier in the witness device end authentication message and the authentication information in the hardware wallet;

[0017] S13. After the authentication is completed, a first session key is generated between the witness device and the witness service station.

[0018] Furthermore, the S2 common device side obtains the authentication parameters between the S2 common device side and the witness service station, including the following steps:

[0019] S21, the witness device collects information of the common device and its user through short-range communication or a biometric collection module, and performs preliminary identity authentication on the common device;

[0020] S22, the witness service station to which the ordinary hardware wallet belongs obtains the authentication parameter, and stores the authentication parameter together with the hardware wallet identifier of the ordinary device end;

[0021] S23. The ordinary hardware wallet on the ordinary device obtains authentication parameters and stores them in memory.

[0022] Furthermore, when performing preliminary identity authentication on the common device end in S21, it is necessary to ensure that the common device end provides the required information, and the format of each information complies with the specification and the value is within a reasonable range.

[0023] Furthermore, the witness service station to which the common hardware wallet belongs in S22 obtains the authentication parameters, and stores the authentication parameters and the hardware wallet identifier of the common device end, specifically including the following steps:

[0024] S221, the witness device generates a true random number and uses it as an authentication parameter;

[0025] S222, the witness device uses the first session key to encrypt the ID and authentication parameters of the common device and sends them to the witness service station to which the witness hardware wallet belongs;

[0026] S223, the witness service station to which the witness hardware wallet belongs encrypts the authentication parameters and sends them to the witness service station to which the hardware wallet on the ordinary device side belongs;

[0027] S224. The witness service station to which the ordinary hardware wallet belongs stores the authentication parameters together with the hardware wallet identifier of the ordinary device end.

[0028] Furthermore, the ordinary hardware wallet on the ordinary device side in S23 obtains the authentication parameters and stores them in the memory, specifically including the following steps:

[0029] S231, the witness device end encrypts the authentication parameters using the public key of the ordinary hardware wallet, and sends them to the ordinary device end through short-range communication;

[0030] S232: The common device receives the encrypted authentication parameters and stores the authentication parameters in the memory of the common hardware wallet.

[0031] Furthermore, the authentication method used in S3 to implement authentication between the common device and the witness service station includes the following steps:

[0032] S31, the common device and the witness service station to which the common hardware wallet belongs use digital certificates to perform HTTPS-style two-way authentication, wherein the authentication includes mutual authentication of authentication parameters of both parties;

[0033] S32, after mutual authentication is completed, a second session key is obtained through negotiation, and a third session key is obtained through calculation of authentication parameters;

[0034] S33. The common device terminal communicates with the witness service station to which the common hardware wallet belongs using the third session key.

[0035] According to another aspect of the present invention, there is provided a witness-based digital currency system, which includes a commercial bank digital currency system and a device end equipped with a hardware wallet, wherein the commercial bank digital currency system is equipped with a witness service station, the hardware wallet includes an ordinary hardware wallet and a witness hardware wallet, the device end includes an ordinary device end and a witness device end, the ordinary device end is equipped with the ordinary hardware wallet, and the ordinary hardware wallet is used by users of the commercial bank digital currency system, and the witness device end is equipped with the witness hardware wallet;

[0036] Wherein, the commercial bank digital currency system is used to perform banking functions for digital currency;

[0037] The witness service station is used to issue ordinary hardware wallets and witness hardware wallets for digital currency;

[0038] The user is the subject of digital currency use;

[0039] The device end equipped with the hardware wallet is the carrier of digital currency.

[0040] Furthermore, the ordinary hardware wallet and the witness hardware wallet are installed with the root certificate of the certificate authority center respectively, and store the digital certificate issued by the certificate authority center based on the hardware wallet, and the witness service station performs mutual authentication and secure communication with the device terminal equipped with the ordinary hardware wallet or the witness hardware wallet.

[0041] Furthermore, the witness device can independently authenticate with the witness service station, and can also communicate with the ordinary device in close proximity, and the close proximity communication includes but is not limited to wired connection, QR code communication, near field communication, infrared communication, and Bluetooth communication. The communication content of the close proximity communication includes the ordinary device and its user information collected by the witness device, and also includes the authentication parameters sent by the witness device to the ordinary device.

[0042] The beneficial effects of the present invention are:

[0043] 1) The present invention combines the hardware wallet and the authentication parameters obtained from the witness. The authentication parameters are stored in the memory of the hardware wallet and will be lost or destroyed regularly after power failure. In the extreme case that the hardware wallet is cracked, the security of the digital currency can still be guaranteed because the enemy cannot obtain the authentication parameters.

[0044] 2) Once the hardware wallet of the present invention is lost, the authentication parameters are lost or destroyed regularly due to power failure, so the hardware wallet cannot be used normally and there is no possibility of being used in a false name;

[0045] 3) The present invention aims at the auditing requirements of hardware wallet use, and records the user end and user information corresponding to the hardware wallet through the witness device end, making the digital currency system more secure. At the same time, the holder of the witness device end can directly conduct transactions through the witness device end and record the information of the actual user. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 is a flow chart of a witness-based digital currency method according to an embodiment of the present invention;

[0048] Figure 2 It is a structural diagram of a witness-based digital currency system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0049] To further illustrate each embodiment, the present invention provides drawings, which are part of the disclosure of the present invention and are mainly used to illustrate the embodiments and can be used in conjunction with the relevant descriptions in the specification to explain the operating principles of the embodiments. With reference to these contents, ordinary technicians in the field should be able to understand other possible implementations and advantages of the present invention. The components in the figures are not drawn to scale, and similar component symbols are generally used to represent similar components.

[0050] According to an embodiment of the present invention, a witness-based digital currency method and system are provided.

[0051] This embodiment is to realize the authentication between the ordinary device end equipped with an ordinary hardware wallet and the witness service station of the commercial bank where it opens an account. The participating roles in this embodiment include the witness service station of the commercial bank, the witness device end equipped with the witness hardware wallet, and the ordinary device end equipped with the ordinary hardware wallet. Both the witness hardware wallet and the ordinary hardware wallet are issued by the witness service station of their respective commercial banks.

[0052] The present invention is further described with reference to the accompanying drawings and specific embodiments. Figure 1 As shown, according to one embodiment of the present invention, a witness-based digital currency method is provided, the method comprising the following steps:

[0053] S1. The witness device and the witness service station realize authentication (the authentication method is used to realize the authentication between the witness device and the witness service station);

[0054] Wherein, the S1 comprises the following steps:

[0055] The witness device and the witness service station to which the witness hardware wallet belongs use digital certificates for HTTPS-style two-way authentication. The witness service station confirms the witness identity of the device by comparing the witness hardware wallet identifier in the witness device authentication message with the authentication information in the hardware wallet. After the authentication is completed, the witness device and the witness service station generate a symmetric session key KS1.

[0056] S2. The common device obtains authentication parameters with the witness service station;

[0057] Wherein, the S2 comprises the following steps:

[0058] S21. The witness device collects information about the general device and its user through short-range communication or biometric collection modules, and performs preliminary identity authentication on the general device: ensuring that the general device provides the required information, and that the format of each information complies with the specification and the value is within a reasonable range. During the audit, the user reports to the bank that the hardware wallet is lost and may be stolen. Professionals find the witness device where the theft occurred, obtain the information of the thief from the corresponding witness device, and thus catch the thief.

[0059] S22. The witness device generates a true random number KR as an authentication parameter. The witness device uses the session key KS1 to encrypt the ID of the ordinary device and the authentication parameter KR and sends it to the witness service station to which the witness hardware wallet belongs. The witness service station to which the witness hardware wallet belongs encrypts the authentication parameter KR and sends it to the witness service station to which the ordinary hardware wallet belongs. The witness service station to which the ordinary hardware wallet belongs stores KR together with the hardware wallet identifier of the ordinary device for subsequent use.

[0060] S23. The witness device encrypts the authentication parameter KR with the public key of the ordinary hardware wallet of the ordinary device and sends it to the ordinary device via short-range communication. The ordinary hardware wallet of the ordinary device stores the authentication parameter in the memory, which is lost when the power is off or destroyed regularly. This reduces the possibility of the authentication parameter being stolen.

[0061] S3, the common device end and the witness service station realize authentication (using the authentication method to realize the authentication between the common device end and the witness service station);

[0062] Wherein, the S3 comprises the following steps:

[0063] S31. The ordinary device and the witness service station to which the ordinary hardware wallet belongs use digital certificates to perform HTTPS-style two-way authentication, and the authentication includes mutual authentication of the authentication parameters of both parties.

[0064] S32. After mutual authentication, the two parties negotiate to obtain the session key KS2. The witness service station to which the ordinary device and the ordinary hardware wallet belong calculates the authentication parameter KR to obtain KS3=MAC(KR,KS2), where MAC(m,k) is the message authentication code obtained by performing the MAC algorithm on the content m using the key k.

[0065] S33, the ordinary device side and the witness service station to which the ordinary hardware wallet belongs use the session key KS3 for subsequent communication. Since the actual session key for communication is generated by the authentication parameters from the witness device side, even if the enemy obtains the user's digital currency wallet and obtains the key in the wallet, it cannot communicate with the commercial bank, thereby ensuring the security of the digital currency.

[0066] According to another aspect of the present invention, Figure 2 As shown, a witness-based digital currency system is provided. Taking the operation example of the central bank digital currency as an example, the basic structure of the digital currency system mainly includes a commercial bank digital currency system and a device end equipped with a hardware wallet. Among them, the commercial bank digital currency system is used to perform banking functions for digital currency; users are the main users of digital currency; and the device end equipped with a hardware wallet is the carrier of digital currency.

[0067] The digital currency system of commercial banks is equipped with a witness service station, which is used to issue hardware wallets for digital currency. The issued hardware wallets include ordinary hardware wallets and witness hardware wallets. If necessary, the witness service station also provides mutual authentication and secure communication with device terminals equipped with ordinary hardware wallets or witness hardware wallets. The hardware wallet of the digital currency is installed with the root certificate of the CA center, and stores the digital certificate issued by the CA center based on the hardware wallet.

[0068] In the witness-based digital currency system of the present invention, the device end is divided into an ordinary device end and a witness device end. The ordinary device end is a device equipped with an ordinary hardware wallet for use by users of commercial banks. Its ordinary hardware wallet is likely to be stolen, and the cooperation of the witness device end is required when authenticating with the witness service station. The witness device end is a device equipped with a witness hardware wallet, which is a relatively important device end, such as a gateway in the user's local area network, a server, or an operating terminal controlled by an operator in the Internet. Due to its high security protection level, its hardware wallet is unlikely to be stolen; it can be independently authenticated with the witness service station; it can communicate with the ordinary device end in close range, such as wired connection, QR code communication, NFC communication, infrared communication, Bluetooth communication, etc., and the communication content is that the witness device end collects the ordinary device end and its user information (the model and device code of the ordinary device end, the user's photo, biological information, ID card information, etc.), and the witness device end sends authentication parameters to the ordinary device end; the holder of the witness device end can directly trade through the witness device end and record the information of the actual user.

[0069] In summary, with the aid of the above technical solution of the present invention, the present invention combines the hardware wallet and the authentication parameters obtained from the witness, the authentication parameters are stored in the memory of the hardware wallet, and will be lost or destroyed regularly after power failure, so that in the extreme case that the hardware wallet is cracked, since the enemy cannot obtain the authentication parameters, the security of the digital currency can still be guaranteed; in addition, once the hardware wallet of the present invention is lost, since the authentication parameters are lost or destroyed regularly after power failure, the hardware wallet cannot be used normally, and there is no possibility of being used in a false name; in addition, the present invention records the user end corresponding to the hardware wallet and its user information through the witness device end for the audit requirements of the use of the hardware wallet, making the digital currency system more secure. At the same time, the holder of the witness device end can directly conduct transactions through the witness device end and record the information of the actual user.

[0070] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0071] The above-mentioned embodiments only express several implementation methods of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A witness-based digital currency method, characterized in that: The method comprises the following steps: S1. Use the authentication method to realize the authentication between the witness device and the witness service station; S2. The common device obtains authentication parameters with the witness service station; The S2 common device side obtains the authentication parameters with the witness service station including the following steps: S21, the witness device collects information of the common device and its user through short-range communication or a biometric collection module, and performs preliminary identity authentication on the common device; When performing preliminary identity authentication on the common device in S21, it is necessary to ensure that the common device provides the required information, and the format of each information complies with the specification and the value is within a reasonable range; S22. The witness service station to which the common hardware wallet belongs obtains the authentication parameters and stores the authentication parameters together with the hardware wallet identifier of the common device end; The witness service station to which the common hardware wallet belongs in S22 obtains the authentication parameters, and stores the authentication parameters and the hardware wallet identifier of the common device end, specifically including the following steps: S221, the witness device generates a true random number and uses it as an authentication parameter; S222, the witness device uses the first session key to encrypt the ID and authentication parameters of the common device and sends them to the witness service station to which the witness hardware wallet belongs; S223, the witness service station to which the witness hardware wallet belongs encrypts the authentication parameters and sends them to the witness service station to which the hardware wallet on the ordinary device side belongs; S224. The witness service station to which the common hardware wallet belongs stores the authentication parameters together with the hardware wallet identifier of the common device end; S23, the ordinary hardware wallet on the ordinary device obtains the authentication parameters and stores them in the memory; The ordinary hardware wallet on the ordinary device side in S23 obtains the authentication parameters and stores them in the memory, specifically including the following steps: S231, the witness device end encrypts the authentication parameters using the public key of the ordinary hardware wallet, and sends them to the ordinary device end through short-range communication; S232, the common device receives the encrypted authentication parameters and stores the authentication parameters in the memory of the common hardware wallet; S3, using an authentication method to implement authentication between the common device and the witness service station; The authentication method used in S3 to implement authentication between the common device and the witness service station includes the following steps: S31, the common device and the witness service station to which the common hardware wallet belongs use digital certificates to perform HTTPS-style two-way authentication, wherein the authentication includes mutual authentication of authentication parameters of both parties; S32, after mutual authentication is completed, a second session key is obtained through negotiation, and a third session key is obtained through calculation of authentication parameters; S33. The common device terminal communicates with the witness service station to which the common hardware wallet belongs using the third session key.

2. A witness-based digital currency method according to claim 1, characterized in that: The S1 uses the authentication method to implement authentication between the witness device and the witness service station, including the following steps: S11, the witness device and the witness service station to which the witness hardware wallet belongs use digital certificates to perform HTTPS-style two-way authentication; S12, the witness service station confirms the witness identity of the device end by comparing the witness hardware wallet identifier in the witness device end authentication message and the authentication information in the hardware wallet; S13. After the authentication is completed, a first session key is generated between the witness device and the witness service station.

3. A witness-based digital currency system, used to implement the steps of the witness-based digital currency method described in any one of claims 1-2, characterized in that: The system includes a commercial bank digital currency system and a device end equipped with a hardware wallet. The commercial bank digital currency system is equipped with a witness service station. The hardware wallet includes an ordinary hardware wallet and a witness hardware wallet. The device end includes an ordinary device end and a witness device end. The ordinary device end is equipped with the ordinary hardware wallet, and the ordinary hardware wallet is used by users of the commercial bank digital currency system. The witness device end is equipped with the witness hardware wallet. Wherein, the commercial bank digital currency system is used to perform banking functions for digital currency; The witness service station is used to issue ordinary hardware wallets and witness hardware wallets for digital currency; The user is the subject of digital currency use; The device end equipped with the hardware wallet is the carrier of digital currency.

4. A witness-based digital currency system according to claim 3, characterized in that: The ordinary hardware wallet and the witness hardware wallet are installed with the root certificate of the certificate authority center respectively, and store the digital certificate issued by the certificate authority center based on the hardware wallet, and the witness service station performs mutual authentication and secure communication with the device terminal equipped with the ordinary hardware wallet or the witness hardware wallet.

5. A witness-based digital currency system according to claim 3, characterized in that: The witness device end can independently authenticate with the witness service station, and can also communicate with the ordinary device end in short distance, and the short distance communication includes but is not limited to wired connection, QR code communication, near field communication, infrared communication, and Bluetooth communication. The communication content of the short distance communication includes the ordinary device end and its user information collected by the witness device end, and also includes the authentication parameters sent by the witness device end to the ordinary device end.

Images