A blockchain-based dynamic guardian secret sharing method and system

Abstract

The application provides a kind of dynamic guardian secret sharing method and system based on blockchain, belong to encryption field, method includes: based on distributed key generation method, group public-private key pair is generated according to system parameter, threshold key pair and public-private key pair of each member in guardian committee;Threshold key share of each member is encrypted to obtain chain share;Based on the joining application initiated by new member, member private key is used to decrypt chain share and calculate Lagrange factor;Determine the first decryption share based on Lagrange factor;Based on the decryption application initiated by new member, Lagrange interpolation method threshold reconstruction is carried out according to threshold key share and chain share, to determine the second decryption share;Determine the threshold key pair of new member according to the first decryption share, the second decryption share and system parameter.The application can ensure that new member reconstructs own secret sharing share without knowing the content of key and the share of remaining members.

Description

Technical Field

[0001] This invention relates to the field of encryption, and in particular to a method and system for dynamic guardian secret sharing based on blockchain. Background Technology

[0002] Distributed key generation (DKG) is a secure protocol that allows multiple participants to generate a shared key without revealing private information. Secret sharing is a crucial means of protecting secrets in distributed scenarios. By forming a trusted committee through trusted bootstrapping or distributed key generation, a secret is kept confidential, with each member holding a share of the secret. Threshold settings significantly enhance the security of secret sharing. Since its inception, blockchain systems have been considered a technology with great potential. By establishing a guardian who is also a secret-sharing committee within the blockchain system, the shared secret share is encrypted, greatly improving security. Committees holding distributed secret shares, based on DKG and secret sharing, have numerous applications in various blockchain and cryptography scenarios. These include providing secure public and private keys in blockchain systems, providing shared keys in multi-party computation or authentication scenarios, and providing distributed randomness for consensus protocols.

[0003] However, in real-world applications, committee members change dynamically, with members joining and leaving at any time. When a member joins, their secret share needs to be allocated. A challenging scientific problem is how to successfully allocate a fixed secret share to a new member in a distributed environment without leaking the shares and secret of other user nodes. When a member leaves, the goal is to prevent the departing member from holding any secret share while ensuring that the remaining committee members update their secret shares. Summary of the Invention

[0004] The purpose of this invention is to provide a blockchain-based dynamic guardian secret sharing method and system that supports dynamic changes in members of the guardianship committee and ensures that new members can restore and reconstruct their correct secret sharing share without knowing the key content and the shares of other members.

[0005] To achieve the above objectives, the present invention provides the following solution:

[0006] A blockchain-based method for dynamic guardian confidentiality sharing includes:

[0007] Initialize system parameters; the system parameters include a positive integer group, a first generator, and a second generator;

[0008] Based on the distributed key generation method, threshold key pairs and group public-private key pairs are generated for each member of the guardianship committee according to the first generator; the guardianship committee includes multiple members, each of whom is a node in the blockchain; the threshold key pair includes the threshold key and threshold key share of the corresponding member;

[0009] Based on the positive integer group and the first generator, generate public-private key pairs for each member;

[0010] For any member of the guardianship committee, based on the system parameters, the threshold key share of the member is encrypted using the group public key and the member's public key to obtain the member's on-chain share; each member's on-chain share includes a first encrypted share and a second encrypted share;

[0011] For any new member, the new member submits a membership application to each member of the guardianship committee.

[0012] For any member of the guardianship committee, based on the new member's joining request, the member's on-chain share is decrypted using the member's private key, and the member's Lagrange factor over the new member is calculated and sent to the new member.

[0013] Based on the Lagrange factor received by the new member, the first decryption share of the new member is determined, and a decryption application is initiated to each member of the guardianship committee through the new member.

[0014] For any member of the guardianship committee, based on the decryption request initiated by the new member, the member's decryption share for the new member is calculated according to the member's threshold key share and the on-chain share of each member, and then sent to the new member;

[0015] Based on the decryption share received by the new member, Lagrange interpolation threshold reconstruction is performed to determine the second decryption share of the new member;

[0016] Based on the new member's first decryption share, second decryption share, and the system parameters, a threshold key pair for the new member is determined so that the new member can secretly share the key as a member of the guardianship committee.

[0017] Optionally, the threshold key pair of the i-th member in the guardianship committee is: The group's public-private key pair is

[0018] in, Let x be the threshold key for the i-th member. i Let i be the threshold key share of the i-th member. x is the group public key, x0 is the group private key, and h is the first generator.

[0019] Optionally, based on the positive integer group and the first generator, a public-private key pair for each member is generated, specifically including:

[0020] For any member, randomly select the member's private key from the group of positive integers;

[0021] The member's public key is determined based on the member's private key and the first generator.

[0022] Optionally, based on the system parameters, the threshold key share of the member is encrypted using the group public key and the member's public key to obtain the member's on-chain share, specifically including:

[0023] Randomly select the on-chain parameter of the member from the group of positive integers;

[0024] Based on the first generator and the on-chain parameters of the member, determine the first encrypted share of the member;

[0025] Based on the on-chain parameters of the member and the second generator, the threshold key share of the member is encrypted using the group public key and the member's public key to obtain the second encrypted share of the member.

[0026] Optionally, the first encrypted share of the i-th member is determined using the following formula:

[0027]

[0028] The second encrypted share of the i-th member is determined using the following formula:

[0029]

[0030] in, For the first encrypted share of the i-th member, Let r be the second encrypted share of the i-th member, h be the first generator, and r be the second encrypted share of the i-th member. i Let g be the uplink parameter of the i-th member, g be the second generator, and x be the uplink parameter of the i-th member. i PK is the threshold key share of the i-th member. i Let be the public key of the i-th member. It is a public key for the group.

[0031] Optionally, based on the joining request initiated by the new member, the member's on-chain share is decrypted using the member's private key, and the Lagrange factor of the member with respect to the new member is calculated, specifically including:

[0032] Based on the new member's joining request, the new member is verified. After successful verification, the member's on-chain share is decrypted using the member's private key to obtain the member's initial decrypted share.

[0033] Obtain the Lagrange parameter of the member with respect to the new member;

[0034] Calculate the Lagrange factor of the member with respect to the new member based on the member's initial decryption share and the member's Lagrange parameter with respect to the new member.

[0035] Optionally, the initial decryption share of the i-th member is determined using the following formula:

[0036]

[0037] in, For the initial decryption share of the i-th member, For the first encrypted share of the i-th member, For the second encrypted share of the i-th member, y i Let i be the private key of the i-th member;

[0038] The Lagrange factor of the i-th member with respect to the new member is calculated using the following formula:

[0039]

[0040] Among them, L ie Let LA be the Lagrange factor of the i-th member with respect to the new member. ie Let be the Lagrange parameter of the i-th member with respect to the new member.

[0041] Optionally, the decryption request includes the member set corresponding to the Lagrange factor received by the new member and the Lagrange parameter of each member in the member set with respect to the new member;

[0042] The following formula is used to calculate the decryption share of the i-th member with respect to the new member:

[0043]

[0044] Where, m i UQ represents the decryption share of the i-th member to the new member. e For the set of members corresponding to the Lagrange factors received by the new member, For the first encrypted share of the j-th member, LA je Let x be the Lagrange parameter of the j-th member with respect to the new member. i Let be the threshold key share of the i-th member.

[0045] Optionally, the blockchain-based dynamic guardian secret sharing method further includes:

[0046] When any target member leaves the guardianship committee, a secret shared polynomial is generated in a distributed manner by the members of the guardianship committee;

[0047] Based on the system parameters and the polynomial, determine the new on-chain share of each member;

[0048] For any member of the guardianship committee, the secret custody share of the member after the target member leaves the guardianship committee is determined based on the member's on-chain share and the member's new on-chain share.

[0049] To achieve the above objectives, the present invention also provides the following solution:

[0050] A blockchain-based dynamic guardian confidentiality sharing system includes:

[0051] The system initialization module is used to initialize system parameters; the system parameters include a positive integer group, a first generator, and a second generator.

[0052] The committee initialization module is used to generate threshold key pairs and group public-private key pairs for each member of the guardian committee based on the distributed key generation method and the first generator; and to generate public-private key pairs for each member based on the positive integer group and the first generator; the guardian committee includes multiple members, each of whom is a node in the blockchain; the threshold key pair includes the threshold key and threshold key share of the corresponding member;

[0053] The share-on-chain module is used to encrypt the threshold key share of any member in the guardianship committee according to the system parameters, using the group public key and the member's public key, to obtain the member's on-chain share; each member's on-chain share includes a first encrypted share and a second encrypted share;

[0054] The initial share decryption module is used to, for any new member, initiate a joining application to each member of the guardian committee through the new member; for any member of the guardian committee, based on the joining application initiated by the new member, decrypt the member's on-chain share using the member's private key, calculate the member's Lagrange factor over the new member, and send the Lagrange factor to the new member;

[0055] The share reconstruction module is used to determine the first decryption share of the new member based on the Lagrange factor received by the new member, and to initiate a decryption application to each member of the guardian committee through the new member;

[0056] The threshold decryption module is used to calculate the decryption share of any member of the guardianship committee for the new member based on the decryption request initiated by the new member, according to the member's threshold key share and the on-chain share of each member, and send it to the new member.

[0057] The new share extraction module is used to perform Lagrange interpolation threshold reconstruction based on the decryption share received by the new member to determine the second decryption share of the new member; and to determine the threshold key pair of the new member based on the first decryption share, the second decryption share and the system parameters, so that the new member can secretly share as a member of the guardian committee.

[0058] According to specific embodiments provided by the present invention, the present invention discloses the following technical effects:

[0059] This invention employs a dual public key double encryption process through system initialization, committee initialization, share on-chaining, share decryption, share reconstruction, threshold decryption, and new share extraction stages. Furthermore, it introduces dynamic changes in the guardian committee members, enabling new members to reconstruct their own secret share without knowing the key content or the shares of other members. This enhances the security and public verifiability of shares during the secret sharing process. The guardian committee holds different shares of a public secret through threshold technology, reconstructing the secret only when the threshold value is met. The distributed storage protection model further improves the security of the secret. Attached Figure Description

[0060] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0061] Figure 1 This is a flowchart of the blockchain-based dynamic guardian secret sharing method of the present invention;

[0062] Figure 2 This is a schematic diagram illustrating the stages of the blockchain-based dynamic guardian secret sharing method of the present invention;

[0063] Figure 3 This is a schematic diagram of the module of the blockchain-based dynamic guardian secret sharing system of the present invention.

[0064] Symbol explanation:

[0065] System initialization module-1, committee initialization module-2, share on-chain module-3, share preliminary decryption module-4, share reconstruction module-5, threshold decryption module-6, new share extraction module-7. Detailed Implementation

[0066] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0067] The purpose of this invention is to provide a method and system for dynamic guardian secret sharing based on blockchain. By combining cryptographic threshold encryption, distributed key generation, secret sharing and blockchain technology, and incorporating double public key encryption, the invention utilizes a decentralized third-party guardian group, with each member's secret sharing share stored on the blockchain, thereby increasing the security of secret sharing.

[0068] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0069] The core of this invention consists of a guardianship committee and a blockchain. The guardianship committee is both a secret-sharing committee that controls the threshold secret share and an encrypted guardianship committee. Members can be dynamically added to the committee, and the secret share of the newly added members needs to be updated. When a member leaves the committee, the share stored on the blockchain needs to be updated.

[0070] Example 1

[0071] like Figure 1 As shown, this embodiment provides a blockchain-based method for dynamic guardian secret sharing, including:

[0072] S1: Initialize system parameters. The system parameters include a positive integer group, a first generator, and a second generator. Specifically, S1 includes:

[0073] (11) Select safety parameter 1 λ Randomly select the first prime number q and multiple second prime numbers {p1, p2, ..., p} k}. Where k is the number of the second prime numbers. The first prime number is greater than the second prime number.

[0074] (12) Calculate the third generator Q based on the first prime number and multiple second prime numbers:

[0075] (13) Determine the positive integer group based on the third generator Q. and the first generator h. The positive integer group is a positive integer from 1 to Q-1. The order of the first generator h is Q-1.

[0076] (14) From the group of positive integers Determine the intermediate generator set {g1, g2, ..., g}. k The set of intermediate generators includes multiple intermediate generators, the number of which is the same as the number of second primes, and the order of each intermediate generator corresponds to the order of each second prime. That is, {g1, g2, ..., g...} k The order of {p1, p2, ..., p} is {p1, p2, ..., p}. k}

[0077] (15) Determine the second generator g based on the intermediate generator set:

[0078] Step S1 initializes system parameters. Various prime generators are used for group computation. After initialization, it can undertake multiple storage and update tasks of DKG (distributed key generation) committee threshold key shares.

[0079] S2: Based on the distributed key generation method, according to the first generator, generate threshold key pairs and group public-private key pairs for each member of the guardianship committee. The guardianship committee includes multiple members, each of whom is a node in the blockchain. The threshold key pair includes the threshold key and threshold key share of the corresponding member.

[0080] Specifically, the guardianship committee has n members, denoted as P1, P2, ..., Pn. n Each member of the guardianship committee pre-runs the DKG method to determine the threshold key pair of the i-th member of the guardianship committee. and group public-private key pairs in, Let x be the threshold key for the i-th member. i Let i be the threshold key share of the i-th member. x is the group public key, x0 is the group private key, and h is the first generator.

[0081] It should be noted that the threshold key shares of each member are x1, x2, ..., x. n It satisfies the relevant properties of the t-th order secret sharing polynomial, that is, t members with a threshold value can recover the group private key x0 by using the threshold key share together.

[0082] S3: Generate public-private key pairs for each member based on the positive integer group and the first generator.

[0083] Specifically, for any member, from the group of positive integers The private key y of the member is randomly selected in the middle. i Based on the member's private key and the first generator h, the member's public key is determined. That is, the public-private key pair of the i-th member is...

[0084] Steps S2 and S3 are used for the initialization process of the guardianship committee members. The guardianship committee members must generate a threshold public-private key pair for the group and a threshold key share for each member in a predetermined manner, which will be used for subsequent decryption operations on encrypted content. In addition, each member must have their own independent pair of public and private keys, which will be used to ensure the security of the encryption and decryption process of the threshold key share independently.

[0085] S4: For any member of the guardianship committee, based on the system parameters, the threshold key share of that member is encrypted using the group public key and the member's public key to obtain the member's on-chain share. Each member's on-chain share includes a first encrypted share and a second encrypted share.

[0086] Specifically, the guardianship committee members P1, P2, ..., P n You need to encrypt your threshold key share twice as a message.

[0087] For the i-th member of the guardianship committee, first from the group of positive integers The uplink parameter r of the i-th member is randomly selected. i .

[0088] Then, based on the first generator h and the on-chain parameters of the i-th member, the first cryptographic share of the i-th member is determined.

[0089] Then, based on the on-chain parameters of the i-th member and the second generator g, the group public key is used. and the public key of the i-th member Threshold key share TSK for the i-th member i =x i Encryption is performed to obtain the second encrypted share of the i-th member.

[0090] Where, x i PK is the threshold key share of the i-th member. i Let be the public key of the i-th member. It is a public key for the group.

[0091] In addition, each member also used the discrete logarithm equality proof method commonly used in the field of blockchain cryptography to generate proofs and record them on the chain.

[0092] Each member of the guardianship committee must encrypt their own threshold key share. Step S4 uses a double encryption mode, using the group public key and the member's own public key for secondary encryption. The resulting ciphertext is used as an encrypted share, generating a corresponding correctness proof and storing it on the blockchain for verification by other nodes.

[0093] S5: For any new member, the new member initiates a membership application to each member of the Guardian Committee. The new member is the user who wishes to join the Guardian Committee and be allocated a key share.

[0094] S6: For any member of the guardianship committee, based on the joining application initiated by the new member, decrypt the member's on-chain share using the member's private key, calculate the member's Lagrange factor over the new member, and send the Lagrange factor to the new member.

[0095] Specifically, (61) based on the new member’s application to join, the new member is identified. After the identification is successful, the member’s on-chain share is decrypted using the member’s private key to obtain the member’s initial decrypted share.

[0096] New member P e Before joining the guardianship committee, the correctness of each member's share on the blockchain must first be verified (each node's share is accompanied by a proof generated by the equality of discrete logarithms, indicating that it is holding the correct share, and then placed on the blockchain; all participating nodes can verify it based on the data on the blockchain), and the set of members that have passed the verification is denoted as U. e New member P e To member set U e Members initiate membership applications, U e The members verify their qualifications and identities, and after verification, each member P in the member set... i Use your own independent private key to perform initial decryption of the on-chain share.

[0097] In this embodiment, the initial decryption share of the i-th member is determined using the following formula.

[0098]

[0099] in, For the first encrypted share of the i-th member, For the second encrypted share of the i-th member, yi Let be the private key of the i-th member.

[0100] (62) Obtain the Lagrange parameter of the member relative to the new member.

[0101] (63) Based on the initial decryption share of the member and the Lagrange parameter of the member with respect to the new member, calculate the Lagrange factor of the member with respect to the new member. Then, generate the corresponding proof using a similar operation to the previous step, and combine the proof with the Lagrange factor L. ie Send them together to the new member P e In this embodiment, the Lagrange factor of the i-th member with respect to the new member is calculated using the following formula:

[0102]

[0103] Among them, L ie Let LA be the Lagrange factor of the i-th member with respect to the new member. ie Let be the Lagrange parameter of the i-th member with respect to the new member.

[0104] To apply to join the guardianship committee and obtain their share, a node first verifies the information stored on the blockchain. Upon successful verification, it sends a request to the corresponding guardianship committee. Each member independently verifies and determines whether to agree to join and decrypts the message. After successful verification, it uses its own private key to perform a preliminary decryption operation on the on-chain share and calculates the share P for the new member. e The Lagrange factor, and the new member P after collecting multiple Lagrange factors. e It can recover the private key share information of your location.

[0105] S7: Based on the Lagrange factor received by the new member, determine the first decryption share of the new member, and initiate a decryption request to each member of the guardianship committee through the new member. Specifically, the decryption request includes the member set corresponding to the Lagrange factor received by the new member and the Lagrange parameters of each member in the member set relative to the new member.

[0106] New member P e After receiving the Lagrange factor and its proof, verify it. If the verification is successful, add it to the member set UQ. e In this process, the Lagrange factor shares are combined to obtain the first decryption share L, which contains its own private key share but has not yet been fully decrypted. e :

[0107]

[0108] Due to the previous DKG process, the members of the guardianship committee have formed a set of group public-private key pairs and their corresponding public-private key shares. Private key shares exceeding a threshold can be used to reconstruct the group key information using Lagrange interpolation. Here, each node restricts the Lagrange parameter, ensuring that through the Lagrange shares of nodes exceeding the threshold, new members can only recover the encrypted information related to their own private key share, and cannot obtain the private key shares of other members.

[0109] S8: For any member of the guardianship committee, based on the decryption request initiated by the new member, calculate the decryption share of the member to the new member according to the member's threshold key share and the on-chain share of each member, and send it to the new member.

[0110] Specifically, the new member P e Inform the members of the guardianship committee of their collection of members, UQ. e The request asks each member to help calculate the decryption share m. i In this embodiment, the decryption share of the i-th member to the new member is calculated using the following formula:

[0111]

[0112] Where, m i UQ represents the decryption share of the i-th member to the new member. e For the set of members corresponding to the Lagrange factors received by the new member, For the first encrypted share of the j-th member, LA je Let x be the Lagrange parameter of the j-th member with respect to the new member. i Let be the threshold key share of the i-th member.

[0113] In step S8, each member uses their own private key share to perform calculations, and finally the new member P... e The private key x used for exploiting the group can be obtained through Lagrange interpolation. o The decryption value and related information are then used to obtain one's own share of the private key.

[0114] S9: Based on the decryption share received by the new member, perform Lagrange interpolation threshold reconstruction to determine the second decryption share L' of the new member. e :

[0115]

[0116] Among them, LA i0 For member P i For the Lagrangian parameters of P0, P0 is P1, P2, ..., P nThis group of nodes stores the secret shares corresponding to their positions. Secret sharing is equivalent to a polynomial curve, with each node corresponding to a share. P0 is the value of x in the polynomial when x is 0, which corresponds to the secret to be stored.

[0117] S10: Determine the threshold key pair of the new member based on the first decryption share, the second decryption share, and the system parameters, so that the new member can secretly share the key as a member of the guardianship committee.

[0118] Specifically, the formula is used to calculate the new member P. e Final decryption share

[0119] Since {g1,g2,…,g k The order of {p1, p2, ..., p} is {p1, p2, ..., p}. k}, For i∈{1,…,k}, continue to use the following formula to calculate the first intermediate variable p' i Second intermediate variable e i :

[0120]

[0121]

[0122] Due to the intermediate generator g i The order is p i p i It is a small prime number, and e can be obtained by solving the discrete logarithm. i =x e ·p' i This leads to k equations x. e =(p' i ) -1 e i mod p i The new member uses the Chinese Remainder Theorem to solve for the final threshold key share x based on k equations. e .

[0123] Furthermore, the blockchain-based dynamic guardian secret sharing method of the present invention also includes:

[0124] S11: When any target member leaves the guardianship committee, a secret-shared polynomial is generated in a distributed manner by the members of the guardianship committee.

[0125] Specifically, if member P l If a person withdraws from the guardianship committee, then {P1, P2, ..., P} n}\P lDistributed generation of secret-sharing polynomial F'(x), where F'(0) = 0 and F'(x) does not know F'(l).

[0126] S12: Determine the new on-chain share of each member based on the system parameters and the polynomial.

[0127] Specifically, for the i-th member, a new on-chain parameter r' of the i-th member is randomly selected. i Using formula and Calculate the new on-chain share of the i-th member to complete the update of the i-th member's share.

[0128] S13: For any member of the guardianship committee, based on the member's on-chain share and the member's new on-chain share, determine the member's secret custody share after the target member leaves the guardianship committee.

[0129] Specifically, the secret custody share of the i-th member after the target member withdraws from the guardianship committee is determined using the following formula.

[0130]

[0131]

[0132] After a member leaves, a new distributed polynomial is generated, and the share of each node is recalculated. Let F'(0) = 0 to ensure that the secret is still the secret on the original polynomial curve. The original share is multiplied by the new share to complete the share update in the case of member departure.

[0133] In summary, the blockchain-based dynamic guardian secret sharing method of this invention includes eight stages: system initialization stage, committee initialization stage, share on-chain stage, share initial decryption stage, share reconstruction stage, threshold decryption stage, new share extraction stage, and member exit stage, as follows: Figure 2 As shown.

[0134] This invention first employs dual public-key encryption and introduces a guardian group to enhance the security and public verifiability of shares in traditional secret-sharing schemes, significantly solving the problem of difficult distributed secret sharing in traditional blockchain environments. More adaptable to distributed environments, multiple parties hold different shares of a public secret through threshold technology. The secret is reconstructed only when the threshold value is met. The distributed storage protection model further enhances the security of holding the secret.

[0135] To better suit real-world applications and specifically address the dynamic changes in the guardianship committee, including members joining and leaving, this invention employs a secure new member share allocation process based on Lifted ElGamal and threshold encryption. This ensures that, while protecting the shares of other nodes and the secret, newly joined members receive a fixed share of the secret-sharing message. Specifically, a complete encryption, decryption, verification, and reconstruction mechanism is used for newly joined members, guaranteeing that they can reconstruct their correct secret-sharing share even without knowing the key content or the shares of other nodes. Furthermore, a scheme for updating the secret-sharing share upon member departure eliminates the need for complete redistribution, simplifying the dynamic joining and leaving process. This enhances both the security of secret information and convenience, increasing the flexibility and adaptability of threshold dynamic guardian secret sharing. Ultimately, it improves the security and applicability of protocols like DKG in blockchain scenarios, resolving the issue of traditional secret sharing not supporting dynamic changes in committee members. This makes the secret sharing scheme better suited for real-world distributed blockchain applications.

[0136] Example 2

[0137] In order to implement the method corresponding to Embodiment 1 above and achieve the corresponding functions and technical effects, a blockchain-based dynamic guardian secret sharing system is provided below.

[0138] like Figure 3 As shown, the blockchain-based dynamic guardian secret sharing system provided in this embodiment includes: system initialization module 1, committee initialization module 2, share on-chain module 3, share preliminary decryption module 4, share reconstruction module 5, threshold decryption module 6, and new share extraction module 7.

[0139] The system initialization module 1 is used to initialize system parameters; the system parameters include a positive integer group, a first generator, and a second generator.

[0140] The committee initialization module 2 is used to generate threshold key pairs and group public-private key pairs for each member of the guardian committee based on the distributed key generation method and the first generator; and to generate public-private key pairs for each member based on the positive integer group and the first generator; the guardian committee includes multiple members, each of whom is a node in the blockchain; the threshold key pair includes the threshold key and threshold key share of the corresponding member.

[0141] The share-on-chain module 3 is used to encrypt the threshold key share of any member in the guardianship committee according to the system parameters, using the group public key and the member's public key, to obtain the member's on-chain share; each member's on-chain share includes a first encrypted share and a second encrypted share.

[0142] The initial share decryption module 4 is used to initiate a joining application to each member of the guardian committee for any new member; for any member of the guardian committee, based on the joining application initiated by the new member, the module uses the member's private key to decrypt the member's on-chain share, calculates the member's Lagrange factor over the new member, and sends the Lagrange factor to the new member.

[0143] The share reconstruction module 5 is used to determine the first decryption share of the new member based on the Lagrange factor received by the new member, and to initiate a decryption application to each member of the guardian committee through the new member.

[0144] The threshold decryption module 6 is used to calculate the decryption share of any member of the guardianship committee for the new member based on the decryption request initiated by the new member, according to the member's threshold key share and the on-chain share of each member, and send it to the new member.

[0145] The new share extraction module 7 is used to perform Lagrange interpolation threshold reconstruction based on the decryption share received by the new member to determine the second decryption share of the new member; and to determine the threshold key pair of the new member based on the first decryption share, the second decryption share and the system parameters, so that the new member can secretly share as a member of the guardianship committee.

[0146] This invention constructs a key encryption escrow scheme based on Paillier threshold keys, which can be associated with blockchain and other systems to realize distributed escrow of blockchain keys. It constructs a distributed key escrow service with distributed multi-party participation, enhances security through guardians, and supports the updating and replacement of committee members.

[0147] Example 3

[0148] This embodiment provides an electronic device, including a memory and a processor. The memory stores a computer program, and the processor runs the computer program to enable the electronic device to execute the blockchain-based dynamic guardian secret sharing method of Embodiment 1.

[0149] Alternatively, the aforementioned electronic device may be a server.

[0150] In addition, embodiments of the present invention also provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the blockchain-based dynamic guardian secret sharing method of Embodiment 1.

[0151] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0152] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. Furthermore, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A blockchain-based method for dynamic guardian confidentiality sharing, characterized in that, The blockchain-based dynamic guardian secret sharing method includes: Initialize system parameters; the system parameters include a positive integer group, a first generator, and a second generator; Based on the distributed key generation method, threshold key pairs and group public-private key pairs are generated for each member of the guardianship committee according to the first generator; the guardianship committee includes multiple members, each of whom is a node in the blockchain; the threshold key pair includes the threshold key and threshold key share of the corresponding member; Based on the positive integer group and the first generator, generate public-private key pairs for each member; For any member of the guardianship committee, based on the system parameters, the threshold key share of the member is encrypted using the group public key and the member's public key to obtain the member's on-chain share; each member's on-chain share includes a first encrypted share and a second encrypted share; For any new member, the new member submits a membership application to each member of the guardianship committee. For any member of the guardianship committee, based on the new member's joining request, the member's on-chain share is decrypted using the member's private key, and the member's Lagrange factor over the new member is calculated and sent to the new member. Based on the Lagrange factor received by the new member, the first decryption share of the new member is determined, and a decryption application is initiated to each member of the guardianship committee through the new member. For any member of the guardianship committee, based on the decryption request initiated by the new member, the member's decryption share for the new member is calculated according to the member's threshold key share and the on-chain share of each member, and then sent to the new member; Based on the decryption share received by the new member, Lagrange interpolation threshold reconstruction is performed to determine the second decryption share of the new member; Based on the new member's first decryption share, second decryption share, and the system parameters, a threshold key pair for the new member is determined so that the new member can secretly share the key as a member of the guardianship committee.

2. The blockchain-based dynamic guardian secret sharing method according to claim 1, characterized in that, The threshold key pair of the i-th member in the guardianship committee is The group public-private key pair is in, Let x be the threshold key for the i-th member. i Let i be the threshold key share of the i-th member. x is the group public key, x0 is the group private key, and h is the first generator.

3. The blockchain-based dynamic guardian secret sharing method according to claim 1, characterized in that, Based on the positive integer group and the first generator, generate public-private key pairs for each member, specifically including: For any member, randomly select the member's private key from the group of positive integers; The member's public key is determined based on the member's private key and the first generator.

4. The blockchain-based dynamic guardian secret sharing method according to claim 1, characterized in that, Based on the system parameters, the threshold key share of each member is encrypted using the group public key and the member's public key to obtain the member's on-chain share, specifically including: Randomly select the on-chain parameter of the member from the group of positive integers; Based on the first generator and the on-chain parameters of the member, determine the first encrypted share of the member; Based on the on-chain parameters of the member and the second generator, the threshold key share of the member is encrypted using the group public key and the member's public key to obtain the second encrypted share of the member.

5. The blockchain-based dynamic guardian secret sharing method according to claim 4, characterized in that, The first encrypted share of the i-th member is determined using the following formula: The second encrypted share of the i-th member is determined using the following formula: in, For the first encrypted share of the i-th member, Let r be the second encrypted share of the i-th member, h be the first generator, and r be the second encrypted share of the i-th member. i Let g be the uplink parameter of the i-th member, g be the second generator, and x be the uplink parameter of the i-th member. i PK is the threshold key share of the i-th member. i Let be the public key of the i-th member. It is a public key for the group.

6. The blockchain-based dynamic guardian secret sharing method according to claim 1, characterized in that, Based on the joining request initiated by the new member, the member's on-chain share is decrypted using the member's private key, and the Lagrange factor of the member with respect to the new member is calculated, specifically including: Based on the new member's joining request, the new member is verified. After successful verification, the member's on-chain share is decrypted using the member's private key to obtain the member's initial decrypted share. Obtain the Lagrange parameter of the member with respect to the new member; Calculate the Lagrange factor of the member with respect to the new member based on the member's initial decryption share and the member's Lagrange parameter with respect to the new member.

7. The blockchain-based dynamic guardian secret sharing method according to claim 6, characterized in that, The initial decryption share of the i-th member is determined using the following formula: in, For the initial decryption share of the i-th member, For the first encrypted share of the i-th member, For the second encrypted share of the i-th member, y i Let i be the private key of the i-th member; The Lagrange factor of the i-th member with respect to the new member is calculated using the following formula: Among them, L ie Let LA be the Lagrange factor of the i-th member with respect to the new member. ie Let be the Lagrange parameter of the i-th member with respect to the new member.

8. The blockchain-based dynamic guardian secret sharing method according to claim 1, characterized in that, The decryption request includes the member set corresponding to the Lagrange factor received by the new member and the Lagrange parameter of each member in the member set with respect to the new member; The following formula is used to calculate the decryption share of the i-th member with respect to the new member: Where, m i UQ represents the decryption share of the i-th member to the new member. e For the set of members corresponding to the Lagrange factors received by the new member, For the first encrypted share of the j-th member, LA je Let x be the Lagrange parameter of the j-th member with respect to the new member. i Let be the threshold key share of the i-th member.

9. The blockchain-based dynamic guardian secret sharing method according to claim 1, characterized in that, The blockchain-based dynamic guardian secret sharing method also includes: When any target member leaves the guardianship committee, a secret shared polynomial is generated in a distributed manner by the members of the guardianship committee; Based on the system parameters and the polynomial, determine the new on-chain share of each member; For any member of the guardianship committee, the secret custody share of the member after the target member leaves the guardianship committee is determined based on the member's on-chain share and the member's new on-chain share.

10. A blockchain-based dynamic guardian secret sharing system, characterized in that, The blockchain-based dynamic guardian secret sharing system includes: The system initialization module is used to initialize system parameters; the system parameters include a positive integer group, a first generator, and a second generator. The committee initialization module is used to generate threshold key pairs and group public-private key pairs for each member of the guardian committee based on the distributed key generation method and the first generator; and to generate public-private key pairs for each member based on the positive integer group and the first generator; the guardian committee includes multiple members, each of whom is a node in the blockchain; the threshold key pair includes the threshold key and threshold key share of the corresponding member; The share-on-chain module is used to encrypt the threshold key share of any member in the guardianship committee according to the system parameters, using the group public key and the member's public key, to obtain the member's on-chain share; each member's on-chain share includes a first encrypted share and a second encrypted share; The initial share decryption module is used to, for any new member, initiate a joining application to each member of the guardian committee through the new member; for any member of the guardian committee, based on the joining application initiated by the new member, decrypt the member's on-chain share using the member's private key, calculate the member's Lagrange factor over the new member, and send the Lagrange factor to the new member; The share reconstruction module is used to determine the first decryption share of the new member based on the Lagrange factor received by the new member, and to initiate a decryption application to each member of the guardian committee through the new member; The threshold decryption module is used to calculate the decryption share of any member of the guardianship committee for the new member based on the decryption request initiated by the new member, according to the member's threshold key share and the on-chain share of each member, and send it to the new member. The new share extraction module is used to perform Lagrange interpolation threshold reconstruction based on the decryption share received by the new member to determine the second decryption share of the new member; and to determine the threshold key pair of the new member based on the first decryption share, the second decryption share and the system parameters, so that the new member can secretly share as a member of the guardian committee.

Images