A blockchain-based distributed key escrow method

Abstract

The application discloses a kind of distributed key escrow methods based on block chain, there are two kinds of committee identity nodes in the method: escrow node and election node. The secret is fragmented using improved Shamir secret sharing, and the fragmented fragments are escrowed on anonymous escrow nodes, which are dynamically elected by the election nodes. The election committee builds an anonymous communication channel to maintain the anonymous identity of the escrow committee. Every certain period of time, the smart contract triggers the re-election of the election nodes and the escrow nodes, dynamically changing the membership of the committee. The old escrow nodes transfer the fragmented shares to the new escrow nodes by halving the fragmented shares through anonymous communication, and the new escrow nodes restore the fragmented shares after receiving them, completing the regular dynamic update of the escrow nodes. The application ensures the security, anonymity and tamper resistance of node information, and decentralizes the management of keys, improving the security and reliability of secret escrow.

Description

TECHNICAL FIELD

[0001] The present application relates to the blockchain technology, Shamir secret sharing technology, anonymous communication technology, and particularly relates to a distributed key escrow method based on a blockchain. BACKGROUND

[0002] The importance of the private key in the blockchain is self-evident, and the private key holds the ownership of the user's digital assets. If the private key is leaked or lost, the user will not be able to access his own digital assets and prove his ownership, which will result in the loss or misuse of the assets. Therefore, protecting the private key is the primary task of the digital asset holder.

[0003] The existing private key management scheme can be mainly divided into local hardware management, software management and escrow management. The biggest problem of hardware management and software management is that if the key is lost without backup, all digital assets under the key will be lost and cannot be retrieved. The traditional escrow needs to be based on a completely trusted third party. Although the problem of not being able to retrieve the key after losing it is solved, there is still a great security risk when the escrow party commits fraud or is attacked and the private key is leaked.

[0004] The blockchain is a new application mode of distributed data storage, P2P point-to-point transmission, Byzantine fault-tolerant consensus algorithm and cryptography algorithm. It has the nature of decentralization, which can avoid the problems caused by single centralization.

[0005] Therefore, based on the blockchain, a trusted, safe and reliable, low-cost key escrow system can be built based on the decentralization of the blockchain. SUMMARY

[0006] The purpose of the present application is to solve the problem that the third party, i.e. the escrow party, cannot be avoided in the traditional escrow system, and to provide a distributed key escrow method based on a blockchain, which improves the security of key escrow.

[0007] The purpose of the present application is achieved by the following technical scheme:

[0008] A distributed key escrow method based on a blockchain, the user's key is cut into a specified number by a slicing method and stored on an anonymous escrow node elected by an election node that constitutes an election committee; every time interval, after the smart contract is triggered, all nodes re-elect new election nodes, the new election nodes re-elect the escrow nodes that constitute the escrow committee, the original escrow nodes send the escrow key slices to the newly elected escrow nodes, and the periodic update of the election nodes, the escrow nodes and the held key slices is completed;

[0009] The slicing method is an improved Shamir secret sharing algorithm, that is, the key of the user is encrypted in an asymmetric bivariate polynomial B(X, Y), wherein X and Y are variables, the dimension of X is t, the dimension of Y is 2t, B(0, 0) = S, S is the secret itself, and t is the minimum number of key fragments set for recovering the key, that is, the threshold value; the divided key fragments are B(i, Y), wherein i is the number of the hosting node.

[0010] Further, the method specifically comprises the following steps:

[0011] (1) All nodes calculate a random verifiable function, and according to a preset rule, a preset number of nodes are selected from all nodes as election nodes to form an election committee, and the identity of the election node is verifiable;

[0012] (2) Each election node randomly selects a node as a hosting node, and all hosting nodes form a hosting committee; the election node establishes a communication mechanism by encrypting the public key corresponding to the hosting node to build a target anonymous channel;

[0013] (3) The user sends the slices to the hosting nodes elected by the election committee through the target anonymous channel built by the election node after the key is sliced and encrypted;

[0014] (4) Every certain period of time, the smart contract is triggered, all nodes reselect election nodes, and the new election nodes reselect the hosting nodes randomly to rebuild the target anonymous channel;

[0015] (5) After the target anonymous channel is rebuilt again, the original hosting node sends the key fragments after halving the key shares to the new hosting node through the new target anonymous channel.

[0016] (6) The new hosting node offsets the fragments by using a bivariate 0 sharing polynomial after receiving the key fragments after halving the shares;

[0017] (7) The new hosting node recovers the shares of the fragments by interaction to rehold the complete key fragments;

[0018] (8) When the user initiates the hosting recovery, the current hosting node sends the key fragments to the user after the user's identity is verified, and the user locally splices the key to complete the recovery of the hosting key.

[0019] Further, all nodes locally run a pre-set random verifiable function; the public parameter of the random verifiable function selects the hash value of the last block, and the node whose output value meets the preset condition becomes an election node.

[0020] Further, after the election node randomly selects a node as a hosting node, a new temporary key pair (esk, epk) is generated locally, where esk is the private key and epk is the public key; the private key esk in the temporary key pair is encrypted with the public key of the selected hosting node to generate a ciphertext ct; the election information (ct, epk) is written into the account book through a transaction to be publicized, and all nodes can obtain the election information; all nodes send messages to the hosting node through the public key epk, but do not know the identity of the recipient, thereby completing the construction of the target anonymous channel; after all nodes obtain the election information, the ciphertext ct in the election information is decrypted using the private key of the node, and if the private key esk corresponding to the public key epk in the election information can be obtained, it is proved that the node is the selected hosting node, otherwise, the node is not the hosting node.

[0021] Further, after the election node selects the hosting node, the user encrypts the private key through the improved Shamir secret sharing algorithm, and sends the key fragments B(i, Y) to the hosting nodes through the target anonymous channel, thereby completing the distributed hosting of the key.

[0022] Further, at regular intervals, the smart contract is triggered, and all nodes will reselect the election node, specifically:

[0023] All nodes run the pre-set random verifiable function locally, and publish the operation result on the chain. The nodes whose operation results meet the preset conditions will be regarded as the new election nodes. When the new election nodes are selected, the old election nodes and the target anonymous channel constructed by the old election nodes are invalid, and the new election nodes randomly select new hosting nodes and construct new target anonymous channels according to the new hosting nodes.

[0024] Further, after the new target anonymous channel is successfully constructed, the old hosting nodes need to transfer the key fragments to the new hosting nodes through the target anonymous channel. The old hosting node i calculates the key fragments B(i, j 1, …j n ) corresponding to the new hosting node j k , and sends the new key fragments to the corresponding new hosting node.

[0025] Further, the new hosting node j calculates the share halved key fragment B(X, j) through Lagrange interpolation after receiving the new key fragments from more than t old hosting nodes, and the recovery threshold is 2t at this time; the share halved key fragment B(X, j) is offset through a bivariate 0 sharing polynomial Q(X, Y) satisfying Q(0, 0) = 0, to obtain a new share halved key fragment B'(X, j) = B(X, j) + Q(X, j), so that the complete share key fragment held by the new hosting node constructed later cannot be calculated with the key fragment held by the old hosting node to obtain the correct encryption polynomial.

[0026] Further, after the new hosting node completes the calculation of the bivariate 0 sharing polynomial, the new hosting nodes are interacted, the node j calculates the share halved key fragment B'(t n The corresponding share halved key fragment B'(t k ,j) is sent to the corresponding new hosting node, and the new hosting node t k After receiving the share halved key fragments sent by any more than 2t nodes, Lagrange interpolation calculation is performed to recalculate the complete share key fragment B'(t k ,Y), and the recovery threshold is recovered to t.

[0027] Further, when the user initiates the hosting recovery, the hosting node sends the key fragment to the user, and the user recovers the polynomial B'(X, Y) locally through Lagrange interpolation to calculate the hosting key S = B'(0, 0) and complete the recovery of the hosting key.

[0028] The beneficial effects of the present application are as follows:

[0029] The present application is based on the decentralized characteristics of the blockchain, and combines the advantages of the decentralized blockchain. Through the decentralized storage of the blockchain, the problem of single point evil is avoided. Through the double committee anonymous algorithm, the security, anonymity and non-tamperability of the node information are ensured, and the communication node is effectively prevented from being attacked. The decentralized implementation of the key hosting improves the security and reliability of the secret hosting. BRIEF DESCRIPTION OF DRAWINGS

[0030] Figure 1 is a flowchart of a distributed key hosting method based on a blockchain of an embodiment of the present application. DETAILED DESCRIPTION

[0031] The present application will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings and preferred embodiments, it should be understood that the specific embodiments described herein are intended to be merely illustrative of the present application and are not to be taken in a limiting sense.

[0032] As Figure 1 The distributed key escrow method based on the blockchain of the embodiment of the application is shown in the figure, the key of the user is cut into a specified number by a slicing method and stored on an anonymous escrow node elected by the election node constituting an election committee; every time interval, the smart contract is triggered, all nodes re-elect new election nodes, the new election nodes re-elect the escrow nodes constituting the escrow committee, the original escrow nodes send the key slices held to the newly elected escrow nodes, and the regular update of the election nodes, the escrow nodes and the held key slices is completed.

[0033] The slicing method here is an improved Shamir secret sharing algorithm, that is, the key of the user is encrypted in a non-symmetric bivariate polynomial B(X, Y), wherein X and Y are variables, the dimension of X is t, the dimension of Y is 2t, B(0, 0) = S, S is the secret itself, and t is the minimum number of key fragments set to recover the key, that is, the threshold value; the divided key fragments are B(i, Y), wherein i is the number of the escrow node.

[0034] The distributed key escrow method based on the blockchain of the embodiment of the application specifically comprises the following steps:

[0035] (1) All nodes calculate a random verifiable function, which is an encryption algorithm, and the output result is randomly generated, but the result can be publicly verified. According to a preset rule, a preset number of nodes are selected from all nodes as election nodes to constitute an election committee, and the identity of the election node is verifiable.

[0036] Here, when the election nodes are elected, all nodes locally run a pre-set random verifiable function; the public parameter of the random verifiable function is the hash value of the last block, and the node whose output value meets the preset condition becomes the election node.

[0037] (2) Each election node randomly selects one node as an escrow node, and only the election node knows the identity of the escrow node, thereby reducing the probability of the escrow node being attacked. All escrow nodes constitute an escrow committee; the election node establishes a communication mechanism by public key encryption through the public key of the escrow node, and constructs a target anonymous channel.

[0038] Exemplarily, after the election node randomly selects a node as a hosting node, a new temporary key pair (esk, epk) is generated locally, where esk is a private key and epk is a public key; the private key esk in the temporary key pair is encrypted with the public key of the selected hosting node to generate a ciphertext ct; the election information (ct, epk) is written into the account book through a transaction to be publicized, and all nodes can obtain the election information; all nodes send messages to the hosting node through the public key epk, but do not know the identity of the recipient, thereby completing the construction of the target anonymous channel; after all nodes obtain the election information, the ciphertext ct in the election information is decrypted using the private key of the node, and if the private key esk corresponding to the public key epk in the election information can be obtained, it is proved that the node is the selected hosting node, otherwise, the node is not the hosting node.

[0039] (3) The user sends the slices to the hosting nodes elected by the election committee through the target anonymous channel constructed by the election node after the slices are encrypted.

[0040] Exemplarily, after the election node elects the hosting node, the user encrypts the key through the improved Shamir secret sharing algorithm, and obtains the key fragments B(i, Y) hosted on the hosting node. The user sends the key fragments B(i, Y) to the hosting node through the target anonymous channel, that is, the public key epk in the election information (ct, epk) published by the election node is used to encrypt the key fragments B(i, Y), and then the encrypted information is published on the blockchain through a transaction block. The corresponding hosting node decrypts the encrypted information, stores the key fragment information obtained after decryption, and completes the distributed hosting of the key.

[0041] (4) Every certain period of time, the smart contract is triggered, all nodes reselect the election node, and the new election node reselects the hosting node randomly and re-constructs the target anonymous channel; the sub-steps of this step are as follows:

[0042] All nodes run the pre-set random verifiable function locally, and publish the operation result on the chain. The nodes meeting the pre-set condition are regarded as the new round of election nodes; after the new round of election nodes are selected, the old election nodes and the target anonymous channel constructed by the old election nodes are invalid, and the new election nodes randomly select new hosting nodes and construct new target anonymous channels according to the new hosting nodes.

[0043] (5) When the target anonymous channel is reconstructed again, the original hosting node sends the key fragments after halving the shares to the new hosting node through the new target anonymous channel. Specifically, when the new target anonymous channel is successfully constructed, the old hosting node needs to transfer the key fragments to the new hosting node through the target anonymous channel. The old hosting node i calculates the new key fragments B(i,j 1, …j n ) corresponding to the new hosting node j k , and sends the new key fragments to the corresponding new hosting node. After the key fragments are transferred to the new hosting node, the old hosting node needs to delete the stored key fragments to ensure security.

[0044] (6) After receiving the key fragments after halving the shares, the new hosting node performs offset processing on the fragments using a bivariate 0-sharing polynomial. Specifically, after receiving the new key fragments from more than t old hosting nodes, the new hosting node j calculates the key fragments B(X,j) after halving the shares by Lagrange interpolation, and the recovery threshold is 2t. By using a bivariate 0-sharing polynomial Q(X,Y) that satisfies Q(0,0) = 0, the key fragments B(X,j) after halving the shares are offset processed to obtain new key fragments B'(X,j) = B(X,j) + Q(X,j), so that the complete share key fragments held by the newly constructed new hosting node cannot be calculated with the key fragments held by the old hosting node to obtain the correct encryption polynomial.

[0045] (7) The new hosting node restores the shares of the fragments by interaction and re-holds the complete key fragments. Specifically:

[0046] After the new hosting node completes the calculation of the bivariate 0-sharing polynomial, the new hosting nodes interact with each other. Node j calculates the corresponding share-halved key fragments B'(t n ,j) of other nodes t1,…,t k in the new hosting committee, and sends them to the corresponding new hosting nodes. After receiving more than 2t key fragments sent by any node, the new hosting node t k performs Lagrange interpolation calculation to re-calculate the complete share key fragments B'(t k ,Y) and restore the threshold t recovery state.

[0047] (8) When the user initiates hosting recovery, the current hosting node sends the key fragments to the user after the user's identity is verified. The user locally assembles the key fragments to complete the recovery of the hosting key.

[0048] Specifically, when the user initiates the hosting recovery, the hosting node sends the key fragments to the user, the user locally restores the polynomial B'(X, Y) through Lagrange interpolation, calculates the hosting key S=B'(0, 0), and completes the recovery of the hosting key.

[0049] Those skilled in the art can understand that the above description is only preferred examples of the application and is not used to limit the application, although the application is described in detail with reference to the foregoing examples, those skilled in the art can still modify the technical solutions recorded in the foregoing examples or make equivalent replacements for part of the technical features. Any modification, equivalent replacement, etc. made within the spirit and principle of the application shall be included in the protection scope of the application.

Claims

1. A blockchain-based distributed key escrow method, characterized by The key of the user is stored on an anonymous hosting node elected by the election node constituting an election committee after being cut into a specified number by a cutting method; Every time interval, the smart contract is triggered, all nodes re-elect new election nodes, the new election nodes elect hosting nodes constituting a hosting committee, and the original hosting nodes send the key slices hosted to the newly elected hosting nodes, completing the regular update of the election nodes, the hosting nodes and the key slices held; The cutting method is an improved Shamir secret sharing algorithm, that is, the key of the user is encrypted in a non-symmetric bivariate polynomial B(X, Y), wherein X and Y are variables, the dimension of X is t, the dimension of Y is 2t, B(0, 0) = S, S is the secret itself, and t is the minimum number of key fragments for recovery, that is, the threshold value; the divided key fragments are B(i, Y), wherein i is the number of the hosting node; After the election node randomly selects a node as a hosting node, a new temporary key pair (esk, epk) is generated locally, wherein esk is a private key and epk is a public key; the private key esk in the temporary key pair is encrypted using the public key of the selected hosting node to generate a ciphertext ct; the election information (ct, epk) is written into the account book through a transaction to be publicized, and all nodes can obtain the election information; all nodes send messages to the hosting node through the public key epk, but do not know the identity of the recipient, thereby completing the construction of the target anonymous channel; after all nodes obtain the election information, the ciphertext ct in the election information is decrypted using the private key of the node, and if the private key esk corresponding to the public key epk in the election information can be obtained, it is proved that the node is the selected hosting node, otherwise, the node is not the hosting node.

2. The blockchain-based distributed key escrow method of claim 1, wherein The method specifically comprises the following steps: (1) all nodes calculate a random verifiable function, and select a preset number of nodes as election nodes from all nodes according to a preset rule to form an election committee, and the identity of the election node is verifiable; (2) each election node randomly selects a node as a hosting node, and all hosting nodes form a hosting committee; the election node establishes a communication mechanism by encrypting the public key corresponding to the hosting node to construct a target anonymous channel; (3) the user sends the key slices to the hosting nodes elected by the election committee through the target anonymous channel constructed by the election node after the key is cut and encrypted; (4) every time interval, the smart contract is triggered, all nodes reselect election nodes, and the new election nodes reselect the hosting nodes randomly to re-construct the target anonymous channel; (5) after the target anonymous channel is re-constructed, the original hosting node sends the key fragments after halving to the new hosting node through the new target anonymous channel; (6) the new hosting node offsets the fragments by using a bivariate 0 sharing polynomial after receiving the key fragments after halving; (7) the new hosting node restores the share of the fragments by interaction to hold the complete key fragments again. (8) When the user initiates the hosting recovery, the current hosting node sends the key fragments to the user after the user identity authentication is passed, and the user locally performs the key splicing to complete the recovery of the hosting key.

3. The blockchain-based distributed key escrow method of claim 2, wherein All nodes locally run a pre-set random verifiable function; the public parameter of the random verifiable function selects the hash value of the last block, and the node whose output value meets the preset condition becomes an election node. 4.The method of claim 1, wherein, After the election node elects the hosting node, the user encrypts the key through the improved Shamir secret sharing algorithm, sends the key fragments B(i, Y) to the hosting node through the target anonymous channel, and completes the distributed hosting of the key. 5.The blockchain-based distributed key escrow method of claim 1, wherein, Every certain period of time, the smart contract is triggered, and all nodes will re-elect the election node, specifically as follows: All nodes locally run a pre-set random verifiable function, and publish the operation result on the chain. The node whose operation result meets the preset condition will be regarded as a new round of election node; after the new round of election node is selected, the old election node and the target anonymous channel constructed by the old election node are invalid, and the new election node randomly selects a new hosting node again, and constructs a new target anonymous channel according to the new hosting node. 6.The method of claim 1, wherein, When the new target anonymous channel is successfully constructed, the old hosting node needs to transfer the key fragments to the new hosting node through the target anonymous channel, and the old hosting node i calculates the new hosting node j 1, … n The corresponding key fragments B(i,j k ) are calculated, and the new key fragments are sent to the corresponding new hosting node.

7. The blockchain-based distributed key escrow method of claim 6, wherein, The new hosting node j, after receiving the new key fragments from more than t old hosting nodes, calculates the key fragments B(X, j) after halving the shares by Lagrange interpolation, and the recovery threshold at this time is 2t; the key fragments B(X, j) after halving the shares are offset by a bivariate 0-sharing polynomial Q(X, Y) satisfying Q(0, 0) = 0, to obtain new key fragments B ′ (X, j) = B(X, j) + Q(X, j) so that the complete share key fragments held by the newly constructed new hosting node cannot be calculated with the key fragments held by the old hosting nodes to obtain the correct encryption polynomial. 8.The blockchain-based distributed key escrow method of claim 1, wherein, After the new hosting nodes finish the computation of the bivariate 0-sharing polynomial, the interaction between the new hosting nodes is performed, and each node j computes the other nodes t1,…,t n The corresponding share halving key piece B ′ (t k ,j) and sends it to the corresponding new hosting node, and the new hosting node t k After receiving share halving key pieces from any more than 2t nodes, the Lagrange interpolation is performed to recompute the complete share key piece B ′ (t k ,Y) and restore to the threshold t recovery state.

9. The blockchain-based distributed key escrow method of claim 1, wherein, When the user initiates the hosting recovery, the hosting node sends the key fragments to the user, who recovers the polynomial B locally by Lagrange interpolation ′ (X,Y), computes the hosting key S = B ′ (0,0), completes the recovery of the hosting key.

Images