A blockchain wallet management method and management system

Abstract

The present invention discloses a management method and management system for a blockchain wallet, belonging to the field of electronic digital data processing technology. The management method includes a method for putting transactions on the chain: obtaining a first account and a second account of a blockchain wallet, wherein the first account is used to generate a public key and a private key; generating a transaction call instruction; signing the call instruction through the private key; sending the signed call instruction to the second account; and putting the call instruction on the chain through the second account. Conducting external transactions through the second account can improve the security of account transactions, avoid exposing the first account and blockchain wallet to the outside world, protect the blockchain wallet and related assets, and effectively avoid or reduce asset risks caused by the evil deeds of the digital currency platform.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic digital data processing, and in particular to a management method and management system for a blockchain wallet. Background Art

[0002] A blockchain account is essentially a pair of asymmetric encrypted public and private keys. A blockchain wallet is used to manage a user's blockchain account. Blockchain wallets are generally divided into centralized wallets, hot wallets, and cold wallets.

[0003] Centralized wallets are generally managed by digital currency platforms operated by enterprises, such as exchanges. Hot wallets and cold wallets are wallets where users manage private keys locally and have full control over their accounts. The difference is that hot wallets are connected to the Internet, also known as online wallets, and are generally in the form of mobile APPs, computer software or browser plug-ins. They are connected to the Internet at any time to sign and send transactions, and the private keys are stored locally on the device. Cold wallets refer to offline wallets that are completely disconnected from the Internet. For example, users write down the private keys on paper or store them in devices that are completely disconnected from the Internet.

[0004] Centralized wallets are at risk of malicious behavior by digital currency platforms. The account creation, data encryption and decryption, and transaction signature operations of hot wallets are all completed by the wallet developer / operator, and the risk of malicious behavior by wallet operators cannot be ruled out; and if the bugs or vulnerabilities of the online wallet program are exploited by attackers, user assets will be lost. Account transfers rely on private keys for transmission and transfer, and there is a risk of being monitored during the transmission process. Summary of the invention

[0005] In view of the above technical problems existing in the prior art, the present invention provides a blockchain wallet management method and management system to improve the security of the transaction process.

[0006] The present invention discloses a management method of a blockchain wallet, including a method for putting transactions on a chain, wherein the method for putting transactions on a chain comprises the following steps: obtaining a first account and a second account of a blockchain wallet, wherein the first account is used to generate a public key and / or a private key; generating a transaction call instruction; signing the call instruction by using the private key; sending the signed call instruction to the second account; and putting the call instruction on a chain by using the second account.

[0007] Preferably, the method for constructing the second account is:

[0008] Generate construction instructions for the second account;

[0009] Signing the build instruction using the private key of the first account;

[0010] Send the signed build instructions to a third-party platform or external device;

[0011] After verifying the signature, the third-party platform or external device constructs the second account according to the construction instructions and uploads it to the chain.

[0012] Preferably, the blockchain wallet, the first account or the second account is deployed in a trusted execution environment;

[0013] When constructing the second account, the third-party platform and the external device generate a unique identity identifier, generate identity credentials, and perform remote identity authentication and authorization management on the first account.

[0014] Preferably, the specific method for constructing the second account includes:

[0015] Sending the construction instruction and parameters of the second account to the trusted program of the trusted execution environment;

[0016] Verifying the identity of the user through the trusted program according to a security verification mechanism;

[0017] After verification, the build instruction is signed by calling the private key interface, and the signed build instruction is returned to the wallet program;

[0018] The wallet program sends the signed build instruction to a third-party platform or external device;

[0019] According to the construction instruction, a second account is constructed in the third-party platform or the device and uploaded to the blockchain;

[0020] Set the address that receives the on-chain assets to the address of the second account.

[0021] Preferably, the specific methods for putting transactions on the chain include:

[0022] Generate call instructions through the wallet program;

[0023] Sending the calling instruction and parameters of the second account to the trusted program of the trusted execution environment;

[0024] According to the security verification mechanism, the identity of the user is verified through the trusted program;

[0025] After verification, the calling instruction is signed by calling the private key interface, and the signed building instruction is returned to the wallet program;

[0026] Sending the signed call instruction to the second account through the wallet program;

[0027] The signed call instructions are packaged and uploaded to the chain through the second account.

[0028] Preferably, the method for transferring the first account authority includes:

[0029] Construct transfer instructions through the wallet program;

[0030] sending the transfer instruction, the second account address and the transfer authorization code to a third device;

[0031] generating a third account in the third device according to the transfer instruction;

[0032] Establishing a connection between the third account and the second account according to the second account address;

[0033] The third account sends a second transfer instruction to the second account;

[0034] After verifying the legitimacy of the third account, setting the third account as a pending confirmation account according to the second transfer instruction;

[0035] After the account to be confirmed is confirmed for the second time, the authority of the first account is transferred to the third account.

[0036] Preferably, the first account is set in the first device, and the specific method of transferring the authority of the first account includes:

[0037] Constructing a first transfer instruction with an authorization code and a signature through a wallet program of the first device;

[0038] Sending the authorization code to a second account;

[0039] Generate a QR code according to the first transfer instruction, the authorization code and the third account address;

[0040] The third device obtains the first transfer instruction, the authorization code and the third account address through the QR code;

[0041] According to the first transfer instruction, construct a third account in a trusted execution environment of a third device, wherein the third account is used to generate a public key and / or a private key;

[0042] Sending a second transfer instruction to the second account through the third account, wherein the second transfer instruction includes any one of the following information or a combination thereof: a transfer authorization code, a public key of the third account, and a private key signature of the first account;

[0043] After verifying the legitimacy of the second transfer instruction, setting the third account or its public key as an account to be confirmed;

[0044] After the wallet program of the first device detects the account to be confirmed, it prompts the user to perform a second confirmation;

[0045] After obtaining the user's second confirmation, the third account or its public key is set as a management account, and the authority of the first account is transferred to the third account;

[0046] The wallet program of the first device calls the trusted program to destroy the first account.

[0047] Preferably, the method for verifying the legitimacy of the user before signing or encrypting includes the following verification methods or a combination thereof: Pin code verification, iris recognition, fingerprint recognition and face recognition.

[0048] The present invention also discloses a management system for implementing the above management method, comprising a first account management module, a calling module, a trusted management module, a second account management module and an uplink module.

[0049] The first account management module is used to obtain a first account of the blockchain wallet, and the second account management module is used to obtain a second account;

[0050] The calling module is used to generate a transaction calling instruction;

[0051] The trusted management module is used to sign the calling instruction by using the private key;

[0052] The calling module is also used to send the signed transaction instruction to the second account;

[0053] The on-chain module is used to upload the call instruction to the chain through the second account.

[0054] Preferably, the management system further comprises a transfer module and a user verification module.

[0055] The transfer module is used to transfer the authority of the first account to the third account;

[0056] The user verification module is used to verify the legitimacy of the user before signing or encrypting.

[0057] Compared with the prior art, the beneficial effects of the present invention are: external transactions are conducted through the second account, which can improve the security of account transactions and avoid exposing the first account and blockchain wallet to the outside world; blockchain wallets and related assets are protected; and asset risks caused by malicious acts of digital currency platforms can be effectively avoided or reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 It is a flow chart of the blockchain wallet management method of the present invention;

[0059] Figure 2 is a flow chart of the second account construction method of the present invention;

[0060] Figure 3 It is a flow chart of the method for transferring authority of the present invention;

[0061] Figure 4 It is a logical block diagram of the management system of the present invention. DETAILED DESCRIPTION

[0062] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0063] The present invention is further described in detail below in conjunction with the accompanying drawings:

[0064] A method for managing a blockchain wallet, such as Figure 1 As shown, a method for putting transactions on a chain is included, and the method for putting transactions on a chain includes the following steps:

[0065] Step 101: Obtain a first account and a second account of a blockchain wallet, where the first account is used to generate a public key and / or a private key.

[0066] Step 102: Generate a transaction call instruction.

[0067] Step 103: Sign the calling instruction using the private key.

[0068] Step 104: Send the signed call instruction to the second account.

[0069] Step 105: The calling instruction is uploaded to the chain through the second account.

[0070] Conducting external transactions through the second account can improve the security of account transactions, avoid exposing the first account and blockchain wallet to the outside world, and protect the blockchain wallet and related assets. It can effectively avoid or reduce the asset risks caused by the malicious behavior of the digital currency platform.

[0071] Among them, the first account has absolute control over the second account. The second account, also known as the contract account, can be set up on a third-party platform or third-party device. More specifically, the second account is a smart contract generated on the chain to host user assets. The external calls, payment and asset management of the blockchain wallet are all hosted by the second account. The first account does not directly manage any assets.

[0072] The third-party platform can be centrally operated by the wallet operator, or hosted by a distributed identity system based on blockchain, or other relevant authoritative identity management platforms. The platform generally has identity information registration to generate a unique identity identifier, generate identity credentials, and perform remote identity authentication and authorization management for the first account.

[0073] like Figure 2 , the method of constructing the second account includes:

[0074] Step 201: Generate a construction instruction for a second account.

[0075] Step 202: Sign the build instruction using the private key of the first account.

[0076] Step 203: Send the signed build instruction to a third-party platform or external device.

[0077] Step 204: After the signature is verified, a second account is constructed and uploaded to the chain through the third-party platform or external device, and a subordinate relationship between the first account and the second account is established.

[0078] Wherein, the blockchain wallet, the first account or the second account is deployed in a trusted execution environment (TEE). TEE is a hardware-level trusted security environment. By building an independent security area in the central processing unit, the programs and data loaded inside are protected in terms of confidentiality and integrity. The current mainstream CPUs all support TEE, such as Inter SGX of the X86 instruction set architecture and TrustZone of the ARM instruction set architecture, and Secure Enclave of Apple processors. TEE generally provides the following features: the memory cannot be accessed by the outside of the TEE, including the main operating system; the memory is encrypted, and the secret key is managed by the CPU; different TEE memory areas are isolated and cannot access each other.

[0079] Trusted programs in the TEE environment are usually developed by technical personnel with reference to the standards of specific hardware manufacturers. The program has the following functions: generate public and private keys and save the private key to the TEE environment, and output the public key; use the private key signature to approve transactions; verify the signature based on the input public key; encrypt data based on the input public key; generate a negotiated key based on the input public key (generally used to create point-to-point exclusive channel communications).

[0080] A specific method for constructing a second account includes the following steps:

[0081] Step 211: Send the construction instruction and parameters of the second account to the trusted program of the trusted execution environment.

[0082] Step 212: Verify the identity of the user through the trusted program according to the security verification mechanism.

[0083] Step 213: After verification, the build instruction is signed by calling the private key interface, and the signed build instruction is returned to the wallet program.

[0084] Step 214: The wallet program sends the signed build instruction to a third-party platform or external device.

[0085] Step 215: On the third-party platform or device, a second account is created and uploaded to the chain.

[0086] Step 216: Set the address for receiving the on-chain asset to the address of the second account, thereby establishing a connection between the second account and the on-chain smart contract or on-chain asset.

[0087] The specific methods of putting transactions on the chain include:

[0088] Step 111: Generate a transaction call instruction through the wallet program.

[0089] Among them, the public key and private key of the first account are generated in the TEE environment.

[0090] Step 112: Send the call instruction and its parameters of the second account to the trusted program of the trusted execution environment. The call instruction is generated by the wallet program. The trusted program and the wallet program are prior art and will not be described in detail in the present invention.

[0091] Step 113: According to the security verification mechanism, the identity of the user is verified through the trusted program.

[0092] Step 114: After verification, the calling instruction is signed by calling the private key interface, and the signed building instruction is returned to the wallet program.

[0093] Step 115: Send the signed call instruction to the second account through the wallet program.

[0094] Step 116: The signed call instruction is packaged and uploaded to the chain through the second account.

[0095] Transactions are conducted with the blockchain’s smart contract through the second account without exposing the first account and blockchain wallet to the management platform. This is equivalent to a signature approval process for transactions sent to the chain.

[0096] like Figure 3 The present invention also includes a method for transferring the first account authority:

[0097] Step 301: Construct a transfer instruction through the wallet program.

[0098] Step 302: Send the transfer instruction, the second account address and the transfer authorization code to a third device.

[0099] Step 303: Generate a third account in the third device according to the transfer instruction. The third account is used to generate a public key and a private key in the third device.

[0100] Step 304: Establish a connection between the third account and the second account according to the second account address.

[0101] Step 305: The third account sends a second transfer instruction to the second account.

[0102] Step 306: After verifying the legitimacy of the third account through the second account, the third account is set as a pending account according to the second transfer instruction. The wallet program can obtain the pending account by monitoring the third account.

[0103] Step 307: After the account to be confirmed is reconfirmed, the authority of the first account is transferred to the third account, that is, the third account is modified as the management account of the second account.

[0104] After the transfer, the first account loses control authority; the third account gains control authority over the second account. The first account can be backed up through the third account. When the first account is at risk or lost, the control authority of the third account can be transferred to the third account in a timely manner. By transferring the control authority of the second account, when the wallet program is attacked or the device where the wallet program is installed is lost, the assets can be protected in time and restored safely.

[0105] Among them, the first account or the third account has control over the second account; when the second account generates risks, the second account can be cleared in time, so it will not lead to an increase in the risk of the blockchain wallet.

[0106] In a specific embodiment, the first account is set in the first device, and the specific method for transferring the first account authority to the third device includes:

[0107] Step 311: Construct a first transfer instruction including an authorization code and a signature through a wallet program of the first device.

[0108] Step 312: Send the authorization code to the second account.

[0109] Step 313: Generate a QR code based on the first transfer instruction, the authorization code and the third account address. For example, the first transfer instruction, the on-chain contract account address and the transfer authorization code are arranged into a text in a certain format and signed. The signature value connects the above three field values ​​and is packaged into a JSON format text, and a QR code is generated and presented based on the text content.

[0110] Step 314: The third device obtains the first transfer instruction, the authorization code and the third account address by scanning the QR code. After scanning the code, the text is parsed to obtain the corresponding content.

[0111] Step 315: According to the first transfer instruction, a third account is established in the trusted execution environment of the third device, and the third account is used to generate a public key and / or a private key.

[0112] Step 316: Send a second transfer instruction to the second account through the third account, where the second transfer instruction includes any one of the following information or a combination thereof: a transfer authorization code, a contract address, a public key of the third account, and a private key signature of the first account.

[0113] Step 317: After verifying the legitimacy of the second transfer instruction, the third account or its public key is set as a to-be-confirmed account through the second account. For example, the transfer authorization code and the private key signature of the first account are verified.

[0114] Step 318: After the wallet program detects the account to be confirmed, it prompts the user to perform a second confirmation.

[0115] The account to be confirmed can be detected through the wallet program of the first device. In the case that the first device is lost or damaged, a second confirmation can be performed through the wallet program of the third device when the legitimacy of the user is verified. In the second confirmation, the private key of the first account can be used for signing, and the legitimacy of the user's identity can be verified before signing.

[0116] Step 319: After obtaining the user's second confirmation, the third account or its public key is set as a management account, and the authority of the first account is transferred to the third account.

[0117] Step 320: The wallet program of the first device calls the trusted program to destroy the first account.

[0118] Methods for verifying the legitimacy of the user before signing or encrypting include the following verification methods or their combination: Pin code verification, iris recognition, fingerprint recognition and face recognition.

[0119] In the present invention, the generation of the first account, the signing of the transaction and the encryption of data are all completed by the trusted program of the TEE environment. The hardware-level security isolation ensures that unless the hardware chip design has a vulnerability and is attacked, no program can read and decrypt the data in the TEE memory.

[0120] Transaction signature data encryption requires verification of whether the device holder is the real person. The verification method can be PIN code verification, iris recognition, fingerprint recognition, or face recognition. Even if the device is lost, the assets will not be lost without the user's password or user feature data. It also prevents potential risks caused by malicious actions by wallet manufacturers.

[0121] By transferring control rights instead of private keys, the export of private keys can be avoided, and the risk of being monitored and leaked during the transfer of private keys can be avoided. The transfer of control rights has a higher security verification process, which improves the security of the transfer of control rights. If traditional private key wallets transfer assets without transferring private keys, each asset needs to be transferred to a new account address, which is cumbersome and greatly increases the handling fee. The transfer of the second account control right not only improves convenience, but also improves economy.

[0122] On-chain assets are managed by the second account, rather than the first account and blockchain wallet, which allows for flexible expansion of more functions and more security verification logic.

[0123] The present invention also provides a management system for implementing the above management method, such as Figure 4 As shown, it includes a first account management module 1, a calling module 2, a trusted management module 3, a second account management module 4 and an on-chain module 5.

[0124] The first account management module 1 is used to obtain the first account of the blockchain wallet, and the second account management module 4 is used to obtain the second account; the calling module 2 is used to generate a transaction calling instruction; the trusted management module 3 is used to sign the calling instruction with the private key; the calling module 2 is also used to send the signed calling instruction to the second account; the chain module 5 is used to chain the calling instruction through the second account.

[0125] The management system of the present invention further comprises a transfer module 6 and a user verification module 7, wherein the transfer module 6 is used to transfer the authority of the first account to the third account; and the user verification module 7 is used to verify the legitimacy of the user before signing or encrypting.

[0126] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for managing a blockchain wallet, characterized in that: A method for putting transactions on a blockchain includes the following steps: Obtain a first account and a second account of a blockchain wallet, wherein the first account is used to generate a public key and a private key and is used to control the second account, and the second account is used to host user assets; Generate transaction call instructions; Signing the calling instruction by using the private key; Send the signed call instruction to the second account; Putting the call instruction on the chain through the second account; It also includes the method of transferring the permissions of the first account: Construct transfer instructions through the wallet program; sending the transfer instruction, the second account address and the transfer authorization code to a third device; generating a third account in the third device according to the transfer instruction; Establishing a connection between the third account and the second account according to the second account address; The third account sends a second transfer instruction to the second account; After verifying the legitimacy of the third account, setting the third account as a pending confirmation account according to the second transfer instruction; After the account to be confirmed is reconfirmed, the authority of the first account is transferred to the third account; the method for constructing the second account: Generate construction instructions for the second account; Signing the build instruction using the private key of the first account; Send the signed build instructions to a third-party platform or external device; After the signature is verified, a second account is constructed and uploaded to the chain through the third-party platform or external device; Wherein, the blockchain wallet, the first account or the second account is deployed in a trusted execution environment; When constructing the second account, the third-party platform or external device generates a unique identity identifier, generates identity credentials, and performs remote identity authentication and authorization management on the first account; The specific methods of putting transactions on the chain include: Generate call instructions through the wallet program; Sending the calling instruction and parameters of the second account to the trusted program of the trusted execution environment; According to the security verification mechanism, the identity of the user is verified through the trusted program; After verification, the calling instruction is signed by calling the private key interface, and the signed building instruction is returned to the wallet program; Sending the signed call instruction to the second account through the wallet program; The signed call instructions are packaged and uploaded to the chain through the second account.

2. The management method according to claim 1, characterized in that: The specific construction method of the second account includes: Sending the construction instruction and parameters of the second account to the trusted program of the trusted execution environment; Verifying the identity of the user through the trusted program according to a security verification mechanism; After verification, the build instruction is signed by calling the private key interface, and the signed build instruction is returned to the wallet program; The wallet program sends the signed build instruction to a third-party platform or external device; According to the construction instruction, a second account is constructed in the third-party platform or external device and uploaded to the chain; Set the address that receives the on-chain assets to the address of the second account.

3. The management method according to claim 1, characterized in that: The first account is set in the first device, and the specific method of transferring the authority of the first account includes: Constructing a first transfer instruction with an authorization code and a signature through a wallet program of the first device; Sending the authorization code to a second account; Generate a QR code according to the first transfer instruction, the authorization code and the third account address; The third device obtains the first transfer instruction, the authorization code and the third account address through the QR code; According to the first transfer instruction, construct a third account in a trusted execution environment of a third device, wherein the third account is used to generate a public key and a private key; Sending a second transfer instruction to the second account through the third account, wherein the second transfer instruction includes: a transfer authorization code, a public key of the third account and / or a private key signature of the first account; After verifying the legitimacy of the second transfer instruction, setting the third account as an account to be confirmed; After the wallet program of the first device detects the account to be confirmed, it prompts the user to perform a second confirmation; After obtaining the user's second confirmation, the third account is set as a management account, and the authority of the first account is transferred to the third account; The first account is destroyed by calling a trusted program through the wallet program of the first device.

4. The management method according to claim 1, characterized in that: Methods for verifying the legitimacy of the user before signing or encrypting include the following verification methods: Pin code verification, iris recognition, fingerprint recognition and / or face recognition.

5. A blockchain wallet management system, characterized in that: Used to implement the management method according to any one of claims 1 to 4, the management system comprises a first account management module, a calling module, a trusted management module, a second account management module and an uplink module, The first account management module is used to obtain a first account of the blockchain wallet, and the second account management module is used to obtain a second account; The calling module is used to generate a transaction calling instruction; The trusted management module is used to sign the calling instruction by using the private key; The calling module is also used to send the signed calling instruction to the second account; The on-chain module is used to upload the call instruction to the chain through the second account; It also includes a transfer module and a user verification module. The transfer module is used to transfer the authority of the first account to the third account; The user verification module is used to verify the legitimacy of the user before signing or encrypting.

Images