Fragmentation key-based signature verification method, device and equipment and storage medium

Abstract

The application provides a signature verification method and device based on fragmented keys, equipment and storage medium, relating to the technical field of block chain. The method obtains the node characteristics of the target network node and the target transaction, determines a plurality of calling network nodes according to the node characteristics, and respectively processes the plurality of calling network nodes according to the node characteristics to obtain a plurality of first key fragments. The plurality of first key fragments are synthesized to obtain a first key required by the target network node, and the target transaction is verified according to the first key to complete the verification of the digital signature of the target transaction. The method optimizes the verification process of the digital signature, improves the stability and flexibility of the block, realizes the random storage of the key fragments, improves the security of the key, reduces the probability of key leakage, strengthens the security of the block chain data storage, and improves the user experience.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of blockchains, and in particular to a signature verification method and device based on fragmented keys, an equipment and a storage medium. BACKGROUND

[0002] Blockchain technology, also known as "distributed ledger" technology, is considered to be the latest way to ensure the security of data storage and movement - it does not store data in a centralized place, but "divides the whole into parts" and stores it in thousands of nodes on the global Internet, and at the same time uses a powerful encryption technology to lock these data together, so as to ensure the integrity and security of the data; wherein, the blockchain network is mainly composed of a series of peer nodes, and the peer node is the basis of the entire network, and each peer node has its own private key.

[0003] The security and credibility of the blockchain are one of its core features, and the private key, as a key factor in verifying and signing transactions, also plays a crucial role in the security and credibility of the blockchain. Therefore, in order to ensure the security of the private key, many cryptography algorithms and security mechanisms are involved in the blockchain technology; at the same time, the blockchain technology is also in continuous development and improvement, such as introducing more secure and efficient cryptography algorithms, optimizing privacy protection mechanisms, etc., to cope with increasingly complex security threats and attacks.

[0004] However, in many existing blockchain systems, the private key is usually stored in a single node or a specific hardware device; if the node or device fails, is attacked, or the private key is illegally obtained, the private key will be exposed, and the private key cannot be prevented from being tampered with or misused; once the private key is leaked, the loss that has occurred cannot be revoked; due to the decentralized nature of the blockchain, transactions cannot be reversed, so once the private key is misused, the asset loss cannot be recovered. SUMMARY

[0005] The present application provides a signature verification method and device based on fragmented keys, an equipment and a storage medium, to solve the technical problem that there is still a possibility of private key leakage in the prior art, and private key leakage may lead to asset loss and tampering of transactions.

[0006] In a first aspect, the present application provides a signature verification method based on fragmented keys, comprising:

[0007] Obtaining the node characteristics of the target network node and the target transaction;

[0008] According to the node characteristics, a plurality of calling network nodes are determined, and the plurality of calling network nodes are respectively processed according to the node characteristics to obtain a plurality of first key fragments;

[0009] generating a first key required by the target network node according to the plurality of first key fragments, the first key being used to indicate a complete key generated after a synthesis process of the plurality of first key fragments;

[0010] performing signature verification on the target transaction according to the first key.

[0011] Optionally, the determining the plurality of calling network nodes according to the node features and performing calling processing on the plurality of calling network nodes according to the node features to obtain the plurality of first key fragments comprises:

[0012] determining a target block in which the target network node is located according to the node features;

[0013] determining a key identifier required by the target network node according to the target block;

[0014] determining the plurality of calling network nodes according to the key identifier and performing calling processing on the plurality of calling network nodes according to the key identifier to obtain the plurality of first key fragments.

[0015] Optionally, the performing calling processing on the calling network nodes according to the key identifier to obtain the plurality of first key fragments comprises:

[0016] generating calling information of the target network node according to the key identifier, the calling information being used to call the first key fragments stored in different network nodes;

[0017] sending calling requests to the plurality of calling network nodes according to the calling information respectively;

[0018] obtaining response information sent by the plurality of calling network nodes respectively;

[0019] performing analysis processing on the plurality of response information to obtain the plurality of first key fragments.

[0020] Optionally, the method further comprises:

[0021] obtaining a second key of the target block and a target consortium chain to which the target block belongs, the second key being used to indicate a block key stored by the target block without fragmentation, and the target consortium chain comprising a plurality of blocks;

[0022] performing fragmentation processing on the second key to obtain a plurality of second key fragments;

[0023] determining a plurality of backup network nodes according to the target consortium chain, the backup network nodes being used to store the fragments of the second key;

[0024] randomly allocate the plurality of second key fragments to different backup network nodes.

[0025] Optionally, the fragmenting the second key to obtain the plurality of second key fragments comprises:

[0026] fragmenting the second key to obtain a plurality of key fragments;

[0027] generating the key identifier of the second key according to the target block;

[0028] respectively marking the plurality of key fragments according to the key identifiers to obtain the plurality of second key fragments.

[0029] Optionally, the method further comprises:

[0030] obtaining an environment parameter of the target network node and a preset security condition, the environment parameter being used to indicate running data information of a target block environment where the target network node is located;

[0031] determining a target security indicator of the target block according to the environment parameter and the preset security condition, the security indicator being used to indicate whether an environment of the target block where the target network node is located is safe;

[0032] determining a target generation mode of the first key according to the target security indicator, the generation mode being used to control a generation frequency of the first key.

[0033] Optionally, the security indicator comprises a first security indicator and a second security indicator, and the determining the target security indicator of the target block according to the environment parameter and the preset security condition comprises:

[0034] determining whether the environment parameter satisfies a preset security condition;

[0035] if the environment parameter satisfies the preset security condition, determining the first security indicator as the target security indicator, the first security indicator being used to indicate that an alliance chain environment where the target network node is located is safe;

[0036] if the environment parameter does not satisfy the preset security condition, determining the second security indicator as the target security indicator, the second security indicator being used to indicate that the alliance chain environment where the target network node is located is not safe.

[0037] Optionally, the generation mode comprises a first generation mode and a second generation mode, and the method further comprises:

[0038] If the target generation mode is the first generation mode, verification information of the target transaction is generated, the verification information being used to indicate that the target block is safe in terms of the running environment, wherein the first generation mode is associated with the first security index;

[0039] According to the verification information and the target transaction, a to-be-processed transaction of the target network node is generated, the to-be-processed transaction being used to indicate a transaction flowing in the target consortium chain;

[0040] If the target generation mode is the second generation mode, the first key is deleted.

[0041] In a second aspect, the present application provides a key fragmentation-based signature verification device, comprising:

[0042] An acquisition module is configured to acquire a node feature of a target network node and a target transaction.

[0043] A determination module is configured to determine a plurality of calling network nodes according to the node feature.

[0044] A processing module is configured to perform calling processing on the plurality of calling network nodes respectively according to the node feature, to obtain a plurality of first key fragments.

[0045] A generation module is configured to generate a first key required by the target network node according to the plurality of first key fragments, the first key being used to indicate a complete key generated after the plurality of first key fragments are subjected to synthesis processing.

[0046] The processing module is further configured to perform signature verification processing on the target transaction according to the first key.

[0047] Optionally, the determination module is further configured to determine a target block in which the target network node is located according to the node feature.

[0048] The determination module is further configured to determine a key identifier required by the target network node according to the target block.

[0049] The determination module is further configured to determine the plurality of calling network nodes according to the key identifier, and perform calling processing on the plurality of calling network nodes respectively according to the key identifier, to obtain a plurality of first key fragments.

[0050] Optionally, the generation module is further configured to generate calling information of the target network node according to the key identifier, the calling information being used to call the first key fragments stored in different network nodes.

[0051] The key fragmentation-based signature verification device further comprises a sending module.

[0052] The sending module is used to send call requests to the plurality of calling network nodes respectively according to the call information.

[0053] The acquisition module is also used to acquire the response information sent by the plurality of calling network nodes respectively.

[0054] The processing module is also used to analyze and process multiple response messages to obtain the multiple first key fragments.

[0055] Optionally, the acquisition module is further configured to acquire the second key of the target block and the target consortium chain to which the target block belongs, wherein the second key is used to indicate the block key stored in the unfragmented target block, and the target consortium chain includes multiple blocks.

[0056] The processing module is also used to fragment the second key to obtain multiple second key fragments.

[0057] The determining module is further configured to determine multiple backup network nodes based on the target consortium blockchain, wherein the backup network nodes are used to store fragments of the second key.

[0058] The processing module is also used to randomly distribute the plurality of second key fragments to different backup network nodes.

[0059] Optionally, the processing module is further configured to fragment the second key to obtain multiple key fragments.

[0060] The generation module is further configured to generate the key identifier of the second key based on the target block.

[0061] The processing module is further configured to mark the plurality of key fragments according to the key identifier to obtain the plurality of second key fragments.

[0062] Optionally, the acquisition module is further configured to acquire the environmental parameters and preset security conditions of the target network node, wherein the environmental parameters are used to indicate the operating data information of the target block environment in which the target network node is located.

[0063] The determining module is further configured to determine the target security index of the target block based on the environmental parameters and the preset security conditions. The security index is used to determine whether the environment of the target block where the target network node is located is secure.

[0064] The determining module is further configured to determine the target generation mode of the first key based on the target security index, wherein the generation mode is used to control the generation frequency of the first key.

[0065] Optionally, the signature verification device based on the fragmentation key further comprises a judging module.

[0066] The judging module is configured to judge whether the environment parameter meets a preset security condition.

[0067] If the environment parameter meets the preset security condition, the determining module is further configured to determine the first security indicator as the target security indicator, the first security indicator being used to indicate that the consortium chain environment where the target network node is located is safe.

[0068] If the environment parameter does not meet the preset security condition, the determining module is further configured to determine the second security indicator as the target security indicator, the second security indicator being used to indicate that the consortium chain environment where the target network node is located is unsafe.

[0069] Optionally, if the target generation mode is the first generation mode, the generation module is further configured to generate verification information of the target transaction, the verification information being used to indicate that the running environment of the target block is safe, wherein the first generation mode is associated with the first security indicator.

[0070] The generation module is further configured to generate a to-be-processed transaction of the target network node according to the verification information and the target transaction, the to-be-processed transaction being used to indicate a transaction flowing in the target consortium chain.

[0071] If the target generation mode is the second generation mode, the processing module is further configured to perform deletion processing on the first key.

[0072] In a third aspect, a signature verification device based on a fragmentation key is provided, comprising:

[0073] a memory;

[0074] a processor;

[0075] The memory stores computer execution instructions.

[0076] The processor executes the computer execution instructions stored in the memory to implement the signature verification method based on the fragmentation key as described in the first aspect and various possible implementation manners of the first aspect.

[0077] In a fourth aspect, a computer storage medium is provided, which stores computer execution instructions, the computer execution instructions being executed by a processor to implement the signature verification method based on the fragmentation key as described in the first aspect and various possible implementation manners of the first aspect.

[0078] In a fifth aspect, the present application provides a computer program product comprising a computer program which, when executed by a processor, implements the method described above.

[0079] The signature verification method based on fragmented keys provided by the present application comprises the following steps: obtaining a node feature of a target network node and a target transaction, determining a target block where the target network node is located according to the node feature, and then determining a key identifier required by the target network node, determining a plurality of calling network nodes according to the key identifier, and calling and processing the plurality of calling network nodes according to the key identifier to obtain a plurality of first key fragments; obtaining an environment parameter of the target network node and a preset security condition, determining a target security indicator of the target alliance chain according to the environment parameter and the preset security condition, and determining a target generation mode of the first key according to the target security indicator; generating the first key required by the target network node according to the plurality of first key fragments, and performing signature verification processing on the target transaction according to the first key; after the signature verification processing is completed, if the target generation mode is a first generation mode, generating verification information of the target transaction, and generating a to-be-processed transaction of the target network node according to the verification information and the target transaction; if the target generation mode is a second generation mode, performing deletion processing on the first key. The method optimizes the verification process of the digital signature, improves the stability and flexibility of the block, realizes the random storage of the key fragments, improves the security of the key, reduces the probability of key leakage, strengthens the security of the blockchain data storage, and improves the user experience. BRIEF DESCRIPTION OF DRAWINGS

[0080] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0081] Figure 1 A scene diagram of the signature verification method based on fragmented keys provided by the present application;

[0082] Figure 2 A flowchart of the signature verification method based on fragmented keys provided by the present application Figure 1 ;

[0083] Figure 3 A flowchart of the signature verification method based on fragmented keys provided by the present application Figure 2 ;

[0084] Figure 4 A structure diagram of the signature verification device based on fragmented keys provided by the present application;

[0085] Figure 5 A structure diagram of the signature verification device based on fragmented keys provided by the present application.

[0086] The specific embodiments of the application have been shown by way of example in the above figures, and will be described in more detail below. These figures and this written description are not intended to limit the scope of the inventive concept in any way, but rather to illustrate the inventive concept to one of ordinary skill in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0087] The exemplary embodiments will be described in detail herein with reference to the attached drawings. The description of the exemplary embodiments is intended to apply to any embodiment of the application, unless specified otherwise. Accordingly, when the same, similar or like components are functionally equivalent in the different drawings, they are designated by the same reference numerals.

[0088] The terms "first", "second", "third", "fourth", and the like used in the description and the claims of the application and the above drawings, if any, are used to distinguish similar objects, and are not necessarily used to describe a particular sequential or chronological order. It should be understood that the data thus used can be interchanged, where appropriate, so that the embodiments of the application described herein can be carried out in sequences other than those illustrated or described herein.

[0089] In the embodiments of the present application, the words "exemplary" or "for example" are used to mean example, illustration, or instance, and do not necessarily have to imply a superiority or superiority over other embodiments or designs. In fact, the use of these words is intended to present concepts in a particular manner.

[0090] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the country and region, necessary security measures are taken, do not violate public order and good customs, and provide corresponding operation portal for user to choose authorization or refusal.

[0091] It should be noted that the signature verification method and device based on fragmentation key, electronic equipment, storage medium and program product provided by the present application can be used in the field of blockchain technology, and can also be used in any field other than blockchain. The application field of the signature verification method and device based on fragmentation key of the present application is not limited.

[0092] First, the terms involved in the present application are explained.

[0093] Blockchain: Also known as blockchain or block chain, it is a block chain storage, tamper-proof, secure and trusted decentralized distributed ledger, which combines distributed storage, peer-to-peer transmission, consensus mechanism, cryptography and other technologies, through the growing data block chain (Blocks) to record transactions and information, to ensure the security and transparency of data. The characteristics of blockchain include decentralization, tamper-proof, transparent, secure and programmable; each data block is linked to the previous block, forming a continuous chain, ensuring the integrity of the transaction history, and smart contract technology makes blockchain programmable, supporting more extensive applications. Blockchain is widely used in finance, supply chain, healthcare, real estate and other fields. Although it still faces challenges in scalability and regulation, it has become a powerful tool to change traditional business and social models, and has great potential for the future.

[0094] Consortium chain: refers to the consensus process of the blockchain controlled by pre-selected nodes. It is mainly used in B2B scenarios such as inter-institutional transactions, accounting or clearing. For example, the system for inter-bank accounting and clearing can adopt the form of consortium chain, with the corresponding gateway nodes of the bank as the accounting nodes.

[0095] Peer node: also known as network node, is a participant in the blockchain system; each Peer node needs to save a complete copy of the blockchain and can participate in transaction verification and consensus process; the main functions of Peer node include: transaction verification, blockchain storage and consensus process. The role of Peer node in the blockchain system is mainly to participate in transaction verification and consensus process to ensure the credibility and consistency of transactions, and each Peer node is an independent individual, which together forms a decentralized network, ensuring the security and reliability of the blockchain system.

[0096] Digital signature: also known as public key digital signature, is a digital string that only the sender of the information can produce and no one else can imitate, which is also a valid proof of the authenticity of the information sent by the sender of the information (ensuring the non-repudiation of the blockchain).

[0097] Group: In the blockchain, a group refers to an entity composed of a group of nodes that maintain and manage the blockchain network through a specific consensus algorithm. A group can contain multiple nodes, which can be members of the same organization or different organizations. Nodes within a group communicate and collaborate with each other to complete tasks such as transaction verification and block generation.

[0098] Transaction: In blockchain, the essence of a transaction is a data exchange or asset transfer conducted through the network; each transaction is a process of information transmission that contains data exchange and value transfer between the sender and the receiver; these transaction information is recorded on the blockchain and is encrypted and verified to ensure its security and tamper resistance. The essence of a transaction is to realize the transfer and exchange of value, and blockchain technology provides a decentralized, secure, and transparent way to record and verify these transactions, thereby establishing trust and transferring value.

[0099] Blockchain technology, also known as "distributed ledger" technology, is considered the latest way to ensure the security of data storage and movement - it does not store data in a centralized place, but "divides" it into thousands of nodes on the global Internet, and at the same time uses a powerful encryption technology to lock these data together, thereby ensuring the integrity and security of the data; the blockchain network is mainly composed of a series of peer nodes, and the peer node is the foundation of the entire network, and each peer node has its own private key.

[0100] The security and credibility of blockchain are one of its core features, and the private key, as a key factor in verifying and signing transactions, also plays a crucial role in the security and credibility of the blockchain. Therefore, in order to ensure the security of the private key, many cryptographic algorithms and security mechanisms are involved in the blockchain technology, such as asymmetric encryption algorithms, hash functions, digital signatures, multi-signatures, etc. At the same time, blockchain technology is constantly developing and improving, such as introducing more secure and efficient cryptographic algorithms, optimizing privacy protection mechanisms, etc., to cope with increasingly complex security threats and attacks.

[0101] In the blockchain, the peer node private key is usually used to verify and sign transactions to ensure the security and reliability of transactions. Existing technologies include: (1) Asymmetric encryption algorithm: peer node private keys are usually generated using asymmetric encryption algorithms such as RSA, ECDSA, etc. These algorithms generate a pair of public and private keys to achieve encryption and decryption, where the public key can be publicly shared, while the private key must be kept secret; (2) Elliptic Curve Cryptography (ECC): ECC is a widely used asymmetric encryption algorithm in recent years, which is more lightweight and secure than traditional RSA algorithms. ECC achieves encryption and decryption through point operations on elliptic curves, thus having higher computational efficiency and shorter key length; (3) Multi-Signature (Multi-Signature): Multi-Signature technology allows multiple peer node private keys to jointly verify and sign transactions, thereby improving the security and reliability of transactions. For example, in the network, at least three peer node private keys are required to jointly sign a transaction.

[0102] However, in the prior art, the private key of most blockchain systems is usually stored in a single node or a specific hardware device; if the node or device fails, is attacked, or the private key is illegally obtained, the private key will be exposed, and it is impossible to prevent the private key from being tampered with or misused; once the private key is leaked, the loss that has occurred cannot be revoked; due to the decentralized nature of the blockchain, transactions cannot be reversed, so once the private key is misused, the asset loss will not be recovered; that is, there is still a possibility of private key leakage in the prior art, and private key leakage is a serious security problem in the blockchain, which can cause asset loss and tampering of transactions.

[0103] The signing verification method based on the fragmentation key provided by the present application aims to solve the above technical problems of the prior art.

[0104] Secondly, the implementation scenarios involved in the present application are described.

[0105] In the blockchain, organizations and alliances refer to different entities or organizations participating in the blockchain network, and an organization can be a single entity or a group composed of multiple entities, while an alliance is a blockchain network jointly participated by multiple organizations; these organizations and alliances jointly maintain and manage the operation of the blockchain in the blockchain network, the flow of transactions in the blockchain and the verification of the corresponding digital signature are controlled by the consensus mechanism, and the nodes in the blockchain network can verify the digital signature of the transaction to ensure the authenticity and integrity of the transaction, thereby maintaining the security and credibility of the entire blockchain system.

[0106] Figure 1 is a scene diagram of the signing verification method based on the fragmentation key provided by the present application. As Figure 1As shown, the consortium chain 101 includes: an organization 1011 and an organization 1012, and the organization 1011 includes: a peer node 1021 and a peer node 1022; the organization 1012 includes: a peer node 1031 and a peer node 1032, and the peer node 1021, the peer node 1022, the peer node 1031 and the peer node 1032 are in communication connection, and the different peer nodes can transmit data and the transaction flow in the current consortium chain 101, each peer node can verify the digital signature of the transaction when receiving the corresponding transaction, and different peer nodes store different key fragments; in the process of digital signature verification, the corresponding peer node can send a key fragment calling request to other peer nodes to obtain the key fragment required at this time and synthesize the corresponding complete key, so as to complete the verification of the digital signature of the transaction. The plurality of peer nodes may, for example, be servers used by a plurality of different users, and the organization 1011 and the organization 1012 may, for example, be network structures formed by a plurality of servers, and the consortium chain 101 may, for example, be a financial blockchain network formed by a plurality of servers, and the plurality of servers belong to different network structures. The type of peer node is not specially limited in the present application.

[0107] The present application provides a key fragmentation-based signature verification method, which sets different private keys for different organizations in the same consortium, fragments the keys in the same organization, and marks the corresponding key fragments according to different organization identifiers; obtains all peer nodes of the consortium, and randomly stores the obtained plurality of key fragments in the peer nodes, and the storage range is all peer nodes of the consortium; when verifying the digital signature in any peer node, determining the organization identifier corresponding to the peer node, calling a plurality of key fragments according to the organization identifier, and synthesizing the key corresponding to the peer node based on the plurality of key fragments, and verifying the digital signature using the key. The method optimizes the verification process of the digital signature, improves the stability and flexibility of the block, realizes the random storage of the key fragments, improves the security of the key, reduces the probability of key leakage, strengthens the security of the blockchain data storage, and improves the user experience.

[0108] The technical solutions of the present application and how the technical solutions of the present application solve the above technical problems will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of the present application will be described below with reference to the drawings.

[0109] Figure 2A flowchart of a signature verification method based on a fragmented key provided by an embodiment of the present application Figure 1 The execution subject of the embodiment can be, for example, a control system of a peer node arranged in a financial consortium chain. As shown in Figure 2 The signature verification method based on a fragmented key provided by the embodiment includes the following steps.

[0110] S201: Obtain a node feature of a target network node and a target transaction.

[0111] The node feature is used to identify and distinguish the identity of different network nodes, and the target transaction is used to indicate a transaction operation that needs to be verified and recorded and flows to the target network node.

[0112] It can be understood that the execution subject of this step is the control system of the target network node, which can obtain the running data of the current network node and the corresponding data information in real time. There are multiple blocks in the same consortium chain, and different blocks are composed of multiple network nodes, that is, the consortium chain is composed of multiple network nodes. In order to enable effective communication and transaction between different network nodes, any network node has a corresponding identity, which can be, for example, a node address, a geographic location of the node. In addition, since the network nodes in the blockchain network are usually connected and communicated according to the network topology, the connection relationship and communication path between the nodes can also be used to distinguish different nodes. The node feature is not specially limited in the present application.

[0113] In the process of transaction flow in the consortium chain, different network nodes can transmit and receive transaction information through network communication, and the corresponding network node can determine whether it is a transaction sent to itself according to the target address or other identifier of the transaction. When a transaction is sent to the consortium chain network, the network node will pass it to other network nodes for verification and confirmation until it reaches the target node or reaches a consensus. The transaction flow can be point-to-point or transmitted through multiple nodes to ensure the reliability and security of the transaction. The following embodiments are explained and described in the point-to-point transaction flow, and the transaction flow is not specially limited in the present application.

[0114] The control system of the target network node can obtain the identity of the target network node that is different from other network nodes, and determine the identity as the node feature. It can also obtain the data information flowing in the current node in real time and analyze and process the data information, so as to determine whether there is a transaction operation that needs to be verified and recorded in the current target network node, that is, according to the transaction operation that needs to be verified and recorded in the target network node, the target transaction that needs to be verified and recorded in the current target network node can be obtained.

[0115] For example, the control system of the peer node arranged in the financial alliance chain can extract the identity of the current peer node, and the identity can be node ID: 8f4e9d2b. When the financial alliance chain performs transaction circulation, the control system can also acquire the running data of the target peer node in real time, analyze and process the running data, determine that there is a transaction operation that needs to be verified and recorded in the current running data, that is, there is identity information corresponding to the transaction, so that the target transaction that needs to be verified and recorded by the target peer node at this time can be determined, and the target transaction can be a digital asset transaction.

[0116] S202: According to the node characteristics, a plurality of calling network nodes are determined, and the plurality of calling network nodes are respectively called according to the node characteristics to obtain a plurality of first key fragments.

[0117] Among them, the calling network node is used to indicate a network node that stores a key fragment required for signature verification processing of a target transaction, and the first key fragment is used to indicate a part of the key after random fragmentation processing of the key stored in the block where the target network node is located.

[0118] It can be understood that the public key and the private key are a key pair used in the field of encrypted communication and digital signature, and the blockchain network is mainly composed of a series of network nodes. The network node is the basis of the entire blockchain network, and different network nodes constitute different blocks, and each block has its corresponding private key. When the network node in the corresponding block receives a target transaction, the corresponding private key needs to be called to verify and record the target transaction. In order to ensure the security of the network node data, the key of the corresponding block is randomly fragmented and stored in different network nodes of different blocks. Different network nodes correspond to different blocks, and different blocks have different block identifiers. Before the key fragment is randomly stored, the control system of the corresponding network node acquires the block information of the network node to identify the corresponding key fragment, so as to smoothly call the key fragment and improve the accuracy of the key fragment calling. Therefore, when the key of the corresponding block is called, the network node where the corresponding key fragment is stored can be determined according to the corresponding block information, so that the key required by the target network node can be called.

[0119] According to the node characteristics of the target network node currently acquired, the block currently occupied by the target network node can be determined, and different blocks have different block identifiers. According to the block identifier corresponding to the current block, comparison processing is performed with multiple network nodes in the same alliance chain, so as to determine multiple network nodes corresponding to the block identifier, and the multiple network nodes are determined as multiple calling network nodes respectively. Since the multiple calling network nodes store the first key fragments required by the target network node, the multiple calling network nodes are called according to the block identifier, and multiple first key fragments are acquired therefrom respectively.

[0120] For example, the block corresponding to the target peer node can be a financial block A, and the financial block A belongs to a financial alliance chain, which includes: the financial block A, the financial block B, and the financial block C. The financial block A includes: the target peer node and the peer node 1, the financial block B includes: the peer node 2 and the peer node 3, and the financial block C includes: the peer node 4 and the peer node 5. According to the node ID of the target peer node, the network structure in the current financial alliance chain is filtered, so that the block currently occupied by the node is determined as the financial block A. The block identifier of the financial block A can be an identifier 7b9e4c6d. The network structure in the current financial alliance chain is filtered again by using the identifier, so that multiple peer nodes with the same block identifier are determined: the target peer node, the peer node 1, the peer node 2, and the peer node 4, which are calling network nodes. The key fragments stored in the target peer node, the peer node 1, the peer node 2, and the peer node 4 are called according to the identifier, so as to obtain multiple key fragments corresponding to the block where the target peer node is located.

[0121] S203: generating a first key required by the target network node according to the multiple first key fragments.

[0122] The first key is used to indicate a complete key generated after the synthesis processing of the multiple first key fragments.

[0123] It can be understood that, in order to ensure the security of the network node data, the key corresponding to the block is randomly fragmented and stored in different network nodes of different blocks. The multiple first key fragments of the same key are respectively identified with corresponding fragmentation orders, that is, the order of the corresponding key fragments can be determined based on the fragmentation order, so as to assist the generation of the first key.

[0124] The plurality of first key fragments currently obtained are respectively analyzed and processed to determine the fragmentation order of each first key fragment, and the plurality of first key fragments are synthesized according to the fragmentation order to obtain a complete key, that is, the first key.

[0125] For example, the key fragments currently obtained are target peer node: 5e, peer node 1: f, peer node 2: 3c8, and peer node 4: 9b, and the corresponding fragmentation orders are 2, 4, 3, and 1, respectively. The first key obtained by synthesizing the plurality of key fragments according to the currently determined fragmentation order is 9b5e3c8f. The character length of the first key is not specially limited in the present application.

[0126] S204: The target transaction is verified according to the first key.

[0127] It can be understood that in the field of encryption, verification generally refers to the process of verifying a digital signature using a key. Specifically, by obtaining the digital signature of the target transaction and the transaction key, and using the transaction key to decrypt the digital signature, an initial hash value is obtained. The data of the target transaction is hashed using the first key of the target network node to generate a hash value. The initial hash value obtained this time is compared with the hash value obtained using the first key. If the two hash values are the same, the verification is passed, indicating that the target transaction data has not been tampered with, thereby ensuring the integrity and authenticity of the transaction.

[0128] The target transaction currently obtained is analyzed and processed to obtain the corresponding digital signature and the transaction key carried by the target transaction. The target transaction is hashed using the transaction key and the first key, respectively, to obtain an initial hash value and a target hash value, respectively. The two are compared and processed. If the comparison is consistent, it indicates that the data of the current target transaction has not been tampered with, and the verification of the digital signature of the target transaction is passed at this time. If the comparison is inconsistent, it indicates that the data of the current target transaction has been tampered with, and the verification of the digital signature of the target transaction is not passed at this time.

[0129] Preferably, the method further comprises:

[0130] The second key of the target block and the target consortium chain to which the target block belongs are obtained. The second key is fragmented to obtain a plurality of second key fragments. A plurality of backup network nodes are determined according to the target consortium chain. The plurality of second key fragments are randomly assigned to different backup network nodes.

[0131] The target block is used to indicate the network structure in which the target network node is located, the second key is used to indicate the block key stored by the target block which has not been fragmented, the target consortium chain includes a plurality of blocks, and the backup network node is used to store the fragments of the second key.

[0132] It can be understood that the first key and the second key have a correlation relationship, and the two are essentially the same, and are both complete keys of the corresponding block. According to the execution time of key fragmentation, the complete key before key fragmentation is called the second key, and the complete key synthesized according to the verification requirement of the target transaction after key fragmentation is called the first key. There is a correlation relationship between the standby network node and the calling network node. According to the execution time of key fragmentation, the network node that does not store the key fragment before key fragmentation is called the standby network node, and the network node that stores the first key fragment after key fragmentation is called the calling network node. When the standby network node stores the second key fragment, the second key fragment is the first key fragment in the verification process of the digital signature of the target transaction, and the standby network node can be used as the calling network node. The difference between the two is only the different running time, that is, the second key fragment and the first key fragment and the standby network node and the calling network node are essentially the same, and different running time uses different names.

[0133] After the establishment of the alliance chain of the target network node is completed, the keys stored in different blocks in the alliance chain need to be fragmented, and the execution processes of the multiple blocks are the same. The present embodiment only explains the process of fragmenting the key of the target block corresponding to the target network node.

[0134] The second key stored in the target block and the target alliance chain to which the target block belongs are obtained. The second key is fragmented to obtain multiple key fragments, and the fragmentation order of each key fragment is determined. The multiple key fragments obtained at present are marked according to the fragmentation order to obtain multiple second key fragments. According to the target alliance chain in which the current target network node is located, all network nodes existing in the target alliance chain are determined, and the multiple network nodes are determined as multiple standby network nodes. The multiple second key fragments determined at present are randomly allocated to different standby network nodes.

[0135] For example, the target block can be a financial block A, and the second key stored in the block is 9b5e3c8f. The second key is fragmented, and the order of the corresponding key fragments is determined. The obtained multiple second key fragments can be: 5e, order 2; f, order 4; 3c8, order 3; 9b, order 1. The alliance chain in which the financial block A is located can be a financial alliance chain, and the peer nodes in the financial alliance chain include: a target peer node, a peer node 1, a peer node 2, a peer node 3, a peer node 4, and a peer node 5. The current acquired peer node is randomly combined with the second key fragment, and the obtained result can be: target peer node: 5e, order 2; peer node 1: f, order 4; peer node 2: 3c8, order 3; peer node 4: 9b, order 1. The method for randomizing the allocation of multiple second key fragments is not specially limited in the present application.

[0136] Preferably, the second key is fragmented to obtain multiple second key fragments, including:

[0137] The second key is fragmented to obtain multiple key fragments. According to the target block, a key identifier of the second key is generated. The multiple key fragments are marked respectively according to the key identifier to obtain multiple second key fragments.

[0138] The key identifier is used to indicate the identification information of the target block.

[0139] It can be understood that, in order to determine the accuracy of the key fragment call, the key fragments of the same block can be identified so that the target network node can identify the key fragments required for signature verification.

[0140] For example, the key identifier can be the name, location information or block address of the target block, which can be used to distinguish the key stored in other blocks under the same financial alliance chain. The key identifier is not specially limited in the present application.

[0141] The signature verification method based on fragmented key provided in the embodiment, by acquiring the node characteristics of the target network node and the target transaction, determining multiple calling network nodes according to the node characteristics, and calling the multiple calling network nodes respectively according to the node characteristics to obtain multiple first key fragments; the multiple first key fragments are synthesized to obtain the first key required by the target network node, and the target transaction is verified according to the first key, so as to complete the verification of the digital signature of the target transaction. The method optimizes the verification process of the digital signature, realizes the randomization storage of the key fragments, improves the security of the key, strengthens the security of the blockchain data storage, and improves the user experience.

[0142] Figure 3 A flowchart illustrating the signature verification method based on fragmented keys provided in this application embodiment. Figure 2 .like Figure 3 As shown, in this embodiment... Figure 2 Based on the embodiments, the signature verification method based on fragmented keys is described in detail. The signature verification method based on fragmented keys shown in this embodiment includes:

[0143] S301: Obtain the node characteristics and target transaction of the target network node.

[0144] Step S301 is similar to step S201 above, and will not be repeated here.

[0145] S302: Based on the node characteristics, determine the target block where the target network node is located.

[0146] S303: Determine the key identifier required for the target network node based on the target block.

[0147] S304: Based on the key identifier, determine multiple calling network nodes, and perform calling processing on the multiple calling network nodes according to the key identifier to obtain multiple first key fragments.

[0148] Understandably, different blocks correspond to different key identifiers, and network nodes can determine the block to which the currently stored key fragment belongs through these key identifiers.

[0149] Based on the currently acquired node characteristics, the block where the target network node is currently located can be determined, i.e., the target block. Different blocks have different key identifiers. The currently determined target block is analyzed and processed to obtain the key identifier corresponding to the target block. Based on the key identifier of the target block, it is compared with multiple network nodes in the same consortium chain to determine multiple network nodes corresponding to the key identifier, and these multiple network nodes are respectively determined as multiple calling network nodes. Since the multiple calling network nodes currently determined store the first key fragment required by the target network node, the multiple calling network nodes are called according to the key identifier to obtain multiple first key fragments.

[0150] Preferably, the network node is invoked according to the key identifier to obtain multiple first key fragments, including:

[0151] Based on the key identifier, generate call information for the target network node; issue call requests to multiple call network nodes according to the call information; obtain response information sent by multiple call network nodes; analyze and process the multiple response information to obtain multiple first key fragments.

[0152] The calling information is used to call the first key fragments stored in different network nodes, and the response information is used to indicate feedback information sent by the calling network node.

[0153] It can be understood that the execution subject of this step is the control system of the target network node, which can generate data transmission and interaction with different network nodes in the same alliance; the alliance chain is a kind of blockchain network composed of a group of known and trusted network nodes, and a specific consensus mechanism and permission control are established between these network nodes. Data transmission and interaction can be carried out between multiple network nodes to realize data transmission and sharing between nodes; in addition, data exchange, communication and cooperation can also be carried out between multiple network nodes to achieve common goals or complete specific tasks.

[0154] According to the key identifier of the target block obtained at present, the calling information of the target network node is generated, that is, the target network node sends a key fragment calling request to multiple network nodes in the same alliance, and it is ensured that the key identifier of the key fragment called this time is consistent with the key identifier of the target block; according to the calling information, calling requests are sent to multiple calling network nodes respectively, and response information sent by the multiple calling network nodes is obtained respectively; the multiple response information obtained at present is analyzed and processed respectively to obtain multiple first key fragments.

[0155] S305: Obtain the environment parameter and the preset security condition of the target network node.

[0156] S306: According to the environment parameter and the preset security condition, determine the target security index of the target block.

[0157] Among them, the environment parameter is used to indicate the running data information of the target block environment where the target network node is located, the preset security condition is used to indicate the network environment security and resource environment security of the block where the target network node is located, and the security index is used to indicate whether the environment of the target block where the target network node is located is safe.

[0158] It can be understood that whether the target block running environment is safe determines the situation of the first key reservation and synthesis of the corresponding network node; if the target block running environment is safe, the probability of the first key leakage is greatly reduced; if the target block running environment is not safe, the probability of the first key leakage is increased. Therefore, when the target network node performs digital signature verification, it is necessary to determine whether the current target block running environment is safe, and the determination of the environment safety only controls the generation frequency of the first key. The determination time of the environment safety in this application is not specially limited.

[0159] Obtain running data information of a target block environment where the target network node is located, analyze and process the running data information to obtain parameter information related to the safety of the environment, and determine the parameter information as an environment parameter; obtain a preset safety condition stored in the target block where the target network node is located; compare the environment parameter obtained at present with the preset safety condition through comparison processing, so as to determine a target safety index of the target block.

[0160] Preferably, the preset safety condition includes network environment safety and resource environment safety of the block where the target network node is located, whether the network environment is safe can be determined by judging whether there is an abnormal external request in the current block, and whether the resource environment is safe can be determined by judging whether the memory usage rate of the processor is consistent with the current program running environment; when both the network environment and the resource environment are safe, it indicates that the environment of the current target block is safe.

[0161] Preferably, the safety index includes a first safety index and a second safety index, and the target safety index of the target alliance chain is determined according to the environment parameter and the preset safety condition, including:

[0162] The first safety index is used to indicate that the environment of the target block where the target network node is located is safe, and the second safety index is used to indicate that the environment of the target block where the target network node is located is not safe.

[0163] The purpose of this step of judging whether the environment parameter meets the preset safety condition is to determine whether the running environment of the target alliance chain is safe.

[0164] If the environment parameter meets the preset safety condition, it indicates that there is no abnormal external request in the network environment of the target block, and the memory usage rate of the corresponding processor is consistent with the current program running environment, at this time it can be determined that the network environment and the resource environment of the target block where the target network node is located are safe, and the first safety index is determined as the target safety index.

[0165] If the environment parameter does not meet the preset safety condition, it indicates that there is an abnormal external request in the network environment of the target block, and / or the memory usage rate of the corresponding processor is not consistent with the current program running environment, at this time it can be determined that the network environment of the target block where the target network node is located is not safe and / or the resource environment is not safe, and the second safety index is determined as the target safety index.

[0166] S307: Determine a target generation mode of the first key according to the target safety index.

[0167] The generation mode is used to control the generation frequency of the first key.

[0168] It can be understood that the environment security of the target block affects the generation frequency of the first key. If the target block running environment is safe, it indicates that the probability of leakage of the corresponding first key is greatly reduced, at which time the synthesis frequency of the first key can be reduced. If the target block running environment is not safe, it indicates that the probability of leakage of the first key is increased, at which time the synthesis frequency of the first key can be increased.

[0169] Different key generation frequencies correspond to different generation modes. According to the target security index of the current environment, the generation frequency of the corresponding first key that can be generated by the target network node is determined, and the generation mode corresponding to the generation frequency is determined as the target generation mode.

[0170] For example, if the environment of the financial block A is safe, it indicates that there is no abnormal external request in the network environment of the financial block A, and the memory usage rate of the corresponding processor is consistent with the current program running environment. At this time, the first key corresponding to the financial block A can be generated only once, and is transferred with the flow of digital asset transactions, and the generation mode corresponding to the generation frequency is determined as the target generation mode. If the environment of the financial block A is not safe, it indicates that there is an abnormal external request in the network environment of the financial block A, and / or the memory usage rate of the corresponding processor is inconsistent with the current program running environment. At this time, the target peer node generates the first key corresponding to the financial block A, and each peer node needs to re-generate the corresponding first key with the flow of digital asset transactions, and the generation mode corresponding to the generation frequency is determined as the target generation mode.

[0171] S308: generating the first key required by the target network node according to the plurality of first key fragments.

[0172] S309: performing signature processing on the target transaction according to the first key.

[0173] Steps S308-S309 are similar to steps S203-S204 described above, and will not be described here.

[0174] S310: if the target generation mode is the first generation mode, generating verification information of the target transaction.

[0175] S311: generating a to-be-processed transaction of the target network node according to the verification information and the target transaction.

[0176] S312: if the target generation mode is the second generation mode, performing deletion processing on the first key.

[0177] The verification information is used to prove the reliability of the target transaction, and the to-be-processed transaction is used to indicate the completion of the transaction verification of the target network node and the transaction ready to flow to the next network node.

[0178] It can be understood that the generation mode includes: a first generation mode and a second generation mode, and the generation mode is associated with the security index; the first generation mode corresponds to the target block running environment security, and the second generation mode corresponds to the target block running environment insecurity, that is, when the target security index is the first security index, the target generation mode of the first key is the first generation mode, and when the target security index is the second security index, the target generation mode of the first key is the second generation mode; and the determination time of the generation mode of the first key is: when the target transaction flows to the target network node, and the network node is the initial network node in the corresponding target block, the generation mode of the first key is determined; if the target security index changes during the target transaction flow, the target generation mode corresponding to the first key needs to be determined again.

[0179] If the target generation mode is the first generation mode, it indicates that the target block running environment is safe, and the probability of the first key leakage is greatly reduced. When the target transaction flows in the block corresponding to the first key, the first key can be synthesized only at the initial verification, and the first key is retained after synthesis, and the flow of the first key is controlled according to the flow of the target transaction. At this time, the verification information of the target transaction is generated, and the pending transaction of the target network node is generated according to the verification information and the target transaction, so as to flow to the next network node.

[0180] If the target generation mode is the second generation mode, it indicates that the target block running environment is not safe, and the probability of the first key leakage is increased. When the target transaction flows in the block corresponding to the first key, the corresponding first key is re-synthesized in the verification process of each network node, and the first key is deleted after the verification ends. At this time, the first key generated at present is deleted.

[0181] Optionally, during the flow of the target transaction, it is judged whether the first key has been synthesized in the target block; if it has been synthesized, it indicates that the synthesized first key can be directly called to verify the digital signature of the target transaction; if it has not been synthesized, it indicates that the target transaction is initially flowed to the block where the current network node is located, at this time, the corresponding first key needs to be generated according to the corresponding network node, and the security of the block environment is determined.

[0182] More specifically, under the premise that the first key has been synthesized, the first key is called, if the first key is not obtained, it indicates that the running environment of the target block is not safe when the first key is synthesized and the previously synthesized first key has been deleted, at this time, the corresponding first key can be regenerated; if the corresponding first key is obtained, it indicates that the running environment of the target block is safe when the first key is synthesized, at this time, the previously synthesized first key can be directly called.

[0183] For example, when the running environment of the current financial block A is safe and the first key is controlled to be synthesized only once, the peer nodes required for the flow of the digital asset transaction are obtained, and the peer nodes belonging to the current financial block A are screened out; when the digital signature verification of the target peer node is completed, it is judged whether the peer nodes to which the digital asset transaction has flowed meet the currently screened peer nodes; if yes, it indicates that the peer nodes required for the digital asset transaction to run in the financial block A have been flowed, at this time, the currently generated key is deleted; if not, it indicates that the peer nodes required for the digital asset transaction to run in the financial block A have not been flowed, at this time, the generated key is retained to facilitate the digital signature verification when flowing to the next peer node.

[0184] The key fragmentation-based signature verification method provided in the embodiment comprises the following steps: obtaining a node feature of a target network node and a target transaction; determining a target block in which the target network node is located according to the node feature, and then determining a key identifier required by the target network node; determining a plurality of calling network nodes according to the key identifier, and calling the plurality of calling network nodes respectively according to the key identifier to obtain a plurality of first key fragments; obtaining an environment parameter of the target network node and a preset security condition; determining a target security indicator of a target alliance chain according to the environment parameter and the preset security condition; determining a target generation mode of the first key according to the target security indicator; generating the first key required by the target network node according to the plurality of first key fragments, and performing signature verification processing on the target transaction according to the first key; after the signature verification processing is completed, if the target generation mode is a first generation mode, generating verification information of the target transaction, and generating a to-be-processed transaction of the target network node according to the verification information and the target transaction; if the target generation mode is a second generation mode, deleting the first key. The method optimizes the verification process of the digital signature, improves the stability and flexibility of the block, realizes the random storage of the key fragments, improves the security of the key, reduces the probability of key leakage, strengthens the security of the blockchain data storage, and improves the user experience.

[0185] Figure 4 The structure diagram of the key fragmentation-based signature verification device provided in the present application is shown in the figure. Figure 4As shown, the application provides a signature verification device based on fragmented keys, which includes:

[0186] An acquisition module 401 is configured to acquire a node feature of a target network node and a target transaction.

[0187] A determination module 402 is configured to determine a plurality of calling network nodes according to the node feature.

[0188] A processing module 403 is configured to perform calling processing on the plurality of calling network nodes respectively according to the node feature, to obtain a plurality of first key fragments.

[0189] A generation module 404 is configured to generate a first key required by the target network node according to the plurality of first key fragments, the first key being used to indicate a complete key generated after synthetic processing on the plurality of first key fragments.

[0190] The processing module 403 is further configured to perform signature verification processing on the target transaction according to the first key.

[0191] Optionally, the determination module 402 is further configured to determine a target block where the target network node is located according to the node feature.

[0192] The determination module 402 is further configured to determine a key identifier required by the target network node according to the target block.

[0193] The determination module 402 is further configured to determine the plurality of calling network nodes according to the key identifier, and perform calling processing on the plurality of calling network nodes respectively according to the key identifier, to obtain a plurality of first key fragments.

[0194] Optionally, the generation module 404 is further configured to generate calling information of the target network node according to the key identifier, the calling information being used to call the first key fragments stored in different network nodes.

[0195] The signature verification device based on fragmented keys further includes a sending module 405.

[0196] The sending module 405 is configured to send calling requests to the plurality of calling network nodes respectively according to the calling information.

[0197] The acquisition module 401 is further configured to acquire response information sent by the plurality of calling network nodes respectively.

[0198] The processing module 403 is further configured to perform analysis processing on the plurality of response information, to obtain the plurality of first key fragments.

[0199] Optionally, the obtaining module 401 is further configured to obtain a second key of the target block and a target consortium chain to which the target block belongs, the second key being used to indicate a block key stored by the target block without fragmentation, and the target consortium chain including a plurality of blocks.

[0200] The processing module 403 is further configured to perform fragmentation processing on the second key to obtain a plurality of second key fragments.

[0201] The determining module 402 is further configured to determine a plurality of backup network nodes according to the target consortium chain, the backup network nodes being used to store fragments of the second key.

[0202] The processing module 403 is further configured to randomly assign the plurality of second key fragments to different backup network nodes.

[0203] Optionally, the processing module 403 is further configured to perform fragmentation processing on the second key to obtain a plurality of key fragments.

[0204] The generating module 404 is further configured to generate the key identifier of the second key according to the target block.

[0205] The processing module 403 is further configured to mark the plurality of key fragments respectively according to the key identifiers to obtain the plurality of second key fragments.

[0206] Optionally, the obtaining module 401 is further configured to obtain an environment parameter of the target network node and a preset security condition, the environment parameter being used to indicate running data information of a target block environment in which the target network node is located.

[0207] The determining module 402 is further configured to determine a target security indicator of the target block according to the environment parameter and the preset security condition, the security indicator being used to indicate whether the target block environment in which the target network node is located is safe.

[0208] The determining module 402 is further configured to determine a target generation mode of the first key according to the target security indicator, the generation mode being used to control a generation frequency of the first key.

[0209] Optionally, the signature verification device based on the fragmented key further includes a judging module 406.

[0210] The judging module 406 is configured to judge whether the environment parameter satisfies a preset security condition.

[0211] If the environment parameter meets the preset security condition, the determination module 402 is further configured to determine the first security indicator as the target security indicator, the first security indicator being used to indicate that the target network node is in a safe consortium chain environment.

[0212] If the environment parameter does not meet the preset security condition, the determination module 402 is further configured to determine the second security indicator as the target security indicator, the second security indicator being used to indicate that the target network node is in an unsafe consortium chain environment.

[0213] Optionally, if the target generation mode is the first generation mode, the generation module 404 is further configured to generate verification information of the target transaction, the verification information being used to indicate that the running environment of the target block is safe, wherein the first generation mode is associated with the first security indicator.

[0214] The generation module 404 is further configured to generate a to-be-processed transaction of the target network node according to the verification information and the target transaction, the to-be-processed transaction being used to indicate a transaction flowing in the target consortium chain.

[0215] If the target generation mode is the second generation mode, the processing module 403 is further configured to perform deletion processing on the first key.

[0216] Figure 5 A structure schematic diagram of the signing verification device based on the fragmented key provided in the present application is provided. As shown in Figure 5 The present application provides a signing verification device based on the fragmented key, which comprises a receiver 501, a transmitter 502, a processor 503 and a memory 504.

[0217] The receiver 501 is configured to receive instructions and data.

[0218] The transmitter 502 is configured to transmit instructions and data.

[0219] The memory 504 is configured to store computer execution instructions.

[0220] The processor 503 is configured to execute the computer execution instructions stored in the memory 504 to realize each step performed by the signing verification method based on the fragmented key in the above-mentioned embodiments. For details, please refer to the related description in the foregoing signing verification method based on the fragmented key.

[0221] Optionally, the above-mentioned memory 504 can be independent or integrated with the processor 503.

[0222] When the memory 504 is independently provided, the electronic device further includes a bus for connecting the memory 504 and the processor 503.

[0223] The application further provides a computer readable storage medium, and the computer readable storage medium stores computer execution instructions. When the processor executes the computer execution instructions, the method for verifying based on the fragmented key implemented by the device for verifying based on the fragmented key is realized.

[0224] The application further provides a computer program product, comprising a computer program, which, when executed by a processor, implements the method described above.

[0225] It should be noted that, for the foregoing method embodiments, in order to simply describe, they are all expressed as a series of action combinations, but those skilled in the art should know that the application is not limited to the action order described, because according to the application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the application.

[0226] It should be further noted that, although each step in the flowchart is displayed in sequence according to the arrow indication, these steps are not necessarily executed in sequence according to the arrow indication. Unless explicitly stated in this article, the execution of these steps has no strict order limitation, and these steps can be executed in other orders. Moreover, at least part of the steps in the flowchart can include multiple sub-steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily sequential, but can be executed in rotation or alternation with other steps or sub-steps or stages of other steps.

[0227] It should be understood that the above-mentioned device embodiments are only illustrative, and the device of the application can also be realized by other ways. For example, the division of units / modules in the above-mentioned embodiments is only a logical function division, and another division way can be used in actual implementation. For example, multiple units, modules or components can be combined, or can be integrated into another system, or some features can be ignored or not executed.

[0228] In addition, each functional unit / module in each embodiment of the application can be integrated in one unit / module, or each unit / module can exist physically, or two or more units / modules can be integrated together. The integrated unit / module can be realized in the form of hardware or in the form of software program module.

[0229] If the integrated units / modules are implemented in the form of hardware, the hardware can be a digital circuit, an analog circuit, etc. The physical implementation of the hardware structure includes, but is not limited to, transistors, memristors, etc. Unless otherwise specified, the processor can be any appropriate hardware processor, such as a CPU, a GPU, an FPGA, a DSP, an ASIC, etc. Unless otherwise specified, the storage unit can be any appropriate magnetic storage medium or magneto-optical storage medium, such as resistive random access memory (RRAM), dynamic random access memory (DRAM), static random access memory (SRAM), enhanced dynamic random access memory (EDRAM), high-bandwidth memory (HBM), hybrid memory cube (HMC), etc.

[0230] If the integrated units / modules are implemented in the form of software program modules and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application or the essential part or all or part of the technical solutions that make contributions to the prior art can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the embodiments of the present application. The aforementioned storage medium includes a U disk, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store program codes.

[0231] In the above embodiments, the description of each embodiment has its own focus, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments. The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described, however, as long as the combinations of the technical features do not exist contradictions, they should be considered as the scope of the present application

[0232] Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the specification and examples be considered as exemplary only, with the true scope and spirit of the application being indicated by the following claims.

[0233] It is to be understood that the application is not limited to the precise construction herein disclosed and shown in the drawings, and that various modifications and changes can be made by those skilled in the art without departing from the scope of the application. The scope of the application is limited only by the claims that follow.

Claims

1. A signature verification method based on fragmented keys, characterized in that, The method includes: Obtain the node characteristics and target transactions of the target network nodes; Based on the node characteristics, multiple calling network nodes are determined, and the multiple calling network nodes are called according to the node characteristics respectively to obtain multiple first key fragments; Based on the plurality of first key fragments, a first key required by the target network node is generated, wherein the first key is used to indicate the complete key generated after synthesizing the plurality of first key fragments; The target transaction is verified using the first key; The process involves determining multiple calling network nodes based on the node characteristics, and then processing these nodes according to their respective characteristics to obtain multiple first key fragments, including: Based on the node characteristics, the target block where the target network node is located is determined; Based on the target block, determine the key identifier required for the target network node; Based on the key identifier, the plurality of calling network nodes are determined, and the calling network nodes are called according to the key identifier respectively to obtain a plurality of first key fragments; The process of calling the network node according to the key identifier yields multiple first key fragments, including: Based on the key identifier, call information for the target network node is generated, and the call information is used to call the first key fragment stored in different network nodes; Invocation requests are sent to the plurality of invocation network nodes according to the invocation information; Obtain the response information sent by the multiple calling network nodes respectively; Multiple response messages are analyzed and processed to obtain the multiple first key fragments.

2. The method according to claim 1, characterized in that, The method further includes: Obtain the second key of the target block and the target consortium chain to which the target block belongs. The second key is used to indicate the block key stored in the unfragmented target block. The target consortium chain includes multiple blocks. The second key is fragmented to obtain multiple second key fragments; Based on the target consortium blockchain, multiple backup network nodes are determined, and the backup network nodes are used to store fragments of the second key; The multiple second key fragments are randomly assigned to different backup network nodes.

3. The method according to claim 2, characterized in that, The fragmentation process of the second key yields multiple second key fragments, including: The second key is fragmented to obtain multiple key fragments; Based on the target block, generate the key identifier of the second key; The plurality of key fragments are marked according to the key identifier to obtain the plurality of second key fragments.

4. The method according to claim 3, characterized in that, The method further includes: The environmental parameters and preset security conditions of the target network node are obtained, wherein the environmental parameters are used to indicate the operating data information of the target block environment in which the target network node is located; Based on the environmental parameters and the preset security conditions, the target security index of the target block is determined. The security index is used to determine whether the environment of the target block where the target network node is located is secure. Based on the target security index, a target generation mode for the first key is determined, and the generation mode is used to control the generation frequency of the first key.

5. The method according to claim 4, characterized in that, The security indicators include: a first security indicator and a second security indicator. Determining the target security indicator for the target block based on the environmental parameters and the preset security conditions includes: Determine whether the environmental parameters meet the preset safety conditions; If the environmental parameters meet the preset security conditions, the first security indicator is determined as the target security indicator, and the first security indicator is used to indicate the security of the consortium blockchain environment in which the target network node is located. If the environmental parameters do not meet the preset security conditions, the second security indicator is determined as the target security indicator. The second security indicator is used to indicate that the consortium blockchain environment in which the target network node is located is insecure.

6. The method according to claim 5, characterized in that, The generation modes include: a first generation mode and a second generation mode. After verifying the signature of the target transaction according to the first key, the method further includes: If the target generation mode is the first generation mode, then the verification information of the target transaction is generated. The verification information is used to indicate the security of the operating environment of the target block. The first generation mode is related to the first security indicator. Based on the verification information and the target transaction, a pending transaction is generated for the target network node. The pending transaction is used to indicate the transactions flowing in the target consortium blockchain. If the target generation mode is the second generation mode, then the first key is deleted.

7. A signature verification device based on fragmented keys, characterized in that, include: The acquisition module is used to acquire the node characteristics of the target network node and the target transaction; The determination module is used to determine multiple calling network nodes based on the node characteristics; The processing module is used to process the multiple calling network nodes according to the node characteristics to obtain multiple first key fragments; The generation module is used to generate a first key required by the target network node based on the plurality of first key fragments, wherein the first key is used to indicate the complete key generated after synthesizing the plurality of first key fragments; The processing module is further configured to perform signature verification processing on the target transaction according to the first key; The process involves determining multiple calling network nodes based on the node characteristics, and then processing these nodes according to their respective characteristics to obtain multiple first key fragments, including: The determining module is further configured to determine the target block where the target network node is located based on the node characteristics; The determining module is further configured to determine the key identifier required by the target network node based on the target block; The determining module is further configured to determine the plurality of calling network nodes according to the key identifier, and to perform calling processing on the plurality of calling network nodes according to the key identifier to obtain a plurality of first key fragments; The process of calling the network node according to the key identifier yields multiple first key fragments, including: The generation module is further configured to generate invocation information for the target network node based on the key identifier, wherein the invocation information is used to invoke the first key fragment stored in different network nodes; The sending module is used to send call requests to the plurality of calling network nodes respectively according to the call information; The acquisition module is also used to acquire the response information sent by the plurality of calling network nodes respectively; The processing module is also used to analyze and process multiple response messages to obtain the multiple first key fragments.

8. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 6.

Images