Key wallet management method and system for alliance chain

Abstract

The present invention discloses a key wallet management method and system for alliance chain. At the local server end, an entropy value is generated based on a random number generator, and a key seed is constructed according to the entropy value; a corresponding private key is generated according to the key seed and a certificate issuing authority; a mnemonic corresponding to the private key is associated; the state of the mnemonic and the state of the user password are collected, and the use state of the wallet is triggered according to the combination of the state of the mnemonic and the state of the user password. At this time, the private key and the user password of the user in the alliance chain are uniformly managed and maintained, and the user's management of the key is elevated to the management of the wallet, so that the digital certificate is issued and managed based on the identity authorization mark and the certificate issuing authority, and the interactive part of the alliance chain is entered based on the digital certificate, which not only improves the security of the key management of the alliance chain, simplifies the management process of the user identity, but also provides users with an efficient and convenient blockchain transaction experience.

Description

Technical Field

[0001] The present invention relates to the technical field of key wallet management, and in particular to a key wallet management method and system for an alliance chain. Background Art

[0002] With the development of science and technology, the in-depth application of alliance chain technology in various industries, the key management problem has gradually become a technical bottleneck restricting its further development. In the existing technology, the traditional alliance chain key management method is to store sensitive information such as private keys locally, and separate the private keys from the user passwords for use. It is impossible to uniformly manage and maintain the private keys and user passwords, resulting in low security in the key management of the alliance chain. Summary of the invention

[0003] The purpose of the present invention is to overcome the shortcomings of the prior art. The present invention provides a key wallet management method and system for a consortium chain, which uniformly manages and maintains the private keys and user passwords of users in the consortium chain, and elevates the user's management of the key to the management of the wallet, thereby issuing and managing digital certificates based on identity authorization tags and certificate issuing authorities, and entering the interactive part of the consortium chain based on digital certificates, which not only improves the security of the key management of the consortium chain, simplifies the user identity management process, but also provides users with an efficient and convenient blockchain transaction experience.

[0004] In order to solve the above technical problems, an embodiment of the present invention provides a key wallet management method for a consortium chain, which is applied to a key wallet management scenario for a consortium chain; the key wallet management method for a consortium chain includes:

[0005] On the server side, an entropy value is generated based on a random number generator, and a key seed is constructed based on the entropy value;

[0006] Generate the corresponding private key based on the key seed and the certificate authority;

[0007] Based on the private key association corresponding mnemonic;

[0008] Collect the status of the mnemonic and the status of the user's password, and trigger the usage status of the wallet based on the combination of the status of the mnemonic and the status of the user's password;

[0009] In key management, digital certificates are issued and managed based on identity authorization tags and certificate authorities;

[0010] Enter the interactive part of the alliance chain based on digital certificates, conduct transactions in the interactive part, synchronously record transaction data, and verify identity.

[0011] Optionally, generating an entropy value based on a random number generator locally on the server, and constructing a key seed according to the entropy value, includes:

[0012] On the server side, locate the random number generator, which is in a safe state;

[0013] The entropy value is passed through the SHA256 algorithm to generate a hash, the first four bits are taken, and then concatenated with the entropy value to generate a 132-bit hash;

[0014] The hash is processed into 11 segments through a specific segmentation process, each segment of the hash is 12 bits;

[0015] Compare the hash with the mnemonic to generate 12 words;

[0016] Use 12 words as password. Users can choose mnemonic+passphrase as salt value. At this time, users can selectively enter passphrase. By default, an empty string is used.

[0017] The key seed is constructed by using the PBKDF2 key stretching algorithm and the pseudo-random function HMAC-512 iteratively repeated calculation 2048 times.

[0018] Optionally, the method of generating an entropy value based on a random number generator locally on the server and constructing a key seed according to the entropy value further includes:

[0019] The DeterministicSeed function is used to convert a secure random number entropy value into a deterministic seed. The formula of the DeterministicSeed function is as follows:

[0020] E=DeterministicSeed(new SecureRamdom(128));

[0021] E is the entropy value, and the DeterministicSeed function is used to convert the secure random number entropy value into a deterministic seed; (new SecureRamdom(128)) is the 128-bit coefficient output based on the random number generator;

[0022] In the production process of hash,

[0023] hash=sha256(E)

[0024] entropyWithBits=hash+hash.substring(0,4)

[0025] mnemonic=newArraylist(splitAsStream(entropyWithBits,12));

[0026] Among them, hash is hash; sha256(E) is used to generate a secure hash entropy;

[0027] entropyWithBits is to generate a hash by using the SHA256 algorithm for the entropy value, taking the first four bits, splicing them to the entropy value to generate a 132-bit hash; mnemonic is the password, mnemonic=newArraylist(splitAsStream(entropyWithBits,12)) is to process the hash into 11 segments through a specific segmentation process, each hash is 12 bits; the hash is compared with the mnemonic to generate 12 words;

[0028] The key seed is as follows: seed=PBKDF2(HMAC-512(mnemonic+passphrase,2048)); seed is the key seed, PBKDF2 is the PBKDF2 key stretching algorithm; (HMAC-512(mnemonic+passphrase,2048)) is a pseudo-random function, which iterates 2048 times to generate a key with a key length of 512 bits.

[0029] Optionally, generating a corresponding private key according to the key seed and the certificate authority includes:

[0030] Collect key seeds;

[0031] The key seed is input into the certificate authority and is calculated in the certificate authority, and the corresponding private key is generated by the calculation of the key seed.

[0032] Optionally, the mnemonic words associated with the private key include:

[0033] Associate the private key and the mnemonic phrase;

[0034] When the password exists and the mnemonic is forgotten, the private key stored locally on the server is triggered, and the mnemonic is replaced based on the private key and used as the login factor of the wallet.

[0035] Optionally, the collecting of the status of the mnemonic and the status of the user password, and triggering the usage status of the wallet according to a combination of the status of the mnemonic and the status of the user password, includes:

[0036] The status of collecting mnemonics and the status of user passwords;

[0037] The state of the mnemonic phrase and the state of the user password are combined to form a state combination;

[0038] The wallet usage status is triggered according to the status combination. At this time, the wallet usage status includes normal usage status, private key storage status and identity loss status.

[0039] Optionally, the collecting of the status of the mnemonic and the status of the user password, and triggering the usage status of the wallet according to a combination of the status of the mnemonic and the status of the user password, further includes:

[0040] When both the password and the mnemonic phrase exist, the wallet is used and restored normally. At this time, the wallet is in normal use;

[0041] When the password is forgotten but the mnemonic exists, the user can regain control of the identity by entering the mnemonic and resetting the password to store the private key locally. At this time, the wallet is in the private key storage state.

[0042] When both the password and the mnemonic phrase are forgotten, the user cannot regain control of the wallet, resulting in the loss of user identity. At this time, the wallet is in an identity loss state.

[0043] Optionally, in the key management, issuing and managing digital certificates based on identity authorization tags and certificate authority includes:

[0044] In the key management, the identity authorization tag is obtained based on the triggering of the identity authorization module;

[0045] Associate identity authorization tokens with certificate authorities;

[0046] The digital certificate is issued and managed based on the identity authorization token and the certificate authority, and the digital certificate contains the user's public key.

[0047] Optionally, the interactive part of entering the alliance chain based on the digital certificate, conducting transactions in the interactive part, synchronously recording transaction data, and verifying identity include:

[0048] Collect digital certificates;

[0049] Enter the interactive part of the alliance chain based on the digital certificate and grant the operation authority to access the blockchain network node;

[0050] In the interactive part, relevant transaction data is automatically constructed according to the user's request, and the transaction data is recorded synchronously.

[0051] Optionally, a key wallet management system for a consortium chain is provided, wherein the key wallet management system for a consortium chain is applied to the above-mentioned key wallet management method for a consortium chain, and the key wallet management system for a consortium chain includes:

[0052] The key seed module is used to generate entropy values ​​based on a random number generator locally on the server side and construct a key seed based on the entropy values;

[0053] A private key module is used to generate a corresponding private key based on a key seed and a certificate authority;

[0054] Mnemonic module, used to associate the corresponding mnemonics based on the private key;

[0055] The usage status module is used to collect the status of the mnemonic and the status of the user's password, and trigger the usage status of the wallet according to the combination of the status of the mnemonic and the status of the user's password;

[0056] Digital certificate module, used for issuing and managing digital certificates based on identity authorization tags and certificate authorities in key management;

[0057] The transaction module is used to enter the interactive part of the alliance chain based on the digital certificate, conduct transactions in the interactive part, synchronously record transaction data, and verify identity.

[0058] In an embodiment of the present invention, through the method in the embodiment of the present invention, an entropy value is generated locally on the server based on a random number generator, and a key seed is constructed according to the entropy value; a corresponding private key is generated according to the key seed and the certificate authority; a corresponding mnemonic is associated with the private key; the status of the mnemonic and the status of the user password are collected, and the usage status of the wallet is triggered according to the combination of the status of the mnemonic and the status of the user password; in the management of keys, digital certificates are issued and managed based on identity authorization tags and certificate authorities; the interactive part of the alliance chain is entered based on digital certificates, and transactions are conducted in the interactive part, transaction data is synchronously recorded, and identity is verified. At this time, the private keys and user passwords of users in the alliance chain are uniformly managed and maintained, and the user's management of keys is elevated to the management of wallets, thereby issuing and managing digital certificates based on identity authorization tags and certificate authorities, and entering the interactive part of the alliance chain based on digital certificates, which not only improves the security of the key management of the alliance chain, simplifies the user identity management process, but also provides users with an efficient and convenient blockchain transaction experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0060] Figure 1It is a flowchart of a key wallet management method for a consortium chain in an embodiment of the present invention;

[0061] Figure 2 It is a flowchart of S11 in the key wallet management method for alliance chain in an embodiment of the present invention;

[0062] Figure 3 It is a flow chart of S12 in the key wallet management method for alliance chain in an embodiment of the present invention;

[0063] Figure 4 It is a flowchart of S13 in the key wallet management method for alliance chain in an embodiment of the present invention;

[0064] Figure 5 It is a flowchart of S14 in the key wallet management method for alliance chain in an embodiment of the present invention;

[0065] Figure 6 It is a flow chart of S15 in the key wallet management method for alliance chain in an embodiment of the present invention;

[0066] Figure 7 It is a flowchart of S16 in the key wallet management method for alliance chain in an embodiment of the present invention;

[0067] Figure 8 It is a schematic diagram of the structural composition of a key wallet management system for a consortium chain in an embodiment of the present invention;

[0068] Fig. 9 The figure is a hardware diagram of an electronic device according to an exemplary embodiment.

[0069] Reference numerals

[0070] 40. Electronic device; 41. Processing unit; 42. Storage unit; 421. Random access storage unit; 422. Cache storage unit; 423. Read-only storage unit (ROM); 424. Utility; 425. Program module; 43. Bus; 44. Input / output (I / O) interface; 45. Network adapter. DETAILED DESCRIPTION

[0071] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0072] Method Embodiment

[0073] See also Figures 1 to 9 , a key wallet management method for alliance chain, applied to the key wallet management scenario for alliance chain; the key wallet management method for alliance chain includes:

[0074] Step S11: On the server side, an entropy value is generated based on a random number generator, and a key seed is constructed according to the entropy value;

[0075] Step S12: Generate a corresponding private key according to the key seed and the certificate authority;

[0076] Step S13: Associating the corresponding mnemonic based on the private key;

[0077] Step S14: collecting the status of the mnemonic and the status of the user password, and triggering the usage status of the wallet according to the combination of the status of the mnemonic and the status of the user password;

[0078] Step S15: In the key management, digital certificates are issued and managed based on the identity authorization mark and the certificate authority;

[0079] Step S16: Enter the interactive part of the alliance chain based on the digital certificate, conduct transactions in the interactive part, synchronously record transaction data, and verify identity.

[0080] In an embodiment of the present invention, through the method in the embodiment of the present invention, the private keys and user passwords of users in the alliance chain are uniformly managed and maintained, and the user's management of the key is elevated to the management of the wallet, so that digital certificates are issued and managed based on identity authorization tags and certificate issuing authorities, and the interactive part of the alliance chain is entered based on the digital certificate, which not only improves the security of the key management of the alliance chain, simplifies the user identity management process, but also provides users with an efficient and convenient blockchain transaction experience.

[0081] In step S11, an entropy value is generated locally on the server based on a random number generator, and a key seed is constructed according to the entropy value;

[0082] In the specific implementation process of the present invention, the specific steps may be:

[0083] S111: Locate the random number generator locally on the server, and the random number generator is in a secure state;

[0084] S112: Generate a hash by using the SHA256 algorithm for the entropy value, take the first four bits, and concatenate them to the entropy value to generate a 132-bit hash;

[0085] S113: The hash is processed into 11 segments through a specific segmentation process, each hash segment is 12 bits;

[0086] S114: Compare the hash with the mnemonic to generate 12 words;

[0087] S115: 12 words are used as the password. The user can select mnemonic+passphrase as the salt value. At this time, the user selectively enters the passphrase. The empty string is used by default.

[0088] S116: Use the PBKDF2 key stretching algorithm to iterate and repeat the calculation 2048 times using the pseudo-random function HMAC-512 to construct a key seed.

[0089] In an embodiment of the present application, the Key Management Wallet (KMW) is the core component responsible for key management, which mainly interacts with three types of components: the certificate authority (CA), the local storage environment, and the blockchain network interaction node (Peer).

[0090] First, KMW interacts with CA. CA is a trusted third-party organization within the alliance chain, responsible for issuing and managing certificates. During the wallet generation process, KMW requests and obtains the user's digital certificate from CA to ensure the authenticity and legitimacy of the user's identity. At the same time, the user sets the wallet access password and the BIP39 algorithm to generate the wallet, creating a secure and unique encrypted wallet. This wallet not only contains the user's digital asset information, but also stores important data such as the user's private key.

[0091] Secondly, KMW interacts with the local storage environment. The local storage environment is a physical or logical space that stores private keys and sensitive information. KMW uses encryption algorithms and security technologies to encrypt and store private keys in the local environment to ensure the security and controllability of private keys. In addition, KMW also implements a strict access control mechanism to ensure that only authorized users can access and operate private keys, thereby achieving efficient management and protection of private keys.

[0092] Finally, KMW interacts with Peer. Peer is a node in the blockchain network, responsible for processing transactions, verifying blocks, and communicating with other nodes. KMW encapsulates the user's transaction request into a blockchain-standard format, and hides the user's private key during the transaction signing process to ensure that the private key is not leaked.

[0093] At this point, KMW combines the concept of hierarchical deterministic wallet (HD Wallet) on the basis of the existing PKI system to upgrade the traditional identity certificate management to a higher level of wallet management. HD wallet uses a single seed to generate a series of public and private key pairs, which greatly simplifies the tedious process of users managing complex key systems. At the same time, KMW achieves deterministic generation of wallets by adopting the BIP39 mnemonic algorithm. BIP39 is an open standard for generating and recovering mnemonics, which are a set of easy-to-remember words that provide users with a more intuitive and friendly way to back up and restore identity keys. The use of this algorithm not only simplifies the wallet creation process, but also improves the security and recovery capabilities of the wallet.

[0094] Therefore, the user sets the wallet password and saves it locally on the server. The password is used to verify the user's access rights to the wallet and is only valid for the wallet instance that matches the user information in the current server storage environment. The random number generator is located locally on the server and is in a secure state. When the wallet is first generated, a 128-bit entropy value E is randomly generated through a secure random number generator. This random entropy value can be any binary data.

[0095] At this point, the SecureRandom function is used to return a secure random number generator that is able to produce random numbers that are difficult to predict and statistically uniform. In the context of BIP39, this secure random number (or "entropy") is the starting point for generating mnemonics. 128 bits ensure that the mnemonics have sufficient randomness and security.

[0096] The DeterministicSeed function is used to convert a secure random number entropy value into a deterministic seed. The formula of the DeterministicSeed function is as follows:

[0097] E=DeterministicSeed(new SecureRamdom(128))

[0098] Among them, E is the entropy value, and the DeterministicSeed function is used to convert the secure random number entropy value into a deterministic seed; (new SecureRamdom(128)) is the 128-bit coefficient output based on the random number generator.

[0099] Furthermore, the entropy value is used to generate a hash through the SHA256 algorithm, and the first four bits are taken and concatenated with the entropy value to generate a 132-bit hash; the hash is processed into 11 segments through a specific segmentation process, and each hash segment is 12 bits; the hash is compared with the mnemonic to generate 12 words.

[0100] First, sha256(E) is used to generate a secure hash entropy. Second, to verify the accuracy of the mnemonic, the entropy is hashed with SHA-256 and the first few bits of the hash value are taken as the checksum. The length of the checksum depends on the length of the entropy. For 128 bits of entropy, the first four bits of the SHA-256 hash are taken as the checksum. Third, the extended entropy with the checksum is converted into a binary string, and the bit string is divided into 11 groups of equal length, each containing 11 bits. Each group of 11 binary digits is mapped to a word in the mnemonic list. This mapping is predefined and included in the BIP39 specification. Finally, according to the results of the grouping, the corresponding words are selected from the mnemonic list and combined into a mnemonic list. This list is the final generated mnemonic, which is used to backup and restore the wallet.

[0101] In the hash production process, hash=sha256(E)

[0102] entropyWithBits=hash+hash.substring(0,4)

[0103] mnemonic=newArraylist(splitAsStream(entropyWithBits,12));

[0104] Among them, hash is hash; sha256(E) is used to generate a secure hash entropy;

[0105] entropyWithBits generates a hash by using the SHA256 algorithm to generate a 132-bit hash. mnemonic is the password. mnemonic=newArraylist(splitAsStream(entropyWithBits,12)) processes the hash into 11 segments through a specific segmentation process. Each hash is 12 bits. The hash is compared with the mnemonic to generate 12 words.

[0106] Furthermore, 12 words are used as passwords, and users can choose mnemonic+passphrase as salt values. At this time, users can selectively enter passphrase, and an empty string is used by default; the PBKDF2 key stretching algorithm is used to iterate and repeat the calculation of the pseudo-random function HMAC-512 2048 times to construct the key seed. Optionally, mnemonic and passphrase are both density.

[0107] After determining the password mnemonic and salt value, set the pseudo-random function HMAC-512 and iterate 2048 times to generate a key with a key length of 512 bits. Use the above parameters and the given password and salt value to execute the PBKDF2 key stretching algorithm. After the algorithm is executed, a 512-bit (64-byte) key will be obtained as output, which is the required key seed.

[0108] The key seed is as follows: seed=PBKDF2(HMAC-512(mnemonic+passphrase,2048)); seed is the key seed, PBKDF2 is the PBKDF2 key stretching algorithm; (HMAC-512(mnemonic+passphrase,2048)) is a pseudo-random function, which iterates 2048 times to generate a key with a key length of 512 bits.

[0109] In step S12, a corresponding private key is generated according to the key seed and the certificate authority;

[0110] In the specific implementation process of the present invention, the specific steps may be:

[0111] S121: Collect key seeds;

[0112] S122: The key seed is input into the certificate authority and is operated in the certificate authority. Meanwhile, the key seed is operated to generate a corresponding private key.

[0113] In an embodiment of the present application, key seeds are collected and managed, so that the key seeds are input into a certificate authority and calculated in the certificate authority. At the same time, the calculation of the key seeds generates a corresponding private key, thereby ensuring the calculation of the private key.

[0114] At this time, the BIP39 technology used in KMW allows users to restore wallet information through mnemonics to ensure that the user's identity is not lost. Mnemonics are the basis for restoring identity. In the above, mnemonics are fixed as seeds generated by pseudo-random functions and stretching functions. The key seed can be sent to Fabric CA to reissue the certificate.

[0115] In step S13, the corresponding mnemonic is associated based on the private key;

[0116] In the specific implementation process of the present invention, the specific steps may be:

[0117] S131: associate the private key and the mnemonic phrase;

[0118] S132: When the password exists and the mnemonic is forgotten, the private key stored locally on the server is triggered, and the mnemonic is replaced based on the private key and used as the login factor of the wallet.

[0119] In an embodiment of the present application, a private key and a mnemonic are associated so that a mnemonic can be defined based on the private key. At this time, when the password exists and the mnemonic is forgotten, the private key stored locally on the server is triggered, and the mnemonic is replaced based on the private key and used as a login factor for the wallet.

[0120] S14: Collect the status of the mnemonic and the status of the user's password, and trigger the usage status of the wallet according to the combination of the status of the mnemonic and the status of the user's password;

[0121] In the specific implementation process of the present invention, the specific steps may be:

[0122] S141: collecting the status of the mnemonic and the status of the user password;

[0123] S142: combining the state of the mnemonic phrase and the state of the user password to form a state combination;

[0124] S143: triggering the usage status of the wallet according to the status combination. At this time, the usage status of the wallet includes normal usage status, private key storage status and identity loss status.

[0125] In the embodiment of the present application, the status of the mnemonic and the status of the user password are collected to monitor the status of the mnemonic and the status of the user password, so as to combine the status of the mnemonic and the status of the user password and form a state combination, so as to define the state combination, so as to control the state combination as a whole, and then trigger the use state of the wallet according to the state combination. At this time, the use state of the wallet includes normal use state, private key storage state and identity loss state. Therefore, in the wallet recovery solution, the mnemonic is the most critical information for restoring the wallet, and it is recommended that users store it in a safe paper backup to avoid forgetting.

[0126] At this time, the state of collecting the mnemonic words and the state of the user password, and triggering the use state of the wallet according to the combination of the state of the mnemonic words and the state of the user password, also includes:

[0127] When both the password and the mnemonic phrase exist, the wallet is used and restored normally. At this time, the wallet is in normal use;

[0128] When the password is forgotten but the mnemonic exists, the user can regain control of the identity by entering the mnemonic and resetting the password to store the private key locally. At this time, the wallet is in the private key storage state.

[0129] When both the password and the mnemonic phrase are forgotten, the user cannot regain control of the wallet, resulting in the loss of user identity. At this time, the wallet is in an identity loss state.

[0130] S15: In key management, digital certificates are issued and managed based on identity authorization tags and certificate authorities;

[0131] In the specific implementation process of the present invention, the specific steps may be:

[0132] S151: in the key management, obtaining the identity authorization tag based on the triggering of the identity authorization module;

[0133] S152: associate the identity authorization token and the certificate authority;

[0134] S153: Issue and manage a digital certificate based on the identity authorization tag and the certificate authority, where the digital certificate contains the user's public key.

[0135] In the embodiment of the present application, in the design of KMW, the identity authorization module plays a vital role, which ensures that only authorized users can access and operate resources in the alliance chain network. This module works closely with Fabric CA to provide users with a secure and efficient identity authentication and authorization mechanism.

[0136] By collaborating with Fabric CA, the identity authorization module can issue and manage digital certificates for users. When a user accesses the blockchain network for the first time, the identity authorization module sends a certificate request to Fabric CA. After verifying the user's identity, Fabric CA issues a digital certificate containing the user's public key and returns it to KMW.

[0137] At this time, in the management of the key, the identity authorization tag is obtained based on the triggering of the identity authorization module, so as to introduce the identity authorization tag, thereby managing and controlling the identity authorization tag, and then associating the identity authorization tag and the certificate authority. Therefore, based on the combination of the identity authorization tag and the certificate authority, a digital certificate is issued and managed, and the digital certificate contains the user's public key.

[0138] To ensure the security of user certificates, KMW will use a variety of security mechanisms to ensure that certificates are securely stored in local wallets, and use the certificates for identity authentication and signing in subsequent transactions and operations. First, when KMW communicates with FabricCA or other components, the TLS transmission channel is used to encrypt the communication content to prevent man-in-the-middle attacks and data leaks. Secondly, the user's identity credentials such as private keys and identity certificates use the Advanced Encryption Standard AES algorithm, which provides a variety of key lengths to meet the user's custom needs. Finally, when applying for or verifying user-entered passwords, KMW uses a strong password hashing algorithm to store and manage user passwords, and uses salt values ​​and multiple iterations to prevent rainbow table attacks and brute force cracking.

[0139] S16: Enter the interactive part of the alliance chain based on the digital certificate, conduct transactions in the interactive part, synchronously record transaction data, and verify identity;

[0140] In the specific implementation process of the present invention, the specific steps may be:

[0141] S161: Collect digital certificates;

[0142] S162: Enter the interactive part of the alliance chain according to the digital certificate and grant the operation authority to access the blockchain network node;

[0143] S163: In the interactive part, the relevant transaction data is automatically constructed according to the user's request, and the transaction data is synchronously recorded and identity authentication is performed at the same time.

[0144] In the embodiment of the present application, the chain interaction module is one of the core components of KMW, which is responsible for handling all interactions between users and the alliance chain network. This module provides a secure transaction signature interface, allowing applications to request signatures without directly accessing private keys, allowing users to perform transactions, monitor events and other blockchain-related operations without exposing private keys.

[0145] At this time, the interactive part of the alliance chain is entered according to the digital certificate, and the operation authority to access the blockchain network node is granted. In the interactive part, the relevant transaction data is automatically constructed according to the user's request, and the transaction data is recorded synchronously. Therefore, the private keys and user passwords of users in the alliance chain are uniformly managed and maintained, and the user's management of keys is elevated to the management of wallets, thereby triggering digital certificates based on identity authorization tags and certificate issuing authorities, and entering the interactive part of the alliance chain based on digital certificates, which not only improves the security of the alliance chain's key management, simplifies the user identity management process, but also provides users with an efficient and convenient blockchain transaction experience.

[0146] For user verification and permission management, users need to log in through KMW's identity authentication mechanism before using the on-chain interaction module. After successful login, the module will grant the user the operation permission to access the blockchain network node based on the user's member service provider (MSP), role and management branch (affiliation).

[0147] For transaction construction, signing, broadcasting and confirmation, users initiate a transaction request to KMW's on-chain interaction module and specify the transaction information. The module automatically constructs relevant transaction data based on the user's request and signs the transaction by calling the private key signature function inside KMW.

[0148] The private key signature function analyzes the transaction chain process in Hyperledger Fabric. During the transaction endorsement process, KMW generates an unsigned transaction proposal based on the user's request and the input parameters of the smart contract, which does not contain private key information. KMW will then prompt the user to enter the password, confirm the user's identity and unlock the user's private key to sign the transaction plan. During this process, the use of the private key is only performed in KMW's secure environment to ensure that the private key will not be exposed. Once the transaction plan is signed successfully, KMW sends the signature and transaction plan to the endorsement node to verify the integrity of the signature and transaction plan, but the network will not have access to the private key.

[0149] Similarly, during the transaction submission process, the transaction will be regenerated by KMW as an unsigned version. After signing the transaction, only the transaction and signature will be sent to the sorting node. The sorting node will verify the signature and process the transaction, but it will not have access to the private key.

[0150] In this way, the private key is safe throughout the transaction and is only used locally by KMW. Even if the middleware is attacked or has vulnerabilities, the attacker cannot obtain the user's private key because the private key has never been sent to any other component in the network. In addition, the chain interaction module is responsible for monitoring the confirmation of the transaction on the blockchain and returning the transaction status to the user. During the interaction process, if an error occurs, the chain interaction module can also perform error handling.

[0151] Through the above methods, KMW's modules are seamlessly integrated with the alliance chain application system to provide users with a one-stop blockchain service experience.

[0152] Specifically, this solution mainly consists of the wallet management module (KMW), the certificate authority (CA), and the alliance chain Hyperledger Fabric. KMW is responsible for interacting with users, storing and using private keys; CA, as a trusted third party within the alliance chain, is responsible for issuing and managing users' digital certificates; Fabric provides distributed ledgers and SDKs to ensure the availability of wallets.

[0153] During the verification process, we first checked the deployment of KMW's wallet management module, CA, and alliance chain to ensure that each component was operating normally and could communicate with each other. Next, we verified the identity authorization module between KMW and CA to ensure that the data format of the request and response was correct and that the digital certificate could be obtained normally. Finally, we verified the on-chain interaction module between KMW and the alliance chain to ensure that the wallet information could be synchronized to the chain accurately and in a timely manner. The functional test results are shown in Table 1.

[0154] Table 1 Functional test results

[0155]

[0156] In an embodiment of the present invention, through the method in the embodiment of the present invention, an entropy value is generated locally on the server based on a random number generator, and a key seed is constructed according to the entropy value; a corresponding private key is generated according to the key seed and the certificate authority; a corresponding mnemonic is associated with the private key; the status of the mnemonic and the status of the user password are collected, and the usage status of the wallet is triggered according to the combination of the status of the mnemonic and the status of the user password; in the management of keys, digital certificates are issued and managed based on identity authorization tags and certificate authorities; the interactive part of the alliance chain is entered based on digital certificates, and transactions are conducted in the interactive part, transaction data is synchronously recorded, and identity is verified. At this time, the private keys and user passwords of users in the alliance chain are uniformly managed and maintained, and the user's management of keys is elevated to the management of wallets, thereby issuing and managing digital certificates based on identity authorization tags and certificate authorities, and entering the interactive part of the alliance chain based on digital certificates, which not only improves the security of the key management of the alliance chain, simplifies the user identity management process, but also provides users with an efficient and convenient blockchain transaction experience.

[0157] System Example

[0158] See also Figure 8 , Figure 8 It is a schematic diagram of the structural composition of the key wallet management system for the alliance chain in an embodiment of the present invention.

[0159] like Figure 8 As shown, a key wallet management system for alliance chain, the key wallet management system for alliance chain includes:

[0160] The key seed module 21 is used to generate an entropy value based on a random number generator locally on the server side, and construct a key seed according to the entropy value;

[0161] The private key module 22 is used to generate a corresponding private key according to the key seed and the certificate authority;

[0162] A mnemonic module 23, used to associate a corresponding mnemonic based on a private key;

[0163] A usage status module 24, which is used to collect the status of the mnemonic and the status of the user password, and trigger the usage status of the wallet according to the combination of the status of the mnemonic and the status of the user password;

[0164] A digital certificate module 25 is used to issue and manage digital certificates based on identity authorization tags and certificate issuing authorities in key management;

[0165] The transaction module 26 is used to enter the interactive part of the alliance chain based on the digital certificate, conduct transactions in the interactive part, synchronously record transaction data, and verify identity.

[0166] Device Embodiment

[0167] See also Fig. 9 , refer to the following Fig. 9 The electronic device 40 according to this embodiment of the present invention will be described. Fig. 9 The electronic device 40 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0168] like Fig. 9 As shown, the electronic device 40 is in the form of a general computing device. The components of the electronic device 40 may include but are not limited to: at least one processing unit 41, at least one storage unit 42, and a bus 43 connecting different system components (including the storage unit 42 and the processing unit 41).

[0169] The storage unit stores program codes, which can be executed by the processing unit 41, so that the processing unit 41 executes the steps according to various exemplary embodiments of the present invention described in the above “Embodiment Method” section of this specification.

[0170] The storage unit 42 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit 421 and / or a cache storage unit 422 , and may further include a read-only storage unit (ROM) 423 .

[0171] The storage unit 42 may also include a utility 424 having a set (at least one) of program modules 425, such program modules 425 including but not limited to: an operating system, one or more application programs, other program modules and program data, each of which or some combination may include the implementation of a network environment.

[0172] Bus 43 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0173] The electronic device 40 may also communicate with one or more external devices (e.g., keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable a user to interact with the electronic device 40, and / or any device that enables the electronic device 40 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 44. Furthermore, the electronic device 40 may also communicate with one or more networks (e.g., local area networks, wide area networks, and / or public networks, such as the Internet) via a network adapter 45. Fig. 9 As shown, the network adapter 45 communicates with other modules of the electronic device 40 via the bus 43. It should be understood that although Fig. 9 Not shown, other hardware and / or software modules may be used in conjunction with the electronic device 40, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, tape drives, and data backup planning systems.

[0174] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0175] Those skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, and the storage medium can include: a read-only memory, a random access memory, a disk or an optical disk, etc. In addition, it stores computer program instructions, and when the computer program instructions are executed by a computer, the computer executes the above method.

[0176] In addition, the key wallet management method and system for the alliance chain provided by the embodiments of the present invention are introduced in detail above. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A key wallet management method for alliance chain, characterized in that: Applied to the key wallet management scenario for alliance chain; the key wallet management method for alliance chain includes: On the server side, an entropy value is generated based on a random number generator, and a key seed is constructed based on the entropy value; Generate the corresponding private key based on the key seed and the certificate authority; Based on the private key association corresponding mnemonic; Collect the status of the mnemonic and the status of the user's password, and trigger the usage status of the wallet based on the combination of the status of the mnemonic and the status of the user's password; In key management, digital certificates are issued and managed based on identity authorization tags and certificate authorities; Enter the interactive part of the alliance chain based on digital certificates, conduct transactions, synchronously record transaction data, and verify identity in the interactive part; The method generates an entropy value based on a random number generator locally on the server, and constructs a key seed according to the entropy value, including: locating a random number generator locally on the server, and the random number generator is in a safe state; generating a hash segment by using the entropy value through the SHA256 algorithm, taking the first four bits, splicing them to the entropy value, and generating a 132-bit hash; processing the hash into 11 segments through a specific segmentation process, each hash segment is 12 bits; comparing the hash with the mnemonic to generate 12 words; using the 12 words as a password, the user can select mnemonic+passphrase as a salt value, at this time, the user selectively enters the passphrase, and an empty string is used by default; using the PBKDF2 key stretching algorithm to use the pseudo-random function HMAC-512 to iteratively repeat the calculation 2048 times to construct the key seed; The state of collecting mnemonics and the state of user passwords, and triggering the use state of the wallet according to the combination of the state of mnemonics and the state of user passwords, include: collecting the state of mnemonics and the state of user passwords; combining the state of mnemonics and the state of user passwords to form a state combination; triggering the use state of the wallet according to the state combination, at this time, the use state of the wallet includes normal use state, private key storage state and identity loss state; when both the password and the mnemonics exist, the wallet is used normally and restored, at this time, the wallet is in normal use state; when the password is forgotten and the mnemonics exist, the user regains control of the identity by entering the mnemonics, and realizes local storage of the private key by resetting the password, at this time, the wallet is in the private key storage state; when both the password and the mnemonics are forgotten, the user cannot regain control of the wallet, resulting in the loss of the user's identity, at this time, the wallet is in the identity loss state; The method of issuing and managing digital certificates based on identity authorization tags and certificate issuing authorities in key management includes: obtaining identity authorization tags based on triggering of identity authorization modules in key management; associating identity authorization tags with certificate issuing authorities; issuing and managing digital certificates based on a combination of identity authorization tags and certificate issuing authorities, wherein the digital certificates contain user public keys; The method of entering the interactive part of the alliance chain based on the digital certificate, conducting transactions, synchronously recording transaction data and verifying identity in the interactive part includes: collecting digital certificates; entering the interactive part of the alliance chain according to the digital certificate, and granting operation permissions to access the blockchain network node; in the interactive part, automatically constructing relevant transaction data according to the user's request, synchronously recording the transaction data, and performing identity authentication at the same time.

2. According to the alliance chain-oriented key wallet management method of claim 1, it is characterized in that: The method of generating an entropy value based on a random number generator locally on the server and constructing a key seed according to the entropy value also includes: The DeterministicSeed function is used to convert a secure random number entropy value into a deterministic seed. The formula of the DeterministicSeed function is as follows: E=DeterministicSeed(new SecureRamdom(128)); E is the entropy value. The DeterministicSeed function is used to convert the secure random number entropy value into a deterministic seed. (new SecureRamdom(128) is the 128-bit coefficient output based on the random number generator. In the hash production process, hash = sha256(E) entropyWithBits=hash+hash.substring(0,4) mnemonic=new ArrayList(splitAsStream(entropyWithBits,12)); Among them, hash is a hash; sha256(E) is used to generate a secure hash entropy; entropyWithBits is to generate a hash by using the SHA256 algorithm for the entropy value, taking the first four bits, splicing them to the entropy value and generating a 132-bit hash; mnemonic is the password, new ArrayList(splitAsStream(entropyWithBits,12)) is to process the hash into 11 segments through a specific segmentation process, each hash is 12 bits; the hash is compared with the mnemonic to generate 12 words; The key seed is as follows: seed=PBKDF2(HMAC-512(mnemonic+passphrase,2048)); Among them, seed is the key seed, PBKDF2 is the PBKDF2 key stretching algorithm; HMAC-512 (mnemonic + passphrase, 2048) is a pseudo-random function, which iterates 2048 times to generate a key with a key length of 512 bits.

3. The key wallet management method for alliance chain according to claim 2 is characterized in that: The generating of the corresponding private key according to the key seed and the certificate authority includes: Collect key seeds; The key seed is input into the certificate authority and is calculated in the certificate authority, and the corresponding private key is generated by the calculation of the key seed.

4. The key wallet management method for alliance chain according to claim 3 is characterized in that: The mnemonics corresponding to the private key association include: Associate the private key and the mnemonic phrase; When the password exists and the mnemonic is forgotten, the private key stored locally on the server is triggered, and the mnemonic is replaced based on the private key and used as the login factor of the wallet.

5. A key wallet management system for alliance chain, characterized in that: The key wallet management system for alliance chain is applied to the key wallet management method for alliance chain as claimed in any one of claims 1 to 4, and the key wallet management system for alliance chain includes: The key seed module is used to generate entropy values ​​based on a random number generator locally on the server side and construct a key seed based on the entropy values; A private key module is used to generate a corresponding private key based on a key seed and a certificate authority; Mnemonic module, used to associate the corresponding mnemonics based on the private key; The usage status module is used to collect the status of the mnemonic and the status of the user's password, and trigger the usage status of the wallet according to the combination of the status of the mnemonic and the status of the user's password; Digital certificate module, used for issuing and managing digital certificates based on identity authorization tags and certificate authorities in key management; The transaction module is used to enter the interactive part of the alliance chain based on the digital certificate, conduct transactions in the interactive part, synchronously record transaction data, and verify identity; The method generates an entropy value based on a random number generator locally on the server, and constructs a key seed according to the entropy value, including: locating a random number generator locally on the server, and the random number generator is in a safe state; generating a hash segment by using the entropy value through the SHA256 algorithm, taking the first four bits, splicing them to the entropy value, and generating a 132-bit hash; processing the hash into 11 segments through a specific segmentation process, each hash segment is 12 bits; comparing the hash with the mnemonic to generate 12 words; using the 12 words as a password, the user can select mnemonic+passphrase as a salt value, at this time, the user selectively enters the passphrase, and an empty string is used by default; using the PBKDF2 key stretching algorithm to use the pseudo-random function HMAC-512 to iteratively repeat the calculation 2048 times to construct the key seed; The state of collecting mnemonics and the state of user passwords, and triggering the use state of the wallet according to the combination of the state of mnemonics and the state of user passwords, include: collecting the state of mnemonics and the state of user passwords; combining the state of mnemonics and the state of user passwords to form a state combination; triggering the use state of the wallet according to the state combination, at this time, the use state of the wallet includes normal use state, private key storage state and identity loss state; when both the password and the mnemonics exist, the wallet is used normally and restored, at this time, the wallet is in normal use state; when the password is forgotten and the mnemonics exist, the user regains control of the identity by entering the mnemonics, and realizes local storage of the private key by resetting the password, at this time, the wallet is in the private key storage state; when both the password and the mnemonics are forgotten, the user cannot regain control of the wallet, resulting in the loss of the user's identity, at this time, the wallet is in the identity loss state; The method of issuing and managing digital certificates based on identity authorization tags and certificate issuing authorities in key management includes: obtaining identity authorization tags based on triggering of identity authorization modules in key management; associating identity authorization tags with certificate issuing authorities; issuing and managing digital certificates based on a combination of identity authorization tags and certificate issuing authorities, wherein the digital certificates contain user public keys; The method of entering the interactive part of the alliance chain based on the digital certificate, conducting transactions, synchronously recording transaction data and verifying identity in the interactive part includes: collecting digital certificates; entering the interactive part of the alliance chain according to the digital certificate, and granting operation permissions to access the blockchain network node; in the interactive part, automatically constructing relevant transaction data according to the user's request, synchronously recording the transaction data, and performing identity authentication at the same time.

Images