Data processing method and device, equipment, medium and program product

Abstract

The embodiment of the invention provides a data processing method and device, equipment, a medium and a program product, and the method comprises the steps: obtaining a secret key fragment corresponding to a secret key share held by an ith participant in a first participant set in response to a secret key redistribution demand of the first participant set; key redistribution processing is carried out on the key fragments, and a plurality of sub-key shares and commitment information corresponding to the key fragments are generated; broadcasting a public key corresponding to the secret key and commitment information to a second participant set for verification processing, so that participants in the second participant set return a target verification result; and if the target verification result indicates that both the public key and the commitment information are successfully verified, allocating a sub-key share to the jth participant in the second participant set based on the plurality of sub-key shares, so that the jth participant becomes a new participant holding the key. According to the embodiment of the invention, the digital assets can be efficiently protected.

Description

Technical Field

[0001] The present application relates to the field of computer technology, in particular to the field of blockchain, and specifically to a data processing method, a data processing device, a computer equipment, a computer-readable storage medium, and a computer program product. Background Art

[0002] MPC (Multi-Party Computation) is an important encryption security method.

[0003] At present, MPC mainly achieves multi-party negotiation and signature to disperse risks by breaking the secret key into multiple secret key shares (or secret key shards), and each participant in the decentralized network holds a single secret key share. However, one or more participants in the decentralized network may lose their secret key shares, which poses a greater threat to the security of the secret key; for example, in a 3-shard scenario, after a participant loses a secret key shard, although the negotiation signature can still be achieved based on the secret key shares held by the remaining two participants, once any of the remaining two participants also lose their secret key shares, the complete secret key will be lost, which means the loss of digital assets.

[0004] Therefore, how to improve the security of secret keys has become an important research topic in the field of digital asset protection. Summary of the invention

[0005] The embodiments of the present application provide a data processing method, apparatus, device, medium and program product, which can improve the security of keys by recovering key shards, thereby efficiently protecting digital assets.

[0006] On the one hand, an embodiment of the present application provides a data processing method, the method comprising:

[0007] In response to a key redistribution demand of the first participant set, a key fragment corresponding to a key share held by an i-th participant in the first participant set is obtained; the first participant set includes multiple participants, some of which have lost their key shares; the i-th participant is any participant who has not lost the key share;

[0008] Perform key redistribution processing on the key fragments to generate multiple sub-key shares and commitment information corresponding to the key fragments; the commitment information is used to indicate the authenticity of the public key and key fragments held by the i-th participant, and the key fragments have a matching relationship with the public key;

[0009] Broadcasting the public key and commitment information corresponding to the secret key to the second set of participants for verification, so that the participants in the second set of participants return the verification results;

[0010] If the verification result indicates that both the public key and the commitment information are successfully verified, a sub-key share is allocated to the jth participant in the second party set based on multiple sub-key shares, so that the jth participant becomes a new participant holding the secret key; the jth participant is any participant in the second party set.

[0011] In the embodiment of the present application, the i-th participant in the first participant set who has not lost the secret key share, when determining that the first participant set has a need for key redistribution (such as one or more participants in the first participant set have lost their secret key shares), can first calculate the secret key fragments corresponding to the secret key share based on the secret key share it holds, and the secret key fragments are part of the key; then, the i-th participant performs key redistribution processing on the secret key fragments to generate multiple sub-secret key shares and commitment information. Further, the i-th participant first broadcasts the public key and commitment information corresponding to the secret key to the second participant set, so that the participants in the second participant set first verify the public key and commitment information, so as to ensure that the i-th participant is not a malicious party, thereby maintaining data security; when the i-th participant receives the verification result returned by the second participant set, and the verification result is a successful verification, the i-th participant then allocates a sub-secret key share to the j-th participant in the second participant set based on multiple sub-secret key shares, so that the j-th participant is called a new participant holding the secret key based on the allocated sub-secret key share. It can be seen that when the embodiment of the present application detects that there is a need for key redistribution in the first set of participants, it can help restore the original number of key shares based on the key shares held by the i-th participant, thereby ensuring the security of the key. For example, if the key was originally divided into 3 key shares, but one key share is lost, the key retrieval capability provided by this solution can be used to restore 3 key shares from only 2 key shares left after the loss, thereby ensuring the security of the key.

[0012] On the other hand, an embodiment of the present application provides a data processing device, the device comprising:

[0013] an acquisition unit, configured to, in response to a key redistribution demand of a first set of participants, acquire a key fragment corresponding to a key share held by an i-th participant in the first set of participants; the first set of participants includes a plurality of participants, some of which have lost their key shares; the i-th participant is any participant that has not lost its key share;

[0014] a processing unit, configured to perform key redistribution processing on the key fragments, and generate a plurality of sub-key shares and commitment information corresponding to the key fragments; the commitment information is used to indicate the authenticity of the public key and the key fragments held by the i-th participant, and that the key fragments have a matching relationship with the public key;

[0015] The processing unit is further used to broadcast the public key and the commitment information corresponding to the secret key to the second set of participants for verification processing, so that the participants in the second set of participants return the verification results;

[0016] The processing unit is also used to allocate a sub-key share to the j-th participant in the second party set based on multiple sub-key shares if the verification result indicates that the verification of both the public key and the commitment information is successful, so that the j-th participant becomes a new participant holding the secret key; the j-th participant is any participant in the second party set.

[0017] In one implementation, the conditions for generating the key redistribution requirement of the first set of participants include:

[0018] If the number of participants in the first party set who have lost their secret key shares is less than or equal to the signature threshold associated with the first party set, it is determined that the first party set has a need for secret key redistribution;

[0019] Among them, the signature threshold is used to indicate the maximum allowed number of lost key shares in the first set of participants; if the number of participants in the first set of participants who have lost key shares is greater than the signature threshold, the number of participants in the first set of participants who have not lost key shares does not meet the number requirement of participants required for the negotiated signature.

[0020] In one implementation, the processing unit, when used to obtain the key fragment corresponding to the key share held by the i-th participant in the first participant set, is specifically used to:

[0021] Obtaining a Lagrange interpolation polynomial corresponding to the secret key; the independent variable of the Lagrange interpolation polynomial is the participant identifier of the participant in the first participant set, and the dependent variable of the Lagrange interpolation polynomial is the secret key share held by the participant in the first participant set;

[0022] Obtain the party identifiers of other parties in the first party set, except the i-th party, that participate in the negotiation and signature;

[0023] Based on the party identifiers of other parties participating in the negotiated signature, the party identifier of the ith party, and the Lagrangian interpolation polynomial corresponding to the secret key, calculate the Lagrangian interpolation coefficient of the secret key share held by the ith party;

[0024] According to the secret key share held by the ith participant and the Lagrange interpolation coefficient, a secret key fragment corresponding to the secret key share held by the ith participant is obtained; wherein the secret key fragment held by the ith participant is one of multiple secret key fragments constituting the secret key.

[0025] In one implementation, the processing unit is used to perform key redistribution processing on the key fragments to generate multiple sub-key shares and commitment information corresponding to the key fragments, specifically for:

[0026] Obtaining a signature threshold associated with the first party set and the number of parties included in the second party set;

[0027] Based on the Lagrangian interpolation algorithm, the signature threshold and the number of participants included in the second participant set, a Lagrangian interpolation polynomial corresponding to the secret key fragment held by the i-th participant is constructed;

[0028] Obtaining the party identifier of each party to which the sub-key share is to be allocated in the second party set, and inputting the party identifier of each party into the Lagrange interpolation polynomial corresponding to the key fragment, to generate a plurality of sub-key shares corresponding to the key fragment; the party identifier and the sub-key share have a corresponding relationship; and,

[0029] Based on the Lagrange interpolation polynomial corresponding to the secret key fragment, the commitment information of the secret key fragment is generated.

[0030] In one implementation, the processing unit is configured to allocate a sub-key share to a j-th participant in the second set of participants based on a plurality of sub-key shares if the target verification result indicates that both the public key and the commitment information are successfully verified, specifically to:

[0031] Get the first timeout limit;

[0032] If the target verification results returned by each participant in the second party set to which the sub-key shares are to be allocated are received within the first timeout period, and each target verification result indicates that the verification of both the public key and the commitment information is successful, then the sub-key share among the multiple sub-key shares that corresponds to the participant identification of the j-th participant in the second party set is allocated to the j-th participant.

[0033] In one implementation, the processing unit is further configured to:

[0034] If at least one of the participants to be allocated sub-key shares in the second participant set does not return the target verification result within the first timeout period, or there is a target verification result indicating that the verification of at least one of the public key and the commitment information has failed, then a reallocation prompt message is output;

[0035] The reallocation prompt message is used to prompt that the key reallocation has failed.

[0036] In one implementation, the processing unit is further configured to:

[0037] Get the second timeout limit;

[0038] If a share confirmation message is received from each participant in the second participant set to be allocated a sub-key share within the second timeout period, the secret key share held by the i-th participant is destroyed; the share confirmation message is used to indicate that the participant has successfully verified the received sub-key share;

[0039] The i-th participant is removed from the first participant set.

[0040] In the embodiment of the present application, when the i-th participant detects that there is a need for key redistribution in the first participant set, it can help restore the original number of key shares based on the key shares held by the i-th participant, thereby ensuring the security of the key. For example, if the key was originally divided into 3 key shares, but one key share is lost, the key retrieval capability provided by this solution can be used to restore 3 key shares from only 2 key shares left after the loss, thereby ensuring the security of the key.

[0041] On the other hand, an embodiment of the present application provides a data processing method, the method comprising:

[0042] Receiving the public key and commitment information broadcasted by the i-th participant in the first participant set; wherein the i-th participant is a participant that has not lost the secret key share among the multiple participants included in the first participant set; the commitment information is obtained by the i-th participant performing a secret key redistribution process on the secret key fragments corresponding to the secret key share held by the i-th participant;

[0043] Verifying the public key and the commitment information respectively to obtain verification results, and returning the verification results to the i-th participant; when the i-th participant determines that the verification result indicates that the participants in the second set of participants have successfully verified the public key and the commitment information, the j-th participant in the second set of participants is allocated a sub-key share based on the multiple sub-key shares;

[0044] Receive the sub-key share sent by the i-th participant, and based on the sub-key share, treat the j-th participant in the second party set as a new participant holding the secret key.

[0045] In an embodiment of the present application, the jth participant in the second participant can first receive the public key and commitment information sent by the participant in the first participant set who has not lost the secret key share, such as the i-th participant; then, verify the public key and commitment information to determine that the identity of the i-th participant is safe and reliable; finally, the j-th participant obtains the sub-secret key share from the i-th participant, and uses the j-th participant as a new participant holding the secret key based on the sub-secret key share. It can be seen that in the process of secret key redistribution in the embodiment of the present application, by first verifying the identity of the i-th participant to whom the sub-secret key share is to be sent, and then sending the sub-secret key share after the verification is successful, it can ensure that the j-th participant obtains the sub-secret key share from the safe i-th participant, thereby ensuring the correctness of the secret key share obtained based on the sub-secret key share, thereby avoiding the malicious party from destroying the secret key and effectively ensuring the security of the secret key.

[0046] On the other hand, an embodiment of the present application provides a data processing device, the device comprising:

[0047] A receiving unit, configured to receive a public key and commitment information broadcasted by an i-th participant in a first participant set; wherein the i-th participant is a participant that has not lost a secret key share among multiple participants included in the first participant set; and the commitment information is obtained by the i-th participant performing a secret key redistribution process on the secret key fragments corresponding to the secret key share held by the i-th participant;

[0048] a processing unit, configured to perform verification processing on the public key and the commitment information respectively, obtain verification results, and return the verification results to the i-th participant; so that when the i-th participant determines that the verification result indicates that the participants in the second participant set have successfully verified the public key and the commitment information, the i-th participant allocates a sub-key share to the j-th participant in the second participant set based on the multiple sub-key shares;

[0049] The processing unit is also used to receive the sub-key share sent by the i-th participant, and based on the sub-key share, take the j-th participant in the second participant set as a new participant holding the secret key.

[0050] In one implementation, the number of participants in the first set of participants who have not lost their secret key shares is multiple; the commitment information includes a public key; and the processing unit is used to verify the public key and the commitment information respectively, and when the target verification result is obtained, specifically to:

[0051] Obtaining the public key broadcasted by each participant in the first participant set who has not lost the secret key share, and verifying whether the public keys broadcasted by each participant are the same, and generating a first verification result; wherein, if the public keys broadcasted by each participant are the same, the first verification result indicates that the verification of the public key is successful; if the public key sent by a participant is different from the public keys sent by other participants, the first verification result indicates that the verification of the public key fails;

[0052] and, verifying whether a public key sent by the i-th party in the first party set and a public key included in the commitment information sent by the i-th party are the same, and generating a second verification result; wherein, if the public key sent by the i-th party and the public key included in the commitment information sent by the i-th party are the same, the second verification result indicates that the verification of the commitment information sent by the i-th party is successful;

[0053] Based on the first verification result and the second verification result, a target verification result is generated.

[0054] In one implementation, the commitment information includes a signature threshold associated with the first set of participants, and the number of participants included in the first set of participants;

[0055] The processing unit is configured to, when taking the jth party in the second party set as a new party holding the secret key based on the sub-secret key share, specifically:

[0056] Based on the Lagrange interpolation algorithm, the signature threshold and the number of participants included in the first participant set, a Lagrange interpolation polynomial of the secret key is constructed;

[0057] Verify whether the received sub-key share is the coordinate point in the Lagrange interpolation polynomial corresponding to the key;

[0058] If yes, determine the secret key share held by the jth participant based on the sub-secret key share;

[0059] Generate a share confirmation message based on the secret key share held by the jth participant, and send the share confirmation message to each participant in the first set of participants and each participant in the second set of participants; and,

[0060] If a share confirmation message is received from each participant in the second participant set, the jth participant in the second participant set is regarded as a new participant holding the secret key.

[0061] In one implementation, the processing unit, when determining the secret key share held by the j-th participant based on the sub-secret key share, is specifically configured to:

[0062] Obtain the sub-secret key shares sent by the other participants in the first party set who have not lost the secret key shares except the i-th participant;

[0063] Add up the received sub-key shares to get the added key share;

[0064] The added secret key share is taken as the secret key share held by the jth participant.

[0065] In an embodiment of the present application, the jth participant in the second participant can first receive the public key and commitment information sent by the participant in the first participant set who has not lost the secret key share, such as the i-th participant; then, verify the public key and commitment information to determine that the identity of the i-th participant is safe and reliable; finally, the j-th participant obtains the sub-secret key share from the i-th participant, and uses the j-th participant as a new participant holding the secret key based on the sub-secret key share. It can be seen that in the process of secret key redistribution in the embodiment of the present application, by first verifying the identity of the i-th participant to whom the sub-secret key share is to be sent, and then sending the sub-secret key share after the verification is successful, it can ensure that the j-th participant obtains the sub-secret key share from the safe i-th participant, thereby ensuring the correctness of the secret key share obtained based on the sub-secret key share, thereby avoiding the malicious party from destroying the secret key and effectively ensuring the security of the secret key.

[0066] On the other hand, an embodiment of the present application provides a computer device, the device comprising:

[0067] A processor for loading and executing computer programs;

[0068] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the data processing method is implemented.

[0069] On the other hand, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program, and the computer program is suitable for being loaded by a processor and executing the above-mentioned data processing method.

[0070] On the other hand, an embodiment of the present application provides a computer program product or a computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and when the computer instructions are executed by the processor, the above-mentioned data processing method is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0072] Figure 1 is a schematic diagram of a key redistribution provided by an exemplary embodiment of the present application;

[0073] Figure 2It is a flowchart of a data processing method provided by an exemplary embodiment of the present application;

[0074] Figure 3 It is a flowchart of an exemplary embodiment of the present application providing a method for an i-th participant to receive a verification result under a first timeout condition;

[0075] Figure 4 It is a flowchart of a method for an i-th participant to receive a share confirmation message under a second timeout condition provided by an exemplary embodiment of the present application;

[0076] Figure 5 is a flowchart of another data processing method provided by an exemplary embodiment of the present application;

[0077] Figure 6 is a flowchart of another data processing method provided by an exemplary embodiment of the present application;

[0078] Figure 7 It is a flowchart of an identity verification stage provided by an exemplary embodiment of the present application;

[0079] Figure 8 It is a flowchart of a key verification result provided by an exemplary embodiment of the present application;

[0080] Fig. 9 is a structural schematic diagram of a data processing device provided by an exemplary embodiment of the present application;

[0081] Fig.10 is a schematic diagram of the structure of another data processing device provided by an exemplary embodiment of the present application;

[0082] Fig.11 It is a structural diagram of a computer device provided by an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0083] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0084] In the embodiments of the present application, blockchain technology is involved. Blockchain is a new application mode of computer technologies such as distributed data storage, point-to-point transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods, each of which contains information about a batch of network transactions, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain is maintained by blockchain nodes in the blockchain network; the blockchain network often contains multiple blockchain nodes, each of which holds the same blockchain to achieve maintenance and management of the blockchain. In actual applications, if a user wants to put data on the chain, the user can upload the data to a blockchain node in the blockchain network through the device he holds. At this time, the blockchain node and other blockchain nodes in the blockchain network will verify the data and generate blocks based on the data after the verification is successful; and the blockchain nodes in the blockchain network will reach a consensus on the block, so that the block can be connected to the blockchain after the consensus is successful, so as to achieve the chain of the transaction and ensure the security of the transaction.

[0085] Furthermore, in order to ensure the security of transactions in the blockchain network and implement transaction signing or decryption, etc., it is also necessary to rely on the resource client in the blockchain technology. Among them, the resource client can be used to implement the resource management business function, and based on the resource management business function, realize the communication connection with the decentralized application client. In other words, the resource client is a tool for managing and storing user digital resources; for example, digital resources can be transferred to other accounts based on the resource client; for another example, digital resources transferred from other accounts can be received based on the resource client. In form, the resource client can be a hardware device or a software program.

[0086] In this application, the resource client of the target object can establish a communication connection with the decentralized application client to realize the authorized login and other related operations of the target object. It is understandable that with the widespread deployment of various decentralized applications (Decentralized application, Dapp) on the blockchain, the activities of users on the blockchain have increased; when using decentralized applications, general users can use the blockchain key management tool to log in, and the address in the blockchain key management tool corresponds to a user on the blockchain. The decentralized application can obtain the user address from the key management tool through some interfaces, and in order to solve the problem that the Dapp background cannot trust the user address used when logging in to the decentralized application. In short, the resource client has functions such as blockchain private key generation, signature transaction (collection, transfer and other transactions) and blockchain address balance query. In form, the resource client is similar to an account of an online bank, which can be used to keep the user's private key in the blockchain network, etc.; the user's identity is identified by the private key on the blockchain, and the user's assets are managed by the private key. In addition, for operations such as the transfer, destruction, and transfer of digital assets, the correct transaction blockchain will only be executed by using the user's private key to sign the transaction to confirm the operation. The forged signature blockchain will be rejected and prompted with a failure, thereby ensuring the safe storage, transfer, and use of digital assets on the blockchain.

[0087] As the security requirements for keys (or secret keys) increase, the MPC (Multi-Party Computation) tool has been proposed. MPC allows two (or more) parties to jointly calculate the output of a function without revealing their input information. In the digital signature scenario, the MPC tool is a digital signature protocol used to authorize transactions; specifically, participants who hold a key shard or a key share of a secret key can negotiate a signature without revealing the key share they hold. It can be seen that compared to a single participant holding a complete secret key, the distributed storage of key shards provided by the MPC tool provides higher security for transactions, and effectively avoids security issues such as single point failures by distributing control rights to achieve the purpose of dispersing risks or improving disaster preparedness.

[0088] Among them, the mpc tool mainly relies on the threshold signature scheme (TSS) algorithm to implement the multi-party negotiation signature process; the threshold signature can also be called a threshold signature (or signature threshold), which is an encrypted digital signature protocol. The threshold signature algorithm supports a group of participants with signing authority in the set of participants holding the secret key shard (the participants with signing authority can be called signers at this time); the signer can negotiate and sign the transaction on behalf of the entire set of participants without exposing the secret key shards held by itself, which can greatly improve the security and privacy of the digital signature system. In the specific process of the threshold signature, the number of all participants can be defined as n and the threshold threshold t, then only at least t+1 participants need to participate in the negotiation signature and generate a public key together to achieve the negotiation signature for the transaction; that is, the threshold signature algorithm can be a t / n threshold signature method. In detail, the threshold signature algorithm mainly implements the negotiation signature process described above through the KeyGen algorithm and the Sign algorithm. Among them, the KeyGen algorithm and the Sign algorithm are distributed among multiple parties; the participants of the KeyGen algorithm are the number of participants in the entire mpc scenario, and the number of participants of the Sign algorithm is the threshold t+1.

[0089] It should be noted that the computer devices held by the above-mentioned participants can be terminals with application deployment, or servers corresponding to a certain platform (such as a browser); for example, the computer devices held by participants 1 and 2 are terminals, and the computer devices held by the participants are servers, etc. Among them, whether the computer device is a terminal or a server is customized by the user according to the storage requirements of the secret key shards; if the user wants to store the secret key share in the application, then the computer device can be a terminal at this time, and if the user wants to store the secret key share in a certain platform, then the computer device can be a server corresponding to the platform.

[0090] Furthermore, (1) terminals may include but are not limited to: smart phones (such as Android phones, iOS phones, etc.), tablet computers, portable personal computers, mobile Internet devices (Mobile Internet Devices, MID for short), smart TVs, car-mounted devices, head-mounted devices and other terminal devices. (2) Applications deployed in terminals refer to computer programs for completing one or more specific tasks; including but not limited to: ① Clients, so-called clients (also known as application clients, APP clients) refer to applications installed and running in terminals; ② Installation-free applications, that is, applications that can be used without downloading and installing. Such applications are also commonly known as mini-programs, which usually run as sub-programs in the client. ③ Web applications opened through a browser; and so on. Of course, applications of the same type can be divided into applications with different functions according to their application functions, such as game applications, communication applications, audio and video applications, and payment applications, etc. (3) The server can be an independent physical server or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0091] It should also be noted that the terminal and the server can be directly or indirectly connected via wired or wireless communication, and this application does not limit this. Optionally, the above-mentioned terminal and / or server can be a blockchain node in the aforementioned blockchain network, directly participating in the transaction on-chain storage. Optionally, the above-mentioned terminal and / or server can also be an off-chain device connected to the blockchain network, so that the terminal and / or server can interact with the blockchain node in the blockchain network to realize the transaction on-chain storage.

[0092] For ease of explanation, the embodiment of the present application is explained using the example of the number of participants in the participant set n=3 and the threshold signature t=1, and does not limit the number of participants and the threshold signature in the actual application scenario of the embodiment of the present application, which is specially explained here.

[0093] In actual applications, there may be a situation where one or more participants in the set of participants cannot participate in the negotiation signature; for example, the device held by the participant cannot participate in the negotiation signature due to some reasons (such as network disconnection, hardware damage or other reasons), such as the server is unavailable or runs away; for example, the secret key share held by the participant is lost; etc. In this case, if the number of remaining participants who can participate in the negotiation signature is exactly t+1, then the set of participants is likely to lose the secret key share again, or the device is unavailable, resulting in the number of participants participating in the negotiation signature being less than t+1, resulting in the loss of the secret key, and then the loss of data on the chain.

[0094] Based on this, an embodiment of the present application proposes a data processing solution, specifically a key redistribution solution based on decentralization; the solution provides a shard refresh mechanism for the mpc tool. In a scenario where the threshold is recoverable (that is, the number of parties that can participate in the negotiated signature is greater than or equal to t+1), the single key shard held by the party holding the key share is refreshed, so that the user end can regain the original number of key shards, and the original key shards are deleted and invalidated, thereby restoring the security of the shards.

[0095] This scheme mainly realizes the function of shard refresh or redistribution based on the threshold capability of Shamir secret sharing. Specifically, Shamir secret sharing constructs a t-order Shamir polynomial through the threshold signature t of the first participant set, takes the secret key S to be shared as the constant term of the Shamir polynomial, and divides the secret key corresponding to the secret key into n parts and gives them to the n participants in the first participant set; when the number of secret key shards is the largest (that is, n) or equal to t+1, the secret key can be obtained. Among them, the order of the Shamir polynomial is t=1, and the private key shares x_1, x_2, and x_3 are the values ​​of y1 (i.e., the secret key share held by participant 1), y2 (i.e., the secret key share held by participant 2), and y3 (i.e., the secret key share held by participant 3) corresponding to the independent variables x=1 (representing participant 1 with participant identification 1), x=2 (representing participant 2 with participant identification 2), and x=3 (representing participant 3 with participant identification 3) on the Shamir polynomial. Among them, according to the principle of polynomials, for a polynomial of order 1 (a straight line on the x-axis and y-axis), any two points on the polynomial (such as the point on the polynomial corresponding to participant 1 is represented as (x_1, y1)) can restore the polynomial. Therefore, through the two key shards held by the remaining two participants in the first participant who have not lost the key share, Shamir secret sharing can be performed separately, and the corresponding key share can be distributed to the corresponding second participant set; in this way, each participant in the second participant set calculates its own key shard locally based on the sub-key share sent by the first participant set that has not lost the key share, and keeps the complete public key unchanged, thereby realizing the refresh of the original key in the first participant set, that is, refreshing the remaining 2 key shards held by the first participant set to the new 3 key shards in the second participant set, and invalidating the old 2 key shards.

[0096] It can be seen that the first party set involved in the embodiment of the present application is a set of parties that originally hold secret keys, and the parties in the party set hold secret key shares of the secret keys. When there is a need to redistribute secret keys in the first party set (such as a party in the first party set loses its secret key share), the user can reselect one or more parties to form a second party set, so as to restore multiple secret key shares corresponding to the complete secret key in the second party set. Among them, the parties in the first party set and the parties in the second party set are all or partially the same, or the parties in the first party set and the parties in the second party set are all different.

[0097] A schematic diagram of the key redistribution architecture can be found in Figure 1 ;like Figure 1As shown, the first participant set includes participants 101, 102 and 103, where participant 101 holds key shard 1 of the secret key, participant 2 holds key shard 2 of the secret key and participant 3 holds key shard 3 of the secret key. If participant 2 loses key shard 2 due to some reasons (such as hardware damage, network connection failure or key shard theft, etc.), participant 1 in the first participant set that has not lost the key shard can perform Shamir secret sharing based on key shard 1 it holds, and obtain three sub-key shares; similarly, participant 3 in the first participant set that has not lost the key shard can perform Shamir secret sharing based on key shard 3 it holds, and obtain three sub-key shares. Then, participant 1 in the first participant set sends the three sub-key shares to the three participants in the second participant set respectively; similarly, participant 3 in the second participant set sends the three sub-key shares to the three participants in the second participant set respectively. Finally, any participant in the second set of participants can generate its own secret key share based on the two sub-secret key shares it received, thereby recovering the number of secret keys in the second set of participants, effectively ensuring the security of the secret keys and thus ensuring the security of the on-chain data.

[0098] It should be noted that, in addition to the scenario described above in which a participant in the first set of participants loses a key fragment, the key redistribution scenario may also include a scenario in which a user has a need for key redistribution. For example, within a first time period, the user intends to distribute the key to the first set of participants, that is, the key distribution corresponding to the key is held by each participant in the first set of participants; if within a second time period, the user intends to distribute the key to the second set of participants (such as the user wants to switch participants), it is determined that the user has a need for key redistribution, and at this time, the data processing solution provided in the embodiment of the present application can be used to perform key redistribution. Among them, the first time period and the second time period mentioned above are different.

[0099] It should also be noted that, ① considering that the first party set is a party set in which the secret key fragments are lost, the embodiment of the present application may refer to it as old members, and the parties in the old members may be represented as old party; similarly, the second party set is a party set to be allocated sub-secret key shares, and the embodiment of the present application may refer to it as new members, and the parties in the new members may be represented as new party. Furthermore, all or part of the parties in the second party set may be the same as the parties in the first party set; for example, the first party set includes party 1, party 2, and party 3, and the second party set may include party 1 in the first party set, and may also include party 4 and party 5 that are not included in the first party set; the parties in the second party set may be specified by the user, and there is no limitation on this. ② The number of participants in the second set of participants can be the same as the number of participants in the first set of participants. In this implementation, the secret key shards are restored to the original number; of course, the number of participants in the second set of participants can also be different from the number of participants in the first set of participants. For example, the number of participants in the first set of participants is 3, but the user can specify 4 participants to form the second set of participants. In this implementation, not only can the recovery of the secret key shards be achieved, but also the user's need to redefine the number of participants during the redistribution process can be met. ③ The collection and processing of relevant data in the embodiments of this application should be strictly in accordance with the requirements of relevant national laws and regulations. The acquisition of personal information requires the knowledge or consent of the individual subject (or the legal basis for the acquisition of information), and the subsequent use and processing of data shall be carried out within the scope of authorization of laws and regulations and the subject of personal information. For example, when the embodiments of this application are applied to specific products or technologies, such as obtaining the secret key share of the participant, the user's permission or consent is required, and the collection, use and processing of relevant data (such as the collection and release of the barrage posted by the object, etc.) need to comply with the relevant laws, regulations and standards of relevant countries and regions.

[0100] Based on the data processing scheme described above, the embodiment of the present application proposes a more detailed data processing method. The data processing method proposed in the embodiment of the present application will be described in detail below in conjunction with the accompanying drawings.

[0101] Figure 2 A flow chart of a data processing method provided by an exemplary embodiment of the present application is shown. The data processing method can be executed by a computer device, specifically by a computer device held by the i-th participant in the first participant set who has not lost the secret key share; wherein the first participant set includes multiple participants, some of which have lost their secret key shares, and the i-th participant is any participant in the first participant set who has not lost the secret key share. Figure 2As shown, the data processing method may include but is not limited to steps S201-S204:

[0102] S201: In response to a key redistribution demand of a first set of participants, obtain key fragments corresponding to a key share held by an i-th participant in the first set of participants.

[0103] Among them, the conditions for generating the need for key redistribution of the first set of participants may include but are not limited to: ① There is a participant in the first set of participants who loses the key share he holds; in this case, it is not limited to the number of lost key shares, that is, as long as there is key loss in the first set of participants, it is determined that the first set of participants has a need for key redistribution.

[0104] ② If the number of participants in the first set of participants who have lost their secret key shares is less than or equal to the signature threshold associated with the first set of participants (and the threshold t mentioned above), it is determined that the first set of participants has a secret key distribution demand; wherein the signature threshold t indicates the maximum number of secret key shares allowed to be lost by the first set of participants. If the number of participants in the first set of participants who have lost their secret key shares is greater than the signature threshold, the number of participants in the first set of participants who have not lost their secret key shares does not meet the number of participants required for the negotiated signature. For example, assuming that the signature threshold associated with the first set of participants is t=2, then it is determined that the number of participants that need to negotiate the signature of the first set of participants is t+1=3, and the number of participants in the first set of participants who hold secret key shares is n=5. Optionally, if one secret key share is lost in the first set of participants, that is, the number of participants who have lost a secret key share is less than the signature threshold t, then the number of participants who have not lost a secret key share in the first set of participants is 4, which still meets the number of participants required for the negotiated signature; however, in order to maintain the security of the secret key and avoid the security issues caused by further loss of the secret key, the first set of participants can still generate a demand for key redistribution. Optionally, if two secret key shares are lost in the first set of participants, that is, the number of lost secret key shares is equal to the signature threshold t, then the number of participants who have not lost a secret key share in the first set of participants is 3, then it is determined that the first set of participants can still negotiate the signature, but if the secret key share continues to be lost, it will lead to the loss of the secret key, and thus the loss of the on-chain assets, so the first set of participants generates a demand for key redistribution to improve the security of the secret key.

[0105] ③ A computer device held by a participant in the first participant set is unavailable; the present embodiment of the application does not limit the reasons for the unavailability of the computer device. For example, the computer device may be unavailable due to hardware damage; for another example, the computer device may be unavailable due to inability to access the communication network; for another example, the computer device may be unavailable due to insufficient power; and so on.

[0106] When a key redistribution requirement is generated in the first set of participants, the i-th participant in the first set of participants who has not lost the key share (any one of the participants in the first set of participants who have not lost the key share, and each participant who has not lost the key share performs the operation performed by the i-th participant) can respond to the key redistribution requirement of the first set of participants and obtain the key fragment corresponding to the key share held by the i-th participant. Considering that the embodiment of the present application is based on the principle of Shamir secret sharing to achieve redistribution; the key share x_i held by the i-th participant is the dependent variable yi output by the Shamir polynomial when the independent variable is the participant identifier of the i-th participant in the Shamir polynomial. Based on the basic principle of polynomials, it is known that the secret key cannot be directly obtained based on the secret key share held by the participants in the first set of participants who have not lost the secret key share; therefore, the embodiment of the present application supports the Lagrange interpolation algorithm (a polynomial interpolation method) to calculate the multiplication coefficient of the Lagrange interpolation for the i-th participant based on the participants in the first set of participants who have not lost the secret key share, so as to determine the secret key fragment w_i corresponding to the secret key share held by the i-th participant through the multiplication coefficient and the secret key share held by the i-th participant. Among them, the secret key fragments corresponding to each participant in the first set of participants are added together to obtain the constant term S of the Shamir polynomial, and the constant term S is the real secret key; that is, the secret key fragment held by the i-th participant is one of the multiple secret key fragments that constitute the secret key.

[0107] The above briefly introduces the calculation principle of the secret key fragment corresponding to the secret key share held by the i-th participant. The specific implementation process of calculating the secret key fragment w_i based on the Lagrangian interpolation algorithm may include but is not limited to: first, obtain the Lagrangian interpolation polynomial corresponding to the secret key; the independent variable of the Lagrangian interpolation polynomial (which can be understood as the horizontal axis x in the coordinate axis) is the participant identification of the participant in the first participant set, and the dependent variable of the Lagrangian interpolation polynomial (which can be understood as the vertical axis y in the coordinate axis) is the secret key share held by the participant in the first participant set. Then, obtain the participant identification of other participants in the first participant set except the i-th participant and participating in the negotiation signature. Secondly, based on the participant identification of other participants participating in the negotiation signature, the participant identification of the i-th participant, and the Lagrangian interpolation polynomial corresponding to the secret key, calculate the Lagrangian interpolation coefficient of the secret key share held by the i-th participant. Finally, according to the secret key share and Lagrange interpolation coefficient held by the ith participant, the secret key fragment corresponding to the secret key share held by the ith participant is obtained; specifically, the secret key fragment w_i corresponding to the secret key share x_i held by the ith participant = Lagrange interpolation coefficient * secret key share x_i.

[0108] S202: Perform key redistribution processing on the key fragments to generate multiple sub-key shares and commitment information corresponding to the key fragments.

[0109] After the i-th participant obtains the secret key fragment wi based on the above steps, the secret key fragment w_i held by it can be used as the "secret key" to be stored by multiple parties. At this time, secret sharing can be performed on the "secret key" to distribute the multiple sub-secret key shares corresponding to w_i to each participant in the second set of participants. It should be noted that in order to improve the security of secret sharing, the embodiment of the present application supports the use of an improved algorithm of Shamir's secret sharing - the verifiable key sharing (Feldmanverifiable secret sharing, Feldman VSS) algorithm to achieve secret sharing for the secret key fragment w_i. Among them, the Feldman VSS algorithm is improved based on Shamir's secret sharing. Shamir's secret sharing contains an assumption that all participants, including the key distributor, must be honest; the Feldman VSS algorithm adds a verifiable part compared to the Shamir secret sharing algorithm to improve the anti-deception ability. In the MPC tool scenario, each participant is a secret distributor of FeldmanVSS, but each participant selects a polynomial, distributes secrets, and provides verifiable commitment information, ensuring decentralized sharing of secrets. Even if there are some malicious parties, the complete secret will not be leaked.

[0110] In a specific implementation, the process of performing key redistribution processing on key fragments based on the Feldman VSS algorithm and generating multiple sub-key shares and commitment information corresponding to the key fragments may include but is not limited to:

[0111] 1) Choose a Lagrange interpolation polynomial for the key fragment w_i.

[0112] Specifically, the signature threshold t associated with the first set of participants and the number of participants n included in the second set of participants are obtained, and based on the Lagrangian interpolation algorithm, the signature threshold t and the number of participants n included in the second set of participants, the Lagrangian interpolation polynomial corresponding to the secret key fragment held by the i-th participant is constructed. In the scenario of the set of participants with t=1 and n=3, the order of the Lagrangian interpolation polynomial is 1, and the constant term is the secret key fragment w_i, and the polynomial coefficients of the Lagrangian interpolation polynomial are random.

[0113] 2) When the independent variable in the Lagrange interpolation polynomial is x=1, 2, 3, ..., n, the value of the dependent variable is the n sub-key shares corresponding to the key fragment w_i.

[0114] As described above, the independent variable of the polynomial is the participant identification of the participant, and the dependent variable of the polynomial is the secret key share held by the participant corresponding to the corresponding participant identification. Therefore, the embodiment of the present application supports first obtaining the participant identification of each participant to be allocated a sub-secret key share in the second participant set; then, the participant identification of each participant is respectively input into the Lagrange interpolation polynomial corresponding to the secret key fragment, and a plurality of sub-secret key shares corresponding to the secret key fragment are generated. It can be seen from the above description process that the participant identification and the sub-secret key share have a corresponding relationship. For example, the party identification of party 1 in the second party set is a, then the party identification a is input into the Lagrange interpolation polynomial, and the output information is the sub-key share a to be allocated to party 1, that is, the party identification a of party 1 and the sub-key share a have a corresponding relationship; similarly, the party identification of party 2 in the second party set is b, then the party identification b is input into the Lagrange interpolation polynomial, and the output information is the sub-key share b to be allocated to party 2, that is, the party identification b of party 2 and the sub-key share b have a corresponding relationship.

[0115] 3) Calculate the commitment information (i.e. Feldman commitment).

[0116] Among them, the commitment information is used to indicate the authenticity of the public key and secret key fragment held by the i-th participant, and the secret key fragment has a matching relationship with the public key (that is, the secret key corresponding to the secret key fragment matches the public key); the role of the commitment information is that the i-th participant promises the participants in the second participant set the correctness of the secret key share (or secret key fragment) and public key information held by it, so that the participants in the second participant set can verify the commitment information to verify the identity of the i-th participant, thereby avoiding the security problems caused by the malicious behavior of the participant to the secret key or on-chain assets. Specifically, according to the principle of the Feldman VSS algorithm, after constructing the Lagrangian interpolation polynomial corresponding to the secret key fragment w_i based on the aforementioned related content, the commitment information of the secret key fragment can be generated based on the polynomial coefficients of the Lagrangian interpolation polynomial. Among them, the commitment information can be expressed as g*, where "*" is the polynomial coefficient in the Lagrangian interpolation polynomial.

[0117] S203: Broadcast the public key and commitment information corresponding to the secret key to the second set of participants for verification, so that the participants in the second set of participants return the verification results.

[0118] The i-th participant in the first party set obtains the commitment information based on the Feldman VSS algorithm, and also obtains the public key corresponding to the secret key, and broadcasts the public key and the commitment information to each participant in the second party set, so that the participants in the second party set can verify the public key and the commitment information, so that the participants in the second party set can authenticate the i-th participant based on the public key and the commitment information, and ensure that the i-th participant is not a malicious participant, thereby ensuring the security of subsequent secret keys.

[0119] S204: If the verification result indicates that both the public key and the commitment information are successfully verified, a sub-key share is allocated to the j-th participant in the second participant set based on multiple sub-key shares, so that the j-th participant becomes a new participant holding the secret key.

[0120] Specifically, if the verification result returned by the second participant in the second participant set indicates that the verification of both the public key and the commitment information is successful, indicating that the second participant confirms that the identity of the i-th participant in the first participant set is correct and safe, then the i-th participant allocates a sub-secret key share to the j-th participant in the second participant set based on the multiple sub-secret key shares obtained in the above steps, so that the j-th participant becomes a new participant holding the secret key, thereby realizing the recovery of the secret key share. The verification result may be returned to the i-th participant in the form of Ack (AckMsg).

[0121] Furthermore, the i-th participant has a time limit for receiving the verification result; only when the verification results sent by each participant in the second participant set are received within the timeout period, and the verification results all indicate that the verification is successful, can it be determined that the second participant set has successfully verified the identity of the i-th participant; this can avoid the i-th participant from being in a state of waiting for reception for a long time, thereby avoiding waste of resources. For the specific implementation process, please refer to Figure 3 ;like Figure 3 As shown, first, the i-th participant can obtain the first timeout period, such as the first timeout period is 60 seconds. The specific duration of the first timeout period can be pre-configured, and the embodiment of the present application does not limit the duration of the first timeout period. Then, if the i-th participant receives the verification results returned by each participant in the second party set to be allocated sub-key shares within the first timeout period, and each verification result indicates that the verification of the public key and the commitment information is successful, indicating that each participant in the second party set has verified that the identity of the i-th participant is correct, then based on the correspondence between the reference party identifier and the sub-key share, the sub-key share in multiple sub-key shares that has a corresponding relationship with the participant identifier of the j-th participant in the second party set can be allocated to the j-th participant. On the contrary, if at least one of the participants to be allocated the sub-key share in the second participant set does not return the verification result within the first timeout period, or there is a verification result indicating that the verification of at least one of the public key and the commitment information has failed, then the reallocation prompt information is output; the reallocation prompt information is used to prompt that the reallocation of the key has failed. At this time, the i-th participant can output the reallocation prompt information to the user, so that the user can customize whether to restart the reallocation procedure. It is worth noting that the above-mentioned judgment process can be specifically as follows Figure 3 The two-step verification shown; wherein: the first step is to determine whether the verification results sent by all participants in the second participant set whose sub-key shares are to be allocated have been received; the second step is to determine whether the verification results sent by each participant are successful; this two-stage verification method can effectively improve the verification efficiency, save verification resources, and increase the verification speed.

[0122] Furthermore, after receiving the sub-key share sent by the ith participant, the participant in the second party set (such as the jth participant) will verify the binding relationship between the sub-key share and the commitment information based on the cached commitment information and the sub-key share. Specifically, it will verify the authenticity of the sub-key share based on the commitment information to ensure the authenticity of the received sub-key share, thereby ensuring the reliability of the key share subsequently generated based on the sub-key share; only after the verification of the sub-key share is successful, will subsequent operations be performed to make the jth participant a new participant holding the key.

[0123] In the above case, the i-th participant will also obtain the second timeout period, and wait to receive a share confirmation message (such as an Ack message) from the second set of participants within the second timeout period. The share confirmation message is used to indicate that the participants in the second set of participants have successfully verified the received sub-key shares. For the specific implementation process, please refer to Figure 4 ;like Figure 4 As shown, if a share confirmation message is received from each participant in the second set of participants to be allocated a sub-secret key share within the second timeout period, indicating that each participant in the second set of participants has successfully verified the sub-secret key share, the secret key share held by the i-th participant is destroyed; the i-th participant is withdrawn from the first set of participants, specifically from the Shamir secret sharing protocol. On the contrary, if a share confirmation message is not received from one or more participants in the second set of participants within the second timeout period, the i-th participant can output a prompt message to the user, so as to prompt the user through the prompt message that the redistribution has failed and whether the redistribution needs to be restarted, so that the user can intuitively and timely perceive the redistribution result.

[0124] In summary, the i-th participant in the first participant set who has not lost the secret key share, when determining that the first participant set has a need for key redistribution (such as one or more participants in the first participant set have lost their secret key shares), can first calculate the secret key fragments corresponding to the secret key share based on the secret key share it holds, and the secret key fragments are part of the key; then, the i-th participant performs key redistribution processing on the secret key fragments to generate multiple sub-secret key shares and commitment information. Further, the i-th participant first broadcasts the public key and commitment information corresponding to the secret key to the second participant set, so that the participants in the second participant set can first verify the public key and commitment information, so as to ensure that the i-th participant is not a malicious party, thereby maintaining data security; when the i-th participant receives the verification result returned by the second participant set, and the verification result is a successful verification, the i-th participant then allocates a sub-secret key share to the j-th participant in the second participant set based on multiple sub-secret key shares, so that the j-th participant becomes a new participant holding the secret key based on the allocated sub-secret key share. It can be seen that when the embodiment of the present application detects that there is a need for key redistribution in the first set of participants, it can help restore the original number of key shares based on the key shares held by the i-th participant, thereby ensuring the security of the key. For example, if the key was originally divided into 3 key shares, but one key share is lost, the key retrieval capability provided by this solution can be used to restore 3 key shares from only 2 key shares left after the loss, thereby ensuring the security of the key.

[0125] Figure 5A flowchart of another data processing method provided by an exemplary embodiment of the present application is shown. The data processing method can be executed by a computer device, specifically, by a computer device held by the jth participant in the second participant set to be allocated a sub-key share; the jth participant is any participant in the second participant set. Figure 5 As shown, the data processing method may include but is not limited to steps S501-S503:

[0126] S501: Receive the public key and commitment information broadcast by the i-th participant in the first participant set.

[0127] S502: Verify the public key and commitment information respectively to obtain verification results, and return the verification results to the i-th participant.

[0128] In steps S501-S502, the jth participant in the second participant set, upon receiving the public key and commitment information broadcast by the ith participant in the first participant set, can verify the correctness of the public key and commitment information to achieve the effect of verifying the correctness and reliability of the ith participant's identity, thereby ensuring that the jth participant subsequently obtains the sub-secret key share from the correct participant, thereby ensuring the security of the secret key and on-chain assets. In a specific implementation, the number of participants in the first participant set who have not lost the secret key share is multiple, and the multiple participants include the ith participant; and the commitment information broadcast by the ith participant includes the public key; then the process of the jth participant performing verification on the public key and commitment information may include but is not limited to:

[0129] 1) Verify the consistency of the public keys broadcast by each participant who has not lost the secret key share from the first set of participants. Specifically, the jth participant can obtain the public key broadcast by each participant who has not lost the secret key share in the first set of participants, and verify whether the public keys broadcast by each participant are the same, and generate a first commitment verification result. Among them, considering that the public keys held by each participant in the same set of participants should be the same, therefore, if the public keys broadcast by each participant in the first set of participants are the same, it means that each participant is a correct participant holding the correct public key, and the first commitment verification result indicates: the verification of the public key is successful.

[0130] 2) Verify the commitment information. Specifically, verify whether the public key broadcast by each participant in the first party set is consistent with the public key in the corresponding commitment information; if they are consistent, further verify the reliability of the participants in the first party set. Taking the i-th participant in the first party set as an example, it is possible to verify whether the public key sent by the i-th participant in the first party set is the same as the public key included in the commitment information sent by the i-th participant, and generate a second credential verification result; wherein, if the public key sent by the i-th participant is the same as the public key included in the commitment information sent by the i-th participant, the second credential verification result indicates that the verification of the commitment information sent by the i-th participant is successful.

[0131] In this way, the jth participant can generate a target verification result based on the first verification result and the second verification result. If the first verification result and / or the second verification result have a verification failure, the target verification result indicates that the verification of the public key and / or the commitment information has failed; conversely, if the first verification result and the second verification result are both verification successes, the target verification result indicates that both the public key and the commitment information have been verified successfully.

[0132] Furthermore, the jth participant can return the target verification result to the first participant set, so that the participants in the first participant set can return the corresponding sub-key shares according to the target verification result to perform subsequent operations. Furthermore, the embodiment of the present application also supports the jth participant to cache the commitment information sent by each participant in the first participant set, so as to perform key verification on the received sub-key shares based on the commitment information.

[0133] S503: Receive the sub-key share sent by the i-th participant, and based on the sub-key share, take the j-th participant in the second participant set as a new participant holding the secret key.

[0134] Among them, the commitment information sent by the i-th participant includes the signature threshold t associated with the first participant, and the number of participants n included in the first party set. Then, based on the sub-secret key share, the process of taking the j-th participant in the second party set as the new participant holding the secret key may include: first, based on the Lagrangian interpolation algorithm, the signature threshold t and the number of participants n included in the first party set, constructing a Lagrangian interpolation polynomial of the secret key; in the scenario where n=3 and t=1, the Lagrangian interpolation algorithm is a polynomial of order 1.

[0135] Then, check whether the received sub-key share is a coordinate point in the Lagrange interpolation polynomial corresponding to the secret key. If the sub-key share is a coordinate point in the Lagrange interpolation polynomial, it means that there is a matching relationship or binding relationship between the sub-key share and the commitment information, that is, the commitment information sent in the previous stage can verify whether the sub-key share is correct. Secondly, if the sub-key share is a coordinate point in the Lagrange interpolation polynomial corresponding to the secret key, the secret key share held by the jth participant is determined based on the sub-key share. Specifically: obtain the sub-key shares sent by the participants who have not lost the secret key share except the i-th participant in the first participant set, and add the received sub-key shares to obtain the added secret key share, so that the added secret key share can be used as the secret key share held by the j-th participant.

[0136] Finally, a share confirmation message is generated based on the secret key share held by the jth participant, and the share confirmation message is sent to each participant in the first participant set and each participant in the second participant set, so that the participants in the first participant set and the participants in the second participant set can all understand that the jth participant is ready to become a new participant holding a secret key. Furthermore, the jth participant can also receive share confirmation information returned by other participants in the second participant set; if the share confirmation message sent by each participant in the second participant set is received, it means that each participant in the second participant set is ready to become a new participant holding a secret key share, and the jth participant in the second participant set is regarded as a new participant holding a secret key.

[0137] In summary, the jth participant in the second participant can first receive the public key and commitment information sent by the participant in the first participant set who has not lost the secret key share, such as the i-th participant; then, verify the public key and commitment information to determine that the identity of the i-th participant is safe and reliable; finally, the j-th participant obtains the sub-secret key share from the i-th participant, and uses the j-th participant as a new participant holding the secret key based on the sub-secret key share. It can be seen that in the process of secret key redistribution, the embodiment of the present application can ensure that the j-th participant obtains the sub-secret key share from the safe i-th participant by first verifying the identity of the i-th participant to whom the sub-secret key share is to be sent, and then sending the sub-secret key share after the verification is successful, thereby ensuring the correctness of the secret key share obtained based on the sub-secret key share, thereby avoiding the destruction of the secret key by the malicious party and effectively ensuring the security of the secret key.

[0138] It is worth noting that the above Figure 2 The embodiment shown mainly describes the specific implementation process of the data processing method from the perspective of the i-th participant in the first participant set; Figure 5The embodiment shown mainly describes the specific implementation process of the data processing method from the perspective of the jth participant in the second participant set. Figure 6 A flow chart of the data processing method performed by the i-th participant in the first participant set and the j-th participant in the second participant set is given; Figure 6 As shown: s11. The i-th participant in the first set of participants calculates the secret key fragment w_i based on the secret key share x_i held. The secret key fragment w_i is added to the secret key fragments held by other participants in the first set of participants to obtain the real secret key. s12. The i-th participant calculates multiple sub-secret key shares and commitment information based on the secret key fragment w_i. s13. The i-th participant broadcasts the public key and commitment information to the j-th participant in the second set of participants. s14. The j-th participant in the second set of participants verifies the broadcasted public key and commitment information and generates a verification result. s15. The j-th participant returns the verification result to the i-th participant. s16. When the i-th participant receives the verification result and determines that the verification result indicates that the j-th participant has successfully verified both the public key and the commitment information, it sends the sub-secret key share corresponding to the participant identifier of the j-th participant to the j-th participant. s17. The jth participant verifies the sub-secret key share and generates the secret key share held by the jth participant based on the sub-secret key share. s18. The jth participant sends the share confirmation information to the other participants in the first participant set and the second participant set except the jth participant. s19. After receiving the share confirmation information sent by all participants in the second participant set, the i-th participant destroys the old secret key share and exits the protocol.

[0139] It is worth noting that the execution order of the above steps s17 and s18 is not specific; for example, after verifying the sub-secret key share, step s18 can be executed to send the share confirmation information to the other participants in the first party set and the second party set except the j-th party; for another example, after verifying the sub-secret key share and generating the secret key share held by the j-th party based on the sub-secret key share, step s18 can be executed to send the share confirmation information to the other participants in the first party set and the second party set except the j-th party. It is also worth noting that the specific implementation process of the above steps can be found in the above Figure 2 and Figure 5 The relevant description of the relevant contents in the illustrated embodiment will not be repeated here.

[0140] The embodiment of the present application can roughly divide the data processing method described in the above steps s11-s19 into two stages, namely the first stage and the second stage. Among them, the first stage completes the negotiation of public key consistency and the broadcast of Feldman VSS commitment. In the second stage, the old members (the first set of participants) point-to-point distribute the new sub-key shares to the new members (the second set of participants), and the new members verify the sub-key shares and FVSS commitments. After all the verifications are completed, the new private key shards are calculated, and the final ack (i.e., share confirmation message) is broadcast to the new members and old members; in this way, the new members and old members determine that the reallocation is completed after collecting and confirming the final acks of other participants. The two stages mentioned above are elaborated in detail below, among which:

[0141] (1) The first stage is the identity authentication stage of the i-th participant. The method flow diagram of the identity authentication stage can be found in Figure 7 .like Figure 7 As shown, assuming that the first participant set includes three participants, namely, participant 1, participant 2 and participant 3, and the secret key share of participant 2 is lost, for participant 1 and participant 2, the implementation process shown in the above steps S201-S203 can be adopted to generate their respective multiple sub-secret key fragments (such as the number of participants to be allocated sub-secret key shares in the second participant set is 3, and the number of multiple sub-secret key shares is 3 at this time) and commitment information. Then, participant 1 and participant 2 can broadcast the public key corresponding to the secret key and the commitment information to each participant to be allocated sub-secret key shares in the second participant set. Then, the participants in the second participant set can follow the received public key and commitment information to ensure the correctness of the identity of participant 1 and participant 2 in the first participant set. Finally, each participant in the second participant set can return the verification result to participant 1 and participant 2 in the first participant set, which can be an Ack message, so that participant 1 and participant 2 can perform subsequent operations according to the Ack message.

[0142] (2) The second stage is the key verification stage of the sub-key share. The method flow diagram of the key verification stage can be found in Figure 8 .like Figure 8As shown, when both the participant 1 and the participant 2 in the first participant set receive the verification results returned by each participant in the second participant set, and the verification result is a successful verification, the participant 1 and the participant 2 can distribute multiple sub-key shares to the second participant set according to the corresponding relationship between the participant identification and the sub-key share. Then, the participants in the second participant set can verify the binding relationship (or matching relationship) between the sub-key share and the corresponding commitment information according to the cached commitment information to verify the authenticity of the sub-key share. Finally, the second participant set can return a share confirmation message to the participant 1 and the participant 2 in the first participant set, indicating that the participants in the second participant set have successfully verified the sub-key share, so that the participant 1 and the participant 2 can perform the operation of destroying the old secret key share and exiting the protocol, thereby ensuring that the second participant set becomes a new participant set holding the secret key.

[0143] It can be seen that the implementation example itself supports verifying the identities of the participants in the first set of participants in the first stage, and executing the sub-key share distribution only after the verification is successful; on the one hand, it can prevent the participants from doing evil, and on the other hand, it can save computing resources to a certain extent and improve the redistribution efficiency.

[0144] In summary, the embodiments of the present application provide a new decentralized private key management method, which allows users to store blockchain account keys (specifically private keys) in the form of key shards on computer devices of multiple participants; if part of the key shards are lost, as long as the recoverable signature threshold is not exceeded, the key can be "recovered". While ensuring the security of the key (the key shards have never met and the complete key has never appeared), a new complete key shard is securely negotiated, allowing the resource client to have the ability to "recover" after the key shard is lost, thereby further ensuring the security of on-chain assets.

[0145] The method of the embodiment of the present application is described in detail above. In order to facilitate better implementation of the above method of the embodiment of the present application, the device of the embodiment of the present application is provided below accordingly.

[0146] Fig. 9 A schematic diagram of the structure of a data processing device provided by an exemplary embodiment of the present application is shown. The data processing device may be a computer program (including program code) running in a computer device; the data processing device may be used to execute Figure 2 and Figure 6 Part or all of the steps in the method embodiment shown; the device includes the following units:

[0147] The acquisition unit 901 is used to obtain the key fragment corresponding to the key share held by the i-th participant in the first participant set in response to the key redistribution demand of the first participant set; the first participant set includes multiple participants, some of which have lost their key shares; the i-th participant is any participant who has not lost the key share;

[0148] The processing unit 902 is used to perform key redistribution processing on the key fragments to generate multiple sub-key shares and commitment information corresponding to the key fragments; the commitment information is used to indicate the authenticity of the public key and the key fragments held by the i-th participant, and the key fragments have a matching relationship with the public key;

[0149] The processing unit 902 is further used to broadcast the public key and the commitment information corresponding to the secret key to the second set of participants for verification processing, so that the participants in the second set of participants return the verification result;

[0150] Processing unit 902 is also used to allocate a sub-key share to the j-th participant in the second party set based on multiple sub-key shares if the verification result indicates that the verification of both the public key and the commitment information is successful, so that the j-th participant becomes a new participant holding the secret key; the j-th participant is any participant in the second party set.

[0151] In one implementation, the conditions for generating the key redistribution requirement of the first set of participants include:

[0152] If the number of participants in the first party set who have lost their secret key shares is less than or equal to the signature threshold associated with the first party set, it is determined that the first party set has a need for secret key redistribution;

[0153] Among them, the signature threshold is used to indicate the maximum allowed number of lost key shares in the first set of participants; if the number of participants in the first set of participants who have lost key shares is greater than the signature threshold, the number of participants in the first set of participants who have not lost key shares does not meet the number requirement of participants required for the negotiated signature.

[0154] In one implementation, the processing unit 902, when used to obtain the key fragment corresponding to the key share held by the i-th participant in the first participant set, is specifically used to:

[0155] Obtaining a Lagrange interpolation polynomial corresponding to the secret key; the independent variable of the Lagrange interpolation polynomial is the participant identifier of the participant in the first participant set, and the dependent variable of the Lagrange interpolation polynomial is the secret key share held by the participant in the first participant set;

[0156] Obtain the party identifiers of other parties in the first party set, except the i-th party, that participate in the negotiation and signature;

[0157] Based on the party identifiers of other parties participating in the negotiated signature, the party identifier of the ith party, and the Lagrangian interpolation polynomial corresponding to the secret key, calculate the Lagrangian interpolation coefficient of the secret key share held by the ith party;

[0158] According to the secret key share held by the ith participant and the Lagrange interpolation coefficient, a secret key fragment corresponding to the secret key share held by the ith participant is obtained; wherein the secret key fragment held by the ith participant is one of multiple secret key fragments constituting the secret key.

[0159] In one implementation, the processing unit 902 is used to perform key redistribution processing on the key fragments to generate multiple sub-key shares and commitment information corresponding to the key fragments, specifically for:

[0160] Obtaining a signature threshold associated with the first party set and the number of parties included in the second party set;

[0161] Based on the Lagrangian interpolation algorithm, the signature threshold and the number of participants included in the second participant set, a Lagrangian interpolation polynomial corresponding to the secret key fragment held by the i-th participant is constructed;

[0162] Obtaining the party identifier of each party to which the sub-key share is to be allocated in the second party set, and inputting the party identifier of each party into the Lagrange interpolation polynomial corresponding to the key fragment, to generate a plurality of sub-key shares corresponding to the key fragment; the party identifier and the sub-key share have a corresponding relationship; and,

[0163] Based on the Lagrange interpolation polynomial corresponding to the secret key fragment, the commitment information of the secret key fragment is generated.

[0164] In one implementation, the processing unit 902 is configured to allocate a sub-key share to a j-th participant in the second set of participants based on the multiple sub-key shares if the target verification result indicates that the verification of both the public key and the commitment information is successful, specifically to:

[0165] Get the first timeout limit;

[0166] If the target verification results returned by each participant in the second party set to which the sub-key shares are to be allocated are received within the first timeout period, and each target verification result indicates that the verification of both the public key and the commitment information is successful, then the sub-key share among the multiple sub-key shares that corresponds to the participant identification of the j-th participant in the second party set is allocated to the j-th participant.

[0167] In one implementation, the processing unit 902 is further configured to:

[0168] If at least one of the participants to be allocated sub-key shares in the second participant set does not return the target verification result within the first timeout period, or there is a target verification result indicating that the verification of at least one of the public key and the commitment information has failed, then a reallocation prompt message is output;

[0169] The reallocation prompt message is used to prompt that the key reallocation has failed.

[0170] In one implementation, the processing unit 902 is further configured to:

[0171] Get the second timeout limit;

[0172] If a share confirmation message is received from each participant in the second participant set to be allocated a sub-key share within the second timeout period, the secret key share held by the i-th participant is destroyed; the share confirmation message is used to indicate that the participant has successfully verified the received sub-key share;

[0173] The i-th participant is removed from the first participant set.

[0174] According to one embodiment of the present application, Fig. 9 The various units in the data processing device shown can be individually or completely combined into one or several other units to form, or one (some) of the units can be further divided into multiple functionally smaller units to form, which can achieve the same operation without affecting the realization of the technical effects of the embodiments of the present application. The above-mentioned units are divided based on logical functions. In practical applications, the function of one unit can also be implemented by multiple units, or the functions of multiple units can be implemented by one unit. In other embodiments of the present application, the data processing device may also include other units. In practical applications, these functions can also be implemented with the assistance of other units, and can be implemented by the collaboration of multiple units. According to another embodiment of the present application, it can be executed by running on a general computing device such as a computer including processing elements and storage elements such as a central processing unit (CPU), a memory access storage medium (RAM), and a read-only storage medium (ROM). Figure 2 and Figure 6 A computer program (including program code) for each step involved in the corresponding method shown in FIG. Fig. 9 The data processing device shown in the embodiment of the present application is implemented by the data processing device. The computer program can be recorded on a computer-readable recording medium, for example, and loaded into the above-mentioned computing device through the computer-readable recording medium and run therein.

[0175] In the embodiment of the present application, the i-th participant in the first participant set who has not lost the secret key share, when determining that the first participant set has a need for key redistribution (such as one or more participants in the first participant set have lost their secret key shares), can first calculate the secret key fragments corresponding to the secret key share based on the secret key share it holds, and the secret key fragments are part of the key; then, the i-th participant performs key redistribution processing on the secret key fragments to generate multiple sub-secret key shares and commitment information. Further, the i-th participant first broadcasts the public key and commitment information corresponding to the secret key to the second participant set, so that the participants in the second participant set first verify the public key and commitment information, so as to ensure that the i-th participant is not a malicious party, thereby maintaining data security; when the i-th participant receives the verification result returned by the second participant set, and the verification result is a successful verification, the i-th participant then allocates a sub-secret key share to the j-th participant in the second participant set based on multiple sub-secret key shares, so that the j-th participant is called a new participant holding the secret key based on the allocated sub-secret key share. It can be seen that when the embodiment of the present application detects that there is a need for key redistribution in the first set of participants, it can help restore the original number of key shares based on the key shares held by the i-th participant, thereby ensuring the security of the key. For example, if the key was originally divided into 3 key shares, but one key share is lost, the key retrieval capability provided by this solution can be used to restore 3 key shares from only 2 key shares left after the loss, thereby ensuring the security of the key.

[0176] Fig.10 A schematic diagram of the structure of another data processing device provided by an exemplary embodiment of the present application is shown. The data processing device may be a computer program (including program code) running in a computer device; the data processing device may be used to execute Figure 5 and Figure 6 Part or all of the steps in the method embodiment shown; the device includes the following units:

[0177] The receiving unit 1001 is used to receive the public key and commitment information broadcasted by the i-th participant in the first participant set; wherein the i-th participant is a participant that has not lost the secret key share among the multiple participants included in the first participant set; the commitment information is obtained by the i-th participant performing a secret key redistribution process on the secret key fragments corresponding to the secret key share held by the i-th participant;

[0178] The processing unit 1002 is configured to perform verification processing on the public key and the commitment information respectively, obtain verification results, and return the verification results to the i-th participant; when the i-th participant determines that the verification result indicates that the participants in the second participant set have successfully verified the public key and the commitment information, the i-th participant allocates a sub-key share to the j-th participant in the second participant set based on the multiple sub-key shares;

[0179] The processing unit 1002 is further used to receive the sub-key share sent by the i-th participant, and based on the sub-key share, take the j-th participant in the second participant set as a new participant holding the secret key.

[0180] In one implementation, the number of participants in the first set of participants who have not lost their secret key shares is multiple; the commitment information includes a public key; the processing unit 1002 is used to verify the public key and the commitment information respectively, and when the target verification result is obtained, it is specifically used to:

[0181] Obtaining the public key broadcasted by each participant in the first participant set who has not lost the secret key share, and verifying whether the public keys broadcasted by each participant are the same, and generating a first verification result; wherein, if the public keys broadcasted by each participant are the same, the first verification result indicates that the verification of the public key is successful; if the public key sent by a participant is different from the public keys sent by other participants, the first verification result indicates that the verification of the public key fails;

[0182] and, verifying whether a public key sent by the i-th party in the first party set and a public key included in the commitment information sent by the i-th party are the same, and generating a second verification result; wherein, if the public key sent by the i-th party and the public key included in the commitment information sent by the i-th party are the same, the second verification result indicates that the verification of the commitment information sent by the i-th party is successful;

[0183] Based on the first verification result and the second verification result, a target verification result is generated.

[0184] In one implementation, the commitment information includes a signature threshold associated with the first set of participants, and the number of participants included in the first set of participants;

[0185] The processing unit 1002 is configured to, when taking the jth party in the second party set as a new party holding the secret key based on the sub-secret key share, specifically:

[0186] Based on the Lagrange interpolation algorithm, the signature threshold and the number of participants included in the first participant set, a Lagrange interpolation polynomial of the secret key is constructed;

[0187] Verify whether the received sub-key share is the coordinate point in the Lagrange interpolation polynomial corresponding to the key;

[0188] If yes, determine the secret key share held by the jth participant based on the sub-secret key share;

[0189] Generate a share confirmation message based on the secret key share held by the jth participant, and send the share confirmation message to each participant in the first set of participants and each participant in the second set of participants; and,

[0190] If a share confirmation message is received from each participant in the second participant set, the jth participant in the second participant set is regarded as a new participant holding the secret key.

[0191] In one implementation, the processing unit 1002 is configured to determine the key share held by the j-th participant based on the sub-key share, specifically to:

[0192] Obtain the sub-secret key shares sent by the other participants in the first party set who have not lost the secret key shares except the i-th participant;

[0193] Add up the received sub-key shares to get the added key share;

[0194] The added secret key share is taken as the secret key share held by the jth participant.

[0195] According to one embodiment of the present application, Fig.10 The various units in the data processing device shown can be individually or completely combined into one or several other units to form, or one (some) of the units can be further divided into multiple functionally smaller units to form, which can achieve the same operation without affecting the realization of the technical effects of the embodiments of the present application. The above-mentioned units are divided based on logical functions. In practical applications, the function of one unit can also be implemented by multiple units, or the functions of multiple units can be implemented by one unit. In other embodiments of the present application, the data processing device may also include other units. In practical applications, these functions can also be implemented with the assistance of other units, and can be implemented by the collaboration of multiple units. According to another embodiment of the present application, it can be executed by running on a general computing device such as a computer including processing elements and storage elements such as a central processing unit (CPU), a memory access storage medium (RAM), and a read-only storage medium (ROM). Figure 5 and Figure 6 A computer program (including program code) for each step involved in the corresponding method shown in FIG. Fig.10 The data processing device shown in the embodiment of the present application is implemented by the data processing device. The computer program can be recorded on a computer-readable recording medium, for example, and loaded into the above-mentioned computing device through the computer-readable recording medium and run therein.

[0196] In an embodiment of the present application, the jth participant in the second participant can first receive the public key and commitment information sent by the participant in the first participant set who has not lost the secret key share, such as the i-th participant; then, verify the public key and commitment information to determine that the identity of the i-th participant is safe and reliable; finally, the j-th participant obtains the sub-secret key share from the i-th participant, and uses the j-th participant as a new participant holding the secret key based on the sub-secret key share. It can be seen that in the process of secret key redistribution in the embodiment of the present application, by first verifying the identity of the i-th participant to whom the sub-secret key share is to be sent, and then sending the sub-secret key share after the verification is successful, it can ensure that the j-th participant obtains the sub-secret key share from the safe i-th participant, thereby ensuring the correctness of the secret key share obtained based on the sub-secret key share, thereby avoiding the malicious party from destroying the secret key and effectively ensuring the security of the secret key.

[0197] Fig.11 FIG. 1 shows a schematic diagram of a computer device provided by an exemplary embodiment of the present application. Fig.11 , the computer device includes a processor 1101, a communication interface 1102 and a computer-readable storage medium 1103. The processor 1101, the communication interface 1102 and the computer-readable storage medium 1103 may be connected via a bus or other means. The communication interface 1102 is used to receive and send data. The computer-readable storage medium 1103 may be stored in a memory of the computer device, the computer-readable storage medium 1103 is used to store a computer program, the computer program includes program instructions, and the processor 1101 is used to execute the program instructions stored in the computer-readable storage medium 1103. The processor 1101 (or CPU (Central Processing Unit)) is the computing core and control core of the computer device, which is suitable for implementing one or more instructions, and is specifically suitable for loading and executing one or more instructions to implement the corresponding method flow or corresponding function.

[0198] The embodiment of the present application also provides a computer-readable storage medium (Memory), which is a memory device in a computer device for storing programs and data. It is understandable that the computer-readable storage medium here can include both built-in storage media in the computer device and, of course, extended storage media supported by the computer device. The computer-readable storage medium provides a storage space that stores the processing system of the computer device. In addition, one or more instructions suitable for being loaded and executed by the processor 1101 are also stored in the storage space, and these instructions can be one or more computer programs (including program codes). It should be noted that the computer-readable storage medium here can be a high-speed RAM memory, or a non-volatile memory, such as at least one disk storage; optionally, it can also be at least one computer-readable storage medium located away from the aforementioned processor.

[0199] In one embodiment, the computer-readable storage medium stores one or more instructions; the processor 1101 loads and executes the one or more instructions stored in the computer-readable storage medium to implement the corresponding steps in the above data processing method embodiment; in a specific implementation, the one or more instructions in the computer-readable storage medium are loaded by the processor 1101 and the following steps are executed:

[0200] In response to a key redistribution demand of the first participant set, a key fragment corresponding to a key share held by an i-th participant in the first participant set is obtained; the first participant set includes multiple participants, some of which have lost their key shares; the i-th participant is any participant who has not lost the key share;

[0201] Perform key redistribution processing on the key fragments to generate multiple sub-key shares and commitment information corresponding to the key fragments; the commitment information is used to indicate the authenticity of the public key and key fragments held by the i-th participant, and the key fragments have a matching relationship with the public key;

[0202] Broadcasting the public key and commitment information corresponding to the secret key to the second set of participants for verification, so that the participants in the second set of participants return the verification results;

[0203] If the verification result indicates that both the public key and the commitment information are successfully verified, a sub-key share is allocated to the jth participant in the second party set based on multiple sub-key shares, so that the jth participant becomes a new participant holding the secret key; the jth participant is any participant in the second party set.

[0204] In one implementation, the conditions for generating the key redistribution requirement of the first set of participants include:

[0205] If the number of participants in the first party set who have lost their secret key shares is less than or equal to the signature threshold associated with the first party set, it is determined that the first party set has a need for secret key redistribution;

[0206] Among them, the signature threshold is used to indicate the maximum allowed number of lost key shares in the first set of participants; if the number of participants in the first set of participants who have lost key shares is greater than the signature threshold, the number of participants in the first set of participants who have not lost key shares does not meet the number requirement of participants required for the negotiated signature.

[0207] In one implementation, one or more instructions in the computer-readable storage medium are loaded by the processor 1101 and when executing to obtain the key fragment corresponding to the key share held by the i-th participant in the first set of participants, specifically perform the following steps:

[0208] Obtaining a Lagrange interpolation polynomial corresponding to the secret key; the independent variable of the Lagrange interpolation polynomial is the participant identifier of the participant in the first participant set, and the dependent variable of the Lagrange interpolation polynomial is the secret key share held by the participant in the first participant set;

[0209] Obtain the party identifiers of other parties in the first party set, except the i-th party, that participate in the negotiation and signature;

[0210] Based on the party identifiers of other parties participating in the negotiated signature, the party identifier of the ith party, and the Lagrangian interpolation polynomial corresponding to the secret key, calculate the Lagrangian interpolation coefficient of the secret key share held by the ith party;

[0211] According to the secret key share held by the ith participant and the Lagrange interpolation coefficient, a secret key fragment corresponding to the secret key share held by the ith participant is obtained; wherein the secret key fragment held by the ith participant is one of multiple secret key fragments constituting the secret key.

[0212] In one implementation, one or more instructions in the computer-readable storage medium are loaded by the processor 1101 and when performing key redistribution processing on the key fragments to generate multiple sub-key shares and commitment information corresponding to the key fragments, specifically perform the following steps:

[0213] Obtaining a signature threshold associated with the first party set and the number of parties included in the second party set;

[0214] Based on the Lagrangian interpolation algorithm, the signature threshold and the number of participants included in the second participant set, a Lagrangian interpolation polynomial corresponding to the secret key fragment held by the i-th participant is constructed;

[0215] Obtaining the party identifier of each party to which the sub-key share is to be allocated in the second party set, and inputting the party identifier of each party into the Lagrange interpolation polynomial corresponding to the key fragment, to generate a plurality of sub-key shares corresponding to the key fragment; the party identifier and the sub-key share have a corresponding relationship; and,

[0216] Based on the Lagrange interpolation polynomial corresponding to the secret key fragment, the commitment information of the secret key fragment is generated.

[0217] In one implementation, one or more instructions in the computer-readable storage medium are loaded by the processor 1101 and when executing if the target verification result indicates that the verification of both the public key and the commitment information is successful, a sub-key share is allocated to the j-th participant in the second set of participants based on the multiple sub-key shares, specifically performing the following steps:

[0218] Get the first timeout limit;

[0219] If the target verification results returned by each participant in the second party set to which the sub-key shares are to be allocated are received within the first timeout period, and each target verification result indicates that the verification of both the public key and the commitment information is successful, then the sub-key share among the multiple sub-key shares that corresponds to the participant identification of the j-th participant in the second party set is allocated to the j-th participant.

[0220] In one implementation, one or more instructions in the computer-readable storage medium are loaded by the processor 1101 and further perform the following steps:

[0221] If at least one of the participants to be allocated sub-key shares in the second participant set does not return the target verification result within the first timeout period, or there is a target verification result indicating that the verification of at least one of the public key and the commitment information has failed, then a reallocation prompt message is output;

[0222] The reallocation prompt message is used to prompt that the key reallocation has failed.

[0223] In one implementation, one or more instructions in the computer-readable storage medium are loaded by the processor 1101 and further perform the following steps:

[0224] Get the second timeout limit;

[0225] If a share confirmation message is received from each participant in the second participant set to be allocated a sub-key share within the second timeout period, the secret key share held by the i-th participant is destroyed; the share confirmation message is used to indicate that the participant has successfully verified the received sub-key share;

[0226] The i-th participant is removed from the first participant set.

[0227] In another embodiment, the computer-readable storage medium stores one or more instructions; the processor 1101 loads and executes the one or more instructions stored in the computer-readable storage medium to implement the corresponding steps in the above data processing method embodiment; in a specific implementation, the one or more instructions in the computer-readable storage medium are loaded by the processor 1101 and the following steps are executed:

[0228] Receiving the public key and commitment information broadcasted by the i-th participant in the first participant set; wherein the i-th participant is a participant that has not lost the secret key share among the multiple participants included in the first participant set; the commitment information is obtained by the i-th participant performing a secret key redistribution process on the secret key fragments corresponding to the secret key share held by the i-th participant;

[0229] Verifying the public key and the commitment information respectively to obtain verification results, and returning the verification results to the i-th participant; when the i-th participant determines that the verification result indicates that the participants in the second set of participants have successfully verified the public key and the commitment information, the j-th participant in the second set of participants is allocated a sub-key share based on the multiple sub-key shares;

[0230] Receive the sub-key share sent by the i-th participant, and based on the sub-key share, treat the j-th participant in the second party set as a new participant holding the secret key.

[0231] In one implementation, the number of participants in the first set of participants who have not lost their secret key shares is multiple; the commitment information includes a public key; one or more instructions in a computer-readable storage medium are loaded by the processor 1101 and are executed to perform verification processing on the public key and the commitment information respectively, and when a target verification result is obtained, the following steps are specifically performed:

[0232] Obtaining the public key broadcasted by each participant in the first participant set who has not lost the secret key share, and verifying whether the public keys broadcasted by each participant are the same, and generating a first verification result; wherein, if the public keys broadcasted by each participant are the same, the first verification result indicates that the verification of the public key is successful; if the public key sent by a participant is different from the public keys sent by other participants, the first verification result indicates that the verification of the public key fails;

[0233] and, verifying whether a public key sent by the i-th party in the first party set and a public key included in the commitment information sent by the i-th party are the same, and generating a second verification result; wherein, if the public key sent by the i-th party and the public key included in the commitment information sent by the i-th party are the same, the second verification result indicates that the verification of the commitment information sent by the i-th party is successful;

[0234] Based on the first verification result and the second verification result, a target verification result is generated.

[0235] In one implementation, the commitment information includes a signature threshold associated with the first set of participants, and the number of participants included in the first set of participants;

[0236] The one or more instructions in the computer-readable storage medium are loaded by the processor 1101 and when executing the j-th participant in the second participant set as a new participant holding the secret key based on the sub-secret key share, the following steps are specifically performed:

[0237] Based on the Lagrange interpolation algorithm, the signature threshold and the number of participants included in the first participant set, a Lagrange interpolation polynomial of the secret key is constructed;

[0238] Verify whether the received sub-key share is the coordinate point in the Lagrange interpolation polynomial corresponding to the key;

[0239] If yes, determine the secret key share held by the jth participant based on the sub-secret key share;

[0240] Generate a share confirmation message based on the secret key share held by the jth participant, and send the share confirmation message to each participant in the first set of participants and each participant in the second set of participants; and,

[0241] If a share confirmation message is received from each participant in the second participant set, the jth participant in the second participant set is regarded as a new participant holding the secret key.

[0242] In one implementation, one or more instructions in the computer-readable storage medium are loaded by the processor 1101 and when executing determining the key share held by the j-th participant based on the sub-key shares, specifically perform the following steps:

[0243] Obtain the sub-secret key shares sent by the other participants in the first party set who have not lost the secret key shares except the i-th participant;

[0244] Add up the received sub-key shares to get the added key share;

[0245] The added secret key share is taken as the secret key share held by the jth participant.

[0246] Based on the same inventive concept, the principles and beneficial effects of solving the problems provided by the computer device in the embodiment of the present application are similar to the principles and beneficial effects of solving the problems provided by the data processing method in the method embodiment of the present application. Please refer to the principles and beneficial effects of the implementation of the method. For the sake of concise description, they will not be repeated here.

[0247] The embodiment of the present application also provides a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. The processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device performs the above-mentioned data processing method.

[0248] A person skilled in the art can appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in this application can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0249] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loading and executing computer program instructions on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable device. The computer instruction can be stored in a computer-readable storage medium or transmitted by a computer-readable storage medium. The computer instruction can be transmitted from a website site, a computer, a server or a data center to another website site, a computer, a server or a data center by wired (for example, coaxial cable, optical fiber, digital line (DSL)) or wireless (for example, infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that a computer can access or a data processing device such as a server, a data center, etc. that contains one or more available media integration. Available media can be magnetic media (for example, floppy disk, hard disk, tape), optical media (for example, DVD), or semiconductor media (for example, solid-state drive (Solid State Disk, SSD)) and the like.

[0250] The above description is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technical object familiar with the technical field can easily think of changes or replacements within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A data processing method, characterized in that: include: In response to a key redistribution demand of the first set of participants, obtaining a key fragment corresponding to a key share held by an i-th participant in the first set of participants; The first set of participants includes multiple participants, some of whom lose their shares of secret keys; The i-th participant is any participant who has not lost the secret key share; Performing key redistribution processing on the key fragments to generate a plurality of sub-key shares and commitment information corresponding to the key fragments; the commitment information is used to indicate the authenticity of the public key held by the i-th participant and the key fragments, and the key fragments have a matching relationship with the public key; Broadcasting the public key corresponding to the secret key and the commitment information to the second set of participants for verification processing, so that the participants in the second set of participants return the target verification result; If the target verification result indicates that the verification of both the public key and the commitment information is successful, then a sub-key share is allocated to the j-th participant in the second set of participants based on the multiple sub-key shares, so that the j-th participant becomes a new participant holding the secret key; the j-th participant is any participant in the second set of participants.

2. The method according to claim 1, characterized in that The conditions for generating the key redistribution requirement of the first set of participants include: If the number of participants in the first set of participants who have lost their secret key shares is less than or equal to the signature threshold associated with the first set of participants, it is determined that the first set of participants has a need for key redistribution; Among them, the signature threshold is used to indicate the maximum allowed number of lost key shares of the first set of participants; if the number of participants in the first set of participants who have lost key shares is greater than the signature threshold, the number of participants in the first set of participants who have not lost key shares does not meet the number requirement of participants required for the negotiated signature.

3. The method according to claim 1, characterized in that The obtaining of the key fragment corresponding to the key share held by the i-th participant in the first set of participants includes: Obtaining a Lagrangian interpolation polynomial corresponding to the secret key; the independent variable of the Lagrangian interpolation polynomial is the participant identifier of the participant in the first participant set, and the dependent variable of the Lagrangian interpolation polynomial is the secret key share held by the participant in the first participant set; Obtaining the party identifiers of other parties in the first party set, except the i-th party, that participate in the negotiation and signature; Calculate the Lagrangian interpolation coefficient of the secret key share held by the i-th party based on the party identifiers of the other parties participating in the negotiation signature, the party identifier of the i-th party, and the Lagrangian interpolation polynomial corresponding to the secret key; According to the secret key share held by the i-th participant and the Lagrange interpolation coefficient, a secret key fragment corresponding to the secret key share held by the i-th participant is obtained; wherein the secret key fragment held by the i-th participant is one of the multiple secret key fragments that constitute the secret key.

4. The method according to claim 1, characterized in that The performing key redistribution processing on the key fragments to generate a plurality of sub-key shares and commitment information corresponding to the key fragments includes: Obtaining a signature threshold associated with the first set of participants, and the number of participants included in the second set of participants; Based on the Lagrangian interpolation algorithm, the signature threshold, and the number of participants included in the second participant set, constructing a Lagrangian interpolation polynomial corresponding to the secret key fragment held by the i-th participant; Obtaining the party identifier of each party to which the sub-key share is to be allocated in the second party set, and inputting the party identifier of each party into the Lagrange interpolation polynomial corresponding to the key fragment, to generate a plurality of sub-key shares corresponding to the key fragment; the party identifier and the sub-key share have a corresponding relationship; and, Commitment information of the secret key fragment is generated based on the Lagrange interpolation polynomial corresponding to the secret key fragment.

5. The method according to claim 1, characterized in that If the target verification result indicates that the verification of both the public key and the commitment information is successful, allocating a sub-key share to the j-th participant in the second set of participants based on the multiple sub-key shares, including: Get the first timeout limit; If the target verification results returned by each participant to whom the sub-key shares are to be allocated in the second set of participants are received within the first timeout period, and each target verification result indicates that the verification of the public key and the commitment information is successful, then the sub-key share among the multiple sub-key shares that corresponds to the participant identification of the j-th participant in the second set of participants is allocated to the j-th participant.

6. The method according to claim 5, characterized in that The method further comprises: If at least one of the parties to be allocated sub-key shares in the second set of parties does not return the target verification result within the first timeout period, or there is a target verification result indicating that the verification of at least one of the public key and the commitment information has failed, then output a reallocation prompt message; The reallocation prompt information is used to prompt that the current key reallocation has failed.

7. The method according to claim 1, characterized in that The method further comprises: Get the second timeout limit; If a share confirmation message is received from each participant in the second set of participants to be allocated a sub-key share within the second timeout period, the secret key share held by the i-th participant is destroyed; the share confirmation message is used to indicate that the participant has successfully verified the received sub-key share; The i-th participant is removed from the first participant set.

8. A data processing method, characterized in that: include: Receiving the public key and commitment information broadcasted by the i-th participant in the first participant set; wherein the i-th participant is a participant that has not lost the secret key share among the multiple participants included in the first participant set; the commitment information is obtained by the i-th participant performing a secret key redistribution process on the secret key fragments corresponding to the secret key share held by the i-th participant; Verifying the public key and the commitment information respectively to obtain a target verification result, and returning the target verification result to the i-th participant; when the i-th participant determines that the target verification result indicates that the participants in the second set of participants have successfully verified the public key and the commitment information, the j-th participant in the second set of participants is allocated a sub-key share based on the multiple sub-key shares; Receive the sub-key share sent by the i-th participant, and based on the sub-key share, take the j-th participant in the second party set as a new participant holding the secret key.

9. The method according to claim 8, characterized in that The number of participants in the first set of participants who have not lost their secret key shares is multiple; the commitment information includes a public key; The verifying the public key and the commitment information respectively to obtain a target verification result includes: Obtaining the public key broadcasted by each participant in the first set of participants who has not lost the secret key share, and verifying whether the public keys broadcasted by each participant are the same, and generating a first verification result; wherein, if the public keys broadcasted by each participant are the same, the first verification result indicates that the verification of the public key is successful; if the public key sent by a participant is different from the public keys sent by other participants, the first verification result indicates that the verification of the public key fails; and, verifying whether the public key sent by the i-th party in the first set of parties is the same as the public key included in the commitment information sent by the i-th party, and generating a second verification result; wherein, if the public key sent by the i-th party is the same as the public key included in the commitment information sent by the i-th party, the second verification result indicates that the verification of the commitment information sent by the i-th party is successful; A target verification result is generated based on the first verification result and the second verification result.

10. The method according to claim 8, characterized in that The commitment information includes a signature threshold associated with the first set of participants, and the number of participants included in the first set of participants; The step of taking the jth participant in the second participant set as a new participant holding the secret key based on the sub-secret key share includes: Constructing a Lagrangian interpolation polynomial of the secret key based on a Lagrangian interpolation algorithm, the signature threshold, and the number of parties included in the first party set; Verify whether the received sub-key share is a coordinate point in the Lagrange interpolation polynomial corresponding to the key; If yes, determining the secret key share held by the j-th participant based on the sub-secret key share; Generate a share confirmation message based on the secret key share held by the j-th participant, and send the share confirmation message to each participant in the first set of participants and each participant in the second set of participants; and, If a share confirmation message is received from each participant in the second set of participants, the jth participant in the second set of participants is taken as a new participant holding the secret key.

11. The method according to claim 10, characterized in that The determining the secret key share held by the j-th participant based on the sub-secret key share includes: Obtaining sub-secret key shares sent by other participants in the first set of participants, except the i-th participant, who have not lost their secret key shares; Add up the received sub-key shares to get the added key share; The added secret key share is used as the secret key share held by the j-th participant.

12. A data processing device, characterized in that: include: an acquisition unit, configured to, in response to a key redistribution demand of the first set of participants, acquire a key fragment corresponding to a key share held by an i-th participant in the first set of participants; The first set of participants includes multiple participants, some of whom lose their shares of secret keys; The i-th participant is any participant who has not lost the secret key share; a processing unit, configured to perform key redistribution processing on the key fragments, and generate a plurality of sub-key shares and commitment information corresponding to the key fragments; the commitment information is used to indicate the authenticity of the public key held by the i-th participant and the key fragments, and that the key fragments have a matching relationship with the public key; The processing unit is further used to broadcast the public key corresponding to the secret key and the commitment information to the second set of participants for verification processing, so that the participants in the second set of participants return the verification result; The processing unit is also used to allocate a sub-key share to the j-th participant in the second set of participants based on the multiple sub-key shares if the verification result indicates that the verification is successful for both the public key and the commitment information, so that the j-th participant becomes a new participant holding the secret key; the j-th participant is any participant in the second set of participants.

13. A data processing device, characterized in that: include: A receiving unit, configured to receive a public key and commitment information broadcasted by an i-th participant in a first participant set; wherein the i-th participant is a participant that has not lost a secret key share among a plurality of participants included in the first participant set; and the commitment information is obtained by the i-th participant performing a secret key redistribution process on the secret key fragments corresponding to the secret key share held by the i-th participant; a processing unit, configured to perform verification processing on the public key and the commitment information respectively, obtain verification results, and return the verification results to the i-th participant; so that when the i-th participant determines that the verification result indicates that the participants in the second set of participants have successfully verified the public key and the commitment information, the j-th participant in the second set of participants is allocated a sub-key share based on the multiple sub-key shares; The processing unit is further used to receive the sub-key share sent by the i-th participant, and based on the sub-key share, take the j-th participant in the second participant set as a new participant holding the secret key.

14. A computer device, characterized in that: include: a processor adapted to execute a computer program; A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by the processor, the method according to any one of claims 1 to 7 is implemented, or the method according to any one of claims 8 to 11 is implemented.

15. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is suitable for being loaded by a processor and executing the method according to any one of claims 1 to 7, or executing the method according to any one of claims 8 to 11.

16. A computer program product, characterized in that The computer program product comprises computer instructions, and when the computer instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented, or the method according to any one of claims 8 to 11 is implemented.

Images