A data processing method, apparatus, device, medium, and program product

Abstract

Embodiments of the present application provide a data processing method, device, equipment, medium and program product, wherein the method comprises: in response to a key reassignment requirement of a first participant set, obtaining a key fragment corresponding to a key share held by an i-th participant in the first participant set; performing key reassignment processing on the key fragment to generate a plurality of sub-key shares corresponding to the key fragment and commitment information; broadcasting the public key corresponding to the key and the commitment information to a second participant set for verification processing, so that a participant in the second participant set returns a target verification result; if the target verification result indicates that the public key and the commitment information are both verified successfully, assigning a sub-key share to a j-th participant in the second participant set based on the plurality of sub-key shares, so that the j-th participant becomes a new participant holding the key. The embodiments of the present application can efficiently protect digital assets.

Description

Technical Field

[0001] This application relates to the field of computer technology, and more particularly to the field of blockchain, specifically to a data processing method, a data processing device, a computer equipment, a computer-readable storage medium, and a computer program product. Background Technology

[0002] MPC (Multi-Party Computation) is an important cryptographic security method.

[0003] Currently, MPC primarily achieves multi-party negotiated signatures by breaking the key into multiple key shares (or key shards), with each participant in the decentralized network holding a single key share, thus distributing risk. However, one or more participants in the decentralized network may lose key shares, posing a significant threat to key security. For example, in a 3-shard scenario, although a participant can still negotiate a signature based on the key shares held by the remaining two participants after losing one key shard, if either of the remaining two participants also loses its key share, the entire key is lost, meaning the loss of digital assets.

[0004] Therefore, how to improve the security of secret keys has become an important research topic in the field of digital asset protection. Summary of the Invention

[0005] This application provides a data processing method, apparatus, device, medium, and program product that can improve key security by recovering key fragments, thereby effectively protecting digital assets.

[0006] On one hand, embodiments of this application provide a data processing method, the method comprising:

[0007] In response to the key redistribution request of the first set of participants, obtain the key fragment corresponding to the key share held by the i-th participant in the first set of participants; the first set of participants contains multiple participants, some of whom have lost their key shares; the i-th participant is any participant that has not lost its key share;

[0008] The key fragments are redistributed to generate multiple sub-key shares and commitment information corresponding to the key fragments; the commitment information is used to indicate the authenticity of the public key and key fragment held by the i-th participant, and the key fragments and public keys have a matching relationship;

[0009] The public key and commitment information corresponding to the secret key are broadcast to the second set of participants for verification, so that the participants in the second set of participants return the verification result;

[0010] If the verification result indicates that both the public key and the commitment information have been successfully verified, then a subkey share is allocated to the j-th participant in the second participant set based on multiple subkey shares, making the j-th participant a new participant holding the key; the j-th participant can be any participant in the second participant set.

[0011] In this embodiment, when the i-th participant in the first participant set that has not lost its key share determines that a key redistribution requirement has arisen in the first participant set (e.g., one or more participants in the first participant set have lost their key shares), it can first calculate the key fragment corresponding to its key share based on its held key share. This key fragment is part of the key. Then, the i-th participant performs key redistribution processing on the key fragment, generating multiple sub-key shares and commitment information. Further, the i-th participant first broadcasts the public key and commitment information corresponding to the key to the second participant set, so that the participants in the second participant set can first verify the public key and commitment information to ensure that the i-th participant is not a malicious party, thereby maintaining data security. When the i-th participant receives the verification result returned by the second participant set, and the verification result is successful, the i-th participant then allocates a sub-key share to the j-th participant in the second participant set based on the multiple sub-key shares, so that the j-th participant becomes a new participant holding the key based on the allocated sub-key share. Therefore, when a key redistribution requirement is detected in the first set of participants, this embodiment can help restore the original number of key shares based on the key share held by the i-th participant, thereby ensuring key security. For example, if the key was originally divided into 3 key shares, but one key share is lost, the key retrieval capability provided by this solution can be used to restore the key from having only 2 key shares remaining after the loss to having 3 key shares, thus ensuring key security.

[0012] On the other hand, embodiments of this application provide a data processing apparatus, which includes:

[0013] The acquisition unit is used to acquire the key fragment corresponding to the key share held by the i-th participant in the first participant set in response to the key redistribution request of the first participant set; the first participant set contains multiple participants, some of whom have lost their key shares; the i-th participant is any participant that has not lost its key share;

[0014] The processing unit is used to perform key redistribution processing on the key fragments, generating multiple sub-key shares and commitment information corresponding to the key fragments; the commitment information is used to indicate the authenticity of the public key and key fragment held by the i-th participant, and that the key fragments and public keys have a matching relationship;

[0015] The processing unit is also used to broadcast the public key and commitment information corresponding to the secret key to the second set of participants for verification processing, so that the participants in the second set of participants return the verification result;

[0016] The processing unit is further configured to, if the verification result indicates that the verification of both the public key and the commitment information is successful, allocate a sub-key share to the j-th participant in the second participant set based on multiple sub-key shares, so that the j-th participant becomes a new participant holding the key; the j-th participant is any participant in the second participant set.

[0017] In one implementation, the conditions for generating a key redistribution requirement among the first set of participants include:

[0018] If the number of participants in the first participant set who have lost their key share is less than or equal to the signature threshold associated with the first participant set, then the first participant set is determined to have a key redistribution requirement.

[0019] The signature threshold is used to indicate the maximum number of key shares that can be lost in the first set of participants. If the number of participants in the first set of participants who have lost key shares is greater than the signature threshold, then the number of participants in the first set of participants who have not lost key shares does not meet the requirement of the number of participants required for negotiated signature.

[0020] In one implementation, the processing unit, when acquiring the key fragment corresponding to the key share held by the i-th participant in the first participant set, specifically performs the following:

[0021] Obtain the Lagrange interpolation polynomial corresponding to the key; the independent variable of the Lagrange interpolation polynomial is the participant identifier of the participant in the first participant set, and the dependent variable of the Lagrange interpolation polynomial is the share of the key held by the participant in the first participant set;

[0022] Obtain the participant identifiers of all participants in the first set of participants, excluding the i-th participant, who have participated in the negotiation and signed the agreement.

[0023] Based on the participant identifiers of other participants who participated in the negotiation signature, the participant identifier of the i-th participant, and the Lagrange interpolation polynomial corresponding to the key, calculate the Lagrange interpolation coefficients of the key share held by the i-th participant.

[0024] Based on the key share held by the i-th participant and the Lagrange interpolation coefficient, the key fragment corresponding to the key share held by the i-th participant is obtained; wherein, the key fragment held by the i-th participant is one of the multiple key fragments that make up the key.

[0025] In one implementation, the processing unit, used for key redistribution processing of key fragments and generating multiple sub-key shares and commitment information corresponding to the key fragments, specifically performs the following:

[0026] Obtain the signature threshold associated with the first set of participants, and the number of participants contained in the second set of participants;

[0027] Based on the Lagrange interpolation algorithm, the signature threshold, and the number of participants in the second participant set, construct the Lagrange interpolation polynomial corresponding to the key fragment held by the i-th participant;

[0028] Obtain the participant identifiers of each participant in the second participant set whose sub-key shares are to be allocated, and input each participant's identifier into the Lagrange interpolation polynomial corresponding to the key fragment to generate multiple sub-key shares corresponding to the key fragment; there is a correspondence between the participant identifier and the sub-key share; and,

[0029] The commitment information of the key fragment is generated based on the Lagrange interpolation polynomial corresponding to the key fragment.

[0030] In one implementation, the processing unit, when allocating a subkey share to the j-th participant in the second participant set based on multiple subkey shares if the target verification result indicates successful verification of both the public key and the commitment information, specifically performs the following:

[0031] Get the first timeout limit;

[0032] If the target verification results are received from each participant in the second participant set whose subkey shares are to be allocated within the first timeout period, and each target verification result indicates that the verification of the public key and commitment information is successful, then the subkey share that corresponds to the participant identifier of the j-th participant in the second participant set will be allocated to the j-th participant.

[0033] In one implementation, the processing unit is further used for:

[0034] If, within the first timeout period, at least one of the participants in the second participant set who are to be allocated a subkey share fails to return the target verification result, or if there is a target verification result indicating that at least one of the public key and commitment information has failed to be verified, then a redistribution prompt message will be output.

[0035] The key redistribution message indicates that the key redistribution failed.

[0036] In one implementation, the processing unit is further used for:

[0037] Obtain the second timeout limit;

[0038] If a share confirmation message is received from each participant in the second participant set whose sub-key shares are to be allocated within the second timeout period, the key share held by the i-th participant is destroyed; the share confirmation message is used to indicate that the participant has successfully verified the received sub-key share.

[0039] Remove the i-th participant from the first participant set.

[0040] In this embodiment, when the i-th participant detects a key redistribution requirement in the first participant set, it can help restore the original number of key shares based on the key shares held by the i-th participant, thereby ensuring key security. For example, if the key was originally divided into 3 key shares, but one key share is lost, the key retrieval capability provided by this scheme can be used to restore the key from having only 2 key shares remaining after the loss to having 3 key shares, thus ensuring key security.

[0041] On the other hand, embodiments of this application provide a data processing method, the method comprising:

[0042] Receive the public key and commitment information broadcast by the i-th participant in the first participant set; wherein, the i-th participant is the participant among the multiple participants included in the first participant set that has not lost its key share; the commitment information is obtained by the i-th participant through key redistribution processing of the key fragments corresponding to its key share;

[0043] The public key and the commitment information are verified separately to obtain the verification result, and the verification result is returned to the i-th participant; when the i-th participant determines that the verification result indicates that the participants in the second participant set have successfully verified both the public key and the commitment information, the i-th participant allocates a sub-key share to the j-th participant in the second participant set based on multiple sub-key shares.

[0044] Receive the subkey share sent by the i-th participant, and based on the subkey share, designate the j-th participant in the second participant set as the new participant holding the key.

[0045] In this embodiment, the j-th participant in the second participant group can first receive the public key and commitment information sent by a participant in the first participant group that has not lost its key share, such as the i-th participant. Then, the public key and commitment information are verified to confirm that the i-th participant's identity is secure and reliable. Finally, the j-th participant obtains a sub-key share from the i-th participant and, based on this sub-key share, becomes the new participant holding the key. Therefore, this embodiment ensures that the j-th participant obtains the sub-key share from a secure i-th participant during key redistribution by first verifying the identity of the i-th participant to be sent the sub-key share, and only sending the sub-key share after successful verification. This ensures the correctness of the key share obtained based on the sub-key share, preventing malicious parties from damaging the key and effectively protecting key security.

[0046] On the other hand, embodiments of this application provide a data processing apparatus, which includes:

[0047] The receiving unit is used to receive the public key and commitment information broadcast by the i-th participant in the first participant set; wherein, the i-th participant is the participant among the multiple participants included in the first participant set that has not lost its key share; the commitment information is obtained by the i-th participant through key redistribution processing of the key fragments corresponding to its held key share;

[0048] The processing unit is used to verify the public key and the commitment information respectively, obtain the verification result, and return the verification result to the i-th participant; so that when the i-th participant determines that the verification result indicates that the participants in the second participant set have successfully verified both the public key and the commitment information, the i-th participant allocates a sub-key share to the j-th participant in the second participant set based on multiple sub-key shares.

[0049] The processing unit is also configured to receive the subkey share sent by the i-th participant and, based on the subkey share, designate the j-th participant in the second participant set as a new participant holding the key.

[0050] In one implementation, the number of participants in the first participant set who have not lost their key share is multiple; the commitment information includes a public key; the processing unit is used to verify the public key and the commitment information respectively, and when obtaining the target verification result, it is specifically used for:

[0051] Obtain the public key broadcast by each participant in the first participant set whose key share has not been lost, and verify whether the public keys broadcast by each participant are the same, and generate a first verification result; wherein, if the public keys broadcast by each participant are the same, the first verification result indicates that the public key verification is successful; if the public key sent by a participant is different from the public key sent by other participants, the first verification result indicates that the public key verification is unsuccessful.

[0052] In addition, verify whether the public key sent by the i-th participant in the first participant set is the same as the public key contained in the commitment information sent by the i-th participant, and generate a second verification result; wherein, if the public key sent by the i-th participant is the same as the public key contained in the commitment information sent by the i-th participant, the second verification result indicates that the verification of the commitment information sent by the i-th participant is successful.

[0053] Based on the first and second verification results, the target verification result is generated.

[0054] In one implementation, the commitment information includes a signature threshold associated with the first set of participants, and the number of participants included in the first set of participants;

[0055] The processing unit, used to designate the j-th participant in the second participant set as a new participant holding the key based on the sub-key share, specifically for:

[0056] Based on the Lagrange interpolation algorithm, the signature threshold, and the number of participants in the first participant set, the Lagrange interpolation polynomial of the key is constructed.

[0057] Verify whether the received subkey share is the coordinate point in the Lagrange interpolation polynomial corresponding to the key;

[0058] If so, the share of the key held by the j-th participant is determined based on the share of the subkey.

[0059] A share confirmation message is generated based on the key share held by the j-th participant, and this message is sent to each participant in the first participant set and each participant in the second participant set; and,

[0060] If a share confirmation message is received from each participant in the second participant set, then the j-th participant in the second participant set will be designated as the new participant holding the key.

[0061] In one implementation, the processing unit, when determining the key share held by the j-th participant based on the sub-key share, specifically performs the following:

[0062] Obtain the sub-key shares sent by the participants in the first participant set, excluding the i-th participant, who have not lost their key shares;

[0063] Add up the received subkey shares to get the summed key share;

[0064] The summed key share is used as the key share held by the j-th participant.

[0065] In this embodiment, the j-th participant in the second participant group can first receive the public key and commitment information sent by a participant in the first participant group that has not lost its key share, such as the i-th participant. Then, the public key and commitment information are verified to confirm that the i-th participant's identity is secure and reliable. Finally, the j-th participant obtains a sub-key share from the i-th participant and, based on this sub-key share, becomes the new participant holding the key. Therefore, this embodiment ensures that the j-th participant obtains the sub-key share from a secure i-th participant during key redistribution by first verifying the identity of the i-th participant to be sent the sub-key share, and only sending the sub-key share after successful verification. This ensures the correctness of the key share obtained based on the sub-key share, preventing malicious parties from damaging the key and effectively protecting key security.

[0066] On the other hand, embodiments of this application provide a computer device, the device comprising:

[0067] A processor is used to load and execute computer programs;

[0068] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described data processing method.

[0069] On the other hand, embodiments of this application provide a computer-readable storage medium storing a computer program adapted to be loaded by a processor and executed by the above-described data processing method.

[0070] On the other hand, embodiments of this application provide a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and when the computer instructions are executed by the processor, they implement the aforementioned data processing method. Attached Figure Description

[0071] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0072] Figure 1 This is a schematic diagram illustrating a key redistribution provided in an exemplary embodiment of this application;

[0073] Figure 2This is a flowchart illustrating a data processing method provided in an exemplary embodiment of this application;

[0074] Figure 3 This is a schematic diagram of a process provided by an exemplary embodiment of this application, showing how the i-th participant receives the verification result under a first timeout period.

[0075] Figure 4 This is a schematic diagram of a process provided by an exemplary embodiment of this application, showing how the i-th participant receives a share confirmation message under a second timeout period.

[0076] Figure 5 This is a flowchart illustrating another data processing method provided in an exemplary embodiment of this application;

[0077] Figure 6 This is a flowchart illustrating yet another data processing method provided in an exemplary embodiment of this application;

[0078] Figure 7 This is a schematic diagram of an authentication phase provided by an exemplary embodiment of this application;

[0079] Figure 8 This is a schematic diagram of a key verification result provided in an exemplary embodiment of this application;

[0080] Figure 9 This is a schematic diagram of the structure of a data processing apparatus provided in an exemplary embodiment of this application;

[0081] Figure 10 This is a schematic diagram of the structure of another data processing apparatus provided in an exemplary embodiment of this application;

[0082] Figure 11 This is a schematic diagram of the structure of a computer device provided in an exemplary embodiment of this application. Detailed Implementation

[0083] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0084] This application involves blockchain technology. Blockchain is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and cryptographic algorithms. Essentially, a blockchain is a decentralized database, a chain of data blocks linked using cryptographic methods. Each data block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and generate the next block. A blockchain is maintained by blockchain nodes in a blockchain network; a blockchain network often contains multiple blockchain nodes, each holding the same blockchain for maintenance and management. In practical applications, if a user wants to upload data to the blockchain, the user can upload the data to a blockchain node in the blockchain network through their device. This blockchain node and other blockchain nodes in the network will verify the data, and upon successful verification, generate a block based on the data. The blockchain nodes in the network then reach a consensus on this block, so that after successful consensus, the blockchain can be connected to the blockchain, realizing the on-chain recording of the transaction and ensuring transaction security.

[0085] Furthermore, ensuring the security of transactions within a blockchain network, including transaction signing and decryption, relies on resource clients within the blockchain technology. These resource clients implement resource management functions and, based on these functions, establish communication connections with decentralized application clients. In other words, a resource client is a tool responsible for managing and storing users' digital resources; for example, it can transfer digital resources to other accounts or receive digital resources transferred from other accounts. Formally, the resource client can be a hardware device or a software program.

[0086] In this application, the resource client of the target object can establish a communication connection with the decentralized application client to realize operations such as authorized login of the target object. It is understandable that with the widespread deployment of various decentralized applications (DApps) on the blockchain, user activity on the blockchain is increasing. Generally, when using a decentralized application, users can log in using a blockchain key management tool. The address in this key management tool corresponds to a user on the blockchain. The decentralized application can obtain the user address from the key management tool through some interfaces. To address the issue that the DApp backend cannot trust the user address used for login, the resource client has functions such as blockchain private key generation, transaction signing (receiving, transferring, etc.), and blockchain address balance query. In form, the resource client is similar to an online bank account, which can be used to store the user's private key in the blockchain network; the user's identity is identified through the private key on the blockchain, and the user's assets are managed through the private key. Furthermore, for operations such as the transfer, destruction, and remittance of digital assets, only transactions confirmed by signing the transaction using the user's private key will be executed by the blockchain if the transaction is genuine. Forged signatures will be rejected and fail, thus ensuring the secure storage, transfer, and use of digital assets on the blockchain.

[0087] With increasing demands for key security, Multi-Party Computation (MPC) tools have emerged. MPC allows two or more parties to jointly compute a function's output without revealing their input information. In digital signature scenarios, MPC tools are a digital signature protocol used to authorize transactions; specifically, parties holding key shards or shares of the key can negotiate signatures without disclosing their respective key shares. Therefore, compared to a single party holding the complete key, the distributed key sharding method provided by MPC tools offers higher transaction security. By distributing control, it aims to mitigate risk and improve disaster recovery, effectively avoiding single points of failure and other security issues.

[0088] The MPC tool primarily relies on the Threshold Signature Scheme (TSS) algorithm to implement the multi-party negotiation signature process. Threshold signature, also known as threshold signing (or signature threshold), is a cryptographic digital signature protocol. The threshold signature algorithm supports a set of participants with signing authority (called the signer) within the set of participants holding key fragments. The signer can negotiate and sign the transaction on behalf of the entire set of participants without exposing its own key fragment, significantly improving the security and privacy of the digital signature system. In the specific process of threshold signature, the number of all participants can be defined as n, and the threshold threshold as t. Only when at least t+1 participants participate in the negotiation signature and jointly generate a public key can the negotiation signature for the transaction be achieved; that is, the threshold signature algorithm can be a t / n threshold signature method. Specifically, the threshold signature algorithm mainly implements the negotiation signature process described above through the KeyGen and Sign algorithms. Among them, the KeyGen algorithm and the Sign algorithm are distributed among multiple parties; the number of participants in the KeyGen algorithm is the total number of participants in the entire MPC scenario, and the number of participants in the Sign algorithm is the threshold t+1.

[0089] It should be noted that the computer devices held by the aforementioned participants can be terminals with applications deployed, or servers corresponding to a specific platform (such as a browser); for example, the computer devices held by Participant 1 and Participant 2 are terminals, while the computer devices held by Participant 3 are servers, etc. Whether the computer device is a terminal or a server is customized by the user based on the storage requirements of the key shards; if the user wants to store key shards in an application, then the computer device can be a terminal; if the user wants to store key shards on a specific platform, then the computer device can be a server corresponding to that platform.

[0090] Furthermore, (1) the terminal may include, but is not limited to: smartphones (such as Android phones, iOS phones, etc.), tablet computers, portable personal computers, mobile internet devices (MIDs), smart TVs, in-vehicle devices, head-mounted devices, and other terminal devices. (2) the application deployed in the terminal refers to a computer program that completes one or more specific tasks; including but not limited to: ① client, the so-called client (also known as application client, APP client) refers to the application installed and running in the terminal; ② installation-free application, that is, an application that can be used without downloading and installing, this type of application is also known as a mini-program, which usually runs as a subroutine in the client. ③ web application opened through a browser; etc. Of course, applications of the same type can be divided into applications with different functions according to their application functions, such as game applications, communication applications, audio and video applications, and payment applications, etc. (3) A server can be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0091] It should also be noted that the terminal and server can be connected directly or indirectly via wired or wireless communication, and this application does not impose any restrictions on this. Optionally, the aforementioned terminal and / or server can be a blockchain node in the aforementioned blockchain network, directly participating in the on-chain storage of transactions. Optionally, the aforementioned terminal and / or server can also be an off-chain device connected to the blockchain network, in which case the terminal and / or server can interact with the blockchain nodes in the blockchain network to achieve on-chain storage of transactions.

[0092] For ease of explanation, this application embodiment uses the example of a participant set with n=3 participants and a threshold signature t=1. It does not limit the number of participants and the threshold signature in the actual application scenario of this application embodiment. This is hereby stated.

[0093] In practical applications, there may be situations where one or more participants in the participant set are unable to participate in the negotiation and signing process. For example, a participant's device may be unable to participate due to various reasons (such as network outages, hardware damage, or server unavailability or outages); another example is that a participant's share of the key may be lost; and so on. In this case, if the number of remaining participants capable of participating in the negotiation and signing process is exactly t+1, then the participant set is very likely to lose more key shares or have its devices become unavailable, resulting in fewer than t+1 participants participating in the negotiation and signing process, leading to key loss and consequently, on-chain data loss.

[0094] Based on this, this application proposes a data processing scheme, specifically a decentralized key redistribution scheme. This scheme provides a shard refresh mechanism for the MPC tool. In scenarios where the threshold is recoverable (i.e., the number of participants who can participate in negotiation and signing is greater than or equal to t+1), the single key shards held by the participants holding key shares are refreshed, allowing the user to regain the original number of key shards, and the original key shards are deleted and invalidated, thereby restoring the security of the shards.

[0095] This scheme primarily leverages the threshold capability of Shamir secret sharing to implement sharding refresh or redistribution functionality. Specifically, Shamir secret sharing constructs a Shamir polynomial of order t using the threshold signature t of the first set of participants. The key S to be shared is used as a constant term in the Shamir polynomial. The key shards corresponding to the key are divided into n parts and distributed to the n participants in the first set of participants. The key is obtained when the number of key shards is maximized (i.e., n) or equal to t+1. Here, the order of the Shamir polynomial is t=1, and the private key shares x_1, x_2, and x_3 are the values ​​of y1 (the key share held by participant 1), y2 (the key share held by participant 2), and y3 (the key share held by participant 3) corresponding to the independent variables x=1 (representing participant 1 with participant identifier 1), x=2 (representing participant 2 with participant identifier 2), and x=3 (representing participant 3 with participant identifier 3) in the Shamir polynomial. As can be seen from the principle of polynomials, for a polynomial of order 1 (which is a straight line on the x and y axes), any two points on the polynomial (e.g., the point on the polynomial corresponding to participant 1 is represented as (x_1, y1)) can reconstruct the polynomial. Therefore, by using the two key fragments held by the remaining two participants in the first participant who have not lost their key shares, each can perform a Shamir secret sharing, distributing the corresponding key shares to the corresponding second participant set. In this way, each participant in the second participant set calculates its own key fragment locally based on the sub-key shares sent by the participants in the first participant set that have not lost their key shares, while keeping the complete public key unchanged. This achieves the refresh of the original key in the first participant set, that is, refreshing the remaining two key fragments held by the first participant set to three new key fragments in the second participant set, and invalidating the old two key fragments.

[0096] Therefore, the first set of participants involved in this application embodiment is the set of participants who originally held the key, and the participants in this set hold key shares of the key. When there is a need for key redistribution in the first set of participants (e.g., a participant in the first set of participants has lost its key share), the user can reselect one or more participants to form a second set of participants, so as to recover multiple key shares corresponding to the complete key in the second set of participants. The participants in the first set and the participants in the second set are all or partly the same, or the participants in the first set and the participants in the second set are all different.

[0097] A schematic diagram of a key redistribution architecture can be found here. Figure 1 ;like Figure 1As shown, the first participant set includes participants 101, 102, and 103. Participant 101 holds key fragment 1 of the key, participant 2 holds key fragment 2 of the key, and participant 3 holds key fragment 3 of the key. If participant 2 loses its key fragment 2 for some reason (such as hardware damage, network connection failure, or key fragment theft), participant 1 in the first participant set, who has not lost its key fragment, can perform a Shamir secret sharing based on its key fragment 1 to obtain 3 sub-key shares. Similarly, participant 3 in the first participant set, who has not lost its key fragment, can perform a Shamir secret sharing based on its key fragment 3 to obtain 3 sub-key shares. Then, participant 1 in the first participant set sends the 3 sub-key shares to the 3 participants in the second participant set; similarly, participant 3 in the second participant set sends the 3 sub-key shares to the 3 participants in the second participant set. Finally, any participant in the second participant set can generate its own key share based on the two sub-key shares it receives, thereby restoring the number of keys in the second participant set, effectively ensuring the security of the keys, and thus ensuring the security of on-chain data.

[0098] It should be noted that the key redistribution scenario includes not only the scenario described above where a participant in the first participant set loses a key fragment, but also the scenario where a user has a key redistribution requirement. For example, if a user intends to redistribute a key to the first participant set during a first time period, that is, each participant in the first participant set holds the key corresponding to that key; if the user intends to redistribute a key to the second participant set during a second time period (e.g., the user wants to switch participants), then it is determined that the user has a key redistribution requirement, and the data processing scheme provided in this application embodiment can be used for key redistribution. Note that the first and second time periods mentioned above are different.

[0099] It should also be noted that: ① Considering that the first set of participants is a set of participants with lost key fragments, this embodiment can refer to it as old members, and the participants in the old members can be represented as oldparty; similarly, the second set of participants is a set of participants to be allocated sub-key shares, this embodiment can refer to it as newmembers, and the participants in the new members can be represented as new party. Furthermore, all or some of the participants in the second set of participants can be the same as the participants in the first set of participants; for example, if the first set of participants includes participant 1, participant 2, and participant 3, the second set of participants can include participant 1 from the first set, and can also include participants 4 and 5 not included in the first set; the participants in the second set of participants can be specified by the user, and this is not limited. ② The number of participants in the second participant set can be the same as the number of participants in the first participant set. In this implementation, the key shards are restored to their original number. Of course, the number of participants in the second participant set can also be different from the number of participants in the first participant set. For example, if the number of participants in the first participant set is 3, but the user can specify 4 participants to form the second participant set, this implementation can not only restore the key shards but also meet the user's need to redefine the number of participants during the redistribution process. ③ The data collection and processing in this application embodiment should strictly comply with the requirements of relevant national laws and regulations. Obtaining personal information requires the knowledge or consent of the individual subject (or has a legal basis for information acquisition), and subsequent data use and processing should be carried out within the scope of laws and regulations and the authorization of the personal information subject. For example, when this application embodiment is applied to specific products or technologies, such as obtaining the key share of a participant, the user's permission or consent is required, and the collection, use, and processing of related data (such as the collection and publication of bullet comments by the object) must comply with the relevant laws, regulations, and standards of the relevant countries and regions.

[0100] Based on the data processing scheme described above, this application proposes a more detailed data processing method. The data processing method proposed in this application will be described in detail below with reference to the accompanying drawings.

[0101] Figure 2 This illustration shows a flowchart of a data processing method provided by an exemplary embodiment of this application. The data processing method can be executed by a computer device, specifically by a computer device held by the i-th participant in a first set of participants who has not lost their key share; wherein the first set of participants includes multiple participants, some of whom have lost their key share, and the i-th participant is any participant in the first set who has not lost their key share. Figure 2As shown, the data processing method may include, but is not limited to, steps S201-S204:

[0102] S201: In response to the key redistribution request of the first set of participants, obtain the key fragment corresponding to the key share held by the i-th participant in the first set of participants.

[0103] The conditions for generating a key redistribution requirement for the first set of participants may include, but are not limited to: ① A participant in the first set of participants has lost its share of the key; in this case, it is not limited to the number of lost key shares, that is, as long as there is a key loss in the first set of participants, it is determined that the first set of participants generates a key redistribution requirement.

[0104] ② If the number of participants in the first participant set who have lost key shares is less than or equal to the signature threshold associated with the first participant set (and the aforementioned threshold t), then the first participant set is determined to have a key allocation requirement. Here, the signature threshold t indicates the maximum number of key shares that the first participant set is allowed to lose. If the number of participants in the first participant set who have lost key shares is greater than the signature threshold, then the number of participants in the first participant set who have not lost key shares does not meet the requirement for the number of participants needed to negotiate a signature. For example, assuming the signature threshold associated with the first participant set is t = 2, then the number of participants in the first participant set who need to negotiate a signature is determined to be t + 1 = 3, and the number of participants holding key shares in the first participant set is n = 5. Optionally, if one key share is lost in the first participant set (i.e., the number of participants with lost key shares is less than the signature threshold t), the number of participants with remaining unlost key shares in the first participant set is 4, which still meets the required number of participants for negotiation and signature. However, to maintain key security and avoid security issues caused by further key loss, the first participant set can still generate a key redistribution request. Optionally, if two key shares are lost in the first participant set (i.e., the number of lost key shares equals the signature threshold t), the number of participants with remaining unlost key shares in the first participant set is 3. It is determined that the first participant set can still negotiate and sign. However, if key shares continue to be lost, it will lead to key loss and consequently, loss of on-chain assets. Therefore, the first participant set generates a key redistribution request to improve key security.

[0105] ③ In the first set of participating parties, there are participating parties whose computer equipment is unavailable; the embodiments of this application do not limit the reasons for the unavailability of computer equipment. For example, the computer equipment may be unavailable due to hardware damage; the computer equipment may be unavailable due to inability to access the communication network; the computer equipment may be unavailable due to insufficient power; and so on.

[0106] When a key redistribution request arises in the first set of participants, the i-th participant in the first set who has not lost a key share (which is any one of the participants in the first set who has not lost a key share, and each participant who has not lost a key share executes the operation performed by the i-th participant) can respond to the key redistribution request of the first set of participants and obtain the key fragment corresponding to the key share held by the i-th participant. Considering that the embodiments of this application are based on the principle of Shamir secret sharing to achieve redistribution; the key share x_i held by the i-th participant is the dependent variable yi of the Shamir polynomial output when the independent variable is the participant identifier of the i-th participant. Based on the fundamental principles of polynomials, the key cannot be directly obtained from the key share held by a participant in the first set of participants who has not lost their key share. Therefore, this application supports using a Lagrange interpolation algorithm (a polynomial interpolation method) to calculate the multiplication coefficients of the Lagrange interpolation for the i-th participant based on the participants in the first set who have not lost their key shares. This allows the key fragment w_i corresponding to the key share held by the i-th participant to be determined using these multiplication coefficients and the key share held by the i-th participant. The key fragments corresponding to each participant in the first set are added together to obtain the constant term S of the Shamir polynomial, which is the actual key. In other words, the key fragment held by the i-th participant is one of the multiple key fragments that make up the key.

[0107] The above provides a brief introduction to the calculation principle of the key fragment corresponding to the key share held by the i-th participant. The specific implementation process of calculating the key fragment w_i based on the Lagrange interpolation algorithm may include, but is not limited to: First, obtaining the Lagrange interpolation polynomial corresponding to the key; the independent variable of this Lagrange interpolation polynomial (which can be understood as the horizontal axis x in the coordinate axis) is the participant identifier of the participant in the first participant set, and the dependent variable of the Lagrange interpolation polynomial (which can be understood as the vertical axis y in the coordinate axis) is the key share held by the participant in the first participant set. Then, obtaining the participant identifiers of the other participants in the first participant set besides the i-th participant who participated in the negotiation and signing. Second, based on the participant identifiers of the other participants who participated in the negotiation and signing, the participant identifier of the i-th participant, and the Lagrange interpolation polynomial corresponding to the key, calculating the Lagrange interpolation coefficients of the key share held by the i-th participant. Finally, based on the key share held by the i-th participant and the Lagrange interpolation coefficient, the key fragment corresponding to the key share held by the i-th participant is obtained; specifically, the key fragment w_i corresponding to the key share x_i held by the i-th participant is equal to the Lagrange interpolation coefficient * key share x_i.

[0108] S202: Perform key redistribution processing on the key fragments to generate multiple sub-key shares and commitment information corresponding to the key fragments.

[0109] After obtaining the key fragment w_i based on the aforementioned steps, the i-th participant can use its held key fragment w_i as a "key" to be stored by multiple parties. At this point, a secret sharing can be performed on this "key" to distribute the multiple sub-key shares corresponding to w_i to the participants in the second participant set. It should be noted that, to improve the security of secret sharing, this application embodiment supports the use of an improved algorithm of Shamir secret sharing—the Feldman verifiable secret sharing (Feldman VSS) algorithm—to achieve secret sharing of key fragment w_i. The Feldman VSS algorithm is an improvement on Shamir secret sharing. Shamir secret sharing includes the assumption that all participants, including the key distributor, must be honest. Compared to the Shamir secret sharing algorithm, the Feldman VSS algorithm adds a verifiable component, thereby improving its anti-spoofing capabilities. In the MPC tool scenario, each participant is a secret distributor of Feldmanvss, but each selects a polynomial, distributes the secret, and provides verifiable commitment information, ensuring decentralized sharing of the secret. Even if there are some malicious parties, the complete secret will not be leaked.

[0110] In specific implementations, the process of redistributing key fragments based on the Feldman-VSS algorithm to generate multiple sub-key shares and commitment information corresponding to key fragments may include, but is not limited to:

[0111] 1) Choose a Lagrange interpolation polynomial for the key fragment w_i.

[0112] Specifically, the signature threshold t associated with the first set of participants and the number n of participants in the second set of participants are obtained. Based on the Lagrange interpolation algorithm, the signature threshold t, and the number n of participants in the second set of participants, a Lagrange interpolation polynomial corresponding to the key fragment held by the i-th participant is constructed. In the scenario of participant sets t=1 and n=3, the order of this Lagrange interpolation polynomial is 1, the constant term is the key fragment w_i, and the polynomial coefficients of the Lagrange interpolation polynomial are random.

[0113] 2) When calculating the independent variable x = 1, 2, 3, ..., n in the Lagrange interpolation polynomial, the dependent variable is the n subkey shares corresponding to the key fragment w_i.

[0114] As described above, the independent variable of the polynomial is the participant identifier of each participant, and the dependent variable is the key share held by the participant corresponding to that identifier. Therefore, this embodiment supports first obtaining the participant identifiers of each participant in the second set of participants whose sub-key shares are to be allocated; then, inputting each participant's identifier into the Lagrange interpolation polynomial corresponding to the key fragment to generate multiple sub-key shares corresponding to the key fragment. As can be seen from the above description, there is a correspondence between participant identifiers and sub-key shares. For example, if participant 1 in the second participant set has participant identifier 'a', then inputting participant identifier 'a' into the Lagrange interpolation polynomial will output the subkey share 'a' to be allocated to participant 1. That is, participant identifier 'a' of participant 1 corresponds to subkey share 'a'. Similarly, if participant 2 in the second participant set has participant identifier 'b', then inputting participant identifier 'b' into the Lagrange interpolation polynomial will output the subkey share 'b' to be allocated to participant 2. That is, participant identifier 'b' of participant 2 corresponds to subkey share 'b'.

[0115] 3) Calculate the commitment information (i.e., the Feldman commitment).

[0116] The commitment information is used to indicate the authenticity of the public key and key fragment held by the i-th participant, and that the key fragment and public key are matched (i.e., the key corresponding to the key fragment matches the public key). The purpose of this commitment information is for the i-th participant to promise the correctness of its key share (or key fragment) and public key information to the participants in the second participant set. This allows the participants in the second participant set to verify the identity of the i-th participant by checking the commitment information, thereby preventing security issues caused by malicious actions by the participant affecting the key or on-chain assets. Specifically, according to the Feldman VSS algorithm principle, after constructing the Lagrange interpolation polynomial corresponding to the key fragment w_i based on the aforementioned content, the commitment information of the key fragment can be generated based on the polynomial coefficients of this Lagrange interpolation polynomial. This commitment information can be represented as g*, where "*" represents the polynomial coefficients in the Lagrange interpolation polynomial.

[0117] S203: Broadcast the public key and commitment information corresponding to the secret key to the second set of participants for verification processing, so that the participants in the second set of participants return the verification result.

[0118] The i-th participant in the first participant set calculates the commitment information based on the Feldman-VSS algorithm, obtains the public key corresponding to the secret key, and broadcasts the public key and commitment information to each participant in the second participant set. This allows the participants in the second participant set to verify the public key and commitment information, enabling them to authenticate the i-th participant based on the public key and commitment information, ensuring that the i-th participant is not a malicious participant, thereby ensuring the security of the subsequent secret key.

[0119] S204: If the verification result indicates that the verification of both the public key and the commitment information is successful, then the j-th participant in the second participant set is allocated a sub-key share based on multiple sub-key shares, so that the j-th participant becomes a new participant holding the key.

[0120] Specifically, if the verification result returned by the second participant in the second participant set indicates that both the public key and the commitment information have been successfully verified, it means that the second participant confirms that the identity of the i-th participant in the first participant set is correct and secure. Then, based on the multiple sub-key shares obtained in the aforementioned steps, the i-th participant allocates sub-key shares to the j-th participant in the second participant set, making the j-th participant a new participant holding the key, thereby restoring the key share. The verification result can be returned to the i-th participant in the form of Ack (AckMsg).

[0121] Furthermore, the verification result received by the i-th participant is time-limited; only when the i-th participant receives verification results from all participants in the second participant set within the timeout period, and all verification results indicate successful verification, is the identity verification of the i-th participant by the second participant set considered successful. This avoids the i-th participant being in a waiting state for an extended period, thus preventing resource waste. For a detailed implementation process, please refer to [link to implementation details]. Figure 3 ;like Figure 3 As shown, firstly, the i-th participant can obtain a first timeout period, such as 60 seconds. The specific duration of the first timeout period can be pre-configured, and this embodiment does not limit the duration of the first timeout period. Then, if the i-th participant receives the verification results returned by each participant in the second participant set whose sub-key shares are to be allocated within the first timeout period, and each verification result indicates that the verification of the public key and commitment information is successful, it means that each participant in the second participant set has verified the identity of the i-th participant correctly. Then, based on the correspondence between the reference party identifier and the sub-key share, the sub-key share that corresponds to the participant identifier of the j-th participant in the second participant set can be allocated to the j-th participant. Conversely, if, within the first timeout period, at least one participant in the second participant set who is to be allocated a sub-key share fails to return a verification result, or if a verification result indicates that at least one of the public key and commitment information has failed, a redistribution prompt message is output. This redistribution prompt message indicates that the key redistribution has failed. At this time, the i-th participant can output the redistribution prompt message to the user so that the user can customize whether the redistribution process needs to be restarted. It is worth noting that the judgment process mentioned above can specifically be as follows: Figure 3 The two-step verification process is shown below. The first step is to determine whether the verification results sent by all participants in the second participant set who are to be allocated sub-key shares have been received. The second step is to determine whether the verification results sent by each participant indicate that the verification was successful. This two-stage verification method can effectively improve verification efficiency, save verification resources, and increase verification speed.

[0122] Furthermore, after receiving the subkey share sent by the i-th participant, the participants in the second set of participants (such as the j-th participant) will also verify the binding relationship between the subkey share and the commitment information based on the cached commitment information. Specifically, the authenticity of the subkey share is verified based on the commitment information to ensure the authenticity of the received subkey share, thereby ensuring the reliability of the key share subsequently generated based on the subkey share. Only after the verification of the subkey share is successful will subsequent operations be performed to make the j-th participant a new participant holding the key.

[0123] In the above scenario, the i-th participant will also acquire a second timeout period and wait within this period to receive a share confirmation message (such as an Ack message) from the second participant set. This share confirmation message indicates that the participants in the second participant set have successfully verified the received subkey share. For details on the implementation process, please refer to [link to implementation details]. Figure 4 ;like Figure 4 As shown, if confirmation messages for the sub-key shares to be allocated are received from each participant in the second participant set within the second timeout period, it indicates that each participant in the second participant set has successfully verified the sub-key shares. In this case, the key share held by participant i is destroyed, and participant i is removed from the first participant set, specifically from the Shamir secret sharing protocol. Conversely, if no confirmation messages for the sub-key shares are received from one or more participants in the second participant set within the second timeout period, participant i can output a prompt message to the user. This prompt message indicates that the reallocation has failed and whether a restart is needed, allowing the user to intuitively and promptly perceive the reallocation result.

[0124] In summary, when the i-th participant in the first participant set who has not lost its key share determines that a key redistribution requirement has arisen in the first participant set (e.g., one or more participants in the first participant set have lost their key shares), it can first calculate the key fragment corresponding to its key share, which is part of the key. Then, the i-th participant performs key redistribution processing on the key fragment, generating multiple sub-key shares and commitment information. Further, the i-th participant first broadcasts the public key and commitment information corresponding to the key to the second participant set, so that the participants in the second participant set can verify the public key and commitment information to ensure that the i-th participant is not a malicious party, thereby maintaining data security. When the i-th participant receives the verification result returned by the second participant set, and the verification result is successful, the i-th participant then allocates a sub-key share to the j-th participant in the second participant set based on the multiple sub-key shares, so that the j-th participant becomes a new participant holding the key based on the allocated sub-key share. Therefore, when a key redistribution requirement is detected in the first set of participants, this embodiment can help restore the original number of key shares based on the key share held by the i-th participant, thereby ensuring key security. For example, if the key was originally divided into 3 key shares, but one key share is lost, the key retrieval capability provided by this solution can be used to restore the key from having only 2 key shares remaining after the loss to having 3 key shares, thus ensuring key security.

[0125] Figure 5This illustration shows a flowchart of another data processing method provided by an exemplary embodiment of this application. This data processing method can be executed by a computer device, specifically by the computer device held by the j-th participant in the second set of participants whose sub-key shares are to be allocated; the j-th participant can be any participant in the second set of participants. Figure 5 As shown, the data processing method may include, but is not limited to, steps S501-S503:

[0126] S501: Receive the public key and commitment information broadcast by the i-th participant in the first participant set.

[0127] S502: Verify the public key and commitment information respectively, obtain the verification result, and return the verification result to the i-th participant.

[0128] In steps S501-S502, when the j-th participant in the second participant set receives the public key and commitment information broadcast by the i-th participant in the first participant set, it can verify the correctness of the public key and commitment information to verify the identity and reliability of the i-th participant. This ensures that the j-th participant subsequently obtains the sub-key share from the correct participant, thereby ensuring the security of the key and on-chain assets. Specifically, if there are multiple participants in the first participant set who have not lost their key share, and the i-th participant is among these multiple participants; and the commitment information broadcast by the i-th participant contains the public key; then the process by which the j-th participant performs verification on the public key and commitment information may include, but is not limited to:

[0129] 1) Verify the consistency of the public keys broadcast by each participant in the first participant set who has not lost their key share. Specifically, the j-th participant can obtain the public key broadcast by each participant in the first participant set who has not lost their key share, and verify whether the public keys broadcast by each participant are the same, generating a first commitment verification result. Considering that the public keys held by each participant in the same participant set should be the same, if the public keys broadcast by each participant in the first participant set are the same, it indicates that each participant is a correct participant holding the correct public key, and the first commitment verification result indicates: public key verification successful.

[0130] 2) Verify the commitment information. Specifically, verify whether the public key broadcast by each participant in the first participant set is consistent with the public key in the corresponding commitment information; if they are consistent, further verify the reliability of the participants in the first participant set. Taking the i-th participant in the first participant set as an example, it can be verified whether the public key sent by the i-th participant in the first participant set is the same as the public key contained in the commitment information sent by the i-th participant, and generate a second credential verification result; wherein, if the public key sent by the i-th participant is the same as the public key contained in the commitment information sent by the i-th participant, the second credential verification result indicates that the verification of the commitment information sent by the i-th participant was successful.

[0131] In this way, the j-th participant can generate a target verification result based on the first verification result and the second verification result. Specifically, if either the first verification result or the second verification result is a verification failure, the target verification result indicates that the verification of the public key and / or commitment information has failed; conversely, if both the first and second verification results are successful, the target verification result indicates that the verification of both the public key and the commitment information has been successful.

[0132] Furthermore, the j-th participant can return the target verification result to the first participant set, so that the participants in the first participant set can return the corresponding subkey share based on the target verification result to perform subsequent operations. Even further, this embodiment of the application also supports the j-th participant caching the commitment information sent by each participant in the first participant set, so that the received subkey share can be verified based on the commitment information later.

[0133] S503: Receive the subkey share sent by the i-th participant, and based on the subkey share, designate the j-th participant in the second participant set as the new participant holding the key.

[0134] Wherein, the commitment information sent by the i-th participant includes the signature threshold t associated with the first participant and the number n of participants contained in the first participant set. Then, the process of making the j-th participant in the second participant set a new participant holding the key based on the subkey share can include: First, constructing the Lagrange interpolation polynomial of the key based on the Lagrange interpolation algorithm, the signature threshold t, and the number n of participants contained in the first participant set; in the scenario where n=3 and t=1, the Lagrange interpolation algorithm is a polynomial of order 1.

[0135] Next, it is verified whether the received subkey share is a coordinate point in the Lagrange interpolation polynomial corresponding to the key. If the subkey share is a coordinate point in the Lagrange interpolation polynomial, it indicates that there is a matching or binding relationship between the subkey share and the commitment information, that is, the commitment information sent in the aforementioned stage can verify whether the subkey share is correct. Secondly, if the subkey share is a coordinate point in the Lagrange interpolation polynomial corresponding to the key, the key share held by the j-th participant is determined based on the subkey share. Specifically: the subkey shares sent by the other participants in the first participant set (excluding the i-th participant) that have not lost their key shares are obtained, and the received subkey shares are added together to obtain the summed key share. This summed key share can then be used as the key share held by the j-th participant.

[0136] Finally, a share confirmation message is generated based on the key share held by the j-th participant. This share confirmation message is sent to each participant in the first participant set and each participant in the second participant set, so that participants in both sets are aware that the j-th participant is ready to become a new key holder. Furthermore, the j-th participant can also receive share confirmation information returned by other participants in the second participant set; if it receives share confirmation messages from each participant in the second participant set, it indicates that each participant in the second participant set is ready to become a new key holder, and thus the j-th participant in the second participant set is designated as the new key holder.

[0137] In summary, the j-th participant in the second participant group can first receive the public key and commitment information sent by a participant in the first participant group who has not lost a key share, such as the i-th participant. Then, the public key and commitment information are verified to confirm that the i-th participant's identity is secure and reliable. Finally, the j-th participant obtains a sub-key share from the i-th participant and, based on this sub-key share, becomes the new participant holding the key. Therefore, this embodiment of the application, in the key redistribution process, ensures that the j-th participant obtains the sub-key share from a secure i-th participant by first verifying the identity of the i-th participant to be sent the sub-key share, and only sending the sub-key share after successful verification. This ensures the correctness of the key share obtained based on the sub-key share, thereby preventing malicious parties from destroying the key and effectively protecting the key's security.

[0138] It is worth noting that the above Figure 2 The illustrated embodiment mainly describes the specific implementation process of the data processing method from the perspective of the i-th participant in the first participant set; the above Figure 5The illustrated embodiment primarily describes the specific implementation process of the data processing method from the perspective of the j-th participant in the second participant set. For ease of understanding, it is combined with... Figure 6 Provide a flowchart illustrating the process by which the i-th participant in the first set of participants and the j-th participant in the second set of participants jointly execute the data processing method; for example... Figure 6 As shown: s11. The i-th participant in the first participant set calculates key fragment w_i based on its held key share x_i. This key fragment w_i is added to the key fragments held by other participants in the first participant set to obtain the actual key. s12. The i-th participant calculates multiple sub-key shares and commitment information based on key fragment w_i. s13. The i-th participant broadcasts the public key and commitment information to the j-th participant in the second participant set. s14. The j-th participant in the second participant set verifies the broadcast public key and commitment information and generates a verification result. s15. The j-th participant returns the verification result to the i-th participant. s16. Upon receiving the verification result and determining that it indicates the j-th participant has successfully verified both the public key and commitment information, the i-th participant sends a sub-key share corresponding to the j-th participant's participant identifier. s17. Participant j verifies the subkey share and generates a key share held by participant j based on the subkey share. s18. Participant j sends share confirmation information to all other participants in the first and second participant sets except for participant j. s19. After receiving share confirmation information from all participants in the second participant set, participant i destroys the old key share and exits the protocol.

[0139] It is worth noting that the execution order of steps s17 and s18 is not important. For example, step s18 can be executed after verifying the subkey share to send the share confirmation information to all participants in the first and second participant sets except for the j-th participant. Alternatively, step s18 can be executed after verifying the subkey share and generating the key share held by the j-th participant based on the subkey share to send the share confirmation information to all participants in the first and second participant sets except for the j-th participant. It is also worth noting that the specific implementation process of each step can be found in the aforementioned... Figure 2 and Figure 5 The relevant descriptions of the contents in the illustrated embodiments will not be repeated here.

[0140] This application embodiment can roughly divide the data processing method described in steps s11-s19 above into two stages: a first stage and a second stage. In the first stage, public key consistency negotiation and the broadcast of the Felldman VSS commitment are completed. In the second stage, the old members (the first set of participants) distribute new subkey shares to the new members (the second set of participants) point-to-point. The new members verify the subkey shares and the FVSS commitment. After all verifications are completed, a new private key fragment is calculated, and a final ack (i.e., a share confirmation message) is broadcast to the new members and old members. Thus, after the new members and old members collect and confirm the final acks from other participants, the redistribution is completed. The two stages mentioned above are described in detail below:

[0141] (1) The first stage is the authentication stage for the i-th participant. A flowchart of the method for this authentication stage can be found in [link to flowchart]. Figure 7 .like Figure 7 As shown, assuming the first participant set contains three participants: participant 1, participant 2, and participant 3, and participant 2's key share is lost, then for participants 1 and 2, the implementation process shown in steps S201-S203 above can be used to generate multiple sub-key fragments (e.g., if the number of participants in the second participant set to be allocated sub-key shares is 3, then the number of multiple sub-key shares is 3) and commitment information. Then, participants 1 and 2 can broadcast the public key corresponding to their keys and commitment information to each participant in the second participant set whose sub-key shares are to be allocated. Then, the participants in the second participant set can use the received public key and commitment information to ensure the correctness of the identities of participants 1 and 2 in the first participant set. Finally, each participant in the second participant set can return a verification result to participants 1 and 2 in the first participant set, specifically an Ack message, so that participants 1 and 2 can perform subsequent operations based on the Ack message.

[0142] (2) The second stage is the key verification stage for the sub-key share. A flowchart illustrating the method for this key verification stage can be found here. Figure 8 .like Figure 8As shown, when both Participant 1 and Participant 2 in the first participant set receive the verification results returned by each participant in the second participant set, and the verification results are successful, Participant 1 and Participant 2 can allocate multiple subkey shares to the second participant set according to the correspondence between participant identifiers and subkey shares. Then, the participants in the second participant set can verify the binding relationship (or matching relationship) between the subkey shares and the corresponding commitment information based on the cached commitment information to verify the authenticity of the subkey shares. Finally, the second participant set can return a share confirmation message to Participant 1 and Participant 2 in the first participant set, indicating that the participants in the second participant set have successfully verified the subkey shares. Participant 1 and Participant 2 can then execute the operation of destroying the old key shares and exiting the protocol, thereby ensuring that the second participant set becomes the new participant set holding the key.

[0143] Therefore, the embodiment supports verifying the identity of the participants in the first participant set in the first stage, and only performing the subkey share allocation after the verification is successful. On the one hand, this can prevent malicious behavior by the participants, and on the other hand, it can save computing resources and improve redistribution efficiency to a certain extent.

[0144] In summary, this application provides a novel decentralized private key management method. This method allows users to store blockchain account keys (specifically private keys) in the form of key shards on the computer devices of multiple participants. If some key shards are lost, as long as the recoverable signature threshold is not exceeded, the key can be "recovered." Under the premise of ensuring key security (key shards have never met and the complete key has never appeared), a new complete key shard can be securely negotiated, giving resource clients the ability to "retrieve" lost key shards, thereby further ensuring the security of on-chain assets.

[0145] The methods of the embodiments of this application have been described in detail above. In order to facilitate better implementation of the above methods of the embodiments of this application, the apparatus of the embodiments of this application is provided below.

[0146] Figure 9 The diagram illustrates a structural schematic of a data processing apparatus according to an exemplary embodiment of this application. This data processing apparatus may be a computer program (including program code) running on a computer device; the data processing apparatus may be used to execute... Figure 2 and Figure 6 The method embodiments shown include some or all of the steps; the apparatus includes the following units:

[0147] The acquisition unit 901 is used to acquire the key fragment corresponding to the key share held by the i-th participant in the first participant set in response to the key redistribution request of the first participant set; the first participant set contains multiple participants, some of whom have lost their key shares; the i-th participant is any participant that has not lost its key share.

[0148] Processing unit 902 is used to perform key redistribution processing on key fragments, generating multiple sub-key shares and commitment information corresponding to key fragments; the commitment information is used to indicate the authenticity of the public key and key fragment held by the i-th participant, and the key fragment and public key have a matching relationship;

[0149] The processing unit 902 is also used to broadcast the public key and commitment information corresponding to the secret key to the second set of participants for verification processing, so that the participants in the second set of participants return the verification result;

[0150] The processing unit 902 is further configured to, if the verification result indicates that the verification of both the public key and the commitment information is successful, allocate a sub-key share to the j-th participant in the second participant set based on multiple sub-key shares, so that the j-th participant becomes a new participant holding the key; the j-th participant is any participant in the second participant set.

[0151] In one implementation, the conditions for generating a key redistribution requirement among the first set of participants include:

[0152] If the number of participants in the first participant set who have lost their key share is less than or equal to the signature threshold associated with the first participant set, then the first participant set is determined to have a key redistribution requirement.

[0153] The signature threshold is used to indicate the maximum number of key shares that can be lost in the first set of participants. If the number of participants in the first set of participants who have lost key shares is greater than the signature threshold, then the number of participants in the first set of participants who have not lost key shares does not meet the requirement of the number of participants required for negotiated signature.

[0154] In one implementation, the processing unit 902, when obtaining the key fragment corresponding to the key share held by the i-th participant in the first participant set, is specifically used for:

[0155] Obtain the Lagrange interpolation polynomial corresponding to the key; the independent variable of the Lagrange interpolation polynomial is the participant identifier of the participant in the first participant set, and the dependent variable of the Lagrange interpolation polynomial is the share of the key held by the participant in the first participant set;

[0156] Obtain the participant identifiers of all participants in the first set of participants, excluding the i-th participant, who have participated in the negotiation and signed the agreement.

[0157] Based on the participant identifiers of other participants who participated in the negotiation signature, the participant identifier of the i-th participant, and the Lagrange interpolation polynomial corresponding to the key, calculate the Lagrange interpolation coefficients of the key share held by the i-th participant.

[0158] Based on the key share held by the i-th participant and the Lagrange interpolation coefficient, the key fragment corresponding to the key share held by the i-th participant is obtained; wherein, the key fragment held by the i-th participant is one of the multiple key fragments that make up the key.

[0159] In one implementation, the processing unit 902 is used to perform key redistribution processing on the key fragments, and when generating multiple sub-key shares and commitment information corresponding to the key fragments, it is specifically used for:

[0160] Obtain the signature threshold associated with the first set of participants, and the number of participants contained in the second set of participants;

[0161] Based on the Lagrange interpolation algorithm, the signature threshold, and the number of participants in the second participant set, construct the Lagrange interpolation polynomial corresponding to the key fragment held by the i-th participant;

[0162] Obtain the participant identifiers of each participant in the second participant set whose sub-key shares are to be allocated, and input each participant's identifier into the Lagrange interpolation polynomial corresponding to the key fragment to generate multiple sub-key shares corresponding to the key fragment; there is a correspondence between the participant identifier and the sub-key share; and,

[0163] The commitment information of the key fragment is generated based on the Lagrange interpolation polynomial corresponding to the key fragment.

[0164] In one implementation, processing unit 902 is configured to, if the target verification result indicates successful verification of both the public key and the commitment information, allocate a subkey share to the j-th participant in the second participant set based on multiple subkey shares, specifically:

[0165] Get the first timeout limit;

[0166] If the target verification results are received from each participant in the second participant set whose subkey shares are to be allocated within the first timeout period, and each target verification result indicates that the verification of the public key and commitment information is successful, then the subkey share that corresponds to the participant identifier of the j-th participant in the second participant set will be allocated to the j-th participant.

[0167] In one implementation, the processing unit 902 is further configured to:

[0168] If, within the first timeout period, at least one of the participants in the second participant set who are to be allocated a subkey share fails to return the target verification result, or if there is a target verification result indicating that at least one of the public key and commitment information has failed to be verified, then a redistribution prompt message will be output.

[0169] The key redistribution message indicates that the key redistribution failed.

[0170] In one implementation, the processing unit 902 is further configured to:

[0171] Obtain the second timeout limit;

[0172] If a share confirmation message is received from each participant in the second participant set whose sub-key shares are to be allocated within the second timeout period, the key share held by the i-th participant is destroyed; the share confirmation message is used to indicate that the participant has successfully verified the received sub-key share.

[0173] Remove the i-th participant from the first participant set.

[0174] According to one embodiment of this application, Figure 9 The data processing apparatus shown can be constructed by combining each unit into one or more other units, or by further dividing one or more units into several smaller functional units. This achieves the same operation without affecting the technical effects of the embodiments of this application. The above units are based on logical function division. In practical applications, the function of one unit can be implemented by multiple units, or the function of multiple units can be implemented by one unit. In other embodiments of this application, the data processing apparatus may also include other units. In practical applications, these functions can also be implemented with the assistance of other units, and can be implemented by multiple units working together. According to another embodiment of this application, the data processing apparatus can be executed by running on a general-purpose computing device, such as a computer, which includes processing elements and storage elements such as a central processing unit (CPU), RAM, and ROM. Figure 2 and Figure 6 The computer program (including program code) for each step involved in the corresponding method shown, to construct such... Figure 9 The data processing apparatus shown herein, and the data processing method for implementing the embodiments of this application, are described. A computer program may be recorded on, for example, a computer-readable recording medium, loaded onto the aforementioned computing device via the computer-readable recording medium, and executed therein.

[0175] In this embodiment, when the i-th participant in the first participant set that has not lost its key share determines that a key redistribution requirement has arisen in the first participant set (e.g., one or more participants in the first participant set have lost their key shares), it can first calculate the key fragment corresponding to its key share based on its held key share. This key fragment is part of the key. Then, the i-th participant performs key redistribution processing on the key fragment, generating multiple sub-key shares and commitment information. Further, the i-th participant first broadcasts the public key and commitment information corresponding to the key to the second participant set, so that the participants in the second participant set can first verify the public key and commitment information to ensure that the i-th participant is not a malicious party, thereby maintaining data security. When the i-th participant receives the verification result returned by the second participant set, and the verification result is successful, the i-th participant then allocates a sub-key share to the j-th participant in the second participant set based on the multiple sub-key shares, so that the j-th participant becomes a new participant holding the key based on the allocated sub-key share. Therefore, when a key redistribution requirement is detected in the first set of participants, this embodiment can help restore the original number of key shares based on the key share held by the i-th participant, thereby ensuring key security. For example, if the key was originally divided into 3 key shares, but one key share is lost, the key retrieval capability provided by this solution can be used to restore the key from having only 2 key shares remaining after the loss to having 3 key shares, thus ensuring key security.

[0176] Figure 10 The diagram illustrates the structure of another data processing apparatus provided in an exemplary embodiment of this application. This data processing apparatus may be a computer program (including program code) running on a computer device; the data processing apparatus may be used to execute... Figure 5 and Figure 6 The method embodiments shown include some or all of the steps; the apparatus includes the following units:

[0177] The receiving unit 1001 is used to receive the public key and commitment information broadcast by the i-th participant in the first participant set; wherein, the i-th participant is the participant among the multiple participants included in the first participant set that has not lost its key share; the commitment information is obtained by the i-th participant through key redistribution processing of the key fragments corresponding to its held key share;

[0178] Processing unit 1002 is used to perform verification processing on the public key and the commitment information respectively, obtain the verification result, and return the verification result to the i-th participant; so that when the i-th participant determines that the verification result indicates that the participants in the second participant set have successfully verified both the public key and the commitment information, the i-th participant allocates a sub-key share to the j-th participant in the second participant set based on multiple sub-key shares.

[0179] The processing unit 1002 is further configured to receive a subkey share sent by the i-th participant, and to designate the j-th participant in the second participant set as a new participant holding the key based on the subkey share.

[0180] In one implementation, the number of participants in the first participant set who have not lost their key share is multiple; the commitment information includes a public key; the processing unit 1002 is used to verify the public key and the commitment information respectively, and when obtaining the target verification result, it is specifically used for:

[0181] Obtain the public key broadcast by each participant in the first participant set whose key share has not been lost, and verify whether the public keys broadcast by each participant are the same, and generate a first verification result; wherein, if the public keys broadcast by each participant are the same, the first verification result indicates that the public key verification is successful; if the public key sent by a participant is different from the public key sent by other participants, the first verification result indicates that the public key verification is unsuccessful.

[0182] In addition, verify whether the public key sent by the i-th participant in the first participant set is the same as the public key contained in the commitment information sent by the i-th participant, and generate a second verification result; wherein, if the public key sent by the i-th participant is the same as the public key contained in the commitment information sent by the i-th participant, the second verification result indicates that the verification of the commitment information sent by the i-th participant is successful.

[0183] Based on the first and second verification results, the target verification result is generated.

[0184] In one implementation, the commitment information includes a signature threshold associated with the first set of participants, and the number of participants included in the first set of participants;

[0185] Processing unit 1002, when adding the j-th participant in the second participant set as a new participant holding the key based on the sub-key share, specifically performs the following:

[0186] Based on the Lagrange interpolation algorithm, the signature threshold, and the number of participants in the first participant set, the Lagrange interpolation polynomial of the key is constructed.

[0187] Verify whether the received subkey share is the coordinate point in the Lagrange interpolation polynomial corresponding to the key;

[0188] If so, the share of the key held by the j-th participant is determined based on the share of the subkey.

[0189] A share confirmation message is generated based on the key share held by the j-th participant, and this message is sent to each participant in the first participant set and each participant in the second participant set; and,

[0190] If a share confirmation message is received from each participant in the second participant set, then the j-th participant in the second participant set will be designated as the new participant holding the key.

[0191] In one implementation, the processing unit 1002, when determining the key share held by the j-th participant based on the sub-key share, specifically performs the following:

[0192] Obtain the sub-key shares sent by the participants in the first participant set, excluding the i-th participant, who have not lost their key shares;

[0193] Add up the received subkey shares to get the summed key share;

[0194] The summed key share is used as the key share held by the j-th participant.

[0195] According to one embodiment of this application, Figure 10 The data processing apparatus shown can be constructed by combining each unit into one or more other units, or by further dividing one or more units into several smaller functional units. This achieves the same operation without affecting the technical effects of the embodiments of this application. The above units are based on logical function division. In practical applications, the function of one unit can be implemented by multiple units, or the function of multiple units can be implemented by one unit. In other embodiments of this application, the data processing apparatus may also include other units. In practical applications, these functions can also be implemented with the assistance of other units, and can be implemented by multiple units working together. According to another embodiment of this application, the data processing apparatus can be executed by running on a general-purpose computing device, such as a computer, which includes processing elements and storage elements such as a central processing unit (CPU), RAM, and ROM. Figure 5 and Figure 6 The computer program (including program code) for each step involved in the corresponding method shown, to construct such... Figure 10 The data processing apparatus shown herein, and the data processing method for implementing the embodiments of this application, are described. A computer program may be recorded on, for example, a computer-readable recording medium, loaded onto the aforementioned computing device via the computer-readable recording medium, and executed therein.

[0196] In this embodiment, the j-th participant in the second participant group can first receive the public key and commitment information sent by a participant in the first participant group that has not lost its key share, such as the i-th participant. Then, the public key and commitment information are verified to confirm that the i-th participant's identity is secure and reliable. Finally, the j-th participant obtains a sub-key share from the i-th participant and, based on this sub-key share, becomes the new participant holding the key. Therefore, this embodiment ensures that the j-th participant obtains the sub-key share from a secure i-th participant during key redistribution by first verifying the identity of the i-th participant to be sent the sub-key share, and only sending the sub-key share after successful verification. This ensures the correctness of the key share obtained based on the sub-key share, preventing malicious parties from damaging the key and effectively protecting key security.

[0197] Figure 11 A schematic diagram of the structure of a computer device provided in an exemplary embodiment of this application is shown. Please refer to... Figure 11 The computer device includes a processor 1101, a communication interface 1102, and a computer-readable storage medium 1103. The processor 1101, communication interface 1102, and computer-readable storage medium 1103 can be connected via a bus or other means. The communication interface 1102 is used to receive and send data. The computer-readable storage medium 1103 can be stored in the computer device's memory and is used to store computer programs, including program instructions. The processor 1101 is used to execute the program instructions stored in the computer-readable storage medium 1103. The processor 1101 (or CPU (Central Processing Unit)) is the computing and control core of the computer device, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions to achieve corresponding method flows or corresponding functions.

[0198] This application embodiment also provides a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the processing system of the computer device. Furthermore, the storage space also stores one or more instructions suitable for loading and execution by the processor 1101, which may be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device; optionally, it can also be at least one computer-readable storage medium located remotely from the aforementioned processor.

[0199] In one embodiment, the computer-readable storage medium stores one or more instructions; the processor 1101 loads and executes one or more instructions stored in the computer-readable storage medium to implement the corresponding steps in the above-described data processing method embodiment; specifically, the one or more instructions in the computer-readable storage medium are loaded and executed by the processor 1101 in the following steps:

[0200] In response to the key redistribution request of the first set of participants, obtain the key fragment corresponding to the key share held by the i-th participant in the first set of participants; the first set of participants contains multiple participants, some of whom have lost their key shares; the i-th participant is any participant that has not lost its key share;

[0201] The key fragments are redistributed to generate multiple sub-key shares and commitment information corresponding to the key fragments; the commitment information is used to indicate the authenticity of the public key and key fragment held by the i-th participant, and the key fragments and public keys have a matching relationship;

[0202] The public key and commitment information corresponding to the secret key are broadcast to the second set of participants for verification, so that the participants in the second set of participants return the verification result;

[0203] If the verification result indicates that both the public key and the commitment information have been successfully verified, then a subkey share is allocated to the j-th participant in the second participant set based on multiple subkey shares, making the j-th participant a new participant holding the key; the j-th participant can be any participant in the second participant set.

[0204] In one implementation, the conditions for generating a key redistribution requirement among the first set of participants include:

[0205] If the number of participants in the first participant set who have lost their key share is less than or equal to the signature threshold associated with the first participant set, then the first participant set is determined to have a key redistribution requirement.

[0206] The signature threshold is used to indicate the maximum number of key shares that can be lost in the first set of participants. If the number of participants in the first set of participants who have lost key shares is greater than the signature threshold, then the number of participants in the first set of participants who have not lost key shares does not meet the requirement of the number of participants required for negotiated signature.

[0207] In one implementation, when one or more instructions in the computer-readable storage medium are loaded by the processor 1101 and executed to obtain the key fragment corresponding to the key share held by the i-th participant in the first participant set, the following steps are specifically performed:

[0208] Obtain the Lagrange interpolation polynomial corresponding to the key; the independent variable of the Lagrange interpolation polynomial is the participant identifier of the participant in the first participant set, and the dependent variable of the Lagrange interpolation polynomial is the share of the key held by the participant in the first participant set;

[0209] Obtain the participant identifiers of all participants in the first set of participants, excluding the i-th participant, who have participated in the negotiation and signed the agreement.

[0210] Based on the participant identifiers of other participants who participated in the negotiation signature, the participant identifier of the i-th participant, and the Lagrange interpolation polynomial corresponding to the key, calculate the Lagrange interpolation coefficients of the key share held by the i-th participant.

[0211] Based on the key share held by the i-th participant and the Lagrange interpolation coefficient, the key fragment corresponding to the key share held by the i-th participant is obtained; wherein, the key fragment held by the i-th participant is one of the multiple key fragments that make up the key.

[0212] In one implementation, when one or more instructions in the computer-readable storage medium are loaded by the processor 1101 and executed to perform key redistribution processing on key fragments to generate multiple sub-key shares and commitment information corresponding to the key fragments, the following steps are specifically performed:

[0213] Obtain the signature threshold associated with the first set of participants, and the number of participants contained in the second set of participants;

[0214] Based on the Lagrange interpolation algorithm, the signature threshold, and the number of participants in the second participant set, construct the Lagrange interpolation polynomial corresponding to the key fragment held by the i-th participant;

[0215] Obtain the participant identifiers of each participant in the second participant set whose sub-key shares are to be allocated, and input each participant's identifier into the Lagrange interpolation polynomial corresponding to the key fragment to generate multiple sub-key shares corresponding to the key fragment; there is a correspondence between the participant identifier and the sub-key share; and,

[0216] The commitment information of the key fragment is generated based on the Lagrange interpolation polynomial corresponding to the key fragment.

[0217] In one implementation, when one or more instructions in a computer-readable storage medium are loaded by processor 1101 and executed, if the target verification result indicates that the verification for both the public key and the commitment information is successful, the following steps are specifically performed when allocating a subkey share to the j-th participant in the second participant set based on multiple subkey shares:

[0218] Get the first timeout limit;

[0219] If the target verification results are received from each participant in the second participant set whose subkey shares are to be allocated within the first timeout period, and each target verification result indicates that the verification of the public key and commitment information is successful, then the subkey share that corresponds to the participant identifier of the j-th participant in the second participant set will be allocated to the j-th participant.

[0220] In one implementation, one or more instructions in a computer-readable storage medium are loaded by processor 1101 and the following steps are also performed:

[0221] If, within the first timeout period, at least one of the participants in the second participant set who are to be allocated a subkey share fails to return the target verification result, or if there is a target verification result indicating that at least one of the public key and commitment information has failed to be verified, then a redistribution prompt message will be output.

[0222] The key redistribution message indicates that the key redistribution failed.

[0223] In one implementation, one or more instructions in a computer-readable storage medium are loaded by processor 1101 and the following steps are also performed:

[0224] Obtain the second timeout limit;

[0225] If a share confirmation message is received from each participant in the second participant set whose sub-key shares are to be allocated within the second timeout period, the key share held by the i-th participant is destroyed; the share confirmation message is used to indicate that the participant has successfully verified the received sub-key share.

[0226] Remove the i-th participant from the first participant set.

[0227] In another embodiment, the computer-readable storage medium stores one or more instructions; the processor 1101 loads and executes one or more instructions stored in the computer-readable storage medium to implement the corresponding steps in the above-described data processing method embodiments; specifically, the one or more instructions in the computer-readable storage medium are loaded by the processor 1101 and executed as follows:

[0228] Receive the public key and commitment information broadcast by the i-th participant in the first participant set; wherein, the i-th participant is the participant among the multiple participants included in the first participant set that has not lost its key share; the commitment information is obtained by the i-th participant through key redistribution processing of the key fragments corresponding to its key share;

[0229] The public key and the commitment information are verified separately to obtain the verification result, and the verification result is returned to the i-th participant; when the i-th participant determines that the verification result indicates that the participants in the second participant set have successfully verified both the public key and the commitment information, the i-th participant allocates a sub-key share to the j-th participant in the second participant set based on multiple sub-key shares.

[0230] Receive the subkey share sent by the i-th participant, and based on the subkey share, designate the j-th participant in the second participant set as the new participant holding the key.

[0231] In one implementation, the number of participants in the first participant set who have not lost their key share is multiple; the commitment information contains the public key; one or more instructions in the computer-readable storage medium are loaded by the processor 1101 and executed to verify the public key and the commitment information respectively. When the target verification result is obtained, the following steps are specifically performed:

[0232] Obtain the public key broadcast by each participant in the first participant set whose key share has not been lost, and verify whether the public keys broadcast by each participant are the same, and generate a first verification result; wherein, if the public keys broadcast by each participant are the same, the first verification result indicates that the public key verification is successful; if the public key sent by a participant is different from the public key sent by other participants, the first verification result indicates that the public key verification is unsuccessful.

[0233] In addition, verify whether the public key sent by the i-th participant in the first participant set is the same as the public key contained in the commitment information sent by the i-th participant, and generate a second verification result; wherein, if the public key sent by the i-th participant is the same as the public key contained in the commitment information sent by the i-th participant, the second verification result indicates that the verification of the commitment information sent by the i-th participant is successful.

[0234] Based on the first and second verification results, the target verification result is generated.

[0235] In one implementation, the commitment information includes a signature threshold associated with the first set of participants, and the number of participants included in the first set of participants;

[0236] When one or more instructions in a computer-readable storage medium are loaded by processor 1101 and, when executing the instruction to add the j-th participant in the second participant set as a new participant holding the key based on the subkey share, the following steps are specifically performed:

[0237] Based on the Lagrange interpolation algorithm, the signature threshold, and the number of participants in the first participant set, the Lagrange interpolation polynomial of the key is constructed.

[0238] Verify whether the received subkey share is the coordinate point in the Lagrange interpolation polynomial corresponding to the key;

[0239] If so, the share of the key held by the j-th participant is determined based on the share of the subkey.

[0240] A share confirmation message is generated based on the key share held by the j-th participant, and this message is sent to each participant in the first participant set and each participant in the second participant set; and,

[0241] If a share confirmation message is received from each participant in the second participant set, then the j-th participant in the second participant set will be designated as the new participant holding the key.

[0242] In one implementation, one or more instructions in the computer-readable storage medium are loaded by processor 1101 and, when executing the determination of the key share held by the j-th participant based on the subkey share, specifically perform the following steps:

[0243] Obtain the sub-key shares sent by the participants in the first participant set, excluding the i-th participant, who have not lost their key shares;

[0244] Add up the received subkey shares to get the summed key share;

[0245] The summed key share is used as the key share held by the j-th participant.

[0246] Based on the same inventive concept, the principle and beneficial effects of the computer device provided in the embodiments of this application in solving the problem are similar to the principle and beneficial effects of the data processing method in the embodiments of this application in solving the problem. Please refer to the principle and beneficial effects of the method implementation. For the sake of brevity, they will not be repeated here.

[0247] This application also provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the aforementioned data processing method.

[0248] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this application can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0249] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in or transmitted through a computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data processing device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk (SSD)).

[0250] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A data processing method, characterized in that, include: In response to the key redistribution request of the first set of participants, obtain the key fragment corresponding to the key share held by the i-th participant in the first set of participants; The first set of participants includes multiple participants, some of whom have lost their share of the key. The i-th participant is any participant that has not lost its key share; The key fragment is subjected to key redistribution processing to generate multiple sub-key shares and commitment information corresponding to the key fragment; the commitment information is used to indicate the authenticity of the public key held by the i-th participant and the key fragment, and the key fragment and the public key have a matching relationship; The public key corresponding to the secret key and the commitment information are broadcast to the second set of participants for verification, so that the participants in the second set of participants return the target verification result; If the target verification result indicates that both the public key and the commitment information have been successfully verified, then a subkey share is allocated to the j-th participant in the second participant set based on the plurality of subkey shares, so that the j-th participant becomes a new participant holding the key; the j-th participant can be any participant in the second participant set.

2. The method as described in claim 1, characterized in that, The conditions for generating the key redistribution request of the first set of participants include: If the number of participants in the first participant set who have lost their key share is less than or equal to the signature threshold associated with the first participant set, then it is determined that the first participant set has a key redistribution requirement. The signature threshold is used to indicate the maximum number of key shares that can be lost in the first set of participants. If the number of participants in the first set of participants who have lost key shares is greater than the signature threshold, then the number of participants in the first set of participants who have not lost key shares does not meet the requirement of the number of participants required for negotiated signature.

3. The method as described in claim 1, characterized in that, The step of obtaining the key fragment corresponding to the key share held by the i-th participant in the first participant set includes: Obtain the Lagrange interpolation polynomial corresponding to the key; the independent variable of the Lagrange interpolation polynomial is the participant identifier of the participant in the first participant set, and the dependent variable of the Lagrange interpolation polynomial is the key share held by the participant in the first participant set; Obtain the participant identifiers of the other participants in the first set of participants, excluding the i-th participant, who have participated in the negotiation and signing. Based on the participant identifiers of the other participants who participated in the negotiation signature, the participant identifier of the i-th participant, and the Lagrange interpolation polynomial corresponding to the key, calculate the Lagrange interpolation coefficients of the key share held by the i-th participant. Based on the key share held by the i-th participant and the Lagrange interpolation coefficient, the key fragment corresponding to the key share held by the i-th participant is obtained; wherein, the key fragment held by the i-th participant is one of the multiple key fragments that make up the key.

4. The method as described in claim 1, characterized in that, The step of performing key redistribution processing on the key fragment to generate multiple sub-key shares and commitment information corresponding to the key fragment includes: Obtain the signature threshold associated with the first set of participants and the number of participants included in the second set of participants; Based on the Lagrange interpolation algorithm, the signature threshold, and the number of participants included in the second participant set, the Lagrange interpolation polynomial corresponding to the key fragment held by the i-th participant is constructed. Obtain the participant identifiers of each participant in the second participant set whose sub-key shares are to be allocated, and input the participant identifiers of each participant into the Lagrange interpolation polynomial corresponding to the key fragment to generate multiple sub-key shares corresponding to the key fragment; the participant identifiers and sub-key shares have a corresponding relationship; and, Based on the Lagrange interpolation polynomial corresponding to the key fragment, the commitment information of the key fragment is generated.

5. The method as described in claim 1, characterized in that, If the target verification result indicates that both the public key and the commitment information have been successfully verified, then a subkey share is allocated to the j-th participant in the second participant set based on the plurality of subkey shares, including: Get the first timeout limit; If, within the first timeout period, the target verification results are received from each participant in the second participant set whose subkey shares are to be allocated, and each target verification result indicates that the verification of the public key and the commitment information is successful, then the subkey share that corresponds to the participant identifier of the j-th participant in the second participant set will be allocated to the j-th participant.

6. The method as described in claim 5, characterized in that, The method further includes: If, within the first timeout period, at least one of the participants in the second set of participants whose sub-key shares are to be allocated fails to return the target verification result, or if there is a target verification result indicating that at least one of the public key and the commitment information has failed to be verified, then a reallocation prompt message is output. The key redistribution message indicates that the key redistribution failed.

7. The method as described in claim 1, characterized in that, The method further includes: Obtain the second timeout limit; If a share confirmation message is received from each participant in the second participant set whose sub-key shares are to be allocated within the second timeout period, the key share held by the i-th participant is destroyed; the share confirmation message is used to indicate that the participant has successfully verified the received sub-key share. Remove the i-th participant from the first participant set.

8. A data processing method, characterized in that, include: Receive the public key and commitment information broadcast by the i-th participant in the first participant set; wherein, the i-th participant is the participant among the multiple participants included in the first participant set that has not lost its key share; the commitment information is obtained by the i-th participant through key redistribution processing of the key fragments corresponding to its held key share; The public key and the commitment information are verified separately to obtain a target verification result, and the target verification result is returned to the i-th participant; such that when the i-th participant determines that the target verification result indicates that the participants in the second participant set have successfully verified both the public key and the commitment information, the i-th participant allocates a sub-key share to the j-th participant in the second participant set based on multiple sub-key shares; Receive the subkey share sent by the i-th participant, and based on the subkey share, designate the j-th participant in the second participant set as a new participant holding the key.

9. The method as described in claim 8, characterized in that, The number of participants in the first set of participants who have not lost their key shares is multiple; the commitment information includes a public key; The step of verifying the public key and the commitment information respectively to obtain the target verification result includes: Obtain the public key broadcast by each participant in the first participant set whose key share has not been lost, and verify whether the public keys broadcast by each participant are the same, and generate a first verification result; wherein, if the public keys broadcast by each participant are the same, the first verification result indicates that the verification of the public key is successful; if the public key sent by a participant is different from the public key sent by other participants, the first verification result indicates that the verification of the public key is unsuccessful. In addition, verify whether the public key sent by the i-th participant in the first participant set is the same as the public key contained in the commitment information sent by the i-th participant, and generate a second verification result; wherein, if the public key sent by the i-th participant is the same as the public key contained in the commitment information sent by the i-th participant, the second verification result indicates that the verification of the commitment information sent by the i-th participant is successful. Based on the first verification result and the second verification result, a target verification result is generated.

10. The method as described in claim 8, characterized in that, The commitment information includes the signature threshold associated with the first set of participants, and the number of participants included in the first set of participants; The step of designating the j-th participant in the second participant set as a new participant holding the key based on the sub-key share includes: Based on the Lagrange interpolation algorithm, the signature threshold, and the number of participants included in the first participant set, the Lagrange interpolation polynomial of the key is constructed. Verify whether the received subkey share is a coordinate point in the Lagrange interpolation polynomial corresponding to the key; If so, the key share held by the j-th participant is determined based on the sub-key share; A share confirmation message is generated based on the key share held by the j-th participant, and the share confirmation message is sent to each participant in the first participant set and each participant in the second participant set; and, If a share confirmation message is received from each participant in the second participant set, then the j-th participant in the second participant set will be designated as the new participant holding the key.

11. The method as described in claim 10, characterized in that, The step of determining the key share held by the j-th participant based on the sub-key share includes: Obtain the sub-key shares sent by the other participants in the first participant set who have not lost their key shares, excluding the i-th participant. Add up the received subkey shares to get the summed key share; The summed key share is taken as the key share held by the j-th participant.

12. A data processing apparatus, characterized in that, include: The acquisition unit is used to acquire the key fragment corresponding to the key share held by the i-th participant in the first participant set in response to the key redistribution request of the first participant set. The first set of participants includes multiple participants, some of whom have lost their share of the key. The i-th participant is any participant that has not lost its key share; The processing unit is used to perform key redistribution processing on the key fragment, generating multiple sub-key shares and commitment information corresponding to the key fragment; the commitment information is used to indicate the authenticity of the public key held by the i-th participant and the key fragment, and the key fragment and the public key have a matching relationship; The processing unit is further configured to broadcast the public key corresponding to the secret key and the commitment information to the second set of participants for verification processing, so that the participants in the second set of participants return the verification result; The processing unit is further configured to, if the verification result indicates that the verification of both the public key and the commitment information is successful, allocate a sub-key share to the j-th participant in the second participant set based on the plurality of sub-key shares, so that the j-th participant becomes a new participant holding the key; the j-th participant is any participant in the second participant set.

13. A data processing apparatus, characterized in that, include: A receiving unit is configured to receive the public key and commitment information broadcast by the i-th participant in the first participant set; wherein the i-th participant is the participant among the multiple participants included in the first participant set that has not lost its key share; the commitment information is obtained by the i-th participant through key redistribution processing of the key fragments corresponding to its held key share; The processing unit is configured to perform verification processing on the public key and the commitment information respectively, obtain a verification result, and return the verification result to the i-th participant; so that when the i-th participant determines that the verification result indicates that the participants in the second participant set have successfully verified both the public key and the commitment information, the i-th participant allocates a sub-key share to the j-th participant in the second participant set based on multiple sub-key shares. The processing unit is further configured to receive a subkey share sent by the i-th participant, and, based on the subkey share, designate the j-th participant in the second participant set as a new participant holding the key.

14. A computer device, characterized in that, include: A processor, adapted to execute computer programs; A computer-readable storage medium storing a computer program that, when executed by the processor, implements the method as described in any one of claims 1-7, or implements the method as described in any one of claims 8-11.

15. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program adapted to be loaded by a processor and to perform the method as claimed in any one of claims 1-7, or to perform the method as claimed in any one of claims 8-11.

16. A computer program product, characterized in that, The computer program product includes computer instructions that, when executed by a processor, implement the method as described in any one of claims 1-7, or the method as described in any one of claims 8-11.

Images