Random beacon generation and reconfiguration method and system

Abstract

The invention discloses a random beacon generation and reconfiguration method and system, and relates to the technical field of cryptography. According to the method, a public key and a private key are initialized and generated in a decentralized network, and the private key is split into a plurality of secret shares and sent to each node; each node uses own secret share to sign and broadcasts a threshold signature to other nodes; each node verifies the validity of the aggregation signature by using a public key, and if the aggregation signature is valid, a random beacon is generated; selecting a committee node from the nodes, broadcasting the PVSS transcript to all the committee nodes by each non-committee node, carrying out validity verification after receiving the PVSS transcript by the committee node, aggregating the PVSS transcript and broadcasting the PVSS transcript to the non-committee nodes; and after the non-committee node receives the secret key, the non-committee node carries out validity verification, and after verification is passed and a consensus is reached, the obtained secret is reconstructed to obtain a private key for reconfiguration in the next round. The method can be applied to scenes depending on credible random numbers, such as block chains.

Description

Technical Field

[0001] The present invention relates to the technical field of cryptography, and in particular to a method and system for generating and reconfiguring a random beacon. Technical Background

[0002] A random beacon is a public source of randomness, often used to provide trusted randomness to distributed systems, lotteries, and blockchains. Existing random beacons can be divided into two types: centralized and decentralized. The trust of centralized random beacons depends on a single organization, such as Random.org and NIST's random beacon project. The security, activity, unpredictability, and non-deviability of this type of random beacon system will completely rely on the single organization that provides the service. A decentralized random beacon divides trust among n nodes in a distributed network, and can tolerate the existence of f corrupt nodes in the network, and ensure activity, security, and the unpredictability and non-deviability of beacon values. Currently, some of the more famous distributed random beacon systems include DRand.

[0003] Decentralized random beacons use threshold signatures to enable n nodes to generate unique threshold signature values, providing unpredictability and non-deviability. However, the existing distributed random beacon protocols have high communication and computational overheads during the reconfiguration phase, which results in a long reconfiguration time when the participating nodes change. Therefore, a random beacon protocol with low computational and communication overheads during the reconfiguration phase is needed. Summary of the invention

[0004] In view of the technical problems existing in the prior art, the object of the present invention is to provide an efficient method and system for generating and reconfiguring random beacons.

[0005] Several key terms used in the present invention are explained (common knowledge in the art):

[0006] 1. PVSS (Publicly Verifiable Secret Sharing): is a cryptographic protocol that allows secrets to be securely shared with multiple participants, allowing any third party to verify the correctness and integrity of these secret shares without knowing the actual secret content.

[0007] 2. PVSS transcript: A publicly verifiable secret share record generated by the PVSS protocol, containing secret shares, verification information, protocol metadata, and other information.

[0008] 3. MVBA (Multi-valued Validated Asynchronous Byzantine Agreement): Multi-valued Validated Asynchronous Byzantine Agreement, which is used to reach consensus in an asynchronous network environment with Byzantine faults (i.e. malicious nodes).

[0009] 4. Committee Nodes: A group of trusted nodes selected in a blockchain network or distributed system.

[0010] The technical solution adopted by the present invention to achieve the above-mentioned purpose is as follows:

[0011] A method for generating and reconfiguring a random beacon comprises the following steps:

[0012] 1) In a decentralized network, all network nodes perform initialization, generate a public reference string, generate public and private keys based on the public reference string, split the private key into multiple secret shares and send them to each network node;

[0013] 2) Each network node uses its own secret share to sign the concatenation of the protocol identifier and the current random beacon generation round number, and broadcasts the generated threshold signature to other network nodes in the network;

[0014] 3) After receiving f+1 threshold signatures, each network node aggregates them to obtain an aggregate signature, where f is the number of tolerable corrupt nodes, and uses the public key to verify the validity of the aggregate signature. If the aggregate signature is valid, a random beacon is generated based on the aggregate signature, otherwise the operation is terminated;

[0015] 4) Select committee nodes from network nodes based on the generated random beacon, the total number of network nodes and the preset number of committee nodes;

[0016] 5) Each non-committee node generates a secret value and a PVSS transcript of the secret value locally, and broadcasts the PVSS transcript to all committee nodes;

[0017] 6) After receiving the PVSS transcript, the committee node verifies its validity. When the number of PVSS transcripts that pass the validity verification reaches f+1, it aggregates them to obtain the aggregated PVSS transcript, and broadcasts the aggregated PVSS transcript to non-committee nodes;

[0018] 7) The non-committee node verifies the validity of the received aggregated PVSS transcript. After passing the validity verification and reaching a consensus, the secret of the obtained unique PVSS transcript is reconstructed to obtain the private key for the next round of reconfiguration.

[0019] Furthermore, in step 1), a verifiable unpredictable function VUF is executed on all network nodes to initialize them.

[0020] Furthermore, in step 3), the generated random beacon is derived through the Drive algorithm of the function VUF.

[0021] Furthermore, in step 7), the secret of the unique PVSS transcript obtained is reconstructed by Lagrange interpolation method.

[0022] Furthermore, in step 7), the non-committee node executes the MVBA protocol and sets the validity condition function of the MVBA protocol to verify the validity of the PVSS transcript.

[0023] A random beacon generation and reconfiguration system, comprising:

[0024] The random beacon generation module is used to initialize all network nodes in a decentralized network, generate a public reference string, generate a public key and a private key based on the public reference string, split the private key into multiple secret shares and send them to each network node; each network node uses its own secret share to sign the concatenation result of the protocol identifier and the current random beacon generation round number, and broadcasts the generated threshold signature to other network nodes in the network; after receiving f+1 threshold signatures, each network node aggregates to obtain an aggregate signature, where f is the number of tolerable corrupt nodes, and uses the public key to verify the validity of the aggregate signature. If the aggregate signature is valid, a random beacon is generated based on the aggregate signature;

[0025] The reconfiguration module is used to select committee nodes from network nodes according to the generated random beacon, the total number of network nodes and the preset number of committee nodes; each non-committee node generates a secret value and a PVSS transcript of the secret value locally, and broadcasts the PVSS transcript to all committee nodes; the committee node verifies the validity after receiving the PVSS transcript, and when the number of PVSS transcripts that pass the validity verification reaches f+1, it aggregates to obtain an aggregated PVSS transcript, and broadcasts the aggregated PVSS transcript to non-committee nodes; the non-committee node verifies the validity of the received aggregated PVSS transcript, and after passing the validity verification and reaching a consensus, reconstructs the secret of the obtained unique PVSS transcript to obtain the private key for the next round of reconfiguration.

[0026] Compared with the prior art, the present invention has the following advantages:

[0027] When reconfiguring asynchronous random beacons, traditional methods often require re-executing ADKG (asynchronous distributed key generation) with high time overhead to complete the reconfiguration. The solution proposed in the present invention does not need to re-execute ADKG, but reconfigures through PVSS and asynchronous consensus mechanism. Compared with the solution using ADKG, the solution proposed in the present invention can perform reconfiguration efficiently. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 It is a flow chart of a method for generating and reconfiguring a random beacon in an embodiment of the present invention. Specific implementation methods

[0030] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in combination with the embodiments of the present invention and the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0031] A method for generating and reconfiguring a random beacon proposed in the present invention can efficiently generate and reconfigure random beacons, and is applied to all nodes in the network that participate in the generation of random beacons. Specifically, after initialization, all network nodes will generate random numbers through threshold signatures, and then use the PVSS protocol and the MVBA protocol to generate the private key required for the next round of random beacon generation. This method can be constructed using, but is not limited to, threshold signatures, PVSS protocols, and MVBA protocols. The participants in this method are n network nodes. In a successful reconfiguration process, some nodes will be selected from all nodes to form a committee, and the generation and reconfiguration of random numbers (i.e., random beacons) will be completed through communication between nodes and between nodes and committee nodes.

[0032] The execution flow of this method is as follows:

[0033] 1) All network nodes perform initialization, generate a public reference string, and generate a public-private key pair based on the public reference string. Each node stores the secret share of the public key and private key locally;

[0034] 2) Each node uses the secret share of the private key to sign the concatenation of the protocol identifier and the current random beacon generation round number, and broadcasts the obtained threshold signature to other nodes;

[0035] 3) Each node receives the threshold signature, and after receiving f+1 threshold signatures, it aggregates them to obtain the aggregate signature, where f is the number of corrupted nodes that can be tolerated; then, the validity of the aggregate signature is verified by the public key. If it is valid, the export function is executed to export the random number r (i.e., random beacon), otherwise the operation is terminated; all network nodes will repeatedly call the current step to generate a random beacon until the participating nodes of the random beacon change, and then enter step 4) to start reconfiguration;

[0036] 4) According to the derived random number r, the total number of nodes in the network n, and the size of the committee node k, a committee node of size k is selected from all nodes;

[0037] 5) Non-committee nodes generate secret values ​​(random values) locally, generate PVSStranscripts corresponding to the secret values, and broadcast them to all committee nodes;

[0038] 6) After receiving the PVSS transcript, the committee node first verifies the validity of the PVSS transcript and stores the verified PVSS transcript locally; when the number of PVSS transcripts stored locally reaches f+1, the stored PVSS transcripts are aggregated to obtain the aggregated PVSS transcript, which is broadcast to all non-committee nodes;

[0039] 7) Non-committee nodes execute the MVBA protocol and set the validity condition function of MVBA to verify the validity of the aggregated PVSStranscript. After validity detection and consensus, all nodes obtain a unique PVSStranscript; then, all nodes decrypt the PVSS transcript and reconstruct the secret through Lagrange interpolation method to generate the private key for the next round of reconfiguration, and continue the next round of random beacon generation and reconfiguration.

[0040] In an embodiment of the present invention, a method for generating a random beacon is provided, and the process is as follows: Figure 1 As shown, the specific steps include:

[0041] 1. Initialization:

[0042] Each network node P i Execute the Setup of VUF (Verifiable Unpredictable Function) to generate the public reference string crs vuf , then perform key generation to generate n secret shares sk1, sk2, ..., sk of the public key pk and the private key sk n Sent to each node.

[0043] 2. Random beacon generation:

[0044] 1) Each node P i Use the secret share sk of the private key held i Sign the concatenation result SID||round of the protocol identifier and the current random beacon generation round number, where SID is the protocol identifier and round is the random beacon generation round, and get the threshold signature σ i , and broadcast the threshold signature to other nodes;

[0045] 2) After receiving f+1 signatures, other nodes aggregate the threshold signatures to obtain the aggregate signature σ; then, the validity of the aggregate signature is verified by the public key pk. If the current aggregate signature is valid, the Drive algorithm (i.e., the export function) of VUF is executed to export the random number r (i.e., the random beacon), otherwise the operation is terminated;

[0046] 3. Reconfiguration:

[0047] 1) Execute C←sample(n,r,k) to select committee nodes of size k from all nodes, where C is the set of all selected committee nodes and sample is a function that selects committee nodes based on the number of nodes n in the network, the random number r, and the number of committee nodes k;

[0048] 2) Each non-committee node generates a secret value s locally i , and generate its corresponding PVSS transcript, denoted as pvss i , and pvss i Broadcast to all committee nodes;

[0049] 3) The committee node receives the node P i pvss i After that, first of all, pvss i The validity of the i Stored locally; when the locally stored pvss i When the number reaches f+1, all stored PVSS transcripts are aggregated to obtain the aggregated PVSS transcript, recorded as pvss; then, pvss is broadcast to all non-committee nodes;

[0050] 4) Non-committee nodes execute the MVBA protocol and set the validity condition function of MVBA to verify the validity of pvss. After validity detection and consensus, all nodes obtain a unique pvss; after that, all nodes reconstruct the secret share and obtain the private key sk′ for the next round of reconfiguration.

[0051] It should be understood that the "system" used in this specification is a method for distinguishing different components, elements, parts, portions or assemblies at different levels. However, if other words can achieve the same purpose, the words can be replaced by other expressions.

[0052] As shown in this specification and claims, unless the context clearly indicates an exception, the words "a", "an", "an" and / or "the" do not refer to the singular and may also include the plural. Generally speaking, the terms "comprise" and "include" only indicate the inclusion of the steps and elements that have been clearly identified, and these steps and elements do not constitute an exclusive list. The method or device may also include other steps or elements.

[0053] Flowcharts are used in this specification to illustrate the operations performed by the methods according to the embodiments of this specification. It should be understood that the preceding or following operations are not necessarily performed precisely in order. On the contrary, the various steps may be processed in reverse order or simultaneously. At the same time, other operations may also be added to these processes, or one or more operations may be removed from these processes.

[0054] The basic concepts have been described above. Obviously, for those skilled in the art, the above detailed disclosure is only for example and does not constitute a limitation of this specification. Although not explicitly stated here, those skilled in the art may make various modifications, improvements and corrections to this specification. Such modifications, improvements and corrections are suggested in this specification, so such modifications, improvements and corrections still belong to the spirit and scope of the exemplary embodiments of this specification.

[0055] At the same time, this specification uses specific words to describe the embodiments of this specification. For example, "one embodiment", "an embodiment" and / or "some embodiments" refer to a certain feature, structure or characteristic related to at least one embodiment of this specification. Therefore, it should be emphasized and noted that "one embodiment" or "an embodiment" or "an alternative embodiment" mentioned twice or more in different locations in this specification does not necessarily refer to the same embodiment. In addition, certain features, structures or characteristics in one or more embodiments of this specification can be appropriately combined.

[0056] In addition, it will be understood by those skilled in the art that various aspects of this specification may be illustrated and described by a number of patentable categories or situations, including any new and useful process, machine, product or combination of substances, or any new and useful improvements thereto. Accordingly, various aspects of this specification may be performed entirely by hardware, entirely by software (including firmware, resident software, microcode, etc.), or by a combination of hardware and software. The above hardware or software may be referred to as "data blocks", "modules", "engines", "units", "components" or "systems". In addition, various aspects of this specification may be represented as a computer product located in one or more computer-readable media, which includes computer-readable program code.

[0057] A computer storage medium may include a propagated data signal containing computer program code, for example, in baseband or as part of a carrier wave. The propagated signal may be in a variety of forms, including electromagnetic, optical, etc., or a suitable combination. A computer storage medium may be any computer-readable medium other than a computer-readable storage medium, which can be connected to an instruction execution system, device or apparatus to communicate, propagate or transmit the program for use. The program code on the computer storage medium may be transmitted via any suitable medium, including radio, cable, fiber optic cable, RF, or similar media, or any combination of the above media.

[0058] The computer program code required for the operation of each part of this specification can be written in any one or more programming languages, including object-oriented programming languages ​​such as Java, Scala, Smalltalk, Eiffel, JADE, Emerald, C++, C#, VB.NET, Python, etc., conventional procedural programming languages ​​such as C language, Visual Basic, Fortran2003, Perl, COBOL2002, PHP, ABAP, dynamic programming languages ​​such as Python, Ruby and Groovy, or other programming languages, etc. The program code can be run entirely on the user's computer, or run on the user's computer as an independent software package, or run partially on the user's computer and partially on a remote computer, or run entirely on a remote computer or processing device. In the latter case, the remote computer can be connected to the user's computer through any network form, such as a local area network (LAN) or a wide area network (WAN), or connected to an external computer (e.g., via the Internet), or in a cloud computing environment, or used as a service such as software as a service (SaaS).

[0059] In addition, unless explicitly stated in the claims, the order of the processing elements and sequences described in this specification, the use of alphanumeric characters, or the use of other names are not intended to limit the order of the processes and methods of this specification. Although the above disclosure discusses some invention embodiments that are currently considered useful through various examples, it should be understood that such details are only for illustrative purposes, and the attached claims are not limited to the disclosed embodiments. On the contrary, the claims are intended to cover all modifications and equivalent combinations that are consistent with the essence and scope of the embodiments of this specification. For example, although the system components described above can be implemented by hardware devices, they can also be implemented only by software solutions, such as installing the described system on an existing processing device or mobile device.

[0060] Similarly, it should be noted that in order to simplify the description disclosed in this specification and thus help understand one or more embodiments of the invention, in the above description of the embodiments of this specification, multiple features are sometimes combined into one embodiment, figure or description thereof. However, this disclosure method does not mean that the features required by the subject matter of this specification are more than the features mentioned in the claims. In fact, the features of the embodiments are less than all the features of the single embodiment disclosed above.

[0061] In some embodiments, numbers describing the number of components and attributes are used. It should be understood that such numbers used in the description of the embodiments are modified by the modifiers "about", "approximately" or "substantially" in some examples. Unless otherwise specified, "about", "approximately" or "substantially" indicate that the numbers are allowed to vary by ±20%. Accordingly, in some embodiments, the numerical parameters used in the specification and claims are approximate values, which may change according to the required features of individual embodiments. In some embodiments, the numerical parameters should take into account the specified significant digits and adopt the general method of retaining digits. Although the numerical domains and parameters used to confirm the breadth of their range in some embodiments of this specification are approximate values, in specific embodiments, the setting of such numerical values ​​is as accurate as possible within the feasible range.

[0062] Each patent, patent application, patent application publication, and other materials, such as articles, books, specifications, publications, documents, etc., cited in this specification are hereby incorporated by reference in their entirety. Except for application history documents that are inconsistent with or conflicting with the contents of this specification, documents that limit the broadest scope of the claims of this specification (currently or later attached to this specification) are also excluded. It should be noted that if the descriptions, definitions, and / or use of terms in the materials attached to this specification are inconsistent or conflicting with the contents described in this specification, the descriptions, definitions, and / or use of terms in this specification shall prevail.

[0063] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0064] Finally, it should be understood that the embodiments described in this specification are only used to illustrate the principles of the embodiments of this specification. Other variations may also fall within the scope of this specification. Therefore, as an example and not a limitation, alternative configurations of the embodiments of this specification may be considered consistent with the teachings of this specification. Accordingly, the embodiments of this specification are not limited to the implementations explicitly introduced and described in this specification.

Claims

1. A method for generating and reconfiguring a random beacon, characterized in that: The following steps are involved: 1) In a decentralized network, all network nodes perform initialization, generate a public reference string, generate public and private keys based on the public reference string, split the private key into multiple secret shares and send them to each network node; 2) Each network node uses its own secret share to sign the concatenation of the protocol identifier and the current random beacon generation round number, and broadcasts the generated threshold signature to other network nodes in the network; 3) After receiving f+1 threshold signatures, each network node aggregates them to obtain an aggregate signature, where f is the number of tolerable corrupt nodes, and uses the public key to verify the validity of the aggregate signature. If the aggregate signature is valid, a random beacon is generated based on the aggregate signature, otherwise the operation is terminated; 4) Select committee nodes from network nodes based on the generated random beacon, the total number of network nodes and the preset number of committee nodes; 5) Each non-committee node generates a secret value and a PVSS transcript of the secret value locally, and broadcasts the PVSS transcript to all committee nodes; 6) After receiving the PVSS transcript, the committee node verifies its validity. When the number of PVSS transcripts that pass the validity verification reaches f+1, it aggregates them to obtain the aggregated PVSS transcript, and broadcasts the aggregated PVSS transcript to non-committee nodes; 7) The non-committee node verifies the validity of the received aggregated PVSS transcript. After passing the validity verification and reaching a consensus, the secret of the obtained unique PVSS transcript is reconstructed to obtain the private key for the next round of reconfiguration.

2. The method according to claim 1, characterized in that In step 1), a verifiable unpredictable function VUF is executed on all network nodes for initialization.

3. The method according to claim 1, characterized in that In step 3), the generated random beacon is derived through the Drive algorithm of the function VUF.

4. The method according to claim 1, characterized in that In step 7), the secret of the unique PVSS transcript obtained is reconstructed by Lagrange interpolation method.

5. The method according to claim 1, characterized in that Step 7) The non-committee node executes the MVBA protocol and sets the validity condition function of the MVBA protocol to verify the validity of the PVSS transcript.

6. A random beacon generation and reconfiguration system, characterized in that: include: The random beacon generation module is used to initialize all network nodes in the decentralized network, generate a public reference string, generate a public key and a private key based on the public reference string, split the private key into multiple secret shares and send them to each network node; each network node uses its own secret share to sign the concatenation result of the protocol identifier and the current random beacon generation round number, and broadcasts the generated threshold signature to other network nodes in the network; After receiving f+1 threshold signatures, each network node aggregates them to obtain an aggregate signature, where f is the number of tolerable corrupt nodes, and uses the public key to verify the validity of the aggregate signature. If the aggregate signature is valid, a random beacon is generated based on the aggregate signature. The reconfiguration module is used to select committee nodes from network nodes according to the generated random beacon, the total number of network nodes and the preset number of committee nodes; each non-committee node generates a secret value and a PVSS transcript of the secret value locally, and broadcasts the PVSS transcript to all committee nodes; the committee node verifies the validity after receiving the PVSS transcript, and when the number of PVSS transcripts that pass the validity verification reaches f+1, it aggregates to obtain an aggregated PVSS transcript, and broadcasts the aggregated PVSS transcript to non-committee nodes; the non-committee node verifies the validity of the received aggregated PVSS transcript, and after passing the validity verification and reaching a consensus, reconstructs the secret of the obtained unique PVSS transcript to obtain the private key for the next round of reconfiguration.

7. The system according to claim 6, characterized in that Execute the VUF function on all network nodes to initialize.

8. The system according to claim 6, characterized in that The generated random beacon is exported through the Drive algorithm of function VUF.

9. The system according to claim 6, characterized in that The secret of the unique PVSS transcript is reconstructed by Lagrange interpolation method.

10. The system according to claim 6, characterized in that The non-committee nodes execute the MVBA protocol and set the validity condition function of the MVBA protocol to verify the validity of the PVSS transcript.

Images