A random beacon generation and reconfiguration method and system

Abstract

The present invention discloses a method and system for generating and reconfiguring a random beacon, relating to the field of cryptography technology. The present invention initializes and generates public and private keys in a decentralized network, splits the private key into multiple secret shares, and sends them to each node; each node uses its own secret share to sign and broadcasts the threshold signature to other nodes; each node verifies the validity of the aggregate signature using the public key, and if the aggregate signature is valid, a random beacon is generated; a committee node is selected from the nodes, and each non-committee node broadcasts the PVSS transcript to all committee nodes. After receiving the transcript, the committee nodes perform validity verification, aggregate the passed transcripts, and broadcast them to non-committee nodes; the non-committee nodes perform validity verification after receiving the transcript, and after verification passes and consensus is reached, reconstruct the obtained secret to obtain the private key for the next round of reconfiguration. The present invention can be applied to scenarios that rely on trusted random numbers, such as blockchains.

Description

Technical Field

[0001] The present invention relates to the technical field of cryptography, and in particular to a method and system for generating and reconfiguring a random beacon. Technical Background

[0002] A randomness beacon is a public source of randomness, commonly used to provide trusted randomness in distributed systems, lotteries, and blockchains. Existing randomness beacons can be categorized as centralized or decentralized. Centralized randomness beacons, such as Random.org and the NIST Randomness Beacon Project, rely on a single organization for trust. The security, liveness, unpredictability, and immutability of the beacon value of this type of randomness beacon system are completely dependent on the single organization providing the service. Decentralized randomness beacons, on the other hand, divide trust among n nodes in a distributed network and can tolerate f corrupt nodes in the network while guaranteeing liveness, security, and the unpredictability and immutability of the beacon value. Well-known distributed randomness beacon systems include DRand.

[0003] Decentralized randomness beacons use threshold signatures to enable n nodes to generate a unique threshold signature value, providing unpredictability and immutability. However, existing distributed randomness beacon protocols incur high communication and computational overhead during the reconfiguration phase, resulting in extended reconfiguration times when participating nodes change. Therefore, a randomness beacon protocol with low computational and communication overhead during the reconfiguration phase is needed. Summary of the Invention

[0004] In view of the technical problems existing in the prior art, the object of the present invention is to provide an efficient method and system for generating and reconfiguring random beacons.

[0005] Explanations of several key terms used in the present invention (common knowledge in the art):

[0006] 1. PVSS (Publicly Verifiable Secret Sharing): is a cryptographic protocol that allows secrets to be securely shared with multiple participants, allowing any third party to verify the correctness and integrity of these secret shares without knowing the actual secret content.

[0007] 2. PVSS transcript: A publicly verifiable secret share record generated by the PVSS protocol, containing information such as secret shares, verification information, and protocol metadata.

[0008] 3. MVBA (Multi-valued Validated Asynchronous Byzantine Agreement): Multi-valued Validated Asynchronous Byzantine Agreement, which is used to reach consensus in asynchronous network environments with Byzantine faults (i.e., malicious nodes).

[0009] 4. Committee Nodes: A group of trusted nodes selected in a blockchain network or distributed system.

[0010] The technical solutions adopted by the present invention to achieve the above-mentioned purpose are as follows:

[0011] A method for generating and reconfiguring a random beacon comprises the following steps:

[0012] 1) In a decentralized network, all network nodes perform initialization, generate a public reference string, generate public and private keys based on the public reference string, split the private key into multiple secret shares and send them to each network node;

[0013] 2) Each network node uses its own secret share to sign the concatenation of the protocol identifier and the current random beacon generation round number, and broadcasts the generated threshold signature to other network nodes in the network;

[0014] 3) After receiving f+1 threshold signatures, each network node aggregates them to obtain an aggregate signature, where f is the number of tolerable corrupt nodes. The public key is used to verify the validity of the aggregate signature. If the aggregate signature is valid, a random beacon is generated based on the aggregate signature; otherwise, the operation is terminated.

[0015] 4) Select committee nodes from the network nodes based on the generated random beacon, the total number of network nodes, and the preset number of committee nodes;

[0016] 5) Each non-committee node generates a secret value and a PVSS transcript of the secret value locally, and broadcasts the PVSS transcript to all committee nodes;

[0017] 6) After receiving the PVSS transcript, the committee node verifies its validity. When the number of PVSS transcripts that pass the validity verification reaches f+1, it aggregates them to obtain the aggregated PVSS transcript and broadcasts the aggregated PVSS transcript to non-committee nodes.

[0018] 7) The non-committee node verifies the validity of the received aggregated PVSS transcript. After passing the validity verification and reaching a consensus, the secret of the obtained unique PVSS transcript is reconstructed to obtain the private key for the next round of reconfiguration.

[0019] Furthermore, in step 1), a verifiable unpredictable function VUF is executed on all network nodes to initialize them.

[0020] Furthermore, the random beacon generated in step 3) is derived through the Drive algorithm of the function VUF.

[0021] Furthermore, in step 7), the secret of the unique PVSS transcript obtained is reconstructed by Lagrange interpolation method.

[0022] Furthermore, in step 7), the African committee node executes the MVBA protocol and sets the validity condition function of the MVBA protocol to verify the validity of the PVSS transcript.

[0023] A random beacon generation and reconfiguration system, comprising:

[0024] The random beacon generation module is used to initialize all network nodes in a decentralized network, generate a public reference string, generate public and private keys based on the public reference string, split the private key into multiple secret shares, and send them to each network node. Each network node uses its own secret share to sign the concatenation of the protocol identifier and the current random beacon generation round number, and broadcast the generated threshold signature to other network nodes in the network. After receiving f+1 threshold signatures, each network node aggregates them to obtain an aggregate signature, where f is the number of corrupted nodes that can be tolerated. The public key is used to verify the validity of the aggregate signature. If the aggregate signature is valid, a random beacon is generated based on the aggregate signature.

[0025] The reconfiguration module is used to select committee nodes from network nodes based on the generated random beacon, the total number of network nodes and the preset number of committee nodes. Each non-committee node locally generates a secret value and a PVSS transcript of the secret value, and broadcasts the PVSS transcript to all committee nodes. After receiving the PVSS transcript, the committee node verifies its validity. When the number of PVSS transcripts that pass the validity verification reaches f+1, it aggregates them to obtain an aggregated PVSS transcript, and broadcasts the aggregated PVSS transcript to non-committee nodes. The non-committee nodes verify the validity of the received aggregated PVSS transcript. After passing the validity verification and reaching a consensus, they reconstruct the secret of the unique PVSS transcript to obtain the private key for the next round of reconfiguration.

[0026] Compared with the existing technology, the present invention has the following advantages:

[0027] Traditional methods often require re-executing ADKG (asynchronous distributed key generation), which has high time overhead, to complete the reconfiguration when reconfiguring asynchronous random beacons. The solution proposed in this invention does not require re-executing ADKG, but instead reconfigures through PVSS and an asynchronous consensus mechanism. Compared with the solution using ADKG, the solution proposed in this invention can perform reconfiguration efficiently. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 This is a flow chart of a method for generating and reconfiguring a random beacon in an embodiment of the present invention. Specific implementation methods

[0029] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments of the present invention and the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0030] The present invention proposes a method for generating and reconfiguring a random beacon, which can efficiently generate and reconfigure random beacons and is applied to all nodes in the network that participate in random beacon generation. Specifically, after initialization, all network nodes will generate a random number through a threshold signature, and then use the PVSS protocol and the MVBA protocol to generate the private key required for the next round of random beacon generation. This method can be constructed using, but is not limited to, threshold signatures, PVSS protocols, and MVBA protocols. The participants in this method are n network nodes. In a successful reconfiguration process, some nodes will be selected from all nodes to form a committee, and the generation and reconfiguration of random numbers (i.e., random beacons) will be completed through communication between nodes and between nodes and committee nodes.

[0031] The execution flow of this method is as follows:

[0032] 1) All network nodes perform initialization, generate a public reference string, and then generate a public-private key pair based on the public reference string. Each node stores the secret share of the public key and private key locally;

[0033] 2) Each node uses the secret share of the private key to sign the concatenation of the protocol identifier and the current random beacon generation round number, and broadcasts the obtained threshold signature to other nodes;

[0034] 3) Each node receives a threshold signature and aggregates f+1 threshold signatures to obtain an aggregate signature, where f is the number of tolerable corrupted nodes. The aggregate signature is then verified for validity using the public key. If valid, the export function is executed to derive the random number r (i.e., the random beacon). Otherwise, the operation is terminated. All network nodes will repeatedly call the current step to generate a random beacon until the participating nodes of the random beacon change, at which point they proceed to step 4) to begin reconfiguration.

[0035] 4) Based on the derived random number r, the total number of nodes in the network n, and the size k of the committee node, a committee node of size k is selected from all nodes;

[0036] 5) Non-committee nodes generate a secret value (random value) locally, generate a PVSStranscript corresponding to the secret value, and broadcast it to all committee nodes;

[0037] 6) After receiving the PVSS transcript, the committee node first verifies the validity of the PVSS transcript and stores the verified PVSS transcript locally. When the number of locally stored PVSS transcripts reaches f+1, the stored PVSS transcripts are aggregated to obtain the aggregated PVSS transcript, which is then broadcast to all non-committee nodes.

[0038] 7) Non-committee nodes execute the MVBA protocol and set the validity condition function of MVBA to verify the validity of the aggregated PVSStranscript. After validity detection and consensus, all nodes obtain a unique PVSStranscript. After that, all nodes decrypt the PVSS transcript and reconstruct the secret through Lagrange interpolation to generate the private key for the next round of reconfiguration, and continue the next round of random beacon generation and reconfiguration.

[0039] In an embodiment of the present invention, a method for generating a random beacon is provided, and the process is as follows: Figure 1 As shown, the specific steps include:

[0040] 1. Initialization:

[0041] Each network node P i Execute the Setup of VUF (Verifiable Unpredictable Function) to generate the public reference string crs vuf , then perform key generation to generate n secret shares sk1, sk2, ..., sk of the public key pk and private key sk n Sent to each node.

[0042] 2. Random beacon generation:

[0043] 1) Each node P i Use the secret share sk of the private key held i Sign the concatenation result SID||round of the protocol identifier and the current random beacon generation round, where SID is the protocol identifier and round is the random beacon generation round, to obtain the threshold signature σ i , and broadcast the threshold signature to other nodes;

[0044] 2) After receiving f+1 signatures, other nodes aggregate the threshold signature to obtain the aggregate signature σ; then, the validity of the aggregate signature is verified by the public key pk. If the current aggregate signature is valid, the Drive algorithm (i.e., the export function) of VUF is executed to export the random number r (i.e., the random beacon), otherwise the operation is terminated;

[0045] 3. Reconfiguration:

[0046] 1) Execute C←sample(n,r,k) to select a committee node of size k from all nodes, where C is the set of all selected committee nodes and sample is a function that selects committee nodes based on the number of nodes in the network n, the random number r, and the number of committee nodes k.

[0047] 2) Each non-committee node generates a secret value s locally i , and generate its corresponding PVSS transcript, recorded as pvss i , and pvss i Broadcast to all committee nodes;

[0048] 3) The committee node receives the node P i pvss i After that, first of all, pvss i The validity of the i Stored locally; when locally stored pvss i When the number reaches f+1, all stored PVSS transcripts are aggregated to obtain the aggregated PVSS transcript, denoted as pvss; then, pvss is broadcast to all non-committee nodes;

[0049] 4) Non-committee nodes execute the MVBA protocol and set the validity condition function of MVBA to verify the validity of pvss. After validity detection and consensus, all nodes obtain a unique pvss; then, all nodes reconstruct the secret share and obtain the private key sk′ for the next round of reconfiguration.

[0050] It should be understood that the "system" used in this specification is a method for distinguishing different components, elements, parts, portions or assemblies at different levels. However, if other words can achieve the same purpose, the words can be replaced by other expressions.

[0051] As used in this specification and claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" do not refer to the singular but also include the plural. Generally speaking, the terms "comprises" and "include" only indicate the inclusion of the steps and elements specifically identified, and these steps and elements do not constitute an exclusive list. A method or apparatus may also include other steps or elements.

[0052] Flowcharts are used throughout this specification to illustrate the operations performed by the methods according to the embodiments of this specification. It should be understood that the preceding or following operations do not necessarily need to be performed in exact order. Instead, the steps may be performed in reverse order or simultaneously. Furthermore, other operations may be added to these processes, or one or more operations may be removed from these processes.

[0053] While the basic concepts have been described above, it will be apparent to those skilled in the art that the detailed disclosure is merely illustrative and does not limit this specification. Although not explicitly stated herein, various modifications, improvements, and revisions to this specification may be made by those skilled in the art. Such modifications, improvements, and revisions are suggested in this specification and remain within the spirit and scope of the exemplary embodiments of this specification.

[0054] This specification also uses specific terms to describe the embodiments of this specification. For example, "one embodiment," "an embodiment," and / or "some embodiments" refer to a feature, structure, or characteristic associated with at least one embodiment of this specification. Therefore, it should be emphasized and noted that references to "one embodiment," "an embodiment," or "an alternative embodiment" two or more times in different locations in this specification do not necessarily refer to the same embodiment. Furthermore, certain features, structures, or characteristics of one or more embodiments of this specification may be appropriately combined.

[0055] In addition, it will be understood by those skilled in the art that various aspects of this specification may be illustrated and described by a number of patentable categories or situations, including any new and useful process, machine, product or combination of substances, or any new and useful improvements thereto. Accordingly, various aspects of this specification may be performed entirely by hardware, entirely by software (including firmware, resident software, microcode, etc.), or by a combination of hardware and software. The above hardware or software may be referred to as "data blocks", "modules", "engines", "units", "components" or "systems". In addition, various aspects of this specification may be represented as a computer product located in one or more computer-readable media, which includes computer-readable program code.

[0056] A computer storage medium may include a propagated data signal embodying the computer program code, for example, in baseband or as part of a carrier wave. The propagated signal may be in a variety of forms, including electromagnetic, optical, or any suitable combination thereof. A computer storage medium may be any computer-readable medium other than a computer-readable storage medium that can be connected to an instruction execution system, apparatus, or device to communicate, propagate, or transfer the program for use. The program code on the computer storage medium may be transmitted via any suitable medium, including radio, cable, fiber optic cable, RF, or similar media, or any combination of these.

[0057] The computer program codes required for the operation of the various parts of this specification can be written in any one or more programming languages, including object-oriented programming languages ​​such as Java, Scala, Smalltalk, Eiffel, JADE, Emerald, C++, C#, VB.NET, Python, etc., conventional procedural programming languages ​​such as C, Visual Basic, Fortran2003, Perl, COBOL2002, PHP, ABAP, dynamic programming languages ​​such as Python, Ruby and Groovy, or other programming languages. The program code can be run entirely on the user's computer, or as a separate software package on the user's computer, or partly on the user's computer and partly on a remote computer, or entirely on a remote computer or processing device. In the latter case, the remote computer can be connected to the user's computer through any network form, such as a local area network (LAN) or a wide area network (WAN), or connected to an external computer (e.g., via the Internet), or in a cloud computing environment, or used as a service such as software as a service (SaaS).

[0058] In addition, unless expressly stated in the claims, the order of the processing elements and sequences, the use of alphanumeric characters, or the use of other names described in this specification are not intended to limit the order of the processes and methods of this specification. Although the above disclosure discusses some embodiments of the invention that are currently considered useful through various examples, it should be understood that such details are for illustrative purposes only, and the appended claims are not limited to the disclosed embodiments. On the contrary, the claims are intended to cover all modifications and equivalent combinations that are consistent with the spirit and scope of the embodiments of this specification. For example, although the system components described above can be implemented by hardware devices, they can also be implemented only by software solutions, such as installing the described system on an existing processing device or mobile device.

[0059] Similarly, it should be noted that, in order to simplify the presentation of this specification and thus facilitate understanding of one or more embodiments of the invention, the foregoing descriptions of the embodiments of this specification sometimes combine multiple features into a single embodiment, figure, or description thereof. However, this disclosure method does not imply that the subject matter of this specification requires more features than those recited in the claims. In fact, an embodiment may have fewer features than all of the features of a single disclosed embodiment.

[0060] In some embodiments, numbers are used to describe the quantity of components and attributes. It should be understood that such numbers used in the description of the embodiments are modified by the modifiers "about", "approximately" or "substantially" in some examples. Unless otherwise stated, "about", "approximately" or "substantially" indicate that the numbers are allowed to vary by ±20%. Accordingly, in some embodiments, the numerical parameters used in the description and claims are approximate values, which may change according to the required characteristics of individual embodiments. In some embodiments, the numerical parameters should take into account the specified significant digits and adopt the general method of retaining digits. Although the numerical domains and parameters used to confirm the breadth of their range in some embodiments of this specification are approximate values, in specific embodiments, the settings of such numerical values ​​are as accurate as possible within the feasible range.

[0061] Each patent, patent application, patent application publication, and other materials, such as articles, books, specifications, publications, and documents, cited in this specification is hereby incorporated by reference in its entirety. This includes application history documents that are inconsistent with or conflict with the content of this specification, as well as documents (currently or subsequently attached to this specification) that limit the broadest scope of the claims of this specification. It should be noted that if the descriptions, definitions, and / or terminology used in the accompanying materials are inconsistent or conflicting with the content of this specification, the descriptions, definitions, and / or terminology used in this specification will control.

[0062] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically separate entities. That is, these functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0063] Finally, it should be understood that the embodiments described in this specification are intended only to illustrate the principles of the embodiments of this specification. Other variations may also fall within the scope of this specification. Therefore, by way of example and not limitation, alternative configurations of the embodiments of this specification may be considered consistent with the teachings of this specification. Accordingly, the embodiments of this specification are not limited to the implementations explicitly described and illustrated in this specification.

Claims

1. A method for generating and reconfiguring a random beacon, characterized in that: The following steps are involved: 1) In a decentralized network, all network nodes perform initialization, generate a public reference string, generate public and private keys based on the public reference string, split the private key into multiple secret shares and send them to each network node; 2) Each network node uses its own secret share to sign the concatenation of the protocol identifier and the current random beacon generation round number, and broadcasts the generated threshold signature to other network nodes in the network; 3) After receiving f+1 threshold signatures, each network node aggregates them to obtain an aggregate signature, where f is the number of tolerable corrupt nodes. The public key is used to verify the validity of the aggregate signature. If the aggregate signature is valid, a random beacon is generated based on the aggregate signature; otherwise, the operation is terminated. 4) Select committee nodes from the network nodes based on the generated random beacon, the total number of network nodes, and the preset number of committee nodes; 5) Each non-committee node generates a secret value and a PVSS transcript of the secret value locally, and broadcasts the PVSS transcript to all committee nodes; 6) After receiving the PVSS transcript, the committee node verifies its validity. When the number of PVSS transcripts that pass the validity verification reaches f+1, it aggregates them to obtain the aggregated PVSS transcript and broadcasts the aggregated PVSS transcript to non-committee nodes. 7) The non-committee node verifies the validity of the received aggregated PVSS transcript. After passing the validity verification and reaching a consensus, the secret of the obtained unique PVSS transcript is reconstructed to obtain the private key for the next round of reconfiguration.

2. The method according to claim 1, wherein In step 1), a verifiable unpredictable function VUF is executed on all network nodes to initialize them.

3. The method according to claim 1, wherein In step 3), the generated random beacon is derived through the Drive algorithm of the function VUF.

4. The method according to claim 1, wherein In step 7), the secret of the unique PVSS transcript obtained is reconstructed by Lagrange interpolation method.

5. The method according to claim 1, wherein Step 7) The Central African Committee node executes the MVBA protocol and sets the validity condition function of the MVBA protocol to verify the validity of the PVSS transcript.

6. A random beacon generation and reconfiguration system, characterized in that: include: The random beacon generation module is used to initialize all network nodes in the decentralized network, generate a public reference string, generate public and private keys based on the public reference string, split the private key into multiple secret shares, and send them to each network node. Each network node uses its own secret share to sign the concatenation of the protocol identifier and the current random beacon generation round number, and broadcasts the generated threshold signature to other network nodes in the network. After receiving f+1 threshold signatures, each network node aggregates them to obtain an aggregate signature, where f is the number of tolerable corrupt nodes. The public key is used to verify the validity of the aggregate signature. If the aggregate signature is valid, a random beacon is generated based on the aggregate signature. The reconfiguration module is used to select committee nodes from network nodes based on the generated random beacon, the total number of network nodes and the preset number of committee nodes. Each non-committee node locally generates a secret value and a PVSS transcript of the secret value, and broadcasts the PVSS transcript to all committee nodes. After receiving the PVSS transcript, the committee node verifies its validity. When the number of PVSS transcripts that pass the validity verification reaches f+1, it aggregates them to obtain an aggregated PVSS transcript, and broadcasts the aggregated PVSS transcript to non-committee nodes. The non-committee nodes verify the validity of the received aggregated PVSS transcript. After passing the validity verification and reaching a consensus, they reconstruct the secret of the unique PVSS transcript to obtain the private key for the next round of reconfiguration.

7. The system according to claim 6, wherein: Execute the VUF function on all network nodes to initialize them.

8. The system according to claim 6, wherein: The generated random beacon is exported through the Drive algorithm of the function VUF.

9. The system according to claim 6, wherein: The secret of the obtained unique PVSS transcript is reconstructed by Lagrange interpolation method.

10. The system according to claim 6, wherein: The non-committee nodes execute the MVBA protocol and set the validity condition function of the MVBA protocol to verify the validity of the PVSS transcript.

Images