Asynchronous distributed key generation method and system with optimal time complexity

Abstract

The present invention discloses an asynchronous distributed key generation method and system with optimal time complexity, the method comprising: sharing a random key through a high threshold asynchronous complete secret sharing instance corresponding to a first node; after a first number of nodes complete the high threshold asynchronous complete secret sharing instance, broadcasting the completed shared instance set in a Byzantine broadcast instance; after completing a second number of Byzantine broadcast instances, entering the following iterative steps: in the current iterative step, querying a weak consistency master node election oracle, obtaining a pseudo-random number pair, and proposing a multi-valued Byzantine negotiation instance; performing key derivation according to the identity of the Byzantine broadcast instance in the agreed pseudo-random pair, and obtaining a distributed key; if the multi-valued Byzantine negotiation instance output is empty, entering the next iteration. The present invention can achieve a time complexity of O(1) when generating distributed keys, and supports domain elements such as private keys and high thresholds.

Description

Technical Field

[0001] The present invention relates to the field of distributed computing technology, and in particular to an asynchronous distributed key generation method and system with optimal time complexity. Background Art

[0002] This section is intended to provide a background or context to the embodiments of the invention recited in the claims. No admission is made that the description herein is prior art by inclusion in this section.

[0003] In an asynchronous environment, the effective operation of distributed negotiation and consensus mechanisms depends on the distributed key generation protocol (ADKG). For example, HoneyBadger BFT, BEAT and other protocols all use distributed signatures or distributed encryption.

[0004] Asynchronous distributed key generation technology refers to the use of an asynchronous network environment, usually assuming that there are malicious adversaries who may make incorrect inputs to the system. After the final protocol is completed, each node securely generates a threshold private key. After obtaining a number of private keys exceeding the threshold, the private key itself can be reconstructed.

[0005] The time complexity of the earliest proposed asynchronous distributed key generation protocol is O(n), and its communication complexity reaches O(n 4 ), which requires considerable time and communication overhead, and is difficult to meet the low latency and high scalability requirements of digital currencies. Subsequently, a technical solution proposed a protocol with O(1) time and O(n³ log n) communication complexity, as well as a protocol with O(n³) communication complexity. However, these two protocols still have two shortcomings: First, these protocols cannot implement domain elements as private keys, and therefore cannot be compatible with commonly used distributed signature schemes Schnorr, ECDSA, BLS, and national secret algorithms SM2 and SM9 signatures; second, these protocols do not support high thresholds (thresholds exceeding 2 / 3 of the total number of nodes), but asynchronous consensus requires the use of high-threshold cryptographic algorithms, so these protocols are difficult to apply in consensus protocols.

[0006] Recently, a technical solution proposed a protocol in a distributed business network that reduces security assumptions, supports private keys as domain elements, and significantly improves the performance of the protocol with high thresholds. A later technical solution uses MPC to achieve the transformation of low-threshold integrity secret sharing to high-threshold distributed key generation protocol based on super-reversible matrices, which greatly improves performance and is the most efficient distributed key generation protocol known to date, but still has a time complexity of O (log n).

[0007] It can be seen that the existing distributed key generation schemes cannot achieve O(1) time complexity and cannot support domain elements being private keys and high thresholds. Summary of the invention

[0008] An embodiment of the present invention provides an asynchronous distributed key generation method with optimal time complexity, which can achieve O(1) time complexity when generating distributed keys, and supports domain elements such as private keys and high thresholds. The method is applied to a first node in an asynchronous distributed system, and the first node is any node in the asynchronous distributed system, including:

[0009] Determine a random key, and share the random key through a high threshold asynchronous perfect secret sharing instance corresponding to the first node;

[0010] After a first number of nodes complete the high threshold asynchronous complete secret sharing instance, broadcasting a completed sharing instance set in a Byzantine broadcast instance corresponding to the first node and a Byzantine broadcast instance corresponding to the second node, the completed sharing instance set being a set of identity identifiers of completed high threshold asynchronous complete secret sharing instances, and the second node being a node other than the first node in the asynchronous distributed system;

[0011] After the first node completes the second number of Byzantine broadcast instances, the following iterative steps are performed:

[0012] In the current iteration step, query the weak consistency master node election oracle to obtain a pseudo-random number pair;

[0013] Proposing the pseudo-random number pair to a multi-valued Byzantine negotiation instance, and waiting for the output of the multi-valued Byzantine negotiation instance, wherein the multi-valued Byzantine negotiation instance is used to reach a consensus on the pseudo-random number pairs proposed by multiple nodes;

[0014] If the multi-valued Byzantine negotiation instance outputs a consistent pseudo-random number pair, the key is derived based on the identity of the Byzantine broadcast instance in the consistent pseudo-random pair to obtain a distributed key;

[0015] If the output of the multi-valued Byzantine negotiation instance is empty, add 1 to the current iteration step and enter the next iteration.

[0016] An embodiment of the present invention provides an asynchronous distributed key generation system with optimal time complexity, which can achieve O(1) time complexity when generating distributed keys, and supports domain elements such as private keys and high thresholds. The system is applied to a first node in an asynchronous distributed system, and the first node is any node in the asynchronous distributed system. The system includes:

[0017] A sharing module, configured to determine a random key, and share the random key through a high threshold asynchronous perfect secret sharing instance corresponding to the first node;

[0018] A key set proposal module is used to broadcast a completed sharing instance set in a Byzantine broadcast instance corresponding to the first node and a Byzantine broadcast instance corresponding to the second node after a first number of nodes complete the high threshold asynchronous complete secret sharing instance, wherein the completed sharing instance set is a set of identity identifiers of completed high threshold asynchronous complete secret sharing instances, and the second node is a node other than the first node in the asynchronous distributed system;

[0019] The iteration module is used for the key to enter the following iteration steps after the first node completes the second number of Byzantine broadcast instances:

[0020] In the current iteration step, query the weak consistency master node election oracle to obtain a pseudo-random number pair;

[0021] Proposing the pseudo-random number pair to a multi-valued Byzantine negotiation instance, and waiting for the output of the multi-valued Byzantine negotiation instance, wherein the multi-valued Byzantine negotiation instance is used to reach a consensus on the pseudo-random number pairs proposed by multiple nodes;

[0022] If the multi-valued Byzantine negotiation instance outputs a consistent pseudo-random number pair, the key is derived based on the identity of the Byzantine broadcast instance in the consistent pseudo-random pair to obtain a distributed key;

[0023] If the output of the multi-valued Byzantine negotiation instance is empty, add 1 to the current iteration step and enter the next iteration.

[0024] An embodiment of the invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned asynchronous distributed key generation method with optimal time complexity when executing the computer program.

[0025] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the asynchronous distributed key generation method with optimal time complexity is implemented.

[0026] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the asynchronous distributed key generation method with optimal time complexity is implemented.

[0027] In an embodiment of the present invention, a random key is determined; the random key is shared through a high threshold asynchronous complete secret sharing instance corresponding to a first node; after a first number of nodes complete the high threshold asynchronous complete secret sharing instance, a completed shared instance set is broadcast in a Byzantine broadcast instance corresponding to the first node and a Byzantine broadcast instance corresponding to a second node, the completed shared instance set is a set of identity identifiers of completed high threshold asynchronous complete secret sharing instances, and the second node is a node other than the first node in the asynchronous distributed system; after the first node completes a second number of Byzantine broadcast instances, Enter the following iterative steps: In the current iterative step, query the weak consistency master node election oracle to obtain a pseudo-random number pair; propose the pseudo-random number pair to the multi-valued Byzantine negotiation instance, and wait for the output of the multi-valued Byzantine negotiation instance, which is used to reach a consensus on the pseudo-random number pairs proposed by multiple nodes; if the multi-valued Byzantine negotiation instance outputs a consistent pseudo-random number pair, perform key derivation based on the identity of the Byzantine broadcast instance in the agreed pseudo-random pair to obtain a distributed key; if the output of the multi-valued Byzantine negotiation instance is empty, add 1 to the current iterative step and enter the next iteration. Through the above process, the time complexity of the distributed key generation process can be achieved to be O (1). Since the high-threshold asynchronous complete secret sharing instance adopted in the example of the present invention itself uses domain elements for secret sharing, and uses commitment as proof provided to other nodes, in the final reconstruction process, the final domain element is used as the private key and the group element is used as the public key. Therefore, the scheme proposed in the embodiment of the present invention supports domain elements as private keys; in addition, since the high-threshold asynchronous complete secret sharing instance is constructed through a random matrix extraction method, it is possible to achieve a transformation from low-threshold asynchronous complete secret sharing to high-threshold asynchronous distributed key generation, so that the scheme proposed in the embodiment of the present invention supports high thresholds. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0029] Figure 1 This is a flow chart of an asynchronous distributed key generation method with optimal time complexity in an embodiment of the present invention;

[0030] Figure 2 This is an execution flow chart of the weak consistency master node election oracle in an embodiment of the present invention;

[0031] Figure 3It is an execution flow chart of a multi-valued Byzantine negotiation example in an embodiment of the present invention;

[0032] Figure 4 A schematic diagram showing a delay comparison between the solution proposed in an embodiment of the present invention and the currently disclosed protocol DXKR;

[0033] Figure 5 Schematic diagram of an asynchronous distributed key generation system with optimal time complexity in an embodiment of the present invention;

[0034] Figure 6 Schematic diagram of a computer device in an embodiment of the present invention. DETAILED DESCRIPTION

[0035] To make the purpose, technical solution and advantages of the embodiments of the present invention more clear, the embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0036] Figure 1 The flowchart of the asynchronous distributed key generation method with optimal time complexity in an embodiment of the present invention is applied to a first node in an asynchronous distributed system, where the first node is any node in the asynchronous distributed system, and the method includes:

[0037] Step 101, determining a random key, and sharing the random key through a high threshold asynchronous perfect secret sharing instance corresponding to the first node;

[0038] Step 102: after a first number of nodes complete the high threshold asynchronous complete secret sharing instance, broadcast a completed sharing instance set in a Byzantine broadcast instance corresponding to the first node and a Byzantine broadcast instance corresponding to the second node, wherein the completed sharing instance set is a set of identity identifiers of completed high threshold asynchronous complete secret sharing instances;

[0039] Step 103, after the first node completes the second number of Byzantine broadcast instances, enter the following iterative steps:

[0040] Step 1031, in the current iteration step, query the weak consistency master node election oracle to obtain a pseudo-random number pair;

[0041] Step 1032, proposing the pseudo-random number pair to a multi-valued Byzantine negotiation instance, and waiting for the output of the multi-valued Byzantine negotiation instance, wherein the multi-valued Byzantine negotiation instance is used to reach a consensus on the pseudo-random number pairs proposed by multiple nodes;

[0042] Step 1033: If the multi-valued Byzantine negotiation instance outputs a consistent pseudo-random number pair, a key is derived according to the identity of the Byzantine broadcast instance in the consistent pseudo-random pair to obtain a distributed key;

[0043] Step 1034: If the output of the multi-valued Byzantine negotiation instance is empty, add 1 to the current iteration step and enter the next iteration.

[0044] Each step is described in detail below. Through the above process, the time complexity of the distributed key generation process can be achieved to be O (1). Since the high-threshold asynchronous complete secret sharing instance adopted by the example of the present invention itself uses domain elements for secret sharing, and uses commitment as proof provided to other nodes, in the final reconstruction process, the final domain element is used as the private key and the group element is used as the public key, so the scheme proposed in the embodiment of the present invention supports domain elements as private keys; in addition, since the high-threshold asynchronous complete secret sharing instance is constructed by a random matrix extraction method, it is possible to achieve the transformation from low-threshold asynchronous complete secret sharing to high-threshold asynchronous distributed key generation, so that the scheme proposed in the embodiment of the present invention supports high thresholds.

[0045] Specifically, the solution proposed in the embodiment of the present invention uses the method of multi-party secure computing to first run n low-threshold and high-threshold asynchronous complete secret sharing instances in parallel; then each node transforms the shared secret share through a locally negotiated random super-reversible matrix, thereby realizing the secret sharing of higher-dimensional polynomials, and finally realizing the construction of high-threshold ADKG through the verification of zero-knowledge proof and the reconstruction of high-dimensional polynomials. Therefore, the example of the present invention supports a high threshold (a threshold of not less than 1 / 2 of the total number of nodes).

[0046] In an embodiment of the present invention, the asynchronous distributed key generation with optimal time complexity includes five stages: sharing (step 101), key set proposal (step 102), weak consistency master node election protocol and MBA and key sharing (step 103).

[0047] In step 101, a random key is determined, and the random key is shared through a high threshold asynchronous perfect secret sharing instance corresponding to a first node;

[0048] Asynchronous Complete Secret Sharing (ACSS) refers to the sharing of a secret s by the master node P in an asynchronous environment. ACSS includes a sharing phase and a reconstruction phase. In the sharing phase, the master node P distributes the secret. In the reconstruction phase, the nodes aggregate and recover the secret. In step 101, each node Pi first selects a random key si, and then shares si through an asynchronous complete secret sharing ACSS instance. The ACSS instance corresponding to Pi is denoted as ACSSi. The ACSS protocol is required to have homomorphic partial commitment properties (e.g., DYX+, DXKR, ZYL+). Each node uses two local parameter share sets Si of each node and the first shared instance set Ti′ to track the values ​​in each ACSS instance.

[0049] In step 102, after a first number t+1 of nodes complete the high threshold asynchronous complete secret sharing instance, a completed sharing instance set Ti is broadcasted in a Byzantine broadcast (RBC) instance corresponding to the first node and a Byzantine broadcast instance corresponding to the second node, wherein the completed sharing instance set Ti is a set of identity identifiers of completed high threshold asynchronous complete secret sharing instances;

[0050] Among them, in an asynchronous distributed system, there are n nodes, t of which are wrong.

[0051] In one embodiment, the method further comprises:

[0052] After the first node Pi and each second node complete the high threshold asynchronous complete secret sharing instance, obtain the shared share sj,i for the first node Pi output by the high threshold asynchronous complete secret sharing instance corresponding to the first node and each second node;

[0053] Add the shared share sj,i to the share set Si, and add the identity of the completed high threshold asynchronous perfect secret sharing instance to the first sharing instance set Ti′;

[0054] After a first number t+1 of nodes complete the high-threshold asynchronous complete secret sharing instance, the completed sharing instance set Ti is set as the first sharing instance set Ti′.

[0055] Specifically, after ACSSi ends, Pi adds si,i to Si, and after ACSSj ends, Pi adds sj,i to Si and j to Ti′, where sj,i is the share of node pi in ACSSj. The first number t+1 of nodes completes the high threshold asynchronous complete secret sharing instance, i.e., |Ti′| = t + 1.

[0056] In one embodiment, broadcasting the completed shared instance set Ti in the Byzantine broadcast RBC instance corresponding to the first node and the Byzantine broadcast instance corresponding to the second node includes:

[0057] When the completed instance set Ti is included in the first instance set Ti′ (i.e., Tj Ti′), participate in the Byzantine broadcast instance corresponding to the second node;

[0058] Send corresponding confirmation messages to all other nodes, each confirmation message including a confirmation message identifier, the number of the first node, and the identity identifier of the Byzantine broadcast instance corresponding to the second node;

[0059] After receiving a confirmation message for the third number nt, the identity identifier of the Byzantine broadcast instance corresponding to the second node is added to the completed broadcast instance set Hi′ as the identity identifier of the completed Byzantine broadcast instance, where the completed broadcast instance set is used to count the number of Byzantine broadcast instances completed by the first node.

[0060] Specifically, when the completed instance set Ti is included in the first instance set Ti′ (i.e., Tj Ti′), participates in the Byzantine broadcast instance corresponding to the second node. In this way, it is ensured that if RBCj is completed, at least t + 1 correct nodes have participated in RBCj. Therefore, for each k ∈ Tj, at least t + 1 correct nodes have completed ACSSk. Each node Pi uses Hi′ to track the completed Byzantine broadcast instances.

[0061] In step 103, after the first node completes the second number 2t + 1 Byzantine broadcast instances (ie, Hi′ = 2t + 1), the following iterative steps are performed:

[0062] In step 1031, in the current iteration step, the weak consistency master node election oracle is queried to obtain a pseudo-random number pair;

[0063] In one embodiment, querying a weak consistency master node election oracle to obtain a pseudo-random number pair includes:

[0064] The current iteration step and the set of completed broadcast instances are input into the weak consistency master node election oracle to obtain a pseudo-random number pair, wherein the pseudo-random number pair includes a pseudo-random number and an identity of a Byzantine broadcast instance that generates the pseudo-random number.

[0065] Specifically, in each iteration r, each node first queries the weak consistency master node election oracle. The Election(r, Hi′) function represents the oracle. Where r is the number of iterations, and Hi′ is the identifier of the completed RBC instance. The weak consistency master node election oracle outputs a pseudo-random number pair (ki, cmi) for each Pi, where ki ∈ [n], cmi is a pseudo-random number, and ki is the identity of the Byzantine broadcast instance that generates the pseudo-random number. Different nodes may output inconsistent pseudo-random number pairs.

[0066] See also Figure 2 This is an execution flow chart of the weak consistency master node election oracle in the embodiment of the present invention. The weak consistency master node election oracle in the embodiment of the present invention has two communication steps: the sending (SEND) step and the sharing (SHARE) step. In the sending (SEND) step, the nodes exchange the identities of their completed RBC instances. This ensures the formation of the core set. After that, the node starts to create shares using the threshold PRF (pseudo-random number generation function) scheme and shares them with the second node in the sharing (SHARE) step. After each node collects enough shares corresponding to the settings of each RBC instance, they will combine them into a PRF value to generate a pseudo-random number.

[0067] In one embodiment, the execution steps of the weak consistency master node election oracle include:

[0068] Step 201, taking the completed broadcast instance set Hi′ as the first broadcast instance set Hi;

[0069] Step 202, broadcast a send message to all nodes, wherein the send message (SEND, r, Hi) includes a send message identifier SEND, a current iteration step r, and a first broadcast instance set Hi;

[0070] The specific execution steps of the weak consistency master node election oracle are for each node, that is, each node broadcasts a message to the second node.

[0071] Step 203, after receiving the send message from the second node, when the first broadcast instance set in the send message from the second node is included in the completed broadcast instance set of the first node, accept the send message from the second node, and merge the first broadcast instance set in the send message from the second node into the first election set corresponding to the first node ;

[0072] Specifically, the message sent by the second node Pj is (SEND, r, Hj), and the first broadcast instance set in the message sent by the second node is included in the completed broadcast instance set of the first node, that is, Pi is only , that is, Pi accepts the information only after it has completed all RBC instances that Pj has completed. After that, Pi sets Fi′ to .

[0073] Step 204, after waiting for receiving the second number 2t + 1 of sending messages, the first election set is used as the final election set Fi;

[0074] Specifically, each node will not proceed to the next step until it receives the 2t+1 message. The first election set Fi′ is used as the final election set Fi.

[0075] Step 205, start the shared sending function and determine a threshold value for the identity of each Byzantine broadcast instance in the final election set;

[0076] Specifically, for each k ∈ Fi , Pi hopes to obtain a threshold value , used for subsequent calculation of pseudo-random numbers.

[0077] Step 206, obtaining the maximum threshold value and the corresponding hash value among all threshold values ​​through the maximum value obtaining function, and the hash value is used as the pseudo-random number of the Byzantine broadcast instance corresponding to the second node;

[0078] Specifically, each node Pi starts evaluating the maximum threshold value received by calling the maximum value obtaining function ObtainMax(). In this function, Pi iterates the pseudo-random number and calculates the hash value of the pseudo-random number. Among the values, Pi selects the value with the largest hash value. Finally, the ObtainMax() function outputs (k, cmi), where cm i is the maximum hash value, and k is the identity of the RBC instance that generated cmi. Then, the Election(r, Hi′) function outputs (k, cmi) at Pi as a pseudo-random number pair.

[0079] Step 207: Use the pseudo-random number and the identity of the corresponding Byzantine broadcast instance as a pseudo-random number pair.

[0080] Specifically, the share sending function can be expressed as SendShares(r), in which Pi will create a threshold share for any completed RBC instance and send it to the second node, that is, Pi can send at most n SHARE messages. The detailed execution steps are given below.

[0081] In one embodiment, the steps of executing the shared sending function include:

[0082] Create a threshold share for each completed Byzantine broadcast instance through the share generation function , sending the threshold share to the second node through a shared message, wherein the shared message includes a shared message identifier, a current iteration step, an identity identifier of the Byzantine broadcast instance corresponding to the second node, and a threshold share of the Byzantine broadcast instance corresponding to the second node; meanwhile, the first node locally stores a verification key for the second node;

[0083] After receiving the shared message from the second node, the received shared message is verified through the verification key of the second node. After the verification is passed, all threshold shares of the second node are merged into one threshold value through a reconstruction function.

[0084] Specifically, the share generation function is expressed as GenShare(r,j,Tj), where r is the iteration step and Tj is the jth completed Byzantine broadcast instance. If r-delivers is run on Tj and the (SHARE,r,j,-) message has not been sent before, the GenShare(r,j,Tj) function will be called to create a share.

[0085] Pi uses Tj as a reference to determine its secret key sk i,j and all authentication keys. Specifically, , where s l,i Is Pi in ACSS l In addition, each node can interpolate and create a verification key vk for any node k ∈ [n] j [k] , such that With this setup, Pi can use the threshold PRF scheme as Create a threshold share Then, Pi sends a sharing message (SHARE,r,j, ). At the same time, local storage sk i,j and verification key to verify the share from the second node. After entering the SHARE step, Pi continues to collect threshold shares from the second node and merges the threshold shares into a PRF value, namely the threshold value.

[0086] In step 1032, the pseudo-random number pair is proposed to the multi-valued Byzantine negotiation MBA instance, and the output of the multi-valued Byzantine negotiation instance is waited for. The multi-valued Byzantine negotiation instance is used to reach a consensus on the pseudo-random number pairs proposed by multiple nodes; specifically, Pi proposes ki || cmi to the MBA instance, denoted as MBAr. Then, Pi waits for the output of MBAr. There are two cases, namely step 1033 and step 1034.

[0087] In step 1033, if the multi-valued Byzantine negotiation instance outputs a consistent pseudo-random number pair, a key is derived according to the identity of the Byzantine broadcast instance in the consistent pseudo-random pair to obtain a distributed key;

[0088] Specifically, the pseudo-random number pair that is agreed upon by the multi-valued Byzantine negotiation instance outputs is that MBAr outputs kr || cmr and kr ≠ ⊥, in which case the node begins to enter the key derivation phase. This work can be integrated with most DKG methods that use ACSS with homomorphic partial commitment properties. Depending on the ACSS protocol used, key derivation may be different. Taking the DYX+ method as an example, for any j ∈ (Any node corresponding to the identity of the Byzantine broadcast instance in the agreed pseudo-random pair), the corresponding key in ACSSj will be included in the output of DKG.

[0089] In one embodiment, key derivation is performed according to the identity of the Byzantine broadcast instance in the agreed pseudo-random pair to obtain a distributed key, including:

[0090] The node corresponding to the identity of the Byzantine broadcast instance in the agreed pseudo-random pair is used as the consistent node;

[0091] All shared shares sj,i corresponding to the consistent nodes for the first node are combined into the key of the first node.

[0092] Specifically, each node sets its key ski to .

[0093] In one embodiment, the method further comprises:

[0094] After obtaining the key of the first node, obtain the random keys of all consistent nodes;

[0095] Combine the random keys of all consistent nodes into a public key exponent;

[0096] Generate a public key according to the public key exponent;

[0097] A verification key of the first node is generated according to the key of the first node through key interpolation.

[0098] Specifically, the public key can be expressed as h z , where z is In addition, through key interpolation, each node can also obtain the verification key of any node Pj , h is a parameter.

[0099] Figure 3The execution flow chart of the multi-valued Byzantine negotiation example in the embodiment of the present invention is shown in FIG. The multi-valued Byzantine negotiation MBA example construction uses a variant of HD-MBA, which can be terminated in only three steps in the optimal case. The protocol largely follows HD-MBA, but with two modifications.

[0100] (1) HD-MBA uses threshold signatures, while the protocol in the embodiment of the present invention replaces each threshold signature with a set of nf digital signatures.

[0101] (2) The present invention implements two most efficient re-voting asynchronous Byzantine agreement instances RABA with a fast path without coin tossing, namely Quadratic-RABA, and replaces the original local coin tossing with public coin tossing.

[0102] Through these two changes, the communication complexity of the multi-valued Byzantine negotiation instance constructed in the embodiment of the present invention is O(kn 3 ), the message complexity is O(n 2 ), the communication cost of each node is O(kn 2 ).

[0103] join Figure 3 , the execution steps of the multi-valued Byzantine negotiation MBA instance include:

[0104] Step 301: Generate a distribution message based on the input pseudo-random number pair , and broadcast to all nodes;

[0105] Step 302, after receiving a fourth number n-2t of matching distribution messages, generate a response message according to the distribution message and broadcast it to all nodes;

[0106] Step 303, after receiving a consistent response message of the third number nt, create a digital signature for the pseudo-random number, generate a feedback message according to the digital signature, and broadcast it to all nodes;

[0107] Step 304, after receiving the third number of matching feedback messages, sending decision information to the asynchronous Byzantine negotiation instance capable of re-voting;

[0108] Step 305: Obtain a pseudo-random number pair output by the asynchronous Byzantine negotiation instance that can re-vote.

[0109] Specifically, there are two situations for the pseudo-random number pair output by the asynchronous Byzantine negotiation instance with re-voting, namely, a pseudo-random number pair that reaches consensus and empty, which will be judged separately later.

[0110] In step 1034, if the output of the multi-valued Byzantine negotiation instance is empty, the current iteration step is increased by 1 and the next iteration is entered.

[0111] Specifically, if the output of the multi-valued Byzantine negotiation instance MBAr is empty ⊥, it means that the nodes have failed to reach a consensus on a certain k ∈ [n]. At this time, the nodes enter the next iteration.

[0112] The solutions proposed in the embodiments of the present invention are deployed in different distributed systems, and the number of nodes is set to 4, 13, 25, 49, 64, 127, and 202 respectively. Figure 4 This is a schematic diagram comparing the delay of the solution proposed in the embodiment of the present invention with the currently disclosed protocol DXKR. It can be seen that the delay of the currently disclosed protocol DXKR is 1.6 to 4.8 times that of this solution. And as n increases, the efficiency advantage of this solution becomes more obvious.

[0113] The embodiment of the present invention further proposes an asynchronous distributed key generation system with optimal time complexity, the principle of which is similar to the asynchronous distributed key generation method with optimal time complexity, and will not be repeated here.

[0114] Figure 5 A schematic diagram of an asynchronous distributed key generation system with optimal time complexity in an embodiment of the present invention includes: a first node applied in an asynchronous distributed system, including:

[0115] A sharing module 501 is used to determine a random key, and share the random key through a high threshold asynchronous perfect secret sharing instance corresponding to the first node;

[0116] The key set proposal module 502 is used to broadcast the completed sharing instance set in the Byzantine broadcast instance corresponding to the first node and the Byzantine broadcast instance corresponding to the second node after the first number of nodes complete the high threshold asynchronous complete secret sharing instance, wherein the completed sharing instance set is a set of identity identifiers of the completed high threshold asynchronous complete secret sharing instance, and the second node is a node other than the first node in the asynchronous distributed system;

[0117] Iteration module 503 is used to enter the following iterative steps after the key completes the second number of Byzantine broadcast instances at the first node:

[0118] In the current iteration step, query the weak consistency master node election oracle to obtain a pseudo-random number pair;

[0119] Proposing the pseudo-random number pair to a multi-valued Byzantine negotiation instance, and waiting for the output of the multi-valued Byzantine negotiation instance, wherein the multi-valued Byzantine negotiation instance is used to reach a consensus on the pseudo-random number pairs proposed by multiple nodes;

[0120] If the multi-valued Byzantine negotiation instance outputs a consistent pseudo-random number pair, the key is derived based on the identity of the Byzantine broadcast instance in the consistent pseudo-random pair to obtain a distributed key;

[0121] If the output of the multi-valued Byzantine negotiation instance is empty, add 1 to the current iteration step and enter the next iteration.

[0122] In one embodiment, the key set proposal module is used to:

[0123] After the first node and each second node complete the high threshold asynchronous complete secret sharing instance, obtain a share for the first node output by the high threshold asynchronous complete secret sharing instance corresponding to the first node and each second node;

[0124] Adding the shared share to a share set, and adding the identity of the completed high threshold asynchronous perfect secret sharing instance to a first shared instance set;

[0125] After a first number of nodes complete the high-threshold asynchronous complete secret sharing instance, setting the completed sharing instance set as the first sharing instance set;

[0126] The completed shared instance set is broadcasted in the Byzantine broadcast instance corresponding to the first node and the Byzantine broadcast instance corresponding to the second node.

[0127] In one embodiment, the key set proposal module is used to:

[0128] When the completed instance set is included in the first instance set, participating in the Byzantine broadcast instance corresponding to the second node;

[0129] Send corresponding confirmation messages to all other nodes, each confirmation message including a confirmation message identifier, the number of the first node, and the identity identifier of the Byzantine broadcast instance corresponding to the second node;

[0130] After receiving the third number of confirmation messages, the identity of the Byzantine broadcast instance corresponding to the second node is added to the completed broadcast instance set as the identity of the completed Byzantine broadcast instance, where the completed broadcast instance set is used to count the number of Byzantine broadcast instances completed by the first node.

[0131] In one implementation, the iteration module is used to:

[0132] The current iteration step and the set of completed broadcast instances are input into the weak consistency master node election oracle to obtain a pseudo-random number pair, wherein the pseudo-random number pair includes a pseudo-random number and an identity of a Byzantine broadcast instance that generates the pseudo-random number.

[0133] In one implementation, the iteration module is used to:

[0134] The node corresponding to the identity of the Byzantine broadcast instance in the agreed pseudo-random pair is used as the consistent node;

[0135] All shared shares corresponding to the consistent nodes for the first node are combined into the key of the first node.

[0136] In one implementation, the iteration module is further configured to:

[0137] After obtaining the key of the first node, obtain the random keys of all consistent nodes;

[0138] Combine the random keys of all consistent nodes into a public key exponent;

[0139] Generate a public key according to the public key exponent;

[0140] A verification key of the first node is generated according to the key of the first node through key interpolation.

[0141] In summary, in the method and system proposed in the embodiment of the present invention, a random key is determined; the random key is shared through the high threshold asynchronous complete secret sharing instance corresponding to the first node; after the first number of nodes complete the high threshold asynchronous complete secret sharing instance, the completed shared instance set is broadcast in the Byzantine broadcast instance corresponding to the first node and the Byzantine broadcast instance corresponding to the second node, and the completed shared instance set is a set of identity identifiers of the completed high threshold asynchronous complete secret sharing instance; after the first node completes the second number of Byzantine broadcast instances, the following iteration is entered Steps: In the current iteration step, query the weak consistency master node election oracle to obtain a pseudo-random number pair; propose the pseudo-random number pair to a multi-valued Byzantine negotiation instance, and wait for the output of the multi-valued Byzantine negotiation instance, which is used to reach a consensus on the pseudo-random number pairs proposed by multiple nodes; if the multi-valued Byzantine negotiation instance outputs a consistent pseudo-random number pair, perform key derivation based on the identity of the Byzantine broadcast instance in the consistent pseudo-random pair to obtain a distributed key; if the output of the multi-valued Byzantine negotiation instance is empty, add 1 to the current iteration step and enter the next iteration. Through the above process, the time complexity of the distributed key generation process can be achieved to be O(1). Since the high-threshold asynchronous complete secret sharing instance adopted by the example of the present invention itself uses domain elements for secret sharing, and uses commitment as proof provided to other nodes, in the final reconstruction process, the final domain element is used as the private key and the group element is used as the public key. Therefore, the solution proposed in the embodiment of the present invention supports domain elements as private keys. In addition, since the high-threshold asynchronous complete secret sharing instance is constructed through a random matrix extraction method, it is possible to achieve a transformation from low-threshold asynchronous complete secret sharing to high-threshold asynchronous distributed key generation, so that the solution proposed in the embodiment of the present invention supports high thresholds.

[0142] An embodiment of the present invention further provides a computer device, Figure 6 It is a schematic diagram of a computer device in an embodiment of the present invention. The computer device 600 includes a memory 610, a processor 620, and a computer program 630 stored in the memory 610 and executable on the processor 620. When the processor 620 executes the computer program 630, the data visualization method based on the data exchange model is implemented.

[0143] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the data visualization method based on the data exchange model is implemented.

[0144] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the data visualization method based on the data exchange model is implemented.

[0145] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0146] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0147] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0148] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0149] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. An asynchronous distributed key generation method with optimal time complexity, characterized in that: The method is applied to a first node in an asynchronous distributed system, where the first node is any node in the asynchronous distributed system, including: Determine a random key, and share the random key through a high threshold asynchronous perfect secret sharing instance corresponding to the first node; After a first number of nodes complete the high threshold asynchronous complete secret sharing instance, broadcasting a completed sharing instance set in a Byzantine broadcast instance corresponding to the first node and a Byzantine broadcast instance corresponding to the second node, the completed sharing instance set being a set of identity identifiers of completed high threshold asynchronous complete secret sharing instances, and the second node being a node other than the first node in the asynchronous distributed system; After the first node completes the second number of Byzantine broadcast instances, the following iterative steps are performed: In the current iteration step, query the weak consistency master node election oracle to obtain a pseudo-random number pair; Proposing the pseudo-random number pair to a multi-valued Byzantine negotiation instance, and waiting for the output of the multi-valued Byzantine negotiation instance, wherein the multi-valued Byzantine negotiation instance is used to reach a consensus on the pseudo-random number pairs proposed by multiple nodes; If the multi-valued Byzantine negotiation instance outputs a consistent pseudo-random number pair, the key is derived based on the identity of the Byzantine broadcast instance in the consistent pseudo-random pair to obtain a distributed key; If the output of the multi-valued Byzantine negotiation instance is empty, add 1 to the current iteration step and enter the next iteration.

2. The method according to claim 1, characterized in that Also includes: After the first node and each second node complete the high threshold asynchronous complete secret sharing instance, obtain a share for the first node output by the high threshold asynchronous complete secret sharing instance corresponding to the first node and each second node; Adding the shared share to a share set, and adding the identity of the completed high threshold asynchronous perfect secret sharing instance to a first shared instance set; After a first number of nodes complete the high-threshold asynchronous complete secret sharing instance, the completed sharing instance set is set as the first sharing instance set.

3. The method according to claim 1, characterized in that Broadcasting the completed shared instance set in the Byzantine broadcast instance corresponding to the first node and the Byzantine broadcast instance corresponding to the second node, including: When the completed instance set is included in the first instance set, participating in the Byzantine broadcast instance corresponding to the second node; Send corresponding confirmation messages to all other nodes, each confirmation message including a confirmation message identifier, the number of the first node, and the identity identifier of the Byzantine broadcast instance corresponding to the second node; After receiving the third number of confirmation messages, the identity of the Byzantine broadcast instance corresponding to the second node is added to the completed broadcast instance set as the identity of the completed Byzantine broadcast instance, where the completed broadcast instance set is used to count the number of Byzantine broadcast instances completed by the first node.

4. The method according to claim 1, characterized in that Query the weak consistency master node election oracle to obtain a pseudo-random number pair, including: The current iteration step and the set of completed broadcast instances are input into the weak consistency master node election oracle to obtain a pseudo-random number pair, wherein the pseudo-random number pair includes a pseudo-random number and an identity of a Byzantine broadcast instance that generates the pseudo-random number.

5. The method according to claim 1, characterized in that The execution steps of the weak consistency master node election oracle include: Taking the completed broadcast instance set as the first broadcast instance set; Broadcasting a message to all nodes, wherein the message includes a message identifier, a current iteration step, and a first broadcast instance set; After receiving the send message from the second node, when the first broadcast instance set in the send message from the second node is included in the completed broadcast instance set of the first node, accept the send message from the second node, and merge the first broadcast instance set in the send message from the second node into the first election set corresponding to the first node; After waiting for the second number of sent messages to be received, the first election set is used as the final election set; Start the shared sending function and determine a threshold value for the identity of each Byzantine broadcast instance in the final election set; The maximum threshold value and the corresponding hash value among all threshold values ​​are obtained through the maximum value obtaining function, and the hash value is used as the pseudo-random number of the Byzantine broadcast instance corresponding to the second node; The pseudo-random number and the identity of the corresponding Byzantine broadcast instance are used as a pseudo-random number pair.

6. The method according to claim 5, characterized in that The execution steps of the shared sending function include: By sharing the generation function, a threshold share is created for each completed Byzantine broadcast instance, and the threshold share is sent to the second node through a shared message, wherein the shared message includes a shared message identifier, a current iteration step, an identity identifier of the Byzantine broadcast instance corresponding to the second node, and a threshold share of the Byzantine broadcast instance corresponding to the second node; meanwhile, the verification key for the second node is stored locally at the first node; After receiving the shared message from the second node, the received shared message is verified through the verification key of the second node. After the verification is passed, all threshold shares of the second node are merged into one threshold value through a reconstruction function.

7. The method according to claim 1, characterized in that According to the identity of the Byzantine broadcast instance in the agreed pseudo-random pair, the key is derived to obtain the distributed key, including: The node corresponding to the identity of the Byzantine broadcast instance in the agreed pseudo-random pair is used as the consistent node; All shared shares corresponding to the consistent nodes for the first node are combined into the key of the first node.

8. The method according to claim 7, characterized in that Also includes: After obtaining the key of the first node, obtain the random keys of all consistent nodes; Combine the random keys of all consistent nodes into a public key exponent; Generate a public key according to the public key exponent; A verification key of the first node is generated according to the key of the first node through key interpolation.

9. The method according to claim 1, characterized in that The execution steps of the multi-valued Byzantine negotiation instance include: Generate a distribution message based on the input pseudo-random number pair and broadcast it to all nodes; After receiving a fourth number of matching distribution messages, generating a response message according to the distribution message and broadcasting it to all nodes; After receiving a third number of consistent response messages, creating a digital signature for the pseudo-random number, generating a feedback message based on the digital signature, and broadcasting it to all nodes; After receiving the third number of matching feedback messages, sending a decision message to the asynchronous Byzantine consensus instance with re-voting capability; Get a pseudo-random number pair output by an asynchronous Byzantine consensus instance with re-voting.

10. An asynchronous distributed key generation system with optimal time complexity, characterized in that: The method is applied to a first node in an asynchronous distributed system, where the first node is any node in the asynchronous distributed system, including: A sharing module, configured to determine a random key, and share the random key through a high threshold asynchronous perfect secret sharing instance corresponding to the first node; A key set proposal module is used to broadcast a completed sharing instance set in a Byzantine broadcast instance corresponding to the first node and a Byzantine broadcast instance corresponding to the second node after a first number of nodes complete the high threshold asynchronous complete secret sharing instance, wherein the completed sharing instance set is a set of identity identifiers of completed high threshold asynchronous complete secret sharing instances, and the second node is a node other than the first node in the asynchronous distributed system; The iteration module is used for the key to enter the following iteration steps after the first node completes the second number of Byzantine broadcast instances: In the current iteration step, query the weak consistency master node election oracle to obtain a pseudo-random number pair; Proposing the pseudo-random number pair to a multi-valued Byzantine negotiation instance, and waiting for the output of the multi-valued Byzantine negotiation instance, wherein the multi-valued Byzantine negotiation instance is used to reach a consensus on the pseudo-random number pairs proposed by multiple nodes; If the multi-valued Byzantine negotiation instance outputs a consistent pseudo-random number pair, the key is derived based on the identity of the Byzantine broadcast instance in the consistent pseudo-random pair to obtain a distributed key; If the output of the multi-valued Byzantine negotiation instance is empty, add 1 to the current iteration step and enter the next iteration.

11. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 9 is implemented.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

13. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

Images