Account management method, device and architecture based on signature algorithm dynamic integration

Abstract

The invention relates to an account management method, device and architecture based on signature algorithm dynamic integration, and the method comprises the steps: constructing various types of signature algorithms into members in a signature algorithm dynamic link library, and deploying a dynamic configuration contract in a block chain node, thereby achieving the dynamic update support of the signature algorithms during the account management operation period; meanwhile, the public key-private key pair information contains account import information, the account import information is non-plaintext import information matched with different signature algorithm types, and login and verification of the block chain account are carried out based on the account import information, so that different types of signature algorithms can be compatible to realize a uniform format, and the verification efficiency of the block chain account is improved. Meanwhile, the account import information is set to be in a non-plaintext form, so that the security of user account login can be improved; dynamic updating of the signature algorithm and secure management of the block chain account during operation are supported, and the method has flexibility, security and good expandability.

Description

Technical Field

[0001] The present disclosure relates to the technical field of blockchain and account management, and in particular to an account management method, device and architecture based on dynamic integration of signature algorithms. Background Art

[0002] With the rapid development of blockchain technology, signature algorithms have become the core technology for ensuring data security and identity authentication. Generally speaking, a digital signature is a message digest algorithm with a key, which includes a public key and a private key, and is used to verify data integrity and authenticate data sources. Traditional blockchain systems usually rely on fixed signature algorithms, such as some conventional signature algorithms: SM2 signature algorithm, Ed25519 signature algorithm, RSA signature algorithm, DSA signature algorithm, etc. However, with the continuous advancement of quantum computing technology, traditional cryptography faces the risk of being cracked, so some quantum-resistant signature algorithms (such as the Dilithium2 quantum-resistant signature algorithm) have gradually emerged and are expected to be applied to ensure data security or identity authentication.

[0003] In the process of realizing the concept of the present disclosure, it was found that the relevant technology has the following technical problems: the current blockchain architecture only supports fixed algorithms. If you want to upgrade or be compatible with different types of signature algorithms, you need to make complex changes to the overall system architecture or operation logic, and at the same time, you need to shut down the blockchain network for maintenance. It is impossible to meet the demand for real-time update of the signature algorithm during the operation of the blockchain node. Moreover, there is currently no blockchain system that can be compatible with multiple different types of algorithms (for example, compatible with conventional signature algorithms and quantum-resistant signature algorithms at the same time). As a result, the upgrade and iteration of user account management of blockchain nodes is relatively complex and the transformation efficiency is low. With the development of quantum computing, user account management also faces the need for integrated upgrades that require compatibility with quantum-resistant signature algorithms. Summary of the invention

[0004] In order to solve the above technical problems or at least partially solve the above technical problems, the embodiments of the present disclosure provide an account management method, device and architecture based on dynamic integration of signature algorithms.

[0005] In the first aspect, the embodiment of the present disclosure provides an account management method based on dynamic integration of signature algorithms. The above method is applied to a blockchain node in a blockchain network or an electronic device that can communicate with a blockchain node, including: receiving a user account creation request; according to the above creation request, querying the signature algorithm information supported by the blockchain network based on the dynamic configuration contract deployed by the corresponding node, and generating a signature algorithm list on the front-end interface according to the above signature algorithm information; the above dynamic configuration contract is used for dynamic update and query of the signature algorithm supported by the above blockchain network; determining the target signature algorithm selected by the user in the above signature algorithm list, calling the above target signature algorithm from the signature algorithm dynamic link library to generate the public key-private key pair information corresponding to the new account; the above public key-private key pair information includes: account public key, account private key and account import information; the above signature algorithm dynamic link library covers multiple types of signature algorithms; the above account import information is non-plaintext import information matching different signature algorithm types; receiving a request for blockchain account login based on the above account import information on the login interface, decoding and verifying the above account import information, and presenting the main interface of the above new account in the login state after the verification is passed.

[0006] In some embodiments, the account import information is non-plaintext import information in a preset format obtained by performing corresponding encoding processing on the account public key and the account private key or the account private key according to different signature algorithm types. When the signature algorithm type of the target signature algorithm is a conventional signature algorithm type, the account import information is non-plaintext import information in a preset format obtained by encoding the account private key; when the signature algorithm type of the target signature algorithm is a quantum-resistant signature algorithm type, the account import information is non-plaintext import information in a preset format obtained by encoding the account public key and the account private key.

[0007] In some embodiments, for conventional signature algorithm types, the account import information is in the following preset format:

[0008]

[0009] , in, Indicates account import information for common signature algorithm types; represents a first encoding operation; Indicates the leading bit mark, which is used to identify that this is the key format for account import and is used to generate a fixed prefix; 0x00.. indicates the padding byte, which is used to adjust the parameter length so that the encoding result obtains a prefix of fixed length; Represents the account private key; Indicates the index information of the target signature algorithm; Indicates that Before the function Bytes as check digits, where is a positive integer; They correspond to the first hash operation and the second hash operation respectively.

[0010] In some embodiments, for the quantum-resistant signature algorithm type, the account import information is in the following preset format:

[0011]

[0012] , in, Indicates account import information for quantum-resistant signature algorithm types; represents a second encoding operation; Indicates the leading bit mark, which is used to identify that this is the key format for account import and is used to generate a fixed prefix; 0x00.. indicates the padding byte, which is used to adjust the parameter length so that the encoding result obtains a prefix of fixed length; Represents the account private key; Represents the account public key; Indicates the index information of the target signature algorithm; Indicates that Before the function Bytes as check digits, where is a positive integer; They correspond to the third hash operation and the fourth hash operation respectively.

[0013] In some embodiments, decoding and verifying the account import information includes: Decoding the account import information to obtain decoded information; the decoded information includes: a leading bit mark, index information of the target signature algorithm, and a check bit; Based on the dynamic configuration contract deployed on the corresponding node, query is performed to obtain the configuration parameters of the target signature algorithm corresponding to the above index information; the above configuration parameters include: a preset leading bit mark corresponding to the signature algorithm prefix, whether the public key can be derived based on the private key, a preset private key length, and a preset public key length; Verify whether the leading bit mark in the above decoded information is consistent with the above preset leading bit mark; When the leading bit mark is consistent with the preset leading bit mark, it is determined whether the public key in the configuration parameters can be derived based on the private key to perform the split operation and the check bit verification operation in one of the following ways: In the case where the public key can be derived based on the private key, the decoding private key is obtained by splitting the decoded information according to the preset private key length starting from the leading bit mark in the decoded information; performing a first preset hash operation according to the leading bit mark, the decoding private key and the index information of the target signature algorithm and intercepting the first preset byte as the first data to be verified; verifying whether the first data to be verified is consistent with the check bit in the decoded information; or, In the case where the public key cannot be derived based on the private key, starting from the leading bit mark in the decoded information, the decoded private key and the decoded public key are sequentially split according to the preset private key length and the preset public key length to obtain a decoded private key and a decoded public key; a second preset hash operation is performed according to the leading bit mark, the decoded private key, the decoded public key and the index information of the target signature algorithm, and a second preset byte is intercepted as the second data to be verified; and it is verified whether the second data to be verified is consistent with the check bit in the decoded information; Among them, when the verification results corresponding to the check bit verification operation are consistent, the verification is deemed to be passed, and a new account object is constructed based on the decoded information that passed the verification; the above-mentioned new account object contains key pair information consisting of an object public key and an object private key; the above-mentioned object private key is used to sign messages or data transmitted by the node; the above-mentioned object public key is used to verify the validity of the signature in the message or data transmitted by the node.

[0014] In some embodiments, the public key-private key pair information further includes: an account blockchain address. The account blockchain address is generated by encoding the index information of the target signature algorithm and the account public key to generate the account blockchain address. The node of the blockchain network includes a signature interface and a verification interface that can call the signature algorithm in the signature algorithm dynamic link library. The signature interface is used to call the corresponding signature algorithm for signing, and the verification interface is used to call the corresponding signature algorithm for signature verification.

[0015] In some embodiments, the dynamic update includes: adding a new signature algorithm, deleting a signature algorithm, or changing the configuration content of the signature algorithm. The method also includes: dynamically updating the signature algorithm by the first node in the blockchain network. The first node is the same as or different from the execution subject created by the user account. Among them, the dynamic update of the signature algorithm by the first node in the blockchain network includes: the first node receives a signature algorithm update transaction request; the update transaction request carries the following information: configuration information of the content to be updated and a digital signature for the content to be updated; based on the dynamic configuration contract deployed by the first node, the legality of the content to be updated is verified, and the digital signature is verified; after the content to be updated and the digital signature are verified, the first node initiates a signature algorithm update vote to other nodes in the blockchain network; if the vote is passed, the first node updates the signature algorithm according to the content to be updated, and obtains the dynamically updated signature algorithm information; the first node synchronizes the updated signature algorithm information to other nodes in the blockchain network; and the transaction record is written to the blockchain account book by the first node or other nodes.

[0016] In some embodiments, the digital signature is obtained by signing based on the object private key in the node account object of the first node; the configuration information of the content to be updated includes: index information of the signature algorithm to be updated, configuration parameters to be updated and update operation instructions; the configuration parameters to be updated include: the preset leading bit mark corresponding to the prefix when the account import information is encoded, whether the public key can be derived based on the private key, the preset private key length, the preset public key length and the byte length corresponding to the check bit. Wherein, the legality of the content to be updated is verified, including: verifying whether the preset private key length, the preset public key length, and the byte length corresponding to the check bit in the configuration parameters to be updated match the corresponding signature algorithm to be updated; verifying whether the preset leading bit mark corresponding to the prefix when the account import information is encoded meets the preset specification; wherein, the digital signature is verified, including: verifying the digital signature based on the object public key in the node account object of the first node.

[0017] In the second aspect, the embodiment of the present disclosure provides an account management device based on dynamic integration of signature algorithms. The above-mentioned device is a blockchain node in a blockchain network, or the above-mentioned device is an electronic device capable of communicating with a blockchain node. The above-mentioned device includes: an account creation request receiving module, a signature algorithm list generating module, an account information generating module and a login module. The above-mentioned account creation request receiving module is used to receive a user account creation request. The above-mentioned signature algorithm list generating module is used to query the signature algorithm information supported by the above-mentioned blockchain network based on the dynamic configuration contract deployed by the corresponding node according to the above-mentioned creation request, and generate a signature algorithm list on the front-end interface according to the above-mentioned signature algorithm information; the above-mentioned dynamic configuration contract is used for dynamic update and query of the signature algorithm supported by the above-mentioned blockchain network. The above-mentioned account information generating module is used to determine the target signature algorithm selected by the user in the above-mentioned signature algorithm list, and call the above-mentioned target signature algorithm from the signature algorithm dynamic link library to generate the public key-private key pair information corresponding to the newly created account; the above-mentioned public key-private key pair information includes: account public key, account private key and account import information. The above-mentioned signature algorithm dynamic link library covers multiple types of signature algorithms. The above-mentioned account import information is non-plaintext import information matching different signature algorithm types. The login module is used to receive a request for blockchain account login based on the account import information on the login interface, decode and verify the account import information, and present the main interface of the newly created account in the login state after the verification is passed.

[0018] In some embodiments, when the above-mentioned device is a blockchain node, the above-mentioned device further includes: a signature algorithm update voting module and an update information synchronization receiving module. The above-mentioned signature algorithm update voting module is used to receive the signature algorithm update voting initiated by the first node and vote for the signature algorithm update. The above-mentioned update information synchronization receiving module is used to receive the updated signature algorithm information synchronized by the first node and perform configuration synchronization locally; the above-mentioned first node and the above-mentioned device are different blockchain nodes. Or, when the above-mentioned device is a blockchain node, in other embodiments, the above-mentioned device further includes: a signature algorithm update transaction receiving module, a verification module, a signature algorithm update voting initiation module, a signature algorithm update configuration module and an update information synchronization sending module. The above-mentioned signature algorithm update transaction receiving module is used to receive the signature algorithm update transaction request initiated by the current node; the above-mentioned update transaction request carries the following information: configuration information of the content to be updated and the digital signature for the above-mentioned content to be updated. The above-mentioned verification module is used to verify the legality of the above-mentioned content to be updated and the above-mentioned digital signature based on the dynamic configuration contract deployed by the above-mentioned current node. The signature algorithm update voting initiation module is used to initiate the signature algorithm update voting to other nodes in the blockchain network after the content to be updated and the digital signature are verified. The signature algorithm update configuration module is used to update the signature algorithm according to the content to be updated to obtain the dynamically updated signature algorithm information when the vote is passed. The update information synchronization sending module is used to synchronize the updated signature algorithm information to other nodes in the blockchain network.

[0019] In the third aspect, the embodiments of the present disclosure provide an account management architecture based on a blockchain network. The above architecture includes: multiple blockchain nodes deployed with dynamic configuration contracts, a signature algorithm dynamic link library and an account management model. The above dynamic configuration contract is used for dynamic update and query of the signature algorithm supported by the above blockchain network. The above signature algorithm dynamic link library contains signature algorithms of conventional signature algorithm types and anti-quantum signature algorithm types; the above signature algorithm dynamic link library has a preset specification interface, which allows the required signature algorithm to be selected and called from the signature algorithm list supported by the above signature algorithm dynamic link library according to the signature operation requirements or verification operation requirements when the node is running. The above account management model is located in the node of the above blockchain network or in an electronic device that can communicate with the above node, and is used to support the creation of a new account, login verification of a new account, and data signature and data verification after login of a new account.

[0020] The account management model includes the following processing logic during the creation of a new account and the verification of the login of a new account: According to the user account creation request, query the signature algorithm information supported by the blockchain network based on the dynamic configuration contract deployed by the corresponding node, and generate a signature algorithm list on the front-end interface based on the above signature algorithm information; Determine the target signature algorithm selected by the user in the signature algorithm list, and call the target signature algorithm from the signature algorithm dynamic link library to generate the public key-private key pair information corresponding to the newly created account; the public key-private key pair information includes: account public key, account private key and account import information; the signature algorithm dynamic link library covers multiple types of signature algorithms; the account import information is non-plaintext import information matching different signature algorithm types; A request for blockchain account login based on the account import information is received on the login interface, the account import information is decoded and verified, and after the verification is passed, a main interface showing the newly created account in a logged-in state is presented.

[0021] In a fourth aspect, an embodiment of the present disclosure provides an electronic device. The electronic device includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; the memory is used to store computer programs; and the processor is used to implement the above-mentioned account management method based on dynamic integration of signature algorithms when executing the programs stored in the memory.

[0022] In a fifth aspect, an embodiment of the present disclosure provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the account management method based on dynamic integration of signature algorithms is implemented.

[0023] The above technical solution provided by the embodiments of the present disclosure has at least some or all of the following advantages: By building various types of signature algorithms as members of the signature algorithm dynamic link library and deploying dynamic configuration contracts in the blockchain nodes, since the above dynamic configuration contracts are used for the dynamic update and query of the signature algorithms supported by the above blockchain network, if the signature algorithm is updated during the user account management process, the latest signature algorithm information after the update is queried based on the dynamic configuration contract, so that the signature algorithm list generated on the front-end interface is also the latest result, realizing the dynamic update support of the signature algorithm during account management; after the user obtains the target signature algorithm by interacting with the visual front-end interface, the execution subject (for example, a node or The target signature algorithm or an electronic device that can communicate with the above-mentioned node) can generate the public key-private key pair information corresponding to the newly created account by calling the target signature algorithm from the signature algorithm dynamic link library to realize account generation; at the same time, since the public key-private key pair information contains account import information, the above account import information is non-plaintext import information that matches different signature algorithm types, and the blockchain account is logged in and verified based on the above account import information, which can be compatible with different types of signature algorithms to achieve a unified format, and at the same time, by setting the account import information in non-plaintext form, it can also improve the security of user account login; it supports dynamic updating of signature algorithms and secure management of blockchain accounts during operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0025] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0026] Figure 1 The system architecture diagram of the account management architecture based on the blockchain network according to an embodiment of the present disclosure is schematically shown; Figure 2 The flowchart of the account management method based on dynamic integration of signature algorithm according to an embodiment of the present disclosure is schematically shown; Figure 3A The following schematically shows a schematic diagram of an implementation scenario in which a blockchain node according to an embodiment of the present disclosure is used as a client device; Figure 3B The following schematically shows a schematic diagram of an implementation scenario in which a blockchain node according to an embodiment of the present disclosure is used as a server device; Figure 4AThe following schematically shows an initial state diagram of a front-end interface for account creation according to an embodiment of the present disclosure; Figure 4B A schematic diagram schematically shows a state in which a target signature algorithm is selected in a front-end interface for account creation according to an embodiment of the present disclosure; Figure 4C A schematic diagram schematically shows a state diagram of a front-end interface for account creation generating public key-private key pair information corresponding to a newly created account according to an embodiment of the present disclosure; Figure 5A The following schematically shows an initial state diagram of a login interface corresponding to account login according to an embodiment of the present disclosure; Figure 5B A schematic diagram of a state after filling in account import information on a login interface corresponding to an account login according to an embodiment of the present disclosure is schematically shown; Figure 6 A schematic diagram schematically shows a main interface of a newly created account in a logged-in state presented after decoding and verification of account import information according to an embodiment of the present disclosure; Figure 7 A detailed implementation flowchart of step S240 according to an embodiment of the present disclosure is schematically shown; and Figure 8 The structural block diagram of the electronic device provided by the embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present disclosure.

[0028] During the research and development, it was found that the current blockchain architecture only supports fixed algorithms. If you want to upgrade or be compatible with different types of signature algorithms, you need to make complex changes to the overall system architecture or operation logic, and the blockchain network needs to be shut down for maintenance, which cannot meet the demand for real-time updates of signature algorithms during the operation of blockchain nodes. In addition, there is currently no blockchain system that can be compatible with multiple different types of algorithms (for example, compatible with conventional signature algorithms and quantum-resistant signature algorithms at the same time), so the upgrade and iteration of user account management of blockchain nodes is relatively complex and the transformation efficiency is low. With the development of quantum computing, user account management is also facing the need for integrated upgrades that require compatibility with quantum-resistant signature algorithms.

[0029] In view of this, the embodiments of the present disclosure provide an account management method, device and architecture based on dynamic integration of signature algorithms. In the account management architecture based on the blockchain network, based on modular settings, by deploying dynamic configuration contracts and setting signature algorithm dynamic link libraries in blockchain nodes, multiple signature algorithms are supported, including classic signature algorithms (such as SM2 signature algorithms, Ed25519 signature algorithms) and quantum-resistant signature algorithms (such as Dilithium2 quantum-resistant signature algorithms), to achieve compatibility with multiple types of signature algorithms such as conventional signature algorithm types and quantum-resistant signature algorithm types, and support dynamic updates such as dynamic loading and unloading of signature algorithms, so that blockchain nodes can replace or upgrade signature algorithms during operation, ensuring the flexible response capabilities and security of blockchain nodes in the face of new security threats; at the same time, the account management model can support account creation, account login verification, data signature, signature verification, etc., and support the generation of public key-private key pair information (which can be simply described as key pair information) and key pair import / export functions in the process of creating an account, and enhance readability and compatibility by generating account import information in a unified format. The above architecture supports the integration and expansion of multiple types of blockchain signature algorithms, and has the advantages of flexibility, security and scalability.

[0030] The following is a detailed description with reference to specific embodiments.

[0031] A first exemplary embodiment of the present disclosure provides an account management architecture based on a blockchain network.

[0032] Figure 1 The system architecture diagram of an account management architecture based on a blockchain network according to an embodiment of the present disclosure is schematically shown.

[0033] Reference Figure 1 As shown, the account management architecture 100 based on the blockchain network provided by the embodiment of the present disclosure includes: multiple blockchain nodes 110 (hereinafter simply described as nodes) deployed with dynamic configuration contracts, a signature algorithm dynamic link library 130 and an account management model 120. The above-mentioned dynamic configuration contract is used for dynamic update and query of the signature algorithm supported by the above-mentioned blockchain network. The above-mentioned signature algorithm dynamic link library 130 includes multiple types of signature algorithms, for example, signature algorithms including conventional signature algorithm types and anti-quantum signature algorithm types. The above-mentioned signature algorithm dynamic link library 130 has a preset standard interface, which allows the required signature algorithm to be selected and called from the signature algorithm list supported by the above-mentioned signature algorithm dynamic link library according to the signature operation requirements or verification operation requirements when the node is running.

[0034] The nodes of the above-mentioned blockchain network include a signature interface (sign() interface) and a verification interface (for example, represented as a verify() interface) that can call the signature algorithm in the above-mentioned signature algorithm dynamic link library. The above-mentioned signature interface is used to call the corresponding signature algorithm for signing, and the above-mentioned verification interface is used to call the corresponding signature algorithm for signature verification.

[0035] For example, Figure 1 Node 1, node 2, node 3, node 4, ..., node N are exemplified, N is a positive integer and N ≥ 4, and multiple signature algorithms are exemplified in the signature algorithm dynamic link library 130, including SM2 signature algorithm and Ed25519 signature algorithm corresponding to conventional signature algorithm types, and also including Dilithium2, Dilithium3, Dilithium5 signature algorithm of anti-quantum signature algorithm type. Generally speaking, there is no limit on the number of nodes included in the blockchain network, which can be 2, 3, 4 or even more.

[0036] In some embodiments, the account management model 120 is located in the blockchain node 110. In other embodiments, in combination with Figure 1 As shown in the communication link indicated by the dashed box and lightning, the account management model 120 is located in the electronic device 101 that can communicate with the blockchain node 110. The account management model 120 is used to support the creation of a new account, login verification of a new account, and data signing and data verification after the new account logs in.

[0037] In some embodiments, the above node may be a client device or a server device in a C (client)-S (server) architecture. Figure 1 As shown by the solid arrow in the middle, when the above node is used as a client device, the account management model 120 can be located in the above node. When the above node is used as a server device, it is used to provide account management services for electronic devices. The account management model 120 can be located in the server device corresponding to the above node; or refer to Figure 1 As shown by the dotted arrow in the middle, when the above-mentioned node acts as a server device, the above-mentioned account management model 120 can also be located in an electronic device 101 (acting as a client device) that can communicate with the server device, and through interaction with the server device (blockchain node) to call the dynamic configuration contract deployed by the server device, the query and call of the signature algorithm, etc. are realized.

[0038] In some embodiments, the account management model includes the following processing logic during the creation of a new account and the verification of the login of a new account: According to the user account creation request, query the signature algorithm information supported by the blockchain network based on the dynamic configuration contract deployed by the corresponding node, and generate a signature algorithm list on the front-end interface based on the above signature algorithm information; Determine the target signature algorithm selected by the user in the above signature algorithm list, and call the above target signature algorithm from the signature algorithm dynamic link library to generate the public key-private key pair information (which can also be described as key pair information) corresponding to the newly created account; the above public key-private key pair information includes: account public key, account private key and account import information; the above signature algorithm dynamic link library covers multiple types of signature algorithms; the above account import information is non-plaintext import information matching different signature algorithm types; A request for blockchain account login based on the account import information is received on the login interface, the account import information is decoded and verified, and after the verification is passed, a main interface showing the newly created account in a logged-in state is presented.

[0039] In some embodiments, the account import information is non-plaintext import information in a preset format obtained by performing corresponding encoding processing on the account public key and the account private key or on the account private key to match different signature algorithm types.

[0040] When the signature algorithm type of the target signature algorithm is a conventional signature algorithm type, the account import information is non-plaintext import information in a preset format obtained by encoding the account private key.

[0041] When the signature algorithm type of the target signature algorithm is a quantum-resistant signature algorithm type, the account import information is non-plaintext import information in a preset format obtained by encoding the account public key and the account private key.

[0042] In the above account management architecture 100, the blockchain node is supported to dynamically update the signature algorithm during operation. The specific update logic is detailed in the subsequent description of the account management method, which is not elaborated here.

[0043] Reference Figure 1As shown, the account management architecture 100 based on the blockchain network is divided into three core parts: the signature algorithm dynamic link library, the account management model, and the node deployment dynamic configuration contract. The modular setting is realized, so that the functions of each part of the blockchain system are clear and the coupling degree is low, and it can flexibly support the dynamic loading, unloading and replacement of multiple signature algorithms. For example, through the signature algorithm dynamic library, the node can select and call various types of signature algorithms (such as SM2, Ed25519, Dilithium2) according to the needs at runtime. At the same time, it can be compatible with classical and anti-quantum algorithms: it supports classical signature algorithms (such as SM2, Ed25519), and also supports anti-quantum signature algorithms (such as Dilithium2), which can take into account current and future security needs, and can still maintain a high level of security in the face of quantum computing threats. At the same time, through the standardized SDK interface, it can uniformly handle the signature, verification, key generation and import / export operations of different algorithms, which enhances the compatibility and operability of the blockchain system.

[0044] By deploying a dynamic configuration contract and setting a signature algorithm dynamic link library 130 in the blockchain node 110, multiple signature algorithms are supported, including classic signature algorithms (such as SM2 signature algorithm, Ed25519 signature algorithm) and quantum-resistant signature algorithms (such as Dilithium2, Dilithium3, Dilithium5 quantum-resistant signature algorithms, etc.), achieving compatibility with multiple types of signature algorithms such as conventional signature algorithm types and quantum-resistant signature algorithm types, and supporting dynamic updates such as dynamic loading and unloading of signature algorithms, so that blockchain nodes can replace or upgrade signature algorithms during operation, ensuring the flexible response capabilities and security of blockchain nodes in the face of new security threats; at the same time, the account management model can support account creation, account login verification, data signature, signature verification, etc., and support the generation of public key-private key pair information (which can be simply described as key pair information) and key pair import / export functions during account creation, and enhance readability and compatibility by generating account import information in a unified format. The above architecture supports the integration and expansion of multiple types of blockchain signature algorithms, and has the advantages of flexibility, security and scalability.

[0045] A second exemplary embodiment of the present disclosure provides an account management method based on dynamic integration of signature algorithms.

[0046] The method of this embodiment is applied to an execution subject with a login function and a display screen. The execution subject is, for example, a blockchain node in a blockchain network (corresponding to a scenario of a client device) or an electronic device that can communicate with a blockchain node (the blockchain node is a server of the electronic device, which is used to provide service support for account login and blockchain transactions). For example, it can be applied to Figure 1The blockchain node 110 in the exemplary account management architecture 100 may be applied to an electronic device 101 capable of communicating with a blockchain node.

[0047] Figure 2 The flowchart of the account management method based on dynamic integration of signature algorithm according to an embodiment of the present disclosure is schematically shown. Figure 3A The following schematically shows a schematic diagram of an implementation scenario in which a blockchain node according to an embodiment of the present disclosure is used as a client device; Figure 3B A schematic diagram of an implementation scenario in which a blockchain node is used as a server device according to an embodiment of the present disclosure is schematically shown.

[0048] Reference Figure 2 As shown, the account management method based on dynamic integration of signature algorithm provided by the embodiment of the present disclosure includes the following steps: S210, 220, S230 and S240.

[0049] In step S210, a request to create a user account is received.

[0050] In an implementation scenario CJ1, refer to Figure 3A As shown, the execution subject of the above account management method is a blockchain node, which is a client device. Taking node 4 as an example, node 4 has a visual front-end interface, and the account management model 120 is located in node 4. At the same time, node 4 is deployed with a dynamic configuration contract. The above node 4 can dynamically update and query the signature algorithm in the signature algorithm dynamic link library 130 based on the dynamic configuration contract. In this embodiment, the user can initiate a user account creation request in the front-end interface of node 4. For example, the user initiates this creation request by clicking the function key to create an account, and node 4 is deemed to have received the above creation request.

[0051] In another implementation scenario CJ2, referring to Figure 3B As shown, the execution subject of the above account management method is an electronic device that can communicate with the blockchain node. The electronic device serves as a client device, and the electronic device has a visual front-end interface. The account management model 120 is located in the electronic device; the blockchain node serves as a server device, and node 4 is used as an example of a blockchain node. Node 4 is deployed with a dynamic configuration contract. The above node 4 can dynamically update and query the signature algorithm in the signature algorithm dynamic link library 130 based on the dynamic configuration contract. When the above electronic device executes the account management method, it calls the dynamic configuration contract deployed by node 4 by interacting with node 4 to query and call the signature algorithm. In this embodiment, the user can initiate a request to create a user account in the front-end interface of the electronic device. Specifically, the creation request can be initiated by clicking the function key to create an account, and the above creation request is deemed to be received on the electronic device.

[0052] In step S220, according to the above creation request, the signature algorithm information supported by the blockchain network is queried based on the dynamic configuration contract deployed on the corresponding node, and a signature algorithm list is generated on the front-end interface according to the above signature algorithm information; the above dynamic configuration contract is used for dynamic update and query of the signature algorithm supported by the above blockchain network.

[0053] The dynamic configuration contract is used to record and manage the configuration parameters of the signature algorithms supported in the blockchain network, including algorithm type index, algorithm name, key length (private key length and public key length, etc.) and other information.

[0054] Dynamically configured contracts support the following functions: Initiate an update task: A node account can propose to add or update the configuration of the signature algorithm by submitting an update task transaction.

[0055] Task voting decision: Other node administrators vote on the update task.

[0056] Query interface: supports querying the configuration related to the signature algorithm, which is convenient for nodes in the blockchain network or other external devices (such as electronic devices in the example) to access.

[0057] Reference Figure 3A As shown, in the implementation scenario CJ1, node 4 queries the signature algorithm information supported by the blockchain network according to the dynamic configuration contract deployed by itself, and generates a signature algorithm list on the front-end interface according to the above signature algorithm information.

[0058] Reference Figure 3B As shown, in implementation scenario CJ2, the electronic device (client) queries node 4 for signature algorithm information supported by the blockchain network, that is, based on the dynamic configuration contract deployed by node 4 (corresponding to the server), the electronic device queries the signature algorithm information supported by the blockchain network. The electronic device generates a signature algorithm list on the front-end interface based on the queried signature algorithm information.

[0059] By constructing various types of signature algorithms as members of the signature algorithm dynamic link library, and deploying dynamic configuration contracts in blockchain nodes, since the above dynamic configuration contracts are used for the dynamic update and query of the signature algorithms supported by the above blockchain network, if the signature algorithm is updated during the user account management process, the latest signature algorithm information after the update is queried based on the dynamic configuration contract, so that the signature algorithm list generated on the front-end interface is also the latest result, realizing the dynamic update support of the signature algorithm during account management; thereby realizing the dynamic update of the signature algorithm during the node operation and the security management of the blockchain account. At the same time, since the above signature algorithm dynamic link library supports multiple signature algorithms, including classic signature algorithms (such as SM2 signature algorithm, Ed25519 signature algorithm) and quantum-resistant signature algorithms (such as Dilithium2, Dilithium3, Dilithium5 quantum-resistant signature algorithms, etc.), it realizes compatibility with multiple types of signature algorithms such as conventional signature algorithm types and quantum-resistant signature algorithm types, and supports dynamic updates such as dynamic loading and unloading of multiple types of signature algorithms, so that blockchain nodes can replace or upgrade signature algorithms during operation, ensuring the flexible response capabilities and security of blockchain nodes in the face of new security threats.

[0060] Figure 4A The schematic diagram schematically shows the initial state of the front-end interface for account creation according to an embodiment of the present disclosure.

[0061] In some embodiments, reference Figure 4A As shown, an initial state 400a of the front-end interface during account creation is shown. The front-end interface in the initial state 400a includes a signature algorithm list 410. Figure 4A The example in the article shows the SM2 signature algorithm, Ed25519 signature algorithm and Dilithium2 and Dilithium3 in the classic signature algorithm, and illustrates the selection function box for each signature algorithm. This function box can be replaced with other forms according to the front-end display differences, such as but not limited to: single-click selection, double-click selection, or other selection triggering methods. The above front-end interface also includes: preset fields for public key-private key pairs, including: account public key field, account private key field, account import information field and account blockchain address field. Since the specific value information of these fields has not yet been generated, the information boxes of these fields are displayed as blank. Figure 4AThe account public key information box 421, the account private key information box 422, the account import information box 423, and the account blockchain address information box 424 are illustrated. The front-end interface in the initial state 400a also includes an account generation function key 430, which is used to trigger when the user selects the target signature algorithm from the signature algorithm list 410. The triggering method can be clicking or long pressing a preset time; if no signature algorithm is detected to be selected in the signature algorithm list 410, the account function generation key 430 will not trigger the execution of the account generation logic (corresponding to the subsequent step S230).

[0062] In step S230, determine the target signature algorithm selected by the user in the above-mentioned signature algorithm list, and call the above-mentioned target signature algorithm from the signature algorithm dynamic link library to generate the public key-private key pair information corresponding to the newly created account; the above-mentioned public key-private key pair information includes: account public key, account private key and account import information; the above-mentioned signature algorithm dynamic link library covers multiple types of signature algorithms; the above-mentioned account import information is non-plaintext import information that matches different signature algorithm types.

[0063] Reference Figure 3A and Figure 1 As shown, in the implementation scenario CJ1 , the node 4 may execute step S230 based on the account management model 120 .

[0064] Reference Figure 3B and Figure 1 As shown, in implementation scenario CJ2, the electronic device may execute step S230 based on the account management model 120.

[0065] Figure 4B The following schematically shows a state diagram of a target signature algorithm being selected in a front-end interface for account creation according to an embodiment of the present disclosure.

[0066] Combination Figure 4A and Figure 4B As shown, the user selects the quantum-resistant signature algorithm Dilithium2 from the signature algorithm list 410 presented in the front-end interface in the initial state 400a. Figure 4B In the front-end interface in the selected state 400b, the selection function box corresponding to the quantum-resistant signature algorithm Dilithium2 is checked, and then the user triggers the execution of the account generation logic by clicking the account function generation key 430. Figure 3A Example node 4 or Figure 3BIn the electronic device corresponding to the example node 4), according to the check state of the selection function box, it can be determined that the target signature algorithm selected by the user in the above signature algorithm list is Dilithium2, and the above target signature algorithm Dilithium2 is called from the signature algorithm dynamic link library 130 to generate the public key-private key pair information corresponding to the newly created account.

[0067] In some embodiments, the public key-private key pair information can also be described as key pair information, which can be generated based on the key pair generation interface createKeyPair( INDEX ) to implement the following steps in the above step S230: calling the above target signature algorithm from the signature algorithm dynamic link library to generate the public key-private key pair information corresponding to the new account. Among them, INDEX Indicates the index information of the target signature algorithm (for example, Dilithium2, Ed25519, SM2, etc.).

[0068] In some embodiments, based on the above key pair generation interface createKeyPair( INDEX ) returns the public key-private key pair information, which includes: account public key, account private key, account import information, account blockchain address and index information of the target signature algorithm.

[0069] In some embodiments, the returned public key-private key pair information may be in hexadecimal format, and the public key-private key pair information corresponding to the target signature algorithm Ed25519 is as follows: { "pk": "9c0c2febf8b6af610109912c0088490aea9d74707744716f2887aa0f988ad625", "sk": "7d6e8220ae2b6fe465d5b8aba2bb3eae663c4d635bbfc2417ec1ecb7f70652fa", "address": "adxSaZ1c4JT13MVU3TpN64tbhLnC1mu64CftF", "importKey":"privbwU47y7cN2BdoSTx2UrVY9pzAFuzoc3PdkdZiP4rGyaFUYHTPHtV", "sign_type": "ed25519" } Among them, pk (short for public key) represents the public key of the newly created account, which is used to verify the signature and generate the account address; sk (short for secret key) represents the private key of the newly created account, which is used for signing and identity authentication; address represents the blockchain address of the account; importKey represents the account import information; sign_type represents the index information of the target signature algorithm (such as the signature algorithm type or signature algorithm name, etc.), and createKeyPair( INDEX ) INDEX The values ​​are the same.

[0070] The above account blockchain address address is generated in the following way: encoding and processing are performed according to the index information of the above target signature algorithm and the account public key to generate the account blockchain address.

[0071] For example, the address field is an account address generated by encoding the public key according to a specific encoding method, with a fixed prefix of "adx" as the unique identifier of the account on the blockchain. The specific encoding method is as follows: , (1) in, Indicates the account blockchain address; represents the target encoding operation; A leading bit flag indicating a fixed prefix used to generate a blockchain address (e.g., the prefix "adx" of the address in the public key-private key pair information in the example of the target signature algorithm Ed25519 above); Indicates the index information of the target signature algorithm; Indicates that the target hash operation is performed on the account public key and the front is taken D bytes, of which D is a positive integer; Indicates that , and Perform splicing (i.e., “+” indicates a splicing operation, and subsequent expressions are similar and will not be repeated).

[0072] In the embodiment of the present disclosure, by setting the account import information importKey in the public key-private key pair information, the account import information is non-plaintext import information matching different signature algorithm types, and the blockchain account is logged in and verified based on the account import information, which can not only be compatible with different types of signature algorithms to achieve a unified format, but also improve the security of user account login by setting the account import information in non-plaintext form. In the embodiment of the present disclosure, by setting a unified format account blockchain address generation and key pair generation mechanism, a unified format corresponding to the blockchain address and account import information is generated through a specific encoding method (such as Base58 encoding), which enhances the readability and manageability of the data and ensures the compatibility between different types of signature algorithms. At the same time, the solution also supports local support for signature algorithms through the Web interface (front-end interface). Users can generate key pair information, import accounts (account login stage), create transactions (stage after login) and export data (supporting the export of account information and transaction records after login), etc. through the front-end interface, so as to obtain a more friendly and intuitive user interaction experience.

[0073] In some embodiments, the account import information is non-plaintext import information in a preset format obtained by performing corresponding encoding processing on the account public key and the account private key or on the account private key to match different signature algorithm types.

[0074] When the signature algorithm type of the above-mentioned target signature algorithm is a conventional signature algorithm type, such as the SM2 signature algorithm or the Ed25519 signature algorithm, the public key can be derived based on the private key, and the above-mentioned account import information is non-plaintext import information in a preset format obtained after encoding the above-mentioned account private key.

[0075] In some embodiments, for conventional signature algorithm types, the account import information is in the following preset format:

[0076]

[0077] , (2) in, Indicates account import information for common signature algorithm types; represents a first encoding operation; Indicates the leading bit mark, which is used to identify that this is the key format for account import and is used to generate a fixed prefix; 0x00.. indicates the padding byte, which is used to adjust the parameter length so that the encoding result obtains a prefix of fixed length; Represents the account private key; Indicates the index information of the target signature algorithm; Indicates that Before the function Bytes as check digits, where is a positive integer; They correspond to the first hash operation and the second hash operation respectively.

[0078] When the signature algorithm type of the above-mentioned target signature algorithm is an anti-quantum signature algorithm type, for example: Dilithium2 anti-quantum signature algorithm, Dilithium3 anti-quantum signature algorithm or Dilithium5 anti-quantum signature algorithm, etc., and the public key cannot be derived based on the private key, then the above-mentioned account import information is non-plaintext import information in a preset format obtained by encoding the above-mentioned account public key and the above-mentioned account private key.

[0079] In some embodiments, for the quantum-resistant signature algorithm type, the account import information is in the following preset format:

[0080]

[0081] , (3) in, Indicates account import information for quantum-resistant signature algorithm types; represents a second encoding operation; Indicates the leading bit mark, which is used to identify that this is the key format for account import and is used to generate a fixed prefix; 0x00.. indicates the padding byte, which is used to adjust the parameter length so that the encoding result obtains a prefix of fixed length; Represents the account private key; Represents the account public key; Indicates the index information of the target signature algorithm; Indicates that Before the function Bytes as check digits, where is a positive integer; They represent the third hash operation and the fourth hash operation respectively. In formulas (2) and (3), “+” represents a concatenation operation.

[0082] In the above formulas (1) to (3), , The value of and the length of the padding byte are calculated based on the value of the fixed prefix string and the length of the encoded character. Blockchain nodes can query the configuration parameters of the signature algorithm through dynamic configuration contracts.

[0083] In the above embodiment, the above account import information can be in a string format, and the corresponding encoding operation (such as a target encoding operation, a first encoding operation, a second encoding operation, etc.) adopts but is not limited to one of the following encoding algorithms: base58 encoding algorithm or base64 encoding algorithm, which is used to convert binary data into a string.

[0084] Figure 4C The diagram schematically shows a state diagram of a front-end interface for account creation generating public key-private key pair information corresponding to a newly created account according to an embodiment of the present disclosure.

[0085] Reference Figure 4C As shown, the front-end interface in the filled state 400c after the public key-private key pair information is generated is illustrated. For example, the account public key information box 421, the account private key information box 422, the account import information box 423, and the account blockchain address information box 424 are all filled with corresponding content. As an example, the account public key (field, for example, represented by pk) is: 72281ea274... (the ellipsis indicates that only part of the content is illustrated here, and all the content will be displayed in the actual scenario, and the subsequent representation method is similar); the account private key (field, for example, represented by sk) is: a130d0ac1f...; the account import information (field, for example, represented by importKey) is: priv...; the account blockchain address (field, for example, represented by address) is: adx...

[0086] In some embodiments, reference Figure 4C As shown, the account public key, account private key, account import information, account blockchain address and other information presented on the front-end interface support copying and exporting. The user only needs to use the account import information during login (refer to the description of the subsequent step S240). Therefore, in order to enhance security and prevent the front-end interface from being seen by other people and causing the account private key to be leaked, the front-end interface can be presented by default by hiding some information when presenting the content of the account private key, and after the user enters the viewing permission and passes the verification, all information will be presented within a shorter preset time period (for example, within 1 minute, within 30 seconds, etc.) (during which users are supported to copy and export the account private key), and then continue to present it in a way of hiding some information.

[0087] In step S240, a request for blockchain account login based on the account import information is received on the login interface, the account import information is decoded and verified, and after the verification is passed, a main interface with the newly created account in a logged-in state is presented.

[0088] Figure 5A The initial state diagram of the login interface corresponding to account login according to an embodiment of the present disclosure is schematically shown. Figure 5BThe diagram schematically shows a state diagram of a login interface corresponding to an account login after filling in account import information according to an embodiment of the present disclosure.

[0089] Reference Figure 5A As shown, a login interface 500a in the initial state when the account is logged in is presented, and the login interface 500a includes an import account input box 510 for inputting account import information and a login function key 520. An input prompt is presented in the import account input box 510: Please enter the account import information, and the input prompt is hidden when the user enters content in the import account input box 510.

[0090] It is understandable that the style and layout of the above login interface are only examples, and the specific style, layout and whether the text on the login interface needs to be presented can be adjusted according to actual conditions.

[0091] The user enters the account import information corresponding to the newly created account obtained in the aforementioned step S230 in the import account input box 510 of the login interface 500a in the initial state: priv..., refer to Figure 5B As shown in the login interface 500b after the account import information is filled in; the user continues to trigger the login function key 520 (for example, by single-clicking or long pressing for a preset time), which is deemed to be a request for blockchain account login based on the above account import information priv... on the login interface.

[0092] Figure 6 A schematic diagram of a main interface of a newly created account in a logged-in state presented after decoding and verification of account import information according to an embodiment of the present disclosure is schematically shown.

[0093] In some embodiments, the account import information is decoded and verified (the specific process is described later in detail). Figure 7 for detailed description); see Figure 6 As shown, after the account import information is decoded and verified, the login is deemed successful, and the main interface 600 of the newly created account in the login state is presented. As an example, the main interface 600 includes a transaction data display area 610, a login account display area 620, and a transaction record display area 630 of the transaction scene. Figure 6The transaction data display area 610 in the example corresponds to the blockchain financial scenario. The asset balance data 10xx is presented in the transaction data display area 610. The transaction data display area 610 also includes a transaction function key 611. For example, the transaction function key 611 in the example is to create a transaction. In the actual scenario, more transaction function keys can be added or more transaction functions can be provided. The login account display area 620 displays the signature algorithm, account blockchain address and account export function key 621 corresponding to the login account, and supports the export of account information. The account information can specifically be the information of the newly created account object, including the key pair information composed of the object public key and the object private key, and can also include the account export information corresponding to the signature algorithm, the account blockchain address, etc. The transaction record display area 630 includes a transaction record export function key 631, which supports the export function of blockchain transaction records.

[0094] Figure 7 The detailed implementation flow chart of step S240 according to an embodiment of the present disclosure is schematically shown.

[0095] In some embodiments, reference Figure 7 As shown, in the above step S240, decoding and verifying the above account import information includes the following steps: S710, S720, S730, {S741, S751 and S761} or {S742, S752 and S762}. In some embodiments, refer to Figure 7 As shown in the dotted box, the above step S240 further includes step S770.

[0096] In step S710, the account import information is decoded to obtain decoded information; the decoded information includes: a leading bit mark, index information of the target signature algorithm and a check bit.

[0097] The specific content of the decoded information can refer to the form of the concatenated string in the above formula (2): ; or refer to the form of the concatenated string in the example in the above formula (3): .

[0098] In the account login scenario, the account import information may be correct and valid, or it may be invalid information initiated by a network attacker. In order to distinguish it from the original information encoded during the account creation process, the string corresponding to the decoded information is represented as follows: ,or, .

[0099] The specific content is marked by adding superscript TBVThe information is distinguished from the original information in a way, for example: the leading bit mark of To Be Verified , the check digit to be verified or .

[0100] In step S720, a query is performed based on the dynamic configuration contract deployed on the corresponding node to obtain the above index information. The configuration parameters of the corresponding target signature algorithm; the above configuration parameters include: the preset leading bit flag corresponding to the signature algorithm prefix, whether the public key can be derived based on the private key, the preset private key length and the preset public key length.

[0101] The configuration parameters of the account creation and generation phase (corresponding to steps S210 to S230 ) can be obtained through the query.

[0102] In step S730, it is verified whether the leading bit flag in the decoded information is consistent with the preset leading bit flag.

[0103] For example, verify the leading bit mark to be verified in the decoded information With the leading bit preset Are they consistent?

[0104] In the case where the leading bit mark is consistent with the preset leading bit mark, according to whether the public key in the configuration parameters can be derived based on the private key, determine whether to use one of the following methods to perform the split operation and the check bit verification operation: {S741, S751 and S761} or {S742, S752 and S762}. In the case where the leading bit mark is inconsistent with the preset leading bit mark, a prompt message indicating login failure is fed back on the login interface.

[0105] In step S741, when the public key can be derived based on the private key, the decoding private key is obtained by splitting the decoding information after the leading bit mark according to the preset private key length; in step S751, a first preset hash operation is performed according to the leading bit mark, the decoding private key and the index information of the target signature algorithm, and the first preset byte (for example, the leading bit mark) is intercepted. M bytes) as the first data to be verified; wherein the algorithm corresponding to step S751 for obtaining the first data to be verified is the same as the algorithm for obtaining the check bit adopted in the account creation and generation phase; in step S761, verify whether the first data to be verified is consistent with the check bit in the decoded information.

[0106] For example, the decrypted private key is: , get the first data to be verified The algorithm process is as follows:

[0107] , (4) The result obtained according to formula (4) Before M Bytes to get the first data to be verified. Then verify The check digit during the account creation phase If the verification is successful, the account login is successful; if the verification is not successful, a prompt message indicating that the account login failed is fed back on the login interface.

[0108] Step S742, when the public key cannot be derived based on the private key, the decoding information is split in sequence according to the preset private key length and the preset public key length starting from the leading bit mark in the decoding information to obtain a decoding private key and a decoding public key; Step S752, a second preset hash operation is performed according to the leading bit mark, the decoding private key, the decoding public key and the index information of the target signature algorithm, and a second preset byte (for example N bytes) as the second data to be checked; in step S762, verify whether the second data to be checked is consistent with the check bit in the decoded information.

[0109] For example, the decrypted private key is: , the decoded public key is ; Get the second data to be verified The algorithm process is as follows:

[0110] , (5) The result obtained according to formula (5) is Before N Bytes to get the second data to be verified. Then verify Verification digit during account creation If the verification is successful, the account login is successful; if the verification is not successful, a prompt message indicating that the account login failed is fed back on the login interface.

[0111] If the verification results corresponding to the check digit verification operation are consistent, the verification is considered to be successful, and you can jump to the main interface in the successful login state.

[0112] In step S770, a new account object is constructed according to the verified decoded information; the new account object includes key pair information consisting of an object public key and an object private key.

[0113] The newly created account object is an account management data object in the logged-in state in the account management model 120. It is different from the result of the account creation generation stage (account public key, account private key), so it is described by the object public key and object private key. In the logged-in state, various data processing transactions can be performed based on the blockchain account and signature algorithm, such as but not limited to digital financial transactions, bank-to-securities transfer transactions, data storage chain transactions, etc.

[0114] The above object private key is used to sign the message or data transmitted by the node. The above object public key is used to verify the validity of the signature in the message or data transmitted by the node.

[0115] In the embodiments of the present disclosure, in order to support the secure management and operation of keys, an account data structure is defined at the bottom layer of the blockchain. The account data structure is used to support operations such as key pair generation, account import verification, message signing, and message signature verification.

[0116] Take C++ as an example to introduce the data types in the account data structure. The account data structure example is as follows, where the content after " / / " is used for explanation: class Account { Account(int INDEX); / / The first account data structure corresponding to the constructed key pair generation function, the parameter is the index information INDEX corresponding to the target signature algorithm; Account(string importKey); / / Constructs the second account data structure for login verification based on account import information. The parameter is the account import information importKey; string pk; / / Account public key string sk; / / Account private key string importKey; / / Account import information string address; / / Account blockchain address int INDEX; / / Index information corresponding to the target signature algorithm / / The following code represents the query, signature and verification interfaces in sequence string GetAddress() const {return address;} / / API for getting the account blockchain address string Sign(const std::string&message) const; / / Interface for signing messages static bool Verify(string message, string signature, string pk); Interface for verifying the signature in the message }.

[0117] In some embodiments, the account data structure of the above example is based on Figure 1 The account management model 200 shown in the example is created and managed.

[0118] In the embodiment including the above steps S210~S240, by constructing various types of signature algorithms as members in the signature algorithm dynamic link library, and by deploying a dynamic configuration contract in the blockchain node, since the above dynamic configuration contract is used for the dynamic update and query of the signature algorithm supported by the above blockchain network, if the signature algorithm is updated during the user account management process, the latest signature algorithm information after the update is queried based on the dynamic configuration contract, so that the signature algorithm list generated on the front-end interface is also the latest result, realizing the dynamic update support of the signature algorithm during the account management period; after the user obtains the target signature algorithm by interacting with the visual front-end interface, the execution subject (for example, A node in a blockchain network or an electronic device that can communicate with the above node) can generate an account by calling a target signature algorithm from a signature algorithm dynamic link library to generate a public key-private key pair information corresponding to a newly created account; at the same time, since the public key-private key pair information contains account import information, the above account import information is non-plaintext import information that matches different signature algorithm types, and the blockchain account is logged in and verified based on the above account import information, which can be compatible with different types of signature algorithms to achieve a unified format, and at the same time, by setting the account import information to a non-plaintext form, it can also improve the security of user account login; it supports dynamic updating of signature algorithms and secure management of blockchain accounts during operation.

[0119] In the embodiment of the present disclosure, a dynamic configuration contract is deployed on the nodes of the blockchain network to support the dynamic update of the signature algorithm and the compatibility management of multiple types of signature algorithms. The dynamic configuration contract supports the node account to initiate the signature algorithm update task, and verifies and approves the update task through a voting mechanism. After approval, the dynamic configuration contract will update the relevant configuration of the signature algorithm and provide access to the updated configuration information through the query interface.

[0120] In some embodiments, the above dynamic update includes: adding a new signature algorithm, deleting a signature algorithm, or changing the configuration content of the signature algorithm.

[0121] The method further includes: dynamically updating the signature algorithm by a first node in the blockchain network. The first node is the same as or different from the execution subject created by the user account.

[0122] The above-mentioned dynamic update of the signature algorithm by the first node in the blockchain network includes: The first node receives a signature algorithm update transaction request; the update transaction request carries the following information: configuration information of the content to be updated and a digital signature for the content to be updated; for example, the configuration information of the content to be updated is at least one of the following: first configuration information of a signature algorithm to be added, second configuration information of a signature algorithm to be deleted, and third configuration information of an existing signature algorithm to be changed; Based on the dynamic configuration contract deployed by the first node, verify the legality of the content to be updated and verify the digital signature; After the content to be updated and the digital signature are verified, the first node initiates a signature algorithm update vote to other nodes in the blockchain network; in some embodiments, the person with voting authority may be a node administrator or a user with other preset authority; In the case of a vote passing, the first node updates the signature algorithm according to the content to be updated to obtain dynamically updated signature algorithm information; in some embodiments, a vote passing may correspond to the following situations: all nodes in the blockchain network vote in favor, or nodes above a preset ratio or above a preset number vote in favor; The first node synchronizes the updated signature algorithm information to other nodes in the blockchain network; and the first node or other nodes write the transaction record into the blockchain ledger.

[0123] In some embodiments, the digital signature is obtained by signing the object private key in the node account object of the first node; the configuration information of the content to be updated includes: the index information of the signature algorithm to be updated, the configuration parameters to be updated and the update operation instructions; the configuration parameters to be updated include: the preset leading bit mark corresponding to the prefix when the account import information is encoded, whether the public key can be derived based on the private key, the preset private key length, the preset public key length and the byte length corresponding to the check bit. The update operation instructions include: adding, deleting or changing.

[0124] Among them, the legitimacy of the above-mentioned content to be updated is verified, including: verifying whether the preset private key length, preset public key length, and byte length corresponding to the check bit in the above-mentioned configuration parameters to be updated match the corresponding signature algorithm to be updated; verifying whether the preset leading bit mark corresponding to the prefix when encoding the above-mentioned account import information meets the preset specification. If both the above matching verification and the verification of meeting the preset specification are passed, it is deemed that the legitimacy verification has passed. In some embodiments, the integrity of the signature algorithm dynamic link library is also verified.

[0125] The step of verifying the digital signature includes: verifying the digital signature based on the object public key in the node account object of the first node.

[0126] In this embodiment, by deploying a dynamic configuration contract on the blockchain node, the update, replacement and compatibility management of the signature algorithm are supported; the dynamic configuration contract supports the node account to initiate the signature algorithm update task, and the update task is verified and approved through the voting mechanism. The dynamic loading and unloading of the signature algorithm is realized through the dynamic configuration contract and the signature algorithm dynamic link library. The blockchain node can replace or upgrade the signature algorithm at runtime, which improves the flexibility, security and scalability of account management.

[0127] The third exemplary embodiment of the present disclosure provides an account management device based on dynamic integration of a signature algorithm. The above device is a blockchain node in a blockchain network, or the above device is an electronic device capable of communicating with a blockchain node.

[0128] In this embodiment, the above-mentioned device includes: an account creation request receiving module, a signature algorithm list generating module, an account information generating module and a login module.

[0129] The account creation request receiving module is used to receive a user account creation request.

[0130] The above-mentioned signature algorithm list generation module is used to query the signature algorithm information supported by the above-mentioned blockchain network based on the dynamic configuration contract deployed by the corresponding node according to the above-mentioned creation request, and generate a signature algorithm list on the front-end interface according to the above-mentioned signature algorithm information; the above-mentioned dynamic configuration contract is used for dynamic update and query of the signature algorithms supported by the above-mentioned blockchain network.

[0131] The above account information generation module is used to determine the target signature algorithm selected by the user in the above signature algorithm list, and call the above target signature algorithm from the signature algorithm dynamic link library to generate the public key-private key pair information corresponding to the newly created account; the above public key-private key pair information includes: account public key, account private key and account import information. The above signature algorithm dynamic link library covers multiple types of signature algorithms. The above account import information is non-plaintext import information that matches different signature algorithm types.

[0132] The login module is used to receive a request for blockchain account login based on the account import information on the login interface, decode and verify the account import information, and present the main interface of the newly created account in the login state after the verification is passed.

[0133] In some embodiments, when the above-mentioned device is a blockchain node, the above-mentioned device also includes: a signature algorithm update voting module and an update information synchronization receiving module.

[0134] The signature algorithm update voting module is used to receive the signature algorithm update vote initiated by the first node and vote on the signature algorithm update.

[0135] The above-mentioned update information synchronization receiving module is used to receive the updated signature algorithm information synchronized by the first node and perform configuration synchronization locally; the above-mentioned first node and the above-mentioned device are different blockchain nodes.

[0136] Alternatively, in other embodiments, when the above-mentioned device is a blockchain node, the above-mentioned device also includes: a signature algorithm update transaction receiving module, a verification module, a signature algorithm update voting initiation module, a signature algorithm update configuration module and an update information synchronization sending module.

[0137] The signature algorithm update transaction receiving module is used to receive a signature algorithm update transaction request initiated by the current node; the update transaction request carries the following information: configuration information of the content to be updated and a digital signature for the content to be updated.

[0138] The verification module is used to verify the legality of the content to be updated and the digital signature based on the dynamic configuration contract deployed by the current node.

[0139] The above-mentioned signature algorithm update voting initiation module is used for the current node to initiate a signature algorithm update vote to other nodes in the above-mentioned blockchain network after the above-mentioned content to be updated and the above-mentioned digital signature are verified and passed.

[0140] The above-mentioned signature algorithm update configuration module is used to update the configuration of the signature algorithm according to the above-mentioned content to be updated when the vote is passed, and obtain the dynamically updated signature algorithm information.

[0141] The above-mentioned update information synchronization sending module is used to synchronize the updated signature algorithm information to other nodes of the above-mentioned blockchain network.

[0142] For more details and beneficial effects of this embodiment, please refer to the relevant description of the first embodiment, which will not be repeated here.

[0143] Any number of the functional modules included in the device of this embodiment can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. At least one of the functional modules included in the device of this embodiment can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in any appropriate combination of any of them. Alternatively, at least one of the functional modules included in the device of this embodiment can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be executed.

[0144] A fourth exemplary embodiment of the present disclosure provides an electronic device.

[0145] Figure 8 The structural block diagram of the electronic device provided by the embodiment of the present disclosure is schematically shown.

[0146] Reference Figure 8 As shown, the electronic device 800 provided by the embodiment of the present disclosure includes a processor 801, a communication interface 802, a memory 803 and a communication bus 804, wherein the processor 801, the communication interface 802 and the memory 803 communicate with each other through the communication bus 804; the memory 803 is used to store computer programs; the processor 801 is used to implement the account management method based on dynamic integration of the signature algorithm as described above when executing the program stored in the memory.

[0147] The fifth exemplary embodiment of the present disclosure further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the account management method based on dynamic integration of signature algorithms as described above is implemented.

[0148] The computer-readable storage medium may be included in the device or apparatus described in the above embodiment; or it may exist independently without being assembled into the device or apparatus. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0149] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, apparatus, or device.

[0150] It should be noted that the collection, collection, update, analysis, processing, use, transmission, storage and other aspects of user personal information involved in the technical solution provided by the embodiments of the present disclosure are in compliance with the provisions of relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. Necessary measures are taken for user personal information to prevent illegal access to user personal information data and maintain the security of user personal information, network security and national security.

[0151] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0152] The foregoing is merely a specific embodiment of the present disclosure, which enables those skilled in the art to understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features applied herein.

Claims

1. An account management method based on dynamic integration of signature algorithm, characterized in that: The method is applied to a blockchain node in a blockchain network or an electronic device capable of communicating with a blockchain node, and includes: Receive a request to create a user account; According to the creation request, the signature algorithm information supported by the blockchain network is queried based on the dynamic configuration contract deployed by the corresponding node, and a signature algorithm list is generated on the front-end interface according to the signature algorithm information; the dynamic configuration contract is used for dynamic update and query of the signature algorithm supported by the blockchain network; Determine the target signature algorithm selected by the user in the signature algorithm list, and call the target signature algorithm from the signature algorithm dynamic link library to generate public key-private key pair information corresponding to the newly created account; the public key-private key pair information includes: account public key, account private key and account import information; the signature algorithm dynamic link library covers multiple types of signature algorithms; the account import information is non-plaintext import information matching different signature algorithm types; A request for blockchain account login based on the account import information is received on the login interface, the account import information is decoded and verified, and after the verification is passed, a main interface with the newly created account in a logged-in state is presented.

2. The method according to claim 1, characterized in that The account import information is non-plaintext import information in a preset format obtained by performing corresponding encoding processing on the account public key and the account private key or the account private key according to different signature algorithm types; When the signature algorithm type of the target signature algorithm is a conventional signature algorithm type, the account import information is non-plaintext import information in a preset format obtained by encoding the account private key; When the signature algorithm type of the target signature algorithm is a quantum-resistant signature algorithm type, the account import information is non-plaintext import information in a preset format obtained by encoding the account public key and the account private key.

3. The method according to claim 2, characterized in that For conventional signature algorithm types, the account import information is in the following preset format: ， in, Indicates account import information for common signature algorithm types; represents a first encoding operation; Indicates the leading bit mark, which is used to identify that this is the key format for account import and is used to generate a fixed prefix; 0x00.. indicates the padding byte, which is used to adjust the parameter length so that the encoding result obtains a prefix of fixed length; Represents the account private key; Indicates the index information of the target signature algorithm; Indicates that Before the function Bytes as check digits, where is a positive integer; They correspond to the first hash operation and the second hash operation respectively.

4. The method according to claim 2, characterized in that: For quantum-resistant signature algorithm types, the account import information is in the following preset format: ， in, Indicates account import information for quantum-resistant signature algorithm types; represents a second encoding operation; Indicates the leading bit mark, which is used to identify that this is the key format for account import and is used to generate a fixed prefix; 0x00.. indicates the padding byte, which is used to adjust the parameter length so that the encoding result obtains a prefix of fixed length; Represents the account private key; Represents the account public key; Indicates the index information of the target signature algorithm; Indicates that Before the function Bytes as check digits, where is a positive integer; They correspond to the third hash operation and the fourth hash operation respectively.

5. The method according to any one of claims 1 to 4, characterized in that Decoding and verifying the account import information, including: Decoding the account import information to obtain decoded information; the decoded information includes: a leading bit mark, index information of a target signature algorithm, and a check bit; A query is performed based on the dynamic configuration contract deployed on the corresponding node to obtain configuration parameters of the target signature algorithm corresponding to the index information; the configuration parameters include: a preset leading bit flag corresponding to the signature algorithm prefix, whether the public key can be derived based on the private key, a preset private key length, and a preset public key length; Verifying whether the leading bit mark in the decoded information is consistent with the preset leading bit mark; When the leading bit mark is consistent with the preset leading bit mark, according to whether the public key in the configuration parameter can be derived based on the private key, determining to perform the split operation and the check bit verification operation in one of the following ways: In the case where the public key can be derived based on the private key, the decoding private key is obtained by splitting the public key according to the preset private key length starting from the leading bit mark in the decoding information; performing a first preset hash operation according to the leading bit mark, the decoding private key and the index information of the target signature algorithm and intercepting a first preset byte as the first data to be verified; verifying whether the first data to be verified is consistent with the check bit in the decoding information; or, In the case where the public key cannot be derived based on the private key, starting from the leading bit mark in the decoded information, the decoded private key and the decoded public key are sequentially split according to the preset private key length and the preset public key length to obtain a decoded private key and a decoded public key; a second preset hash operation is performed according to the leading bit mark, the decoded private key, the decoded public key and the index information of the target signature algorithm, and a second preset byte is intercepted as the second data to be verified; and it is verified whether the second data to be verified is consistent with the check bit in the decoded information; Among them, when the verification results corresponding to the check bit verification operation are consistent, the verification is deemed to be passed, and a new account object is constructed based on the decoded information that passed the verification; the new account object contains key pair information consisting of an object public key and an object private key; the object private key is used to sign messages or data transmitted by the node; the object public key is used to verify the validity of the signature in the message or data transmitted by the node.

6. The method according to any one of claims 1 to 4, characterized in that The public key-private key pair information also includes: account blockchain address; The account blockchain address is generated in the following way: Encode the target signature algorithm index information and the account public key to generate the account blockchain address; The nodes of the blockchain network include a signature interface and a verification interface that can call the signature algorithm in the signature algorithm dynamic link library. The signature interface is used to call the corresponding signature algorithm for signing, and the verification interface is used to call the corresponding signature algorithm for signature verification.

7. The method according to claim 1, characterized in that The dynamic update includes: adding a new signature algorithm, deleting a signature algorithm, or changing the configuration content of a signature algorithm; The method further includes: dynamically updating the signature algorithm by a first node in the blockchain network; the first node is the same as or different from the execution subject created by the user account; The dynamically updating the signature algorithm by the first node in the blockchain network includes: The first node receives a signature algorithm update transaction request; the update transaction request carries the following information: configuration information of the content to be updated and a digital signature for the content to be updated; based on the dynamic configuration contract deployed by the first node, the legality of the content to be updated is verified, and the digital signature is verified; after the content to be updated and the digital signature are verified, the first node initiates a signature algorithm update vote to other nodes of the blockchain network; if the vote passes, the first node updates the signature algorithm configuration according to the content to be updated, and obtains the dynamically updated signature algorithm information; the first node synchronizes the updated signature algorithm information to other nodes of the blockchain network; and the first node or other nodes write the transaction record to the blockchain ledger.

8. The method according to claim 7, characterized in that The digital signature is obtained by signing based on the object private key in the node account object of the first node; The configuration information of the content to be updated includes: index information of the signature algorithm to be updated, configuration parameters to be updated and update operation instructions; the configuration parameters to be updated include: a preset leading bit mark corresponding to the prefix when the account import information is encoded, whether the public key can be derived based on the private key, the preset private key length, the preset public key length and the byte length corresponding to the check bit; The verification of the legitimacy of the content to be updated includes: Verify whether the preset private key length, the preset public key length, and the byte length corresponding to the check bit in the configuration parameters to be updated match the corresponding signature algorithm to be updated; Verify whether the preset leading bit mark corresponding to the prefix when encoding the account import information meets the preset specification; The digital signature is verified, including: The digital signature is verified based on the object public key in the node account object of the first node.

9. An account management device based on dynamic integration of signature algorithm, characterized in that: The device is a blockchain node in a blockchain network, or the device is an electronic device capable of communicating with a blockchain node, and the device includes: An account creation request receiving module, used to receive a user account creation request; A signature algorithm list generation module, used to query the signature algorithm information supported by the blockchain network based on the dynamic configuration contract deployed by the corresponding node according to the creation request, and generate a signature algorithm list on the front-end interface according to the signature algorithm information; the dynamic configuration contract is used for dynamic update and query of the signature algorithms supported by the blockchain network; An account information generation module is used to determine the target signature algorithm selected by the user in the signature algorithm list, and call the target signature algorithm from the signature algorithm dynamic link library to generate public key-private key pair information corresponding to the newly created account; the public key-private key pair information includes: account public key, account private key and account import information; the signature algorithm dynamic link library covers multiple types of signature algorithms; the account import information is non-plaintext import information matching different signature algorithm types; The login module is used to receive a request for blockchain account login based on the account import information on the login interface, decode and verify the account import information, and present the main interface of the newly created account in the login state after the verification is passed.

10. The device according to claim 9, characterized in that In the case where the device is a blockchain node, the device further includes: A signature algorithm update voting module is used to receive a signature algorithm update vote initiated by the first node and vote on the signature algorithm update; an update information synchronization receiving module is used to receive the updated signature algorithm information synchronized by the first node and perform configuration synchronization locally; the first node and the device are different blockchain nodes; or, A signature algorithm update transaction receiving module is used to receive a signature algorithm update transaction request initiated by the current node; the update transaction request carries the following information: configuration information of the content to be updated and a digital signature for the content to be updated; a verification module is used to verify the legality of the content to be updated and the digital signature based on the dynamic configuration contract deployed by the current node; a signature algorithm update voting initiating module is used to initiate a signature algorithm update vote to other nodes of the blockchain network by the current node after both the content to be updated and the digital signature are verified; a signature algorithm update configuration module is used to update the signature algorithm according to the content to be updated when the vote is passed, and obtain the dynamically updated signature algorithm information; an update information synchronization sending module is used to synchronize the updated signature algorithm information to other nodes of the blockchain network.

11. An account management architecture based on a blockchain network, characterized in that: include: A plurality of blockchain nodes deployed with dynamic configuration contracts, wherein the dynamic configuration contracts are used for dynamic update and query of signature algorithms supported by the blockchain network; A signature algorithm dynamic link library, including signature algorithms of conventional signature algorithm types and quantum-resistant signature algorithm types; the signature algorithm dynamic link library has a preset standard interface, allowing the required signature algorithm to be selected and called from the signature algorithm list supported by the signature algorithm dynamic link library according to the signature operation requirements or verification operation requirements when the node is running; An account management model, located in a node of the blockchain network or in an electronic device capable of communicating with the node, for supporting the creation of a new account, login verification of a new account, and data signing and data verification after the new account logs in; The account management model includes the following processing logic during the creation of a new account and the verification of the login of a new account: According to the user account creation request, query the signature algorithm information supported by the blockchain network based on the dynamic configuration contract deployed by the corresponding node, and generate a signature algorithm list on the front-end interface according to the signature algorithm information; Determine the target signature algorithm selected by the user in the signature algorithm list, and call the target signature algorithm from the signature algorithm dynamic link library to generate public key-private key pair information corresponding to the newly created account; the public key-private key pair information includes: account public key, account private key and account import information; the signature algorithm dynamic link library covers multiple types of signature algorithms; the account import information is non-plaintext import information matching different signature algorithm types; A request for blockchain account login based on the account import information is received on the login interface, the account import information is decoded and verified, and after the verification is passed, a main interface with the newly created account in a logged-in state is presented.

12. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; Memory, used to store computer programs; A processor, for implementing the method according to any one of claims 1 to 8 when executing a program stored in a memory.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images