BLS negotiation key generation method and device in dynamic change environment

Abstract

The invention discloses a BLS negotiation key generation method and device in a dynamic change environment, and the method comprises the steps: firstly constructing a polynomial for each participating node in a block chain, selecting a random number generator in the polynomial to generate a random constant term and a polynomial coefficient, and fixing the polynomial coefficient except for the random generation as 1; and then each participating node calculates the key contribution of each node through the polynomial generated in the previous step and the id of each node and distributes the key contribution to the corresponding node. Each participating node maps a polynomial coefficient to an elliptic curve to obtain a verification vector, then distributes the verification vector to each node, performs key contribution verification, and finally, each participating node sums a first element of the verification vector to obtain a system public key; and summing the key contributions and then carrying out Lagrange interpolation to obtain a system private key. According to the method, the polynomial coefficient is simplified, and meanwhile, most verification operations can be completed through pre-calculation, so that the communication overhead is greatly reduced.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a method and device for generating a BLS negotiation key in a dynamically changing environment. Background Art

[0002] The BLS (Boneh-Lynn-Shacham) signature scheme plays an important role in blockchain. On the one hand, the BLS signature scheme allows the signatures of multiple signers to be aggregated into a single signature without verifying each signature one by one. This feature of aggregate signatures makes it more efficient to verify transactions or contracts in blockchain, reduces the cost of computing and storage, and improves the throughput and performance of the system. On the other hand, the size of the aggregate signature generated by the BLS signature scheme is fixed and is independent of the number of participants. In contrast, the traditional multi-signature scheme requires the storage and transmission of each individual signature, resulting in a linear relationship between the size of the signature and the number of participants. In blockchain, the signature size is of great significance for reducing the storage requirements and network bandwidth of the blockchain. The BLS signature scheme optimizes the size of the signature and reduces the storage and transmission overhead by aggregating the signature. Therefore, by using the BLS signature scheme, the blockchain can achieve higher throughput and lower resource consumption, promoting the widespread application and development of blockchain technology.

[0003] In a decentralized blockchain environment, BLS relies on the DKG (Distributed Key Generation) protocol to achieve secure and reliable key generation and distribution. Since nodes in a distributed environment are mutually untrustworthy, (t,n)-DKG needs to detect and prevent malicious participants from tampering with or forging key shares through interaction and verification between participants. However, the complexity of interaction between multiple participants is O(n 2 ), and each participant needs to broadcast its own verification vector of length t for verification. By combining the verification vectors, participants can verify the correctness of the received private key contribution. Therefore, the communication overhead required for DKG verification is O(n 2 ·t), and the computational overhead is O(n). In the highly dynamic environment of public blockchain validators, the heavy communication and computational overhead limits the further application of the BLS signature scheme in blockchain.

[0004] In view of this, how to design a more efficient and lightweight BLS key negotiation mechanism in a dynamically changing blockchain environment is a research difficulty in the current blockchain field. In response to this problem, the present invention proposes an algorithm for BLS key negotiation in a dynamically changing environment, which solves this problem well. Summary of the invention

[0005] The present invention aims to address the deficiencies of the prior art and to propose a method for generating a BLS negotiation key in a dynamically changing environment.

[0006] The object of the present invention is achieved through the following technical solution: A method for generating a BLS negotiation key in a dynamically changing environment, comprising the following steps:

[0007] S1. Construct a polynomial for each participating node in the blockchain, wherein a random number generator is used to generate a random constant term and a polynomial coefficient, and the polynomial coefficients other than the randomly generated ones are fixed to 1;

[0008] S2. Each participating node adds 1 to the ID value of the other nodes and inserts it into its own polynomial to distribute to each node to calculate the key contribution vector received by each participating node, and at the same time calculates the verification vector and distributes it;

[0009] S3. Verify the correctness of the key contribution based on the collected verification vector and contribution vector;

[0010] S4. Add the first elements of the verification vectors corresponding to the nodes that have passed the verification to obtain the system public key, and add the key contributions of the nodes that have passed the verification to obtain the summarized key contribution. The summarized key contribution is forwarded to other nodes, and the system private key is reconstructed using the Lagrange interpolation method.

[0011] Furthermore, the formula of the polynomial is specifically as follows:

[0012]

[0013] Where s∈Z t-1 , each participating node N i A secure random number generator is selected to generate t random polynomial coefficients. The degree of the polynomial is t-1, and the random t-2 coefficients of the t-1 polynomial coefficients, except the constant term, are fixed to 1 to reduce the communication and computational overhead of the verification process.

[0014] Furthermore, the key contribution is specifically:

[0015] Each participating node N i The id of each participating node N is i. i The other nodes N j Add 1 to the id value and substitute it into the polynomial to get f i (j+1), then f i (j+1) is distributed to each node N j , where i, j∈Z n-1 Then for each participating node N j , the received key contribution vector can be expressed as

[0016] SC j =[f0(j+1),f1(j+1),…,f n-1 (j+1)]

[0017] Furthermore, the verification vector is node N j The mapping of the corresponding polynomial coefficients on the elliptic curve BN128 is as follows:

[0018] V j =[a j，0 G, G, …, a j，s ·G, …,G]

[0019] Among them, a j，0 G stands for N j The mapping of the constant term coefficients of the corresponding polynomial on the elliptic curve BN128; there are t-2 items in the verification vector of length t that are constants 1·G.

[0020] Furthermore, the verification key contribution is specifically:

[0021] X i，j =SC i [j]·G

[0022]

[0023] If X i，j =Y i，j , then the participating nodes N i Can prove that node N j The sent f j (i+1) is the correct value, for each participating node N i , calculate Y i,j When a j,0 G+(i+1) s a j,s The value of G, Obtained through pre-calculation.

[0024] Furthermore, the S4 specifically includes:

[0025] Each participating node N i First, add the first element of the verification vector corresponding to all verified nodes to obtain the system public key; if the key contributions sent by n nodes are all correct values, the system public key is shown as

[0026]

[0027] Then, each participating node N iAdd up all verified key contributions to get the aggregated key contribution, expressed as

[0028]

[0029] The aggregated key contributions are forwarded to other nodes again; each participating node receives t S from other nodes i , the system private key SK is reconstructed by Lagrange interpolation method, expressed as:

[0030]

[0031] in is the Lagrange coefficient.

[0032] On the other hand, the specification of the present invention also provides a BLS negotiated key generation device in a dynamically changing environment, including a memory and one or more processors, wherein the memory stores executable code, and when the processor executes the executable code, it implements the BLS negotiated key generation method in a dynamically changing environment.

[0033] On the other hand, the specification of the present invention also provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, the method for generating a BLS negotiation key in a dynamically changing environment is implemented.

[0034] Beneficial effects of the present invention: In view of the heavy communication and computational overhead of the BLS algorithm in the key negotiation process, the present invention proposes an algorithm for BLS key negotiation in a dynamically changing environment. By simplifying the polynomial coefficients, the size of the verification vector used by each participating node in the key distribution process is simplified to a constant 2. Benefiting from the above design, the present invention can reduce the communication overhead from O(n 2 ·t) is reduced to O(n 2 ); at the same time, since the t-2 verification elements are all constants 1·G, most of the verification operations can be completed through pre-computation, thus reducing the computational overhead from O(n) to O(1). BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A flowchart of a BLS key negotiation method in a dynamically changing environment provided by an embodiment of the present invention;

[0036] Figure 2 A schematic diagram of a BLS key negotiation device in a dynamically changing environment provided by an embodiment of the present invention; DETAILED DESCRIPTION

[0037] The specific implementation modes of the present invention are further described in detail below with reference to the accompanying drawings.

[0038] like Figure 1 As shown, the embodiment of the present invention may include the following steps:

[0039] Parameter definition: Define the elliptic curve, the total number of participating nodes in the system and the minimum number of participants required to reach a consensus. Specifically, let G be a base point on the elliptic curve BN128, the total number of participating nodes in the system is n, and the minimum number of participants required to reach a consensus is t.

[0040] Polynomial generation: Each participating node generates a polynomial through a secure random number generator.

[0041] Specifically, each participating node N i Choose a secure random number generator to generate t random polynomial coefficients. The white variable of the polynomial is x and the degree is t-1. For example, x s represents a polynomial with x as the white variable and s as the degree. The form of the polynomial is as follows:

[0042]

[0043] Different from the original DKG scheme, the present invention fixes the random t-2 coefficients of the t-1 polynomial coefficients, except the constant term, to 1 when constructing the polynomial, so as to reduce the communication and computational overhead of the verification process. t-1 , represents a randomly selected non-zero coefficient polynomial x s The number of times.

[0044] Key contribution calculation and distribution: Each participating node calculates the key contribution of each node using the polynomial generated in the previous step and the ID of each node and distributes it to the corresponding node.

[0045] Specifically, assume that each participating node N i The id of each participating node N is i. i The other nodes N j Add 1 to the id value and substitute it into the polynomial to get f i (j+1), then f i (j+1) is distributed to each node N j , where i, j∈Z n-1 Then for each participating node N j , the received key contribution vector can be expressed as

[0046] SC j =[f0(j+1),f1(j+1),…,f n-1 (j+1)]

[0047] Verification vector calculation and distribution: Each participating node obtains the verification vector by mapping the polynomial coefficients to the elliptic curve, and then distributes it to each node.

[0048] Specifically, in order to facilitate each participating node N i Verification from other nodes N j The key contribution f j The correctness of (i+1), N j Need to broadcast its own verification vector. Technically, the verification vector is defined as node N j The corresponding polynomial coefficients are mapped on the elliptic curve BN128. Therefore, it can be expressed as

[0049] V j =[a j , 0·G,G,…,a j，s ·G, …,G]

[0050] Among them, a j，0 G stands for N j The mapping of the constant term coefficients of the corresponding polynomial on the elliptic curve BN128, specifically, a j，0 is considered as a scalar, and the scalar multiplication operation is performed on the elliptic curve base point G, and the result is a new point on the elliptic curve. Since there are t-2 items in the verification vector of length t that are constants 1·G, N j Only need to broadcast a j，0 G and a j，s G can help other nodes complete the verification. This greatly reduces the communication overhead in the process of distributing the verification vector. Note that steps 3 and 4 are performed in parallel.

[0051] Key contribution verification: Each participating node verifies the correctness of the key contribution based on the verification vector sent by other nodes. i The correctness of the key contribution is verified through the collected verification vectors. The verification process is as follows:

[0052] X i,j =SC i [j]·G

[0053]

[0054] If X i,j =Y i,j , then the participating nodes N i Can prove that node N j The sent f j (i+1) is the correct value. The complexity of the verification vector V is simplified in the present invention, so for each participating node N i For example, the calculation of Yi,j When a j,0 G+(i+1) s a j,s The value of G, It can be obtained through pre-calculation and does not need to be executed every time verification is performed, which greatly reduces the computational overhead in the verification process.

[0055] Key generation: Each participating node sums the first element of the verification vector to obtain the system public key; sums the key contributions and then performs Lagrange interpolation to obtain the system private key.

[0056] In this phase, each participating node N i First, add the first element of the verification vector corresponding to all verified nodes to obtain the system public key. Assuming that the key contributions sent by n nodes are all correct values, the system public key can be expressed as

[0057]

[0058] Then, each participating node N i Add up all verified key contributions to get the aggregated key contribution, expressed as

[0059]

[0060] These aggregated key contributions are forwarded to other nodes again. Each participating node only needs to receive t S from other nodes. i , the system private key SK can be reconstructed by Lagrange interpolation method, expressed as

[0061]

[0062] in is the Lagrange coefficient.

[0063] Corresponding to the aforementioned embodiment of a method for generating a BLS negotiation key in a dynamically changing environment, the present invention further provides an embodiment of a device for generating a BLS negotiation key in a dynamically changing environment.

[0064] See also Figure 2 An embodiment of the present invention provides a BLS negotiation key generation device in a dynamically changing environment, including a memory and one or more processors, wherein the memory stores executable code, and when the processor executes the executable code, it is used to implement a BLS negotiation key generation method in a dynamically changing environment in the above embodiment.

[0065] An embodiment of a BLS negotiated key generation device in a dynamically changing environment provided by the present invention can be applied to any device with data processing capabilities, and the device with data processing capabilities can be a device or apparatus such as a computer. The device embodiment can be implemented through software, or through hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of any device with data processing capabilities in which it is located reading the corresponding computer program instructions in the non-volatile memory into the internal memory for execution. From a hardware perspective, if Figure 2 As shown, it is a hardware structure diagram of a device with data processing capability in which a BLS negotiation key generation device is located in a dynamically changing environment provided by the present invention, except Figure 2 In addition to the processor, memory, network interface, and non-volatile memory shown, any device with data processing capabilities in which the apparatus in the embodiments is located may also include other hardware, generally based on the actual functions of the device with data processing capabilities, which will not be described in detail.

[0066] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0067] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of the present invention. Ordinary technicians in this field can understand and implement it without paying creative work.

[0068] An embodiment of the present invention further provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, a method for generating a BLS negotiation key in a dynamically changing environment in the above embodiment is implemented.

[0069] The computer-readable storage medium may be an internal storage unit of any device with data processing capability described in any of the aforementioned embodiments, such as a hard disk or a memory. The computer-readable storage medium may also be an external storage device of any device with data processing capability, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. equipped on the device. Furthermore, the computer-readable storage medium may also include both an internal storage unit and an external storage device of any device with data processing capability. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capability, and may also be used to temporarily store data that has been output or is to be output.

[0070] The present invention also provides a computer program product, including a computer program, and when the computer program is executed by a processor, the method for generating a BLS negotiation key in a dynamically changing environment is implemented.

[0071] Those skilled in the art will readily appreciate other embodiments of the present application after considering the description and practicing the contents disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The description and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the claims.

[0072] It should be understood that the above general description and the detailed description below are only exemplary and explanatory and cannot limit the present application. The present application is not limited to the precise structure described above and shown in the drawings, and various modifications and changes can be made without departing from the scope thereof. The scope of the present application is limited only by the attached claims.

Claims

1. A method for generating a BLS negotiation key in a dynamically changing environment, characterized in that: The following steps are involved: S1. Construct a polynomial for each participating node in the blockchain, wherein a random number generator is used to generate a random constant term and a polynomial coefficient, and the polynomial coefficients other than the randomly generated ones are fixed to 1; S2. Each participating node adds 1 to the ID value of the other nodes and inserts it into its own polynomial to distribute to each node to calculate the key contribution vector received by each participating node, and at the same time calculates the verification vector and distributes it; S3. Verify the correctness of the key contribution based on the collected verification vector and contribution vector; S4. Add the first elements of the verification vectors corresponding to the nodes that have passed the verification to obtain the system public key, and add the key contributions of the nodes that have passed the verification to obtain the summarized key contribution. The summarized key contribution is forwarded to other nodes, and the system private key is reconstructed using the Lagrange interpolation method.

2. According to claim 1, a method for generating a BLS negotiation key in a dynamically changing environment is characterized in that: The formula of the polynomial is as follows: where x s represents a polynomial with white variable x and degree s, s∈Z t-1 , represents a randomly selected non-zero coefficient polynomial x s The number of times each participating node N i A secure random number generator is selected to generate t random polynomial coefficients; the degree of the polynomial is t-1, and the random t-2 coefficients of the t-1 polynomial coefficients, except the constant term, are fixed to 1 to reduce the communication and computational overhead of the verification process.

3. According to claim 1, a method for generating a BLS negotiation key in a dynamically changing environment is characterized in that: The key contribution is specifically: Each participating node N i The id of each participating node N is i. i The other nodes N j Add 1 to the id value and substitute it into the polynomial to get f i (j+1), then f i (j+1) is distributed to each node N j , where i, j∈Z n-1 Then for each participating node N j , the received key contribution vector can be expressed as SC j =[f0(j+1),f1(j+1),…,f n-1 (j+1)] 4. According to claim 1, a method for generating a BLS negotiation key in a dynamically changing environment is characterized in that: The verification vector is node N j The mapping of the corresponding polynomial coefficients on the elliptic curve BN128 is as follows: V j =[a j，0 ·G,G,…,a j，s ·G,…,G] Among them, a j，0 G stands for N j The mapping of the constant term coefficients of the corresponding polynomial on the elliptic curve BN128; there are t-2 items in the verification vector of length t that are constants 1·G.

5. A method for generating a BLS negotiation key in a dynamically changing environment according to claim 4, characterized in that: The verification key contribution is specifically: X i，j =SC i [j]·G If X i，j =Y i，j , then the participating nodes N i Can prove that node N j The sent f j (i+1) is the correct value, for each participating node N i , calculate Y i，j When a j，0 G+(i+1) s a j，s The value of G, Obtained through pre-calculation.

6. A method for generating a BLS negotiation key in a dynamically changing environment according to claim 1, characterized in that: The S4 specifically includes: Each participating node N i First, add the first element of the verification vector corresponding to all verified nodes to obtain the system public key; if the key contributions sent by n nodes are all correct values, the system public key is shown as Then, each participating node N i Add up all verified key contributions to get the aggregated key contribution, expressed as The aggregated key contributions are forwarded to other nodes again; each participating node receives t S from other nodes i , the system private key SK is reconstructed by Lagrange interpolation method, expressed as: in is the Lagrange coefficient.

7. A BLS negotiation key generation device in a dynamically changing environment, comprising a memory and one or more processors, wherein the memory stores executable code, characterized in that: When the processor executes the executable code, a method for generating a BLS negotiation key in a dynamically changing environment as described in any one of claims 1 to 6 is implemented.

8. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by a processor, a method for generating a BLS negotiation key in a dynamically changing environment as described in any one of claims 1 to 6 is implemented.

Images