Key management method based on distributed block chain

Abstract

The invention discloses a key management method based on a distributed block chain, and relates to the technical field of information security. Comprising the following steps: step 1: generating a block of a key, step 2: managing the key according to a block body of the key, step 21: querying a public key of a user: traversing forwards from a latest block through a node of a block chain, and feeding back a latest effective key to the node for querying the public key of the user, step 22: updating the key, and step 23: cancelling the key: when the key of the user needs to be destroyed, cancelling the key, and initiating a key destruction request to the core node, verifying the identity and authority of the user through the core node, and destroying the key and key related information according to the identity and authority of the user.

Description

Technical Field

[0001] The invention discloses a key management method based on distributed blockchain, which relates to the technical field of information security. Background Art

[0002] In today's era of high-speed transmission and interaction of digital information, information security has become a vital issue. As one of the core links to ensure information security, the reliability and security of key management directly affect the stable operation of the entire system. The existing key management model generally adopts a centralized storage architecture, that is, the keys are stored in a single or very few key nodes. This method simplifies the key management process to a certain extent, but it hides huge risks. From a technical perspective, single-point storage makes these key nodes the lifeblood of the entire key system. Since all key information is gathered here, once these nodes are threatened by various threats such as network attacks, hardware failures, and software vulnerability exploits, the consequences are disastrous. If a network attacker successfully breaks through this single point, he can easily obtain a large amount of key data, resulting in key leakage. Once the key is leaked, malicious attackers can decrypt protected sensitive information, causing serious problems such as user privacy infringement and theft of commercial secrets. Summary of the invention

[0003] The present invention aims at the problems of the prior art and provides a key management method based on distributed blockchain, which eliminates the risk of single point failure, eliminates the risk brought by single point failure, and evenly distributes the key management responsibilities to multiple nodes, thereby avoiding the collapse of the entire key system due to the failure, attack or control of individual or a few key nodes, and effectively ensures that the key system can operate continuously and stably. At the same time, the flexibility and scalability of the system are significantly improved, so that it can easily adapt to information systems of different scales and complexities, can easily add or remove nodes, and flexibly adjust key management strategies, so as to fully meet the ever-changing and growing business needs and security requirements.

[0004] The specific scheme proposed by the present invention is:

[0005] The present invention provides a key management method based on a distributed blockchain, comprising:

[0006] Step 1: Generate key blocks: The master key generation center selects an elliptic curve to generate private and public keys, and collaborates with the slave key generation center to split the private key, then send the split private key to the user, and send the public key information to the blockchain core node.

[0007] The core node performs key signing on the public key information and publishes the signed public key information to the blockchain network. After other nodes verify the public key information, the public key information is added to the Merkle tree as a block. When the core node discovers a legal block, it broadcasts the discovered block to all nodes.

[0008] Step 2: Manage the key according to the block body of the key:

[0009] Step 21: Query the public key of the user: Traverse forward from the latest block through the nodes of the blockchain, and feedback the latest valid key to the node that queries the public key of the user.

[0010] Step 22: Update the key: When there is a need to update the key, the master key generation center generates a new unique identity for the user based on the entity identifier of the user, and re-selects an elliptic curve to generate a new private key and a new public key. Collaborate with the slave key generation center to split the new private key, then send the split new private key to the user, and send the new public key information to the blockchain core node. The core node performs key signing on the new public key information and publishes it. After the new public key information is verified by other nodes, it is added to the Merkle tree as a block to complete the update.

[0011] Step 23: Revoke the key: When it is necessary to destroy the user's key, initiate a key destruction request to the core node. The core node verifies the user's identity and permissions, and destroys the key and key-related information according to the user's identity and permissions.

[0012] Furthermore, in step 1 of the key management method based on a distributed blockchain, the master key generation center selects the secp256k1 elliptic curve. The equation of the secp256k1 elliptic curve is y 2 = x 3 + 7 (mod p). Randomly select a large integer as the private key dA, satisfying 1 < dA < n - 1, where n is the order of the secp256k1 elliptic curve. Calculate QA = dA * G to obtain the corresponding public key QA, where G is the base point on the secp256k1 elliptic curve.

[0013] Collaborate with the slave key generation center to split the private key dA into dsA1 and dsA2, then send the split private keys dsA1 and dsA2 to the user, and send the public key information to the blockchain core node.

[0014] Furthermore, in step 21 of the key management method based on a distributed blockchain, querying the public key of the user includes:

[0015] Send the query request to the nodes of the blockchain. Traverse forward from the latest block through the nodes of the blockchain, and feedback the latest valid key to the node that queries the public key of the user.

[0016] The corresponding public key information and the block and Merkle tree branch information containing the public key information are returned through the node.

[0017] Furthermore, when a key is cancelled in step 23 of the key management method based on a distributed blockchain, the key to be cancelled will be marked as a to-be-destroyed state on the blockchain through the core node, and subsequent operations will be triggered to encrypt or mark the transaction records related to the key as invalid to prevent subsequent illegal access and use; in the local key storage, the relevant data of the key will be completely deleted, and the relevant data of the key includes the private key, the public key and any derived key materials. At the same time, the user status information on the blockchain is updated to indicate that the key has been destroyed, and other relevant nodes are notified to synchronously update the local records.

[0018] The present invention also provides a key management system based on a distributed blockchain, comprising: a key generation module and a key management module,

[0019] The key generation module generates the key block: the master key generation center selects the elliptic curve to generate the private key and public key, and cooperates with the slave key generation center to split the private key, and then sends the split private key to the user, and sends the public key information to the blockchain core node.

[0020] The core node signs the public key information and publishes it to the blockchain network. After other nodes verify the public key information, the public key information is added to the Merkle tree as a block. The core node finds the legal block and broadcasts the found block to all nodes.

[0021] The key management module manages the key according to the key block:

[0022] Step 21: Query the user's public key: Traverse the blockchain nodes from the latest block forward and feed back the latest valid key to the node that queries the user's public key.

[0023] Step 22: Update the key: When the key needs to be updated, the master key generation center generates a new unique identity for the user based on the user's entity identity, and reselects the elliptic curve to generate a new private key and a new public key. Collaborate with the slave key generation center to split the new private key, and then send the split new private key to the user, send the new public key information to the blockchain core node, and sign and publish the new public key information through the core node. The new public key information is verified by other nodes and added to the Merkle tree as a block to complete the update.

[0024] Step 23: Deregister the key: When the user's key needs to be destroyed, a key destruction request is initiated to the core node, the core node verifies the user's identity and authority, and destroys the key and key-related information based on the user's identity and authority.

[0025] Furthermore, the key generation module of the key management system based on distributed blockchain selects the secp256k1 elliptic curve through the master key generation center. The equation of the secp256k1 elliptic curve is y 2 = x 3 + 7 (mod p). Randomly select a large integer as the private key dA, satisfying 1 < dA < n - 1, where n is the order of the secp256k1 elliptic curve. Calculate the corresponding public key QA = dA * G, where G is the base point on the secp256k1 elliptic curve.

[0026] And cooperate with the key generation center to split the private key dA into dsA1 and dsA2, then send the split private keys dsA1 and dsA2 to the user, and send the public key information to the blockchain core node.

[0027] Furthermore, when the key management module of the key management system based on distributed blockchain queries the user's public key in step 21, it includes:

[0028] Send the query request to the nodes of the blockchain, traverse forward from the latest block through the nodes of the blockchain, and feedback the latest valid key to the node querying the user's public key.

[0029] Return the corresponding public key information, as well as the block containing the public key information and the Merkle tree branch information, through the node.

[0030] Furthermore, when the key management module of the key management system based on distributed blockchain cancels the key in step 23, the core node will mark the key to be cancelled as the state to be destroyed on the blockchain, and trigger subsequent operations to encrypt or mark the transaction records related to the key as invalid to prevent subsequent illegal access and use; in the local key storage, completely delete the relevant data of the key. The relevant data of the key includes the private key, public key, and any derived key materials. At the same time, update the user status information on the blockchain to indicate that the key has been destroyed, and notify other relevant nodes to synchronize and update the local records.

[0031] The beneficial effects of the present invention are:

[0032] Based on blockchain technology, it ensures the integrity and accuracy of the public key and user identity information, reducing the risk of being maliciously tampered with. The strict key generation, distribution, and storage mechanisms improve the security of the cryptographic system and reduce the possibility of key leakage;

[0033] Supports multiple core nodes and a large number of user nodes through a distributed system architecture, has good scalability, and can adapt to the growing user needs and business scale. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0035] Figure 1 It is a schematic architecture diagram of the application of the method of the present invention.

[0036] Figure 2 It is a schematic diagram of the Merkle tree related to the present invention.

[0037] Figure 3 It is a schematic diagram of the public key query process of the present invention.

[0038] Figure 4 It is a schematic diagram of the key update process of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0039] The following further describes the present invention in conjunction with the drawings and specific embodiments, so that those skilled in the art can better understand the present invention and be able to implement it, but the examples given are not intended to limit the present invention.

[0040] Embodiment 2

[0041] The present invention provides a key management method based on a distributed blockchain, including:

[0042] Step 1: Generate a key block: The master key generation center selects an elliptic curve to generate a private key and a public key, collaborates with the slave key generation center, splits the private key, then sends the split private key to the user, and sends the public key information to the blockchain core node.

[0043] The core node performs key signing on the public key information and publishes the signed public key information to the blockchain network. After other nodes verify the public key information, the public key information is added to the Merkle tree as a block. After the core node discovers a legal block and broadcasts the discovered block to all nodes.

[0044] In step 1, the master key generation center can further select the secp256k1 elliptic curve. The equation of the secp256k1 elliptic curve is y 2 = x 3 + 7 (mod p), randomly select a large integer as the private key dA, satisfying 1 < dA < n - 1, where n is the order of the secp256k1 elliptic curve, and calculate QA = dA * G to obtain the corresponding public key QA, where G is the base point on the secp256k1 elliptic curve.

[0045] And cooperate with the key generation center to split the private key dA into dsA1 and dsA2, then send the split private keys dsA1 and dsA2 to the user, and send the public key information to the blockchain core node.

[0046] After user A receives dsA1 and dsA2, he obtains the complete private key dA by calculating dA=dsA1+dsA2(modn).

[0047] After the public key information is signed by the core node key, it is published to the blockchain network through the core node. After the other core nodes receive the public key information through the network, they add the information to the cache queue. When the node starts to generate a block, it extracts some public key information from the cache queue and adds it to the new Merkle tree after verifying the validity of the public key information. Figure 2 As shown in the figure, it is used as the block body. When the core node finds a valid block, it broadcasts the found block to all nodes. The remaining nodes verify whether the block is valid after receiving the broadcasted block. After passing the legitimacy check, the block is added to the blockchain, and according to the information contained in the block, the cache queue of the information is adjusted and the information contained in the next block is selected from the cache queue after the adjustment. Whether the node retains the block body depends on whether it contains the public key that needs to be saved.

[0048] Step 2: Manage the key according to its block:

[0049] Step 21: Query the user's public key: Traverse the blockchain nodes from the latest block forward and feed back the latest valid key to the node that queries the user's public key.

[0050] The query of the user's public key includes:

[0051] The query request is sent to the node of the blockchain, and the latest valid key is fed back to the node that queries the user's public key through the node of the blockchain from the latest block forward.

[0052] The corresponding public key information, blocks containing the public key information, and Merkle tree branch information are returned through the node. In addition, users in different system domains can query the system parameters on the chain through the blockchain, effectively realizing cross-domain communication.

[0053] Step 22: Update the key: When the key needs to be updated, the master key generation center generates a new unique identity for the user based on the user's entity identity, and reselects the elliptic curve to generate a new private key and a new public key Q'. It collaborates with the slave key generation center to split the new private key, and then sends the split new private key to the user, and sends the new public key information to the blockchain core node. The core node signs and publishes the new public key information, and the new public key information is verified by other nodes and added to the Merkle tree as a block to complete the update.

[0054] The information generated by the key update process needs to be written into the blockchain through the master key generation center. In this process, the transaction input is the transaction index corresponding to the user key update, and the output is the system parameters, user entity identifier, new user identity identifier, new public key Q' and new validity period. When the new key takes effect on the blockchain, the old key will automatically become invalid. However, the old key will still be recorded on the blockchain, which can not only ensure the traceability of historical information, but also realize the function of key archiving.

[0055] Step 23: Deregister the key: When the user's key needs to be destroyed, a key destruction request is initiated to the core node, the core node verifies the user's identity and authority, and destroys the key and key-related information based on the user's identity and authority.

[0056] When the key is cancelled in step 23, the core node will mark the key to be cancelled as pending destruction on the blockchain, triggering subsequent operations to encrypt or mark the transaction records related to the key as invalid to prevent subsequent illegal access and use; in the local key storage, the key-related data is completely deleted, including the private key, public key, and any derived key materials. At the same time, the user status information on the blockchain is updated to indicate that the key has been destroyed, and other related nodes are notified to update the local records synchronously. The entire key destruction process will be fully recorded on the blockchain, forming an unalterable audit trail to ensure the traceability and compliance of the destruction operation.

[0057] Example 2

[0058] The present invention also provides a key management system based on a distributed blockchain, comprising: a key generation module and a key management module,

[0059] The key generation module generates the key block: the master key generation center selects the elliptic curve to generate the private key and public key, and cooperates with the slave key generation center to split the private key, and then sends the split private key to the user, and sends the public key information to the blockchain core node.

[0060] The core node signs the public key information and publishes it to the blockchain network. After other nodes verify the public key information, the public key information is added to the Merkle tree as a block. The core node finds the legal block and broadcasts the found block to all nodes.

[0061] The key management module manages the key according to the key block:

[0062] Step 21: Query the user's public key: Traverse the blockchain nodes from the latest block forward and feed back the latest valid key to the node that queries the user's public key.

[0063] Step 22: Update the key: When the key needs to be updated, the master key generation center generates a new unique identity for the user based on the user's entity identity, and reselects the elliptic curve to generate a new private key and a new public key. Collaborate with the slave key generation center to split the new private key, and then send the split new private key to the user, send the new public key information to the blockchain core node, and sign and publish the new public key information through the core node. The new public key information is verified by other nodes and added to the Merkle tree as a block to complete the update.

[0064] Step 23: Deregister the key: When the user's key needs to be destroyed, a key destruction request is initiated to the core node, the core node verifies the user's identity and authority, and destroys the key and key-related information based on the user's identity and authority.

[0065] As the information interaction and execution process between the modules in the above-mentioned system are based on the same concept as the embodiment of the method of the present invention, the specific contents can be found in the description of the embodiment of the method of the present invention and will not be repeated here.

[0066] Similarly, the system of the present invention uses blockchain technology to ensure the integrity and accuracy of public keys and user identity information, reducing the risk of malicious tampering. Strict key generation, distribution and storage mechanisms improve the security of the cryptographic system and reduce the possibility of key leakage;

[0067] Through the distributed system architecture, it supports multiple core nodes and a large number of user nodes, has good scalability, and can adapt to the growing user needs and business scale.

[0068] It should be noted that not all steps and modules in the above-mentioned processes and system structures are necessary, and some steps or modules can be ignored according to actual needs. The execution order of each step is not fixed and can be adjusted as needed. The system structure described in the above-mentioned embodiments can be a physical structure or a logical structure, that is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or some components in multiple independent devices may be implemented together.

[0069] The above-described embodiments are only preferred embodiments for fully illustrating the present invention, and the protection scope of the present invention is not limited thereto. Equivalent substitutions or changes made by those skilled in the art based on the present invention are within the protection scope of the present invention. The protection scope of the present invention shall be subject to the claims.

Claims

1. A key management method based on distributed blockchain, characterized by include: Step 1: Generate key blocks: The master key generation center selects an elliptic curve to generate private and public keys, and collaborates with the slave key generation center to split the private key, then send the split private key to the user, and send the public key information to the blockchain core node. The core node signs the public key information and publishes it to the blockchain network. After other nodes verify the public key information, the public key information is added to the Merkle tree as a block. The core node finds the legal block and broadcasts the found block to all nodes. Step 2: Manage the key according to its block: Step 21: Query the user's public key: Traverse the blockchain nodes from the latest block forward and feed back the latest valid key to the node that queries the user's public key. Step 22: Update the key: When the key needs to be updated, the master key generation center generates a new unique identity for the user based on the user's entity identity, and reselects the elliptic curve to generate a new private key and a new public key. Collaborate with the slave key generation center to split the new private key, and then send the split new private key to the user, send the new public key information to the blockchain core node, and sign and publish the new public key information through the core node. The new public key information is verified by other nodes and added to the Merkle tree as a block to complete the update. Step 23: Deregister the key: When the user's key needs to be destroyed, a key destruction request is initiated to the core node, the core node verifies the user's identity and authority, and destroys the key and key-related information based on the user's identity and authority.

2. The key management method based on a distributed blockchain according to claim 1, characterized in that in step 1, the secp256k1 elliptic curve is selected by the master key generation center, and the equation of the secp256k1 elliptic curve is y 2 = x 3 + 7 (mod p), randomly select a large integer as the private key dA, satisfying 1 < dA < n - 1, where n is the order of the secp256k1 elliptic curve, and calculate the corresponding public key QA = dA * G, where G is the base point on the secp256k1 elliptic curve, And cooperate with the key generation center to split the private key dA into dsA1 and dsA2, then send the split private keys dsA1 and dsA2 to the user, and send the public key information to the blockchain core node.

3. A key management method based on distributed blockchain according to claim 1, characterized in that In step 21, the user's public key is queried, including: The query request is sent to the node of the blockchain, and the latest valid key is fed back to the node that queries the user's public key through the node of the blockchain from the latest block forward. The corresponding public key information and the block and Merkle tree branch information containing the public key information are returned through the node.

4. A key management method based on distributed blockchain according to claim 1, characterized in that When the key is cancelled in step 23, the core node will mark the key to be cancelled as pending destruction on the blockchain, triggering subsequent operations to encrypt or mark the transaction records related to the key as invalid to prevent subsequent illegal access and use; in the local key storage, the key-related data is completely deleted, including the private key, public key and any derived key materials. At the same time, the user status information on the blockchain is updated to indicate that the key has been destroyed, and other related nodes are notified to synchronously update the local records.

5. A key management system based on distributed blockchain, characterized by include: Key generation module and key management module, The key generation module generates the key block: the master key generation center selects the elliptic curve to generate the private key and public key, and cooperates with the slave key generation center to split the private key, and then sends the split private key to the user, and sends the public key information to the blockchain core node. The core node signs the public key information and publishes it to the blockchain network. After other nodes verify the public key information, the public key information is added to the Merkle tree as a block. The core node finds the legal block and broadcasts the found block to all nodes. The key management module manages the key according to the key block: Step 21: Query the user's public key: Traverse the blockchain nodes from the latest block forward and feed back the latest valid key to the node that queries the user's public key. Step 22: Update the key: When the key needs to be updated, the master key generation center generates a new unique identity for the user based on the user's entity identity, and reselects the elliptic curve to generate a new private key and a new public key. Collaborate with the slave key generation center to split the new private key, and then send the split new private key to the user, send the new public key information to the blockchain core node, and sign and publish the new public key information through the core node. The new public key information is verified by other nodes and added to the Merkle tree as a block to complete the update. Step 23: Deregister the key: When the user's key needs to be destroyed, a key destruction request is initiated to the core node, the core node verifies the user's identity and authority, and destroys the key and key-related information based on the user's identity and authority.

6. A distributed blockchain-based key management system according to claim 5, characterized in that The key generation module selects the secp256k1 elliptic curve through the master key generation center. The equation of the secp256k1 elliptic curve is y 2 = x 3 + 7 (mod p). Randomly select a large integer as the private key dA, satisfying 1 < dA < n - 1, where n is the order of the secp256k1 elliptic curve. Calculate the corresponding public key QA = dA * G, where G is the base point on the secp256k1 elliptic curve. And cooperate with the key generation center to split the private key dA into dsA1 and dsA2, then send the split private keys dsA1 and dsA2 to the user, and send the public key information to the blockchain core node.

7. A distributed blockchain-based key management system according to claim 5, characterized in that The key management module queries the user's public key in step 21, including: The query request is sent to the node of the blockchain, and the latest valid key is fed back to the node that queries the user's public key through the node of the blockchain from the latest block forward. The corresponding public key information and the block and Merkle tree branch information containing the public key information are returned through the node.

8. A distributed blockchain-based key management system according to claim 5, characterized in that When the key management module cancels the key in step 23, the key to be cancelled will be marked as pending destruction on the blockchain through the core node, and subsequent operations will be triggered to encrypt or mark the transaction records related to the key as invalid to prevent subsequent illegal access and use; in the local key storage, the relevant data of the key will be completely deleted, and the relevant data of the key includes the private key, the public key and any derived key materials. At the same time, the user status information on the blockchain will be updated to indicate that the key has been destroyed, and other relevant nodes will be notified to synchronously update the local records.

Images