A Key Management Method Based on Distributed Blockchain

Abstract

This invention discloses a key management method based on distributed blockchain, relating to the field of information security technology; it includes: Step 1: generating a key block; Step 2: managing the key according to the key block body: Step 21: querying the user's public key: traversing the blockchain nodes from the latest block backwards, and feeding back the latest valid key to the node querying the user's public key; Step 22: updating the key; Step 23: canceling the key: when it is necessary to destroy the user's key, a key destruction request is initiated to the core node, the core node verifies the user's identity and permissions, and destroys the key and key-related information according to the user's identity and permissions.

Description

Technical Field

[0001] This invention discloses a key management method based on distributed blockchain, which relates to the field of information security technology. Background Technology

[0002] In today's era of high-speed digital information transmission and interaction, information security has become a crucial issue. Key management, as a core component of information security, directly impacts the stable operation of the entire system through its reliability and security. Existing key management models generally employ a centralized storage architecture, storing keys on a single or very few critical nodes. While this simplifies key management to some extent, it harbors significant risks. From a technical perspective, single-point storage makes these critical nodes the Achilles' heel of the entire key system. Since all key information converges here, the consequences of these nodes being attacked by threats such as network attacks, hardware failures, or software vulnerabilities are unimaginable. If a network attacker successfully breaches this single point, they can easily obtain a large amount of key data, leading to key leakage. Once keys are leaked, malicious attackers can decrypt protected sensitive information, causing serious problems such as user privacy violations and theft of trade secrets. Summary of the Invention

[0003] This invention addresses the problems of existing technologies by providing a key management method based on distributed blockchain. It eliminates the risk of single points of failure by evenly distributing key management responsibilities across multiple nodes. This prevents the entire key system from collapsing due to the failure, attack, or control of individual or a few critical nodes, effectively ensuring the continuous and stable operation of the key system. Simultaneously, it significantly improves the system's flexibility and scalability, enabling it to easily adapt to information systems of varying sizes and complexities. Nodes can be easily added or removed, and key management strategies can be flexibly adjusted, thus fully meeting the ever-changing and growing business needs and security requirements.

[0004] The specific solution proposed in this invention is as follows:

[0005] This invention provides a key management method based on a distributed blockchain, comprising:

[0006] Step 1: Generating Key Blocks: The master key generation center selects an elliptic curve to generate private and public keys, and collaborates with the secondary key generation center to split the private key. The split private key is then sent to the user, and the public key information is sent to the blockchain core nodes.

[0007] The core node performs a key signature on the public key information and publishes the signed public key information to the blockchain network. After other nodes verify the public key information, the public key information is added to the Merkle tree as a block. When the core node discovers a legal block, it broadcasts the discovered block to all nodes.

[0008] Step 2: Manage the key according to the block body of the key:

[0009] Step 21: Query the public key of the user: Traverse forward from the latest block through the nodes of the blockchain, and feedback the latest valid key to the node that queries the public key of the user.

[0010] Step 22: Update the key: When there is a need to update the key, the master key generation center generates a new unique identity for the user based on the entity identifier of the user, and re-selects an elliptic curve to generate a new private key and a new public key. Collaborating with the slave key generation center, the new private key is split, and then the split new private key is sent to the user, and the new public key information is sent to the blockchain core node. The core node performs a key signature on the new public key information and publishes it. After the new public key information is verified by other nodes, it is added to the Merkle tree as a block to complete the update.

[0011] Step 23: Revoke the key: When it is necessary to destroy the user's key, a key destruction request is initiated to the core node. The core node verifies the user's identity and permissions, and destroys the key and key-related information according to the user's identity and permissions.

[0012] Furthermore, in step 1 of the described key management method based on a distributed blockchain, the master key generation center selects the secp256k1 elliptic curve. The equation of the secp256k1 elliptic curve is y 2 = x 3 + 7 (mod p). A large integer is randomly selected as the private key dA, satisfying 1 < dA < n - 1, where n is the order of the secp256k1 elliptic curve. The corresponding public key QA is obtained by calculating QA = dA * G, where G is the base point on the secp256k1 elliptic curve.

[0013] Collaborating with the slave key generation center, the private key dA is split into dsA1 and dsA2, and then the split private keys dsA1 and dsA2 are sent to the user, and the public key information is sent to the blockchain core node.

[0014] Furthermore, in step 21 of the described key management method based on a distributed blockchain, querying the public key of the user includes:

[0015] Send the query request to the nodes of the blockchain. Traverse forward from the latest block through the nodes of the blockchain, and feedback the latest valid key to the node that queries the public key of the user.

[0016] The node returns the corresponding public key information, as well as the block and Merkle tree branch information containing the public key information.

[0017] Furthermore, in step 23 of the key management method based on distributed blockchain, when canceling a key, the core node marks the key to be canceled as pending destruction on the blockchain and triggers subsequent operations to encrypt or mark the transaction records related to the key as invalid to prevent unauthorized access and use. In the local key storage, the key-related data is completely deleted, including the private key, public key, and any derived key materials. At the same time, the user status information on the blockchain is updated to indicate that the key has been destroyed, and other relevant nodes are notified to update their local records synchronously.

[0018] This invention also provides a key management system based on a distributed blockchain, comprising: a key generation module and a key management module.

[0019] The key generation module generates key blocks by selecting an elliptic curve to generate private and public keys through the master key generation center. It then collaborates with the slave key generation center to split the private key, sending the split private key to the user and the public key information to the blockchain core nodes.

[0020] The core node performs key signing on the public key information and publishes the signed public key information to the blockchain network. After other nodes verify the public key information, it is added to the Merkle tree as a block. The core node discovers the valid block and broadcasts the discovered block to all nodes.

[0021] The key management module manages keys based on the key block size:

[0022] Step 21: Query the user's public key: By traversing the blockchain from the latest block backwards, the nodes return the latest valid key to the node querying the user's public key.

[0023] Step 22: Key Update: When a key update is needed, the master key generation center generates a new unique identifier for the user based on the user's entity identifier. It then re-selects an elliptic curve to generate a new private key and a new public key. Collaborating with the slave key generation center, the new private key is split and sent to the user. The new public key information is sent to the blockchain core nodes. The core nodes perform key signing and publish the new public key information. After verification by other nodes, the new public key information is added to the Merkle tree as a block, completing the update.

[0024] Step 23: Deregister Key: When it is necessary to destroy a user's key, a key destruction request is sent to the core node. The core node verifies the user's identity and permissions and destroys the key and key-related information according to the user's identity and permissions.

[0025] Furthermore, the key generation module of the key management system based on distributed blockchain selects the secp256k1 elliptic curve through the master key generation center. The equation of the secp256k1 elliptic curve is y 2 = x 3 + 7 (mod p). A large integer is randomly selected as the private key dA, satisfying 1 < dA < n - 1, where n is the order of the secp256k1 elliptic curve. The corresponding public key QA is obtained by calculating QA = dA * G, where G is the base point on the secp256k1 elliptic curve.

[0026] And in cooperation with the slave key generation center, the private key dA is split into dsA1 and dsA2, and then the split private keys dsA1 and dsA2 are sent to the user, and the public key information is sent to the blockchain core node.

[0027] Furthermore, when the key management module of the key management system based on distributed blockchain queries the public key of the user in step 21, it includes:

[0028] Sending the query request to the nodes of the blockchain, traversing forward from the latest block through the nodes of the blockchain, and feeding back the latest valid key to the node querying the public key of the user.

[0029] Returning the corresponding public key information, as well as the block containing the public key information and the Merkle tree branch information, through the said node.

[0030] Furthermore, when the key management module of the key management system based on distributed blockchain cancels the key in step 23, the core node will mark the key to be cancelled as the pending destruction state on the blockchain, and trigger subsequent operations to encrypt or mark as invalid the transaction records related to the key, preventing subsequent illegal access and use; in the local key storage, the relevant data of the key is completely deleted. The relevant data of the key includes the private key, the public key, and any derived key materials. At the same time, the user status information on the blockchain is updated to indicate that the key has been destroyed, and other relevant nodes are notified to synchronously update the local records.

[0031] The advantages of the present invention are:

[0032] Based on blockchain technology, it ensures the integrity and accuracy of the public key and user identity information, reducing the risk of being maliciously tampered with. The strict key generation, distribution, and storage mechanisms improve the security of the cryptographic system and reduce the possibility of key leakage;

[0033] Supporting multiple core nodes and a large number of user nodes through a distributed system architecture, it has good scalability and can adapt to the growing user needs and business scale. Brief Description of the Drawings

[0034] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0035] Figure 1 It is a schematic architecture diagram of the application of the method of the present invention.

[0036] Figure 2 It is a schematic diagram of the Merkle tree related to the present invention.

[0037] Figure 3 It is a schematic diagram of the process of querying the public key of the present invention.

[0038] Figure 4 It is a schematic diagram of the process of updating the key of the present invention. Detailed Embodiments

[0039] The following further illustrates the present invention in conjunction with the drawings and specific embodiments, so that those skilled in the art can better understand the present invention and be able to implement it, but the embodiments cited are not intended to limit the present invention.

[0040] Embodiment 2

[0041] The present invention provides a key management method based on a distributed blockchain, including:

[0042] Step 1: Generate a key block: The master key generation center selects an elliptic curve to generate a private key and a public key, collaborates with the slave key generation center, splits the private key, then sends the split private key to the user, and sends the public key information to the blockchain core node.

[0043] The core node performs key signing on the public key information and publishes the signed public key information to the blockchain network. After other nodes verify the public key information, the public key information is added to the Merkle tree as a block. After the core node discovers a legal block and broadcasts the discovered block to all nodes.

[0044] In step 1, the secp256k1 elliptic curve can be further selected by the master key generation center. The equation of the secp256k1 elliptic curve is y 2 = x 3 + 7 (mod p). Randomly select a large integer as the private key dA, satisfying 1 < dA < n - 1, where n is the order of the secp256k1 elliptic curve. Calculate QA = dA * G to obtain the corresponding public key QA, where G is the base point on the secp256k1 elliptic curve.

[0045] It collaborates with the key generation center to split the private key dA into dsA1 and dsA2, and then sends the split private keys dsA1 and dsA2 to the user, while sending the public key information to the blockchain core node.

[0046] After receiving dsA1 and dsA2, user A obtains the complete private key dA by calculating dA = dsA1 + dsA2 (mod n).

[0047] After the public key information is signed by the core node's key, it is published to the blockchain network through the core node. Other core nodes receive the public key information through the network and add it to their cache queue. When a node starts generating blocks, it retrieves several public key pieces from the cache queue, verifies their validity, and adds them to a new Merkle tree. Figure 2 As shown, this serves as the block body. When a core node discovers a valid block, it broadcasts the discovered block to all nodes. The remaining nodes verify the block's validity upon receiving it. After passing the validity check, the block is added to the blockchain, and based on the information contained in the block, the information cache queue is adjusted, and the next block containing the information is selected from the adjusted cache queue. Whether a node retains the block body depends on whether it contains the public key that needs to be saved.

[0048] Step 2: Manage the key according to the key block:

[0049] Step 21: Query the user's public key: The blockchain nodes traverse backward from the latest block and return the latest valid key to the node querying the user's public key.

[0050] The query for a user's public key includes:

[0051] The query request is sent to the nodes of the blockchain. The nodes then traverse backwards from the latest block and return the latest valid key to the node that is querying the user's public key.

[0052] The node returns the corresponding public key information, as well as the block and Merkle tree branch information containing the public key. Furthermore, users in different system domains can query system parameters on the blockchain, effectively enabling cross-domain communication.

[0053] Step 22: Update Key: When a key update is required, the master key generation center generates a new unique identity for the user based on the user's entity identifier, and re-selects an elliptic curve to generate a new private key and a new public key Q'. In collaboration with the slave key generation center, the new private key is split, and then the split new private key is sent to the user. The new public key information is sent to the blockchain core node, which performs key signing and publishes the new public key information. The new public key information is verified by other nodes and then added to the Merkle tree as a block, completing the update.

[0054] The key update process, initiated by the master key generation center, involves writing the information generated into the blockchain. In this process, the transaction input is the transaction index corresponding to the user key before the update, while the output includes system parameters, user entity identifier, new user identity identifier, new public key Q', and a new expiration date. Once the new key takes effect on the blockchain, the old key automatically becomes invalid. However, the old key is still recorded on the blockchain, ensuring both the traceability of historical information and key archiving functionality.

[0055] Step 23: Deregister Key: When it is necessary to destroy a user's key, a key destruction request is sent to the core node. The core node verifies the user's identity and permissions and destroys the key and key-related information according to the user's identity and permissions.

[0056] In step 23, when canceling the key, the core node marks the key to be canceled as pending destruction on the blockchain and triggers subsequent operations. This includes encrypting or invalidating key-related transaction records to prevent unauthorized access and use; completely deleting all key-related data, including the private key, public key, and any derived key materials, from the local key storage; updating the user state information on the blockchain to indicate that the key has been destroyed; and notifying other relevant nodes to update their local records. The entire key destruction process is fully recorded on the blockchain, forming an immutable audit trail to ensure the traceability and compliance of the destruction operation.

[0057] Example 2

[0058] This invention also provides a key management system based on a distributed blockchain, comprising: a key generation module and a key management module.

[0059] The key generation module generates key blocks by selecting an elliptic curve to generate private and public keys through the master key generation center. It then collaborates with the slave key generation center to split the private key, sending the split private key to the user and the public key information to the blockchain core nodes.

[0060] The core node performs key signing on the public key information and publishes the signed public key information to the blockchain network. After other nodes verify the public key information, it is added to the Merkle tree as a block. The core node discovers the valid block and broadcasts the discovered block to all nodes.

[0061] The key management module manages keys based on the key block size:

[0062] Step 21: Query the user's public key: By traversing the blockchain from the latest block backwards, the nodes return the latest valid key to the node querying the user's public key.

[0063] Step 22: Key Update: When a key update is needed, the master key generation center generates a new unique identifier for the user based on the user's entity identifier. It then re-selects an elliptic curve to generate a new private key and a new public key. Collaborating with the slave key generation center, the new private key is split and sent to the user. The new public key information is sent to the blockchain core nodes. The core nodes perform key signing and publish the new public key information. After verification by other nodes, the new public key information is added to the Merkle tree as a block, completing the update.

[0064] Step 23: Deregister Key: When it is necessary to destroy a user's key, a key destruction request is sent to the core node. The core node verifies the user's identity and permissions and destroys the key and key-related information according to the user's identity and permissions.

[0065] The information interaction and execution process between the modules in the above system are based on the same concept as the method embodiment of the present invention, and the specific details can be found in the description in the method embodiment of the present invention, and will not be repeated here.

[0066] Similarly, the system of this invention, based on blockchain technology, ensures the integrity and accuracy of public keys and user identity information, reducing the risk of malicious tampering. Strict key generation, distribution, and storage mechanisms enhance the security of the cryptographic system and reduce the possibility of key leakage.

[0067] With a distributed system architecture, it supports multiple core nodes and a large number of user nodes, has good scalability, and can adapt to the ever-growing user demand and business scale.

[0068] It should be noted that not all steps and modules in the above processes and system structures are mandatory; some steps or modules can be omitted as needed. The execution order of the steps is not fixed and can be adjusted as required. The system structures described in the above embodiments can be physical or logical structures. That is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or they may be implemented by certain components in multiple independent devices.

[0069] The above-described embodiments are merely preferred embodiments provided to fully illustrate the present invention, and the scope of protection of the present invention is not limited thereto. Equivalent substitutions or modifications made by those skilled in the art based on the present invention are all within the scope of protection of the present invention. The scope of protection of the present invention is defined by the claims.

Claims

1. A key management method based on distributed blockchain, characterized by: include: Step 1: Generating Key Blocks: The master key generation center selects an elliptic curve to generate private and public keys, and collaborates with the secondary key generation center to split the private key. The split private key is then sent to the user, and the public key information is sent to the blockchain core nodes. The core node performs key signing on the public key information and publishes the signed public key information to the blockchain network. After other nodes verify the public key information, it is added to the Merkle tree as a block. The core node discovers the valid block and broadcasts the discovered block to all nodes. Step 2: Manage the key according to the key block: Step 21: Query the user's public key: By traversing the blockchain from the latest block backwards, the nodes return the latest valid key to the node querying the user's public key. Step 22: Key Update: When a key update is needed, the master key generation center generates a new unique identifier for the user based on the user's entity identifier. It then re-selects an elliptic curve to generate a new private key and a new public key. Collaborating with the slave key generation center, the new private key is split and sent to the user. The new public key information is sent to the blockchain core nodes. The core nodes perform key signing and publish the new public key information. After verification by other nodes, the new public key information is added to the Merkle tree as a block, completing the update. Step 23: Deregister Key: When it is necessary to destroy a user's key, a key destruction request is sent to the core node. The core node verifies the user's identity and permissions and destroys the key and key-related information according to the user's identity and permissions.

2. The key management method based on a distributed blockchain according to claim 1, wherein in step 1, the secp256k1 elliptic curve is selected by the master key generation center, and the equation of the secp256k1 elliptic curve is y 2 = x 3 + 7 (mod p), a large integer is randomly selected as the private key dA, satisfying 1 < dA < n - 1, where n is the order of the secp256k1 elliptic curve, and the corresponding public key QA is obtained by calculating QA = dA * G, where G is the base point on the secp256k1 elliptic curve It collaborates with the key generation center to split the private key dA into dsA1 and dsA2, and then sends the split private keys dsA1 and dsA2 to the user, while sending the public key information to the blockchain core node.

3. The key management method based on distributed blockchain according to claim 1, characterized in that: Step 21 involves querying the user's public key, including: The query request is sent to the nodes of the blockchain. The nodes then traverse backwards from the latest block and return the latest valid key to the node that is querying the user's public key. The node returns the corresponding public key information, as well as the block and Merkle tree branch information containing the public key information.

4. The key management method based on distributed blockchain according to claim 1, characterized in that: In step 23, when canceling a key, the core node marks the key to be canceled as pending destruction on the blockchain and triggers subsequent operations. The transaction records related to the key are encrypted or marked as invalid to prevent unauthorized access and use. In the local key storage, the key-related data is completely deleted, including the private key, public key, and any derived key materials. At the same time, the user status information on the blockchain is updated to indicate that the key has been destroyed, and other relevant nodes are notified to update their local records synchronously.

5. A key management system based on distributed blockchain, characterized in that: include: Key generation module and key management module, The key generation module generates key blocks by selecting an elliptic curve to generate private and public keys through the master key generation center. It then collaborates with the slave key generation center to split the private key, sending the split private key to the user and the public key information to the blockchain core nodes. The core node performs key signing on the public key information and publishes the signed public key information to the blockchain network. After other nodes verify the public key information, it is added to the Merkle tree as a block. The core node discovers the valid block and broadcasts the discovered block to all nodes. The key management module manages keys based on the key block size: Step 21: Query the user's public key: By traversing the blockchain from the latest block backwards, the nodes return the latest valid key to the node querying the user's public key. Step 22: Key Update: When a key update is needed, the master key generation center generates a new unique identifier for the user based on the user's entity identifier. It then re-selects an elliptic curve to generate a new private key and a new public key. Collaborating with the slave key generation center, the new private key is split and sent to the user. The new public key information is sent to the blockchain core nodes. The core nodes perform key signing and publish the new public key information. After verification by other nodes, the new public key information is added to the Merkle tree as a block, completing the update. Step 23: Deregister Key: When it is necessary to destroy a user's key, a key destruction request is sent to the core node. The core node verifies the user's identity and permissions and destroys the key and key-related information according to the user's identity and permissions.

6. A key management system based on distributed blockchain according to claim 5, characterized in that: The key generation module selects the secp256k1 elliptic curve through the master key generation center. The equation of the secp256k1 elliptic curve is y 2 = x 3 + 7 (mod p). Randomly select a large integer as the private key dA, satisfying 1 < dA < n - 1, where n is the order of the secp256k1 elliptic curve. Calculate the corresponding public key QA = dA * G, where G is the base point on the secp256k1 elliptic curve. It collaborates with the key generation center to split the private key dA into dsA1 and dsA2, and then sends the split private keys dsA1 and dsA2 to the user, while sending the public key information to the blockchain core node.

7. A key management system based on distributed blockchain according to claim 5, characterized in that: In step 21, the key management module queries the user's public key, including: The query request is sent to the nodes of the blockchain. The nodes then traverse backwards from the latest block and return the latest valid key to the node that is querying the user's public key. The node returns the corresponding public key information, as well as the block and Merkle tree branch information containing the public key information.

8. A key management system based on distributed blockchain according to claim 5, characterized in that: When the key management module cancels a key in step 23, the core node marks the key to be canceled as pending destruction on the blockchain and triggers subsequent operations. The transaction records related to the key are encrypted or marked as invalid to prevent unauthorized access and use. In the local key storage, the key-related data is completely deleted, including the private key, public key, and any derived key materials. At the same time, the user status information on the blockchain is updated to indicate that the key has been destroyed, and other relevant nodes are notified to update their local records synchronously.

Images