Distributed key generation method, cross-chain notarization method, medium and equipment

Abstract

The invention discloses a distributed key generation method, a cross-chain notarization method, a medium and equipment, and the method comprises the steps: obtaining the number of current members of a current committee, a temporary public key and a first constant term when a cross-chain request is received on a block chain, and enabling the members of the committee to change dynamically; based on the current member number, the temporary public key and the first constant term, determining first ciphertext information of the current committee member; determining first coefficient information of the current committee members based on the number of the current members, the first constant term and a specified polynomial function; sending the first ciphertext information and the first coefficient information to a block chain, and obtaining second ciphertext information of other current committee members from the block chain; according to the second ciphertext information and the first coefficient information, the private key fragment and the public key fragment of the current committee member are determined, and no party can grasp the complete key fragment, so that the security of the cross-chain process is improved, and frequent attacks of malicious parties are avoided.

Description

Technical Field

[0001] The present invention belongs to the field of cross-chain blockchain technology, and more specifically, relates to a distributed key generation method, a cross-chain notarization method, a medium, and a device. Background Art

[0002] Due to the isolation and closedness of blockchains, as well as the high degree of heterogeneity between chains, the data circulation and value transfer between blockchains have become technical bottlenecks that hinder the widespread application of blockchain technology. "Cross-chain" technology has emerged to solve cross-chain operation problems such as assets and data between different chains and realize the interconnection and interoperability of blockchains. Related technologies propose a notary mechanism, in which blockchains A and B themselves cannot directly interoperate. Usually, a mutually trusted third party is introduced as an intermediary, and this mutually trusted intermediary verifies and forwards cross-chain messages. In this way, although heterogeneous blockchains can be supported across chains, there is a centralization risk, and only exchange can be achieved but not transfer. Therefore, the notary mechanism will introduce the risk of single point failure, and the public identity of the notary committee members is prone to the risk of forced or denial of service (DoS) attacks.

[0003] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present application, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0004] The purpose of the present invention is to provide a distributed key generation method, a cross-chain notarization method, a medium and a device, which are used to solve the problem that single point failure is prone to occur in related technologies and faces more DoS attack risks.

[0005] According to one aspect of an embodiment of the present application, a method for generating a distributed key is provided, the method comprising:

[0006] When a cross-chain request is received on the blockchain, the current number of members of the current committee, as well as the temporary public keys and the first constant term of the current committee members are obtained; the current committee members are related to the time when the cross-chain request is received;

[0007] Determine the first ciphertext information of the current committee members based on the current number of members, the temporary public key and the first constant term;

[0008] Determining first coefficient information of current committee members based on the current number of members, the first constant term, and the specified polynomial function;

[0009] Send the first ciphertext information and the first coefficient information to the blockchain, and obtain the second ciphertext information of other current committee members from the blockchain;

[0010] According to the second ciphertext information and the first coefficient information, the private key shard and the public key shard of the current committee member are determined.

[0011] In some embodiments, the private key shard and the public key shard of the current committee member are determined based on the second ciphertext information and the first coefficient information, including: verifying whether the second ciphertext information received by the current committee member is correct based on the first coefficient information; when the second ciphertext information is correct, determining the private key shard of the current committee member based on the second ciphertext information; and determining the public key shard of the current committee member based on the first coefficient information.

[0012] In some embodiments, after verifying whether the second ciphertext information received by the current committee member is correct based on the first coefficient information, the method further includes: when the second ciphertext information is erroneous, generating an error sharding certificate corresponding to the second ciphertext information; and sending the error sharding certificate to the blockchain.

[0013] In some embodiments, the method also includes: when a new era is reached, the current committee is changed to a historical committee, and the new committee is used as the new current committee, and the transfer request refers to a request to transfer the equity certificate from the first chain to the second chain; the historical public key shards of the historical committee members are written to the blockchain, and the historical public key shards of other historical committee members are obtained from the blockchain; the historical private key shards of the historical committee members are used as the first constant term, and the step of returning to determine the first ciphertext information of the current committee members based on the current number of members, the temporary public key and the first constant term is executed.

[0014] In some embodiments, when a cross-chain request is received on the blockchain, the method further includes: if the current committee is an initial committee, obtaining an initial random number of the initial committee; determining the commitments of the initial committee members based on the initial random number and a first constant term; sending the commitments to the blockchain, and obtaining commitments of other initial committee members from the blockchain.

[0015] In some embodiments, before determining the private key shard and the public key shard of the current committee member based on the second ciphertext information and the first coefficient information, the method further includes: verifying whether the second ciphertext information received by the current committee member is correct based on the commitment.

[0016] According to one aspect of an embodiment of the present application, a method for cross-chain notarization is provided, the method comprising:

[0017] When a cross-chain request is received on the blockchain, a specified number of nodes are randomly selected from the nodes of the blockchain as the current committee members of the corresponding blockchain; any node among the current committee members has a temporary public key and a temporary private key;

[0018] Execute the distributed key generation method provided in any embodiment of the present application to obtain the public key shard and private key shard of the current committee member;

[0019] The cross-chain transaction message is verified based on public key sharding and private key sharding; the cross-chain transaction message is the verification message when the current committee performs cross-chain authentication.

[0020] In some embodiments, the cross-chain transaction message is verified based on the public key sharding and the private key sharding, including: creating a first notarization account of the current committee on the first chain, and creating a second notarization account of the current committee on the second chain; the first chain and the second chain are cross-chain blockchains; the first equity certificate of the required cross-chain is transferred to the notarization account of the first chain; when the transfer of the first equity certificate is completed, the current committee member corresponding to the first notarization account uses the public key sharding to create a first cross-chain message of the completion of the transfer of the first equity certificate, and submits the first cross-chain message to the second chain; according to the private key sharding, the first cross-chain message is verified; when the first cross-chain message is successfully verified, the second equity certificate corresponding to the first equity certificate is deleted on the second chain, and the user who owns the first equity certificate is designated.

[0021] According to one aspect of an embodiment of the present application, a computer medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the distributed key generation method or cross-chain notarization method provided in any embodiment of the present application is implemented.

[0022] According to one aspect of an embodiment of the present application, an electronic device is provided, including: a processor; a memory for storing executable instructions of the processor; the processor executes the executable instructions to enable the electronic device to implement the distributed key generation method or cross-chain notarization method provided in any embodiment of the present application.

[0023] In the technical solution of the present application, when a cross-chain request is received on the blockchain, the current number of members of the current committee, as well as the temporary public key and the first constant term of the current committee members are obtained; the members of the current committee are related to the time when the cross-chain request is received; based on the current number of members, the temporary public key and the first constant term, the first ciphertext information of the current committee members is determined; based on the current number of members, the first constant term and the specified polynomial function, the first coefficient information of the current committee members is determined; the first ciphertext information is sent to the blockchain, and the second ciphertext information of other current committee members is obtained from the blockchain; according to the second ciphertext information and the first coefficient information, the private key sharding and public key sharding of the current committee members are determined; When the cross-chain request is received at different times, the specific members of the current committee are also different, that is, the committee members are dynamically changing, and the committee members send the ciphertext information to the blockchain. Although all nodes on the chain can obtain the ciphertext information, only the members with the temporary private key corresponding to the temporary public key can decrypt and obtain the real value. It is difficult for malicious parties to lock the specific members of the committee, and it is difficult to break through the majority of all participants to obtain more than half of the private key shards and public key shards. In other words, in the distributed key generation process of this application, no party can master the complete private key shards and public key shards, and the identities of committee members are dynamically hidden, which can improve the security of the cross-chain process and avoid frequent attacks by malicious parties.

[0024] It should be understood that the above general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present application, and together with the specification are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0026] Figure 1 The figure schematically shows a flow chart of a method for generating a distributed key provided in an embodiment of the present application.

[0027] Figure 2 The figure schematically shows a flow chart of a method for generating a distributed key provided in an embodiment of the present application.

[0028] Figure 3 The figure schematically shows a flow chart of a method for generating a distributed key provided in an embodiment of the present application.

[0029] Figure 4The figure schematically shows a flow chart of a cross-chain verification method provided in an embodiment of the present application.

[0030] Figure 5 The structural block diagram of an electronic device provided by an embodiment of the present application is schematically shown.

[0031] Figure 6 The structure block diagram of a computer system for implementing an electronic device according to an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0032] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this application will be more comprehensive and complete and fully convey the concept of the example embodiments to those skilled in the art.

[0033] In addition, the features, structures or characteristics described in the present application may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known methods, devices, realizations or operations are not shown or described in detail to avoid blurring the various aspects of the present application.

[0034] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0035] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0036] In order to solve the centralization problem of the notary mechanism, related technologies propose multi-signature and secure multi-party computing methods. The multi-signature mechanism requires several notaries to have complete private keys to sign transactions, that is, the private keys are still in the hands of several people. If an attacker attacks any private key holder, he can still obtain the private key to do evil. Secure multi-party computing eliminates the concept of a single private key and requires notaries to jointly form a private key to complete transaction verification. In this way, the notary does not independently own the complete private key, thereby ensuring security. However, in secure multi-party computing, although the private key is in the hands of multiple notaries, the identity of the notary is public. If the attacker breaks through all notaries at the same time, the private key can still be recovered. Compared with the original multi-signature, it only increases the difficulty of the attacker's attack, but does not avoid it from the underlying technology. If the members of the notary committee are changed regularly and the identities of the notary committee members are hidden, that is, the notary committee members themselves do not know whether they are notary committee members, nor do they know who else is on the notary committee, then the notary committee members cannot collude. For external attackers, in order to succeed in the attack, they must break through the majority of all participants, which is almost impossible to achieve. Therefore, if Figure 1 As shown, the present application provides a method for generating a distributed key to generate corresponding private key fragments and public key fragments for members of a notary committee. The method includes S110 to S150, and the specific steps are as follows.

[0037] S110. When a cross-chain request is received on the blockchain, the current number of members of the current committee, as well as the temporary public keys, the specified polynomial function and the first constant term of the current committee members are obtained; the members of the current committee are related to the time when the cross-chain request is received.

[0038] Specifically, a cross-chain request is a request generated when a user on a chain wants to transfer a stake certificate to another chain. A stake certificate is an electronic certification or certificate of ownership of a digital product. A digital product is a specific digitized work, artwork or commodity that is uniquely identified using blockchain technology, such as digital paintings, pictures, music, videos and 3D models.

[0039] The committee is a notarial organization composed of multiple nodes randomly selected from the blockchain nodes, and the members of the notarial committee are replaced regularly. The current number of members is the number of members of the notarial committee in the current epoch, n, and its specific value can be predetermined. In addition, the epoch can also be understood as a round. This application can be set to rotate the members of the notarial committee every specified period of time. There is a sequence between these epochs. The current epoch is the epoch when the cross-chain request is received on the blockchain. When the time of receiving the cross-chain request is different, the specific members of the current committee are also different, that is, the members of the committee are dynamically changing, and the members of the current committee are related to the time when the cross-chain request is received.

[0040] The temporary public key is an encryption key that a node makes public. Other nodes except the node can use the temporary public key of the node to encrypt information to obtain encrypted information, and then transmit the encrypted information to the node to encrypt the information. At the same time, the temporary public key has a corresponding temporary private key. The node can use the temporary private key to decrypt the received encrypted information and obtain the real information sent by other nodes.

[0041] The specified polynomial function is the calculation function of the information sent by the committee members. For example, the specified polynomial function is Gi, where i represents the serial number of the current committee member. The order of the polynomial function is (t-1), and t can be determined according to the preset signature threshold (t-of-n). Common signature thresholds are 5-of-9, 13-of-19, and 15-of-21. 5-of-9 means that there are 9 members in the committee. At this time, t=5, that is, only 5 of them can recover the committee private key and sign the cross-chain transaction. The first constant term is the constant term of the specified polynomial function, which can be a preset value. The constant term can also be a random number u i , to further increase the complexity of the encryption process. Assuming that the cross-chain request is received on the blockchain at the initial epoch, the private key shard and public key shard are generated for the initial committee to authenticate. A series of calculations and information sharing processes are required between nodes. The current number of members, temporary public key, specified polynomial function and first constant term obtained in this step are the parameters required for the calculation process.

[0042] S120. Determine the first ciphertext information of the current committee members based on the current number of members, the temporary public key, the specified polynomial function and the first constant term.

[0043] Specifically, the first ciphertext information refers to the ciphertext obtained by encrypting the real information using the temporary public key of a committee member. i Committee members need to be identified k The corresponding first ciphertext information ct i,k =ENC epk_k (σ i,k ), where σ i,k = Gi(k), where k represents the kth member of the n committee members. Then for the current committee member P i (i∈n), we can get the first ciphertext information (ct i,1 ,ct i,2 ,……,ct i,n ).

[0044] S130. Determine first coefficient information of current committee members based on the current number of members, the first constant term, and a specified polynomial function.

[0045] Specifically, the first coefficient information is data calculated based on the coefficients of each term in the specified polynomial function, and the first coefficient information can provide a verification basis for the subsequent step of verifying whether the second ciphertext information received by the current committee member is correct. For example, the coefficients of each term of the specified polynomial function Gi are a i,0 、a i,1 , ... and a i,t-1 , that is, if t = 5, then the coefficients of the polynomial function Gi are a i,0 、a i,1 、a i,2 、a i,3 and a i,4 Then the first coefficient information When t=1, the first coefficient information As mentioned before, the constant term specifying the polynomial function Gi can be a random number u i ,Right now It should be understood that x It is a preset function, so the specific value of each coefficient information can be obtained.

[0046] S140: Send the first ciphertext information to the blockchain, and obtain the second ciphertext information of other current committee members from the blockchain.

[0047] Specifically, each node on the blockchain can synchronize the data on the blockchain. Therefore, when the first ciphertext information is sent to the blockchain, other committee members can obtain the first ciphertext information. Only the node with the temporary private key corresponding to the temporary public key used to encrypt the first ciphertext information can decrypt the corresponding first ciphertext information through its own temporary private key pair and obtain the true value included in the first ciphertext information. For example, the current committee member P1 sends the first ciphertext information (ct 1,2 ,ct 1,3 ,……,ct 1,n ) is sent to the blockchain, and the current committee member P2 sends the second ciphertext information (ct 2,1 ,ct 2,3 ,……,ct 2,n ) is sent to the blockchain, so the current committee member P1 can obtain the second ciphertext information (ct 2,1 ,ct 2,3 ,……,ct 2,n ), and use the temporary private key esk_1 to encrypt the second ciphertext information ct 2,1 Decrypt and get the corresponding true value σ 2,1It should be understood that the current committee member P1 can obtain the second ciphertext information sent to the blockchain by (n-1) committee members, and therefore can obtain the true value of the (n-1) second ciphertext information by decrypting it with the temporary private key esk_1.

[0048] S150. Determine the private key shard and the public key shard of the current committee member according to the second ciphertext information and the first coefficient information.

[0049] Specifically, verification is performed based on the second ciphertext information and the first coefficient information to determine whether the second ciphertext information received by the current committee member is incorrect. If it is determined that the second ciphertext information received by the current committee member is incorrect, the calculation of the private key shard and the public key shard using the second ciphertext information is abandoned; if it is determined that the received second ciphertext information is correct, the true value of the second ciphertext information is substituted into the preset private key shard calculation formula to calculate the private key shard, and the first coefficient information is substituted into the preset public key shard calculation formula to calculate the public key shard.

[0050] In the technical solution of the present application, when a cross-chain request is received on the blockchain, the current number of members of the current committee, as well as the temporary public key and the first constant term of the current committee members are obtained; the members of the current committee are related to the time when the cross-chain request is received; based on the current number of members, the temporary public key and the first constant term, the first ciphertext information of the current committee members is determined; based on the current number of members, the first constant term and the specified polynomial function, the first coefficient information of the current committee members is determined; the first ciphertext information is sent to the blockchain, and the second ciphertext information of other current committee members is obtained from the blockchain; according to the second ciphertext information and the first coefficient information, the private key sharding and the public key sharding of the current committee members are determined; in this way, when a cross-chain request is received When the time is different, the specific members of the current committee are also different, that is, the committee members are dynamically changing, and the committee members send the ciphertext information to the blockchain. Although all nodes on the chain can obtain the ciphertext information, only the members with the temporary private key corresponding to the temporary public key can decrypt and obtain the real value. It is difficult for malicious parties to lock the specific members of the committee, and it is difficult to break through the majority of all participants to obtain more than half of the private key shards and public key shards. That is to say, in the distributed key generation process of this application, no party can master the complete private key shards and public key shards, and the identities of the committee members are dynamically hidden, that is, a dynamic hidden committee (DHC) is formed, which can improve the security of the cross-chain process and avoid frequent attacks by malicious parties.

[0051] In some embodiments, Figure 2 As shown, according to the second ciphertext information and the first coefficient information, the private key shard and the public key shard of the current committee member are determined, including the following S210 to S230.

[0052] S210. Verify whether the second ciphertext information received by the current committee member is correct based on the first coefficient information.

[0053] Specifically, substitute the first coefficient information into the formula: And substitute the true value of the second ciphertext information obtained by decryption into the formula: Then compare Is it equal to If the two are equal, it is determined that the second ciphertext information received by the current committee member is correct; otherwise, it is determined that the received second ciphertext information is incorrect.

[0054] S220. When the second ciphertext information is correct, determine the private key shard of the current committee member according to the second ciphertext information.

[0055] Specifically, when the second ciphertext information is correct, the calculation steps of private key sharding and public key sharding are performed to avoid errors in the generated distributed secret key. If it is determined that the received second ciphertext information is correct, the true value of the second ciphertext information is substituted into the preset private key sharding calculation formula to calculate the private key sharding. For example, the private key sharding calculation formula can be: psk_i = ∑ j∈[n] σ j,i , where σ j,i Indicates the current committee member P j Sent to current committee members P i The true value of the second ciphertext information.

[0056] S230. Determine the public key fragment of the current committee member according to the first coefficient information.

[0057] Specifically, the first coefficient information is substituted into a preset public key sharding calculation formula to calculate the public key sharding. Calculate the private key gsk_i = ∑ j∈[n u j , then the public key sharding calculation formula for each committee member can be: Where l represents the serial number of the committee member.

[0058] In some embodiments, after verifying whether the second ciphertext information received by the current committee member is correct based on the first coefficient information, the method further includes: when the second ciphertext information is erroneous, generating an error sharding certificate corresponding to the second ciphertext information; and sending the error sharding certificate to the blockchain.

[0059] Specifically, the error shard proof is used to notify other committee members that they have received an incorrect ciphertext shard, and then send [write request, cross-chain request, error shard proof] to the blockchain. For example, the error shard proof can be a zero-knowledge proof π, or other specified values ​​or strings.

[0060] In some embodiments, Figure 3 As shown, the method also includes S310 to S330, and the specific process is as follows.

[0061] S310. When a new era is reached, the current committee is changed to the historical committee, and the new committee becomes the new current committee.

[0062] Specifically, when a new era is reached, the committee members need to be replaced, and then the private key shards and public key shards of the new committee for authentication are recalculated. Replacing the committee members means that the current committee becomes the historical committee, and the new committee becomes the current committee. It should be understood that the number of committee members before and after the replacement may be different. For example, the previous committee (that is, the historical committee referred to in this application) has a total of c1 members, and the new current committee has a total of c2 members. Then the signature threshold of the historical committee is t1, and the signature threshold of the new current committee is t2.

[0063] S320, write the historical public key shards of the historical committee members to the blockchain, and obtain the historical public key shards of other historical committee members from the blockchain.

[0064] Specifically, members of the History Committee P j Write its own historical public key shard to the blockchain, that is, write [transfer request, cross-chain request, historical public key shard ppk_j(j∈c1)] to the blockchain. Correspondingly, other members of the historical committee also write their own historical public key shards to the blockchain accordingly, so the historical committee member P j Other historical public key shards can be obtained from the blockchain.

[0065] S330: Use the historical private key shards of the historical committee members as the first constant term, and return to execute the step of determining the first ciphertext information of the current committee members based on the current number of members, the temporary public key and the first constant term.

[0066] Specifically, Historical Committee member P jSelect a polynomial Gi of order (t2-1) so that the constant term of the polynomial is its own historical private key shard psk_j, which can also be understood as taking the historical private key shard psk_j as the new first constant term. In this embodiment, the step of determining the first ciphertext information of the current committee member based on the current number of members, the temporary public key and the first constant term refers to performing encryption operations based on the new current number of members c2, the temporary public key of the new committee member and the historical private key shard psk_j to obtain the new first ciphertext information. For example, corresponding to the new current committee member k∈c2, let σ i，k = Gi(k), and encrypt it using the temporary public key of committee member k to obtain the new first ciphertext information c i，k =ENC(σ i，k ).

[0067] In another embodiment, the Ring VRF (Verifiable Random Function) protocol developed based on Zero-Knowledge Proof (ZKP) technology randomly assigns committee members for each epoch.

[0068] Specifically, the Ring VRF protocol randomly generates ZK proofs (zero-knowledge proofs) for certain nodes. This zero-knowledge proof can represent the temporary identity of the committee members. The committee members recognize and communicate with each other through temporary identities to collaborate on a task, such as threshold signatures during notarization. This ensures that the dynamic hidden committee members are anonymous both to the outside world and to each other.

[0069] In another embodiment, any node on the blockchain has a trusted execution hardware (TEE), which implements security protection through hardware isolation and cryptographic protection. Trusted execution hardware usually consists of two parts: a secure processor and trusted execution hardware software. The secure processor is a specialized hardware that is usually embedded in devices such as mobile phones, tablets, and smart cards. It is independent of the main processor and has its own memory and processing power. The trusted execution hardware software runs on the secure processor, which provides a protected execution environment that can run trusted applications. Therefore, the trusted execution hardware can be regarded as a secure black box, and the committee members can generate the private key shard and public key shard of the node in the trusted execution hardware to ensure that the key generation process is trustworthy and no one can get the complete committee key.

[0070] In some embodiments, when a cross-chain request is received on the blockchain, the method further includes: if the current committee is an initial committee, obtaining an initial random number of the initial committee; determining the commitments of the initial committee members based on the initial random number and a first constant term; sending the commitments to the blockchain, and obtaining commitments of other initial committee members from the blockchain.

[0071] Specifically, as mentioned above, the initial committee in this embodiment refers to the committee when the cross-chain request is received. This name is used to distinguish the previous and next committees when the committee is rotated. It does not mean that the initial committee is the committee in the first epoch. i Refers to a random number generated after receiving a cross-chain request. In cryptography, cryptographic commitments involve a committer and a verifier. For example, a current committee member calculates the commitment where r i is a random number. i Sent to the blockchain, committing to c i Sent to the verifier (i.e. other current committee members). At the same time, the current committee member P i Other current committee members P can also be obtained from the blockchain j Commitment c sent to the blockchain j , and the current committee member P i Can also serve as a verifier.

[0072] In some embodiments, before determining the private key shard and the public key shard of the current committee member based on the second ciphertext information and the first coefficient information, the method further includes: verifying whether the second ciphertext information received by the current committee member is correct based on the commitment.

[0073] Specifically, cryptographic commitment usually includes a commitment phase and a reveal phase. The commitment phase is the above-mentioned generation of commitment c i The revealing process is the process in which the verifier compares the received commitment with the recalculated commitment. i According to other members P j The computational commitment revealed j , re-calculate the commitment c j process, get commitment j ′, then compare the commitment c j and promise c j ′. If they are consistent, the verification is successful; otherwise, the verification fails. That is, if the current committee member P i Received Commitment c j and the recalculated commitment c j’ are equal, the second ciphertext information received by the current committee member is correct, otherwise the second ciphertext information is incorrect.

[0074] The following is an explanation of the distributed key generation process of the present application through specific examples.

[0075] At time T1, the cross-chain application sid is received on the blockchain, and c1 nodes P are randomly selected from all blockchain nodes. i As a member of the current committee, t1 of them can recover the private key of the current committee. Each current committee member P i Each is associated with a temporary public key epk_i and has a corresponding temporary private key esk_i, where the temporary public key is public and the temporary private key is kept privately by the committee members.

[0076] When receiving the cross-chain application sid on the blockchain, each current committee member P i Perform the following steps.

[0077] Choose a random number u i , calculate commitment where r i is a random number. i ] is sent to the blockchain and waits for all nodes on the blockchain to broadcast c i The commitment i The random number u used to hide each current committee member i , and prove that it has the correct u in the subsequent calculation process i , to indicate that it is the node that handles the cross-chain request sid.

[0078] Current Committee Members i Select a polynomial Gi of order (t1-1) such that Gi(0) = u i , that is, the random number u i is the constant term of the polynomial Gi.

[0079] For every number k from 1 to c1, let σ i,k = Gi(k), and encrypt it using the kth temporary public key to obtain the first ciphertext information ct i,k =ENC epk_k (σ i,k ).

[0080] Let the coefficient of the polynomial be a i,0 、a i,1 , ... and a i,t1-1 , calculate the first coefficient information

[0081] Write [write request, cross-chain request, first ciphertext information (ct i,1 ,ct i,2 ,……,ct i,n )] is sent to the blockchain.

[0082] Send [read request, cross-chain request] to the blockchain, obtain the second ciphertext information of other current committee members stored on the blockchain, and then use its own temporary private key esk_i to decrypt the obtained second ciphertext information to obtain (c1-1) σ j,i , where j≠i.

[0083] Check Commitment c i Is it equal to

[0084] Check whether the ciphertext fragmentation is correct, that is, compare Is it equal to If the two are not equal, then the current committee member P i Generate a zero-knowledge proof π to prove that it has received the wrong ciphertext shard, and send [write request, cross-chain request, zero-knowledge proof] to the blockchain. If the two are equal, calculate the current committee member P i The private key fragment psk_i = ∑ j∈[n] σ j,i . Assume that the public key is calculated Calculate the private key gsl_i = ∑ j∈[n u j , then the public key sharding calculation formula for each committee member can be: Where l represents the serial number of the committee member.

[0085] Returns [cross-chain request, private key shard psk_i, public key shard ppk_j] to the blockchain.

[0086] At this point, all current committee members have generated corresponding private key shards and public key shards, and no party has the complete private key and public key.

[0087] When cross-chain is performed, it is also necessary to rotate the committee, rotate the initial committee in the above process to a new committee, and combine the private key shards and public key shards generated by the above initial committee to generate new private key shards and public key shards of the current committee. The specific process is as follows.

[0088] Set the new current committee member to Q i , which has a temporary public key epk_i and a corresponding temporary private key esk_i. The new current committee has a total of c2 nodes, of which t2 members can recover the private key of the current committee.

[0089] After receiving [transfer request, cross-chain request, public key shard ppk_j] on the blockchain, historical committee member P i (i.e., initial committee members) can read the public key fragments sent by other historical committee members from the blockchain.

[0090] Historical Committee Member P i Select a polynomial Gi of order (t2-1) such that Gi(0) = psk_j, where psk_j is the member of the historical committee P i Its own private key shard.

[0091] For every number k from 1 to c2, let σ i,k = Gi(k), and encrypt it using the kth temporary public key to obtain the new first ciphertext information ct i,k =ENC epk_k (σ i,k ).

[0092] Let the coefficient of the polynomial be a i,0 、a i,1 , ... and a i,t2-1 , calculate the first coefficient information Among them A i,0 Equal to the public key shard ppk_j of other historical committee members.

[0093] [write request, cross-chain request, (ct i,1 ,……,ct i,t2-1 )] is sent to the blockchain, and then waits until all members of the historical committee have completed broadcasting the new second ciphertext information (ct j,1 ,……,ct j,t2-1 ). [Write request, cross-chain request, (A i,1 , ..., A i,t2-1 )] is sent to the blockchain.

[0094] After completing the above process, the new current committee member Q i Read the cross-chain request on the blockchain and use the temporary private key to decrypt the ciphertext information to get And read from the blockchain

[0095] Check Current Committee Members Q i Whether the received ciphertext fragments are correct, such as comparing Is it equal to if and If they are not equal, then the current committee member Q i A proof of faulty sharding will be generated, such as a zero-knowledge proof, and then [write request, cross-chain request, proof of faulty sharding] will be sent to the blockchain. and If they are equal, then the valid message set of the initial committee is I, and the size of this set I is t1, which is the number of members of the initial committee. Then the global private key shard of the current committee is npsk i =∑ j∈I λ j *σ j,i ,in Then the current committee member Q i The public key fragment is

[0096] Finally, output [rotation request, cross-chain request sid, (private key shard npsk i , public key shard {nppk_j} j∈[c2] )]. At this time, the committee selects c1 P i Rotation is c2 Q i , and the temporary public key of the current committee remains unchanged after the rotation, but new public key shards and private key shards are generated.

[0097] The following introduces the cross-chain notarization method of this application, such as Figure 4 As shown, the method includes S410 to S430, and the specific steps are as follows.

[0098] S410. When a cross-chain request is received in the blockchain, a specified number of nodes are randomly selected from the nodes of the blockchain as the current committee members of the corresponding blockchain; any node among the current committee members has a temporary public key and a temporary private key.

[0099] Specifically, at time T1, a cross-chain application sid is received on the blockchain, and c1 nodes P are randomly selected from all blockchain nodes. i As a member of the current committee, t1 of them can recover the private key of the current committee. Each current committee member P i Each is associated with a temporary public key epk_i and has a corresponding temporary private key esk_i, where the temporary public key is public and the temporary private key is kept privately by the committee members.

[0100] S420. Execute the distributed key generation method provided in any embodiment of the present application to obtain the public key fragment and the private key fragment of the current committee member.

[0101] Specifically, the specific implementation process of the distributed key generation method provided by this application has been specifically explained in the above paragraphs and will not be repeated here. It should be noted that in this application, the current committee in different epochs is dynamically changing, and according to the above distributed key generation process, the private key shards and public key shards corresponding to different epochs can be obtained.

[0102] S430. Verify the cross-chain transaction message based on the public key sharding and the private key sharding; the cross-chain transaction message is the verification message when the current committee performs cross-chain authentication.

[0103] Specifically, if the user wants the cross-chain bridge he created to support 10 chains, he needs to create 10 dynamic hidden committees, and each chain corresponds to 1 dynamic hidden committee. The cross-chain transaction message sent to a chain needs to be verified by the dynamic hidden committee. Only when the verification is passed, the subsequent cross-chain transaction steps will be executed.

[0104] In some embodiments, the cross-chain transaction message is verified based on the public key sharding and the private key sharding, including: creating a first notarization account of the current committee on the first chain, and creating a second notarization account of the current committee on the second chain; the first chain and the second chain are cross-chain blockchains; the first equity certificate of the required cross-chain is transferred to the notarization account of the first chain; when the transfer of the first equity certificate is completed, the current committee member corresponding to the first notarization account uses the public key sharding to create a first cross-chain message of the completion of the transfer of the first equity certificate, and submits the first cross-chain message to the second chain; according to the private key sharding, the first cross-chain message is verified; when the first cross-chain message is successfully verified, the second equity certificate corresponding to the first equity certificate is deleted on the second chain, and the user who owns the first equity certificate is designated.

[0105] Specifically, the current committee creates notarization accounts on the first chain and the second chain respectively, which are used to verify the cross-chain transaction messages when the first chain and the second chain conduct cross-chain transactions, so as to verify the correctness of the cross-chain transaction messages received by the first chain or the second chain, and avoid erroneous messages causing data errors in the blockchain, or malicious parties forging keys to tamper with data, etc. The notarization account can be understood as a transit account for temporarily storing the equity certificates that need to be transferred. For example, in the process of converting the first equity certificate of the first chain to the second equity certificate in the second chain, the first equity certificate is first transferred to the notarization account of the first chain. Then, the current committee member corresponding to the first notarization account is created, and the first cross-chain message is created using the public key shard of the current committee member, and the first cross-chain message is submitted to the second chain to inform the second chain that the first equity certificate has been transferred to the first notarization account. The second chain verifies the first cross-chain message through the private key shard to determine the authenticity of the first cross-chain message. If the first cross-chain message is true, the first cross-chain message verification is successful, and then the second equity certificate corresponding to the first equity certificate is deleted on the second chain, and the user who owns the first equity certificate in the second chain is specified, thereby transferring the first equity certificate from the first chain to the specified user in the second chain.

[0106] The electronic equipment of this application is introduced below, such as Figure 5As shown, the present application provides an electronic device, which includes: a processor 510 and a memory 520, the memory 520 is used to store executable instructions of the processor; the processor 510 executes the executable instructions to enable the electronic device to implement the distributed key generation method or cross-chain verification method provided by any embodiment of the present application.

[0107] Specifically, the distributed key generation method or cross-chain verification method provided by any embodiment of the present application is stored in the memory 520 of the electronic device, and the distributed key generation method provided by any embodiment of the present application is executed by the processor 510, so that the committee members are dynamically changed. Although all nodes on the chain can obtain the ciphertext information, only members with temporary private keys corresponding to temporary public keys can decrypt and obtain the true value. It is difficult for malicious parties to lock specific members of the committee, and it is difficult to break through the majority of all participants to obtain more than half of the private key shards and public key shards. That is to say, in the distributed key generation process of the present application, no party can master the complete private key shards and public key shards, and the identity of the committee members is dynamically hidden, that is, a dynamic hidden committee (DHC) is formed, which can improve the security of the cross-chain process and avoid frequent attacks by malicious parties. Alternatively, the cross-chain verification method provided by any embodiment of the present application is executed by the processor 510 to complete the cross-chain verification through a dynamically hidden committee, ensure the authenticity of the data in the cross-chain transaction process, improve the security of the cross-chain process, and avoid malicious parties tampering with transaction data.

[0108] It should be known that the specific implementation content of the electronic device in the present application has been explained in detail in the corresponding method embodiment and will not be repeated here.

[0109] Figure 6 The structure block diagram of a computer system for implementing an electronic device according to an embodiment of the present application is schematically shown.

[0110] It should be noted that Figure 6 The computer system 600 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0111] like Figure 6As shown, the computer system 600 includes a processor 601, which can be a CPU (Central Processing Unit) or an MCU (Microcontroller Unit). The processor 601 can perform various appropriate actions and processes according to the program stored in the read-only memory 602 (Read-Only Memory, ROM) or the program loaded from the storage part 608 to the random access memory 603 (Random Access Memory, RAM). In the random access memory 603, various programs and data required for system operation are also stored. The processor 601, the read-only memory 602 and the random access memory 603 are connected to each other through a bus 604. The input / output interface 605 (Input / Output interface, i.e., I / O interface) is also connected to the bus 604.

[0112] The following components are connected to the input / output interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a local area network card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed so that a computer program read therefrom is installed into the storage section 608 as needed.

[0113] In particular, according to an embodiment of the present application, the process described in each method flow chart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer readable medium, and the computer program contains a program code for executing the method shown in the flow chart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, various functions defined in the system of the present application are executed.

[0114] It should be noted that the computer-readable medium shown in the embodiment of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by an instruction execution system, device or device or used in combination with it. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0115] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the above-mentioned module, program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0116] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0117] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation method of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the implementation method according to the present application.

[0118] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary technical means in the art that are not disclosed in the present application.

[0119] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A method for generating a distributed key, characterized in that: include: When a cross-chain request is received on the blockchain, the current number of members of the current committee, as well as the temporary public keys, the specified polynomial function and the first constant term of the current committee members are obtained; the members of the current committee are related to the time when the cross-chain request is received; Determine first ciphertext information of current committee members based on the current number of members, the temporary public key, the specified polynomial function and the first constant term; Determining first coefficient information of current committee members based on the current number of members, the first constant term, and a specified polynomial function; Sending the first ciphertext information to the blockchain, and obtaining the second ciphertext information of other current committee members from the blockchain; The private key shard and the public key shard of the current committee member are determined according to the second ciphertext information and the first coefficient information.

2. The method for generating a distributed key according to claim 1, wherein: The determining, according to the second ciphertext information and the first coefficient information, the private key shard and the public key shard of the current committee member includes: Verifying, based on the first coefficient information, whether the second ciphertext information received by the current committee member is correct; When the second ciphertext information is correct, determining the private key shard of the current committee member according to the second ciphertext information; The public key fragment of the current committee member is determined according to the first coefficient information.

3. The method for generating a distributed key according to claim 2, wherein: After verifying whether the second ciphertext information received by the current committee member is correct according to the first coefficient information, the method further includes: When the second ciphertext information is wrong, generating an error fragmentation proof corresponding to the second ciphertext information; The error shard proof is sent to the blockchain.

4. The method for generating a distributed key according to claim 1, wherein: The method further comprises: When a new epoch is reached, changing the current committee to the historical committee, and making the new committee the new current committee; Write the historical public key shards of the historical committee members to the blockchain, and obtain the historical public key shards of other historical committee members from the blockchain; The historical private key shards of the historical committee members are used as the first constant term, and the step of determining the first ciphertext information of the current committee members based on the current number of members, the temporary public key and the first constant term is returned.

5. The method for generating a distributed key according to claim 1, wherein: When a cross-chain request is received on the blockchain, the method further includes: If the current committee is an initial committee, obtaining an initial random number of the initial committee; Determining the commitment of initial committee members based on the initial random number and the first constant term; The commitment is sent to the blockchain, and commitments of other initial committee members are obtained from the blockchain.

6. The method for generating a distributed key according to claim 5, wherein: Before determining the private key shard and the public key shard of the current committee member according to the second ciphertext information and the first coefficient information, the method further includes: Based on the commitment, verify whether the second ciphertext information received by the current committee member is correct.

7. A cross-chain notarization method, characterized in that: include: When a cross-chain request is received in the blockchain, a specified number of nodes are randomly selected from the nodes of the blockchain as current committee members of the corresponding blockchain; any node among the current committee members has a temporary public key and a temporary private key; Execute the distributed key generation method described in any one of claims 1 to 6 provided in this application to obtain the public key shard and private key shard of the current committee member; The cross-chain transaction message is verified based on the public key shard and the private key shard; the cross-chain transaction message is a verification message when the current committee performs cross-chain authentication.

8. The cross-chain notarization method according to claim 7, characterized in that: The verifying the cross-chain transaction message based on the public key shard and the private key shard includes: Creating a first notarization account of the current committee on the first chain, and creating a second notarization account of the current committee on the second chain; the first chain and the second chain are cross-chain blockchains; Transfer the required cross-chain first equity certificate to the notarization account of the first chain; When the transfer of the first equity certificate is completed, the current committee member corresponding to the first notary account uses the public key shard to create a first cross-chain message indicating the completion of the transfer of the first equity certificate, and submits the first cross-chain message to the second chain; Verifying the first cross-chain message according to the private key sharding; When the first cross-chain message verification succeeds, a second equity certificate corresponding to the first equity certificate is deleted on the second chain, and a user who owns the first equity certificate is designated.

9. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the distributed key generation method described in any one of claims 1-6 and the cross-chain notarization method described in any one of claims 7-8.

10. An electronic device, characterized in that: include: processor; A memory, configured to store executable instructions of the processor; The processor executes the executable instructions to enable the electronic device to implement the distributed key generation method as described in any one of claims 1-6 above, and the cross-chain notarization method as described in any one of claims 7-8.

Images