Asynchronous distributed random number protocol based on producer-consumer model and reliable broadcast

Abstract

The invention belongs to the technical field of network security protocols, and particularly relates to an asynchronous distributed random number protocol based on a producer-consumer model and reliable broadcast. The asynchronous distributed random number protocol provided by the invention is constructed under a producer-consumer model, and comprises a producer process, a consumer process and a removal process which run among a plurality of distributed nodes under an asynchronous network environment; each node in the producer process continuously produces a new PVSS commitment and reaches a consensus for the PVSS commitment through a BRB protocol; in the consumer process, each node continuously elects a leader and reveals a secret value hidden in the PVSS commitment generated by the leader at the earliest, and a consensus is achieved for the distributed random number in the round through a BRB-like protocol; and the removal process is responsible for removing the fault node. The method has low communication overhead and calculation cost and extremely high throughput, can be adapted to a real network environment, and can be widely applied to various distributed scenes such as secure multi-party calculation and anonymous communication.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security protocols, and particularly relates to an asynchronous distributed random number protocol. Background Art

[0002] Publicly Verifiable Secret Sharing (PVSS)

[12] is a cryptographic protocol that allows a secret to be split into multiple shares and distributed to multiple participants. In a PVSS with a (t, n) threshold structure, any t of the n participants (0 < t < n) can cooperate to recover the original secret. Different from traditional secret sharing schemes [1], PVSS not only allows participants to recover the secret, but also provides a verification mechanism that enables any third party to check whether the encrypted shares provided by users are correct without knowing the specific content of the secret shares, ensuring the transparency and fairness of the secret sharing process. The PVSS scheme includes the following five algorithms: an initialization algorithm (PVSS.Setup), which generates a key pair (sk i , pk i ) for each participant; a secret distribution algorithm (PVSS.Share), which generates a PVSS commitment and a corresponding validity proof to ensure the correctness of the submitted PVSS commitment; a verification algorithm (PVSS.Verify), which is used to verify the correctness of the submitted commitment; a secret pre-reconstruction algorithm (PVSS.PreRecon), which generates a decryption key for decrypting the committed value; and a secret reconstruction algorithm (PVSS.Recon), which is used to reconstruct the original secret value. In practical applications, PVSS can be widely used in distributed systems such as cryptocurrencies and blockchains.

[0003] Reliable Broadcast (BRB) [2] is a protocol used to ensure the correct transmission of information in a distributed system in an asynchronous network environment, especially when facing malicious or unreliable nodes (collectively referred to as faulty nodes). Its main goal is to ensure that even when some nodes deliberately send incorrect information or cannot work properly (collectively referred to as faulty nodes), other honest nodes can receive the correct message sent by the leader, ensuring that all honest nodes receive the same information, that is, reaching a consensus among the nodes. When the total number of nodes is n, the protocol can tolerate at most Faulty nodes; The BRB protocol achieves the above consensus by broadcasting three types of messages separately: initial message, broadcast by the leader; echo message, broadcast by other nodes after receiving the initial message; ready message, broadcast by other nodes after receiving 2f+1 echo messages or f+1 ready messages. When an honest node i receives 2f+1 ready messages, the protocol ensures that all honest nodes have received the same information. The BRB protocol satisfies the following three important properties: correctness, that is, all honest nodes will output the message sent by the leader under the premise that the leader is honest; consistency, that is, all honest nodes will output the same message regardless of whether the leader is honest or not; termination [3], that is, all honest nodes will eventually reach a consensus on the same message. This protocol is usually used in distributed systems that require high security and fault tolerance, such as blockchain, distributed ledgers, and multi-party computing, to ensure that honest nodes in the system can still maintain consistency and reliability in the event of malicious attacks or network problems.

[0004] A distributed random number protocol [4] aims to generate a publicly verifiable sequence of random values at regular time intervals. The protocol guarantees that all output random values are trustworthy and tamper-proof, which is crucial for a wide range of applications, such as secure multi-party computation, cryptographic primitive initialization, consensus protocols, and Byzantine agreements in distributed systems. A distributed random number protocol should meet the following five important properties: liveness, that is, the protocol can generate random numbers at fixed time intervals, even if there are failures or attacks in the system; bias resistance, that is, the random numbers generated by the protocol must be unbiased and uniformly distributed; unpredictability, that is, the generated random numbers are unpredictable; public verifiability, that is, any participant can independently verify the correctness of the random numbers; guaranteed output delivery, that is, the protocol will generate valid random numbers within each set time interval, even if some participants are malicious, fail to respond, or even try to subvert the protocol. Summary of the Invention

[0005] The purpose of the present invention is to provide a safe and efficient asynchronous distributed random number protocol suitable for asynchronous network environments, so as to meet the urgent demand for distributed random number generation in real network environments.

[0006] The distributed random number protocol (distributed random number generation method) provided by the present invention is based on the producer-consumer model

[11] , uses the Publicly Verifiable Secret Sharing (PVSS)

[12] scheme as the underlying cryptographic primitive, and runs jointly between multiple distributed nodes in an asynchronous network environment. In the producer-consumer model, the producer process continuously generates PVSS commitments, and the consumer process continuously consumes PVSS commitments to generate random numbers. Each node reaches consensus in the producer process and the consumer process respectively through the BRB protocol [2] and the BRB-like protocol. The specific steps are as follows:

[0007] (1) The (t,n) threshold publicly verifiable secret sharing (PVSS)

[12] scheme is used as the underlying cryptographic primitive of the asynchronous distributed random number protocol to share secrets between distributed nodes. The scheme mainly includes the following five algorithms: initialization algorithm (PVSS.Setup), which is used as the initialization algorithm of the asynchronous distributed random number protocol, generates a key pair (sk i ,pk i ); secret distribution algorithm (PVSS.Share), called by each distributed node, the caller divides the secret into n encrypted shares, each share is equipped with a validity proof, forms a PVSS commitment and distributes it to other nodes, where the secret value is hidden in these commitments, realizing the distribution of the secret value; verification algorithm (PVSS.Verify), called by each distributed node, verifies the validity of the received PVSS commitment; secret pre-reconstruction algorithm (PVSS.PreRecon), called by each distributed node, generates a decryption key for decrypting the PVSS commitment; secret reconstruction algorithm (PVSS.Recon), called by each distributed node, is used to reconstruct the secret value and generate a distributed random number.

[0008] (2) Based on Bracha’s reliable broadcast protocol (BRB) [2], a new broadcast protocol is constructed, which is called a BRB-like protocol in this paper and used in the consumer process and removal process of the asynchronous distributed random number protocol. The BRB-like protocol is similar to the BRB protocol process, with the main difference being that the initial message in the BRB protocol, i.e., the initial message, is sent by the leader node, while in the BRB-like protocol, the initial message is sent by multiple honest nodes. In addition, the BRB-like protocol is proven to have the same correctness, consistency, and termination characteristics.

[0009] (3) Design an asynchronous distributed random number protocol based on the producer-consumer model

[11] and reliable broadcast [2], which runs in an authenticated asynchronous network environment. The asynchronous network consists of a public broadcast channel linked in pairs. The distributed nodes in the asynchronous network only accept and process the message when the message is correctly signed. The "broadcast" mentioned above means that all nodes in the protocol will receive the message. The total number of nodes P in the protocol is set to n. Nodes that may destroy the protocol or do not comply with the protocol are called faulty nodes, and their number is at most f, and Always holds true (to simplify the protocol, n=3f+1 can be set); nodes that follow the protocol are considered honest nodes.

[0010] The specific description of the asynchronous distributed random number protocol based on the producer-consumer model and reliable broadcast is as follows: The protocol mainly consists of three designed processes, namely the producer process, the consumer process, and the removal process. The protocol sets the PVSS scheme threshold to t=f+1. In the producer process, nodes continuously generate new PVSS commitments, and all honest nodes reach a consensus on the newly generated PVSS commitment values through the BRB protocol; in the consumer process, after randomly selecting the leader node L, the honest nodes jointly consume the leader’s earliest generated and unconsumed PVSS commitment to generate random numbers, and reach a consensus on the generated distributed random numbers through a BRB-like protocol; in the removal process, the honest nodes remove the faulty nodes and set their status to "removed". The asynchronous distributed random number protocol defines the concept of "round" in the consumer process. "One round" means that an honest node consumes a PVSS commitment to generate a distributed random number R e time period; define the leader queue LQ to record the latest f leader nodes; define the candidate leader list CL to represent the potential leader node, that is, the node that has not been selected as the leader in the past f rounds; define the dictionary CTL, where CTL[i] is a queue that records the PVSS commitments generated by node i in order; define {pk i},LQ,CL,R e-1 ,e,L,CTL is the same global state maintained locally by each node in the protocol, where {pk i} is the public key of each node in the protocol, e is the current round, R e-1 Represents the random value generated in the previous round. The execution process of the asynchronous distributed random number protocol proposed in this invention can be found in Figure 1 Assuming the protocol has been initialized and the PVSS.Setup algorithm is called to generate key pairs for all nodes participating in the protocol, the execution flow of the asynchronous distributed random number protocol proposed in this invention can be described by the above three processes, with details as follows:

[0011] (1) Producer process

[0012] In the producer process, node i calls the secret distribution algorithm (PVSS.Share) in the PVSS scheme to generate a new PVSS commitment (C,π), where C is the encrypted share generated by node i and π is the validity proof corresponding to each share. Then v = (i, C,π) is broadcast as the initial message in the reliable broadcast BRB protocol; other nodes call the verification algorithm (PVSS.Verify) to verify the correctness of the PVSS commitment; if the PVSS commitment is correct, it will eventually be recorded in the CTL[vi] queue maintained locally by each node; otherwise, it means that i is a faulty node and CTL[vi] remains unchanged; the execution steps of the producer process based on the BRB protocol are as follows (see Figure 2 ):

[0013] (1) Node i calls the secret distribution algorithm (PVSS.Share) to generate a commitment value (C,π), then constructs a message (initial,v) and broadcasts it in the BRB protocol, where v = (i,C,π) and initial is the message type;

[0014] (2) After node i receives (initial, v), it calls the verification algorithm (PVSS.Verify) to verify the correctness of the PVSS commitment. If the verification result is correct, i constructs the message (echo, hv) and broadcasts it, where hv is the hash value of v and echo is the message type;

[0015] (3) After node i receives 2f+1 (echo, hv) messages or receives (ready, hv) messages broadcasted by f+1 nodes that have completed step (3), it constructs a message (ready, hv) and broadcasts it, where ready is the message type;

[0016] (4) After node i receives 2f+1 (ready, hv) messages, it saves v in the local CTL[vi] queue; then, each node enters the next round of producer process to continue generating PVSS commitments.

[0017] (2) Consumer Process

[0018] In the consumer process, assuming the current round is e, after randomly selecting a leader L, each node calls the PVSS.PreRecon and PVSS.Recon algorithms to collaboratively reconstruct the secret value hidden in L's earliest generated and unconsumed PVSS commitment. Then, each node generates the distributed random number of this round based on the secret value and the random number of the previous round. Each node in the consumer process reaches a consensus on the distributed random number through a BRB-like protocol. The execution steps of the consumer process based on the BRB-like protocol are as follows (see Figure 3 ):

[0019] (1) Node i calculates the leader node L in the consumer process of this round based on the global state information maintained locally. e-1 mod|CL|], then obtain the earliest unconsumed PVSS commitment v←CTL[L].get() of the leader node L, where v = (j, C, π), j is the leader node. Subsequently, when |CTL[L]| ≥ 1 or the leader's status L.status = removed, update the global state information: 1) remove the head element from the leader queue LQ; 2) add it to the candidate queue CL; 3) if L.status ! = removed, add L to LQ and remove it from CL. Finally, each node i calls the secret pre-reconstruction algorithm (PVSS.PreRecon) to generate the decryption key D of the PVSS commitment i And (recon,D i ) is broadcast as the initial message in a BRB-like protocol, where recon is the message type;

[0020] (2) Node i receives t correct (recon, D i ) message, the secret reconstruction algorithm (PVSS.Recon) is called to recover the secret g hidden in the PVSS commitment value provided by L s , calculate the random number R of this round e =Hash(R e-1 ,g s ), where Hash is a hash function; finally construct the message (reconEcho, e, R e ) and broadcast, where reconEcho is the message type;

[0021] (3) Node i receives 2f+1 (reconEcho,e,R e ) message or receive the (reconReady,e,R) broadcast from f+1 nodes that have completed step (3) e ) message, construct the message (reconReady,e,R e ) and broadcast, where reconReady is the message type;

[0022] (4) Node i receives 2f+1 (reconReady, e, R e ) message, then R e As the distributed random number generated in the current round e; then, each node enters the next round of consumer process to continue generating distributed random numbers.

[0023] (3) Removing the process

[0024] The removal process is used to remove faulty nodes in the producer process. When node j behaves maliciously in the producer process, that is, when j becomes a faulty node, no new values will be added to the queue CTL[j] that records the PVSS commitments generated by node j; therefore, when j is selected as the leader L times |CTL[j]| in the consumer process, CTL[j] will be empty; if j is selected as the leader again and the queue remains empty for a long time in the current round e, the removal process will remove the node; the "long time" refers to the time that exceeds the global parameter Δt set by the protocol; the execution steps of the removal process based on the BRB-like protocol are as follows: (see Figure 4 ):

[0025] (1) Node i uses local timing. If it finds that |CTL[L]| = 0 for more than Δt, it constructs a message (removal, v) as the initial message in the BRB class and broadcasts it, where v = (L, e), L is j, and removal is the message type.

[0026] (2) After node i receives t (removal, v) messages, it constructs a message (removalEcho, v) and broadcasts it;

[0027] (3) After node i receives 2f+1 (removalEcho, v) messages or receives (removalReady, v) messages broadcasted by f+1 nodes that have completed step (3), it constructs the message (removalReady, v) and broadcasts it;

[0028] (4) After node i receives 2f+1 (removalReady, v) messages, it changes the status of the current leader L to removed, that is, L.status = removed, and notifies the consumer process to re-select a leader.

[0029] The asynchronous distributed random number protocol proposed in this invention is constructed under the producer-consumer model. PVSS serves as its underlying cryptographic primitive and includes three main processes: the producer process, the consumer process, and the removal process. These processes run together between multiple distributed nodes in an asynchronous network environment. In the producer process, each node is responsible for continuously producing new PVSS commitments and reaching consensus on these PVSS commitments through the BRB protocol. In the consumer process, each node continuously elects a leader and reveals the secret value hidden in the leader's earliest PVSS commitment. Based on this secret value and the random number of the previous round, the distributed random number of this round is generated, and then a consensus on the distributed random number of this round is reached through a BRB-like protocol. The removal process is responsible for removing faulty nodes through a BRB-like protocol. The distributed random number protocol implemented by this invention in a fully asynchronous network environment has low communication overhead and computational cost, as well as extremely high throughput. It is suitable for real-world network environments and can be widely used in various distributed scenarios such as secure multi-party computing, consensus algorithms, anonymous communication, and blockchain sharding.

[0030] The significance and advantages of the present invention are as follows:

[0031] This paper proposes an efficient and secure distributed random number protocol, which solves the efficiency and security issues of distributed random number generation in asynchronous network environments. By introducing a publicly verifiable secret sharing

[12] mechanism, a producer-consumer model

[11] , and a reliable broadcast [2] protocol, it not only enhances the fault tolerance of distributed systems, but also improves the efficiency of distributed random number protocols, meeting the requirements of modern distributed systems for efficiency, reliability, and security. Its core innovations and advantages are mainly reflected in the following aspects:

[0032] This paper adopts a producer-consumer model, separating the generation and consumption of PVSS commitments. The producer process continuously generates new PVSS commitments and reaches consensus using the PVSS and BRB protocols. The consumer process continuously consumes PVSS commitments, reconstructs secrets, generates distributed random numbers, and reaches consensus through BRB-like broadcast messages. Furthermore, this paper effectively handles node failures by removing processes. This design significantly improves system throughput while ensuring security and liveness.

[0033] The present invention satisfies the key security properties of distributed random number protocols, including liveness, bias resistance, unpredictability, public verifiability, and output delivery guarantees. These properties ensure the security and reliability of the protocol, especially in environments that require tolerance to faulty nodes. In addition, the present invention excels in throughput and response time, with the speed of distributed random number generation being consistent with the speed of consumer processes, significantly outperforming existing solutions [7][8].

[0034] In summary, this invention implements an efficient and secure distributed random number protocol in an asynchronous network through PVSS, reliable broadcast, and a producer-consumer model, addressing many of the efficiency and adaptability challenges of existing protocols. This invention has significant application value in distributed systems requiring high security, reliability, and throughput, such as blockchain, secure multi-party computation, and distributed consensus. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 This is a diagram that provides an overview of the asynchronous distributed random number protocol based on the producer-consumer model and reliable broadcasting proposed by the present invention.

[0036] Figure 2 This is a workflow diagram of the producer process in the distributed random number protocol proposed in the present invention.

[0037] Figure 3 This is a workflow diagram of the consumer process in the distributed random number protocol proposed in the present invention.

[0038] Figure 4 This is a workflow diagram of the removal process in the distributed random number protocol proposed in the present invention.

[0039] Figure 5 This figure is a comparison diagram of the bandwidth required to generate each distributed random number and related work in the asynchronous distributed protocol proposed by the present invention under different numbers of nodes.

[0040] Figure 6 This figure is a comparison chart of the average throughput of distributed random numbers per minute of the asynchronous distributed random number protocol proposed in this invention and related work under different numbers of nodes. DETAILED DESCRIPTION

[0041] The asynchronous distributed random number protocol based on the producer-consumer model and reliable broadcast proposed in this paper uses PVSS as the underlying cryptographic primitive. Under the producer-consumer model, it implements secure and efficient distributed random number generation in an asynchronous network environment based on BRB and BRB-like protocols.

[0042] The present invention uses the (t,n) threshold PVSS

[12] scheme, which mainly includes the following five algorithms: initialization algorithm (PVSS.Setup), generating a key pair for each participant (sk i ,pk i); secret distribution algorithm (PVSS.Share), which generates PVSS commitments and corresponding proofs to ensure the correctness of the submitted PVSS commitments; verification algorithm (PVSS.Verify), which is used to verify the correctness of the submitted commitments; secret pre-reconstruction algorithm (PVSS.PreRecon), which generates the decryption key used to decrypt the commitment value; secret reconstruction algorithm (PVSS.Recon).

[0043] In terms of distributed node consensus in asynchronous networks, this paper adopts BRB[2] and BRB-like protocols to achieve consensus among distributed nodes. Nodes that may break the protocol or do not comply with the protocol are called faulty nodes, otherwise they are honest nodes. If the total number of nodes in the protocol is n, this protocol can tolerate up to Faulty nodes.

[0044] Under the producer-consumer model

[11] , the present invention mainly involves three processes, namely the producer process, the consumer process and the removal process. In the producer process, node i continuously calls the PVSS.Share algorithm to generate PVSS commitments, and other nodes call the PVSS.Verify algorithm to verify the PVSS commitments. All nodes reach a consensus on the PVSS commitments through the BRB protocol and then add them to the corresponding queue CTL[i]. In the consumer process, each node first passes L=CL[R e-1 mod|CL|] calculates the leader L of the current round e, and then all nodes continuously call the PVSS.PreRecon and PVSS.Recon algorithms to consume PVSS commitments and generate new random values, and reach a consensus on the new distributed random values through a BRB-like protocol; the removal process is executed in conjunction with the above two processes. Specifically, in the producer process, if the faulty node j generates an incorrect PVSS commitment, no new values will be added to the CTL[j] maintained by the honest node; in the consumer process, if j is selected as the leader L for |CTL[j]| times, the CTL[j] maintained by the honest node will become empty; when j is selected as the leader L again, if |CTL[L]|=0 for a long time, L will be removed by the removal process, and consensus will be reached through a BRB-like protocol.

[0045] The bandwidth and throughput required for the protocol to generate distributed random numbers were experimentally tested in the present invention. The experimental environment was set up as follows: (1) The Charm Crypto library was used as the encryption library, and the MNT159 asymmetric curve was selected to implement the PVSS scheme; (2) The network was set up as a fully connected P2P network, and nodes were linked through TCP socket programming. The producer process and the consumer process shared a P2P network interface and competed for network resources during operation; (3) Server setting: The experiment was deployed on 128 AWS cloud servers, each server was configured with 2 vCPUs and 4GB RAM, and the servers were distributed in 8 different regions (Canada, Ireland, Ohio, Paris, São Paulo, Seoul, Singapore and Sydney); (4) Operating system and software environment: All servers ran on the Linux ubuntu-bionic-18.04 operating system and the Python version was 3.6.9. Figure 5 The bandwidth required to generate each distributed random number in the asynchronous distributed random number protocol proposed in this invention is described, and compared with other schemes. The bandwidth consumption of this invention is better than Hydrand[7]. Figure 6 The average throughput of distributed random numbers per minute of the asynchronous distributed random number protocol proposed in this invention is described and compared with other schemes. The throughput of this invention is better than Hydrand[7] and SPURT[8].

[0046] References:

[0047] [1]Shamir A.How to share a secret[J].Communications of the ACM,1979,22(11):612-613.

[0048] [2]Bracha G.An asynchronous[(n-1) / 3]-resilient consensus protocol[C] / / Proceedings of the third annual ACM symposium on Principles of distributed computing.1984:154-162.

[0049] [3]Abraham I,Asharov G.Gradecast in synchrony and reliable broadcastin asynchrony with optimal resilience,efficiency,and unconditional security[C] / / Proceedings of the 2022 ACM Symposium on Principles of DistributedComputing.2022:392-398.

[0050] [4]Rabin M O.Transaction protection by beacons[J].Journal of Computerand System Sciences,1983,27(2):256-267.

[0051] [5] I.OnΣ-Protocols,https: / / www.cs.au.dk / ~ivan / Sigma.pdf,Accessed:2025-04-20.

[0052] [6]Fiat A,Shamir A.How to prove yourself:Practical solutions toidentification and signature problems[C] / / Conference on the theory andapplication of cryptographic techniques.Berlin,Heidelberg:Springer BerlinHeidelberg,1986:186-194.

[0053] [7]Schindler P,Judmayer A,Stifter N,et al.Hydrand:Efficientcontinuous distributed randomness[C] / / 2020IEEE Symposium on Security andPrivacy(SP).IEEE,2020:73-89.

[0054] [8]Das S,Krishnan V,Isaac I M,et al.Spurt:Scalabledistributedrandomness beacon with transparent setup[C] / / 2022IEEE Symposium on Securityand Privacy(SP).IEEE,2022:2502-2517.

[0055] [9]Cascudo I,David B.ALBATROSS:publicly attestable batched randomnessbased on secret sharing[C] / / Advances in Cryptology–ASIACRYPT 2020:26thInternational Conference on the Theory and Application of Cryptology andInformation Security,Daejeon,South Korea,December 7–11,2020,Proceedings,PartIII 26.Springer International Publishing,2020:311-341.

[0056]

[10] Cascudo I,David B,Garms L,et al.YOLO YOSO:fast and simpleencryption and secret sharing in the YOSO model[C] / / International Conferenceon the Theory and Application of Cryptology and Information Security.Cham:Springer Nature Switzerland,2022:651-680.

[0057]

[11] Dijkstra E W.Cooperating sequential processes[M] / / The origin ofconcurrent programming:from semaphores to remote procedure calls.New York,NY:Springer New York,2002:65-138.

[0058]

[12] Cascudo I,David B.SCRAPE:Scalable randomness attested by publicentities[C] / / International Conference on Applied Cryptography and NetworkSecurity.Cham:Springer International Publishing,2017:537-556。

Claims

1. An asynchronous distributed random number protocol based on the producer-consumer model and reliable broadcast, characterized in that: The public verifiable secret sharing (PVSS) scheme is used as the underlying cryptographic primitive, running across multiple distributed nodes in an asynchronous network environment. In a producer-consumer model, the producer process continuously generates PVSS commitments, and the consumer process continuously consumes PVSS commitments to generate random numbers. Each node reaches consensus in the producer process and the consumer process through the BRB protocol and the BRB-like protocol respectively. The specific steps are as follows: (1) The (t,n) threshold publicly verifiable secret sharing (PVSS) scheme is used as the underlying cryptographic primitive of the asynchronous distributed random number protocol to share secrets between distributed nodes. The scheme mainly includes the following five algorithms: initialization algorithm (PVSS.Setup), which is used as the initialization algorithm of the asynchronous distributed random number protocol, generates a key pair (sk i ,pk i ); Secret distribution algorithm (PVSS.Share), called by each distributed node, the caller divides the secret into n encrypted shares, each share is equipped with a validity proof, forms a PVSS commitment and distributes it to other nodes, where the secret value is hidden in these commitments, thus realizing the distribution of the secret value; Verification algorithm (PVSS.Verify), called by each distributed node, verifies the validity of the received PVSS commitment; Secret pre-reconstruction algorithm (PVSS.PreRecon), called by each distributed node, generates a decryption key for decrypting the PVSS commitment; Secret reconstruction algorithm (PVSS.Recon), called by each distributed node, is used to reconstruct the secret value and generate a distributed random number; (2) Based on Bracha's reliable broadcast protocol (BRB), a new broadcast protocol is constructed, called a BRB-like protocol, and used in the consumer process and removal process of the asynchronous distributed random number protocol; The BRB-like protocol is similar to the BRB protocol process. The main difference is that the initial message in the BRB protocol is sent by the leader node, while in the BRB-like protocol, the initial message is sent by multiple honest nodes. In addition, the BRB-like protocol is proven to have the same correctness, consistency and termination properties. (3) Design an asynchronous distributed random number protocol based on the producer-consumer model and reliable broadcast, running in an authenticated asynchronous network environment. The asynchronous network consists of a public broadcast channel linked in pairs. The distributed nodes in the asynchronous network only accept and process the message when the message is correctly signed. The "broadcast" mentioned above means that all nodes in the protocol will receive the message. The total number of nodes P in the protocol is set to n. Nodes that may destroy the protocol or do not comply with the protocol are called faulty nodes, and their number is at most f, and Nodes that comply with the protocol are considered honest nodes.

2. The asynchronous distributed random number protocol according to claim 1, wherein: Based on the producer-consumer model, reliable broadcast protocol, and PVSS scheme, the protocol consists of three processes: producer process, consumer process, and removal process. The PVSS scheme threshold is set to t = f + 1. In the producer process, nodes continuously generate new PVSS commitments, and all honest nodes reach a consensus on the newly generated PVSS commitment values through the BRB protocol. In the consumer process, after randomly selecting a leader node L, honest nodes jointly use the leader's earliest generated and unconsumed PVSS commitment to reconstruct L's shared secret value to generate a distributed random number, and then reach a consensus on the distributed random number through a BRB-like protocol. In the removal process, the honest node removes the faulty node and sets its status to "removed". The asynchronous distributed random number protocol defines the concept of "round" in the consumer process. "One round" means that the honest node consumes a PVSS commitment to generate a distributed random number R e time period; define the leader queue LQ to record the latest f leader nodes; define the candidate leader list CL to represent potential leader nodes, that is, the nodes that have not been selected as leaders in the past f rounds; Define a dictionary CTL, where CTL[i] is a queue that records the PVSS commitments generated by node i in order; define {pk i },LQ,CL,R e-1 ,e,L,CTL is the same global state maintained locally by each node in the protocol, where {pk i } is the public key of each node in the protocol, e is the current round, R e-1 represents the random value generated in the previous round; the overall overview of the asynchronous distributed random number protocol proposed in this invention can be seen in Figure 1; assuming that the protocol has been initialized and key pairs are generated for all nodes participating in the protocol by calling the PVSS.Setup algorithm, the execution flow of the asynchronous distributed random number protocol proposed in this invention can be described by the above three processes, with details as follows: (1) In the producer process, node i calls the secret distribution algorithm (PVSS.Share) in the PVSS scheme to generate a new PVSS commitment (C,π), where C is the encrypted share generated by node i and π is the validity proof corresponding to each share. Then v = (i, C,π) is broadcast as the initial message in the reliable broadcast BRB protocol; other nodes call the verification algorithm (PVSS.Verify) to verify the correctness of the PVSS commitment; if the PVSS commitment is correct, it will eventually be recorded in the CTL[vi] queue maintained locally by each node; otherwise, it means that i is a faulty node and CTL[vi] remains unchanged. The execution steps of the producer process based on the BRB protocol are as follows: (1) Node i calls the secret distribution algorithm (PVSS.Share) to generate a commitment value (C,π), then constructs a message (initial,v) and broadcasts it in the BRB protocol, where v = (i,C,π) and initial is the message type; (2) After node i receives (initial, v), it calls the verification algorithm (PVSS.Verify) to verify the correctness of the PVSS commitment. If the verification result is correct, i constructs the message (echo, hv) and broadcasts it, where hv is the hash value of v and echo is the message type; (3) After node i receives 2f+1 (echo, hv) messages or receives (ready, hv) messages broadcasted by f+1 nodes that have completed step (3), it constructs a message (ready, hv) and broadcasts it, where ready is the message type; (4) After node i receives 2f+1 (ready, hv) messages, it saves v in the local CTL[vi] queue; then, each node enters the next round of producer process to continue generating PVSS commitments; (2) In the consumer process, assuming the current round is e, after randomly selecting a leader L, each node calls the PVSS.PreRecon and PVSS.Recon algorithms to collaboratively reconstruct the secret value hidden in L's earliest generated and unconsumed PVSS commitment. Then, each node generates the distributed random number of this round based on the secret value and the random number of the previous round. Each node reaches a consensus on the distributed random number through a BRB-like protocol. The execution steps of the consumer process based on the BRB-like protocol are as follows: (1) Node i calculates the leader node L in the consumer process of this round based on the global state information maintained locally. e-1 mod|CL|], then obtain the earliest unconsumed PVSS commitment v←CTL[L].get() of the leader node L, where v=(j,C,π), j is the leader node; then, when |CTL[L]|≥1 or the leader's status L.status=removed, update the global status information: 1) remove the head element from the leader queue LQ; 2) add it to the candidate queue CL; 3) if L.status !=removed, add L to LQ and remove it from CL; finally, each node i calls the secret pre-reconstruction algorithm (PVSS.PreRecon) to generate the decryption key D of the PVSS commitment i And construct the message (recon,D i ) is broadcast as the initial message in a BRB-like protocol, where recon is the message type; (2) Node i receives t correct (recon, D i ) message, the secret reconstruction algorithm (PVSS.Recon) is called to recover the secret g hidden in the PVSS commitment value provided by L s , calculate the random number R of this round e =Hash(R e-1 ,g s ), where Hash is a hash function; finally construct the message (reconEcho, e, R e ) and broadcast, where reconEcho is the message type; (3) Node i receives 2f+1 (reconEcho,e,R e ) message or receive the (reconReady,e,R) broadcast from f+1 nodes that have completed step (3) e ) message, construct the message (reconReady,e,R e ) and broadcast, where reconReady is the message type; (4) Node i receives 2f+1 (reconReady, e, R e ) message, then R e As the distributed random number generated in the current round e; Afterwards, each node enters the next round of consumer process to continue generating distributed random numbers; (3) The removal process is used to remove faulty nodes in the producer process. When node j behaves maliciously in the producer process, i.e., when node j becomes a faulty node, no new values will be added to the queue CTL[j] that records the PVSS commitments generated by node j. Therefore, when j is selected as the |CTL[j]| secondary leader L in the consumer process, CTL[j] will be empty. If j is elected as the leader again and the queue remains empty for a long time in the current round e, the removal process will remove the node; the "long time" mentioned here means that the time exceeds the global parameter Δt set by the protocol. The execution steps of the removal process based on the BRB-like protocol are as follows: (1) Node i uses local timing. If it finds that |CTL[L]| = 0 for more than Δt, it constructs a message (removal, v) as the initial message in the BRB class and broadcasts it, where v = (L, e), L is j, and removal is the message type. (2) After node i receives t (removal, v) messages, it constructs a message (removalEcho, v) and broadcasts it; (3) After node i receives 2f+1 (removalEcho, v) messages or receives (removalReady, v) messages broadcasted by f+1 nodes that have completed step (3), it constructs the message (removalReady, v) and broadcasts it; (4) After node i receives 2f+1 (removalReady, v) messages, it changes the status of the current leader L to removed, that is, L.status = removed, and notifies the consumer process to re-select a leader.

Images