Method and device for realizing data security exchange in distributed network

Abstract

The invention relates to the technical field of data encryption exchange, in particular to a method and a device for realizing data security exchange in a distributed network. The method comprises the following steps: generating a first secret value by a main node, and processing the first secret value to obtain a plurality of fragments; sending at least two fragments selected from the plurality of fragments to each child node; the child node reconstructs based on the received fragments to obtain a second secret value; the second secret value is sent to the main node; and if the first secret value is the same as the second secret value, the main node and the child nodes jointly construct a distributed network, and data exchange is performed in the distributed network. According to the invention, safe and efficient data exchange can be realized in the distributed network.

Description

Technical Field

[0001] This invention relates to the field of data encryption and exchange technology, and in particular to a method and apparatus for achieving secure data exchange in a distributed network. Background Technology

[0002] In distributed networks, data transmission is typically encrypted to ensure secure data exchange between multiple nodes. A traditional method for secure data exchange involves each node generating a key pair, consisting of a private key and a public key. The private key is stored locally by the node that generated it, while the public key is distributed to other nodes in the network using a specific key exchange method. These nodes then use the public key to encrypt or decrypt data. While this method effectively enhances data transmission security, it also has limitations. For example, traditional methods lack an effective trust mechanism among the nodes exchanging data. The master node struggles to determine the trustworthiness of other nodes, leading to risks of data tampering, theft, or forgery during transmission. Furthermore, the lack of a collaborative mechanism prevents nodes from spontaneously building a unified and trustworthy data exchange environment, thus impacting the overall security and reliability of the network.

[0003] Therefore, overcoming the shortcomings of the existing technology is an urgent problem to be solved in this technical field. Summary of the Invention

[0004] In view of the above-mentioned defects or improvement needs of the existing technology, the present invention proposes a method and apparatus for realizing secure data exchange in a distributed network, which realizes secure and efficient data exchange and can avoid the inconvenience caused by key management in the existing technology.

[0005] The embodiments of the present invention adopt the following technical solutions: In a first aspect, the present invention provides a method for achieving secure data exchange in a distributed network, specifically comprising: a master node generating a first secret value, processing the first secret value to obtain multiple fragments; and sending at least two fragments selected from the multiple fragments to each child node; The child node reconstructs the data based on the received fragment to obtain the second secret value; and then sends the second secret value to the master node. If the first secret value is the same as the second secret value, the master node and the child node jointly construct a distributed network and exchange data in the distributed network.

[0006] Preferably, the master node generates a first secret value, processes the first secret value to obtain multiple shards, including: Set the total number of fragments and the recovery threshold; The first secret value is used as a constant term, and multiple higher-order terms are randomly generated to construct a polynomial containing the constant term and multiple higher-order terms; wherein the number of higher-order terms is one less than the number of recovery thresholds; Assign a unique number to each shard to be generated; the total number of numbers is equal to the total number of shards. Calculate the function value corresponding to an index in a polynomial; treat the index and its corresponding function value as a slice; Calculate the function value corresponding to each number in turn until all numbers have been calculated, and obtain all fragments.

[0007] Preferably, the child node reconstructs the second secret value based on the received fragment, including: Receive fragments; wherein the number of fragments is greater than or equal to the recovery threshold number; For a piecewise segment, construct the basic polynomial corresponding to the piecewise segment; Obtain the function value in the slice; multiply the basic polynomial by the function value to obtain the weighted polynomial corresponding to the slice; Add the weighted polynomials corresponding to all the segments to obtain the reconstructed polynomial; obtain the constant term of the reconstructed polynomial and use the constant term as the second secret value.

[0008] Preferably, constructing the fundamental polynomial corresponding to a piecewise segment includes: Get the target number of the current fragment; get the non-target number of the non-target fragment; For the current slice, calculate the difference between the variable and the non-target number to obtain the first intermediate expression; calculate the difference between the target number and the non-target number to obtain the second intermediate expression; Divide the first intermediate expression by the second intermediate expression to obtain the ratio; Repeatedly calculate the ratio of the first intermediate expression to the second intermediate expression until all non-target numbers have been calculated. Multiply all ratios to obtain the basic polynomial corresponding to the segment.

[0009] Preferably, identity authentication can also be performed via a public key certificate before data exchange in the distributed network, wherein the process of a child node applying for the public key certificate includes: The child node generates a first key pair based on the second secret value and the key generation algorithm. The first key pair includes a first public key and a first private key. The child node sends a certificate signing request to the certification authority. The certificate signing request includes the first public key, node identity information, and a certificate signing request signed using the first private key. The authentication center verifies the node's identity based on the node's identity information and uses the first public key to verify the signature validity of the certificate signing request. After successful verification, the certification center generates a digital certificate, digitally signs the content of the digital certificate using the certification center's second private key to obtain a public key certificate, and sends the public key certificate to the child node.

[0010] Preferably, identity authentication via public key certificates includes: The child node sends a connection request to the master node, the connection request including the child node's public key certificate; After receiving the public key certificate, the master node uses the second public key of the certification authority to verify the validity of the digital signature in the public key certificate; and verifies the validity period and revocation status of the public key certificate; After successful verification, the master node exchanges data within the distributed network.

[0011] Preferably, the master node generates a first secret value, processes the first secret value to obtain multiple shards, and sends at least two shards selected from the multiple shards to each child node; the child nodes reconstruct based on the received shards to obtain a second secret value, including: The child node generates a first temporary key pair, which includes a first temporary public key and a second temporary private key. The child node sends the second temporary public key to the master node; The master node uses the second temporary public key to encrypt the fragment, obtaining an encrypted fragment; and then sends the encrypted fragment to the child node; The child node receives the encrypted fragment; decrypts the encrypted fragment using the second temporary private key to obtain the fragment; deletes the temporary key pair, and reconstructs the fragment based on the received fragment to obtain the second secret value.

[0012] Preferably, adding a new node in a distributed network includes: The new node generates a second temporary key pair; the second temporary key pair includes a second temporary public key and a second temporary private key; The new node sends the second temporary public key to other child nodes. The other child nodes sign the second temporary public key with the first private key to obtain a signing certificate, and then send the signing certificate to the master node. The master node verifies the number of signed certificates received; When the number of received signature certificates is greater than or equal to the preset number, the new node is added to the distributed network.

[0013] In a second aspect, the present invention provides an apparatus for implementing secure data exchange in a distributed network, specifically comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the processor to perform the method for implementing secure data exchange in a distributed network as described in the first aspect.

[0014] Thirdly, the present invention also provides a non-volatile computer storage medium storing computer-executable instructions that are executed by one or more processors to perform the method provided by the method described in the first aspect.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: the master node generates a first secret value and sends fragments that are related to but not exactly the same as the first secret value to other nodes. Other nodes reconstruct a second secret value based on the received fragments and send the second secret value to the master node. When the master node determines that the first secret value and the second secret value are the same, it considers the other nodes to be trustworthy. The master node will work with other nodes to jointly build a trustworthy distributed network. In this distributed network, secure data exchange between nodes can be realized. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments of the present invention will be briefly described below. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.

[0017] Figure 1 This is a flowchart illustrating a method for implementing secure data exchange in a distributed network, as provided in an embodiment of the present invention. Figure 2 This is a flowchart illustrating the method for a child node to apply for a public key certificate provided in an embodiment of the present invention; Figure 3 This is a flowchart illustrating an encrypted distribution fragmentation method provided in an embodiment of the present invention; Figure 4 This is a flowchart illustrating a method for adding a new node in a distributed network according to an embodiment of the present invention. Figure 5 This is a schematic diagram of a distributed network containing three nodes provided in an embodiment of the present invention; Figure 6 This is a schematic diagram of a structure for adding a new node in a distributed network according to an embodiment of the present invention; Figure 7This is a schematic diagram of a data security exchange device implemented in a distributed network, provided by an embodiment of the present invention. The accompanying figure is labeled as follows: 21: Processor; 22: Memory. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0019] Unless the context otherwise requires, throughout the specification and claims, the term "comprising" is interpreted as openly inclusive, meaning "including, but not limited to." In the description of the specification, terms such as "one embodiment," "some embodiments," "exemplary embodiment," "example," "specific example," or "some examples" are intended to indicate that a particular feature, structure, material, or characteristic associated with that embodiment or example is included in at least one embodiment or example of this disclosure. The illustrative representations of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics mentioned may be included in any suitable manner in any one or more embodiments or examples; that is, although they may be incorporated into embodiments or examples using the above terms for reasons such as order and position, it does not limit them to be incorporated in combination by a single embodiment or example.

[0020] In the description of this invention, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined with "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of embodiments of this disclosure, unless otherwise stated, "a plurality of" means two or more. Furthermore, for example, the description may use the prefix "A" or "B" to describe the same type of nouns as two independent entities. In this case, the corresponding features defined with "A" and "B" are used only to distinguish between similar entities and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features.

[0021] In the description of this invention, the expression “A and / or B” (where A and B are used to formally represent specific features) will be used. The corresponding expression includes the following three combinations: only A, only B, and a combination of A and B.

[0022] As used in this invention, “about,” “approximately,” or “approximately” includes the stated value and the average value within an acceptable range of deviation from a particular value, wherein the acceptable range of deviation is determined by a person skilled in the art taking into account the measurement under discussion and the error associated with the measurement of the particular quantity (i.e., the limitations of the measurement system).

[0023] Furthermore, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0024] Example 1: like Figure 1 As shown, Embodiment 1 of the present invention provides a method for implementing secure data exchange in a distributed network, specifically including the following steps: Step 101: The master node generates a first secret value, processes the first secret value to obtain multiple shards, and sends at least two shards selected from the multiple shards to each child node.

[0025] In one embodiment, the source of the first secret value can be an external trusted entity or a master node. In this invention, the master node generates the first secret value, which can be a large random number. The master node sets the total number of shards and the recovery threshold. The total number of shards refers to the total number of shards that need to be processed into shards for the first secret value. The recovery threshold refers to the minimum number of shards that the child node needs to collect. The secret value can only be recovered if the number of shards received by the child node is greater than or equal to the recovery threshold. Both the total number of shards and the recovery threshold are configurable parameters that can be flexibly adjusted according to specific needs, thereby better adapting to the dynamic joining and leaving of nodes in the distributed network.

[0026] In one embodiment, setting the recovery threshold to 1 means that any shard can recover the secret value. While this improves recovery efficiency, it contradicts the original intention of the secret value distribution mechanism (to reduce the risk of secret value leakage through distributed storage), resulting in a significant decrease in security. Therefore, the recovery threshold needs to be greater than or equal to 2, requiring at least two shards to be selected from the plurality of shards. Furthermore, setting the recovery threshold too high (close to or equal to the total number of shards) means that almost all shards are needed to recover the secret value, thus losing fault tolerance. Therefore, the recovery threshold is generally set between 50% and 75% of the total number of shards.

[0027] Step 102: The child node reconstructs the data based on the received fragment to obtain the second secret value; and sends the second secret value to the master node.

[0028] In one embodiment, a child node receives shards distributed from a master node; wherein the number of shards is greater than or equal to the recovery threshold number; for a shard, a basic polynomial corresponding to the shard is constructed; the function value in the shard is obtained; the basic polynomial is multiplied by the function value to obtain the weighted polynomial corresponding to the shard; the weighted polynomials corresponding to all shards are summed to obtain the reconstructed polynomial; the constant term of the reconstructed polynomial is obtained, and the constant term is used as the second secret value. After obtaining the second secret value, the child node sends the second secret value to the master node.

[0029] Step 103: If the first secret value is the same as the second secret value, the master node and the child node jointly construct a distributed network and exchange data in the distributed network.

[0030] In one embodiment, the master node receives a second secret value from the child node and compares its own first secret value with the second secret value. If the first secret value is the same as the second secret value, the child node is considered trustworthy. The master node and the child node will jointly build a trustworthy distributed network, in which any communication is secure, and the nodes in the distributed network can exchange data securely.

[0031] In one embodiment, traditional methods for ensuring secure data exchange require pausing data transmission during key updates. This key update process can be time-consuming, temporarily preventing other nodes from encrypting data, which can impact the continuous operation of the network and data interaction. In this embodiment, when the master node and child nodes jointly build a trusted distributed network for the first time, it must ensure beforehand that all participating nodes possess the necessary permissions. These permissions mean that nodes can not only legally join the distributed network but also securely initiate or execute encrypted data exchanges with each other.

[0032] This authorization verification process only needs to be performed once when the distributed network is initially built. After verification, it does not need to be repeated during subsequent data transmission. This effectively avoids system downtime caused by key changes during network operation, ensuring the continuity of data transmission and the stability of the system.

[0033] In this embodiment, the master node generates a first secret value and sends fragments that are related to but not exactly the same as the first secret value to other nodes. Other nodes reconstruct a second secret value based on the received fragments and send the second secret value to the master node. When the master node determines that the first secret value and the second secret value are the same, it considers the other nodes to be trustworthy. The master node will work with other nodes to jointly build a trustworthy distributed network, in which secure data exchange between nodes can be realized.

[0034] In one embodiment, the method for processing the first secret value to obtain multiple shards in step 101 specifically involves: the master node setting the total number of shards and the recovery threshold, using the first secret value as a constant term, and randomly generating multiple higher-order terms to construct a polynomial containing the constant term and the multiple higher-order terms; wherein the number of higher-order terms is one less than the recovery threshold, and the expression of the polynomial is:

[0035] in, The first secret value, These are randomly generated higher-order terms. Each shard to be generated is assigned a unique number, where the total number of numbers equals the total number of shards. The function value corresponding to each number in the polynomial is calculated. Each number and its corresponding function value is considered a shard, and the total number of shards equals the total number of numbers. This process is repeated until all numbers have been calculated, resulting in all shards. After the first secret value is processed into multiple shards, the master node distributes the corresponding number of shards to other child nodes according to the recovery threshold. Each child node receives a different number of shards. For example, if the number is 1, the corresponding function value is... , (1, (2, ) is a partition, and similarly, (2, ), (3, ), (4, Both are shards. When distributing shards to child nodes, taking child node 1 and child node 2 as an example, each child node receives at least two shards. Therefore, child node 1 receives shards (1, 2, 3, 4, 5, 6, 7, 8, 9, 1, 1, 1, 2, 1, 2, 3 ... ) and (2, ), child node 2 receives fragment (3, ) and fragments (4, ).

[0036] In one embodiment, in step 102, the child node reconstructs the second secret value based on the received fragment, specifically by constructing the basic polynomial corresponding to the fragment, wherein the basic polynomial corresponding to the fragment is as follows:

[0037] in, This is the number of the current fragment. Let x be the number of all the fragments received by the child node, excluding the current fragment, and t be the total number of fragments received by the child node.

[0038] In one embodiment, the child node constructs a corresponding basic polynomial for each received fragment, and constructs a final reconstructed polynomial based on the function value and basic polynomial corresponding to each fragment. At this time, the constant term of the reconstructed polynomial is the second secret value. Each time a corresponding basic polynomial is constructed for a fragment, the fragment is called the current fragment, and the fragments received by the child node other than the current fragment are called non-target fragments.

[0039] In one embodiment, constructing a basic polynomial for a slice specifically involves: obtaining the target number of the current slice; obtaining the non-target number of the non-target slice; for the current slice, calculating the difference between the variable and the non-target number to obtain a first intermediate expression; calculating the difference between the target number and the non-target number to obtain a second intermediate expression; dividing the first intermediate expression by the second intermediate expression to obtain a ratio; repeatedly calculating the ratio of the first intermediate expression to the second intermediate expression until all non-target numbers have been calculated; multiplying all ratios to obtain the basic polynomial corresponding to the slice. After obtaining the basic polynomial, obtaining the function value in the current slice; multiplying the basic polynomial by the function value to obtain the weighted polynomial corresponding to the slice; adding the weighted polynomials corresponding to all slices to obtain the reconstructed polynomial; obtaining the constant term of the reconstructed polynomial and using the constant term as the second secret value. The reconstructed polynomial is as follows:

[0040] in, The basic polynomial corresponding to the partition is... The function corresponding to the partition is t, where t is the total number of partitions.

[0041] After a trusted distributed network is built, nodes in the distributed network can exchange data securely. To further ensure secure data exchange between nodes, identity authentication can be performed using public key certificates. Authentication using public key certificates before data communication can prevent nodes from using the generated key pair to communicate with other nodes without authorization.

[0042] like Figure 2 As shown, the method for a child node to apply for a public key certificate provided in this embodiment 1 specifically includes the following steps: Step 201: The child node generates a first key pair based on the second secret value and the key generation algorithm. The first key pair includes a first public key and a first private key.

[0043] In one embodiment, in traditional methods for ensuring secure data exchange, when transmitting data from one node to another, the sending node must select a corresponding public key for each target node to encrypt the data, ensuring that the receiving node can correctly decrypt it. While this method guarantees the security of data exchange, it also introduces significant operational complexity. Because each node in the network needs to accurately identify the recipient and match the correct public key before sending data, this significantly increases the difficulty of communication management and implementation in scenarios with a large number of nodes or frequent communication. In this embodiment, each child node generates a first key pair based on the reconstructed second secret value and a key generation algorithm. The key generation algorithm is agreed upon when constructing the distributed network. Since all child nodes share the same second secret value and key generation algorithm, the generated first key pairs are identical. This mechanism ensures that all nodes in the distributed network can use the same public key to encrypt data, regardless of which specific node sent the data. In other words, each node does not need to perform additional operations to ensure the correct public key is used during encrypted communication.

[0044] Furthermore, in traditional methods for ensuring secure data exchange, each node needs to exchange data securely with other nodes, which requires sending the public key to all other nodes. This is a huge drain on time, space, and computing resources. In this embodiment, however, it is not necessary to send the public key to other nodes, thus saving a significant amount of resources.

[0045] Step 202: The child node sends a certificate signing request to the certification authority. The certificate signing request includes the first public key, node identity information, and a certificate signing request signed using the first private key.

[0046] In one embodiment, the first public key only needs to be provided to the certification authority once when applying for a public key certificate. Subsequent child nodes authenticate themselves using their own private public key certificates before exchanging encrypted data with other nodes, without having to directly transmit the first public key.

[0047] Step 203: The authentication center verifies the node identity based on the node identity information and uses the first public key to verify the signature validity of the certificate signing request.

[0048] Step 204: After successful verification, the certification center generates a digital certificate, digitally signs the content of the digital certificate using the certification center's second private key to obtain a public key certificate, and sends the public key certificate to the child node.

[0049] In one embodiment, a child node only needs to provide its initial public key to a certification authority in the distributed network once. The certification authority then verifies the information, issues a public key certificate to the child node upon successful verification, and transmits it encrypted to the corresponding child node for safekeeping. Subsequently, before exchanging encrypted data with other nodes, the child node can complete authentication using its own certificate without directly transmitting the encrypted public key.

[0050] In addition, the master node also needs to apply for its own dedicated public key certificate. The master node generates a key pair internally based on the first secret value and the agreed-upon key generation algorithm. Since the first secret value used by the master node and the second secret value used by the child nodes are the same, and the agreed-upon key generation algorithm is the same, the key pair generated by the master node is the same as the first key pair generated by the child nodes. When the master node exchanges data with other child nodes, no additional operations are needed to ensure that the correct public key is used during encrypted communication. The method for the master node to apply for a public key certificate is the same as the method for the child nodes to apply for a public key certificate, and will not be repeated here.

[0051] In one embodiment, authentication via public key certificates specifically includes: a child node sending a connection request to the master node, the connection request including the child node's public key certificate; upon receiving the public key certificate, the master node uses a second public key from a certification authority to verify the validity of the digital signature in the public key certificate; ensuring that the public key certificate was issued by an accredited certification authority, and verifying the validity period and revocation status of the public key certificate; further verifying whether attributes such as the owner name, IP address (Internet Protocol), and MAC address (Media Access Control) on the public key certificate match the node; after the master node verifies all information, data exchange can commence in the distributed network. Using public key certificates for authentication further enhances security. During data exchange between nodes, the node's public key does not need to be transmitted, replaced by a more comprehensive and secure public key certificate. The verification process of the public key certificate can also be performed efficiently in one step. Except when applying for a public key certificate, the public key does not need to leave the node, making network operations more secure.

[0052] This invention constructs a trusted distributed network based on whether the first secret value in the master node is the same as the second secret value of other nodes. To further ensure the security of data exchange, when the master node distributes fragments to child nodes, it uses an encrypted fragmentation method for distribution.

[0053] like Figure 3 As shown, the encrypted distribution fragment method provided in this embodiment specifically includes the following steps: Step 301: The child node generates a first temporary key pair, which includes a first temporary public key and a second temporary private key.

[0054] In one embodiment, each child node other than the master node generates a first temporary key pair, which includes a first temporary public key and a second temporary private key. The security of fragment distribution is ensured by the first temporary key pair.

[0055] Step 302: The child node sends the second temporary public key to the master node.

[0056] Step 303: The master node uses the second temporary public key to encrypt the fragment, obtaining an encrypted fragment; and sends the encrypted fragment to the child node.

[0057] Step 304: The child node receives the encrypted fragment; decrypts the encrypted fragment using the second temporary private key to obtain the fragment; deletes the temporary key pair, and reconstructs the fragment based on the received fragment to obtain the second secret value.

[0058] In one embodiment, the first temporary key pair is used only for the one-time transmission of the fragment, and the first temporary key pair needs to be deleted immediately after the transmission is completed.

[0059] To further expand the distributed network, or if other new nodes want to exchange data with nodes in the distributed network, new nodes can be added to the distributed network.

[0060] like Figure 4 As shown, the method for adding a new node in a distributed network provided in this embodiment specifically includes the following steps: Step 401: The new node generates a second temporary key pair; the second temporary key pair includes a second temporary public key and a second temporary private key.

[0061] In one embodiment, before a new node joins the distributed network, it uses a second temporary key pair to ensure secure interaction when interacting with other nodes in the distributed network.

[0062] Step 402: The new node sends the second temporary public key to other child nodes. The other child nodes sign the second temporary public key with the first private key to obtain a signing certificate, and then send the signing certificate to the master node.

[0063] In one embodiment, other child nodes sign the second temporary public key with the first private key to ensure that the other child nodes acknowledge that they have received the second temporary public key from the new node and allow the new node to join the distributed network.

[0064] Step 403: The master node verifies the number of received signature certificates.

[0065] In one embodiment, to prevent malicious or unauthorized nodes from entering the distributed network and to avoid potential security risks and network interference, each new node needs to be verified before joining the distributed network. That is, when a new node joins the distributed network, in addition to the master node's consent, a sufficient number of existing nodes' consent is also required. Nodes that fail to pass verification will not be able to join the distributed network.

[0066] Step 404: When the number of received signature certificates is greater than or equal to the preset number, the new node is added to the distributed network.

[0067] In one embodiment, rules can be established during the construction of the distributed network, requiring a predetermined number of existing nodes to agree before a new node can join. For example, in step 401, if the new node transmits its second temporary public key to six child nodes, at least four child nodes (the predetermined number) must send signing certificates to the master node to complete the addition of the new node.

[0068] In one embodiment, after agreeing to a new node joining the distributed network, the master node encrypts and transmits a portion of the data fragments to the new node using a second temporary public key. The new node reconstructs the data fragments based on the received fragments to obtain a third secret value. When the third secret value matches the first secret value, the new node officially joins the distributed network. When a new node joins the distributed network, it needs to perform an authorization verification process, just like other existing nodes. After verification, no further verification is required during subsequent data transmission. Then, the new node generates a key pair, just like the existing child nodes in the distributed network, and uses the public key in the key pair to apply for a public key certificate, deleting the second temporary key pair generated in step 401. At this point, the joining process of the new node is complete, and the new node has the same communication mechanisms and security guarantees as other existing child nodes.

[0069] To prevent the first private key from being intercepted and causing a security crisis during data exchange, the first private key must always remain within the node that generated it. To ensure that the first private key never leaves the node where it was generated, this invention dynamically constructs a dedicated secure encryption zone in the memory of each node in the distributed network. This secure encryption zone is primarily responsible for the key pair generation process, key pair storage, and data encryption / decryption processes, ensuring the security of both data and keys. Key pair generation is handled by the encryption component module within the secure encryption zone. If an unauthorized node is detected accessing the secure encryption zone of a node, that node will automatically delete the key pair. This ensures that the first private key can only be stored in the secure encryption zone, and that data encryption and decryption also take place within this zone.

[0070] The following section uses a distributed network structure containing three nodes to illustrate how this invention achieves secure data exchange.

[0071] like Figure 5 As shown, this embodiment provides a distributed network structure containing three nodes. Figure 1 The distributed network consists of three nodes: node 1, node 2, and node 3. The nodes exchange data through the communication channel shown in the diagram, and each node can communicate with other nodes in encrypted form. Node 1 will be used as the master node for explanation.

[0072] Each node includes a secure encryption zone and a data storage zone. The secure encryption zone comprises an encryption component module and a trusted authentication module. The encryption component module is used to encrypt data and perform secure data exchange; it is part of the secure encryption zone and operates only within it. Furthermore, generated key pairs are securely stored within the secure encryption zone, and all encryption and decryption operations can only be performed within this zone. This design means that the node's own key pair does not need to leave the secure encryption zone, effectively preventing key misuse.

[0073] Furthermore, the secure encrypted zone is designed to ensure that all sensitive data stored within it (such as encrypted data, public key certificates, and key pairs) is promptly erased when unauthorized access is detected. If the secure encrypted zone is not persisted to disk, unencrypted data will not leave the zone when the node device loses power or is compromised; all data stored in the node's memory will be deleted, and the secure encrypted zone will retain no data. If it is necessary to recover digital certificates and key pairs after a power outage, redundant secure encrypted zones can be configured in the node, or the secure encrypted zone can be persisted to disk.

[0074] To ensure that the encryption component modules of nodes 1, 2, and 3 generate the same key pair, such as Figure 5 Node 1 generates a secret value s (i.e., the first secret value), divides the secret value s into 6 fragments, and distributes them to 6 fragment holders. Each node includes multiple fragment holders. When the master node distributes fragments, it transmits the fragments to the fragment holders. Each fragment holder obtains one fragment. Each fragment holder only possesses a part of the secret value s. In order to reconstruct the complete secret value s, a sufficient number of fragment holders must provide their partial fragments. Only after a certain number of fragments are collected can the child nodes reassemble the complete secret value s. This design can ensure that the distributed network system has higher security.

[0075] In this invention, each node possesses at least two secret values; that is, the secret value 's' of node 1 must be allocated to at least two shard holders. This design ensures that a node is allowed to generate a key pair only when at least two trusted shard holders are involved. After node 1 allocates the generated six shards to the six shard holders, shard holders 1 and 2 provide partial shards to node 2, and shard holders 3 and 4 provide partial shards to node 3. The encryption component module in node 2 reconstructs the complete secret value 's' based on the two partial shards, and then uses this secret value 's' and the agreed-upon key generation algorithm to generate a key pair. Similarly, node 3 generates the same key pair based on partial shards 3 and 4, using the same complete secret value 's' and the same key generation algorithm.

[0076] To ensure that the secret value of node 1 can be transmitted securely, node 1 or the shard holder transmits a portion of the shard in encryption to other nodes through a secure interface.

[0077] After nodes 1, 2, and 3 generate their respective key pairs, they need to apply for corresponding public key certificates from the certification authority to complete digital authentication. Each node needs to encrypt its generated public key and send it to the certification authority. The certification authority will generate a corresponding public key certificate and encrypt it before sending it back to the node. The node's public key certificate can be securely stored in a secure encrypted area.

[0078] In this scenario, data exchange between nodes does not require the other party's public key for encryption, whereas traditional networks need to distribute the public key to all nodes in the network, and encrypting and decrypting data also requires matching the node's public key. The design of this invention is particularly important when the distributed network reaches thousands of nodes, saving significant time and resources while ensuring the security of data exchange.

[0079] To further enhance security, this invention also stipulates that each node must prove its identity using a public key certificate issued by a certification authority before engaging in encrypted communication with other nodes. For example, before sending encrypted data to node 3, node 2 needs to encrypt and transmit its public key certificate to node 3. Node 3 then decrypts the certificate using its internal encryption module and authenticates it through the trusted authentication module before allowing data exchange with node 2.

[0080] like Figure 6 As shown in the diagram, this embodiment provides a structural diagram for adding a new node to a distributed network. The diagram includes a master node and several other nodes. The process of a new node joining the distributed network is as follows: First, the new node generates a temporary key pair using its internal encryption module. This temporary key pair includes a temporary public key and a temporary private key. The new node transmits the temporary public key to other nodes in the distributed network. Each node signs the received temporary public key using its own private key, obtaining a signing certificate, and sends the signing certificate to the master node. The signing certificate confirms that other nodes have received the temporary public key from the new node and allows the new node to join the distributed network. The signing certificate includes the temporary public key and information about each node. The master node stores these signing certificates and verifies the temporary public key and node information. The master node verifies the received signing certificates. If the verification is successful, the master node initiates the process to permanently add the new node to the distributed network. Successful verification indicates that the master node has received and verified a sufficient number of signing certificates sent by nodes. After successful verification by the master node, the master node or the shard holder transmits a portion of the shard encrypted using the temporary public key to the new node. The new node reconstructs the key value based on the received portion of the shard and generates a key pair based on the key value and the key generation algorithm. This key pair is identical to the key pairs of other nodes in the network. After generating a key pair, the new node needs to apply for the corresponding public key certificate from the certification authority to complete digital authentication. This certificate is used to verify its identity to other nodes before exchanging data. The new node stores the key pair and public key certificate in a secure encrypted area and deletes the generated temporary key pair. At this point, the joining process of the new node is complete, and the new node has the same communication mechanisms and security guarantees as other existing nodes.

[0081] Example 2: Based on the method for secure data exchange in a distributed network provided in the foregoing embodiments, the present invention also provides an apparatus for secure data exchange in a distributed network that can be used to implement the above method, such as... Figure 7 The diagram shown is a schematic representation of the device architecture according to an embodiment of the present invention. The device for secure data exchange in a distributed network according to this embodiment includes one or more processors 21 and a memory 22. Figure 7 Take a processor 21 as an example.

[0082] Processor 21 and memory 22 can be connected via a bus or other means. Figure 7 Taking the example of a connection between China and Israel via a bus.

[0083] The memory 22, as a non-volatile computer-readable storage medium for implementing secure data exchange in a distributed network, can be used to store non-volatile software programs and non-volatile computer-executable programs, such as the method for implementing secure data exchange in a distributed network in the foregoing embodiments. The processor 21 executes various functional applications and data processing of the apparatus for implementing secure data exchange in a distributed network by running the non-volatile software programs, instructions, and modules stored in the memory 22, thereby implementing the method for implementing secure data exchange in a distributed network as described in the foregoing embodiments.

[0084] Memory 22 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some embodiments, memory 22 may include memory remotely located relative to processor 21, which can be connected to processor 21 via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0085] The program instructions / modules are stored in memory 22. When executed by one or more processors 21, they perform the method for secure data exchange in a distributed network as described in the foregoing embodiments, for example, performing the above-described... Figures 1-4 The steps shown.

[0086] This invention also provides a non-volatile computer storage medium storing computer-executable instructions that are executed by one or more processors, for example... Figure 7 One of the processors 21 can enable the one or more processors to execute the method for implementing secure data exchange in a distributed network as described in the foregoing embodiments, for example, to perform the above-described... Figures 1-4 The steps shown.

[0087] It is worth noting that the information interaction and execution process between the modules and units in the above-mentioned device and system are based on the same concept as the processing method embodiment of the present invention. For details, please refer to the description in the method embodiment of the present invention, and will not be repeated here.

[0088] Those skilled in the art will understand that all or part of the steps in the various methods of the embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, which may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0089] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for achieving secure data exchange in a distributed network, characterized in that, include: The master node generates the first secret value, processes the first secret value, and obtains multiple shards; And send at least two shards selected from the plurality of shards to each child node; The child nodes reconstruct the data based on the received fragments to obtain the second secret value; And send the second secret value to the master node; If the first secret value is the same as the second secret value, the master node and the child node jointly construct a distributed network and exchange data in the distributed network.

2. The method for secure data exchange in a distributed network according to claim 1, characterized in that, The method further includes: Set the total number of fragments and the recovery threshold; The first secret value is used as a constant term, and multiple higher-order terms are randomly generated to construct a polynomial containing the constant term and multiple higher-order terms; wherein the number of higher-order terms is one less than the number of recovery thresholds; Assign a unique number to each shard to be generated; the total number of numbers is equal to the total number of shards. Calculate the function value corresponding to an index in a polynomial; treat the index and its corresponding function value as a slice; Calculate the function value corresponding to each number in turn until all numbers have been calculated, and obtain all fragments.

3. The method for secure data exchange in a distributed network according to claim 2, characterized in that, The method further includes: Receive fragments; wherein the number of fragments is greater than or equal to the recovery threshold number; For a piecewise segment, construct the basic polynomial corresponding to the piecewise segment; Obtain the function value in the slice; multiply the basic polynomial by the function value to obtain the weighted polynomial corresponding to the slice; Add the weighted polynomials corresponding to all the segments to obtain the reconstructed polynomial; obtain the constant term of the reconstructed polynomial and use the constant term as the second secret value.

4. The method for secure data exchange in a distributed network according to claim 3, characterized in that, The method further includes: Get the target number of the current fragment; get the non-target number of the non-target fragment; For the current slice, calculate the difference between the variable and the non-target number to obtain the first intermediate expression; calculate the difference between the target number and the non-target number to obtain the second intermediate expression; Divide the first intermediate expression by the second intermediate expression to obtain the ratio; Repeatedly calculate the ratio of the first intermediate expression to the second intermediate expression until all non-target numbers have been calculated. Multiply all ratios to obtain the basic polynomial corresponding to the segment.

5. The method for secure data exchange in a distributed network according to claim 1, characterized in that, Before data exchange can occur in the distributed network, authentication can also be performed using a public key certificate. The process of a child node applying for the public key certificate includes: The child node generates a first key pair based on the second secret value and the key generation algorithm. The first key pair includes a first public key and a first private key. The child node sends a certificate signing request to the certification authority. The certificate signing request includes the first public key, node identity information, and a certificate signing request signed using the first private key. The authentication center verifies the node's identity based on the node's identity information and uses the first public key to verify the signature validity of the certificate signing request. After successful verification, the certification center generates a digital certificate, digitally signs the content of the digital certificate using the certification center's second private key to obtain a public key certificate, and sends the public key certificate to the child node.

6. The method for secure data exchange in a distributed network according to claim 5, characterized in that, The method further includes: The child node sends a connection request to the master node, the connection request including the child node's public key certificate; After receiving the public key certificate, the master node uses the second public key of the certification authority to verify the validity of the digital signature in the public key certificate; and verifies the validity period and revocation status of the public key certificate; After successful verification, the master node exchanges data within the distributed network.

7. The method for secure data exchange in a distributed network according to claim 1, characterized in that, The method further includes: The child node generates a first temporary key pair, which includes a first temporary public key and a second temporary private key. The child node sends the second temporary public key to the master node; The master node uses the second temporary public key to encrypt the fragment, obtaining an encrypted fragment; and then sends the encrypted fragment to the child node; The child node receives the encrypted fragment; decrypts the encrypted fragment using the second temporary private key to obtain the fragment; deletes the temporary key pair, and reconstructs the fragment based on the received fragment to obtain the second secret value.

8. The method for secure data exchange in a distributed network according to claim 1, characterized in that, The method further includes: The new node generates a second temporary key pair; the second temporary key pair includes a second temporary public key and a second temporary private key; The new node sends the second temporary public key to other child nodes. The other child nodes sign the second temporary public key with the first private key to obtain a signing certificate, and then send the signing certificate to the master node. The master node verifies the number of signed certificates received; When the number of received signature certificates is greater than or equal to the preset number, the new node is added to the distributed network.

9. An apparatus for enabling secure data exchange in a distributed network, characterized in that, The device includes: At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor for performing the method for implementing secure data exchange in a distributed network as described in any one of claims 1-8.

10. A non-volatile computer storage medium, characterized in that, The computer storage medium stores computer-executable instructions that are executed by one or more processors to perform the method for secure data exchange in a distributed network as described in any one of claims 1-8.

Images