Digital asset management method and device, equipment, storage medium and program product

Abstract

The invention discloses a digital asset management method and device, equipment, a storage medium and a program product, and the method comprises the steps: carrying out the hash calculation of transaction data when a super SIM card receives a transaction request carrying transaction data sent by first equipment, and generating a transaction hash value; performing hierarchical signature on the transaction hash value through a preset signature algorithm, and triggering personal identification code authentication of the user so as to release signature data of the hierarchical signature after the personal identification code authentication is passed; and sending the verification abstract of the personal identification code and the signature data to a block chain network, so that the block chain network verifies the signature data, stores the signature data after verification is passed, and returns a transaction confirmation event to the first device. According to the embodiment of the invention, the super SIM card is used as a security carrier, and the transaction data hash calculation, the hierarchical signature and the personal identification code authentication are combined, so that the whole-process security protection of the digital asset transaction is realized, and the security of the digital asset transaction can be effectively improved.

Description

Technical Field

[0001] This invention relates to the field of network security, and more particularly to a digital asset management method, apparatus, device, storage medium, and program product. Background Technology

[0002] Digital asset management refers to the secure management process of assets existing in digital form throughout their entire lifecycle, including key generation, storage, use, backup, and recovery. Existing digital asset management solutions are divided into hardware wallets and software wallets, both designed around core aspects such as secure key generation, storage, use, and backup. Current technologies typically utilize SIM (Subscriber Identity Module) cards as the key management medium for digital assets, enabling convenient and low-cost blockchain digital asset transactions. However, this solution relies solely on the private key stored in the SIM card hardware for signing during transaction execution; transaction authorization is completed with a single private key signature. This means that if the SIM card is lost, stolen, or illegally obtained, attackers can initiate transactions directly without additional identity verification, easily leading to the transfer and theft of digital assets. Furthermore, in attack scenarios such as malicious programs hijacking the SIM card communication link and forging transaction requests, the single private key verification mechanism cannot effectively distinguish between legitimate user operations and illegal intrusions, further amplifying transaction security risks and making it difficult to guarantee the security of digital asset transactions. Summary of the Invention

[0003] The purpose of this invention is to provide a digital asset management method, apparatus, device, storage medium, and program product that can effectively improve the security of digital asset transactions.

[0004] To achieve the above objectives, embodiments of the present invention provide a digital asset management method applied to a super SIM card, the method comprising: Upon receiving a transaction request carrying transaction data from the first device, a hash calculation is performed on the transaction data to generate a transaction hash value; The transaction hash value is layered and signed using a preset signature algorithm, and the user's personal identification code authentication is triggered, so that the signature data of the layered signature is released after the personal identification code authentication is successful. The verification digest of the personal identification code and the signature data are sent to the blockchain network so that the blockchain network can verify the signature data, and after successful verification, store the signature data and return a transaction confirmation event to the first device.

[0005] As an improvement to the above scheme, the step of performing layered signing on the transaction hash value using a preset signature algorithm includes: Retrieve the initial configuration parameters stored when creating a digital asset account; The initial configuration parameters and the initial random salt value are hashed to obtain the enhanced random salt value; The transaction hash value is divided into blocks to obtain several hash blocks; A Merkle tree is constructed using the hash blocks, and a signature segment is generated for each hash block using a signature key chain. The signature segment, the enhanced random salt value, and the root hash are encoded to generate signature data.

[0006] As an improvement to the above solution, before receiving the transaction request carrying transaction data sent by the first device, the method further includes: Upon receiving the initial configuration parameters sent by the business backend, the initial configuration parameters are stored; wherein, the initial configuration parameters are generated by the business backend after receiving the account creation request sent by the first device; The master key pair is generated using a post-quantum cryptography algorithm; The private key in the master key pair is stored, and the public key of the master key pair is sent to the business platform so that the business backend sends the public key to the blockchain network and registers the public key and creates a digital asset account on the blockchain network.

[0007] As an improvement to the above scheme, the account creation request carries identification information, and the initial configuration parameters carry encoded data, hash function type, and preset Merkle tree height; wherein, the encoded data is obtained by the business backend after encoding the identification information.

[0008] As an improvement to the above scheme, the generation of the master key pair using a post-quantum cryptography algorithm includes: Obtain the parameter set of the post-quantum cryptography algorithm, and use the parameter set to generate a first noise vector and a second noise vector; Determine the private key based on the first noise vector; A global matrix is ​​generated using a pseudo-random function, and the public key is calculated using the global matrix, the first noise vector, and the second noise vector.

[0009] As an improvement to the above solution, the method further includes: Upon receiving a mnemonic phrase generation request from the first device, obtain the random entropy value; At least two mnemonic words are generated using the random entropy value, and a first encryption key is generated using the random entropy value as input key material. The mnemonic phrase is encrypted using the first encryption key to obtain the initial encrypted ciphertext; The initial encrypted ciphertext is returned to the first device so that the first device can process the initial encrypted ciphertext into blocks and distribute them to distributed storage nodes for storage. As an improvement to the above scheme, the generation of at least two mnemonic words using the random entropy value includes: Perform a hash calculation on the random entropy value to generate a checksum; Append a portion of the checksum bits to the random entropy value to obtain a binary string; The binary string is segmented to obtain at least two mnemonic words.

[0010] As an improvement to the above solution, the method further includes: Upon receiving a decryption request carrying reconstructed encrypted ciphertext from the business backend, the random entropy value is obtained; wherein, the decryption request is sent by the business backend after receiving a data recovery request from the second device; Using the random entropy value as input key material, a second encryption key is generated; The reconstructed encrypted ciphertext is decrypted using the second encryption key to obtain the mnemonic phrase; The mnemonic phrase is sent to the business backend, so that the business backend can query the asset information associated with the blockchain network based on the mnemonic phrase and synchronize the asset information to the second device.

[0011] As an improvement to the above scheme, the reconstructed encrypted ciphertext is obtained by the business backend reconstructing the blocks of the initial encrypted ciphertext obtained from the distributed storage node.

[0012] To achieve the above objectives, embodiments of the present invention also provide a digital asset management device applied to a super SIM card, comprising: The transaction hash value generation module is used to perform hash calculation on the transaction data and generate a transaction hash value when it receives a transaction request carrying transaction data sent by the first device. The layered signature module is used to perform layered signatures on transaction hash values ​​using a preset signature algorithm and trigger user personal identification code authentication, so as to release the signature data of the layered signature after the personal identification code authentication is successful. The data sending module is used to send the verification digest of the personal identification code and the signature data to the blockchain network, so that the blockchain network can verify the signature data, and after the verification is successful, store the signature data and return a transaction confirmation event to the first device.

[0013] To achieve the above objectives, embodiments of the present invention also provide a digital asset management device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the digital asset management method as described in any of the above embodiments.

[0014] To achieve the above objectives, embodiments of the present invention also provide a computer-readable storage medium storing a computer program, wherein the computer program, when running, controls the device where the computer-readable storage medium is located to execute the digital asset management method as described in any of the above embodiments.

[0015] To achieve the above objectives, embodiments of the present invention also provide a computer program product, including a computer program / instructions, which, when executed by a processor, implement the digital asset management method as described in any of the above embodiments.

[0016] Compared with existing technologies, the digital asset management method, apparatus, device, storage medium, and program products disclosed in this invention, using a super SIM card as a secure carrier, combine transaction data hash calculation, layered signature, and personal identification code authentication to achieve end-to-end security protection for digital asset transactions. Relying on the hardware security features of the super SIM card, the transaction hash generation and signing process are ensured to be executed in an isolated environment, preventing the leakage of sensitive information. The collaborative design of the layered signature mechanism combined with real-time personal identification code authentication not only ensures the unforgeability of signatures through quantum-resistant signature algorithms but also prevents unauthorized transactions through user authorization, thus enhancing transaction security through a dual mechanism. Simultaneously, by only uploading the verification digest and signature data to the blockchain, sensitive information exposure is reduced while meeting blockchain verification requirements. Ultimately, this achieves an organic unity of security, controllability, and privacy protection in digital asset transactions, providing reliable technical support for cross-device and cross-scenario digital asset management. Attached Figure Description

[0017] Figure 1 This is a structural block diagram of a digital asset management system provided in an embodiment of the present invention; Figure 2 This is a flowchart illustrating the asset transaction process in the digital asset management method provided in this embodiment of the invention; Figure 3 This is another flowchart illustrating asset transactions in the digital asset management method provided in this embodiment of the invention; Figure 4 This is a flowchart of generating signature data provided in an embodiment of the present invention; Figure 5 This is a flowchart of creating a digital asset account provided in an embodiment of the present invention; Figure 6This is another flowchart for creating a digital asset account provided in an embodiment of the present invention; Figure 7 This is a flowchart of data backup provided in an embodiment of the present invention; Figure 8 This is another flowchart of data backup provided in an embodiment of the present invention; Figure 9 This is a flowchart of data recovery provided in an embodiment of the present invention; Figure 10 This is another flowchart of data recovery provided in an embodiment of the present invention; Figure 11 This is a structural block diagram of a digital asset management device provided in an embodiment of the present invention; Figure 12 This is a structural block diagram of a digital asset management device provided in an embodiment of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] See Figure 1 , Figure 1This is a structural block diagram of a digital asset management system provided by an embodiment of the present invention. The system includes modules such as a super SIM card, a business backend, a blockchain network, terminal devices, an authentication module, a security chip, a key engine, and cloud storage. The super SIM card, as the core security carrier of the system, integrates functions such as cryptographic algorithm computation, key storage, and transaction signing, serving as the hardware foundation for digital asset security management. The business backend handles the system's business logic processing, including account creation, initialization parameter generation, transaction request forwarding, and distributed storage data management, acting as the system's business hub. The blockchain network provides services such as decentralized notarization of digital assets, account public key registration, and transaction on-chain verification, ensuring the transparency and immutability of asset transactions. The terminal devices can be smart devices with communication capabilities, such as smartphones and tablets, used to run the asset account APP (Application), providing users with an interactive interface for digital assets and initiating requests for creating, logging in, backing up, and restoring digital asset accounts. The authentication module integrates identity verification mechanisms such as PIN (Personal Identification Number) to verify user identity during critical operations such as transactions and restorations, ensuring the legality of the operations. The security chip, either built into or external to the Super SIM card, provides hardware-level capabilities such as random number generation, data encryption and decryption, and secure key storage, offering underlying hardware support for system security. The key engine, also built into or external to the Super SIM card, is responsible for accelerating and managing key-related operations such as key pair generation and layered signatures in post-quantum cryptography algorithms, improving the efficiency and security of cryptographic operations. Cloud storage can rely on distributed storage networks such as IPFS (InterPlanetary File System) to store block data of mnemonic phrase encrypted ciphertext, achieving disaster recovery backup and decentralized storage.

[0020] For example, when a user creates a quantum-resistant digital asset account (such as a blockchain wallet) for the first time using a Super SIM card, the system generates a public-private key pair based on a quantum-safe algorithm and completes on-chain registration. The mnemonic phrase is generated by a hardware random number generator and the AES-256-GCM module of the security chip, then encrypted and stored in the Super SIM card's secure element (SE) and backed up in the IPFS distributed network. The transaction signature process uses a quantum digital signature that integrates PIN code authentication to ensure dual verification of operation authorization. When the device is replaced, the digital asset account is migrated and restored by decrypting the mnemonic phrase. The entire process forms a full lifecycle quantum protection system from key generation to secure storage, signature execution, and disaster recovery.

[0021] See Figure 2 , Figure 2This is a flowchart illustrating asset transactions within a digital asset management method provided in this embodiment of the invention. The digital asset management method is applied to a Super SIM card and includes steps S11-S13. See also... Figure 3 , Figure 3 This is another flowchart illustrating asset transactions in the digital asset management method provided in this embodiment of the invention, which will be discussed below in conjunction with... Figure 3 The above steps S11 to S13 are explained in detail.

[0022] S11. When a transaction request carrying transaction data is received from the first device, a hash calculation is performed on the transaction data to generate a transaction hash value.

[0023] For example, the transaction hash value is used to uniquely identify transaction data and serves as input for subsequent signature operations, ensuring the determinism and immutability of the signed object, while facilitating rapid verification and traceability of transactions by the blockchain network. The transaction data can be key information related to the transfer of digital assets, such as the target address (the digital asset recipient's account), transaction amount, transaction timestamp, and remarks. During hash calculation, the transaction data is irreversibly processed by a hash algorithm module (such as SHA3-512) in the security chip to generate a fixed-length transaction hash value. This process removes redundant information from the transaction data while retaining its unique characteristics, and the original transaction data cannot be derived from the hash value.

[0024] S12. Perform layered signing on the transaction hash value using a preset signing algorithm and trigger the user's personal identification code authentication, so as to release the signature data of the layered signature after the personal identification code authentication is successful.

[0025] For example, the signature algorithm could be a quantum-resistant signature algorithm such as SPHINCS+. These algorithms can resist the risk of quantum computing breaking traditional signature mechanisms, ensuring the long-term security of the signature. Layered signatures refer to breaking down the signature process into multiple levels of computational steps (such as combining key chains, Merkle trees, etc.). First, the transaction hash blocks are signed at the lower level, and then the final signature is generated through layered aggregation. This improves signing efficiency and enhances the signature's resistance to tampering and verifiability. A Personal Identification Number (PIN) serves as a key credential for user authentication, confirming that the current operation is authorized by the user. Since signature data is the core authorization basis for digital asset transactions, PIN verification can prevent unauthorized transactions initiated by others using stolen devices or SIM cards, adding user-level authorization protection to the signature result. In this embodiment of the invention, the layered signature and personal identification code authentication processes can be triggered simultaneously, or the two operations can have a certain time difference (but it is necessary to ensure that the personal identification code authentication can be completed before or shortly after the layered signature ends). The simultaneous triggering design is to complete the user identity verification synchronously during the signature operation, which ensures a strong binding between the signature operation and the user authorization, and avoids the risk of signature abuse due to delayed verification after signature generation. This achieves real-time collaboration between technical layer signature security and user layer identity confirmation, further strengthening the transaction security defense line.

[0026] Further, see Figure 4 , Figure 4 This is a flowchart of generating signature data provided in an embodiment of the present invention. In step S2, the transaction hash value is signed in layers by a preset signature algorithm, specifically including steps S121 to S125.

[0027] S121. Obtain the initial configuration parameters stored when creating the digital asset account.

[0028] For example, the initial configuration parameters provide a unified algorithm standard and basic data for core operations such as signing and verification of digital asset accounts, ensuring the consistency and security of transaction processing. For instance, the initial configuration parameters carry encoded data (combinedId), a hash function type, and a preset Merkle tree height. The encoded data carried in the initial configuration parameters is a string obtained by encoding identification information (such as the device identifier IMSI of the first device, the account identifier userId of the digital asset account, and the super SIM card identifier ICCID), used to associate and bind the account with the entity identity. The hash function type is a cryptographically secure hash algorithm such as SHA3-512, specifying the hash calculation method for transaction data, salt values, and other information, ensuring the irreversibility and collision resistance of the calculation results. The preset value of 16 for the Merkle tree height defines the hierarchical structure of the Merkle tree in the layered signature, determines the aggregation method of hash blocks and the efficiency of signature verification, and ensures that the block signature can achieve overall integrity verification through hierarchical verification.

[0029] S122. Perform hash calculation on the initial configuration parameters and the initial random salt value to obtain the enhanced random salt value.

[0030] For example, the initial random salt value Rand is a random sequence generated by the hardware random number generator (HRNG) of the security chip in the Super SIM card, possessing high randomness and unpredictability. During hash calculation, the encoded data combinedId of the initial configuration parameters is first hashed using SHA3-512 to obtain the first hash value. Then, the first hash value is concatenated with the initial random salt value Rand, and a second hash operation is performed to finally generate a fixed-length enhanced random salt value RandSalt, satisfying: RandSalt=SHA3-512(SHA3-512(combinedId)||Rand), where "||" represents the concatenation operation.

[0031] It should be noted that the initial configuration parameters may contain fixed or predictable information. Therefore, by combining them with a high random salt value and performing multiple hash operations, it is possible to avoid the hash result being cracked due to the regularity of the initial parameters. At the same time, the uniqueness of the random salt value can generate different enhanced salt values ​​for the same initial parameters, which greatly improves the collision resistance and security of the hash result, provides a more reliable random basis for the subsequent signature process, and further strengthens the overall encryption system's resistance to attacks.

[0032] S123. The transaction hash value is divided into blocks to obtain several hash blocks.

[0033] For example, when configuring the hierarchical tree parameters for SPHINCS+ (a hash-based stateless quantum-resistant signature scheme), it is necessary to integrate the core parameters of the hierarchical structure, random factor, and underlying signature algorithm, specifically including: 1) The height of the hierarchical tree is h=16. This parameter defines the depth of the Merkle tree and determines the aggregation level of hash blocks and the hierarchical structure of signature verification. 2) Enhance the random salt value RandSalt to inject high randomness into the signature process and improve collision resistance; 3) One-Time Signature (OTS) algorithm, which can be WOTS+ (Winternitz One-Time Signature). Its key parameter w is configured to 16, which means that the Winternitz cardinality is 16. This parameter balances the signing efficiency and key length, and achieves secure signing of a single message through hash chain operation.

[0034] For example, the above parameter configuration provides a unified standard for the subsequent signature process. When deriving block key materials based on the private key, a one-time signature key chain of corresponding length can be generated according to the hierarchical tree height and WOTS+. It should be noted that deriving block key materials from the private key refers to generating a series of sub-key materials (such as key chains, sub-private keys, etc.) for block signing from the private key (SK1) through a preset key derivation algorithm. These block key materials correspond one-to-one with the blocks of the transaction hash, providing dedicated key support for the underlying one-time signature (such as WOTS+).

[0035] For example, the transaction hash value H can be divided into blocks. For instance, if the transaction hash value is a 512-bit hash value generated by SHA3-512, combined with the Merkle tree height (e.g., 16), it can be evenly divided into 16 32-bit hash blocks. Each block corresponds to a unique identifier (e.g., , ... After dividing the transaction hash value H into blocks, each hash block can be precisely associated with a WOTS+ public key hash. Ultimately, a complete signature is formed through hierarchical aggregation, which not only relies on the quantum resistance of SPHINCS+ to ensure long-term security, but also improves the efficiency and verifiability of the signature through parameter coordination.

[0036] S124. Construct a Merkle tree using the hash blocks, and generate a signature segment for each hash block using a signature key chain.

[0037] For example, based on the leaf nodes of the Merkle tree corresponding to several hash blocks obtained after dividing the transaction hash value into blocks, and following a hierarchical structure with a height h=16, hash operations (such as using the SHA3-512 algorithm) are performed on adjacent nodes layer by layer to generate parent nodes. The bottom-level leaf nodes are aggregated pairwise to form intermediate nodes of the first level, and the nodes of the first level are then aggregated pairwise to form nodes of the second level, and so on, until a unique root node Rroot is finally generated, forming a complete Merkle tree. For each hash block... The corresponding WOTS+ one-time signature key chain is invoked, and the block data and associated parameters (such as...) are processed using the chained hash function SHAKE-256. (This may include block identifiers, random salt values, etc.) for calculation, i.e. ,in Using the SHAKE-256 chained hash function based on the key chain, a signature segment uniquely bound to this block is obtained. .

[0038] Simultaneously, during the Merkle tree construction process, a Merkle path proof set Path is generated for each level of nodes, from the leaf nodes to the root node. This Path proof contains the hash values ​​of adjacent nodes used for aggregation operations at each level. This path proof can be used to reconstruct the root hash during the verification phase, ensuring the integrity and relevance of hash blocks and corresponding signature segments. Ultimately, the validity of the overall transaction signature is confirmed through root node verification.

[0039] S125. Encode the signature segment, the enhanced random salt value, and the root hash to generate signature data.

[0040] For example, the signature segment The path proof Path, the enhanced random salt RandSalt, and the root hash Rroot are encoded according to the RFC8391 standard to generate a quantum-resistant signature, namely the signature data Sig1, which satisfies: Sig1 = Encode({ ,..., },Path,RandSalt,Rroot), where n is the total number of hash blocks.

[0041] In this embodiment of the invention, the layered signature process significantly improves the security and reliability of digital asset transaction signatures through multi-stage collaborative design. First, an enhanced random salt value is generated based on initial configuration parameters, strengthening the randomness and collision resistance of the signature and laying a secure foundation for subsequent signature operations. Second, the transaction hash is processed in blocks and combined with a Merkle tree structure, achieving efficient parallel processing of the signature process through block signing and ensuring the integrity and immutability of transaction data by relying on the hierarchical verification characteristics of the Merkle tree. Finally, a signature segment is generated through a single signature key chain and standardized encoding, combined with the characteristics of quantum-resistant signature algorithms, effectively resisting the risk of quantum computing attacks. The overall process balances signature efficiency and security strength, meeting the blockchain network's requirements for signature verifiability while reducing the security risk of single-stage failure through layered design, providing highly secure and reliable signature protection for digital asset transactions.

[0042] S13. Send the verification digest of the personal identification code and the signature data to the blockchain network so that the blockchain network can verify the signature data, and after the verification is successful, store the signature data and return a transaction confirmation event to the first device.

[0043] For example, the Super SIM card first sends the verification digest and signature data of the Personal Identification Code (PIN) to the business backend. After receiving the signature data Sig1 and the verification digest of the PIN, the business backend aggregates the public key PK1, signature data Sig1, and verification digest Bio_Digest into a complete transaction data packet, which is then broadcast to the blockchain network. The verification digest is an irreversible hash value calculated from the user-input PIN using a hash algorithm (such as SHA3-512), preserving the PIN's verification function while preventing the original PIN from being leaked during transmission and storage. The transaction confirmation event is a confirmation notification generated by the blockchain network after verifying the transaction signature and writing the transaction record to a block. This notification includes the transaction hash, block height, and timestamp, informing the first device (e.g., the user terminal) that the transaction has been recognized by the blockchain consensus and permanently stored. The nodes in the blockchain network first parse the structure of the signature data Sig1 using the public key PK1, extracting the Merkle tree root node Rroot and the signature segments of each hash block. And Merkel path proof Path; then use WOTS + public key hash Li to verify each signature segment. The validity of the signature is verified by reconstructing the root node through the Merkel path and comparing it with the Rroot carried in the signature to confirm the integrity of the overall hash block; at the same time, the validity of the user's identity authorization is verified by combining the verification digest. If all verifications pass, the signature is deemed valid.

[0044] In this embodiment of the invention, a super SIM card is used as a security carrier to combine transaction data hash calculation, layered signature, and personal identification code authentication, achieving end-to-end security protection for digital asset transactions. Leveraging the hardware security features of the super SIM card, the transaction hash generation and signing process are ensured to be executed in an isolated environment, preventing the leakage of sensitive information. The collaborative design of the layered signature mechanism combined with real-time personal identification code authentication ensures the unforgeability of signatures through a quantum-resistant signature algorithm and prevents unauthorized transactions through user authorization, thus enhancing transaction security through a dual mechanism. Simultaneously, only the verification digest and signature data are uploaded to the blockchain, meeting the blockchain verification requirements while reducing the exposure of sensitive information. Ultimately, this achieves an organic unity of security, controllability, and privacy protection in digital asset transactions, providing reliable technical support for cross-device and cross-scenario digital asset management.

[0045] Furthermore, steps S11 to S13 above describe the transaction process of a digital asset account during actual transactions. This embodiment of the invention also provides a process for creating a digital asset account, see [link to documentation]. Figure 5 , Figure 5 This is a flowchart illustrating the creation of a digital asset account according to an embodiment of the present invention. The digital asset management method further includes steps S21 to S23. See also... Figure 6 , Figure 6 This is another flowchart of creating a digital asset account provided by an embodiment of the present invention, which is described below in conjunction with... Figure 6 The above steps S21 to S23 are explained in detail.

[0046] S21. When the initial configuration parameters sent by the business backend are received, the initial configuration parameters are stored; wherein, the initial configuration parameters are generated by the business backend after receiving the account creation request sent by the first device.

[0047] For example, storing the initial configuration parameters serves to provide foundational data support and a unified standard for subsequent core operations of digital asset accounts, such as transaction signing and identity verification. Specifically, these initial configuration parameters are the basic rules determined when the account is created, and can be repeatedly invoked during subsequent transactions after being stored. Simultaneously, storing the initial configuration parameters also provides a basis for account consistency verification, ensuring that operations on the same account in different scenarios (such as transaction verification and account recovery) are performed based on the same rules, avoiding signature invalidation or verification failure due to parameter inconsistencies. This is fundamental to maintaining the security and availability of digital asset accounts.

[0048] Furthermore, the account creation request carries identification information, and the initial configuration parameters carry encoded data, hash function type, and preset Merkle tree height; wherein, the encoded data is obtained by the business backend after encoding the identification information.

[0049] For example, a user sends an account creation request to the business backend using the digital asset APP. The account creation request carries identification information such as the device identifier (IMSI) of the first device, the account identifier (userId) of the digital asset account, and the identifier (ICCID) of the super SIM card. After verifying the validity of the request, the business backend converts the three unique identifiers (ICCID, IMSI, and userId) into string format, concatenates them according to a fixed format, and then performs UTF-8 encoding to generate a binary stream to obtain the encoded data combinedId, which satisfies: combinedId = Encode(ICCID||IMSI|| userId), where "||" represents the concatenation operation to ensure clear boundaries of each identifier. Then, the encoded data combinedId, hash function type = SHA3-512, and Merkle tree height = 16 are used as preset initialization parameters for the SPHINCS+ quantum-resistant signature algorithm and sent to the super SIM card.

[0050] In this embodiment of the invention, the encoding of identification information uniquely binds the initial configuration parameters to the user's identity, device, and SIM card, ensuring a precise association between the account and the entity's identity and preventing identity confusion or impersonation risks from the outset. Furthermore, clearly defining algorithm parameters such as the hash function type and Merkle tree height provides a unified algorithm standard for subsequent signature and verification processes, ensuring consistency and interoperability in transaction processing. Encoding the identification information strengthens the account's identity anchoring capability, and standardized algorithm parameters provide a stable technical benchmark for secure transactions, effectively improving the security and reliability of digital asset accounts throughout the entire process from creation to use.

[0051] S22. Generate the master key pair using a post-quantum cryptography algorithm.

[0052] For example, post-quantum cryptography algorithms refer to cryptographic algorithms that can resist quantum computing attacks, such as SPHINCS+, CRYSTALS-Kyber, and NTRU. They are suitable for ensuring the long-term security of key generation, signing, encryption, and other operations in the quantum computing era. The master key pair refers to the core key pair generated for a digital asset account. It is the foundation of the entire account security system and includes the private key SK1 and the public key PK1. The private key SK1 is the secret key with the highest authority and must be strictly stored in a hardware security element (such as the SE of a super SIM card). It is used for core operations such as deriving block key materials (such as the WOTS+ key chain) and generating transaction signatures. Its confidentiality directly determines account security. The public key PK1 is generated from the private key using a corresponding algorithm and can be publicly transmitted. It is used to verify the legality of transaction signatures. For example, blockchain nodes use the public key to verify the validity of SPHINCS+ signatures. It is one of the identity identifiers of an account in the blockchain network.

[0053] Further, step S22 specifically includes: obtaining the parameter set of the post-quantum cryptography algorithm, and generating a first noise vector and a second noise vector using the parameter set; determining the private key based on the first noise vector; generating a global matrix using a pseudo-random function, and calculating the public key using the global matrix, the first noise vector, and the second noise vector.

[0054] For example, load the pre-computed CRYSTALS-Kyber-1024 parameter set, including modulus q=3329, multinomial dimension m=256, error distribution parameter η=2, and security level LWE (Learning With Errors) parameter (k=4). Activate the hardware acceleration module, including: 1) Parallel NTT (Number Theoretic Transform) is used to accelerate polynomial multiplication and noise sampling processes; 2) The modular reduction simplification of CRIS-b (Conditional R-index Switching for b-value Minimization) implements the modular reduction operation (mod 3329) in the Kyber algorithm through reconfigurable combinational logic, reducing computational latency and hardware resource consumption; 3) CBD (Centered Binomial Distribution) noise sampler, used to generate private key noise and public key noise using shared central binomial distribution hardware modules, reducing physical area consumption.

[0055] For example, a first noise vector s is generated using a CBD noise sampler. The CBD noise sampler generates a first noise vector s that conforms to a central binomial distribution based on the input random seed and the error distribution parameter η, satisfying: s←CBDη(seed). Then, the private key SK1=s∈ And stored in the SuperSIM hardware secure element (SE), where, The polynomial ring is defined by the modulus q, the polynomial dimension m, and the LWE security level parameter k. In the private key generation scenario, the first noise vector s∈ This means that the first noise vector s is a vector containing 4 polynomials, each polynomial having a degree not exceeding 256 and coefficients that are integers modulo 3329.

[0056] For example, a hardware-accelerated pseudo-random function is used to dynamically generate a sparsed version of the global matrix A to support parallel multiplication. In models such as LWE, the global matrix A is a publicly disclosed core parameter, typically a high-dimensional matrix. The sparsed version refers to simplifying the structure of matrix A through specific rules, making most elements zero and retaining only a small number of non-zero elements. A second noise vector e is generated through parallel CBD, satisfying: e←CBDη(seed′), where seed′ refers to a derived random seed, an auxiliary random source generated based on the initial seed using a specific algorithm, used to enhance randomness or adapt to the needs of different stages. Then, the initial public key t is calculated, satisfying t=A·s+e mod q, where multiplication is accelerated by NTT, and addition and modular reduction are processed in real time by the CRIS-b unit. Finally, the public key PK1=(A,t) is output.

[0057] In this embodiment of the invention, a quantum-resistant key system is constructed through the collaborative computation of noise vectors and a global matrix. First and second noise vectors, generated using a preset parameter set, inject cryptographically secure randomness into the private and public keys, ensuring the unpredictability of the keys. The global matrix is ​​generated using a pseudo-random function, and the public key is derived through vector operations. This utilizes mathematical structures to guarantee the correlation and verifiability of the key pairs, while also mitigating the risk of key cracking from quantum computing through post-quantum algorithm characteristics. This invention combines parameterized configuration, random noise generation, and structured computation to proactively address quantum threats while satisfying the fundamental characteristics of asymmetric keys. It provides a highly secure key foundation for digital asset accounts, resistant to future risks, and strengthens the security defenses of digital assets from the core encryption stage.

[0058] S23. Store the private key in the master key pair and send the public key of the master key pair to the business platform, so that the business backend sends the public key to the blockchain network and registers the public key and creates a digital asset account on the blockchain network.

[0059] For example, the private key SK1 is stored in the hardware security element SE of the Super SIM card because the private key is the ownership certificate of the digital asset account, and its confidentiality directly determines the account security. The SE has characteristics such as physical isolation, tamper-proof, and resistance to side-channel attacks, which can prevent the private key from being maliciously read, copied, or tampered with, ensuring that only legitimate users can call the private key for signing through device interaction (such as entering a PIN code), fundamentally preventing asset theft. The public key PK1 is sent to the business platform because the core function of the public key is public verification and identity identification. As an intermediary layer, the business platform needs to obtain the public key to complete the association and management of account information (such as binding user identity and device information), and at the same time synchronize the public key to the blockchain network, so that all nodes in the network can verify the legality of the transaction signature initiated by the account through the public key, realizing the cryptographic logic closed loop of private key signing and public key verification. Registering a public key on the blockchain network completes the creation of a digital asset account. This stems from the asymmetric cryptographic account system of blockchain. Instead of relying on a centralized institution to record account information, blockchain uses public keys to uniquely identify accounts. The account address generated by hashing the public key is essentially a simplified identifier of the public key. All nodes on the network can verify the uniqueness and legitimacy of the account through the binding relationship between this address and the public key. Therefore, registering the public key on the chain (i.e., writing it into the blockchain's account system) means that the account is recognized by the entire network and can be used to receive and send digital assets without requiring an additional centralized account opening process, demonstrating the decentralized nature of blockchain—using keys instead of accounts. The blockchain network returns the account address and initialization confirmation message to the digital asset app, completing the creation of the digital asset account.

[0060] In this embodiment of the invention, the account initialization process, through the collaborative design of the super SIM card, the business backend, and the blockchain network, builds a solid foundation for the secure management of digital assets. The initial configuration parameters generated by the business backend are securely stored on the super SIM card, ensuring the consistency and security of parameters in subsequent operations such as signing. A post-quantum cryptography algorithm is used to generate the master key pair; the private key is securely stored locally, and the public key is registered on the blockchain. This approach not only resists future quantum computing threats through its quantum-resistant algorithm characteristics but also leverages the decentralized nature of the blockchain to achieve trusted account identity verification. This achieves secure parameter configuration, hierarchical key management, and on-chain identity anchoring during the account creation process, ensuring the initial security of digital asset accounts from the source. It provides a trusted identity foundation and security prerequisite for subsequent transactions and other operations, effectively reducing the risks of key leakage and identity forgery during the account creation stage.

[0061] Furthermore, after creating a digital asset account, the present invention also provides a data backup method, see [link to relevant documentation]. Figure 7 , Figure 7 This is a flowchart of data backup provided in an embodiment of the present invention, in which the digital asset management method includes steps S31 to S34. See also... Figure 8, Figure 8 This is another flowchart of data backup provided in the embodiments of the present invention, combined with Figure 8 The above steps S31 to S34 are explained in detail.

[0062] S31. Upon receiving a mnemonic phrase generation request from the first device, obtain the random entropy value.

[0063] For example, the digital asset app on the first device sends a mnemonic phrase generation request to the Super SIM card. A mnemonic phrase is an ordered phrase composed of a specific vocabulary; it's a human-friendly representation of the private key. By mapping binary private key data into easy-to-remember and easy-to-write words, it solves the problem of remembering and backing up private keys (usually long strings of random characters). Users can recover their digital asset accounts across different devices using the mnemonic phrase. The random entropy value is the core raw data for generating the mnemonic phrase; it's a highly random binary sequence generated by a hardware random number generator. For example, the Super SIM card first calls the hardware random number generator (HRNG) built into the security chip to generate a 256-bit random entropy value E.

[0064] S32. Generate at least two mnemonic words using the random entropy value, and generate a first encryption key using the random entropy value as input key material.

[0065] Furthermore, the step of generating at least two mnemonic words using the random entropy value specifically includes: performing a hash calculation on the random entropy value to generate a checksum; appending a portion of the bits of the checksum to the random entropy value to obtain a binary string; and segmenting the binary string to obtain at least two mnemonic words.

[0066] For example, the Super SIM card performs a SHA-256 hash calculation on the random entropy value E to obtain a 256-bit hash value as a checksum C, i.e., C = SHA256(E). The checksum is used to verify the integrity of the entropy value. When the entropy value is subsequently restored using the mnemonic phrase, the hash can be recalculated and the checksum compared to determine whether an error occurred during the backup or restoration process (such as entering an incorrect mnemonic phrase). The Super SIM card sends the checksum to the security chip, which extracts the first 8 bits of the checksum C (since 256 bits of random entropy value correspond to 1 bit of checksum for every 32 bits of entropy value, 256 / 32 = 8). These 8 bits are appended to the end of the random entropy value E, forming a binary string ENT with a total length of 256 + 8 = 264 bits, i.e., ENT = E||C's first 8 bits.

[0067] For example, the binary string ENT is segmented into 11-bit segments. Since 2^64 ÷ 11 = 24, this results in 24 groups of 11-bit binary numbers. Each group of 11-bit values ​​ranges from 0 to 2047 (2^11 = 2048), which corresponds precisely to the index of the 2048 preset words in the BIP39 standard vocabulary. By querying the vocabulary using the index, a mnemonic phrase set M = {m1, m2, ..., m24} containing 24 words can be generated. These mnemonic phrases are a user-friendly mapping of random entropy values, allowing users to back up and restore their accounts by memorizing or recording them. Then, the Super SIM card requests the key engine to generate the first encryption key. The Super SIM card sends the random entropy value to the key engine. The key engine uses the core part of the random entropy value (the initial 256-bit entropy value E) as input to generate the first encryption key Kenc. In this process, the key engine calls the HKDF-SHA512 key derivation function, using the random entropy value E as the initial key material (IKM), the IDSIM obtained by hashing the user's IMSI as the salt value Salt, and specifying the information field Info as "BIP39-KEY". Finally, a first encryption key Kenc with a length of 256 bits (L=32 bytes) is generated, satisfying: Kenc=HKDF(E, Salt=IDSIM,Info="BIP39-KEY",L=32), where Info="BIP39-KEY" is an optional context identifier string used to distinguish keys derived from the same initial material for different purposes. Here it is specified as "BIP39-KEY" to clarify that the key is related to the BIP39 mnemonic phrase system and is used for specific scenarios (such as encrypted storage of mnemonic phrases, encrypted key backup, etc.) to avoid confusion of keys for different purposes.

[0068] In this embodiment of the invention, a random entropy value is generated using a random number generator, providing a highly secure random basis for the mnemonic phrase and avoiding backup risks caused by predictable entropy values. A checksum is generated through hash calculation, and a portion of the bits are truncated and appended to form a complete random entropy value. This value can be used to verify whether the data has been tampered with or corrupted during subsequent mnemonic phrase recovery, ensuring the integrity and accuracy of the entropy value. By balancing the security and verifiability of the random entropy value, reliable core data support is provided for the generation, encryption, and subsequent recovery of the mnemonic phrase, further strengthening the security foundation of digital asset backup.

[0069] S33. Encrypt the mnemonic phrase using the first encryption key to obtain the initial encrypted ciphertext.

[0070] For example, the Super SIM card first calls the hardware-implemented AES-256-GCM encryption module in the security chip, using the first encryption key Kenc as the encryption key to encrypt the mnemonic phrase plaintext M (i.e., an ordered phrase composed of 24 BIP39 standard words). AES-256-GCM is a symmetric encryption algorithm that combines encryption and authentication functions. "256" indicates that the key length is 256 bits (matching Kenc). During the encryption process, GCM mode generates two parts simultaneously: 1) the initial encrypted ciphertext CM, which is the binary data of the mnemonic phrase plaintext M after encryption (CM = AES-GCM encrypted output); 2) the authentication tag T, a fixed-length checksum (generated by the authentication mechanism of GCM mode), used to verify whether the ciphertext has been tampered with or forged.

[0071] For example, after encryption is complete, the Super SIM card stores the core data (random entropy value E, initial encrypted ciphertext CM, and authentication tag T) uniformly in the hardware secure element SE. At the same time, to avoid the risk of temporary data leakage, the random entropy value E and the first encryption key Kenc temporarily generated in memory during the encryption process are immediately erased, leaving only the encrypted ciphertext and necessary auxiliary information in the SE.

[0072] S34. The initial encrypted ciphertext is returned to the first device so that the first device can process the initial encrypted ciphertext into blocks and then distribute it to the distributed storage nodes for storage.

[0073] For example, after the Super SIM card returns the initial encrypted ciphertext CM (including the authentication tag T) to the first device (i.e., the digital asset APP), the first device first processes the initial encrypted ciphertext CM, calculates the content identifier CID of the CM (usually generated by a hash algorithm such as SHA-256, used to uniquely identify the ciphertext), and defines the access permission tag Policy (here, the hash value of the user's PIN code, used as the basis for subsequent decryption permission verification). Subsequently, the initial encrypted ciphertext packages the CID, the CM which has been re-encrypted by AES-GCM (or directly uses the original CM), and the Policy into a data packet D={CID,AES-GCM(CM),Policy} in standard IPFS format. To achieve data disaster recovery and resistance to single points of failure, the first device uses Reed-Solomon encoding to fragment data packet D, generating multiple redundant blocks (such as D1, D2, ..., D8). A "5-of-8" disaster recovery rule is set, meaning that by retrieving any 5 of the 8 fragments, the complete data packet D can be reconstructed using the encoding algorithm, ensuring that the original information can still be recovered even if some storage nodes fail or data is corrupted. Next, the first device distributes these fragments to distributed IPFS nodes (such as decentralized storage networks Filecoin or Ceramic), utilizing IPFS's Distributed Hash Table (DHT) to achieve decentralized cloud storage of data, avoiding the single point of failure risk of traditional centralized storage and data loss due to regional disasters. Finally, the first device registers the CID (Data Unique Identifier) ​​and the hash value of the access policy to a public blockchain or consortium blockchain, forming an immutable record. The blockchain's notarization function ensures that the association between CID and Policy cannot be forged or tampered with. When any device needs to access the encrypted ciphertext, it must first verify the legality of the CID and the permission matching of the Policy through the blockchain, and then obtain the shards from the IPFS node and reconstruct the data.

[0074] In this embodiment of the invention, a high level of security and reliability for digital asset backup is achieved through a core encryption mechanism based on random entropy, combined with distributed storage. A mnemonic phrase is generated based on random entropy, and an encryption key is derived from it, ensuring the randomness of the mnemonic phrase and the strength of the encryption, thus preventing malicious cracking of backup information from the source. The encrypted ciphertext is stored in blocks on distributed nodes, leveraging the redundancy and resistance to single points of failure inherent in distributed architecture to avoid data loss or leakage due to centralized storage risks. This invention improves backup availability and disaster recovery capabilities through distributed storage, providing a reliable offline backup solution for the secure recovery of digital assets, effectively balancing security and accessibility, and reducing the risk of asset loss.

[0075] Furthermore, in this embodiment of the invention, after data backup, when a user needs to log in to their digital asset account on a new device (such as a different mobile phone), data recovery can be performed on the new device. See [link to relevant documentation]. Figure 9 , Figure 9 This is a flowchart of data recovery provided in an embodiment of the present invention, in which the digital asset management method includes steps S41 to S44. See also... Figure 10 , Figure 10 This is another flowchart of data recovery provided in the embodiments of the present invention, which is described below in conjunction with... Figure 10 The steps S41 to S44 above will be explained in detail.

[0076] S41. When receiving a decryption request carrying reconstructed encrypted ciphertext sent by the business backend, obtain the random entropy value; wherein, the decryption request is sent by the business backend after receiving a data recovery request sent by the second device.

[0077] For example, when a user needs to restore their digital asset account on a second device (such as a new mobile phone), they must initiate a data recovery request through the digital asset app on the second device. This request typically includes user authentication information (such as account, biometrics, or device identifier) ​​to prove recovery authorization to the backend. The backend then issues a reconstructed encrypted ciphertext. Upon receiving the decryption request, the Super SIM card obtains the random entropy value E in the hardware secure element (SE) after receiving the instruction.

[0078] Furthermore, the reconstructed encrypted ciphertext is obtained by the business backend reconstructing the blocks of the initial encrypted ciphertext obtained from the distributed storage node.

[0079] For example, when the second device initiates a data recovery request and passes the authentication of the business backend, the business backend first broadcasts a retrieval request to the IPFS distributed storage network based on the CID (Unique Content Identifier of the Initial Encrypted Ciphertext CM) previously stored on the blockchain. The purpose is to retrieve the previously stored fragments of the initial encrypted ciphertext. Since the initial encrypted ciphertext was divided into multiple redundant blocks using Reed-Solomon encoding and distributed across different IPFS nodes during storage, the business backend collects these fragments from the network until the number of fragments collected reaches a preset recovery threshold (e.g., at least 5 fragments). Subsequently, the business backend utilizes the error correction and reconstruction capabilities of Reed-Solomon encoding to verify the 5 collected fragments (verifying data integrity and ensuring that the fragments have not been tampered with), and reconstructs the complete original data packet D through reverse engineering using the encoding algorithm. After parsing data packet D, the reconstructed encrypted ciphertext can be extracted. (Including certification label T).

[0080] In this embodiment of the invention, the business backend obtains initial encrypted ciphertext blocks from distributed storage nodes and reassembles them to generate complete encrypted ciphertext. This ensures the security of ciphertext transmission and storage while improving the reliability of data recovery. Furthermore, the business backend restores the complete ciphertext by reassembling the blocks, ensuring that the decryption process obtains complete and valid data, providing a foundation for accurate mnemonic phrase recovery and asset migration. This achieves closed-loop management of distributed storage, block transmission, and complete reassembly of encrypted ciphertext, maintaining the security advantages of distributed storage while ensuring data integrity through the reassembly mechanism, further enhancing the security and availability of the entire digital asset backup and recovery process.

[0081] S42. Using the random entropy value as input key material, generate a second encryption key.

[0082] For example, the Super SIM card, in conjunction with IDSIM, executes the key derivation function HKDF-SHA512 again to generate a second encryption key. .

[0083] S43. Use the second encryption key to decrypt the reconstructed encrypted ciphertext to obtain the mnemonic phrase.

[0084] For example, using a second encryption key The reconstructed encrypted ciphertext The mnemonic phrase is decrypted and its integrity and authenticity are verified using the GCM certification tag T to recover the original mnemonic phrase.

[0085] S44. Send the mnemonic phrase to the business backend so that the business backend can query the asset information associated with the blockchain network based on the mnemonic phrase and synchronize the asset information to the second device.

[0086] For example, asset information refers to all core data related to a digital asset account, including account balance (such as the quantity of various cryptocurrencies), transaction records (including transaction hashes, timestamps, transfer amounts, counterparty addresses, etc.), smart contract interaction records, and the account's status information in the blockchain network (such as whether there are unconfirmed transactions or staking). Asset information can be queried using a mnemonic phrase because of the strong binding relationship between the mnemonic phrase and the blockchain account. The mnemonic phrase is generated based on a random entropy value E, which can be used to reconstruct a private key SK1 using a key derivation algorithm (such as BIP-32). The private key further corresponds to a unique public key PK1. PK1 is hashed to generate the blockchain digital asset account address, satisfying Wallet_Address=SHA3-512(PK1). The account address is the unique public identifier of the account in the blockchain network, and all asset changes related to that account (such as receiving and sending assets) are recorded in the on-chain data corresponding to that address. The business backend uses the mnemonic phrase to query the asset information associated with the original address in the blockchain network and synchronizes it to the digital account APP on the second device. After confirming asset information via the new device, users complete the account migration process and activate their trading rights.

[0087] In this embodiment of the invention, a homogeneous encryption key is generated based on the stored random entropy value, ensuring the accuracy and security of the decryption process and preventing the mnemonic phrase from being illegally stolen or tampered with during the recovery process. The recovery request from the second device is connected to the blockchain asset query through the business backend, achieving seamless synchronization between the mnemonic phrase and asset information, making cross-device asset migration efficient and feasible. Furthermore, the confidentiality of the recovery process is guaranteed through key homogeneity and local secure storage, while the collaboration between the business backend and the blockchain enhances the convenience of cross-device asset migration, providing users with a reliable cross-device asset management solution.

[0088] See Figure 11 , Figure 11 This is a structural block diagram of a digital asset management device 100 provided in an embodiment of the present invention. The digital asset management device 100 includes: The transaction hash value generation module 11 is used to perform hash calculation on the transaction data and generate a transaction hash value when it receives a transaction request carrying transaction data sent by the first device. The layered signature module 12 is used to perform layered signatures on the transaction hash value using a preset signature algorithm and trigger the user's personal identification code authentication, so as to release the signature data of the layered signature after the personal identification code authentication is successful. The data sending module 13 is used to send the verification digest of the personal identification code and the signature data to the blockchain network, so that the blockchain network can verify the signature data, and after the verification is successful, store the signature data and return a transaction confirmation event to the first device.

[0089] Specifically, the digital asset management device 100 further includes: An initial configuration parameter storage module is used to store the initial configuration parameters when it receives them from the business backend; wherein the initial configuration parameters are generated by the business backend after receiving the account creation request sent by the first device; The master key pair generation module is used to generate master key pairs using post-quantum cryptography algorithms; The master key pair processing module is used to store the private key in the master key pair and send the public key of the master key pair to the business platform, so that the business backend sends the public key to the blockchain network and registers the public key and creates a digital asset account on the blockchain network.

[0090] Specifically, the digital asset management device 100 further includes: The first random entropy value acquisition module is used to acquire a random entropy value when it receives a mnemonic word generation request sent by the first device; The first mnemonic word generation module is used to generate at least two mnemonic words using the random entropy value; The first encryption key generation module is used to generate a first encryption key using the random entropy value as input key material; An initial encrypted ciphertext generation module is used to encrypt the mnemonic phrase using the first encryption key to obtain the initial encrypted ciphertext; An initial encrypted ciphertext sending module is used to return the initial encrypted ciphertext to the first device, so that the first device can process the initial encrypted ciphertext into blocks and distribute it to distributed storage nodes for storage.

[0091] Specifically, the digital asset management device 100 further includes: The second random entropy value acquisition module is used to acquire the random entropy value when it receives a decryption request carrying reconstructed encrypted ciphertext sent by the business backend; wherein, the decryption request is sent by the business backend after receiving a data recovery request sent by the second device; The second encryption key generation module is used to generate a second encryption key using the random entropy value as input key material; The second mnemonic phrase generation module is used to decrypt the recombined encrypted ciphertext using the second encryption key to obtain the mnemonic phrase; The mnemonic phrase sending module is used to send the mnemonic phrase to the business backend, so that the business backend can query the asset information associated in the blockchain network based on the mnemonic phrase and synchronize the asset information to the second device.

[0092] It is worth noting that the working process of each module in the digital asset management device 100 described in the embodiments of the present invention can refer to the working process of the digital asset management method described in the above embodiments, and will not be repeated here.

[0093] See Figure 12 , Figure 12 This is a structural block diagram of a digital asset management device 200 provided in an embodiment of the present invention. The digital asset management device 200 includes a processor 21, a memory 22, and a computer program stored in the memory 22 and executable on the processor 21. When the processor 21 executes the computer program, it implements the steps in the various digital asset management method embodiments described above.

[0094] For example, the computer program may be divided into one or more modules / units, which are stored in the memory 22 and executed by the processor 21 to complete the present invention. The one or more modules / units may be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in the digital asset management device 200.

[0095] The digital asset management device 200 may include, but is not limited to, a processor 21 and a memory 22. Those skilled in the art will understand that the schematic diagram is merely an example of the digital asset management device 200 and does not constitute a limitation on the digital asset management device 200. It may include more or fewer components than illustrated, or combine certain components, or different components. For example, the digital asset management device 200 may also include input / output devices, network access devices, buses, etc.

[0096] The processor 21 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor 21 is the control center of the digital asset management device 200, connecting various parts of the digital asset management device 200 via various interfaces and lines.

[0097] The memory 22 can be used to store the computer programs and / or modules. The processor 21 implements various functions of the digital asset management device 200 by running or executing the computer programs and / or modules stored in the memory 22 and calling the data stored in the memory 22. The memory 22 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 22 may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0098] Wherein, if the modules / units integrated in the digital asset management device 200 are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by the processor 21, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0099] Furthermore, the present invention also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the digital asset management method as described in any of the above embodiments.

[0100] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method of digital asset management, characterized by, The method applied to a super SIM card comprises: Upon receiving a transaction request carrying transaction data sent by a first device, performing hash calculation on the transaction data to generate a transaction hash value; performing hierarchical signature on the transaction hash value through a preset signature algorithm, and triggering personal identification code authentication of a user to release signature data of the hierarchical signature after the personal identification code authentication is passed; sending a verification digest of the personal identification code and the signature data to a blockchain network to enable the blockchain network to verify the signature data and store the signature data after verification and return a transaction confirmation event to the first device.

2. The digital asset management method of claim 1, wherein, The hierarchical signature on the transaction hash value through the preset signature algorithm comprises: obtaining initial configuration parameters stored when a digital asset account is created; performing hash calculation on the initial configuration parameters and an initial random salt value to obtain an enhanced random salt value; performing block processing on the transaction hash value to obtain a plurality of hash blocks; constructing a Merkle tree using the hash blocks, and generating a signature segment for each hash block using a signature key chain once; encoding the signature segment, the enhanced random salt value and a root hash to generate signature data.

3. The digital asset management method of claim 1, wherein, Before receiving the transaction request carrying the transaction data sent by the first device, the method further comprises: Upon receiving initial configuration parameters sent by a business background, storing the initial configuration parameters; wherein the initial configuration parameters are generated by the business background after receiving an account creation request sent by the first device; generating a master key pair using a post-quantum cryptography algorithm; storing a private key in the master key pair, and sending a public key of the master key pair to the business platform to enable the business background to send the public key to a blockchain network and register and create a digital asset account on the blockchain network.

4. The digital asset management method of claim 3, wherein, The account creation request carries identification information, and the initial configuration parameters carry encoding data, a hash function type and a preset Merkle tree height; wherein the encoding data is obtained by encoding the identification information by the business background.

5. The digital asset management method of claim 3, wherein, The generation of the master key pair using the post-quantum cryptography algorithm comprises: obtaining a parameter set of the post-quantum cryptography algorithm, and generating a first noise vector and a second noise vector using the parameter set; determining a private key according to the first noise vector; generating a global matrix through a pseudo-random function, and calculating a public key using the global matrix, the first noise vector and the second noise vector.

6. The digital asset management method of claim 1, wherein, The method further comprises: Upon receiving a mnemonic word generation request sent by the first device, obtaining a random entropy value; generating at least two mnemonic words using the random entropy value, and generating a first encryption key using the random entropy value as input key material; encrypting the mnemonic words using the first encryption key to obtain initial encrypted ciphertext; returning the initial encrypted ciphertext to the first device to enable the first device to distribute the initial encrypted ciphertext to distributed storage nodes for storage after block processing.

7. The digital asset management method of claim 6, wherein, The generation of the at least two mnemonic words using the random entropy value comprises: performing hash calculation on the random entropy value to generate a checksum; appending part bits of the checksum to the random entropy value to obtain a binary string; segmenting the binary string to obtain at least two mnemonics.

8. The digital asset management method of claim 6, wherein, The method further comprises: obtaining the random entropy value when a decryption request carrying reorganized encrypted ciphertext is received from a service background, wherein the decryption request is sent by the service background after receiving a data recovery request sent by a second device; generating a second encryption key by taking the random entropy value as input key material; decrypting the reorganized encrypted ciphertext by using the second encryption key to obtain a mnemonic; sending the mnemonic to the service background, so that the service background queries associated asset information in the blockchain network based on the mnemonic, and synchronizes the asset information to the second device.

9. The digital asset management method of claim 8, wherein, The reorganized encrypted ciphertext is obtained by reorganizing the block of the initial encryption ciphertext obtained by the service background from the distributed storage node.

10. A digital asset management apparatus, characterized by comprising: The application is applied to a super SIM card, and comprises: a transaction hash value generation module configured to generate a transaction hash value by performing hash calculation on transaction data when a transaction request carrying the transaction data is received from a first device; a hierarchical signature module configured to perform hierarchical signature on the transaction hash value by using a preset signature algorithm, trigger personal identification code authentication of a user, and release signature data of the hierarchical signature after the personal identification code authentication is passed; a data sending module configured to send a verification digest of the personal identification code and the signature data to a blockchain network, so that the blockchain network verifies the signature data, stores the signature data after the verification is passed, and returns a transaction confirmation event to the first device.

11. A digital asset management device, characterized by, The computer program is configured to be executed by the processor, and the processor implements the digital asset management method according to any one of claims 1 to 10 when executing the computer program.

12. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, wherein the computer program controls a device where the computer readable storage medium is located to execute the digital asset management method according to any one of claims 1 to 10 when the computer program is running.

13. A computer program product, characterised in that, The computer program / instruction is executed by the processor to implement the digital asset management method according to any one of claims 1 to 10.

Images