MPC threshold signature method and system suitable for HSM

Abstract

The invention discloses an MPC threshold signature method and system suitable for HSM, and relates to the technical field of information security and cryptography, and the method comprises the steps: a management module manages a plurality of hardware security modules HSM, coordinates a key generation module of each HSM to execute a distributed key generation protocol DKG, and enables a private key fragment to be directly generated in each HSM and to be encrypted and stored; the MPC threshold signature module receives a to-be-signed message of an application APP and user certificate information, calls the management module to perform identity verification on the user certificate information, and obtains a target HSM node list associated with a user passing verification; the MPC threshold signature module schedules a threshold signature module with at least a threshold value of t HSM nodes according to the target HSM node list, and MPC threshold signature operation is executed in each HSM based on private key fragments; and the MPC threshold signature module receives partial signatures returned by each HSM, and aggregates the partial signatures into a standard digital signature for realizing efficient, compliant and single-point fault resistant digital signature operation on the premise of ensuring absolute security of the private key.

Description

Technical Field

[0001] This invention relates to the fields of information security and cryptography, and more specifically to an MPC threshold signature method and system applicable to HSM. Background Technology

[0002] With the acceleration of digitalization, digital signatures have become an important means of ensuring electronic transactions, identity authentication, and data integrity. Traditional digital signatures rely on centralized key storage, where the private key is stored entirely in a single Hardware Security Module (HSM). While this model provides physical-level protection, a single point of failure remains. If the HSM is compromised or misused by internal personnel, the private key faces a high risk of being stolen or misused.

[0003] To address the aforementioned risks, existing technologies primarily attempt improvements through two approaches, but both suffer from significant technical drawbacks. The first approach employs a centralized key distribution mechanism, where a designated HSM generates private keys and distributes shares. During signing, the complete private key must first be reconstructed in memory. This approach not only carries the risk of single-point failure at the central node and leakage of private key reconstruction, but also requires complete trust in the central node, making it difficult to meet the availability and security requirements of high-concurrency scenarios. The second approach introduces a secure multi-party computation (MPC) protocol. While this avoids private key reconstruction, existing HSMs do not natively support the complex cryptographic interactions required for MPC. This necessitates the application layer manually coordinating dozens to hundreds of HSM calls and handling complex intermediate state synchronization, significantly increasing the development and maintenance complexity of the system.

[0004] Therefore, there is an urgent need for a new signature method that can deeply integrate the MPC protocol into the HSM, ensure that the private key will never be reassembled, and simplify application layer calls, in order to solve the technical problems of low security, complex interface and loose management in the existing technology. Summary of the Invention

[0005] In view of the above problems, this invention is proposed to provide an MPC threshold signature method and system suitable for HSMs that overcomes or at least partially solves the above problems. By deeply integrating the distributed key generation (DKG) with the entire threshold signature process within multiple hardware security modules (HSMs), it ensures that the private key and its complete representation in any form never reappear or are never reassembled, while simplifying the calling complexity of the MPC system. It is used to achieve efficient, compliant, and single-point-of-failure-resistant digital signature operations while ensuring absolute security of the private key, and is particularly suitable for banks, securities firms, digital asset custody, and national critical information infrastructure.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] In a first aspect, embodiments of the present invention provide an MPC threshold signature method suitable for HSM, comprising the following steps: The management module manages multiple hardware security modules (HSMs) and coordinates the key generation modules of each HSM to execute the distributed key generation protocol (DKG), enabling private key fragments to be generated and encrypted and stored directly within each HSM. The MPC threshold signature module receives the pending signature message and user certificate information from the application (APP), calls the management module to verify the user certificate information, and obtains the list of target HSM nodes associated with the verified user. The MPC threshold signature module schedules at least t threshold signature modules of HSM nodes according to the target HSM node list, and performs MPC threshold signature operation based on the private key fragmentation within each HSM to obtain a partial signature; The MPC threshold signature module receives partial signatures returned by each HSM and aggregates them into a standard digital signature.

[0008] Preferably, the specific implementation process of the Distributed Key Generation Protocol (DKG) includes: Each participating HSM node i Construct t Calculate a first-order random polynomial and its corresponding Feldman commitment value; HSM node i The key share is sent to other HSM nodes via an SSL encrypted channel, and the promised value is broadcast. HSM node i Receive key shares and commitment values ​​from other HSM nodes, verify the consistency between the commitment value and the key share, and if the verification is successful, calculate and generate a local final private key fragment using the received key share, and encrypt and store the private key fragment using the root key built into the HSM.

[0009] Preferably, the specific implementation process of the MPC threshold signature module scheduling the HSM to perform threshold signature includes: Each participating HSM node is instructed to generate a random number pair. And calculate the corresponding commitment value pair ; The MPC threshold signature module calculates the hash value m of the message to be signed, obtains commitment pairs and constructs a binding list B containing the IDs of each node and the commitment values ​​of each node, and sends the hash value m and the binding list B of the message to be signed to all participating HSMs. Each HSM node verifies the validity of the hash value m of the message to be signed and the binding list B, calculates the binding value, and calculates the local random number and random point contribution based on the binding value; Each HSM node calculates the Lagrange interpolation coefficients and, based on the local private key, calculates a partial signature and returns it to the MPC threshold signature module.

[0010] Preferably, the management module also provides a certificate and key sharding binding interface, the specific implementation process of which includes: Receive user and key fragment binding requests initiated by the APP; Generate an X.509 certificate cert, and record the certificate public key, certificate identifier certID, and HSM IP address in a mapping file; Call the key generation module of any HSM to obtain the shared public key MPC_PK; The certificate cert and shared public key MPC_PK are returned to the APP so that the APP can bind the user identity with the certificate cert.

[0011] Preferably, the specific implementation process of the MPC threshold signature module calling the management module to authenticate the user certificate information includes: Receive the message M to be signed sent by the APP, t certificate identifiers certID, and the signature value SignData of the t certificate identifiers certID for the message M1; The management module retrieves the corresponding certificate public key (PK) from the mapping file based on the certificate identifier certID; The signature verification operation is performed using the signature value SignData, the message M1 corresponding to the SignData signature value, and the certificate public key PK. After successful verification, the target HSM node list is returned.

[0012] Secondly, embodiments of the present invention provide an MPC threshold signature system suitable for HSM, comprising: an MPC threshold signature module, a management module, and multiple hardware security modules (HSMs) communicatively connected to the management module; The management module is configured to manage the multiple HSMs and coordinate the key generation modules within each HSM to execute the Distributed Key Generation Protocol (DKG), so that private key fragments are generated and encrypted and stored directly within each HSM. The MPC threshold signature module, which is communicatively connected to the management module and the multiple HSMs respectively, is configured as follows: Receive the pending signature message and user certificate information sent by the application APP, call the management module to verify the user certificate information, and obtain the list of target HSM nodes associated with the verified users; Based on the target HSM node list, the threshold signature module of at least t HSM nodes in the scheduling list performs MPC threshold signature operation based on the private key fragmentation within each HSM to obtain a partial signature; Receive partial signatures returned by each HSM, aggregate them into a standard digital signature, and return it to the APP.

[0013] Thirdly, embodiments of the present invention provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements an MPC threshold signature method suitable for HSM.

[0014] Fourthly, embodiments of the present invention provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement an MPC threshold signature method suitable for HSM.

[0015] As can be seen from the above technical solution, compared with the prior art, the present invention discloses an MPC threshold signature method and system suitable for HSM, which has the following effects: (1) The private key is distributed and stored in multiple HSMs in a sharded manner from generation to use. The complete private key is never reassembled or appears incomplete, which improves the system security. (2) Using the DKG scheme, each participant acts as a key generator, completely eliminating the risk of a single point of failure for a centralized key distributor; (3) It combines DKG cryptographic algorithm and HSM hardware protection, providing security at both the software and hardware levels; (4) All MPC operations (including distributed key fragmentation generation and threshold signature) are performed within each HSM, and intermediate values ​​do not leave the hardware security boundary, effectively resisting memory snooping, side-channel attacks and operating system-level threats; (5) Supports flexible threshold configuration (n≥3,2≤t≤n-1). Combined with the user certificate and shared public key binding mechanism, it can dynamically implement business strategies such as "multi-person approval, hierarchical permission, and temporary authorization" without modifying the underlying key or upgrading the on-chain contract, which significantly improves the system's flexibility and operational efficiency.

[0016] (6) The APP only needs to make one API call to obtain the standard signature, hiding the complexity of MPC collaboration, and at the same time, it achieves strong identity authentication through the front-end USER certificate verification, taking into account both security and ease of use.

[0017] (7) All sensitive operations are performed within HSM, supporting, but not limited to, SM2 and ECDSA algorithms, to meet compliance requirements in multiple scenarios such as finance, government affairs and Web3. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0019] Figure 1 This is a flowchart of an MPC threshold signature method applicable to HSM provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of an MPC threshold signature system suitable for HSM provided in an embodiment of the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] This invention discloses an MPC threshold signature method suitable for HSM, such as... Figure 1 As shown, it includes the following steps: The management module manages multiple hardware security modules (HSMs) and coordinates the key generation modules of each HSM to execute the distributed key generation protocol (DKG), so that private key fragments are generated and encrypted and stored directly within each HSM, ensuring that the complete private key never appears. The MPC threshold signature module receives the pending signature message and user certificate information from the application (APP), calls the management module to verify the user certificate information, and obtains the list of target HSM nodes associated with the verified user. The MPC threshold signature module schedules at least t threshold signature modules of HSM nodes according to the target HSM node list, and performs MPC threshold signature operations based on private key fragmentation within each HSM to obtain a partial signature; The MPC threshold signature module receives partial signatures returned by each HSM and aggregates them into a standard digital signature. All MPC operation steps are completed within the security boundary of the HSM. Private key fragmentation and intermediate value calculation do not leave the hardware environment. The MPC threshold signature module provides a unified atomic signature interface to external APP.

[0022] In this embodiment, the specific implementation process of the Distributed Key Generation Protocol (DKG) includes: Each participating HSM node i Construct t First-order random polynomial And calculate the corresponding Feldman commitment value. , , in t represents the threshold value, 2≤t≤n 1, It is an HSM node HSM i The generated random coefficients, The base point of the elliptic curve It is a random number. It is the order; Each HSM node i Key share via SSL encrypted channel Send it to other HSM nodes j, and broadcast the commitment value, i≠j. Modulus Operations, This represents the unique identifier of HSM node j; Each HSM node i Receive key shares and commitment values ​​from other HSM nodes, and verify the consistency between the commitment value and the key share: calculate , Verify whether V and W are consistent; If the verification passes, the received key share is used to calculate and generate the final local private key fragment. , indicating to The accumulated value is moduloed, and the private key fragments are encrypted and stored using the root key built into HSM (symmetric key, including but not limited to SM4 and AES256); Calculate the shared public key: MPC_PK = , where n represents the total number of HSM nodes, stores MPC_PK in HSM and returns it to the MPC signature scheduling system.

[0023] In this embodiment, the specific implementation process of the MPC threshold signature module scheduling the HSM to perform threshold signature includes: Call each HSM node that participated in the signing Generate random number pairs And calculate the corresponding commitment value pair , , The current set A of signers {1,2,...,n},|A|=t; The MPC threshold signature module calculates the hash value m of the message M to be signed, obtains commitment pairs, constructs a binding list B containing the IDs of each node and their commitment values, and sends the hash value m and the binding list B of the message to be signed to all participating HSMs. ; Each HSM node verifies the format validity of the hash value m of the message to be signed and the binding list B, and calculates the binding value (for the current node). l For a hash value m, within a specific current-round random number context B, calculate a unique "salt value": And calculate a local random number (nonce) based on the bound value: and random point contribution ; Calculate the Lagrange interpolation coefficients for each HSM node. And calculate partial signatures based on local private key fragments. ,Will The public key is returned to the MPC threshold signature module, where it is fragmented. ,in Indicates HSM node l Private key fragments, Indicates HSM node h A unique identifier Indicates HSM node l A unique identifier.

[0024] In this embodiment, the management module also provides a certificate and key sharding binding interface, the specific implementation process of which includes: Receive user and key fragment binding requests initiated by the APP; Generate an X.509 certificate cert, and record the certificate public key, certificate identifier certID, and HSM IP address in a mapping file; Call the key generation module of any HSM to obtain the shared public key MPC_PK; The certificate cert and shared public key MPC_PK are returned to the APP so that the APP can bind the user identity with the certificate cert. At this point, the binding is complete, and the USER establishes an authorization association with the key fragment in the HSM.

[0025] In this embodiment, the specific implementation process of the MPC threshold signature module calling the management module to authenticate user certificate information includes: Receive the message M to be signed sent by the APP, t certificate identifiers certID, and the signature value SignData of the t certificate identifiers certID on the message M1, 2≤t≤n-1; The management module retrieves the corresponding certificate public key (PK) from the mapping file based on the certificate identifier certID; The signature verification operation is performed using the signature value SignData, the message M1 corresponding to the SignData signature value, and the certificate public key PK. After successful verification, the target HSM node list is returned.

[0026] In this embodiment, the MPC threshold signature module receives partial signatures returned by each HSM and aggregates them into a standard digital signature. The specific process is as follows: Verify the signature of each HSM section: Verify If the verification fails, the malicious node is recorded and the verification is terminated; otherwise, the verification passes.

[0027] After successful verification, the MPC threshold signature module calculates the aggregate signature. Output standard digital signature R represents the aggregated random points. .

[0028] This invention provides an MPC threshold signature system suitable for HSMs, such as... Figure 2 As shown, it includes: an MPC threshold signature module, a management module, and multiple hardware security modules (HSMs) that communicate with the management module; The management module is configured to manage multiple HSMs and coordinate the key generation modules within each HSM to execute the Distributed Key Generation Protocol (DKG), enabling private key fragments to be generated and encrypted and stored directly within each HSM. The MPC threshold signature module, which communicates with the management module and multiple HSMs respectively, is configured as follows: Receive the pending signature message and user certificate information sent by the application APP, call the management module to verify the user certificate information, and obtain the list of target HSM nodes associated with the verified users; Based on the target HSM node list, the threshold signature modules of at least t HSM nodes in the scheduling list perform MPC threshold signature operations based on private key fragmentation within each HSM to obtain partial signatures; Receive partial signatures returned by each HSM, aggregate them into a standard digital signature, and return it to the APP; The system provides a unified atomic signature interface to the outside world. All MPC threshold signature operations are completed within the security boundary of HSM, and private key fragmentation and intermediate value calculation do not leave the hardware environment.

[0029] Based on the same inventive concept, and since the principle by which the system solves the problem is similar to the aforementioned method, the repetitive parts will not be repeated.

[0030] This embodiment provides a computer device, including: a memory and a processor. The memory stores a computer program that can run on the processor. When the processor executes the computer program, it implements an MPC threshold signature method suitable for HSM.

[0031] This embodiment provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements an MPC threshold signature method suitable for HSM.

[0032] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0033] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0034] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An MPC threshold signature method suitable for HSM, characterized in that, Includes the following steps: The management module manages multiple hardware security modules (HSMs) and coordinates the key generation modules of each HSM to execute the distributed key generation protocol (DKG), enabling private key fragments to be generated and encrypted and stored directly within each HSM. The MPC threshold signature module receives the pending signature message and user certificate information from the application (APP), calls the management module to verify the user certificate information, and obtains the list of target HSM nodes associated with the verified user. The MPC threshold signature module schedules at least t threshold signature modules of HSM nodes according to the target HSM node list, and performs MPC threshold signature operation based on the private key fragmentation within each HSM to obtain a partial signature; The MPC threshold signature module receives partial signatures returned by each HSM and aggregates them into a standard digital signature.

2. The method as described in claim 1, characterized in that, The specific implementation process of the Distributed Key Generation Protocol (DKG) includes: Each participating HSM node i Construct t Calculate a first-order random polynomial and its corresponding Feldman commitment value; HSM node i The key share is sent to other HSM nodes via an SSL encrypted channel, and the promised value is broadcast. HSM node i Receive key shares and commitment values ​​from other HSM nodes, verify the consistency between the commitment value and the key share, and if the verification is successful, calculate and generate a local final private key fragment using the received key share, and encrypt and store the private key fragment using the root key built into the HSM.

3. The method as described in claim 1, characterized in that, The specific implementation process of the MPC threshold signature module scheduling the HSM to perform threshold signatures includes: Each participating HSM node is instructed to generate a random number pair. And calculate the corresponding commitment value pair ; The MPC threshold signature module calculates the hash value m of the message to be signed, obtains commitment pairs and constructs a binding list B containing the IDs of each node and the commitment values ​​of each node, and sends the hash value m and the binding list B of the message to be signed to all participating HSMs. Each HSM node verifies the validity of the hash value m of the message to be signed and the binding list B, calculates the binding value, and calculates the local random number and random point contribution based on the binding value; Each HSM node calculates the Lagrange interpolation coefficients and, based on the local private key, calculates a partial signature and returns it to the MPC threshold signature module.

4. The method as described in claim 1, characterized in that, The management module also provides an interface for binding certificates and key fragments. The specific implementation process includes: Receive user and key fragment binding requests initiated by the APP; Generate an X.509 certificate cert, and record the certificate public key, certificate identifier certID, and HSM IP address in a mapping file; Call the key generation module of any HSM to obtain the shared public key MPC_PK; The certificate cert and shared public key MPC_PK are returned to the APP so that the APP can bind the user identity with the certificate cert.

5. The method as described in claim 4, characterized in that, The specific implementation process of the MPC threshold signature module calling the management module to authenticate the user certificate information includes: Receive the message M to be signed sent by the APP, t certificate identifiers certID, and the signature value SignData of the t certificate identifiers certID for the message M1; The management module retrieves the corresponding certificate public key (PK) from the mapping file based on the certificate identifier certID; The signature verification operation is performed using the signature value SignData, the message M1 corresponding to the SignData signature value, and the certificate public key PK. After successful verification, the target HSM node list is returned.

6. An MPC threshold signature system suitable for HSM, characterized in that, include: The MPC threshold signature module, the management module, and multiple hardware security modules (HSMs) that are communicatively connected to the management module; The management module is configured to manage the multiple HSMs and coordinate the key generation modules within each HSM to execute the Distributed Key Generation Protocol (DKG), so that private key fragments are generated and encrypted and stored directly within each HSM. The MPC threshold signature module, which is communicatively connected to the management module and the multiple HSMs respectively, is configured as follows: Receive the pending signature message and user certificate information sent by the application APP, call the management module to verify the user certificate information, and obtain the list of target HSM nodes associated with the verified users; Based on the target HSM node list, the threshold signature module of at least t HSM nodes in the scheduling list performs MPC threshold signature operation based on the private key fragmentation within each HSM to obtain a partial signature; Receive partial signatures returned by each HSM, aggregate them into a standard digital signature, and return it to the APP.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements an MPC threshold signature method for HSM as described in any one of claims 1 to 5.

8. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements an MPC threshold signature method applicable to HSM as described in any one of claims 1 to 5.

Images