Computer-implemented systems and methods including public key binding verification - Patents.com

Abstract

To provide a computer-implemented method.SOLUTION: The method includes providing a blockchain transaction comprising a public key combination verification function. The blockchain transaction is configured to be redeemable to permit access to, or transfer control of, a resource by providing the blockchain transaction with an input. The input comprises: a plurality of public keys; a gradient value (λ) related to two of the public keys; and a group public key derived from a combination of the public keys and the gradient value (λ). The blockchain transaction is configured to apply the public key verification function to the input to verify, upon successful redemption of the transaction, that the group public key is derived from the combination of the public keys.SELECTED DRAWING: Figure 6

Description

[Technical field]

[0001] The present disclosure relates generally to the transfer of resource control and / or access, and more particularly to the transfer of such control and / or access using cryptographic multi-signature methods on a blockchain. The present disclosure is particularly suited, but not limited to, for use on the Bitcoin blockchain or any variant of the Bitcoin protocol. [Background technology]

[0002] Herein, we use the term "blockchain" to encompass all forms of electronic, computer-based, distributed ledgers. These include consensus-based blockchain and transaction chain technologies, permissioned and permissionless ledgers, shared ledgers, and variations thereof. Although other blockchain implementations have been proposed and developed, the most widely known application of blockchain technology is the Bitcoin ledger. Bitcoin may be referred to herein for convenience and illustrative purposes, but it should be noted that this disclosure is not limited to use with the Bitcoin blockchain, and alternative blockchain implementations and protocols are encompassed within the scope of this disclosure. The term "user" here may refer to a human or processor-based resource.

[0003] A blockchain is a peer-to-peer electronic ledger implemented as a computer-based decentralized distributed system, composed of blocks, which in turn are composed of transactions. Each transaction is a data structure that encodes the transfer of control of a digital asset or resource (e.g., cryptocurrency or tokenized items) between participants in the blockchain system, and contains at least one input and at least one output. Each block contains a hash of the previous block, and these blocks are strung together to create a permanent, immutable record of all transactions written to the blockchain since origin. Transactions contain small programs, known as scripts, that embed their inputs and outputs and specify how and by whom the transaction's outputs are accessible. In the Bitcoin platform, these scripts are written using a scripting language based on the stack.

[0004] In order for a transaction to be written to the blockchain, it must be validated. Network nodes (miners) perform the work to ensure that invalid transactions are rejected from the network and that each transaction is valid. A software client installed on the node performs this validation work on unspent transactions (UTXOs) by executing the UTXO's lock and unlock scripts. If the execution of the lock and unlock scripts evaluates to TRUE, the transaction is valid and the transaction is written to the blockchain. Thus, for a transaction to be written to the blockchain, it must be (i) validated by the first node that receives the transaction, and if the transaction is valid, the node relays the transaction to other nodes in the network, (ii) added to a new block constructed by miners, and (iii) mined, i.e., added to the public ledger of past transactions.

[0005] Although blockchain technology is most widely known for its use in implementing cryptocurrencies, digital entrepreneurs are beginning to exploit the use of both the cryptographic security system on which Bitcoin is based and the data that can be stored on the blockchain to implement new systems. It would be highly advantageous if blockchain could be used to automate tasks and processes that are not limited to the cryptocurrency field. Such solutions could make their uses more diverse while taking advantage of the benefits of blockchain (e.g. permanence, tamper resistance of the record of events, decentralized processing, etc.).

[0006] Another area of ​​blockchain-related interest is the use of "tokens" (or "colored coins") to represent and transfer real-world entities via the blockchain. Potentially confidential or secret items can be represented by tokens that have no discernible meaning or value. Thus, tokens act as identifiers that allow real-world items to be referenced from the blockchain.

[0007] Blockchain transactions can utilize a built-in multi-signature protocol that restricts transactions such that M signatures out of a total of N must be presented as inputs to a Redeem script to redeem the transaction. For example, a transaction may be locked using a 3-of-5 multi-signature method, such that the transaction can only be unlocked using the three private keys that correspond to any three of the five signatures.

[0008] For the M-of-N method, referring to the commands used in the Bitcoin protocol variant, the opcode OP_MULTISIG takes as input N public keys and M signatures. The N public keys are stored in the Redeem script itself in this example. Starting with the first signature, the opcode searches through the N public keys to see if the signature was generated by it. It drops all keys whose signatures do not match. For this reason, the order of the signatures must match the provided order of the public keys. An example of a multisig Redeem script is given below: [Table 1]

[0009] [Table 1] This requires the following inputs to be provided in order to unlock it: [Table 2]

[0010] [Table 2] From the above, it is clear that the size of the Redeem script scales linearly with both the number of signatures required, M, and the number of participants, N. Thus, as M and N grow, the number of signatures required in the Redeem transaction to redeem the transaction grows, and so does the number of public keys. As a result, the network speed required to propagate, and the space required to store, subsequent Redeem transactions grows. Furthermore, the number of operations that need to be performed when combining the unlock script of the Redeem transaction with the Redeem script grows linearly with N and M.

[0011] It is therefore desirable to provide a solution that reduces the computational and storage requirements associated with transmitting, processing, and storing blockchain transactions that utilize multi-signature protocols, especially transactions that require the storage of a vast number of public keys.

[0012] Such an improved solution is now conceived. Thus, in accordance with the present disclosure, there is provided a method as defined in the accompanying claims. Summary of the Invention

[0013] The present disclosure provides a computer-implemented method, which may be described as a security method.

[0014] The method comprises: Providing a blockchain transaction comprising a public key binding verification function, the blockchain transaction configured to be redeemable to grant access to or transfer control of a resource by providing inputs to the blockchain transaction, the inputs comprising: Multiple public keys; at least one gradient value associated with each two of the plurality of public keys; a group key derived from a combination of the plurality of public keys and the at least one gradient value; wherein the blockchain transaction is configured to, upon successful redemption of the transaction, apply the public key verification function to the input to verify that the group key is derived from the combination of the plurality of public keys.

[0015] Such a method provides a way to transfer control of or access to resources represented and / or controlled by multiple private keys in a secure, reliable and publicly verifiable manner.

[0016] The method includes the steps of deriving a derived public key from a known value; constructing the derived public key as a sequence of secondary public keys; wherein the sequence of secondary public keys is a subset of the plurality of public keys.

[0017] This provides the advantage that a user can convert known requirements of the method into a public key to be used in the method, thereby increasing the versatility of the method. It provides the further advantage that the coefficients of the sequence can be pre-computed, thereby increasing the speed with which the method can be performed.

[0018] The method may include, prior to constructing the derived public key as the sequence of secondary public keys, applying a constraint function to the known values, thereby limiting the size of the subset.

[0019] This provides the advantage of further improving the efficiency of the method.

[0020] The method may include calculating a public key of the plurality based at least in part on a further public key of the plurality of public keys and the derived public key.

[0021] This provides the advantage of removing the requirement to store a given number of public keys, provided that one or more of the multiple are derivable from a single stored public key.

[0022] The blockchain transaction is: a group signature corresponding to the group public key; and Merkle root and A Merkle path validation function; The blockchain transaction may further include: A Merkle path associated with the plurality of public keys; and a group private key corresponding to the group signature; and The payment method is configured to be redeemable by providing the payment method.

[0023] Such a method requires fewer processing steps to achieve a given level of security, thereby offering the advantage of improving the efficiency of the method while maintaining security.

[0024] The present disclosure also provides a system including a processor and a memory including executable instructions that, upon execution by the processor, cause the system to perform any embodiment of the computer-implemented methods described herein.

[0025] The present disclosure also provides a non-transitory computer-readable storage medium having stored thereon executable instructions which, when executed by a processor of a computer system, cause the computer system to at least perform a computer-implemented method described herein.

[0026] These and other aspects of the present disclosure will be apparent from and will be taught with reference to the embodiments described herein, which are described hereinafter, by way of example only, and with reference to the accompanying drawings, in which: [Brief description of the drawings]

[0027] [Figure 1] 1 is a table illustrating data encoding of an uncompressed public key. [Diagram 2] 1 is a table illustrating the progression of a stack implementing an embodiment of the present disclosure. [Diagram 3] 1 is a table illustrating the progression of a stack implementing an embodiment of the present disclosure. [Figure 4] 1 is a table showing the relationship between M, N, and script size for different multi-signature methods. [Diagram 5] 1 illustrates generally two transactions embodying the present disclosure. [Figure 6] 2 is a flow chart showing a sequence of steps embodying the present disclosure. [Figure 7] FIG. 1 illustrates a schematic diagram of a computing environment in which various embodiments can be implemented. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0028] A method is disclosed for verifying the addition of two elliptic curve points in a Bitcoin script. Given two points P1, P2, and a candidate solution P3, the disclosed method verifies that P3=P1+P2 in the script. A further method is disclosed that extends the above method to a series of point additions.

[0029] The method may be used in a signature method for multiple participants, such as a multi-signature method, and may use the Elliptic Curve Digital Signature Algorithm (ECDSA) protocol.

[0030] The elliptic curve of prime numbers is defined by the following equation: y 2 =x 3 +ax+b According to the group structure of the curve, two points on the curve, P1=(x1,y1) and P2=(x2,y2), are added to obtain a third point, P3=(x3,y3), i.e., P3=P1+P2.

[0031] Point P3 is defined to be the point on the elliptic curve that passes through the line connecting P1 and P2 and then reflected about the x-axis. The formula for point addition is:

[0032]

number

[0033] It is not practical to apply the extended Euclidean algorithm within a blockchain transaction script, since it requires modular inverse computation, and therefore elliptic curve point addition as defined by the above formula cannot be implemented within the script.

[0034] In the following, a method is disclosed for verifying the solution of the addition of two points P1 and P2. The calculation of the solution P3=P1+P2 itself is performed outside the script, but the answer is verified within the script. This reduces the computational requirements that may be imposed on the blockchain node.

[0035] To accomplish this verification, we need the solution P3 and the value of the slope of the line between P1 and P2, denoted by λ. The calculation of λ is performed outside the script, but the verification of λ can be performed within the script.

[0036] New public key verification function<Point Add P1,P2,λ,P3> is defined in detail below and is configured to return true if the λ presented to it is the slope of the line between P1 and P2, and if P3=P1+P2. These two validations are accomplished directly in the script, which is emitted upon successful redemption of the transaction.

[0037] Execution of a function involves the following steps:

[0038]

number

[0039] The public key verification function described above operates on three public keys to verify that two of the public keys combine to produce a third public key. This can be stored to verify the addition of three public keys P=P1+P2+P3, and more. The extended function is denoted PointAddMulti and is defined below. Here, the verification procedure verifies that P1, P2, and P3 combine to produce P.

[0040]

number

[0041]

number

[0042] In Figure 1, the uncompressed public key data encoding is shown, where the dummy values ​​of the data are taken from the well-known book, Mastering Bitcoin, 2nd Edition, by A. Antonopoulos, O'Reilly Media (2017).

[0043] Given an uncompressed public key P, the x and y coordinates can be extracted directly from the Bitcoin script using the operator OP_SPLIT as follows:

[0044]

number

[0045]

number

[0046] 2, the first step in constructing the function PointAdd is to verify the input value of λ. If P1 ≠ P2, then it is checked whether the following equation remains true:

[0047]

number

[0048]

number

[0049]

number

[0050] If P1=P2, then a set of operations similar to the above formula can be constructed that checks that the following operations are true:

[0051]

number

[0052]

number

[0053]

number

[0054] The table in FIG. 3 shows the progression of the stack as the above operations are performed.

[0055] A new public key P3 can be generated by adding an existing public key P1 to the public key calculated by multiplying an elliptic curve generator point G by a number S. That is, P3=P1+S·G.

[0056]

number

[0057] Verification of the point addition P3=P1+S·G can be achieved by verifying a series of point additions involving fixed multiples of the generator G.

[0058] As an example, a double-and-add method may be used to decompose the point addition into the following series:

[0059]

number

[0060]

number

[0061] Therefore, P3 = P1 + S · G may be verified by adding at most 255 + 1 = 256 points.

[0062] As an alternative to the double-and-add method, other point-add algorithms such as the sliding window or Montgomery ladder method may be used.

[0063] To make the computation of the point addition with the computed key more manageable, S may be restricted to a narrower range, which may be application specific.

[0064] S represents a range of 4.3 billion values, as follows:

[0065]

number

[0066] As an example, the highest bid in a used car auction is US$16000. A bid of t US dollars, in the form of the number 16000, can be added to a public key P1 to obtain an additive key P=P1+g·G.

[0067] This may be verified in the script by adding up the 14 points.

[0068] To see how this can be used in a bidding process, let's assume the current highest bid for a car is $9000 USD, which is tracked by a particular UTXO. This UTXO has the following Redeem script:

[0069]

number

[0070]

number

[0071] The UTXO can be unlocked if a new bid for t>9000 is provided. The new bidder must provide their public key P1 and the solution P for the sum P=P1+t·G. The fact that they signed the transaction with the sum key P always links them to a specific bid for t USD.

[0072] As another example, consider a Bitcoin miner looking for a nonce (a number) that, when hashed by a block in the blockchain such as the current block, produces a value below a certain threshold. The miner may generate such a transaction locked with the transaction's public key and the first 9 digits of the nonce: P=P1+(first 9 digits of the nonce)·G. There are as many as 1 billion combinations for the first 9 digits of the number. Thus, a public key P can be verified using 30 point additions. This always links key P to the miner's public key and the nonce of the mined block.

[0073] The point-adding verification procedure in the script described above may be used to implement an efficient method of signing transactions using the M-of-N multi-signature method, thereby enabling a more efficient and secure method of transferring control of or access to resources using blockchain.

[0074] In the M-of-N method, the Bitcoin opcode OP_MULTISIG takes as input N public keys and M signatures. Starting with the first signature, the opcode searches through the N public keys to see if the signature was generated by that public key. It drops all keys whose signatures do not match. For this reason, the order of the signatures must match the provided order of the public keys.

[0075] The multisig Redeem script is as follows:

[0076]

number

[0077] From the above, we can see that the size of the script scales linearly with both the number of signatures M required and the number of participants N.

[0078] 4-6, a Merkle tree is created with a leaf corresponding to each M-of-N combination of public keys, which involves selecting M out of a total of N leaves. A Redeem script is then created that includes a Merkle root. The Redeem script requires an unlocked representation of the inputs, including a Merkle path and a signature verification method.

[0079] Two methods of transferring control of or access to a resource are described below, each with their own advantages and disadvantages. 1. Individual signature method: This uses each signature to sign the transaction individually and has the same functionality as multisig, but with a smaller script size. 2. Group Signature Method This provides a single signature of any M participants in a signing group. This can be any public key pre-agreed for each set of M participants, such as a key derived from a shared secret, or a key formed by adding the public keys of the group. In the latter case, an additional option to verify that the key is the sum of the individual member keys is to use the verification method described above.

[0080] Each method has different scaling properties, as summarized in the table shown in FIG.

[0081] Consider the 4-of-5 method, in which the Merkle tree has the following leaves:

[0082]

number

[0083]

number

[0084] In the individual signature method, each member of the group provides an individual signature for the transaction. The functionality of this method is the same as the standard multisig method, but it reduces the size of the script and improves the efficiency with which the script is executed. The script takes the following form:

[0085]

number

[0086]

number

[0087] In this way, P1, ..., P M The mapping of P1, ..., P M It may be a hash of the concatenation of

[0088] The main feature of this method is that each member signs a particular transaction. They do not disclose information about their private keys to each other, thus not compromising the security of their private keys.

[0089] 4, it can be seen that this method has advantageous scaling properties over traditional multisig methods, which is most noticeable when the multisig regime is at small M and large N, e.g., 5-of-1000.

[0090] In the group signature method, only one signature is needed for a group of M members to sign a transaction. The script takes the following form:

[0091]

number

[0092]

number

[0093] The advantage of this method is that the size of the unlocking script is very small, since only one signature is required: the number of public key additions in the script scales linearly with the number of participants M. Thus, this method offers a less expensive operation in terms of processing power than looking up each individual signature.

[0094] The method requires that participants share their private keys with each other. This means that it is useful to have the key pairs they use in the method be one-time use key pairs, which improves the security of the method. Another special feature is that any number of participants with access to the group private key can sign any transaction they wish, which improves the versatility of the method. There are applications where these features are particularly desirable, for example a group of directors who wish to activate a well-established last-resort clause recorded in the blockchain as a UTXO. This may be achieved by unlocking a specific UTXO using the method.

[0095] The above method is completely invisible to external observers; it is in fact a group signature method. To expose the fact that the signature and the corresponding public key relate to a group of users, the method declares in the script that the group public key is the sum of the public keys of the individual participants, P=P1+···+P M may be modified to require that the key be verified. This adapted method may use the key addition verification method described above.

[0096]

number

[0097]

number

[0098] Figure 5 shows a pair of transactions Tx1 and Tx2. Tx1 defines a UTXO with a Redeem script that includes a Verify Merkle Path function, a PointAddMulti function tailored to the specific M-of-N requirements, and a CheckSig function. Tx2 defines a transaction that is later submitted to the blockchain that aims to redeem the UTXO of Tx1 by presenting among its inputs to Tx1 the group signature, the group public key associated with the group signature, the gradient required by the PointAddMulti function, the user's group public key, and the associated Merkle Path.

[0099] Figure 6 shows a flow chart illustrating the steps taken to carry out a method according to the individual signature method and the group signature method described above. In Figure 6, Tx1 and Tx2 may represent a pair of transactions used according to either method.

[0100] Referring to FIG. 7, an illustrative simplified block diagram of a computing device 2600 that may be used to implement at least one embodiment of the present disclosure is provided. In various embodiments, the computing device 2600 may be used to implement any of the illustrated systems described above. For example, the computing device 2600 may be configured for use as a data server, a web server, a portable computing device, a personal computer, or any electronic computing device. As shown in FIG. 7, the computing device 2600 may include one or more processors with one or more levels of cache memory and memory controller (collectively labeled 2602) that may be configured to communicate with a storage subsystem 2606 that includes a main memory 2608 and a permanent storage device 2610. The main memory 2608 may include a dynamic random access memory (DRAM) 2618 and a read only memory (ROM) 2620 as shown. The storage subsystem 2606 and the cache memory 2602 may be used for storage of information such as details associated with transactions and blocks as described in this disclosure. The processor 2602 may be utilized to provide the steps or functions of any embodiment as described in this disclosure.

[0101] The processor 2602 may also communicate with one or more user interface input devices 2612 , one or more user interface output devices 2614 , and a network interface subsystem 2616 .

[0102] Bus subsystem 2604 may provide a mechanism that allows the various components and subsystems of computing device 2600 to communicate with each other as intended. Although bus subsystem 2604 is illustrated generally as a single bus, alternative embodiments of the bus subsystem may utilize multiple buses.

[0103] The network interface subsystem 2616 may provide an interface to other computing devices and networks. The network interface subsystem 2616, in some embodiments, may act as an interface to receive data from and transmit data to other systems in the computing device 2600. For example, the network interface subsystem 2616 may allow a data technician to connect the device to a network so that the data technician can send data to and receive data from the device without being in a remote location, such as a data center.

[0104] User interface input devices 2612 may include one or more user input devices, such as a keyboard, a pointing device such as an integrated mouse, trackball, touchpad, or graphics tablet, a scanner, a barcode scanner, a touch screen integrated into a display, a voice recognition system, an audio input device such as a microphone, and other types of input devices. In general, use of the term "input device" is intended to include all possible types of devices and mechanisms for inputting information into computing device 2600.

[0105] The one or more user interface output devices 2614 may include a display subsystem, a printer, or a non-visual display such as an audio output device, etc. The display subsystem may include a cathode ray tube (CRT), a liquid crystal display (LCD), a light emitting diode (LED) display, or a flat-panel device such as a projection or other display device. In general, use of the term "output device" is intended to include all possible types of devices and mechanisms for outputting information from the computing device 2600. The one or more user interface output devices 2614 may be used, for example, to present a user interface and facilitate user interaction with applications that perform the processes and transformations described herein, when such interaction is appropriate.

[0106] The storage subsystem 2606 may provide a computer-readable storage medium that stores basic programming and data structures that provide the functionality of at least one embodiment of the present disclosure. Applications (e.g., programs, code modules, instructions) that, when executed by one or more processors, provide the functionality of one or more embodiments of the present disclosure may be stored in the storage subsystem 2606. These application modules or instructions may be executed by one or more processors 2602. The storage subsystem 2606 also provides a repository for storing data used in accordance with the present disclosure. For example, the main memory 2608 and the cache memory 2602 may provide volatile storage for programs and data. The permanent storage device 2610 may provide permanent (non-volatile) storage of programs and data and may include a magnetic hard disk drive, one or more floppy disk drives associated with removable media, one or more optical drives (e.g., CD-ROM, or DVD, or Blue-Ray) drives associated with removable media, and other similar storage media. Such programs and data may include programs for performing the steps of one or more embodiments described in this disclosure, and data associated with the transactions and blocks described in this disclosure.

[0107] The computing device 2600 may be of various types, including a portable computing device, a tablet computer, a workstation, or any other device described below. Additionally, the computing device 2600 may include another device that can be connected to the computing device 2600 through one or more ports (e.g., USB, headphone jack, optical connector, etc.). A device that can be connected to the computing device 2600 may include multiple ports configured to receive optical fiber connectors. The device may thus be configured to convert optical signals into electrical signals that are transmitted to the computing device 2600 through the ports connecting the devices for processing. Due to the ever-changing nature of computers and networks, the description of the computing device 2600 shown in FIG. 7 is intended only as a specific example for purposes of describing a preferred embodiment of the device. Many other configurations are possible having more or fewer components than the system shown in FIG. 7.

[0108] It should be noted that the above-described embodiments illustrate, rather than limit, the present invention, and that those skilled in the art can devise many alternative embodiments without departing from the scope of the present disclosure, which is defined by the appended claims. In the claims, any reference signs in parentheses are not intended to limit the claims. The terms "comprising" and "comprises", etc., do not exclude the presence of elements or steps other than those listed in any claim or the specification as a whole. In this specification, "comprising" means "having or consisting of" and "comprises" means "comprising or consisting of". A singular reference of an element does not exclude a plural reference of such an element. Vice versa. The present disclosure can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a device claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The mere fact that certain means are recited in mutually different dependent claims does not indicate that a combination of these means cannot be used to advantage.< / r> < / sigm> < / sig2> < / sig1> < / x1> < / x2> < / y2>

Claims

1. 1. A computer-implemented method comprising: Obtaining a first blockchain transaction having an output including a public key combination verification function, the function including a plurality of public keys and a group public key derived from a combination of the public keys, the first blockchain transaction configured to be redeemable to grant access to or transfer control of a resource; determining at least one gradient value associated with said public key; providing a second blockchain transaction including inputs including the public key, the at least one gradient value, and the group public key; Including, The first blockchain transaction is configured to be redeemable to grant access to or transfer control of a resource upon successful application of the public key combination verification function to the inputs to verify that the group public key was derived from the combination of the public keys.

2. The successful application of the public key binding verification function is (i) applying the function to a first public key and a second public key using gradient values ​​associated with the first and second public keys to obtain a first result; (ii) applying the function to the first result and the third public key using a gradient value associated with the first result and a third public key to obtain a second result; The method of claim 1 , comprising:

3. 3. The method of claim 2, further comprising repeating (ii) at least once, with an additional public key in each iteration.

4. The method of any one of claims 1 to 3, further comprising the step of submitting the second blockchain transaction to a blockchain.

5. The output of the first blockchain transaction is a group signature corresponding to the group public key; and Merkle root and A Merkle path validation function; Further comprising: The input of the second blockchain transaction is: A Merkle path associated with the plurality of public keys; and a group private key corresponding to the group signature; and The method according to any one of claims 1 to 4, comprising:

6. The output of the first blockchain transaction is A plurality of signatures corresponding to the plurality of public keys; and Merkle root and A Merkle path validation function; Further comprising: The input of the second blockchain transaction is: A Merkle path associated with the plurality of public keys; and a plurality of private keys corresponding to the plurality of signatures; The method according to any one of claims 1 to 4, comprising:

7. 1. A system comprising: A processor; a memory containing executable instructions which, upon execution by the processor, cause the system to perform a computer-implemented method according to any one of claims 1 to 6; A system including:

8. A non-transitory computer readable storage medium having stored thereon executable instructions which, when executed by a processor of a computer system, cause the computer system to perform at least one of the computer-implemented methods of any one of claims 1 to 6.

Images