Blockchain-based key management system

Abstract

The present invention relates to a blockchain-based key management system. The blockchain-based key management system comprises: a chain code module; distributed storage; and a blockchain network, wherein a private key is encrypted and stored in the distributed storage and an address for accessing the private key is recorded in a blockchain, thereby enabling significant reduction of a risk of private key leakage due to a single point of failure or hacking.

Description

Blockchain-based key management system

[0001] The present invention relates to a blockchain-based key management system.

[0002] In today's digital environment where security is paramount, Public Key Infrastructure (PKI), which utilizes private and public keys, has established itself as a core technology for secure data encryption and user authentication.

[0003] In conventional key management methods, private keys are typically stored on the user's device or a central server. In this scenario, there is a high risk of private key leakage if the device is lost or the central server is hacked. This issue can lead to catastrophic consequences, particularly in industries requiring high levels of security, such as finance, healthcare, or defense.

[0004] Furthermore, if a user loses their private key, the process of recovering or regenerating it is complex and costly, and in some cases, it may even be impossible.

[0005] Furthermore, existing key management systems are primarily designed based on a centralized structure, which creates a potential for Single Point of Failure (SFO) issues. This threatens the availability and security of the system and limits its ability to provide reliable services.

[0006] The present invention aims to solve the aforementioned problem and provides a blockchain-based key management system.

[0007] Furthermore, it is evident that the technical challenges are not limited to those described above, and that other technical challenges may be derived from the following description.

[0008] A blockchain-based key management system according to one embodiment of the present invention comprises a chaincode module; distributed storage; and a blockchain network. The blockchain-based key management system comprises: a chaincode module; a distributed storage; and a blockchain network. The chaincode module, upon receiving a request for cryptographic key generation including an Entity ID and an Entity PW from a user, generates a private key and a public key of the user, distributes the private key into a predetermined number of chunks, encrypts the chunks using the Entity PW, and transmits them to the distributed storage. The distributed storage stores the encrypted chunks in a distributed manner and returns a Data ID for querying the encrypted chunks to the chaincode module. When the Data ID is returned, the chaincode module generates a Key ID using the Entity ID and the Entity PW, transmits the Entity ID, the Data ID, and the Key ID to the blockchain network, and the blockchain network records the Entity ID, the Data ID, and the Key ID on the blockchain according to a predetermined consensus algorithm.

[0009] The above chaincode module is characterized by generating a private key using a random number generator and generating a public key from the generated private key using the Elliptic Curve Digital Signature Algorithm (ECDSA) or the Edwards Curve Digital Signature Algorithm (EdDSA).

[0010] The above chaincode module is characterized by distributing the private key into a predetermined number of chunks using the Shamir secret sharing algorithm, inputting the Entity PW into a hash function to obtain a hash value, and encrypting the chunks using the hash value as a secret key.

[0011] The above chaincode module is characterized by inputting the Entity ID into a hash function to obtain a hash value, setting the obtained hash value as a salt, inputting the salt value into the hash function a predetermined number of times to obtain a hash value, and generating the Key ID by combining the salt, the round salt, and the Entity PW.

[0012] The above chaincode module is characterized by, upon receiving a user's cryptographic key lookup request including an Entity ID and an Entity PW from the user, requesting and obtaining a Key ID mapped to the Entity ID from the blockchain network, generating a verification Key ID using the Entity ID and Entity PW, and determining whether the verification Key ID matches the obtained Key ID.

[0013] The above chaincode module is characterized by requesting and obtaining a Data ID mapped to the Entity ID from the blockchain network when the verification Key ID and the obtained Key ID match, and accessing an encrypted chunk in the distributed storage using the obtained Data ID.

[0014] The above chaincode module is characterized by decrypting the above encrypted chunk using the Entity PW, inversely calculating the private key using the Shamir secret sharing algorithm on the decrypted chunk, and returning the private key to the user.

[0015] The present invention has the effect of significantly reducing the risk of private key leakage due to a single point of failure or hacking by encrypting and storing the private key in distributed storage and recording the address accessing the private key on the blockchain.

[0016] Furthermore, since the effects of the present invention described above are naturally manifested by the composition of the described content regardless of whether the inventor is aware of them, the aforementioned effects are merely a few effects based on the described content and should not be recognized as describing all effects that the inventor has grasped or that actually exist.

[0017] In addition, the effects of the present invention should be further understood from the overall description in the specification, and even if not explicitly stated, if an effect can be recognized as such by a person of ordinary knowledge in the technical field to which the described content belongs through the present specification, it should be considered as an effect described in the present specification.

[0018] FIG. 1 is a diagram showing a blockchain-based key management system according to one embodiment of the present invention.

[0019] FIG. 2 is a diagram showing the process of a blockchain-based key management system generating a cryptographic key according to one embodiment of the present invention.

[0020] FIG. 3 is a diagram showing the process of a blockchain-based key management system looking up a cryptographic key according to one embodiment of the present invention.

[0021] * Explanation of symbols for major parts of the drawing *

[0022] 100: User terminal 200: Chaincode module

[0023] 300: Distributed storage 400: Blockchain network

[0024] It should be noted that in assigning reference numbers to the components of each drawing in this specification, identical components are given the same number as much as possible, even if they are shown in different drawings.

[0025] Meanwhile, the meaning of the terms described in this specification should be understood as follows. Singular expressions should be understood to include plural expressions unless the context clearly defines otherwise, and terms such as "first," "second," etc. are intended to distinguish one component from another, and the scope of rights should not be limited by these terms. Terms such as "include" or "have" should be understood as not excluding in advance the existence or addition of one or more other features, numbers, steps, actions, components, parts, or combinations thereof.

[0026] The term “at least one” should be understood to include all combinations that can be presented from one or more related items. For example, the meaning of “at least one of the first item, the second item and the third item” is not only the first item, the second item, or the third item individually, but also all combinations of items that can be presented from two or more of the first item, the second item, and the third item.

[0027] FIG. 1 is a diagram showing a blockchain-based key management system according to an embodiment of the present invention. As shown in FIG. 1, the blockchain-based key management system (1) according to the present invention includes a user terminal (100), a chaincode module (200), a distributed storage (300), and a blockchain network (400).

[0028] The user terminal (100) generates and transmits a cryptographic key generation request or a cryptographic key lookup request to the chaincode module (200) according to the user's input. When generating the cryptographic key generation request or the cryptographic key lookup request, the user terminal (100) receives an Entity ID and an Entity PW from the user. The Entity ID and Entity PW are values ​​set arbitrarily by the user, allowing the chaincode module (200) to generate a cryptographic key or look up a cryptographic key based on them. The user terminal (100) transmits the Entity ID and Entity PW entered by the user to the chaincode module (200) along with the cryptographic key generation request or the cryptographic key lookup request.

[0029]

[0030] The chaincode module (200) generates a private key and a public key in accordance with the user's request for cryptographic key generation, encrypts the private key based on the input Entity ID and Entity PW, stores it in the distributed storage (300), and stores access information for the private key in the blockchain through the blockchain network (400). In this way, the reason the chaincode module (200) stores the private key in the distributed storage (300) rather than in the blockchain is that by storing the private key in a distributed manner in the distributed storage (300), it is possible to prevent the private key from being directly leaked from each node constituting the blockchain network (400). Furthermore, the reason for storing access information for the private key in the blockchain is that, due to the nature of the blockchain, it is impossible to alter or tamper with it, so access records can be managed transparently, and accordingly, abnormal access attempts to access the private key can be tracked.

[0031] Accordingly, the present invention stores a private key in a distributed storage (300) and stores information that allows access to the private key stored in the distributed storage (300) in a blockchain, thereby not only securely protecting the private key but also transparently managing the private key through the integrity of the blockchain.

[0032] Additionally, the chaincode module (200) can retrieve the user's private key using the Entity ID and Entity PW entered by the user in response to the user's request to retrieve the private key.

[0033] The distributed storage (300) is composed of multiple nodes and stores data distributed across multiple nodes. The distributed storage (300) stores the private key transmitted from the chaincode module (300) in a distributed manner and transmits the stored private key in response to a request from the chaincode module (300).

[0034] A blockchain network (400) has multiple nodes participating and records data on the blockchain according to a predetermined consensus algorithm. For example, when data is received, the blockchain network (400) generates a transaction to record the data in the ledger of each node and propagates the data to multiple nodes. When more than half of the nodes participating in the blockchain network (400) approve the recording of the data, the blockchain network (400) creates a block connected to a previously stored block to record the data, and propagates the recorded block so that the corresponding block is recorded in the ledger of each node.

[0035] The blockchain network (400) according to the present invention may be implemented as a Hyperledger Fabric blockchain network. In accordance with this embodiment, a plurality of nodes may be composed of authorized users.

[0036] The blockchain network (400) stores access information for the private key transmitted from the chaincode module (200) in the blockchain. In addition, the blockchain network (400) returns access information for the private key upon request from the chaincode module (200).

[0037] Hereinafter, with reference to FIGS. 2 and FIGS. 3, the process of generating a cryptographic key and the process of querying a cryptographic key in a blockchain-based key management system according to the present invention will be explained in more detail.

[0038]

[0039] - Encryption key generation process

[0040] FIG. 2 is a diagram showing the process of a blockchain-based key management system generating a cryptographic key according to one embodiment of the present invention.

[0041] As illustrated in FIG. 2, first, the user inputs an Entity ID and an Entity PW through a user terminal (100) to generate a cryptographic key. The user terminal (100) generates a cryptographic key generation request and transmits it to a chaincode module (200) along with the Entity ID and the Entity PW.

[0042] The chaincode module (200) generates a user's private key and public key in accordance with a cryptographic key generation request including an Entity ID and an Entity PW. At this time, the chaincode module (200) may generate the private key using a random number generator and generate the public key from the generated private key using a predetermined algorithm. Here, the predetermined algorithm may include the Elliptic Curve Digital Signature Algorithm (ECDSA), the Edwards Curve Digital Signature Algorithm (EdDSA), etc.

[0043] The chaincode module (200) can distribute the private key into a predetermined number of chunks. For example, the chaincode module (200) can distribute the private key into 5 chunks using the Shamir secret sharing algorithm.

[0044] The chaincode module (200) can encrypt chunks distributed in a predetermined number using Entity PW as a secret key. Specifically, the chaincode module (200) can input Entity PW into a hash function to obtain a hash value and set the hash value as a secret key. The chaincode module (200) can encrypt chunks using the hash value of Entity PW as a secret key.

[0045] The chaincode module (200) transmits the encrypted chunk to the distributed storage (300).

[0046] The distributed storage (300) stores encrypted chunks in a distributed manner and returns a Data ID for querying encrypted chunks to the chaincode module (200).

[0047] When a Data ID is returned from the distributed storage (300), the chaincode module (200) generates a Key ID using the Entity ID and Entity PW. Here, the Key ID is a key for verifying the user's access rights.

[0048] For example, the chaincode module (200) inputs the Entity ID into a hash function to obtain a hash value, sets the obtained hash value as the salt, inputs the salt value into the hash function a predetermined number of times to obtain a hash value, sets the obtained hash value as the round salt, and can generate a Key ID by combining the salt, the round salt, and the Entity PW. For example, the chaincode module (200) can define a combination of salt + round salt + Entity PW as the Key ID.

[0049] The chaincode module (200) transmits the generated Entity ID, Data ID, and Key ID to the blockchain network (400).

[0050] A blockchain network (400) can record Entity ID, Data ID, and Key ID on the blockchain according to a predetermined consensus algorithm.

[0051]

[0052] - Password key lookup process

[0053] FIG. 3 is a diagram showing the process of a blockchain-based key management system looking up a cryptographic key according to one embodiment of the present invention.

[0054] As illustrated in FIG. 3, first, the user inputs the Entity ID and Entity PW through the user terminal (100) for cryptographic key lookup. The user terminal (100) generates a cryptographic key lookup request and transmits it to the chaincode module (200) along with the Entity ID and Entity PW.

[0055] When the chaincode module (200) receives a cryptographic key lookup request including Entity ID and Entity PW, it requests the Key ID mapped to the Entity ID from the blockchain network (400). The blockchain network (400) extracts the Key ID stored in the blockchain mapped to the Entity ID and returns the extracted Key ID to the chaincode module (200).

[0056] The chaincode module (200) generates a verification Key ID using the Entity ID and Entity PW.

[0057] The chaincode module (200) determines whether the verification Key ID matches the returned Key ID.

[0058] The chaincode module (200) does not return the private key to the user terminal (100) if the verification Key ID and the returned Key ID do not match.

[0059] If the verification Key ID matches the returned Key ID, the chaincode module (200) requests the Data ID mapped to the Entity ID from the blockchain network (400). The blockchain network (400) extracts the Data ID stored in the blockchain mapped to the Entity ID and returns the extracted Data ID to the chaincode module (200).

[0060] The chaincode module (200) accesses encrypted chunks distributed and stored in distributed storage (300) using the returned Data ID. The chaincode module (200) decrypts the encrypted chunks using the Entity PW. The chaincode module (200) can decrypt the encrypted chunks using the hash value of the Entity PW set as the secret key.

[0061] The chaincode module (200) can reverse-calculate the private key from the decrypted chunk using the Shamir secret sharing algorithm. The chaincode module (200) can return the reversed private key to the user through the user terminal (100).

[0062] Those skilled in the art to which the present invention pertains will understand that the above-described invention may be implemented in other specific forms without altering its technical concept or essential features.

[0063] Therefore, the embodiments described above should be understood as illustrative in all respects and not limiting. The scope of the invention is defined by the claims set forth below rather than by the detailed description above, and all modifications or variations derived from the meaning and scope of the claims and equivalent concepts thereof should be interpreted as being included within the scope of the invention.

Claims

1. A blockchain-based key management system comprising a chaincode module; distributed storage; and a blockchain network, wherein The above chaincode module is, When a request for cryptographic key generation including Entity ID and Entity PW is received from a user, the user's private key and public key are generated, the private key is distributed into a predetermined number of chunks, the chunks are encrypted using the Entity PW and transmitted to the distributed storage. The above distributed storage is, The above encrypted chunk is stored in a distributed manner, and a Data ID for querying the above encrypted chunk is returned to the above chaincode module, and The above chaincode module is, When the above Data ID is returned, a Key ID is generated using the above Entity ID and the above Entity PW, and the above Entity ID, the above Data ID, and the above Key ID are transmitted to the blockchain network, and The above blockchain network is, A blockchain-based key management system characterized by recording the above Entity ID, above Data ID, and above Key ID on a blockchain according to a predetermined consensus algorithm.

2. In Paragraph 1, The above chaincode module is, A blockchain-based key management system characterized by generating a private key using a random number generator and generating a public key from the generated private key using an elliptic curve digital signature algorithm (ECDSA) or an Edwards curve digital signature algorithm (EdDSA).

3. In Paragraph 1, The above chaincode module is, A blockchain-based key management system characterized by distributing the above private key into a predetermined number of chunks using the Shamir secret sharing algorithm, inputting the above Entity PW into a hash function to obtain a hash value, and encrypting the above chunks using the above hash value as a secret key.

4. In Paragraph 1, The above chaincode module is, A blockchain-based key management system characterized by inputting the above Entity ID into a hash function to obtain a hash value and setting that value as a salt, inputting the value of the above salt into the hash function a predetermined number of times to obtain a hash value and setting that value as a round salt, and generating the above Key ID by combining the above salt, the above round salt, and the above Entity PW.

5. In Paragraph 1, The above chaincode module is, A blockchain-based key management system characterized by, upon receiving a user's cryptographic key lookup request including an Entity ID and an Entity PW from a user, requesting and obtaining a Key ID mapped to the Entity ID from the blockchain network, generating a verification Key ID using the Entity ID and Entity PW, and determining whether the verification Key ID matches the obtained Key ID.

6. In Paragraph 5, The above chaincode module is, A blockchain-based key management system characterized by, when the above verification Key ID matches the above acquired Key ID, requesting and obtaining a Data ID mapped to the above Entity ID from the blockchain network, and accessing an encrypted chunk in the above distributed storage using the obtained Data ID.

7. In Paragraph 6, The above chaincode module is, A blockchain-based key management system characterized by decrypting the above-mentioned encrypted chunk using the above-mentioned Entity PW, inversely calculating the private key using the decrypted chunk using the Shamir secret sharing algorithm, and returning the above-mentioned private key to the above-mentioned user.

Images