Blockchain Block Header Verification With Segmented Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In blockchain systems, ensuring data security during transmission to service nodes outside the network is challenging due to the risk of signature key leakage.
Innovation Solution
A data management method that involves adding first key information for verifying a block header to the block header of a data block and generating a signature, which is then released to the service node sub-network for verification, allowing the service node to obtain the key information only after successful verification, thus flexibly updating the verification key and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If data is transmitted to service nodes outside the blockchain network, then data sharing and service functionality are improved, but security risk increases due to potential signature key leakage
Solution Approach 1:
The verification key is segmented into two parts: a first verification key embedded in the block header that can be publicly shared with service nodes, and a second verification key kept secret within the blockchain network. This segmentation allows data to be shared externally while maintaining security internally, as the two key parts cannot be combined to reveal the original signature key.
Solution Approach 2:
The critical security element (the second verification key) is extracted from the block header and kept separate within the blockchain network. Only the non-critical first verification key is embedded in the block header for external use. This extraction ensures that even if the block header is accessed by external service nodes, the core security mechanism remains protected.
2Ease of operation
If a fixed verification key is used in the block header, then verification process is simplified, but security is compromised due to key leakage risk
Solution Approach 1:
The verification key is divided into a first verification key for public use in block headers and a second verification key for secure internal use. This allows the verification process to remain simple for external nodes while the critical second key remains protected within the network, preventing key leakage risks.
Solution Approach 2:
The first verification key acts as an intermediary that enables external service nodes to verify block headers without exposing the actual signature key. This intermediary key performs the verification function while the second verification key remains hidden, maintaining both operational simplicity and security.
3Reliability
If the verification key is updated frequently, then security is improved, but system complexity and operational difficulty increase
Solution Approach 1:
By segmenting the verification key into two distinct parts with different security requirements, the system can update the first verification key in block headers without affecting the second verification key. This reduces key management complexity while maintaining security, as only the non-critical first key needs frequent updates.
Solution Approach 2:
Extracting the critical second verification key from the block header structure allows it to remain stable and secure while the first verification key in the block header can be updated as needed. This separation simplifies key management by allowing different update frequencies for different key components.
Data Source
AI summary
This application provide a data management method performed at a blockchain system. The system includes an accounting node sub-network and a service node sub-network. The method includes: generating a first data block in the accounting node sub-network; adding first key information to a block header of the first data block; adding signature corresponding to the first data block to the block header of the first data block; and releasing the block header of the first data block to the service node sub-network. The service node sub-network is configured to verify the signature comprised in the block header of the first data block, and obtain the first key information after a successful verification.