Deriving Public Keys from Digital Signatures for Secure Blockchain Transactions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
E-commerce systems face challenges in securely authorizing transactions based on blockchain data without revealing sensitive information, as interception of digital signatures can lead to data leakage and replay attacks, potentially linking public keys to personal identifying information.
Innovation Solution
A method where a server receives a digital signature from a user device, generates a message based on session-specific data, derives the public key from the signature, and queries the blockchain network to verify ownership, thereby authorizing transactions without exposing the public key or sensitive data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the system requests a digital signature and public key from the user device for transaction authorization, then the system can verify blockchain ownership and authorize transactions, but the public key and sensitive information may be intercepted and linked to personal identifying information
Solution Approach 1:
The patent extracts only the essential verification element (digital signature) from the complete authentication package (signature + public key), and discards the public key transmission. The system derives the public key locally from the signature and message using cryptographic recovery algorithms, thus taking out the harmful component (public key exposure) while retaining the useful function (ownership verification).
Solution Approach 2:
Instead of the conventional approach where the user sends (signature, public key) pair for verification, the patent inverts the process: the user sends only the signature, and the system recovers the public key from the signature and independently generated message. This inversion eliminates public key transmission while maintaining verification reliability through cryptographic derivation.
2Reliability
If the system transmits the message between user device and server to enable public key derivation, then the system can verify blockchain data, but the message transmission may expose session-specific data
Solution Approach 1:
The system employs self-service cryptography where both the user device and server independently generate the same message using identical session-specific data and algorithms. The user device signs the locally generated message, and the server regenerates the same message to derive the public key. This eliminates the need to transmit the message, as both parties serve themselves by generating it independently, thus preventing data exposure while enabling verification.
3Ease of operation
If the system uses conventional authentication methods with public key transmission, then the authorization process is straightforward, but security is compromised due to potential interception and replay attacks
Solution Approach 1:
The patent incorporates preliminary anti-replay measures by including session-specific data (such as nonces or timestamps) within the message that is signed. Before public key derivation, the system verifies that the session-specific data is unique and valid, preventing replay attacks in advance. This preliminary action maintains simplicity by integrating the security check into the existing flow without adding separate complex authentication steps.
Data Source
AI summary
Methods and systems for authorizing transaction requests from user device based on blockchain asset-based access control rules. A server receives a digital signature from a user device and independently generates the message that was signed by the user device. The user device does not send the public key. The server derives the public key from the message and the digital signature and then queries the blockchain network to confirm it corresponds to a valid wallet address. The server obtains ownership data associated with the wallet address from the blockchain network and, based on the ownership data, determines whether to authorize a requested transaction.