Dynamic Threshold Signatures for Flexible Blockchain Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing multi-sig techniques in blockchain networks do not allow parties contributing to signature generation to change after the locking script is configured, limiting the flexibility and security in controlling electronic resources.
Innovation Solution
A dynamic multiparty threshold signature scheme using trusted execution environments (TEEs) enables secure enrollment and disenrollment of group members without changing the single public key, allowing a threshold subset of participants to collectively sign without revealing their private secrets, using elliptic curve digital signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional multi-sig techniques are used, then security control over electronic resources is provided, but the system lacks flexibility to allow parties to change after the locking script is configured
Solution Approach 1:
The patent implements dynamic threshold signature schemes where the set of authorized parties can be modified after initial configuration. The system uses verifiable secret sharing and distributed key generation to allow enrollment and disenrollment of participants while maintaining the original public key and security properties, enabling the system to adapt to changing requirements without compromising security.
Solution Approach 2:
The patent divides the secret key into multiple shares distributed among different parties using secret sharing schemes. Each party holds a portion of the secret, and a threshold number of parties are required to reconstruct the signature. This segmentation allows individual parties to be added or removed from the system while the overall security structure remains intact through cryptographic protocols.
2Adaptability or versatility
If dynamic enrollment and disenrollment of group members is enabled, then system flexibility is improved, but complexity of the signature generation process increases
Solution Approach 1:
The patent performs preliminary key generation and secret sharing during an initialization phase, establishing the foundation for dynamic member management. The system pre-distributes secret shares to authorized parties and sets up the threshold structure in advance, so that subsequent enrollment and disenrollment operations can proceed more efficiently without requiring complete reconfiguration of the cryptographic system.
Solution Approach 2:
The patent introduces trusted execution environments (TEEs) as intermediaries to manage the complexity of threshold signature operations. The TEEs securely handle secret share management, verification, and reconstruction processes, offloading the computational and security burden from the distributed parties and simplifying their individual operations while enabling dynamic member management.
3Reliability
If trusted execution environments are used to protect private secrets, then security is enhanced, but hardware requirements and system cost increase
Solution Approach 1:
The patent extracts the security-critical operations into a separate trusted execution environment, isolating the protection of private secrets from the main system architecture. The TEE acts as a dedicated secure enclave that handles only the cryptographic operations requiring secret protection, while the rest of the system can operate with standard hardware, thus concentrating security requirements rather than distributing them throughout the entire system.
Data Source
AI summary
Techniques are presented for using a processing resource to control access to a resource. Steps comprise generating an elliptic curve digital signature algorithm signature comprising a first signature component, r, and a second signature component, w, the generation step comprising: forming, by a node, a signing group with other nodes; obtaining, by the node, based on a secure random number: a) a multiplicative inverse of the secure random number; and b) the first signature component, r, wherein the first signature component is determined based on the secure random number and an elliptic curve generator point; determining, by the node, a partial signature; receiving partial signatures from other nodes of the signing group; generating the second component; and using the signature to control access to the and/or transfer of a resource over a computer-implemented network.