KR102559881B1 - Method and appartaus for selecting distributed consensus node based on proof-of-nonce - Google Patents

Abstract

A method for selecting a consensus node of a blockchain generating device according to the present invention may include reading a nonce from a nonce chain of a node, calculating the read nonce and previous height information, and comparing the calculated value with a reference value to select the node as a consensus node.

Description

Distributed consensus node selection method and apparatus based on nonce proof {METHOD AND APPARTAUS FOR SELECTING DISTRIBUTED CONSENSUS NODE BASED ON PROOF-OF-NONCE}

The present invention relates to a method and apparatus for selecting a distributed agreement node based on a nonce proof.

In general, blockchain technology is a convergence technology composed of various technologies such as P2P network technology, security and encryption technology, and distributed computing platform technology. In particular, blockchain technology can be defined as an integrity and reliability guarantee technology for maintaining a single Distributed Ledger by verifying transaction information, recording/creating it in block units, and agreeing to share synchronized information for each node. In the existing centralized system, a third party indirectly and passively guaranteed trust through exclusive management of the centralized ledger to prevent transaction information from being manipulated. In blockchain, instead of the indirect and passive method entrusted to a third party central institution, the ledger is managed in a distributed manner through a method in which nodes directly participate and agree (consensus algorithm). The most important core technology among block chain construction technologies is a consensus algorithm for maintaining one block chain between untrusted nodes. It provides important characteristics of blockchain, such as fairness and decentralization in which all nodes have equal opportunities to create blocks (hereinafter referred to as mining) through consensus algorithms, and security that can be safe from the possibility of attack on the consensus node and damage to the ledger.

Patent Publication: 10-2017-0137388, Publication Date: December 13, 2017, Title: Integrity Guarantee Method Using Blockchain Technology. US Patent Publication: US 2017-0344987, Publication Date: November 30, 2017, Title: METHOD AND SYSTEM FOR AN EFFICIENT CONSENSUS MECHANISM FOR PERMSSIONED BLOCKCHAINS USING BLOOM FILTERS AND AUDIT GUARANTEES. US Patent Publication: US 2019/0068380, Publication Date: January 28, 2019 (Initial Application Date: August 21, 2017, CN 2017106\736740.5), Title: BLOCKCHAIN CONSENSUS NODE SELECTION.

An object of the present invention is to provide a distributed agreement node selection method in which a node participating in a distributed agreement (a distributed agreement node) cannot be predicted in advance as a representative of all nodes.

An object of the present invention is to provide a distributed agreement node selection method capable of controlling the number of subjects required for distributed agreement.

An object of the present invention is to provide a distributed agreement node selection method in which assets owned by nodes (such as computing power) do not affect acquisition of distributed agreement qualifications.

An object of the present invention is to provide a distributed agreement node selection method capable of verifying the qualifications of nodes participating in the distributed agreement.

The technical problems of the present invention are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art from the description below.

A method for selecting an agreement node of a block chain generating apparatus according to an embodiment of the present invention includes the steps of reading a nonce from a nonce chain of a node; calculating the read nonce and previous height information; and comparing the calculated value with a reference value in order to select the node as an agreement node.

In an embodiment, the nonce chain is a hash chain.

In an embodiment, the step of generating the nonce chain may be further included.

In an embodiment, generating the nonce chain may include generating the nonce chain using a master key kept private by the node.

In an embodiment, generating the nonce chain using the master key may include generating a base using the master key; generating a hash chain by repeatedly hashing the base a plurality of times; and setting a start height to start using the hash chain.

In an embodiment, it is characterized in that the length of the nonce chain corresponding to the time at which blocks are periodically generated is determined.

In an embodiment, the calculating may include hash calculating the read nonce and previous height information.

In an embodiment, the previous height information may include a header hash value of the previous block.

In an embodiment, when the calculated value as a result of the comparison is smaller than the reference value, the step of disclosing the last nonce value of the nonce chain, the start height of the nonce chain, and the address of the node to other nodes. Can be further included.

In an embodiment, the step of registering nonce chain information of the other nodes in an elite pool may be further included, and the nonce chain information may include an address of a corresponding node, a last nonce value of a corresponding nonce chain, and a start height at which the corresponding nonce chain was started.

In an embodiment, the address of the node is characterized in that it includes a public key or a value limiting the node.

In an embodiment, an agreement node is selected using information of the previous block so that all nodes including the node cannot predict whether or not to select an agreement node for the next block until the previous block is generated.

In an embodiment, a nonce read from the nonce chain is used as a nonce of the hash function in order to give a calculation opportunity for all nodes including the node to be selected as a consensus node once per height.

In an embodiment, when the number of nodes capable of participating in the distributed agreement is n, the minimum number of nodes required for the distributed agreement is x, and the cumulative distribution probability value to be selected below the minimum number of nodes required for the distributed agreement is k, the number of nodes in the distributed agreement is controlled by variables (n, x, k).

In an embodiment, the cumulative distribution probability value k has a binomial distribution characteristic.

In an embodiment, the probability of being selected as the consensus node of the node is a probability value P _x,k according to a Bernoulli trial determined by variables (n, x, k).

In an embodiment, when the number of nodes registered in the elite pool of the node changes, the step of changing the reference value may be further included.

In an embodiment, the reference value is characterized in that it is calculated by multiplying the probability value P _x,k and the calculated value.

In an embodiment, the opportunity to determine whether the node selects an agreement node is limited to once per height.

In an embodiment, the opportunity to determine whether or not the node selects an agreement node is limited to one or more m times or less.

A method for verifying a consensus node of an apparatus for generating a blockchain according to an embodiment of the present invention includes receiving a nonce value, a height of a new block, and an address of the first node from a first node selected from the consensus node; extracting a public nonce value and a start height corresponding to the address of the first node from an elite pool of a second node; subtracting the start height from the height of the new block; hashing the received nonce value by the subtracted height times; and comparing the hash calculated value with the public nonce value disclosed from the first node to verify qualification of the first node as a consensus node.

In an embodiment, when the hash calculated value is equal to the public nonce value, block generation authority of the first node is verified.

In an embodiment, when the hash calculated value and the public nonce value are not identical, the first node is disadvantageous in creating or using a blockchain.

The method of updating the nonce chain of the block chain generating device according to an embodiment of the present invention includes the steps of recording a base hash value corresponding to the nonce chain in the ledger so that it can be later confirmed whether there is any abnormality in the selection of the consensus node; Calculating a new base hash value using the master key of the node; generating a new nonce chain using the base hash value; and disclosing the last nonce value and start height of the new nonce chain to other nodes.

In an embodiment, the new nonce chain is updated when all values of the nonce chain are exhausted.

In an embodiment, the new nonce chain is forcibly updated when the node succeeds in generating a block.

A node liveness verification method of a block chain generating device according to an embodiment of the present invention includes counting the number of distributed agreement nodes; and determining whether the counted value is smaller than a predetermined value, wherein each of the distributed agreement nodes is selected using a nonce chain.

In an embodiment, the predetermined value is characterized in that it is a value associated with an average value of a probability distribution in which a node is selected as a block generation candidate.

In an embodiment, the average value is characterized in that it is determined by the number of nodes registered in the elite pool, the minimum number of nodes required for distributed agreement, and a cumulative distribution probability value in which nodes below the minimum node will be selected.

In an embodiment, the cumulative distribution probability value is a success probability value according to a Bernoulli trial.

A distributed computing system for generating a blockchain according to an embodiment of the present invention includes: at least one first node that creates a nonce chain based on a hash chain and discloses to other nodes information about the nonce chain having a start height, a nonce value of the nonce chain, and an address of the node; and at least one second node verifying the consensus node selection qualification of the at least one first node by using the nonce chain information and the nonce value and height received from the at least one first node.

In an embodiment, when the at least one first node succeeds in generating a block, the nonce chain is updated.

In an embodiment, the at least one second node may further include an elite pool registering the nonce chain information.

In an embodiment, it is characterized in that the at least one first node leaves the elite pool, thereby leaving the consensus body.

In an embodiment, it is characterized in that transaction details of a blockchain are used to register the at least one first node in the elite pool.

A blockchain generating device according to an embodiment of the present invention includes: at least one processor; and a memory storing at least one instruction executed by the at least one processor, the at least one instruction reading a nonce from a nonce chain of a node; calculating the read nonce and previous height information; and comparing the calculated value with a reference value in order to select the node as an agreement node.

The method and apparatus for selecting a distributed agreement node based on the nonce proof according to an embodiment of the present invention make it impossible to predict the nodes participating in the distributed agreement, so that it is impossible for other malicious nodes to predict and attack the distributed agreement node.

The method and apparatus for selecting distributed agreement nodes based on the nonce proof according to an embodiment of the present invention allow only the minimum number of nodes necessary for distributed agreement among all nodes to obtain distributed agreement qualifications, enabling fast agreement between nodes participating in distributed agreement.

The distributed agreement node selection method and apparatus based on the nonce proof according to an embodiment of the present invention enable the distributed agreement qualification to be obtained regardless of the node's computing capability, so that some nodes having strong computing capability cannot monopolize the distributed agreement qualification.

The distributed agreement node selection method and apparatus based on the nonce proof according to an embodiment of the present invention can verify the qualifications of nodes participating in the distributed agreement, thereby preventing unqualified nodes from participating in the distributed agreement.

The accompanying drawings are provided to aid understanding of the present embodiment, and provide embodiments along with detailed descriptions. However, the technical features of this embodiment are not limited to specific drawings, and features disclosed in each drawing may be combined with each other to form a new embodiment.
1 is a diagram showing a block chain according to an embodiment of the present invention by way of example.
2 is a diagram exemplarily showing a nonce chain for a PoN-based distributed agreement algorithm according to an embodiment of the present invention.
3 is a diagram for illustratively explaining a method of using a nonce chain according to an embodiment of the present invention.
4 is a diagram exemplarily showing the structure of an elite pool of nodes in the PoN-based consensus node algorithm according to an embodiment of the present invention.
5 is a diagram exemplarily showing simulation results for average node selection for each total node in the PoN-based distributed agreement algorithm according to an embodiment of the present invention.
6 is a diagram exemplarily illustrating a method for checking a node's right to create a new block according to an embodiment of the present invention.
7 is a diagram exemplarily illustrating a method of verifying qualifications of nodes participating in distributed agreement according to an embodiment of the present invention.
8 is a diagram exemplarily showing a method of updating a nonce chain according to an embodiment of the present invention.
9 is a diagram exemplarily illustrating a method for verifying the liveness of a node according to an embodiment of the present invention.
10 is a diagram showing a block chain generation device 1000 according to an embodiment of the present invention by way of example.

In the following, the content of the present invention will be described clearly and in detail to the extent that a person skilled in the art can easily implement the present invention using drawings.

Since the present invention can have various changes and various forms, specific embodiments will be illustrated in the drawings and described in detail in the text. However, this is not intended to limit the present invention to a specific form disclosed, and should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention. Terms such as first and second may be used to describe various components, but the components should not be limited by the terms. The terms may be used for the purpose of distinguishing one component from another. For example, a first element may be termed a second element, and similarly, a second element may be termed a first element, without departing from the scope of the present invention. It should be understood that when an element is referred to as being “connected” or “connected” to another element, it may be directly connected or connected to the other element, but other elements may exist in the middle. On the other hand, when an element is referred to as “directly connected” or “directly connected” to another element, it should be understood that no other element exists in the middle.

Terms used in this application are only used to describe specific embodiments, and are not intended to limit the present invention. Singular expressions include plural expressions unless the context clearly dictates otherwise. In this application, terms such as "comprise" or "having" are intended to designate that an embodied feature, number, step, operation, component, part, or combination thereof exists, but it should be understood that the presence or addition of one or more other features or numbers, steps, operations, components, parts, or combinations thereof is not precluded. Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which the present invention belongs. Terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning in the context of the related art, and unless explicitly defined in the present application, they are not interpreted in an ideal or excessively formal meaning.

In general, in a blockchain, in a distributed environment, each node can create a block and propagate the information of the block it created, or determine and verify the consistency of the block created by other nodes. In this process, the records of transactions made between each node or contents for block creation and verification must be identically recorded in all nodes. At this time, the protocol used to maintain the state in which all nodes participating in the blockchain record the same information is the Distributed Consensus algorithm. In other words, the distributed agreement algorithm is an algorithm to maintain the system in a unified state by resolving inconsistencies that may occur during the process of collaboration between multiple subjects in a distributed environment. In addition, a distributed consensus entity is a node that is qualified to participate in the distributed consensus process that proposes and connects new blocks to the blockchain.

The representative consensus algorithm used in blockchain is PoW (Proof of Work) based algorithm. PoW is used in major blockchains such as Nakamoto (Bitcoin) and Ethash (Ethereum), but it consumes a lot of meaningless power because centralization problems can occur due to monopolization of computing power. To overcome this, many methods such as PoS (Proof of Stake), DPoS (Delegated Proof of Stake), PoW+PBFT (Practical Byzantine Fault Tolerance), and DPoS+PBFT have been proposed, but there are still various problems such as centralization problems, excessive communication costs, and vulnerability to specific targeted attacks.

In general, in PoW and PoS methods, all nodes become the subject of consensus. In the case of the PoW method, cost and environmental problems due to power consumption occur because all nodes perform meaningless calculations to find a nonce in order to generate a block. In addition, there are centralization problems due to collusion of computing power and scalability limitations that cannot be applied to applications that require transaction speed. In the case of the PoS method, it is proposed to solve the power consumption problem of PoW, but there is a problem such as excessive traffic generation for all nodes to agree.

DPoS and Tendermint delegate the subject of distributed agreement to some fixed nodes in order to solve the problems caused by all nodes becoming the subject of consensus in PoW and PoS. DPoS and Tendermint can reduce the time and cost of consensus and improve performance because the number of distributed agreement subjects is small. However, in the case of DPoS and Tendermint, there is a violation of the decentralized blockchain concept by fixing the delegation of the consensus subject only to a specific node. In addition, since authority is concentrated in a small number of people, the reliability of nodes elected by voting is relatively important, and if they collide with each other, security vulnerabilities may occur. Because of this, the scope of the target to be attacked is reduced, and it may be exposed to threats such as DoS (Denial of Service) attacks.

Conventional distributed agreement algorithms consume more resources than necessary and take a long time for agreement when all nodes participate in the agreement, so they are difficult to use for applications requiring speed. In addition, in the case of the conventional distributed agreement algorithms, in the case of the delegation method, resource consumption is reduced and the consensus time is shorter than when all nodes participate in the agreement, but the delegated node is fixed and exposed to attacks such as DoS, and there are security problems due to collusion of the delegated node.

The Distributed Agreement algorithm based on Proof of Nonce (PoN) according to an embodiment of the present invention has the following characteristics in order to solve the above-described problems of existing Distributed Agreement algorithms.

First, the PoN-based distributed agreement algorithm gives all nodes a fair opportunity to participate (mining) regardless of owned resources and ownership stake for decentralization, and can guarantee transparency, representativeness, and optimization (minimizing consumption of computing power and communication costs) in the consensus process.

Second, the PoN-based distributed agreement algorithm can tolerate block chain attacks and can provide security because it is impossible to predict the consensus subject in the corresponding node and other nodes so that attacks on the consensus subject are impossible.

Third, the PoN-based distributed agreement algorithm provides finalization to prevent forgery and tampering, and can satisfy performance conditions (TPS, block size, block generation time) required by various industries and applications.

In order to satisfy the above-mentioned characteristics, the PoN-based consensus algorithm simultaneously satisfies two conditions. The first condition is that the node having block generation authority cannot be predicted in advance, and the second condition is that the created block cannot be modified again. First, the first condition is necessary to prevent an attack by collusion between nodes. In particular, in the case of a public block chain that no one can trust, if the node to create a block is known in advance, the possibility of an attack increases, so it is necessary to prevent this. Also, the selected node must be able to verify its qualifications. The second condition is that the block, once agreed upon, cannot be modified.

1 is a diagram showing a block chain according to an embodiment of the present invention by way of example. Referring to FIG. 1, when block 101 is created and block 102 is newly created, a method for randomly selecting a node participating in the generation of block 102 is to hash the hash value of block 101 and a random value generated for each node to calculate one value, and compare the calculated value with an arbitrary reference value. At this time, in order for all participating nodes to check whether the block generating nodes have legitimately generated the hashed result, all nodes know the random values generated by the block generating participating nodes.

However, when an arbitrary value of a node participating in block generation is disclosed, two problems may occur. First, by pre-calculating the nodes to participate in block generation based on a public random value, an attack by collusion between nodes may be possible. Second, when the random value used by the nodes participating in block generation is known, a malicious node can use an arbitrary value of a specific node. In order to solve this problem, other nodes should be able to confirm that the random value used by the node belongs to the corresponding node, and at the same time, nodes participating in new block generation should not be able to be predicted in advance by other nodes. Accordingly, the nonce chain for the PoN (Proof of Nonce) based distributed agreement algorithm can be configured as follows.

2 is a diagram exemplarily showing a nonce chain for a PoN-based distributed agreement algorithm according to an embodiment of the present invention. Referring to FIG. 2, the master key is a random number kept private by each node, Base n is a non-public random number generated using the master key, and the nonce chain n is generated by hashing base n repeatedly m times. It can be composed of a nonce chain and a start height to start using the nonce chain.

For example, if a block is created once every 10 seconds, 1080 nonces are required for 3 hours. Therefore, the nonce chain to be used for 3 hours can be created by repeating the hash 1080 times. Meanwhile, although the length of the nonce chain shown in FIG. 2 is 1080, it should be understood that this is merely an embodiment of the present invention.

3 is a diagram for exemplarily explaining a method of using a nonce chain according to an embodiment of the present invention. Referring to FIG. 3, the master key can be kept private by the node and a base hash can be generated starting with a random number.

In an embodiment, the nonce chain may include at least one base chain. In an embodiment, the base chain can keep the next base chain unpredictable. In this case, if a block is generated once every 10 seconds, 1080 blocks can be created in 3 hours.

In an embodiment, hash values connected to the nonce chain can each be used only for one block height. When one base hash is generated from the master key, the next hash value can be calculated by hashing this value, and the next hash value can be calculated by hashing the calculated hash value again. This hash operation may be repeated 1080 times.

On the other hand, it should be understood that the length of 1080 nonce chains is merely an embodiment of the present invention for convenience of description.'

One nonce chain created in this way has a structure in which the hash value of the previous value from the base hash is connected as a chain. Due to the characteristics of hash, forward calculation is possible, but backward calculation has a very difficult feature. The last hash value (hash(0)) of the generated 1080 nonce chains and the height (start_height) of the block in which the chain will be used can be disclosed to all elite nodes. Afterwards, the value corresponding to (block's current height - start height) is taken from the nonce chain and hashed together with the hash value of the height-1 block to determine whether the node participates or not.

For example, it will be explained assuming that a node creates a new nonce chain and discloses that it is used from block height 100. If you want to select nodes to participate in block generation to create a new height block 102, the new block height is 102 and the start height of the corresponding node is 100, so the difference between the two values (block height - start height) can be 2. Therefore, hash(2) is extracted from the nonce chain that the node has, a random number is calculated by hashing this value and the hash value of block 101, and a part of the calculated random number is compared with the reference value. If the result is true, the corresponding node can become a node participating in block generation. At this time, the corresponding node can disclose the hash(2) it used to prove that it has legitimately participated in block generation.

In addition, to confirm the legitimacy of the corresponding node, other nodes repeat the hash operation (height - start height of the block) of hash(2) disclosed by the node participating in block generation, and confirm that the value is the same as the hash(0) value previously disclosed by the node participating in block generation. Also, the hash (block height - start height) value to be used in the corresponding height is an arbitrary number that can be justified by repeating the last hash value (hash(0)) already disclosed by the node. Therefore, each node can be restricted to find one usable hash value at the corresponding height.

Since all nodes other than themselves cannot predict the hash value of the nonce chain, it is impossible to predict nodes that can participate in block generation in advance by collusion between nodes. At the same time, if a node is determined to participate in block generation by calculation, the corresponding node can prove that it has a legitimate hash value by disclosing the corresponding nonce chain value.

In the case of consuming all of one nonce chain, the base hash value can be recorded in the ledger so that it can be checked later whether the results of participating in the node selection so far are correct. The last value (hash(0)) of the nonce chain generated from the base hash(1) to be used next and the start height can be disclosed.

At this time, a node that successfully creates a block can create a nonce chain by changing the base hash to be used next, and disclose the last hash value and start height. If all nodes try to update the nonce chain at the same time, network congestion and node process overload may occur. Therefore, nodes that succeed in block creation can forcibly update the nonce chain to solve the chain update congestion problem.

On the other hand, the block generation candidate selection method of the blockchain consensus algorithm is specifically described below.

In order to determine a block generation node, one random value may be generated by hashing a value from the previous block hash value and the node's nonce chain. As for this random value, even if the characteristic has a uniform distribution and a part of the random value is taken, the characteristic has a uniform distribution. Below, for convenience of calculation, it will be assumed that calculation is performed with only a part of the random value. In the case of using the nonce chain, n nodes each have only one random value. When the value of each node satisfies the condition by comparing a specific reference value, each node may be qualified as a block generation candidate. On the other hand, if the condition is not satisfied, each node may be disqualified from the block generation code. Since the result is that the failure of qualification is 0 and the success of qualification is 1, it can be a Bernoulli trial with a probability of success p.

When a Bernoulli trial with a probability of success p is repeated n times, the distribution of the number of successes X can be a binomial distribution. At this time, the mean and variance of the binomial distribution are respectively as shown in the following equations.

At this time, this probability distribution converges to a normal distribution with a mean of np and a variance of np(1-p) by the central limit theorem when the number of repeated trials n is sufficiently large (n is greater than 30). If the mean is μ and the standard deviation is σ, the probability density function of the normal distribution is:

Here, if some of the output values of the function hash (hash value of the previous node, one hash value selected from the nonce chain) satisfy the condition by comparing a specific reference value, all nodes use the same reference value when selected. μ in Equation 1 means the average value of the selected nodes.

At this time, in Equation 5, when x is 0, it becomes a probability value that no node is selected, and when x is 10, it becomes a probability that 10 or less nodes are selected. When Equation 1 is rearranged for p and Equation 2 is rearranged for σ and substituted into Equation 5, the following equation is obtained.

Therefore, in Equation 6, when the probability F(x) that x or less nodes are selected is fixed as a constant k, the transplantation becomes as follows.

In Equation 6, x becomes a constant under the condition that x or less nodes are already selected above. Therefore, Equation 7 becomes a quadratic equation for μ as follows.

In Equation 8, if (erf-1(2k-1))2 = a and rearranged, it is arranged as follows.

In Equation 9, the solution of this equation is as follows.

where k is calculated as: If a block is generated once every 10 seconds, the number of accumulated blocks generated in one year is 6Х60Х24Х365. Therefore, the reciprocal of the number of accumulated blocks that will occur during the accumulated years must be equal to the probability k that x or less nodes will be selected in the years period. Therefore, k is equal to Equation 11.

For example, if the period in which x or less nodes are selected is set to one million years, the value k is determined by substituting 10 ⁶ for years in Equation 11. When x and k are determined, the average value μ is determined by Equation 10.

Calculated by Equation 8, when the total number of nodes is 1 billion or less, the value of μ that allows 10 nodes or less to be selected only once in a million years is 70.32.

4 is a diagram exemplarily showing simulation results for average node selection for each total node in the PoN-based distributed agreement algorithm according to an embodiment of the present invention. Referring to FIG. 4, <10 means a probability that 10 or less nodes are selected. When this value is around 3.17e-13, it can be seen that less than 10 nodes are selected once in a million years. In addition, the probability of occurrence of 7 or less nodes in calculation is zero.

When n and μ are determined, the probability p that a node is selected is determined as shown in Equation 12. The specific reference value to be used by all nodes is the maximum value that a portion of the calculated hash value can represent (for example, if 32 bits are used, the maximum value is 232) multiplied by (μ/n). Therefore, the reference value difficulty is equal to Equation 13.

In addition, the following fact can be seen from the cumulative distribution function and FIG. 4 . Half means the probability that a node less than 1/2 of the average is selected. This probability can be used to predict network division or node inactivity by the number of nodes selected during algorithm operation.

In FIG. 4, it can be seen that a <half value of 1.38e-5 occurs very rarely with a probability that only half of the node to be selected is selected. Therefore, when the number of selected nodes does not exceed a certain standard value, such as half of the node average, or when this phenomenon occurs continuously, it can be used as a point in time to check the aliveness of a node.

Meanwhile, the characteristics of the PoN-based distributed agreement algorithm are summarized as follows. Mining opportunities can be probabilistically provided equally regardless of owned resources and ownership stakes. No one, including yourself, can predict who will have a mining opportunity. Other nodes can verify that mining is done on legitimate nodes. Consensus blocks cannot be modified. It can be probabilistically guaranteed that there are at least N mining nodes so that they can have representative properties even if not all participate. It is impossible to target the attack by predicting the consensus subject.

5 is a diagram exemplarily showing the structure of an elite pool of nodes in the PoN-based consensus node algorithm according to an embodiment of the present invention. Referring to Figure 5, in order to participate in distributed agreement, a node must register the nonce chain information in the elite pool of other nodes. When a node's nonce chain information is registered in the elite pool of other nodes, the node can become a subject of distributed agreement.

In an embodiment, the nonce chain information may include a node address, a Noncebase(0) value that is the last hash value of the corresponding chain, and a Start height value. In an embodiment, the nonce chain registered by the node can be used from (start height + 1) height. In an embodiment, the node address in the nonce chain information may include the public key of the node or a value capable of limiting the node. In an embodiment, registration of the nonce chain can be disclosed to other nodes using the unused transaction history of the blockchain.

6 is a diagram exemplarily illustrating a method for checking a node's right to create a new block according to an embodiment of the present invention. Referring to FIG. 6, each node may proceed in the following way to check whether or not the right to create a new block to be connected to the blockchain has been obtained.

Nodes bring the noncebase (the height of the new block - the start height registered by the node) from their own nonce chain. At this time, the imported value may be nonceh (S110). Each node is a hash result of the head value of the previous block. can be calculated (S120).

node is If the calculation result is true, it may be determined that a new block creation right has been obtained (S130). To ensure distributed consensus nodes are selected with probability p for each blockchain height h can be used here is obtained with the hash function is the hash value of is the header hash value of the height h-1 block. Therefore, all nodes can know whether the height h-1 block is connected to the blockchain to know whether the height h is a decentralized consensus node. is a nonce value that each node has differently for height h and is a value obtained through the following nonce chain.

When using the nonce chain, first, nodes cannot arbitrarily change the nonce value, so they cannot attempt to become a distributed consensus node using computational power like Bitcoin. Second, since the nonce value of each node cannot be predicted by other nodes, it is impossible for malicious nodes to predict and attack distributed consensus nodes. Third, other nodes can verify the legitimacy of the nonce value disclosed by the node. is the same value used for height h by all nodes so that only the minimum number of nodes required for distributed consensus qualify for distributed consensus.

Afterwards, the node that has obtained the right to create a new block can disclose the nonceh value it used, the height value of the block, and the address of the node (S140).

In the PoN-based consensus node selection method according to an embodiment of the present invention, in order for other nodes to unpredictably select a distributed agreement subject for heighth, a node can be selected with probability p by reading previous heighth-1 information and information from the nonce chain, calculating the two read information, and comparing the calculated result with a specific reference value.

In an embodiment, information of a previous block may be used so that all nodes including itself cannot predict whether or not to select an agreement subject for the next block until the previous block is generated.

In an embodiment, a value obtained from the nonce chain may be used as a nonce of the hash function in order to give a calculation opportunity for all nodes including itself to be selected as a consensus subject only once for each height.

In an embodiment, when the number of nodes that can participate in consensus is n, the minimum number of nodes required for consensus is x, and the probability value that a node less than or equal to the minimum number required for consensus is selected is k, the number of distributed agreement subjects including these three variables (n, x, k) can be controlled.

In an embodiment, the node By comparison, it has a binomial distribution. In an embodiment, a probability value p _x,k having three variables (n, x, k) and Difficulty by multiplying by the maximum value of ( ) can be calculated.

7 is a diagram exemplarily illustrating a method of verifying qualifications of nodes participating in distributed agreement according to an embodiment of the present invention. Referring to FIG. 7 , another node can verify whether the node that disclosed the three pieces of information has the right to create a block as follows.

Other nodes may receive the nonce value, height information, and address of the block generating node (S210). Other nodes may bring the noncebase (0) value and the start height value registered as the address of the corresponding node (S220).

Other nodes can calculate (height of the new block - Start height) from the value disclosed by the node (S230). If the nonceh published by the node is calculated consecutively (height of the new block - Start height) times, and the calculated final value is equal to the noncebase (0), it can be verified whether the public node has the right to create the block. On the other hand, otherwise, the information disclosure node will be determined to be false. Nodes with false verification results may be penalized for block creation and use.

In the method for obtaining consensus subject qualification of the PoN-based distributed node consensus algorithm according to an embodiment of the present invention, the opportunity to determine whether or not to select an agreement subject can be limited to once per node for each height so that each node capable of participating in consensus does not affect the probability of obtaining the consensus subject qualification.

In an embodiment, the opportunity to determine whether to select an agreement subject may be limited to one or more m times or less.

In an embodiment, by disclosing address information by which a node selected as a consensus subject can identify itself, nonce information obtained from its own nonce chain, and height information, other nodes can verify consensus subject qualifications. In an embodiment, a node that fails to pass the consensus subject verification may be penalized.

8 is a diagram exemplarily showing a method of updating a nonce chain according to an embodiment of the present invention. Referring to FIG. 8, when one nonce chain is exhausted, the nonce chain can be updated as follows.

When the nonce chain e is exhausted, the base hash value is recorded in the ledger (S310). This may later confirm whether or not the results of participating in node selection have been abnormal. When one nonce chain is exhausted, the base hash may be recalculated (S320). The nonce chain can be updated by disclosing the last value (hash(0)) and the start height of the nonce chain generated from this base hash (S340).

In an embodiment, when a node exhausts all values of the generated nonce chain and simultaneously attempts to update a new nonce chain, the node that successfully generates a block can forcibly update the new nonce chain to solve the chain update congestion problem.

In an embodiment, since a node that successfully generates a block updates the nonce chain, network congestion caused by excessive traffic and overload of update processing by nodes can be reduced.

Meanwhile, the present invention is applicable to a distributed computing environment. For example, in a distributed computing system in which an unspecified number of people participate, a nonce chain to be used by nodes is created based on the hash chain, start height and nonce (0) are disclosed in advance, nodes are restricted to use hash values in the order of the nonce chain, and other nodes can verify the result later based on the published values.

A distributed computing system generating a blockchain according to an embodiment of the present invention may include at least one first node that creates a nonce chain based on a hash chain and discloses to other nodes information about the nonce chain including a start height, a nonce value of the nonce chain, and an address of the node, and at least one second node that verifies qualification for selection of the consensus node of the at least one first node using the nonce chain information and the nonce value and height received from the at least one first node.

In an embodiment, when at least one first node succeeds in generating a block, the nonce chain may be updated. In an embodiment, at least one second node may further include an elite pool registering nonce chain information. In an embodiment, when at least one first node leaves the elite pool, it may be excluded from the consensus body. In an embodiment, transaction details of the block chain may be used to register at least one first node in the elite pool.

Meanwhile, difficulty will be explained in detail below. The concept of difficulty simply refers to the probability of being selected as a node. That is, a decrease in the probability of being selected as a node and an increase in difficulty mean the same thing.

participating nodes It is possible to determine whether or not to select a distributed agreement subject using a mathematical formula. At this time, if the Difficulty value is too large, too many nodes are selected as subjects of distributed agreement, increasing network traffic and taking a long time for consensus. Conversely, if the Difficulty value is too small, the probability of being selected as a distributed consensus subject is very small, and consensus may become impossible because nodes below the minimum required for consensus are selected. Therefore, a method for determining an appropriate difficulty value that can control the number of subjects required for distributed agreement is needed.

Therefore, the method for determining the probability p for controlling the number of subjects required for distributed agreement is as follows. Selecting a random number and comparing the random number with a specific reference value to pass or fail is called a Bernoulli trial with a probability of success p.

Equation used to select the subject of the distributed agreement The left side of is a random number as a result of the hash function, and the right side is a specific reference value (difficulty, or difficulty). If a specific random number and a reference value are compared, and selecting as the subject of the variance sum is pass and not being selected as fail, the result of the above equation becomes a Bernoulli trial with a success probability p. The cumulative distribution function in the case of x successes out of n Bernoulli trials with probability p of success is:

In order for distributed nodes to successfully reach consensus, a minimum number of nodes is absolutely necessary. Therefore, it is possible to select the minimum number of nodes (x) and the probability value Fx(x) in which the minimum node or less is selected. At this time, this probability value is called k and the probability p can be obtained.

The probability px,k for the minimum number of nodes (x) required for consensus and the probability value (K) for a minimum node or less to be selected is as follows:

Here, n is the number of nodes registered in the elite pool, x is the minimum number of nodes required for consensus, k is the cumulative distribution probability that nodes below x nodes will be selected, and px,k is (n, x, k) It can be determined by three variables.

At this time In order for the probability of the node selected as the subject of distributed agreement to be p _x,k by multiplying the maximum value of p _x,k can be used as At this time, if this maximum value is expressed as maxslice, as shown in the following equation can decide For example, if only 32 bits of the hash result are used for the operation of the above equation, maxslice = 232.

When there is a change in the number of nodes registered in the elite pool open to the node can be newly calculated.

On the other hand, in a system operating with p _x,k probability that satisfies the above-mentioned difficulty, the probability that x of the cumulative distribution function Fx(x) is less than half (μ / 2) of the average (μ) is selected is very low. Therefore, when the number of nodes selected as the subject of distributed agreement is less than or equal to a certain number of nodes, such as μ/2, or when this phenomenon occurs more than twice in a row, it can be used to check node liveness such as network splitting or node inactivation. Meanwhile, it should be understood that the reference value of difficulty is not necessarily limited to half (μ/2) of the average value of the probability distribution. The reference value of the difficulty of the present invention may be an arbitrary value related to the average value of the probability distribution.

9 is a diagram exemplarily illustrating a method for confirming the liveness of a node according to an embodiment of the present invention. Referring to FIG. 9 , a method for checking the liveness of a node is as follows. The number of nodes selected as distributed sum nodes may be counted (S410). It may be determined whether the counted value is smaller than the number of specific nodes (eg, μ/2) (S420). If the counted value is smaller than the number of specific nodes, the liveness of the consensus node algorithm is not guaranteed. On the other hand, when the counted value is equal to or greater than the number of specific nodes, the liveness of the consensus node algorithm can be guaranteed.

The method for verifying node liveness of the PoN-based consensus node algorithm according to an embodiment of the present invention can recognize the possibility of problems such as network division or node inactivity in real time based on the number of nodes selected as consensus subjects.

10 is a diagram showing a block chain generation device 1000 according to an embodiment of the present invention by way of example. Referring to FIG. 10 , the block chain generating device 1000 may include at least one processor 1100, a network interface 1200, a memory 1300, a display 1400, and an input/output device 1500.

The processor 1100 may include at least one device through FIGS. 1 to 9 or may be implemented in at least one method described above through FIGS. 1 to 9 . As described above, the processor 1100 may generate a nonce chain based on a hash chain, disclose nonce chain information including a start height, a nonce value of the nonce chain, and a node address to other nodes, or execute instructions to verify qualification of the at least one first node to select an agreement node by using the nonce chain information and the nonce value and height received from the at least one first node.

The processor 1100 may execute a program and control the generating device 1000 . The generating device 1000 may be connected to an external device (eg, a personal computer or network) through the input/output device 1500 and exchange data. The generation device 1000 may include various electronic systems, such as mobile phones, smart phones, PDAs, tablet computers, laptop computers, computing devices such as personal computers, tablet computers, and netbooks, or electronic products such as televisions, smart televisions, and security devices for gate control.

The network interface 1200 may be implemented to perform communication with an external network through various wired/wireless methods.

The memory 1300 may include computer readable instructions. The processor 1100 may perform the aforementioned operations as instructions stored in the memory 1300 are executed in the processor 1100 . The memory 1300 may be a volatile memory or a non-volatile memory. The memory 1300 may include a storage device to store user data. The storage device may be an embedded multimedia card (eMMC), a solid state drive (SSD), or universal flash storage (UFS). The storage device may include at least one non-volatile memory device. Non-volatile memory devices include NAND flash memory, vertical NAND (VNAND), NOR flash memory, resistive random access memory (RRAM), phase-change memory (PRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), and spin injection magnetization reversal. memory (Spin Transfer Torque Random Access Memory: STT-RAM).

The embodiments described above may be implemented as hardware components, software components, and/or a combination of hardware components and software components. For example, the devices, methods, and components described in the embodiments may be implemented using one or more general-purpose computers or special-purpose computers, such as, for example, a processor, controller, arithmetic logic unit (ALU), digital signal processor, microcomputer, field programmable gate array (FPGA), programmable logic unit (PLU), microprocessor, or any other device capable of executing and responding to instructions. A processing device may run an Operating System (OS) and one or more software applications running on the Operating System.

A processing device may also access, store, manipulate, process, and generate data in response to execution of software. For convenience of understanding, there are cases in which a single processing device is used, but those skilled in the art may recognize that the processing device may include a plurality of processing elements and/or multiple types of processing elements. For example, the processing device may include a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as parallel processors.

Software may include a computer program, code, instructions, or a combination of one or more of these, and may configure a processing device to operate as desired, or may independently or collectively direct a processing device. Software and/or data may be permanently or temporarily embodied in any tangible machine, component, physical device, virtual equipment, computer storage medium or device, or transmitted signal wave, to be interpreted by or to provide instructions or data to a processing device. Software may be distributed on networked computer systems and stored or executed in a distributed manner. Software and data may be stored on one or more computer readable media.

The block chain generation apparatus 1000 according to an embodiment of the present invention includes at least one processor 1100 and a memory 1300 storing at least one instruction executed by the at least one processor 1100, wherein the at least one instruction reads a nonce from a nonce chain of a node, calculates the read nonce and previous height information, and compares the calculated value with a reference value to select the node as an agreement node. 1100).

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. Program instructions recorded on the medium may be specially designed and configured for the embodiment, or may be known and usable to those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROM and DVD, magneto-optical media such as floptical disks, hardware devices specially configured to store and execute program instructions such as ROM, RAM, and flash memory. Examples of program instructions include high-level language codes that can be executed by a computer using an interpreter, as well as machine language codes such as those produced by a compiler. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

The present invention makes it impossible to predict the nodes participating in the distributed agreement, so that it is impossible for other malicious nodes to predict and attack the distributed agreement nodes.

In addition, the present invention allows only the minimum number of nodes necessary for distributed agreement among all nodes to obtain qualifications for distributed agreement, thereby enabling rapid agreement between nodes participating in distributed agreement.

In addition, the present invention makes it possible to obtain distributed agreement qualifications regardless of the node's computing power, so that some nodes with strong computing capabilities cannot monopolize the distributed agreement qualifications.

In addition, the present invention makes it possible to verify the qualifications of nodes participating in distributed agreements, thereby blocking participation in distributed agreements by nodes without qualifications.

On the other hand, as described above, the nonce chain of each node was used to select or verify the consensus node. The nonce chain can be used to assign nodes to a random shard and select the minimum node in each shard as a consensus body.

On the other hand, the above-described content of the present invention is only specific embodiments for carrying out the invention. The present invention will include technical ideas, which are abstract and conceptual ideas that can be utilized as technology in the future, as well as concrete and practically usable means themselves.

100, 101, 102: block
1000: block chain generating device
1100: processor
1300: memory

Claims (8)

In the block generating method of the block chain generating device,
reading a nonce corresponding to a nonce chain of a candidate node;
performing an operation using the nonce and previous block information;
comparing the result of the operation with a reference value in order to check block generation authority of the candidate node; and
After the qualification of the candidate node is verified by at least one of the nodes other than the candidate node, the candidate node participates in the generation of the block as a block generation participation node,
The nonce chain is
Includes a plurality of nonce values,
The nonce values are linked through a hash chain, and the later generated corresponds to the first generated block. According to claim 1,
The nonce chain includes a start height and a last nonce value disclosed to the other nodes, and the last nonce value is used to verify the qualification of the candidate node in at least one or more of the other nodes. Block generation method. According to claim 2,
The qualifications of the candidate node
A hash operation is performed on the nonce using a difference between a height of the block corresponding to the nonce and the starting height;
Block generation method, which is verified based on a result of comparing the result of the hash operation with the last nonce value. According to claim 1,
The step of performing the above calculation is,
A block generation method of performing a hash operation using the nonce and the previous block information. According to claim 1,
Wherein the previous block information is a header hash value of a previous block. According to claim 1,
When the number of nodes that can participate in the distributed agreement for block generation is n, the minimum number of nodes required for the distributed agreement is x, and the cumulative distribution probability value to be selected below the minimum number of nodes required for the distributed agreement is k, the number of distributed agreement nodes is controlled by variables (n, x, k). According to claim 6,
Wherein the cumulative distribution probability value k has a binomial distribution characteristic. In the block chain generating device,
at least one processor; and
a memory storing at least one instruction to be executed by the at least one processor;
The at least one instruction reads a nonce corresponding to a nonce chain of a candidate node; performing an operation using the nonce and previous block information; and comparing a result of the operation with a reference value in order to confirm the authority of the candidate node to generate a block, and after the qualification of the candidate node is verified by at least one or more of nodes other than the candidate node, the candidate node is executed in the at least one processor so as to participate in generation of the block as a block generation participating node;
The nonce chain is
Includes a plurality of nonce values,
The nonce values are connected through a hash chain, and the later generated corresponds to the first generated block.