TW202236130A - Asset cross-chain exchanging system based on threshold signature scheme and method thereof - Google Patents

Abstract

An asset cross-chain exchanging system based on threshold signature scheme and method thereof is disclosed. By performing a distributed key generation (DKG) function based on secure multi-party computation (MPC) through a first client and a second client, so as to generate temporary accounts on different blockchain networks, at the same time, let a fair end host, the first client and the second client have different levels of shares corresponding to each temporary account. When the first client and the second client want to exchange assets of different blockchain networks, first transfer the assets to be exchanged to the corresponding temporary account, and then execute a threshold signature scheme (TSS) according to the shares to obtain of control the corresponding temporary account for completing cross-chain asset exchange. The mechanism is help to improve the high availability of cross-chain asset exchange.

Description

Asset cross-chain exchange system and method based on threshold signature

The invention relates to a system and method for exchanging assets across blockchains, in particular to an asset cross-chain exchange system and method based on threshold signatures.

In recent years, with the popularization and vigorous development of blockchain, various digital currencies based on blockchain technology have sprung up like mushrooms, such as Bitcoin, Ethereum and so on.

Generally speaking, because different digital currencies are based on different blockchains, they cannot be directly traded, exchanged, transferred, etc., and the traditional way is to achieve it through an exchange or a pre-agreed way. However, through the exchange, additional handling fees are required, and the operation is cumbersome and inconvenient; through the pre-agreed method, there is a possibility of breach of contract or fraud. Therefore, the traditional method has the problems of inconvenient asset exchange and poor security.

In view of this, some manufacturers have proposed the technical means of cross-chain exchange assets. Through the notary mechanism (Notary Schemes), when the two parties to the transaction cannot trust each other, one or a group of third parties that are mutually trusted by both parties and are relatively fair and independent act as Notaries to verify and ensure the legitimacy of transactions. However, this method will lead to the illegal transfer of assets if the notary is not impartial and conspires with one of the parties, so the availability of cross-chain exchange assets is greatly limited, so there is a problem of poor usability of cross-chain exchange assets.

To sum up, it can be seen that there has been a problem of poor availability of cross-chain exchange assets in the previous technology for a long time, so it is necessary to propose improved technical means to solve this problem.

The present invention discloses an asset cross-chain exchange system and method based on a threshold signature.

First, the present invention discloses a cross-chain asset exchange system based on a threshold signature, which includes: a fair-end host, a first client host, and a second client host. Wherein, the fair-end host is used to receive the first fragment, another first fragment, second fragment and another second fragment, and form a lower level according to the first fragment and the other first fragment The first new sharing unit of the first new sharing unit, and the second new sharing unit of low level is formed according to the second fragment and the other second fragment; the first client host is used to connect with the fair end host, and in the first The first account in the blockchain network has a first asset, and the first client host includes: a first confirmation module, a first execution module and a first transaction module. Among them, the first confirmation module is used to confirm the owner of the second account of the second blockchain network to the impartial host when the first asset and the second asset are to be exchanged, and to inquire whether the second account has the second account. The ownership of the second asset; the first execution module is connected to the first confirmation module, which is used to execute the distributed key generation function with Secure Multi-Party Computation (MPC) after the confirmation and query are correct. A block chain network generates a first temporary storage account and its corresponding first shared unit with a different level, and generates a first shard of a first new shared unit corresponding to the first shared unit and a lower level and related to the second shared unit. The second fragment of the second new shared unit corresponding to the two shared units and the lower level is sent to the fair-end host; the first transaction module is connected to the first execution module, so that after the first temporary storage account is generated, with The blockchain transaction method transfers the first asset to the first temporary storage account. Then, in the part of the second client host, which is connected to the fair-end host, and has a second asset in the second account of the second blockchain network, the second client host includes: a second confirmation module group, the second execution module and the second transaction module. Among them, the second confirmation module is used to confirm the owner of the first account of the first block chain to the fair-side host when the first asset and the second asset are to be traded, and to inquire whether the first account has the identity of the first asset. Ownership; the second execution module is connected to the second confirmation module, which is used to execute the distributed key generation function with secure multi-party computing to generate the second temporary storage account in the second blockchain network after the confirmation and query are correct and a second shared unit corresponding to it and having a different level, and another second slice that generates a second new shared unit corresponding to the second shared unit and having a lower level and corresponding to the first shared unit and lower Another first fragment of the first new shared unit of the level can be sent to the fair-end host; the second transaction module is connected to the second execution module, which is used to trade in the blockchain after the second temporary storage account is generated Transfer the second asset to the second escrow account. Wherein, the first client host stores a low-level first shared unit and a high-level second shared unit, and the second client host stores a high-level first shared unit and a low-level second shared unit, and allows the first The client host and the second client host choose to execute the threshold signature together with the impartial host to control the first asset of the first temporary storage account according to the first sharing unit and the first new sharing unit, and to control the first asset of the first temporary account according to the second sharing unit. The unit and the second new shared unit control a second asset of the second escrow account.

In addition, the present invention also discloses a cross-chain asset exchange method based on a threshold signature, the steps of which include: providing a first client host, the first client host has a first account in the first blockchain network with the first An asset, providing a second client host, the second client host has a second asset in the second account of the second block chain network, and providing the mutual connection between the first client host and the second client host Fair-side host; when the first client host and the second client-side host want to exchange the first asset and the second asset with each other, they jointly confirm to the fair-end host whether the owners of the first account and the second account are the first client respectively end host and the second client host, and check whether the first account and the second account have the ownership of the first asset and the second asset; after the first client host and the second client host confirm and check that they are correct, the Multi-party computing executes a distributed key generation function to generate a first temporary storage account and its corresponding first shared unit with different levels in the first blockchain network, and generate A second temporary account and its corresponding second shared unit with a different level, wherein the first client host stores a low-level first shared unit and a high-level second shared unit, and the second client host stores a high-level shared unit The first shared unit and the second low-level shared unit; the first client host transfers the first asset to the first temporary storage account in the form of blockchain transactions, and the second client host transfers the first asset to the first temporary storage account in the form of blockchain transactions. The second asset is sent to the second temporary storage account; the first client host and the second client host use secure multi-party computing to execute the distributed key generation function to generate the first slice and the corresponding first shared unit respectively another first fragment, and generate a second fragment corresponding to the second sharing unit and another second fragment respectively, wherein the first client host sends the generated first fragment and the second fragment to The fair-end host, the second client host sends another first fragment and another second fragment generated to the fair-end host; the fair-end host composes according to the received first fragment and another first fragment A low-level first new shared unit, and a low-level second new shared unit formed according to the received second fragment and another second fragment; and the first client host and the second client host allow selection and The fair end host executes the threshold signature together to control the first asset of the first temporary storage account according to the first sharing unit and the first new sharing unit, and to control the second temporary storage account according to the second sharing unit and the second new sharing unit. The second asset of the savings account.

The system and method disclosed in the present invention are as above, and the difference from the prior art is that the present invention uses secure multi-party computation to execute the distributed key generation function through the first client host and the second client host, so that different blocks can The chain network generates a temporary storage account, and at the same time makes the fair end host, the first client host and the second client host have sharing units corresponding to each temporary storage account and different levels, when the first client host and the second client host When the host wants to exchange assets of different blockchain networks, it first transfers the assets to be exchanged to the corresponding temporary storage account, and then executes the threshold signature according to the shared units held to obtain the control of the corresponding temporary storage account, and then Complete the cross-chain exchange of assets.

Through the above-mentioned technical means, the present invention can achieve the technical effect of improving the high availability of cross-chain exchange assets.

The implementation of the present invention will be described in detail below in conjunction with the drawings and examples, so as to fully understand and implement the implementation process of how the present invention uses technical means to solve technical problems and achieve technical effects.

First of all, before explaining the asset cross-chain exchange system and method based on the threshold signature disclosed in the present invention, the application environment of the present invention will be described first. The present invention is applied in an environment with different blockchain networks at the same time. For example: Bitcoin Blockchain Network (Bitcoin Blockchain Network) and Ethereum Blockchain Network (Ethereum Blockchain Network), each node in these blockchain networks can perform secure multi-party calculations to exchange data and Calculate the result, and then execute the threshold signature. Next, explain the self-defined terms of the present invention. The shared unit (Share) in the present invention refers to the shared unit (Share) in different nodes (such as: the first client host and the second client host) when performing secure multi-party computing. The elements generated by exchanging data and calculation results between each other can directly calculate the elliptic curve digital signature algorithm (Elliptic Curve Digital Signature Algorithm, ECDSA) by mathematical operations without reorganizing the private key. The signature (or "signature") in the signature format, such as: "First Shared Unit", "Second Shared Unit", "First New Shared Unit" and "Second New Shared Unit", etc., mutually The only difference between is that the corresponding temporary accounts or holders are different. Among them, the first sharing unit and the first new sharing unit correspond to the first temporary storage account; the second sharing unit and the second new sharing unit correspond to the second temporary storage account; the holding of the first new sharing unit and the second new sharing unit The latter is a fair host, and both the first client host and the second client host have different levels of the first sharing unit and the second sharing unit. In addition, the shards (such as: the first shard, the second shard, another first shard, and another second shard) refer to shards that divide data into shards through sharding technology , so that each fragment can be processed independently by different hosts, and then the final result can be composed according to the processing results. For example, a first slice and another first slice can form a first new sharing unit; a second slice and another second slice can form a second new sharing unit.

The following diagrams will further explain the asset cross-chain exchange system and method based on the threshold signature of the present invention. Please refer to "Picture 1" first. "Picture 1" is the asset cross-chain based on the threshold signature of the present invention. A system block diagram of an exchange system, the system includes: a fair end host 100 , a first client host 110 and a second client host 120 . Among them, the fair-end host 100 is used to receive the first fragment, another first fragment, second fragment, and another second fragment, and form a low-level A first new shared unit, and a second new shared unit at a lower level is formed according to the second slice and another second slice. In practice, the low-level first new sharing unit corresponds to the first temporary storage account and its first sharing unit; the low-level second new sharing unit corresponds to the second temporary storage account and its second sharing unit corresponding. In fact, both the first new shared unit and the second new shared unit are generated by executing a newly added shared unit. When the first client host 110 and the second client host 120 execute the distributed key generation function , and at the same time bring the x-coordinate and level value of the fair-end host 100 into the calculation to generate corresponding fragments, and then the fair-end host 100 forms the fragments into a new sharing unit. For example, assume that the first client host 110 (referred to as "A") has a high-level shared unit with a value of "24", an x-coordinate of a value of "3" and a level value of "0"; the second client host 120 (abbreviated as "B") has a low A shared cell of a level with a value of "5", an x-coordinate of a value of "4" and a level of a value of "1". A and B perform secure multi-party calculations, and generate new shared units (namely: the first new shared unit and the second new shared unit) to the impartial host 100 (referred to as "AMIS") without disclosing the private key. The steps are as follows :

1. AMIS generates the x-coordinate and level value, for example, the x-coordinate is the value "7" and the level value is "1", and sends them to A and B respectively.

2. After receiving the x-coordinate and level value of AMIS, A calculates 0*24 if it is correct. Similarly, B also calculates 1*5. Among them, the value 24 is the value calculated by substituting the x coordinate into the polynomial when the polynomial is "f(x) = 5x + 9"; the value 5 is "f'(x) = 5". In particular, a level value of 0 means no differentiation of the polynomial; a level value of 1 means the first differential of the polynomial; a level value of 2 means the second differential of the polynomial, and so on.

3. A randomly selects a number a in [0, P-1], where P is the number of elliptic curves, then a _b = a and a _amis = -a satisfy a _b + a _amis = 0. Likewise, B also randomly picks a number b in the aforementioned manner, such that b _a + b _amis = 5, and b _a = b and b _amis = 5 - b.

4. A sends a _b to B, and B sends b _a to A. Next, A calculates s _A = b _a + a _amis = b + a. As for B calculate s _B = a _b + b _amis = -a + 5 - b. At this point, A will send s _A to AMIS; B will send s _B to AMIS.

5. Based on the received s _A and s _B , AMIS sets its new sharing unit "s _amis " as "s _A + s _B = b + a + (-a) + 5 – b = 5".

The first client host 110 is used to connect with the fair-end host 100, and the first account in the first blockchain network 101 has the first asset. The first client host 110 includes: a first confirmation module 111 , the first execution module 112 and the first transaction module 113 . Among them, the first confirmation module 111 is used to confirm the owner of the second account of the second blockchain network 102 to the impartial host 100 when the first asset and the second asset are to be exchanged, and to inquire whether the second account Has the ownership of the second asset, and its confirmation method is to confirm and inquire according to the account address. In actual implementation, the first asset refers to the digital assets in the first blockchain network 101, such as: Bitcoin, Ethereum, tokenized goods or services, etc., assuming that the first zone The blockchain network 101 is the Ethereum blockchain network, and tokenization refers to tokens issued based on the ERC (Ethereum Request for Comment) protocol, such as: ERC-20, ERC-721, etc.

The first execution module 112 is connected to the first confirmation module 111, and is used to execute the distributed key generation function with secure multi-party computation after the confirmation and query are correct, so as to generate the first temporary in the first block chain network 101. deposit accounts and their corresponding first sharing units with different levels, for example: a first sharing unit of a high level and a first sharing unit of a low level, and generate a first new account corresponding to the first sharing unit and of a low level The first segment of the sharing unit and the second segment of the second new sharing unit corresponding to the second sharing unit and having a lower level are transmitted to the fair-side host 100 . In fact, the purpose of generating these sharing units (namely: the first sharing unit, the first new sharing unit) is to obtain control over the first temporary storage account when the threshold of the threshold signature is met.

The first transaction module 113 is connected to the first execution module 112, and is used for transferring the first asset to the first temporary storage account in the form of blockchain transaction after the first temporary storage account is generated. For example, assuming that the first asset is 10 bitcoins, the first transaction module 113 will transfer 10 bitcoins from the first account to the first temporary storage account. In actual implementation, the first temporary storage account is the address of the blockchain converted according to the public key generated by executing the distributed key generation function, and the first asset and the first temporary storage account are located in the same blockchain network road (ie: the first blockchain network 101).

Next, in the part of the second client host 120, which is used to connect with the fair-end host 100, and the second account in the second blockchain network 102 has a second asset, the second client host 120 Including: a second confirmation module 121 , a second execution module 122 and a second transaction module 123 . Among them, the second confirmation module 121 is used to confirm the owner of the first account of the first blockchain network 101 to the impartial host 100 when the first asset and the second asset are to be exchanged, and to inquire whether the first account Have ownership of the first property. In actual implementation, the confirmation and inquiry method is similar to the first confirmation module 111 of the first client host 110 . In addition, the second asset refers to a digital asset on the second blockchain network 102, which differs from the first asset in that the two are located in different blockchain networks. For example, assuming that the first asset is Bitcoin, the second asset may be Ether.

The second execution module 122 is connected to the second confirmation module 121, and is used to execute the distributed key generation function with secure multi-party computation after the confirmation and query are correct, so as to generate the second Temporary account and its corresponding second sharing unit with different level, and another second shard that generates a second new sharing unit corresponding to the second sharing unit and lower level and corresponding to the first sharing unit and lower level Another first segment of the first new shared unit is sent to the fair host 100 . In fact, the purpose of generating these sharing units (ie: the second sharing unit, the second new sharing unit) is to obtain control over the second temporary storage account when the threshold of the threshold signature is met.

The second transaction module 123 is connected to the second execution module 122, and is used for transferring the second asset to the second temporary storage account in the form of blockchain transaction after the second temporary storage account is generated. For example, assuming that the second asset is 50 ETH, the second transaction module 123 will transfer 50 ETH from the second account to the second temporary storage account. In actual implementation, the second temporary storage account is the address of the blockchain converted according to the public key generated by executing the distributed key generation function, and the second asset and the second temporary storage account are located in the same blockchain network Road (ie: the second blockchain network 102).

Wherein, the first client host 110 stores a low-level first shared unit and a high-level second shared unit, the second client host 120 stores a high-level first shared unit and a low-level second shared unit, and the second A client host 110 and a second client host 120 are allowed to choose to perform threshold signature together with the impartial host 100 to control the first temporary storage account according to the first sharing unit and the first new sharing unit respectively. asset, and a second asset controlling a second temporary storage account according to the second sharing unit and the second new sharing unit. In addition, in actual implementation, the first client host 110 and the second client host 120 may choose to implement a Gradual Exchange Protocol (Gradual Exchange Protocol) so that the first client host 110 and the second client host 120 exchange their respective There is a low-level first sharing unit and a second sharing unit, and after the exchange is completed, the first client host 110 is allowed to control the second temporary storage according to the high-level second sharing unit and the low-level second sharing unit account, and enabling the second client host 120 to allow the first temporary account to be controlled according to the high-level first sharing unit and the low-level first sharing unit. Specifically, the step-by-step exchange protocol consists of the following steps:

1. Make the first client host 110 and the second client host 120 randomly select r _{A, i} values and r _{B, i} values respectively, and both are in the interval [0, P-1], where A represents the first The client host 110, B represents the second client host 120, P is the number of elliptic curve groups (for example: 256), and i is a positive integer.

2. Split the ciphertext x of the first client host 110 and the ciphertext y of the second client host 120 into k (ie: k = P / 32, in this example P = 256, so k = 8), etc. points to generate multiple x _i values and multiple y _i values, the x _i values satisfy the ciphertext x = sum _i 2 ³²ⁱ x _i , and the y _i values satisfy the ciphertext y = sum _i 2 ³²ⁱ y _i , where , k = P / 32, i is a positive integer satisfying 1 <= i <= k, 0 <= x _i < 2 ³² and 0 <= y _i < 2 ³² .

3. The first client host 110 calculates the value of D _i and the value of E _i , the value of D _i is {x _i G + r _{A, i} M}, and the value of E _i is {r _{A, i} G}, where G is the base point of the elliptic curve group, and M is the public key of the first client host, the second client host 120 calculates the V _i value and the W _i value, and the V _i value is {y _i G + r _B,i N} , the value of W _i is {r _{B, i} G}, where N is the public key of the second client host 120 .

4. The first client host 110 and the second client host 120 exchange their calculated D _i values and V _i values with each other, and then exchange the E _i values and the W _i values in sequence until the sequential exchange is stopped .

In particular, it should be noted that in actual implementation, the modules described in the present invention can be implemented in various ways, including software, hardware or any combination thereof. For example, in some implementations, each module can use software and hardware or one of them. In addition, the present invention can also be realized partially or completely based on hardware. For example, one or more modules in the system can be implemented through integrated circuit chips, system Single chip (System on Chip, SoC), complex programmable logic device (Complex Programmable Logic Device, CPLD), field programmable logic gate array (Field Programmable Gate Array, FPGA) and so on. The present invention can be a system, method and/or computer program. The computer program may include a computer-readable storage medium loaded with computer-readable program instructions for causing a processor to implement various aspects of the present invention, the computer-readable storage medium may be a tangible and equipment. A computer readable storage medium may be, but is not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples (non-exhaustive list) of computer-readable storage media include hard disks, random access memory, read-only memory, flash memory, optical disks, floppy disks, and any suitable combination of the foregoing. As used herein, computer-readable storage media are not to be construed as transient signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (for example, light signals through fiber optic cables), or transmitted electrical signals. Additionally, the computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to various computing/processing devices, or downloaded over a network, such as the Internet, local area network, wide area network, and/or wireless network to an external computer device or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, hubs and/or gateways. The network card or network interface in each computing/processing device receives computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in computer-readable storage media in each computing/processing device middle. The computer program instructions for performing the operations of the present invention may be assembly language instructions, instruction set architecture instructions, machine instructions, machine-related instructions, micro instructions, firmware instructions, or source code or object code written in any combination of one or more programming languages (Object Code), the programming language includes object-oriented programming languages, such as: Common Lisp, Python, C++, Objective-C, Smalltalk, Delphi, Java, Swift, C#, Perl, Ruby and PHP, etc., as well as conventional programs Procedural programming language, such as: C language or similar programming language. The computer program instructions may be executed entirely on the computer, partly on the computer, as a stand-alone piece of software, partly on the client computer and partly on the remote computer, or entirely on the remote computer or server to execute.

Please refer to "Figure 2A" to "Figure 2D". "Figure 2A" to "Figure 2D" are the flow charts of the method for asset cross-chain exchange based on the threshold signature of the present invention. The steps include: providing A client host 110, the first client host 110 has the first asset in the first account of the first block chain network 101, and a second client host 120 is provided, and the second client host 120 is in the second region The second account of the block chain network 102 has a second asset, and provides a fair end host 100 interconnected with the first client host 110 and the second client host 120 (step 210); when the first client host 110 and When the second client host 120 intends to exchange the first asset and the second asset with each other, it jointly confirms to the impartial host 100 whether the owners of the first account and the second account are the first client host 110 and the second client host respectively 120, and check whether the first account and the second account have the ownership of the first asset and the second asset (step 220); after the first client host 110 and the second client host 120 confirm and check that they are correct, they will use multiple security Calculate and execute the distributed key generation function to generate the first temporary storage account and its corresponding first sharing unit with different levels in the first blockchain network 101, and generate the first temporary account in the second blockchain network 102 Generate a second temporary account and its corresponding second shared unit with different levels, wherein the first client host 110 stores the first shared unit with a low level and the second shared unit with a high level, and the second client host 120 Store the high-level first shared unit and the low-level second shared unit (step 230); the first client host 110 sends the first asset to the first temporary storage account in a blockchain transaction, and the second client host 120 transmits the second asset to the second temporary storage account in the form of a blockchain transaction (step 240); the first client host 110 and the second client host 120 execute the distributed key generation function with secure multi-party computing, and use to respectively generate a first fragment and another first fragment corresponding to the first sharing unit, and respectively generate a second fragment and another second fragment corresponding to the second sharing unit, wherein the first client The host 110 transmits the generated first fragment and the second fragment to the fair-end host 100, and the second client host 120 transmits another first fragment and another second fragment generated to the fair-end host 100 (Step 250); the impartial host 100 forms a first new sharing unit according to the received first fragment and another first fragment, and forms a second shared unit according to the received second fragment and another second fragment New sharing unit (step 260); the first client host 110 and the second client host 120 are allowed to choose to perform threshold signature together with the impartial host 100 to control the first sharing unit and the first new sharing unit respectively. A first asset of an escrow account, and a second asset of a second escrow account controlled according to the second sharing unit and the second new sharing unit (step 270 ). Through the above steps, the distributed key generation function can be executed by secure multi-party computing through the first client host 110 and the second client host 120, so as to generate temporary accounts in different blockchain networks, and at the same time make fair The end host 100, the first client host 110 and the second client host 120 have sharing units corresponding to each temporary storage account and different levels, when the first client host 110 and the second client host 120 want to exchange different blocks When linking the assets of the network, first transfer the assets to be exchanged to the corresponding temporary storage account, and then execute the threshold signature according to the shared units held to obtain the control of the corresponding temporary storage account, and then complete the cross-chain exchange of assets.

In addition, after step 270, the first client host 110 and the second client host 120 may choose to implement a Gradual Exchange Protocol (Gradual Exchange Protocol) so that the first client host 110 and the second client host 120 exchange their There is a low-level first sharing unit and a second sharing unit, and after the exchange is completed, the first client host 110 is allowed to control the second temporary storage according to the high-level second sharing unit and the low-level second sharing unit account, and enabling the second client host 120 to allow the first temporary account to be controlled according to the high-level first sharing unit and the low-level first sharing unit (step 280 ). In other words, the first client host 110 or the second client host 120 can directly perform threshold signing based on the high-level first shared unit originally held by itself and the low-level first shared unit obtained after the exchange. Chapter calculation, without the need to cooperate with other parties' hosts, the assets can be returned to the household by itself. In actual implementation, the step-by-step exchange protocol is shown in "Figure 2D", which includes: making the first client host 110 and the second client host 120 randomly select r _A,i values and r _B,i values respectively, and All are in the interval [0, P-1], wherein, A represents the first client host 110, B represents the second client host 120, P is the number of elliptic curve groups, and i is a positive integer (step 281) ; Split the ciphertext x of the first client host 110 and the ciphertext y of the second client host 120 into k equal parts (ie: k = P / 32, assuming P = 256, then k = 8) to generate A plurality of x _i values and a plurality of y _i values, the x _i values satisfy the ciphertext x = sum _i 2 ³²ⁱ x _i , and the y _i values satisfy the ciphertext y = sum _i 2 ³²ⁱ y _i , where k = P / 32, i is a positive integer satisfying 0 <= i <= k, 0 <= x _i < 2 ³² and 0 <= y _i < 2 ³² (step 282); the first client host 110 calculates the D _i value and The value of E _i , the value of D _i is {x _i G + r _{A, i} M}, and the value of E _i is {r _{A, i} G}, wherein G is the base point of the elliptic curve group, and M is the first client The public key of the host 110, the second client host 120 calculates the V _i value and the W _i value, the V _i value is {y _i G + r _{B, i} N}, and the W _i value is {r _{B, i} G}, wherein, N is the public key of the second client host 120 (step 283); the first client host 110 and the second client host 120 exchange their calculated D _i values and V _i values, and then according to The E _i value and the W _i value are exchanged sequentially until the sequential exchange is stopped (step 284). In this way, the other party's ciphertext (ie: ciphertext x and ciphertext y) can be calculated according to the exchanged values, and then the purpose of exchanging low-level shared units can be realized.

The following description will be made in the form of an embodiment in conjunction with "Figure 3" to "Figure 4B", please refer to "Figure 3", "Figure 3" is a schematic diagram of the application of the present invention to generate a shared unit. When executing the distributed key generation function to generate a shared unit, the first client host 110 (hereinafter referred to as "A") and the second client host 120 (hereinafter referred to as "B") will have their own x-coordinates, For example: 3 and 4, and select the level value according to your own level, for example: the value of the level selected by the high level is 0; the value of the level selected by the low level is 1. Assuming that A is a high grade and B is a low grade, both randomly select a first-degree polynomial (311, 312), such as: "f(x) = 3 * x + 5" and "g(x) = 10 * x + 19". Then, based on secure multi-party computation, A will calculate "f(3) = 14" and "f'(4) = 3" based on the x-coordinates and level values of all parties, where, since B's level value is 1, it means It is necessary to differentiate the first-order polynomial to be brought into the x-coordinate of B before bringing it into the calculation. Similarly, B will calculate "g(3) = 49" and "g'(4) = 10" based on the x-coordinates and level values of each party. Then, A passes "f'(4) = 3" to B; B passes "g(3) = 49" to A. At this point, A can set his own sharing unit (ie: the first sharing unit corresponding to the first temporary storage account) to "f(3) + g(3) = 63"; B can set his own sharing unit ( That is: another first shared unit corresponding to the first temporary storage account) is "f'(4) + g'(4) = 13", so far, A gets his own shared unit as "63", and B gets his own The shared unit for is "13". It should be noted that, for the convenience of description, the above are all illustrated with simple numerical values. In fact, the x-coordinate and the shared unit are usually very large numerical values.

As shown in "Figure 4A" and "Figure 4B", "Figure 4A" and "Figure 4B" are schematic diagrams of cross-chain asset exchange using the present invention. Assume that the first client host 110 has an account (ie: the first account 401) in the Bitcoin blockchain network, and an asset in this account (such as: 20 bitcoins) is the first asset; the second client The end host 120 has an account (ie: the second account 402 ) in the Ethereum blockchain network, and an asset (eg: 10 ETH) in this account is the second asset. When the first client host 110 and the second client host 120 want to exchange the first asset and the second asset, both parties will confirm the owners of the first account 401 and the second account 402 to the impartial host 100, and query the first Whether the account 401/second account 402 has ownership of the first asset/second asset. After confirmation and query are correct, the first client host 110 and the second client host 120 will respectively execute the distributed key generation function to generate the first temporary storage account 411 and the second temporary storage account 412, and use The first client host 110 obtains a low-level sharing unit corresponding to the first temporary storage account 411 (ie, the first sharing unit 421 ), and a high-level sharing unit corresponding to the second temporary storage account 412 (ie, the first sharing unit 412 ). Two sharing unit 431); make the second client host 120 obtain the high-level sharing unit corresponding to the first temporary storage account 411 (ie: the first sharing unit 422 ), and the low-level corresponding to the second temporary storage account 412 shared unit (namely: the second shared unit 432). Next, the first client host 110 transfers the first asset in the first account 401 to the first temporary account 411, and the second client host 120 transfers the second asset in the second account 402 to the second temporary account. deposit account 412.

Next, as shown in "FIG. 4B", after the first client host 110 and the second client host 120 know the x-coordinate and the level value of the impartial host 100, they will execute the distributed key generation function again, It is used to add a first new sharing unit 423 corresponding to the first sharing unit ( 421 , 422 ) and a lower level, and a second new sharing unit 433 corresponding to the second sharing unit ( 431 , 432 ) and a lower level. Specifically, the first client host 110 will generate the first fragment 441 corresponding to the first sharing unit (421, 422) and the second fragment 442 corresponding to the second sharing unit (431, 432); the second The client host 120 will generate another first fragment 451 corresponding to the first sharing unit (421, 422) and another second fragment 452 corresponding to the second sharing unit (431, 432), and then, the first The client host 110 transmits the generated first fragment 441 and the second fragment 442 to the impartial host 100; the second client host 120 transmits another first fragment 451 and another second fragment 452 generated to the fair-end host 100, so that the fair-end host 100 can form the first new sharing unit 423 according to the received first fragment 441 and another first fragment 451, and according to the received second fragment 442 and another second slice 452 form a second new shared unit 433 . At this time, the second client host 120 and the fair-end host 100 respectively have low-level sharing units of the Ethereum address (ie: the second sharing unit 431 and the second new sharing unit 433), and the first client host 110 has the Ethereum address The high-level sharing unit of the currency address (ie: the second sharing unit 432); the first client host 110 and the fair-side host 100 respectively have low-level sharing units of the bitcoin address (ie: the first sharing unit 421 and the second new sharing unit 433 ), the second client host 120 owns a high-level sharing unit of the bitcoin address (namely: the first sharing unit 422 ). Therefore, to control the first asset of the first temporary storage account, the second client host 120 must participate in the threshold signature calculation with its sharing unit. Similarly, to control the second assets of the second temporary storage account, the first client host 110 must participate in the threshold signature calculation with its sharing unit. In this way, the second client host 120 and the fair-end host 100 can jointly obtain the control right of the first temporary storage account 411 according to the high-level first sharing unit 422 and the low-level first new sharing unit 423; The end host 110 and the impartial end host 100 can jointly obtain the control right of the second temporary storage account 412 according to the high-level second sharing unit 432 and the low-level second new sharing unit 433 , so as to achieve the purpose of asset cross-chain exchange. In addition, the first client host 110 and the second client host 120 may choose to implement a step-by-step exchange protocol so that the first client host 110 and the second client host 120 exchange their respective low-level first sharing unit and the second sharing unit, and after completing the exchange, make the first client host 110 allow to control the second temporary account according to the second sharing unit of the high level and the second sharing unit of the low level, and make the second client The end host 120 allows controlling the first escrow account according to the high-level first sharing unit and the low-level first sharing unit. In this way, cross-chain asset exchange can be completed while reducing transaction costs, and it can support blockchain networks without smart contracts (Smart Contract). Availability of on-chain swap assets.

In summary, it can be seen that the difference between the present invention and the prior art lies in that the distributed key generation function is executed by secure multi-party computation through the first client host and the second client host, so that different blockchain networks can Generate a temporary storage account, and at the same time make the fair end host, the first client host and the second client host have sharing units corresponding to each temporary storage account and different levels, when the first client host and the second client host want to exchange For assets of different blockchain networks, first transfer the assets to be exchanged to the corresponding temporary storage account, and then perform threshold signatures according to the shared units held to obtain control of the corresponding temporary storage account, and then complete the cross-chain Exchange assets, through this technical means, can solve the problems existing in the previous technology, and then achieve the technical effect of improving the high availability of cross-chain exchange assets.

Although the present invention is disclosed above with the aforementioned embodiments, it is not intended to limit the present invention. Any person familiar with similar skills may make some changes and modifications without departing from the spirit and scope of the present invention. Therefore, the present invention The scope of patent protection shall be subject to what is defined in the scope of patent application attached to this manual.

101: the first blockchain network 102: the second blockchain network 100: the impartial host 110: the first client host 111: the first confirmation module 112: the first execution module 113: the first transaction module Group 120: second client host 121: second confirmation module 122: second execution module 123: second transaction module 311, 312: first-order polynomial 401: first account 402: second account 411: first temporary storage account 412: Second Temporary Account 421, 422: First Shared Unit 431, 432: Second Shared Unit 423: First New Shared Unit 433: Second New Shared Unit 441: First Shard 442: Second Shard 451: Another First Shard A shard 452: another second shard Step 210: provide a first client host with a first asset in a first account in a first blockchain network, provide a a second client host having a second asset in a second account on a second blockchain network and providing interconnection with the first client host and the second client host Step 220: when the first client host and the second client host intend to exchange the first asset and the second asset, jointly confirm the first account and the second asset to the fair end host Whether the owners of the two accounts are the first client host and the second client host respectively, and query whether the first account and the second account have the ownership of the first asset and the second asset Step 230: the The first client host and the second client host execute a distributed key generation function using Secure Multi-Party Computation (MPC) after confirming and querying that they are correct. The chain network generates a first temporary storage account and its corresponding multiple first shared units with different levels, and generates a second temporary storage account and its corresponding and different levels of shared units in the second block chain network. A plurality of second shared units, wherein the first client host stores the first shared unit at a low level and the second shared unit at a high level, and the second client host stores the first shared unit at a high level Sharing unit and the second sharing unit of lower level Step 240: the first client host transfers the first asset to the first temporary storage account, and the second client host transfers the second asset to the second Two Temporary Accounts Step 250: The first client host and the second client host execute the distributed key generation function by secure multi-party computation, so as to generate a first corresponding to the first sharing unit respectively. Fragment and another first fragment, and respectively generate a second fragment and another second fragment corresponding to the second sharing unit, wherein, the first client host will generate the first fragment The first fragment and the second fragment are sent to the fair-end host, and the second client host sends the other first fragment and the other second fragment to the fair-end host. Step 260: the fair-end According to the received first fragment and the other A slice is combined into a low-level first new shared unit, and a low-level second new shared unit is combined according to the received second slice and the other second slice Step 270: the first The client host and the second client host are allowed to choose to implement threshold signature together with the impartial host to generate a first signature message according to the first sharing unit and the first new sharing unit to transfer the second The first asset of a temporary storage account, and a second signature message generated according to the second sharing unit and the second new sharing unit to transfer the second asset of the second temporary storage account Step 280: the first A client host and the second client host choose to implement a Gradual Exchange Protocol (Gradual Exchange Protocol) to enable the first client host and the second client host to exchange the low-level first share unit and the second share unit, and after the exchange is completed, enable the first client host to allow the second temporary storage to be controlled according to the second share unit at a higher level and the second share unit at a lower level account, and make the second client host allow to control the first temporary account signature according to the first sharing unit of the high level and the first sharing unit of the low level. Step 281: Make the first client host and the second client host randomly select a r _A,i value and a r _B,i value respectively, and both are in the interval [0, P-1], wherein A represents the first client host, B represents The second client host, P is the number of elliptic curve groups, and i is a positive integer Step 282: Split a ciphertext x of the first client host and a ciphertext y of the second client host Divided into k to generate multiple x _i values and multiple y _i values, the x _i values satisfy the ciphertext x = sum _i 2 ³²ⁱ x _i , the y _i values satisfy the ciphertext y = sum _i 2 ³²ⁱ y _i , wherein, k = P / 32, i is a positive integer satisfying 1 <= i <= k, 0 <= x _i < 2 ³² and 0 <= y _i < 2 ³² Step 283: The first client The host computer calculates a D _i value and an E _i value, the D _i value is {x _i G + r _{A, i} M}, the E _i value is {r _{A, i} G}, wherein, G is the elliptic curve group Base point, M is the public key of the first client host, the second client host calculates a V _i value and a W _i value, the V _i value is {y _i G + r _{B, i} N}, the W The value of _i is {r _{B, i} G}, wherein N is the public key of the second client host. Step 284: The first client host and the second client host exchange the D _i calculated respectively. value and the V _i value, and then exchange the E _i value and the W _i value in sequence until the sequential exchange is stopped

Figure 1 is a system block diagram of the asset cross-chain exchange system based on the threshold signature of the present invention. Fig. 2A to Fig. 2D are the method flow charts of the asset cross-chain exchange method based on the threshold signature of the present invention. Fig. 3 is a schematic diagram of applying the present invention to generate a shared unit. Figure 4A and Figure 4B are schematic diagrams of asset cross-chain exchange using the present invention.

101: The first blockchain network

102: Second blockchain network

100: impartial host

110: the first client host

111: The first confirmation module

112: The first execution module

113: The first trading module

120: Second client host

121: The second confirmation module

122: The second execution module

123: Second trading module

Claims (8)

A cross-chain asset exchange system based on threshold signature, which includes: A fair-end host, used to receive a first fragment, another first fragment, a second fragment, and another second fragment, and compose according to the first fragment and the other first fragment A first new shared unit of low level, and a second new shared unit of low level formed according to the second slice and the other second slice; A first client host is used to connect with the fair-end host, and a first account in a first blockchain network has a first asset, the first client host includes: A first confirmation module, used to confirm the owner of a second account of a second block chain network to the impartial host when the first asset and a second asset are to be exchanged, and query the second account 2. Whether the account has ownership of the second asset; A first execution module, connected to the first confirmation module, is used to execute a distributed key generation function with Secure Multi-Party Computation (MPC) after the confirmation and query are correct. A block chain network generates a first temporary storage account and corresponding multiple first shared units with different levels, and generates the first new shared unit corresponding to the first shared unit and having a lower level The first segment and the second segment of the second new share unit corresponding to the plurality of second share units and lower-ranked are transmitted to the fair-end host; and A first transaction module, connected to the first execution module, is used to transfer the first asset to the first temporary storage account in the form of a blockchain transaction after the first temporary storage account is generated; and A second client host, used to connect with the fair-end host, and the second account in the second blockchain network has the second asset, the second client host includes: A second confirmation module, used to confirm the owner of the first account of the first blockchain network to the impartial host when the first asset and the second asset are to be exchanged, and query the second Whether an account has ownership of the first asset; A second execution module, connected to the second confirmation module, is used to execute the distributed key generation function by secure multi-party computation to generate a first Two temporary storage accounts and the second shared unit corresponding to them and having different levels, and generating the other second slice of the second new shared unit corresponding to the second shared unit and having a lower level and related to the second shared unit sending the another first segment of the first new shared unit corresponding to the first shared unit and lower level to the fair-side host; and A second transaction module, connected to the second execution module, used to transfer the second asset to the second temporary storage account in the form of blockchain transactions after the second temporary storage account is generated; Wherein, the first client host stores the low-level first shared unit and the high-level second shared unit, and the second client host stores the high-level first shared unit and the low-level all the second sharing unit, and the first client host and the second client host are allowed to choose to perform threshold signature together with the fair-end host to respectively perform controlling the first asset of the first escrow account, and controlling the second asset of the second escrow account according to the second sharing unit and the second new sharing unit. As in claim 1, the asset cross-chain exchange system based on threshold signature, wherein the first client host and the second client host choose to implement a Gradual Exchange Protocol (Gradual Exchange Protocol) so that the first client host and the second client host exchange the low-level first shared unit and the second shared unit held by each other, and after the exchange is completed, allow the first client host to allow according to the high-level said The second sharing unit and the second sharing unit of the lower level control the second temporary account, and allow the second client host to allow The unit controls the first temporary account. Such as the asset cross-chain exchange system based on the threshold signature of claim 2, wherein the step-by-step exchange agreement includes the following steps: Make the first client host and the second client host randomly select a value of rA _,i respectively And a r _{B, i} value, and all in the interval [0, P-1], wherein, A represents the first client host, B represents the second client host, P is the number of elliptic curve groups, and i is a positive integer; splitting a ciphertext x of the first client host and a ciphertext y of the second client host into k equal parts to generate multiple x _i values and multiple y _i values, The x _i value satisfies the ciphertext x = sum _i 2 ³²ⁱ x _i , the y _i value satisfies the ciphertext y = sum _i 2 ³²ⁱ y _i , wherein, k = P / 32, i is a positive integer satisfying 1 <= i <= k, 0 <= x _i < 2 ³² and 0 <= y _i < 2 ³² ; the first client host calculates a D _i value and an E _i value, and the D _i value is {x _i G + r _{A, i} M}, the E _i value is {r _{A, i} G}, wherein, G is the base point of the elliptic curve group, M is the public key of the first client host, and the second client host Calculate a V _i value and a W _i value, the V _i value is {y _i G + r _{B, i} N}, the W _i value is {r _{B, i} G}, where N is the second client the public key of the host; and the first client host and the second client host exchange the D _i value and the V _i value calculated respectively, and then exchange the E _i value and the W i value in sequence _i values until the sequential exchange is stopped. The asset cross-chain exchange system based on threshold signature as in claim 1, wherein the first shard and the other first shard of the first new shared unit, and the second shard of the second new shared unit Fragmentation and the other second fragmentation are when the first client host and the second client host execute the distributed key generation function, simultaneously bring the x-coordinate and level value of the fair-end host into generated by the calculation. A cross-chain asset exchange method based on a threshold signature, the steps of which include: Provide a first client host with a first asset in a first account on a first blockchain network, provide a second client host with a second client host in a A second account of the second block chain network has a second asset, and provides a fair end host interconnected with the first client host and the second client host; When the first client host and the second client host intend to exchange the first asset and the second asset, they jointly confirm to the impartial host whether the owners of the first account and the second account are the first client host and the second client host, and inquiring whether the first account and the second account have ownership of the first asset and the second asset; The first client host and the second client host execute a distributed key generation function using Secure Multi-Party Computation (MPC) after confirming and querying that they are correct, and are used in the first area The block chain network generates a first temporary storage account and its corresponding multiple first shared units with different levels, and generates a second temporary storage account and its corresponding and different levels in the second blockchain network a plurality of second shared units, wherein the first client host stores the first shared unit with a low level and the second shared unit with a high level, and the second client host stores the first shared unit with a high level a shared unit and said second shared unit of lower rank; The first client host transfers the first asset to the first temporary storage account through a blockchain transaction, and the second client host transfers the second asset to the second temporary storage account through a blockchain transaction account; The first client host and the second client host use secure multi-party computation to execute the distributed key generation function to generate a first slice and another first slice corresponding to the first shared unit respectively. Fragmentation, and respectively generating a second fragmentation and another second fragmentation corresponding to the second sharing unit, wherein the first client host will generate the first fragmentation and the second fragmentation sending to the fair-end host, and the second client host sends the generated another first fragment and the other second fragment to the fair-end host; The impartial end forms a low-level first new shared unit based on the received first fragment and the other first fragment, and forms a low-level first new shared unit based on the received second fragment and the other second fragment A second new shared unit at a lower level; and The first client host and the second client host are allowed to choose to implement threshold signature together with the fair-end host to control the first temporary storage account according to the first sharing unit and the first new sharing unit respectively The first asset, and the second asset controlling the second temporary storage account according to the second sharing unit and the second new sharing unit. As in claim 5, the asset cross-chain exchange method based on threshold signature, wherein the method further includes that the first client host and the second client host choose to implement a Gradual Exchange Protocol (Gradual Exchange Protocol) so that the first A client host and the second client host exchange the low-level first shared unit and the second shared unit held by each other, and after completing the exchange, allow the first client host to allow The second sharing unit at a higher level and the second sharing unit at a lower level control the second temporary account and enable the second client host to allow The step of controlling the first temporary storage account by the first sharing unit is described. As in claim 6, the asset cross-chain exchange method based on the threshold signature, wherein the step-by-step exchange agreement includes the following steps: Make the first client host and the second client host randomly select a value of rA _,i respectively And a r _{B, i} value, and all in the interval [0, P-1], wherein, A represents the first client host, B represents the second client host, P is the number of elliptic curve groups, and i is a positive integer; splitting a ciphertext x of the first client host and a ciphertext y of the second client host into k equal parts to generate multiple x _i values and multiple y _i values, The x _i value satisfies the ciphertext x = sum _i 2 ³²ⁱ x _i , the y _i value satisfies the ciphertext y = sum _i 2 ³²ⁱ y _i , wherein, k = P / 32, i is a positive integer satisfying 1 <= i <= k, 0 <= x _i < 2 ³² and 0 <= y _i < 2 ³² ; the first client host calculates a D _i value and an E _i value, and the D _i value is {x _i G + r _{A, i} M}, the E _i value is {r _{A, i} G}, wherein, G is the base point of the elliptic curve group, M is the public key of the first client host, and the second client host Calculate a V _i value and a W _i value, the V _i value is {y _i G + r _{B, i} N}, the W _i value is {r _{B, i} G}, where N is the second client the public key of the host; and the first client host and the second client host exchange the D _i value and the V _i value calculated respectively, and then exchange the E _i value and the W i value in sequence _i values until the sequential exchange is stopped. The asset cross-chain exchange method based on threshold signature as in claim 5, wherein the first new sharing unit and the second new sharing unit are the first client host and the second client host executing the decentralized When the key is generated, the x-coordinate and level value of the impartial host are brought into the calculation at the same time.

Images