TWI710987B - Wallet service system with multi-signature and method thereof - Google Patents

Abstract

A wallet service system with multi-signature and method thereof is disclosed. By providing a terminal device, a recover host, a wallet service host and an exchange host for executing a secret sharing algorithm to generate a plurality of shares, so as to execute a secure multi-party computation (MPC) to calculate a signature to complete a sign of transaction, and allowing the shares to be reset, regenerate at least one new share to replace the original shares under the premise of being able to use the same private key. The mechanism is help to improve the security of wallet.

Description

Wallet service system and method with multiple signatures

The invention relates to a wallet service system and method thereof, in particular to a wallet service system and method with multiple signatures.

In recent years, with the popularity and vigorous development of electronic wallets, various wallet services have sprung up. However, no matter what wallet service is used, it is inseparable from the use of private keys to sign transactions (ie: sign transactions) However, when the private key is stolen, the thief will be able to conduct unauthorized transactions. Therefore, how to protect the private key of the wallet service has become one of the problems that manufacturers urgently want to solve.

Generally speaking, the traditional private key protection method is to encrypt the private key before storing, for example, storing in a database, storing in the form of a file, or using a hardware security module (Hardware Security Module, HSM) to store . However, the above methods have a common problem, that is: there is no way to prevent Memory Dump attacks, because at a certain point in time, the private key will be read into the memory, for example, when the private key is generated At the time, a set of private keys will be generated in a random number method, and then stored after being encrypted. During this process, the private key will be stored in the memory for a short time. In addition, when signing the transaction message, you need to The private key is taken out for signing. At this time, there will also be a private key message in the memory. At this time, the private key is likely to be stolen due to a memory dump attack, so the security of the electronic wallet is not good.

In view of this, some manufacturers have proposed a threshold-type signature technology, which uses multiple private keys to sign together. When the number of signatures reaches the threshold, the signature is valid. In this way, the impact caused by the theft of a single user's private key can be reduced, and the difficulty of a memory dump attack can be effectively increased. However, this method also causes the respective private keys to exist in their respective memory, so it is also unavoidable that the private key may be attacked by memory dumping, so this method still cannot effectively solve the poor security of the electronic wallet problem.

In summary, it can be seen that the prior art has always had the problem of poor security of electronic wallets for a long time, so it is really necessary to propose improved technical means to solve this problem.

The invention discloses a wallet service system with multiple signatures and a method thereof.

First, the present invention discloses a wallet service system with multiple signatures, which is applied in a blockchain network composed of multiple nodes. The system includes: terminal devices, reset service hosts, wallet service hosts, and exchange hosts. Among them, the terminal device is one of the nodes in the blockchain network, which is used to transmit the address generation request and receive the first identification code at the beginning, and transmit the transaction request and receive the second identification code when a blockchain transaction is to be performed. The identification code and the encoded data to be signed, and when you want to reset, send a reset request and receive the third identification code; the reset service host is one of the nodes in the blockchain network for When receiving the address generation request containing the first identification code, obtain the first identification code, and when receiving the reset request containing the third identification code, obtain the third identification code; the wallet service host is in the blockchain network One of the nodes is used to obtain the first identification code when receiving the address generation request containing the first identification code, and transmit the address generation request containing the first identification code to the reset service host. 2. In the transaction request of the identification code and the encoded data to be signed, the second identification code and the encoded data to be signed are obtained, and the third identification code is obtained when the reset request containing the third identification code is received , And send a reset request containing the third identification code to the reset service host; the exchange host is one of the nodes in the blockchain network, used to generate the first identification when receiving the address generation request from the terminal device Code and return it to the terminal device, and send an address generation request containing the first identification code to the wallet service host. When a transaction request is received from the terminal device, a second identification code is generated and the data to be signed in the transaction request is encoded , And then bring the generated second identification code and the encoded data to be signed into the transaction request for transmission to the terminal device and the wallet service host, and when the reset request is received from the terminal device, the third identification code is generated and Send back to the terminal device, and send the reset request containing the third identification code to the wallet service host; where the terminal device, reset service host, wallet service host and exchange host all obtain the first identification code, and establish mutual security Point-to-point connection, and execute the same secret sharing algorithm and exchange calculation results to generate the corresponding N shared units respectively, and multiply each shared unit with the base point and the corresponding interpolation coefficient and then add them together to generate the corresponding The public key of the shared unit, where N is a positive integer; where the terminal device, the wallet service host, and the exchange host all obtain the second identification code and the encoded data to be signed, and establish a secure point-to-point connection with each other for Perform secure multi-party calculations to calculate the signature, and the wallet service host broadcasts the signature to complete the signature of the data to be signed; the terminal device, reset service host, wallet service host, and exchange host all obtain the third identification After the code, a secure point-to-point connection is established with each other, and a secure multi-party operation of resetting the shared unit is performed, so that the terminal device regenerates a new shared unit to replace the original shared unit in the terminal device.

In addition, the present invention discloses a wallet service method with multiple signatures, which is applied in a blockchain network composed of multiple nodes, and the steps include: in the blockchain network, providing a secure point-to-point connection function The terminal device, the reset service host, the wallet service host and the exchange host respectively serve as one of the nodes; at the initial stage, the terminal device sends an address generation request to the exchange host, so that the exchange host generates the first identification code and Back to the terminal device, and the exchange host transmits an address generation request containing the first identification code to the wallet service host, so that the wallet service host transmits the address generation request containing the first identification code to the reset service host; terminal device, reset After the service host, wallet service host, and exchange host all obtain the first identification code, they establish a secure point-to-point connection with each other, and execute the same secret sharing algorithm and exchange calculation results to generate corresponding N sharing units, and Multiply each shared unit with the base point and the corresponding interpolation coefficient and add them together to generate the public key of the corresponding shared unit, where N is a positive integer; when the terminal device wants to perform a blockchain transaction, the terminal device transmits the transaction Request to the exchange host to make the exchange host generate the corresponding second identification code and encode the data to be signed in the transaction request, and bring the generated second identification code and the encoded data to be signed together Incoming transaction requests are sent to the terminal device and the wallet service host; after the terminal device, the wallet service host and the exchange host obtain the second identification code and the encoded data to be signed, they establish a secure point-to-point connection with each other to implement security Multi-party calculations to calculate the signature, and the wallet service host broadcasts the signature to complete the signing of the data to be signed; when the terminal device wants to reset the shared unit, the terminal device sends a reset request to the exchange host to make the transaction The host generates a third identification code and sends it back to the terminal device, and causes the exchange host to send a reset request containing the third identification code to the wallet service host, and then the wallet service host sends a reset request containing the third identification code to Reset the service host; after the terminal device, reset service host, wallet service host, and exchange host all obtain the third identification code, they establish a secure point-to-point connection with each other, and perform the secure multi-party operation of resetting the shared unit to reset the terminal device Generate a new shared unit to replace the original shared unit in the terminal device.

The system and method disclosed in the present invention are as above. The difference from the prior art is that the present invention executes a secret sharing algorithm to generate shared units by providing terminal devices, reset service hosts, wallet service hosts, and exchange hosts. When performing secure multi-party calculations to calculate the signature to complete the transaction signing, and allow the shared unit to be reset, a new shared unit can be regenerated to replace the original shared unit under the premise that the same private key can be used before and after the reset.

Through the above-mentioned technical means, the present invention can achieve the technical effect of improving the security of the electronic wallet.

Hereinafter, the implementation of the present invention will be described in detail with the drawings and embodiments, so as to fully understand and implement the implementation process of how the present invention uses technical means to solve technical problems and achieve technical effects.

Before describing the wallet service system with multiple signatures and its method disclosed in the present invention, the self-defined terms of the present invention will be explained. The “Share” in the present invention refers to the execution of secret sharing algorithms For example, the elements generated by the Joint Random Secret Sharing (JRSS) algorithm are used to exchange between different nodes when performing Secure Multi-Party Computation (SMC/MPC) , In order to calculate the signature (or “signature”) in accordance with the signature format of the Elliptic Curve Digital Signature Algorithm (Elliptic Curve Digital Signature Algorithm, ECDSA), and then achieve hierarchical secret sharing (Hierarchical Secret Sharing, HSS) ), Threshold Secret Sharing (TSS), etc.

The following is a detailed description of the multi-signature wallet service system and method of the present invention in conjunction with the drawings. Please refer to "Figure 1" first. "Figure 1" is the system block diagram of the multi-signature wallet service system of the present invention. , Applied to a blockchain network composed of multiple nodes, this system includes: a terminal device 110, a reset service host 120, a wallet service host 130, and an exchange host 140. Among them, the terminal device 110 is one of the nodes in the blockchain network, which is used to send an address generation request and receive the first identification code at the initial stage, and to send a transaction request and receive the first identification code when a blockchain transaction is to be performed. 2. The identification code and the encoded data to be signed, and when resetting is desired, sending a reset request and receiving a third identification code. In actual implementation, the first identification code, the second identification code, and the third identification code can be any numbers, letters, and symbols, combined into a unique string, or can be directly used as a universally unique identification code (Universally Unique Identifier, UUID) or Globally Unique Identifier (GUID), these identification codes are generated by the exchange host 140 every time a request (Request) is received to provide parties to distinguish and execute based on the identification code The corresponding request.

The reset service host 120 is one of the nodes in the blockchain network, and is used to obtain the first identification code when receiving the address generation request containing the first identification code, and to obtain the first identification code after receiving the address generation request containing the third identification code. Upon reset request, a third identification code is obtained. In other words, the reset service host 120 only receives the address generation request containing the first identification code from the wallet service host 130 during the process of generating the shared unit, and receives from the wallet service host 130 during the process of resetting the shared unit. A reset request containing the third identification code. In actual implementation, when the wallet service host 130 transmits the reset request, it needs to bring in the corresponding original public key or code to inform the other party which shared unit is to be reset. Taking the original public key as an example, other parties can Know the corresponding shared unit according to the original public key and replace it; take the code brought in as an example, you can set an independent code for the shared unit in advance, such as "user_1_key_1", so that other parties know which share to replace unit.

The wallet service host 130 is one of the nodes in the blockchain network, which is used to obtain the first identification code when receiving the address generation request containing the first identification code, and transmit the address generation request containing the first identification code To reset the service host, when a transaction request containing the second identification code and the encoded data to be signed is received, the second identification code and the encoded data to be signed are obtained, and when the third identification code is received When the reset request is made, the third identification code is obtained, and the reset request containing the third identification code is sent to the reset service host. In other words, only when the transaction request is received, the identification code and the encoded data to be signed, such as the transfer-out address, transfer-in address, amount, etc., will be obtained, otherwise only the identification code will be obtained. In actual implementation, the wallet service host 130 can pre-store a blacklist containing the first destination address. When the wallet service host 130 receives a blockchain transaction and its destination address is among the first destination addresses, it refuses to sign Chapter to sign the blockchain transaction, or the wallet service host 130 pre-stores a whitelist containing the second destination address. When the wallet service host receives the blockchain transaction and its destination address is in the second destination address, it is allowed Sign blockchain transactions with signatures. In addition, the wallet service host 130 may also allow the exchange host 140 to set restriction conditions to limit the amount of digital currency sent within a certain time range, for example, limit the amount of digital currency sent in a single day.

The exchange host 140 is one of the nodes in the blockchain network. When receiving an address generation request from the terminal device 110, the exchange host 140 generates a first identification code and sends it back to the terminal device 110, and transmits the first identification code The address of, generates a request to the wallet service host 130. In addition, when a transaction request is received from the terminal device 110, a second identification code is generated and the data to be signed in the transaction request is encoded, and then the generated second identification code is combined with the encoded data to be signed The transaction request is sent to the terminal device 110 and the wallet service host 130. Then, when a reset request is received from the terminal device 110, a third identification code is generated and sent back to the terminal device 110, and a reset request including the third identification code is sent to the wallet service host 130.

As mentioned above, the terminal device 110, the reset service host 120, the wallet service host 130, and the exchange host 140 can be regarded as parties respectively. After the four parties obtain the first identification code, they will establish a secure point-to-point connection with each other. Line, and execute the same secret sharing algorithm and exchange calculation results to generate the corresponding N shared units, and combine each shared unit with the base point and the corresponding interpolation coefficient (such as: Lagrangian coefficient, Burke Hough coefficients, etc.) are multiplied and then added to each other to generate the public key of the corresponding shared unit, where N is a positive integer. At this time, all parties can know which public key their shared unit corresponds to. In addition, after the terminal device 110, the wallet service host 130, and the exchange host 140 obtain the second identification code and the encoded data to be signed, they will establish a secure point-to-point connection with each other to perform secure multi-party operations to calculate the signature , And the wallet service host 130 broadcasts the signature to complete the signature of the signature material to be signed. Then, after the terminal device 110, the reset service host 120, the wallet service host 130, and the exchange host 140 all obtain the third identification code, they will establish a secure point-to-point connection with each other, and perform the secure multi-party operation of resetting the shared unit to make the terminal The device 110 regenerates a new sharing unit to replace the original sharing unit in the terminal device 110. In actual implementation, in addition to replacing the original sharing unit in the terminal device 110 with a new sharing unit, the terminal device 110, the reset service host 120, the wallet service host 130, and the exchange host 140 can all obtain the third identification. After the code, the exchange host 140, the wallet service host 130, and the reset service host 120 are allowed to regenerate a new shared unit to replace the original shared unit. In particular, the above is the case of TSS, and in the case of HSS, the generating and sharing units are the terminal device, the reset service host, the wallet service host, and the exchange host, respectively, according to their respective preset sharing numbers, thresholds, The index value and the level value generate corresponding polynomials, and multiple polynomial values conforming to the shared number are calculated according to the differential J degree polynomial and all index values, where J is the level value. Then, the terminal device, the reset service host, the wallet service host, and the exchange host perform secure multi-party operations to exchange the polynomial values calculated by each, and respectively generate corresponding shared units with different levels according to the exchange results.

In particular, in actual implementation, the terminal device 110, the reset service host 120, the wallet service host 130, and the exchange host 140 are all nodes of the blockchain network, and each node is a computer with network functions. Devices, such as: personal computers, laptops, tablets, smart phones, servers, etc., and each node starts to initiate a peer-to-peer (P2P) connection after holding an identification code. In addition, the aforementioned can realize HSS and TSS, the difference between the two is that the shared unit of the former has different levels (or called hierarchy), while the shared unit of the latter does not. Taking HSS as an example, assuming that five shared units are generated, the configuration of these five shared units can be configured to configure a high-level shared unit in the wallet service host 130, and configure two high-level shared units in the reset service host 120. The host 140 is configured with a low-level sharing unit, and the terminal device 110 is configured with a low-level sharing unit. In the case of TSS, the terminal device 110, the reset service host 120, the wallet service host 130, and the exchange host 140 are each configured with the same level of sharing units.

Please refer to "Figure 2A" and "Figure 2B". "Figure 2A" and "Figure 2B" are the method flowcharts of the multi-signature wallet service method of the present invention, which is applied in an area composed of multiple nodes. In the block chain network, the steps include: in the block chain network, a terminal device 110 with a secure point-to-point connection function, a reset service host 120, a wallet service host 130, and an exchange host 140 are provided to serve as One of the nodes (step 210); at the beginning, the terminal device 110 sends an address generation request to the exchange host 140 so that the exchange host 140 generates a first identification code and sends it back to the terminal device 110, and the exchange host 140 sends The address generation request containing the first identification code is sent to the wallet service host 130, so that the wallet service host 130 transmits the address generation request containing the first identification code to the reset service host 120 (step 220); the terminal device 110, the reset service host 120 After both the wallet service host 130 and the exchange host 140 obtain the first identification code, they establish a secure point-to-point connection with each other, and execute the same secret sharing algorithm and exchange calculation results to generate corresponding N sharing units, and Multiply each shared unit with the base point and the corresponding interpolation coefficient and then add them together to generate the public key of the corresponding shared unit, where N is a positive integer (step 230); when the terminal device 110 wants to perform a blockchain transaction, The terminal device 110 transmits a transaction request to the exchange host 140, so that the exchange host 140 generates a corresponding second identification code, encodes the data to be signed in the transaction request, and combines the generated second identification code with the encoded data The data to be signed is brought into the transaction request and sent to the terminal device 110 and the wallet service host 130 (step 240); the terminal device 110, the wallet service host 130 and the exchange host 140 all obtain the second identification code and the encoded After the data to be signed, a secure point-to-point connection is established to perform secure multi-party calculations to calculate the signature, and the wallet service host 130 broadcasts the signature to complete the signing of the data to be signed (step 250); When the device 110 wants to reset the shared unit, the terminal device 110 sends a reset request to the exchange host 140 so that the exchange host 140 generates a third identification code and sends it back to the terminal device 110, and causes the exchange host 140 to send a third identification code containing the The reset request of the three identification codes is sent to the wallet service host 130, and the wallet service host 130 transmits the reset request containing the third identification code to the reset service host 120 (step 260); the terminal device 110, the reset service host 120, After both the wallet service host 130 and the exchange host 140 obtain the third identification code, they establish a secure point-to-point connection with each other, and perform a secure multi-party operation to reset the shared unit, so that the terminal device 110 regenerates a new shared unit to replace the original terminal The sharing unit of the device 110 (step 270). Through the above steps, by providing the terminal device 110, the reset service host 120, the wallet service host 130, and the exchange host 140, a secret sharing algorithm can be executed to generate a shared unit, so that a secure multi-party calculation can be performed during transactions. Zhang Yi completes the transaction signing and allows the shared unit to be reset. On the premise that the same private key can be used before and after the reset, a new shared unit is regenerated to replace the original shared unit.

The following description will be given in conjunction with "Figure 3" and "Figure 4" by way of embodiment. Please refer to "Figure 3" first. "Figure 3" is a schematic diagram of applying the present invention to generate shared units. When the terminal device 110, the reset service host 120, the wallet service host 130, and the exchange host 140 are executing a secret sharing algorithm (such as JRSS), the four parties will each select at least one random polynomial. For example, the terminal device 110 A random polynomial "d1" can be selected, the reset service host 120 can choose two random polynomials "d2" and "d3", the wallet service host 130 can choose a random polynomial "d4", and the exchange host 140 can choose a random polynomial "D5", these five random polynomials "d1" to "d5" are as shown in "Figure 3", where the constant term is a random integer selected by all parties (or called "Secret"). Then, each party separately sets the index value of each party (for example, the index value of the terminal device 110 can be a value 1, the index value of the reset service host 120 can be a value 2 and a value 3, and the index value of the wallet service host 130 can be Value 4. The index value of the exchange host 140 can be a value of 5.) Bring in the random polynomial of your choice for calculation. For example, the terminal device 110 brings the value 1 to 5 into the random polynomial "d1" to calculate 5 calculation results ( Namely: "d1(1)", "d1(2)", "d1(3)", "d1(4)" and "d1(5)"), resetting the service host 120 will also set the value from 1 to 5 Bring in the random polynomial "d2" to calculate 5 calculation results (ie: "d2(1)", "d2(2)", "d2(3)", "d2(4)" and "d2(5)" ), and take the values 1 to 5 into the random polynomial "d3" to calculate 5 calculation results (ie: "d3(1)", "d3(2)", "d3(3)", "d3(4 )” and “d3(5)”), the wallet service host 130 takes the value 1 to 5 into the random polynomial “d4” to calculate 5 calculation results (ie: “d4(1)”, “d4(2)” , "D4(3)", "d4(4)" and "d4(5)"), the exchange host 140 also takes the values 1 to 5 into the random polynomial "d5" to calculate 5 calculation results (ie: "D5(1)", "d5(2)", "d5(3)", "d5(4)" and "d5(5)"), in this way, a total of 25 calculation results can be calculated, and then , Each party exchanges messages with each other, that is, the four parties will each bring in the calculation result of the value 1 (ie: "d1(1)", "d2(1)", "d3(1)", "d4(1) )” and “d5(1)”), which are provided to the party with the index value “1” to sum to obtain the corresponding shared unit “Sd1” (ie: “Sd1=d1(1)+d2(1)+d3( 1)+d4(1)+d5(1)”), the calculation result of the value 2 will be added (ie: “d1(2)”, “d2(2)”, “d3(2)”, “d4( 2)” and “d5(2)”), which are provided to the party with the index value “2” to sum to obtain the corresponding shared unit “Sd2” (ie: “Sd2=d1(2)+d2(2)+d3 (2)+d4(2)+d5(2)”), and so on, will bring the calculation result of the value 5 (ie: “d1(5)”, “d2(5)”, “d3(5 )”, “d4(5)” and “d5(5)”), which are provided to the party with the index value “5” to sum to obtain the corresponding shared unit “Sd5” (ie: “Sd5=d1(5)+ d2(5)+d3(5)+d4(5)+d5(5)”), so that after MPC calculation and exchange of messages by each party, as shown in "Figure 3", each party will get the corresponding shared unit (terminal Device 110 gets the shared unit "Sd1 ", the reset service host 120 obtains the shared unit "Sd2" and "Sd3", the wallet service host 130 obtains the shared unit "Sd4", and the exchange host 140 obtains the shared unit "Sd5". In particular, if these five shared units use Lagrangian interpolation (that is, a special case of Burkhoff interpolation), the polynomial 300 "39x^4+" as shown in "Figure 3" can be calculated. 45x^3+54^2+74x+56", the solution calculated by bringing the value 0 into x is the value 56 (ie: the private key "d"), however, the private key "d" is calculated here It is only for the convenience of explanation and verification that this value is indeed the sum of the constant terms of the above five random polynomials (ie: "d=d1(0)+d2(0)+d3(0)+d4(0)+d5(0) )”), this value will not be calculated in practical applications, because in the signature calculation formula with “d*r”, such as: “s=k(e+d*r)”, if you can directly Knowing the value of "k(e+d*r)", then there is no need to actually calculate the private key "d". In addition, these five shared units "Sd1" to "Sd5" are respectively multiplied by the base point "G" and the corresponding interpolation coefficients, such as: Lagrangian coefficients "L1" to "L5" are multiplied, and then added together to get The public key "Q", ie: "Q= L1*Sd1*G+ L2*Sd2*G+ L3*Sd3*G+ L4*Sd4*G+ L5*Sd5*G", this public key "Q" is hashed and encoded It becomes the account address.

The above is the case of TSS, assuming it is the case of HSS, that is, to make the shared unit hierarchical, you need to differentiate the polynomial and then take the value. For example, the terminal device 110, the reset service host 120, the wallet service host 130, and the exchange host 140 respectively generate corresponding polynomials according to their preset sharing quantity, threshold value, index value, and level value, and according to the differential J degree The polynomial of and all index values are calculated to meet the shared number of polynomial values, where J is the level value. Then, the terminal device 110, the reset service host 120, the wallet service host 130, and the exchange host 140 perform secure multi-party operations to exchange the polynomial values calculated by each, and generate corresponding shared units with different levels according to the exchange results. . These shared units can calculate the polynomial "f(x)" that satisfies all the conditions through the Berkhof interpolation method on the premise of knowing the polynomial form (Basis), index value, and level value, and the constant term in the polynomial It stands for ciphertext. Similarly, based on security considerations, the ciphertext is not actually calculated, but the shared unit is directly used to calculate the signature, which can obtain the same result as the method of directly using the ciphertext to calculate the signature. For example, suppose the party whose index value is "1", such as the terminal device 110, whose default level value is the value "0", the number of shares is the value "5", and the threshold value is the value "3". When sharing the unit, a polynomial "f" will be randomly generated according to the preset coefficient array, polynomial form (such as: "{1, x, x^2}") and level value, such as: "x^2+2x+3 ", the form of the polynomial will change with the threshold value. Taking the threshold value equal to "4" as an example, the polynomial form is "{1, x, x^2, x^3}", In other words, when the threshold value is "t", in the polynomial form, the highest degree of "x" is "t-1". Next, let "di^j(x)" be a differential polynomial of degree "j", and "di^j(i)" this polynomial takes the value at the point "x = i", where "i" represents The holder of the private key sharing unit whose index value is "i" (the holder may be a hardware wallet device of the server or client), "j" represents the number of differentiations, and is also the level value, The larger the value of "j", the higher the degree of differentiation of the polynomial, and the lower the level (or called the level) of the generated private key sharing unit. Assuming that all the index values are from "1" to "5" and the polynomials "x" and the level values are "j1" to "j5", respectively, the corresponding five values are calculated for the devices with the index value "i". Polynomial values (ie: "di'^j1(1)" to "di'^j5(5)"), then, like TSS, the polynomial value "di'^ calculated by the value "2" will be added j2(2)” is sent to the party whose index value is “2”, and the polynomial value “di'^j3(3)” calculated with the value “3” is sent to the party whose index value is “3”, and By analogy, the polynomial value "di'^j5(5)" calculated with the value "5" is sent to the party whose index value is "5". In other words, the execution of a secure multi-party operation will send the corresponding polynomial value to the corresponding party according to the index value. Therefore, the party with the index value "1", such as the terminal device 110, has the polynomial value "d1^" calculated by itself. In addition to j1(1)", it will also receive polynomial values calculated by different parties from their own polynomials with the value "1" (ie: "d2^j1(1)", "d3^j1(1) ”, “d4^j1(1)” and “d5^j1(1)”); the party whose index value is “2”, such as resetting the service host 120, in addition to having the polynomial value “d2^j2” calculated by itself In addition to (2)", it will also receive the polynomial value calculated by the value "2" from different parties based on their own polynomial (ie: "d1^j2(2)", "d3^j2(2)" , "D4^j2(2)" and "d5^j2(2)"), and so on. In this way, all parties (ie: the terminal device 110, the reset service host 120, the wallet service host 130, and the exchange host 140) can sum up these polynomial values to generate the corresponding shared unit, for example: the index value The side of "1" sums up the polynomial values "d1^j1(1)", "d2^j1 (1)", "d3^j1 (1)", "d4^j1 (1)" and "d5^j1 ( 1)", the shared unit "Sd1" will be obtained (ie: "Sd1 = d1^j1 (1) + d2^j1 (1) + d3^j1 (1) + d4^j1 (1) + d5^j1 (1) )”), the party whose index value is “2” sums up the polynomial values “d1^j2(2)”, “d2^j2 (2)”, “d3^j2 (2)”, “d4^j2 (2) "" and "d5^j2 (2)" will get the shared unit "Sd2" (ie: "Sd2 = d1^j2 (2) + d2^j2 (2) + d3^j2 (2) + d4^j2 (2 ) + d5^j2 (2)”), and so on, each party gets the corresponding shared unit. In actual implementation, each party needs to exchange their own hierarchical value "j" and the X coordinate of the shared unit in order to calculate the Berkhof coefficient for subsequent use in calculating the signature.

As shown in "Figure 4", "Figure 4" is a schematic diagram of resetting the shared unit by applying the present invention. When the terminal device 110 wants to reset the shared unit, it sends a reset request to the exchange host 140, causes the exchange host 140 to generate a third identification code and sends it back to the terminal device 110, and causes the exchange host 140 to send a third identification code containing this The reset request of the three identification code is sent to the wallet service host 130, and the wallet service host 130 transmits the reset request containing the third identification code to the reset service host 120. After all the four parties have obtained the third identification code, a secure point-to-point connection can be established, and at least one polynomial can be selected for each. The polynomial will vary with the number of shared units to be replaced. Take HSS as an example, suppose there are a total of n shared units, t is the threshold and "ji" is the level value corresponding to the i-th shared unit, where 1>=i>=n, if you want to maintain k shared units Change, where n, t, k and ji are all positive integers. Assuming that the k shared units that remain unchanged are 1,...,k and tk>2, then the polynomial can be set to "x*f(x)", where f(x) is the power of t-2 Polynomial. According to the restriction condition "f^ji(i)=0, 0>i>k+1", linear algebra can be used to solve the coefficient restriction condition of f. For example, suppose there are five shared units and the threshold value is 5. To maintain the constant index values of two of the shared units 1, 2, and the corresponding level values of 2, 1, the polynomial can be "x *f(x)" and meet the restriction conditions "f^2(1)=0" and "f^1(2)=0", f(x)=a3x^3+a2x^2+a1x+ The coefficient of a0 must satisfy: "a1=0", "a2=-3*a3" and "a0" and "a3" can be arbitrary numbers. In actual implementation, the polynomials selected by the four parties can be as shown in "Figure 4" as shown in "g1" to "g5". Then, each party takes a different index value (for example: value 1 to value 5) and the corresponding level value (for example: value j1 to value j5) into the polynomial of their choice for calculation. For example, the terminal device 110 will take the value 1 to the value 5 into the polynomial "g1" to calculate 5 calculation results (ie: "g1^j1(1)", "g1^j2(2)", "g1^ j3(3)", "g1^j4(4)" and "g1^5(5)"), resetting the service host 120 will bring the values 1 to 5 into the polynomial "g2" to calculate 5 calculation results ( Namely: "g2^j1(1)", "g2^j2(2)", "g2^j3(3)", "g2^j4(4)" and "g2^j5(5)"), and will Values 1 to 5 are brought into the polynomial "g3" to calculate 5 calculation results (ie: "g3^j1(1)", "g3^j2(2)", "g3^j3(3)", "g3^ j4(4)” and “g3^j5(5)”), and so on, the exchange host 140 will take the value 1 to 5 into the polynomial “g5” to calculate 5 calculation results (ie: “g5^ j1(1)", "g5^j2(2)", "g5^j3(3)", "g5^j4(4)" and "g5^j5(5)"), a total of 25 calculations can be calculated As a result, the four parties exchange messages with each other, that is, each of the four parties will bring in the calculation result of the value 1 (ie: "g1^j1(1)", "g2^j1(1)", "g3^j1 (1)", "g4^j1(1)" and "g5^j(1)"), which are provided to the terminal device 110 to sum to obtain the corresponding polynomial value sum, namely: "Sg1" (the calculation formula is " Sg1=g1^j1(1)+g2^j1(1)+g3^j1(1)+g4^j1(1)+g5^j1(1)”), will bring in the calculation results of the value 2 and the value 3 (Ie: "g1^j2(2)", "g2^j2(2)", "g3^j2(2)", "g4^j2(2)" and "g5^j2(2)"; g1^ j3(3)", "g2^j3(3)", "g3^j3(3)", "g4^j3(3)" and "g5^j3(3)"), provided to the reset service host 120 Sum to get the corresponding polynomial value, namely: "Sg2" and "Sg3" (the calculation formulas are "Sg2=g1^j2(2)+g2^j2(2)+g3^j2(2)+g4" ^j2(2)+g5^j2(2)'' and "Sg3=g1^j3(3)+g2^j3(3)+g3^j3(3)+g4^j3(3)+g5^j3(3 )”), and so on, will bring in the calculation result of the value 5 (ie: "g1^j5(5)", "g2^j5(5)", "g3^j5(5)", "g4^ j5(5)" and "g5^j5(5) ”), which is provided to the exchange host 140 for the summation to obtain the corresponding polynomial value summation, namely: "Sg5" (the calculation formula is "Sg5=g1^j5(5)+g2^j5(5)+g3^j5( 5)+g4^j5(5)+g5^j5(5)”), so that after MPC calculation and exchange of messages by each party, as shown in "Figure 4", each party obtains the sum of the corresponding polynomial values (terminal device 110 obtains the polynomial value addition "Sg1", resets the service host 120 to obtain the polynomial value addition "Sg2" and "Sg3", and so on, the exchange host 140 obtains the polynomial value addition "Sg5"). Next, replace the original shared unit with the sum of the original shared unit and the polynomial value as the new shared unit. Taking the terminal device 110 as an example, the new shared unit "NSd1" is equal to the original shared unit "Sd1" and the polynomial value Add the sum of "Sg1" (ie: NSd1=Sd1+Sg1). In this way, the values of the corresponding two new shared units "NSd1" and "NSd2" will remain unchanged. In particular, for these five new shared units (ie: "NSd1" to "NSd5"), if the Burkhof interpolation method is used, the polynomial 400 "137x^" as shown in "Figure 4" can be calculated. 4-249x^3+54x^2+141x+56", where the solution calculated by bringing the value 0 into x is still the value 56. This value and the shared unit of "Figure 3" use Berkhof interpolation The polynomial generated by the method also brings the value 0 into x. The calculation result is the same (that is: the shared unit generated by TSS can also be used to calculate the polynomial with the same constant term by the Burkhof interpolation method, because the Burkhof interpolation method is In a more general way, when all levels are 0, Burkhoff interpolation is equivalent to Lagrangian interpolation), in other words, even if it has been replaced with a new shared unit, the calculation result of the signature is still maintained No change, equivalent to using the same private key for signing.

In summary, it can be seen that the difference between the present invention and the prior art is that by providing terminal devices, resetting service hosts, wallet service hosts, and exchange hosts, executing secret sharing algorithms to generate shared units for execution during transactions The secure multi-party operation calculates the signature to complete the transaction signing, and allows the shared unit to be reset. On the premise that the same private key can be used before and after the reset, a new shared unit is regenerated to replace the original shared unit. A technical method can solve the problems of the prior art, and then achieve the technical effect of improving the security of the electronic wallet.

Although the present invention is disclosed in the foregoing embodiments as above, it is not intended to limit the present invention. Anyone familiar with similar art can make some changes and modifications without departing from the spirit and scope of the present invention. Therefore, the present invention The scope of patent protection shall be determined by the scope of the patent application attached to this specification.

110: terminal device 120: Reset service host 130: Wallet service host 140: Exchange host 300, 400: polynomial Step 210: Provide a terminal device with a secure point-to-point connection function, a reset service host, a wallet service host, and an exchange host in the blockchain network, each serving as one of the nodes Step 220: Initially, the terminal device transmits an address generation request to the exchange host, so that the exchange host generates a first identification code and sends it back to the terminal device, and the exchange host transmits the first identification code containing the first The address generation request of the identification code is sent to the wallet service host, so that the wallet service host transmits the address generation request including the first identification code to the reset service host Step 230: After the terminal device, the reset service host, the wallet service host, and the exchange host all obtain the first identification code, they establish a secure point-to-point connection with each other, and execute the same secret sharing algorithm and exchange calculation As a result, it is used to generate corresponding N shared units, and multiply each shared unit with a base point and the corresponding interpolation coefficient and then add them together to generate a public key corresponding to the shared unit, where N is positive Integer Step 240: When the terminal device wants to perform a blockchain transaction, the terminal device transmits a transaction request to the exchange host, so that the exchange host generates a corresponding second identification code, and one of the transaction requests The data to be signed is encoded, and the generated second identification code and the encoded data to be signed are brought into the transaction request for transmission to the terminal device and the wallet service host Step 250: After the terminal device, the wallet service host, and the exchange host all obtain the second identification code and the encoded data to be signed, they establish a secure point-to-point connection with each other to perform secure multi-party operations to calculate A signature, and the signature is broadcast by the wallet service host to complete the signing of the data to be signed Step 260: When the terminal device wants to reset the sharing unit, the terminal device sends a reset request to the exchange host, so that the exchange host generates a third identification code and sends it back to the terminal device, and The exchange host transmits the reset request including the third identification code to the wallet service host, and the wallet service host transmits the reset request including the third identification code to the reset service host Step 270: After the terminal device, the reset service host, the wallet service host, and the exchange host all obtain the third identification code, they establish a secure point-to-point connection with each other, and perform a secure multi-party operation to reset the shared unit , To make the terminal device regenerate the new sharing unit to replace the original sharing unit in the terminal device

Figure 1 is a system block diagram of the wallet service system with multiple signatures of the present invention. Fig. 2A and Fig. 2B are the method flowcharts of the multi-signature wallet service method of the present invention. Figure 3 is a schematic diagram of applying the present invention to generate shared units. Figure 4 is a schematic diagram of resetting the shared unit by applying the present invention.

110: terminal device

120: Reset service host

130: Wallet service host

140: Exchange host

Claims (10)

A wallet service system with multiple signatures applied in a blockchain network composed of multiple nodes. The system includes: A terminal device, which is one of the nodes in the blockchain network, used to initially send an address generation request and receive a first identification code, when a blockchain transaction is desired , Send a transaction request and receive a second identification code and encoded data to be signed, and when resetting is desired, send a reset request and receive a third identification code; A reset service host, the reset service host being one of the nodes in the blockchain network, used to obtain the first identification code when the address generation request including the first identification code is received , And when the reset request containing the third identification code is received, the third identification code is obtained; A wallet service host, the wallet service host being one of the nodes in the blockchain network for obtaining the first identification code when the address generation request containing the first identification code is received, And send the address generation request containing the first identification code to the reset service host, and obtain the second identification code when the transaction request containing the second identification code and the encoded data to be signed is received And the encoded data to be signed, and when the reset request containing the third identification code is received, the third identification code is obtained, and the reset request containing the third identification code is sent to the reset Set up a service host; and An exchange host, the exchange host is one of the nodes in the blockchain network, used to generate the first identification code when receiving the address generation request from the terminal device and send it back to the Terminal device, and transmit the address generation request including the first identification code to the wallet service host, and when the transaction request is received from the terminal device, the second identification code is generated and the to-be-signed in the transaction request The data is encoded, and then the generated second identification code and the encoded data to be signed are brought into the transaction request to be transmitted to the terminal device and the wallet service host, and the data is received from the terminal device. When setting a request, generate the third identification code and send it back to the terminal device, and transmit the reset request containing the third identification code to the wallet service host; Wherein, after the terminal device, the reset service host, the wallet service host and the exchange host all obtain the first identification code, they establish a secure point-to-point connection with each other, and execute the same secret sharing algorithm and exchange calculation results , Used to respectively generate corresponding N shared units, and multiply each shared unit with a base point and corresponding interpolation coefficients and add them to each other to generate a public key corresponding to the shared unit, where N is a positive integer ； Wherein, after the terminal device, the wallet service host, and the exchange host all obtain the second identification code and the encoded data to be signed, they establish a secure point-to-point connection with each other to perform secure multi-party operations to calculate a Signature, and the wallet service host broadcasts the signature to complete the signing of the data to be signed; and Wherein, after the terminal device, the reset service host, the wallet service host, and the exchange host all obtain the third identification code, they establish a secure point-to-point connection with each other, and perform a secure multi-party operation to reset the shared unit, Make the terminal device regenerate the new sharing unit to replace the original sharing unit in the terminal device. According to the multi-signature wallet service system of item 1 of the scope of patent application, the wallet service host pre-stores a blacklist containing at least one first destination address. When the wallet service host receives a blockchain transaction and its When the destination address is among the first destination addresses, refuse to sign the blockchain transaction with the signature, or the wallet service host pre-stores a white list containing at least one second destination address, when the wallet When the service host receives the blockchain transaction and its destination address is among the second destination addresses, it is allowed to sign the blockchain transaction with the signature. According to the multi-signature wallet service system of the first item of the patent application, the wallet service host allows the exchange host to set a restriction condition to limit the amount of digital currency sent within at least a time range. The wallet service system with multiple signatures according to item 1 of the scope of patent application, in which the terminal device, the reset service host, the wallet service host and the exchange host all obtain the third identification code, allowing the exchange The host, the wallet service host, and the reset service host each regenerate a new shared unit to replace the original shared unit. According to item 1 of the scope of patent application, the multi-signature wallet service system, wherein the sharing unit is composed of the terminal device, the reset service host, the wallet service host and the exchange host respectively according to a preset one The shared quantity, a threshold value, an index value, and a level value generate a corresponding polynomial, and calculate multiple polynomial values that meet the shared quantity according to the polynomial of degree J and all index values, and perform safe multi-party operations The polynomial values calculated by each are exchanged, and corresponding sharing units with different levels are generated according to the exchange results, where J is the level value. A wallet service method with multiple signatures, applied in a blockchain network composed of multiple nodes, and its steps include: In the blockchain network, a terminal device with a secure point-to-point connection function, a reset service host, a wallet service host, and an exchange host are provided to serve as one of the nodes; Initially, the terminal device transmits an address generation request to the exchange host, so that the exchange host generates a first identification code and sends it back to the terminal device, and the exchange host transmits an address containing the first identification code The address generation request to the wallet service host, so that the wallet service host transmits the address generation request including the first identification code to the reset service host; After the terminal device, the reset service host, the wallet service host, and the exchange host all obtain the first identification code, they establish a secure point-to-point connection with each other, and execute the same secret sharing algorithm and exchange calculation results. To generate corresponding N shared units respectively, and multiply each shared unit with a base point and corresponding interpolation coefficient and then add them together to generate a public key corresponding to the shared unit, where N is a positive integer; When the terminal device wants to perform a blockchain transaction, the terminal device transmits a transaction request to the exchange host, so that the exchange host generates a corresponding second identification code, and a pending signature in the transaction request Data is encoded, and the generated second identification code and the encoded data to be signed are brought into the transaction request to be sent to the terminal device and the wallet service host; After the terminal device, the wallet service host, and the exchange host all obtain the second identification code and the encoded data to be signed, they establish a secure point-to-point connection with each other to perform secure multi-party operations to calculate a signature , And broadcast the signature by the wallet service host to complete the signature of the data to be signed; When the terminal device wants to reset the sharing unit, the terminal device sends a reset request to the exchange host, so that the exchange host generates a third identification code and sends it back to the terminal device, and makes the exchange host The host transmits the reset request including the third identification code to the wallet service host, and then the wallet service host transmits the reset request including the third identification code to the reset service host; and After the terminal device, the reset service host, the wallet service host, and the exchange host all obtain the third identification code, they establish a secure point-to-point connection with each other, and perform a secure multi-party operation for resetting the sharing unit, so that the The terminal device regenerates the new sharing unit to replace the original sharing unit in the terminal device. According to the multi-signature wallet service method of item 6 of the scope of patent application, the wallet service host pre-stores a blacklist containing at least one first destination address. When the wallet service host receives a blockchain transaction and its When the destination address is among the first destination addresses, refuse to sign the blockchain transaction with the signature, or the wallet service host pre-stores a white list containing at least one second destination address, when the wallet When the service host receives the blockchain transaction and its destination address is among the second destination addresses, it is allowed to sign the blockchain transaction with the signature. According to the multi-signature wallet service method according to item 6 of the scope of patent application, the wallet service host allows the exchange host to set a restriction condition to limit the amount of digital currency sent within at least a time range. According to item 6 of the scope of patent application, the wallet service method with multiple signatures, wherein the terminal device, the reset service host, the wallet service host, and the exchange host all obtain the third identification code, then the exchange is allowed The host, the wallet service host, and the reset service host each regenerate a new shared unit to replace the original shared unit. According to the multi-signature wallet service method according to item 6 of the scope of patent application, the steps of generating the sharing unit include: The terminal device, the reset service host, the wallet service host, and the exchange host respectively generate a corresponding polynomial according to a preset shared quantity, a threshold value, an index value, and a level value, and according to the differential J The polynomial of degree and all index values are calculated to meet the shared number of polynomial values, where J is the level value; and The terminal device, the reset service host, the wallet service host, and the exchange host perform secure multi-party operations to exchange the polynomial values calculated by each, and respectively generate corresponding and different levels of the polynomial values according to the exchange results Shared unit.

Images