TWI769738B - Asset cross-chain exchanging system based on threshold signature scheme and method thereof - Google Patents

Abstract

An asset cross-chain exchanging system based on threshold signature scheme and method thereof is disclosed. By performing a distributed key generation (DKG) function based on secure multi-party computation (MPC) through a first client and a second client, so as to generate temporary accounts on different blockchain networks, at the same time, let a fair end host, the first client and the second client have different levels of shares corresponding to each temporary account. When the first client and the second client want to exchange assets of different blockchain networks, first transfer the assets to be exchanged to the corresponding temporary account, and then execute a threshold signature scheme (TSS) according to the shares to obtain of control the corresponding temporary account for completing cross-chain asset exchange. The mechanism is help to improve the high availability of cross-chain asset exchange.

Description

Asset cross-chain exchange system and method based on threshold signature

The present invention relates to a system and method for exchanging assets across blockchains, in particular to a system and method for asset cross-chain exchanging based on threshold signatures.

In recent years, with the popularization and vigorous development of blockchain, various digital currencies based on blockchain technology have sprung up, such as Bitcoin, Ethereum and so on.

Generally speaking, different digital currencies cannot be directly traded, exchanged, transferred, etc. because they are based on different blockchains, and the traditional way is through exchanges or pre-agreed ways. However, through the exchange, it requires extra handling fees, and the operation is cumbersome and inconvenient; through the pre-agreed method, there is the possibility of default or fraud. Therefore, the traditional method has the problems of inconvenient asset exchange and poor security.

In view of this, some manufacturers have proposed a technical means of cross-chain exchange of assets. Through the Notary Schemes, when the two parties cannot trust each other, a relatively fair and independent third party or a group of third parties that are mutually trusted by both parties acts as the Notaries to verify and ensure the legitimacy of transactions. However, this approach will result in assets being illegally traded if the notary is not impartial enough to collude with one of the parties. Therefore, the availability of cross-chain exchange assets is greatly limited, so there is a problem of poor availability of cross-chain exchange assets.

To sum up, it can be seen that there has been a problem of poor availability of cross-chain exchange assets in the prior art for a long time, so it is necessary to propose improved technical means to solve this problem.

The invention discloses an asset cross-chain exchange system and method based on a threshold signature.

First, the present invention discloses an asset cross-chain exchange system based on a threshold signature, which includes: a fair end host, a first client host and a second client host. The fair-end host is used to receive the first fragment, another first fragment, a second fragment and another second fragment, and form a low level according to the first fragment and the other first fragment The first new shared unit, and a low-level second new shared unit is formed according to the second fragment and the other second fragment; the first client host is used to connect with the fair end host, and in the first The first account of the blockchain network has first assets, and the first client host includes: a first confirmation module, a first execution module and a first transaction module. Wherein, the first confirmation module is used for confirming the owner of the second account of the second blockchain network with the fair end host when the first asset and the second asset are to be exchanged, and inquiring whether the second account has the first The ownership of the second asset; the first execution module is connected to the first confirmation module to execute the distributed key generation function by Secure Multi-Party Computation (MPC) after the confirmation and query are correct A blockchain network generates a first temporary account and its corresponding first sharing unit with different levels, and generates a first shard of a first new sharing unit corresponding to the first sharing unit and having a lower level and a first share with the first sharing unit. The second shard of the second new shared unit corresponding to the two shared units and at a lower level is sent to the fair-end host; the first transaction module is connected to the first execution module, and is used for generating a first temporary account after the Blockchain transactions will be the first An asset is transferred to the first escrow account. Next, in the part of the second client host, which is interconnected with the impartial host, and has a second asset in the second account of the second blockchain network, the second client host includes: a second confirmation module group, a second execution module and a second transaction module. Wherein, the second confirmation module is used for confirming the owner of the first account of the first blockchain with the fair end host when the first asset and the second asset are to be traded, and inquiring whether the first account has the first asset Ownership; the second execution module is connected to the second confirmation module to execute the distributed key generation function through secure multi-party computation to generate a second temporary account in the second blockchain network after the confirmation and query are correct and its corresponding second shared unit with a different level, and another second slice that generates a second new shared unit corresponding to the second shared unit and with a lower level and a second shared unit corresponding to the first shared unit and with a lower level Another first shard of the first new shared unit of the level is sent to the fair end host; the second transaction module is connected to the second execution module, and is used for blockchain transactions after the second temporary account is generated Transfer the second asset to the second escrow account. The first client host stores the low-level first shared unit and the high-level second shared unit, the second client host stores the high-level first shared unit and the low-level second shared unit, and allows the first The client host and the second client host choose to execute the threshold signature together with the fair end host to control the first asset of the first temporary account according to the first sharing unit and the first new sharing unit respectively, and according to the second sharing unit The unit and the second new share unit control the second asset of the second escrow account.

In addition, the present invention also discloses a cross-chain asset exchange method based on threshold signature, the steps of which include: a first client host has a first asset in a first account of a first blockchain network, and a second client host The second account in the second blockchain network has second assets, and the fair end host is connected to the first client host and the second client host; when the first client host and the second client host want to communicate with each other When exchanging the first asset and the second asset, the first client host and the second client host jointly confirm to the fair end host whether the owners of the first account and the second account are the first client host respectively and the second client host, and inquire whether the first account and the second account have the ownership of the first asset and the second asset; after the first client host and the second client host have confirmed and inquired that there is no error, the secure multi-party computing Execute a distributed key generation function to generate a first temporary account and its corresponding first shared units with different levels in the first blockchain network, and generate a second blockchain network in the second blockchain network. The temporary account and its corresponding second shared units with different levels, wherein the first client host stores the low-level first shared unit and the high-level second shared unit, and the second client host stores the high-level first shared unit. A shared unit and a low-level second shared unit; the first client host transfers the first asset to the first temporary account in a blockchain transaction, and the second client host transfers the second asset in a blockchain transaction Send to the second temporary account; the first client host and the second client host execute the distributed key generation function through secure multi-party computation, so as to respectively generate the first slice and the other corresponding to the first shared unit a first fragment, and respectively generating a second fragment and another second fragment corresponding to the second sharing unit, wherein the first client host transmits the generated first fragment and the second fragment to the fair end The host, the second client host transmits the generated another first fragment and another second fragment to the fair end host; the fair end host forms a low-level according to the received first fragment and another first fragment The first new shared unit, and the second new shared unit of lower level is formed according to the received second fragment and another second fragment; and the first client host and the second client host allow selection and fairness The host also executes the threshold signature to control the first asset of the first temporary storage account according to the first sharing unit and the first new sharing unit respectively, and control the second temporary storage account according to the second sharing unit and the second new sharing unit the second asset.

The system and method disclosed in the present invention are as above, and the difference from the prior art lies in that the present invention executes the distributed key generation function through secure multi-party computation through the first client host and the second client host, so that in different blocks The link network generates a temporary account, and at the same time, the fair end host, the first client host and the second client host have different levels of sharing units corresponding to each temporary account. When a client host and a second client host want to exchange assets in different blockchain networks, first transfer the assets to be exchanged to the corresponding temporary accounts, and then execute threshold signatures according to the shared units held to obtain Control the corresponding temporary account, and then complete the cross-chain exchange of assets.

Through the above technical means, the present invention can achieve the technical effect of improving the high availability of cross-chain exchange assets.

101: The first blockchain network

102: Second Blockchain Network

100: fair end host

110: First client host

111: The first confirmation module

112: The first execution module

113: The first transaction module

120: Second client host

121: Second confirmation module

122: The second execution module

123: Second Transaction Module

311, 312: First degree polynomial

401: First Account

402: Second Account

411: First staging account

412: Second staging account

421, 422: First Shared Unit

431, 432: Second Shared Unit

423: First new shared unit

433: Second new shared unit

441: first shard

442: Second shard

451: Another first shard

452: Another second shard

Step 210: Provide a first client host, the first client host has a first asset in a first account of a first blockchain network, and provide a second client host, the second client The host has a second asset in a second account of a second blockchain network, and provides a fair end host interconnected with the first client host and the second client host

Step 220: When the first client host and the second client host want to exchange the first asset and the second asset with each other, jointly confirm the owner of the first account and the second account to the fair host Whether it is the first client host and the second client host respectively, and query whether the first account and the second account have the ownership of the first asset and the second asset

Step 230: The first client host and the second client host execute a distributed key generation function using Secure Multi-Party Computation (MPC) after the confirmation and query are correct, so as to The first blockchain network generates a first temporary account account and its corresponding multiple first sharing units with different levels, and generate a second temporary account and its corresponding multiple second sharing units with different levels in the second blockchain network, wherein, The first client host stores the first shared unit of a low level and the second shared unit of a high level, and the second client host stores the first shared unit of a high level and the first shared unit of a low level Two shared units

Step 240: The first client host transfers the first asset to the first temporary account, and the second client host transfers the second asset to the second temporary account

Step 250: The first client host and the second client host execute the distributed key generation function through secure multi-party computation, so as to respectively generate a first segment and another corresponding to the first sharing unit. a first fragment, and respectively generating a second fragment and another second fragment corresponding to the second sharing unit, wherein the first client host will generate the first fragment and the first fragment The two fragments are sent to the fair host, and the second client host sends the generated another first fragment and the other second fragment to the fair host

Step 260: The fair end combines the received first fragment and the other first fragment into a low-level first new sharing unit, and according to the received second fragment and the other first fragment The two shards are combined into a low-level one-second new shared unit

Step 270: The first client host and the second client host are allowed to choose to execute threshold signatures together with the fair end host to generate a first sharing unit according to the first sharing unit and the first new sharing unit, respectively signing a message to transfer the first asset of the first temporary account, and generating a second signature message according to the second sharing unit and the second new sharing unit to transfer the second asset of the second temporary account assets

Step 280 : The first client host and the second client host choose to execute a Gradual Exchange Protocol to enable the first client host and the second client host to exchange their respective low levels with each other the first shared unit and the second shared unit of the the second staging account, and enabling the second client host to allow control of the first staging account signature according to the first sharing unit at a high level and the first sharing unit at a lower level

Step 281: Make the first client host and the second client host randomly select a value of r _A,i and a value of r _B,i , and both are in the interval of [0,P-1], where A represents the first client host, B represents the second client host, P is the number of elliptic curve groups, and i is a positive integer

Step 282: Split a ciphertext x of the first client host and a ciphertext y of the second client host into k equal parts to generate multiple x _i values and multiple y _i values, the x The value of _i satisfies the ciphertext x=sum _i 2 ³²ⁱ x _i , the value of y _i satisfies the ciphertext y=sum _i 2 ³²ⁱ y _i , where k=P/32, i is a positive integer and satisfies 1<=i <=k, 0<=x _i <2 ³² and 0<=y _i <2 ³²

Step 283: The first client host calculates a D _i value and an E _i value, the D _i value is {x _i G+r _{A, i} M}, the E _i value is {r _{A, i} G}, Among them, G is the base point of the elliptic curve group, M is the public key of the first client host, the second client host calculates a V _i value and a Wi value _{, the V i value is {y i G +} r _{B, i} N}, the value of W _i is {r _{B, i} G}, where N is the public key of the second client host

Step 284: The first client host and the second client host exchange the D _i value and the V _i value calculated respectively with each other _, and then sequentially exchange the E _i value and the Wi value until until the sequential exchange is stopped

Figure 1 is a system block diagram of the cross-chain asset exchange system based on threshold signatures of the present invention.

Figures 2A to 2D are flowcharts of the method of the cross-chain asset exchange method based on the threshold signature of the present invention.

FIG. 3 is a schematic diagram of generating a shared unit by applying the present invention.

Figures 4A and 4B are schematic diagrams of cross-chain asset exchange by applying the present invention.

The embodiments of the present invention will be described in detail below in conjunction with the drawings and examples, so as to fully understand and implement the implementation process of how the present invention applies technical means to solve technical problems and achieve technical effects.

First, before describing the threshold-based signature-based asset cross-chain exchange system and method disclosed in the present invention, the application environment of the present invention is described first. The present invention is applied to an environment with different blockchain networks at the same time. For example: Bitcoin Blockchain Network and Ethereum Blockchain Network, each of these blockchain networks Nodes can perform secure multi-party computations to exchange data and computation results with each other, and then perform threshold signatures. Next, for the self-defined terms of the present invention, the sharing unit (Share) of the present invention refers to the different nodes (such as the first client host and the second client host) when performing secure multi-party computation. The element generated by the mutual exchange of data and calculation results, this element can directly calculate the elliptic curve digital signature algorithm (Elliptic Curve Digital Signature Algorithm, ECDSA) without reorganizing the private key. Signatures (or "signatures") in the signature format, such as: "First Shared Unit", "Second Shared Unit", "First New Shared Unit" and "Second New Shared Unit", etc. The only difference is that the corresponding staging account or holder is different. Wherein, the first sharing unit and the first new sharing unit correspond to the first temporary account; the second sharing unit and the second new sharing unit correspond to the second temporary account; the holding of the first new sharing unit and the second new sharing unit The one is the fair end host, and the first client host and the second client host both hold the first shared unit and the second shared unit of different levels. In addition, the shards (eg: a first shard, a second shard, another first shard, and another second shard) refer to shards into which data is divided by sharding technology , so that each shard is processed independently by different hosts, and the final result is composed according to the processing result. For example, a first slice and another first slice can form a first new shared unit; a second slice and another second slice can form a second new shared unit.

The following is a further description of the cross-chain asset exchange system and method based on threshold-type signatures of the present invention in conjunction with the drawings. Please refer to "Figure 1" first. "Figure 1" is the cross-chain assets based on threshold-type signatures of the present invention. The system block diagram of the switching system includes: the fair end host 100 , the first client host 110 and the second client host 120 . The fair-end host 100 is used to receive the first fragment, another first fragment, a second fragment, and another second fragment, and form a low-level fragment according to the first fragment and the other first fragment A first new shared unit, and a low-level Second new shared unit. In practice, the low-level first new sharing unit corresponds to the first temporary storage account and its first sharing unit; the low-level second new sharing unit corresponds to the second temporary storage account and its second sharing unit corresponding. In fact, both the first new shared unit and the second new shared unit are generated by executing the newly added shared unit, when the first client host 110 and the second client host 120 execute the distributed key generation function , at the same time, the X coordinate and the level value of the fair-end host 100 are brought into the calculation to generate corresponding fragments, and then the fair-end host 100 forms the fragments into a new shared unit. For example, suppose the first client host 110 (referred to as the "A") has a high-level shared unit with a value of "24", an X coordinate of a value of "3" and a level value of "0"; the second client host 120 (abbreviated as "B") has a low-level The shared unit of the level, whose value is the value "5", the X coordinate is the value "4" and the level value is the value "1". A and B perform secure multi-party computation, and generate new shared units (ie: the first new shared unit and the second new shared unit) to the fair-end host 100 (referred to as "AMIS") without revealing the private key. The steps are as follows :

1. AMIS generates X coordinate and level value, such as: X coordinate is the value "7", level value is "1", and sends it to A and B respectively.

2. When A receives the X coordinate and level value of AMIS, it calculates 0*24 if it is correct. Likewise, B also calculates 1*5. Among them, the value of 24 is the value calculated when the polynomial is "f(x)=5x+9", and the X-coordinate is added to it; the value of 5 is "f'(x)=5". In particular, a level value of 0 means that the polynomial does not need to be differentiated; a level value of 1 means the first-order differential of the polynomial; a level value of 2 means the second-order differential of the polynomial, and so on.

3. A randomly selects a number a in [0,P-1], where P is the number of elliptic curves, then a _b =a and a _amis =-a satisfy a _b +a _amis =0. Likewise, B also randomly chooses the number b in the aforementioned manner such that b _a + b _amis =5, and b _a =b and b _amis =5-b.

4. A sends a _b to B, and B sends b _a to A. Next, A calculates s _A =b _a +a _amis =b+a. As for B, calculate s _B =a _b +b _amis =-a+5-b. At this point, A will transmit s _A to AMIS; B will transmit s _B to AMIS.

5. AMIS sets its new shared unit "s _amis " to "s _A +s _B =b+a+(-a)+5-b=5" according to the received s _A and s _B .

The first client host 110 is used for interconnecting with the fair end host 100, and has a first asset in the first account of the first blockchain network 101. The first client host 110 includes: a first confirmation module 111 , the first execution module 112 and the first transaction module 113 . Wherein, the first confirmation module 111 is used to confirm the owner of the second account of the second blockchain network 102 with the fair-end host 100 when the first asset and the second asset are to be exchanged, and to check whether the second account is It has the ownership of the second asset, and its confirmation method is to confirm and query according to the account address. In actual implementation, the first asset refers to digital assets in the first blockchain network 101, such as bitcoin, ether, tokenized goods or services, etc., assuming that the first area The blockchain network 101 is the Ethereum blockchain network, and tokenization refers to the tokens issued based on the ERC (Ethereum Request for Comment) protocol, such as ERC-20, ERC-721, etc.

The first execution module 112 is connected to the first confirmation module 111 to execute the distributed key generation function by means of secure multi-party computation after the confirmation and query are correct, so as to generate the first temporary key in the first blockchain network 101 . deposit account and its corresponding first shared units with different levels, such as: high-level first shared units and low-level first shared units, and generate a first new shared unit corresponding to the first shared unit and low-level The first segment of the shared unit and the second segment of the second new shared unit corresponding to the second shared unit and of a lower level are transmitted to the impartial host 100 . In fact, these shared units (ie: the The purpose of a shared unit, a first new shared unit) is to obtain the control right of the first temporary account when the threshold of the threshold-type signature is met.

The first transaction module 113 is connected to the first execution module 112, and is used for transferring the first asset to the first temporary account by means of a blockchain transaction after the first temporary account is generated. For example, assuming that the first asset is 10 bitcoins, the first transaction module 113 will transfer 10 bitcoins from the first account to the first temporary account. In practice, the first temporary account is the address of the blockchain converted from the public key generated by executing the distributed key generation function, and the first asset and the first temporary account are located in the same blockchain network. Road (ie: the first blockchain network 101).

Next, in the part of the second client host 120, which is used to interconnect with the fair host 100, and the second account in the second blockchain network 102 has a second asset, the second client host 120 It includes: a second confirmation module 121 , a second execution module 122 and a second transaction module 123 . Wherein, the second confirmation module 121 is used to confirm the owner of the first account of the first blockchain network 101 with the fair end host 100 when the first asset and the second asset are to be exchanged, and to check whether the first account is Has ownership of the first asset. In actual implementation, the confirmation and query methods are the same as the first confirmation module 111 of the first client host 110 . In addition, the second asset refers to the digital asset in the second blockchain network 102, and the difference from the first asset is that the two are located in different blockchain networks. For example, suppose the first asset is Bitcoin, the second asset may be Ether.

The second execution module 122 is connected to the second confirmation module 121 for executing the distributed key generation function by means of secure multi-party computation after the confirmation and query are correct, so as to generate the second block chain network 102 A staging account and its corresponding second share unit with a different rank, and another second shard that generates a second new share unit corresponding to the second share unit and with a lower rank and a second share unit corresponding to the first share unit and with a lower rank The other first fragment of the first new shared unit is sent to the impartial host 100 . In fact, The purpose of generating these shared units (ie: the second shared unit, the second new shared unit) is to obtain the control right of the second temporary account when the threshold of the threshold-type signature is satisfied.

The second transaction module 123 is connected to the second execution module 122, and is used for transferring the second asset to the second temporary account by means of a blockchain transaction after the second temporary account is generated. For example, assuming that the second asset is 50 ETH, the second transaction module 123 will transfer 50 ETH from the second account to the second temporary account. In practice, the second temporary storage account is the address of the blockchain converted according to the public key generated by executing the distributed key generation function, and the second asset and the second temporary storage account are located in the same blockchain network road (ie: the second blockchain network 102).

The first client host 110 stores the low-level first shared unit and the high-level second shared unit, the second client host 120 stores the high-level first shared unit and the low-level second shared unit, and the third A client host 110 and a second client host 120 are allowed to choose to perform threshold signing together with the fair end host 100 to control the first of the first temporary account according to the first sharing unit and the first new sharing unit, respectively assets, and control the second assets of the second escrow account according to the second sharing unit and the second new sharing unit. In addition, in actual implementation, the first client host 110 and the second client host 120 may choose to execute the Gradual Exchange Protocol to enable the first client host 110 and the second client host 120 to exchange their respective There are low-level first shared units and second shared units, and after the exchange is completed, the first client host 110 is allowed to control the second temporary storage according to the high-level second shared units and the low-level second shared units. account, and enabling the second client host 120 to allow control of the first staging account according to the high-level first sharing unit and the low-level first sharing unit. Specifically, the step-by-step exchange agreement consists of the following steps:

1. Let the first client host 110 and the second client host 120 randomly select r _{A, i} and r _{B, i} values respectively, and both are in the interval of [0, P-1], where A represents the first The client host 110, B represents the second client host 120, P is the number of elliptic curve groups (for example: 256), and i is a positive integer.

2. Split the ciphertext x of the first client host 110 and the ciphertext y of the second client host 120 into k (ie: k=P/32, in this example P=256, so k=8), etc. to generate multiple x _i values and multiple y _i values, the x _i values satisfy the ciphertext x=sum _i 2 ³²ⁱ x _i , and the y _i values satisfy the ciphertext y=sum _i 2 ³²ⁱ y _i , where , k=P/32, i is a positive integer satisfying 1<=i<=k, 0<=x _i <2 ³² and 0<=y _i <2 ³² .

3. The first client host 110 calculates the value of D _i and the value of E _i , where the value of D _i is {x _i G+r _{A, i} M}, and the value of E _i is {r _{A, i} G}, where G is the base point of the elliptic curve group, M is the public key of the first client host, the second client host 120 calculates the V _i value and the Wi value, and the V _i value is {y _i G+r _{B, i N} } , the Wi value is {r _{B, i G} }, where N is the public key of the second client host 120 .

4. The first client host 110 and the second client host 120 exchange the D _i value and the V _i value calculated respectively with each other, and then exchange the E _i value and the Wi value in sequence until the sequential exchange is stopped _. .

It should be noted that, in practice, the modules described in the present invention can be implemented in various ways, including software, hardware, or any combination thereof. For example, in some embodiments, each module can be implemented by using Software and hardware or one of them can be implemented. In addition, the present invention can also be implemented partially or completely based on hardware. For example, one or more modules in the system can be implemented through integrated circuit chips, system Single chip (System on Chip, SoC), Complex Programmable Logic Device (Complex Programmable Logic Device, CPLD), Field Programmable Gate Array (Field Programmable Gate Array, FPGA) etc. The present invention may be a system, method and/or computer program. The computer program may include a computer-readable storage medium on which computer-readable program instructions for causing a processor to implement various aspects of the present invention are loaded, and the computer-readable storage medium may be one that can hold and store instructions for use by the instruction execution device. Tangible device for instruction. Computer-readable storage media can be, but are not limited to, electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of computer-readable storage media include: hard disks, random access memory, read-only memory, flash memory, optical disks, floppy disks, and any suitable combination of the foregoing. Computer-readable storage media, as used herein, are not to be construed as transient signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (eg, optical signals through fiber optic cables), or through electrical wires. transmitted electrical signals. Additionally, the computer-readable program instructions described herein may be downloaded from computer-readable storage media to various computing/processing devices, or downloaded over a network such as the Internet, local area network, wide area network, and/or wireless network to an external computer device or external storage device. Networks may include copper transmission cables, fiber optic transmissions, wireless transmissions, routers, firewalls, switches, hubs and/or gateways. The network card or network interface in each computing/processing device receives computer-readable program instructions from the network and forwards the computer-readable program instructions for storage on the computer-readable storage medium in each computing/processing device middle. The computer program instructions that perform the operations of the present invention may be assembled language instructions, instruction set architecture instructions, machine instructions, machine dependent instructions, microinstructions, firmware instructions, or source or object code written in any combination of one or more programming languages (Object Code), the programming language includes object-oriented programming languages, such as: Common Lisp, Python, C++, Objective-C, Smalltalk, Delphi, Java, Swift, C#, Perl, Ruby and PHP, etc., as well as conventional programs Procedural programming language, such as: C language or similar programming language. The computer program instructions may execute entirely on the computer, partly on the computer, as a stand-alone software, partly on the client computer and partly on the remote computer, or entirely on the remote computer or server execute on.

Please refer to "Fig. 2A" to "Fig. 2D", "Fig. 2A" to "Fig. 2D" are the method flowcharts of the cross-chain asset exchange method based on the threshold signature of the present invention. The steps include: providing the first A client host 110, the first client host 110 has the first asset in the first account of the first blockchain network 101, and provides the second client host 120, the second client host 120 is in the second area The second account of the blockchain network 102 has the second asset, and provides the fair end host 100 interconnected with the first client host 110 and the second client host 120 (step 210); when the first client host 110 and When the second client host 120 wants to exchange the first asset and the second asset with each other, it jointly confirms with the fair end host 100 whether the owners of the first account and the second account are the first client host 110 and the second client host, respectively. 120, and query whether the first account and the second account have the ownership of the first asset and the second asset (step 220); Calculating and executing a distributed key generation function to generate a first temporary account and its corresponding first sharing unit with different levels in the first blockchain network 101 , and in the second blockchain network 102 Generate a second temporary account and its corresponding second shared units with different levels, wherein the first client host 110 stores the low-level first shared unit and the high-level second shared unit, and the second client host 120 Store the high-level first shared unit and the low-level second shared unit (step 230 ); the first client host 110 transfers the first asset to the first temporary account in a blockchain transaction, and the second client host 120 transmits the second asset to the second temporary account by means of a blockchain transaction (step 240); the first client host 110 and the second client host 120 execute the distributed key generation function by means of secure multi-party computation, using to respectively generate a first fragment and another first fragment corresponding to the first sharing unit, and respectively generate a second fragment and another second fragment corresponding to the second sharing unit, wherein the first client The host 110 transmits the generated first fragment and the second fragment to the fair host 100 , and the second client host 120 transmits the generated another first fragment and another second fragment to the fair host 100 (step 250); The fair-end host 100 forms a first new sharing unit according to the received first fragment and another first fragment, and forms a second new sharing unit according to the received second fragment and another second fragment (step 260); the first client host 110 and the second client host 120 are allowed to choose to execute the threshold signature together with the fair end host 100 to control the first temporary account according to the first sharing unit and the first new sharing unit, respectively. A first asset, and a second asset that controls the second escrow account according to the second sharing unit and the second new sharing unit (step 270). Through the above steps, the distributed key generation function can be executed by the first client host 110 and the second client host 120 through secure multi-party computation, so as to generate temporary accounts in different blockchain networks, and at the same time make fair The end host 100, the first client host 110 and the second client host 120 have different levels of sharing units corresponding to each temporary account. When the first client host 110 and the second client host 120 want to exchange different blocks When linking the assets of the network, first transfer the assets to be exchanged to the corresponding temporary account, and then execute the threshold signature according to the shared unit held to obtain the control right of the corresponding temporary account, and then complete the cross-chain exchange of assets.

In addition, after step 270, the first client host 110 and the second client host 120 may optionally execute a Gradual Exchange Protocol to enable the first client host 110 and the second client host 120 to exchange their respective There are low-level first shared units and second shared units, and after the exchange is completed, the first client host 110 is allowed to control the second temporary storage according to the high-level second shared units and the low-level second shared units. account, and enabling the second client host 120 to allow control of the first staging account according to the high-level first sharing unit and the low-level first sharing unit (step 280). In other words, the first client host 110 or the second client host 120 can directly perform threshold signing according to the high-level first shared unit originally held by itself and the low-level first shared unit obtained after the exchange Chapter operations, without the need to cooperate with other parties' hosts, you can return the assets to your own account. In practical implementation, the step-by-step exchange protocol is shown in Figure 2D, which includes: causing the first client host 110 and the second client host 120 to randomly select the r _A,i and r _B,i values, respectively, and are in the interval [0, P-1], wherein A represents the first client host 110, B represents the second client host 120, P is the number of elliptic curve groups, and i is a positive integer (step 281) ; Split the ciphertext x of the first client host 110 and the ciphertext y of the second client host 120 into k equal parts (ie: k=P/32, assuming P=256, then k=8) to generate Multiple x _i values and multiple y _i values, the x _i values satisfy the ciphertext x=sum _i 2 ³²ⁱ x _i , and the y _i values satisfy the ciphertext y=sum _i 2 ³²ⁱ y _i , where k= P/32, i is a positive integer satisfying 0<=i<=k, 0<=x _i <2 ³² and 0<=y _i <2 ³² (step 282); the first client host 110 calculates the value of D _i and The value of E _i , the value of D _i is {x _i G+r _{A, i} M}, and the value of E _i is {r _{A, i} G}, where G is the base point of the elliptic curve group, and M is the first client The public key of the host 110, the second client host 120 calculates the V _i value and the Wi value, the V _i value is {y _i G+r _{B, i N} }, and the Wi value is {r _{B, i} G}, where N is the public key of the second client host 120 (step 283 ); the first client host 110 and the second client host 120 exchange their calculated values of D _i and V _i with each other, and then The E _i value and the Wi value are sequentially exchanged until the sequential exchange is stopped ₍ step 284 ). In this way, the ciphertext of the other party (ie, the ciphertext x and the ciphertext y) can be calculated according to the mutually exchanged values, thereby realizing the purpose of exchanging low-level shared units.

The following description will be given in the form of an embodiment in conjunction with "FIG. 3" to "FIG. 4B", please refer to "FIG. 3", "FIG. 3" is a schematic diagram of applying the present invention to generate a shared unit. When the distributed key generation function is executed to generate the shared unit, the first client host 110 (hereinafter referred to as "A") and the second client host 120 (hereinafter referred to as "B") will have their own X-coordinates. Such as: 3 and 4, and select the level value according to its own level, for example: the level value selected by the high level is the value 0; the level value selected by the low level is the value 1. Assuming that A is a high level and B is a low level, the two randomly select a first-order polynomial (311, 312), such as: "f(x)=3*x+5" and "g(x)=10*x+ 19". Then, based on the secure multi-party calculation, A will calculate "f(3)=14" and "f'(4)=3" according to the X-coordinate and level value of each party, Among them, since the level value of B is a value of 1, it means that the first-order polynomial of the X coordinate of B needs to be differentiated first and then brought into the calculation. Similarly, B will calculate "g(3)=49" and "g'(4)=10" based on each party's X-coordinate and level value. Then, A passes "f'(4)=3" to B; B passes "g(3)=49" to A. At this point, A can make its own shared unit (ie: the first shared unit corresponding to the first temporary account) to be "f(3)+g(3)=63"; B can make its own shared unit ( That is: another first shared unit corresponding to the first temporary account) is "f'(4)+g'(4)=13", so far, A gets its own shared unit as "63", B gets its own The shared unit is "13". It should be noted that, for the convenience of description, the above are all shown with simple numerical values. In fact, the X coordinate and the shared unit are usually very large numerical values.

As shown in "Fig. 4A" and "Fig. 4B", "Fig. 4A" and "Fig. 4B" are schematic diagrams of applying the present invention to exchange assets across chains. Suppose the first client host 110 has an account (ie: the first account 401 ) in the Bitcoin blockchain network, and an asset (eg: 20 bitcoins) in this account is the first asset; the second client The end host 120 has an account (ie, the second account 402 ) in the Ethereum blockchain network, and an asset (eg, 10 ethers) in this account is the second asset. When the first client host 110 and the second client host 120 want to exchange the first asset and the second asset, the two parties will confirm the owners of the first account 401 and the second account 402 with the fair end host 100, and query the first account 401 and the second account 402. Whether account 401/second account 402 has ownership of the first asset/second asset. After the confirmation and query are correct, the first client host 110 and the second client host 120 will respectively execute the distributed key generation function to generate the first temporary account 411 and the second temporary account 412, and make The first client host 110 obtains a low-level sharing unit (ie, the first sharing unit 421 ) corresponding to the first temporary storage account 411 , and a high-level sharing unit (ie, the first sharing unit 421 ) corresponding to the second temporary storage account 412 . Two sharing units 431); enable the second client host 120 to obtain a high-level sharing unit (ie: first sharing unit 422) corresponding to the first temporary account 411, and a low-level corresponding to the second temporary account 412 of shared units (ie: the second sharing unit 432). Next, the first client host 110 transfers the first asset in the first account 401 to the first temporary account 411, and the second client host 120 transfers the second asset in the second account 402 to the second temporary account Deposit account 412.

Next, as shown in FIG. 4B , after the first client host 110 and the second client host 120 know the X-coordinate and the level value of the peer host 100 , the distributed key generation function will be executed again, It is used to add a first new shared unit 423 corresponding to the first shared unit (421, 422) and having a lower level, and a second new shared unit 433 corresponding to the second shared unit (431, 432) and having a lower level. Specifically, the first client host 110 generates a first fragment 441 corresponding to the first sharing unit (421, 422) and a second fragment 442 corresponding to the second sharing unit (431, 432); The client host 120 generates another first fragment 451 corresponding to the first sharing unit (421, 422) and another second fragment 452 corresponding to the second sharing unit (431, 432). The client host 110 transmits the generated first segment 441 and the second segment 442 to the fair end host 100; the second client host 120 transmits the generated another first segment 451 and another second segment 452 to the fair-end host 100, in this way, the fair-end host 100 can form the first new sharing unit 423 according to the received first fragment 441 and another first fragment 451, and according to the received second fragment 442 and another second slice 452 form a second new shared unit 433 . At this time, the second client host 120 and the fair end host 100 respectively have low-level share units of ether addresses (ie, the second share unit 431 and the second new share unit 433 ), and the first client host 110 owns ether The first client host 110 and the fair end host 100 respectively have low-level sharing units of bitcoin addresses (ie: the first sharing unit 421 and the second new sharing unit 432). sharing unit 433), the second client host 120 has a high-level sharing unit (ie, the first sharing unit 422) of the bitcoin address. Therefore, to control the first asset of the first temporary account, the second client host 120 must participate in the threshold signature operation with its shared unit. Similarly, To control the second asset of the second temporary account, the first client host 110 must participate in the threshold signature operation with its shared unit. In this way, the second client host 120 and the fair end host 100 can jointly obtain the control right of the first temporary account 411 according to the high-level first sharing unit 422 and the low-level first new sharing unit 423; the first client The end host 110 and the impartial end host 100 can jointly obtain the control right of the second temporary account 412 according to the high-level second sharing unit 432 and the low-level second new sharing unit 433, thereby realizing the purpose of asset cross-chain exchange. In addition to this, the first client host 110 and the second client host 120 may optionally execute a step-by-step exchange protocol for the first client host 110 and the second client host 120 to exchange their respective low-level first sharing the unit and the second sharing unit, and after completing the exchange, enable the first client host 110 to allow control of the second staging account according to the high-level second sharing unit and the low-level second sharing unit, and enable the second client The end host 120 is allowed to control the first temporary account according to the high-level first sharing unit and the low-level first sharing unit. In this way, it is possible to complete cross-chain exchange of assets under the premise of reducing transaction costs, and can support blockchain networks without smart contracts, without spending the cost of deploying smart contracts. Availability of on-chain exchange assets.

From the above, it can be seen that the difference between the present invention and the prior art is that the distributed key generation function is executed by the first client host and the second client host through secure multi-party computation, so as to be used in different blockchain networks. Generate a temporary account, and at the same time make the fair end host, the first client host and the second client host have different levels of sharing units corresponding to each temporary account, when the first client host and the second client host want to exchange When the assets of different blockchain networks are used, first transfer the assets to be exchanged to the corresponding temporary account, and then execute the threshold signature according to the shared unit held to obtain the control right of the corresponding temporary account, and then complete the cross-chain. By exchanging assets, this technical means can solve the problems existing in the previous technology, and then achieve the technical effect of improving the high availability of cross-chain exchange assets.

Although the present invention is disclosed above by the aforementioned embodiments, it is not intended to limit the present invention. Anyone who is familiar with the similar arts can make some changes and modifications without departing from the spirit and scope of the present invention. The scope of patent protection shall be determined by the scope of the patent application attached to this specification.

101: The first blockchain network

102: Second Blockchain Network

100: fair end host

110: First client host

111: The first confirmation module

112: The first execution module

113: The first transaction module

120: Second client host

121: Second confirmation module

122: The second execution module

123: Second Transaction Module

Claims (8)

An asset cross-chain exchange system based on threshold signature, the system includes: a fair end host for receiving a first shard, another first shard, a second shard and another second shard , and form a low-level first new shared unit according to the first fragment and the other first fragment, and form a low-level second new sharing unit according to the second fragment and the other second fragment a sharing unit; a first client host for interconnecting with the fair end host, and a first account in a first blockchain network having a first asset, the first client host comprising: a The first confirmation module is used for confirming the owner of a second account of a second blockchain network with the fair end host, and inquiring about the second account when the first asset and a second asset are to be exchanged Whether the account has the ownership of the second asset; a first execution module, connected to the first confirmation module, for executing a decentralized operation using Secure Multi-Party Computation (MPC) after confirmation and query are correct formula key generation function to generate a first temporary account and a plurality of first shared units corresponding to different levels in the first blockchain network, and to generate a corresponding and low level of the first shared unit transmitting the first slice of the first new shared unit of the rank and the second slice of the second new shared unit of a lower rank corresponding to a plurality of second shared units to the impartial host; and a first transaction module, connected to the first execution module, for transferring the first asset to the first temporary account in a blockchain transaction mode after the first temporary account is generated; and a first Two client hosts are used for interconnecting with the fair end host, and the second account in the second blockchain network has the second asset, the second client host includes: a second confirmation module , for confirming the owner of the first account of the first blockchain network with the fair end host, and querying whether the first account has the first account when the first asset and the second asset are to be exchanged The ownership of an asset; a second execution module, connected to the second confirmation module, for executing the distributed key generation function through secure multi-party computation after the confirmation and query are correct to execute the distributed key generation function in the second blockchain The network generates a second temporary account and its corresponding second sharing unit with a different level, and generates the other second sharing unit corresponding to the second sharing unit and having a lower level of the second new sharing unit sharding and the other first shard of the first new sharing unit corresponding to the first sharing unit and of a lower level to transmit to the fair end host; and a second transaction module connected to the second execution a module for transferring the second asset to the second temporary account by means of block chain transaction after the second temporary account is generated; wherein the first client host stores the low-level first A shared unit and the second shared unit of the high level, the second client host storing the high level The first sharing unit and the second sharing unit of the lower level, and the first client host and the second client host are allowed to choose to perform threshold signing together with the fair end host to respectively according to the The first sharing unit and the first new sharing unit control the first asset of the first temporary storage account, and control the second temporary storage account according to the second sharing unit and the second new sharing unit assets. The threshold-based signature-based asset cross-chain exchange system as claimed in claim 1, wherein the first client host and the second client host choose to execute a Gradual Exchange Protocol to enable the first client host and the second client host to exchange the first shared unit and the second shared unit of the lower level held by each other, and after the exchange is completed, the first client host allows the first shared unit according to the higher level. The second sharing unit and the second sharing unit of the low level control the second staging account, and cause the second client host to allow the first sharing unit according to the high level and the first sharing unit of the low level The unit controls the first staging account. The threshold-based signature-based asset cross-chain exchange system of claim 2, wherein the step-by-step exchange agreement includes executing the following steps: causing the first client host and the second client host to randomly select an r _{A, i} value respectively and a r _B,i value, and both are in the interval [0,P-1], where A represents the first client host, B represents the second client host, and P is the number of elliptic curve groups, and i is a positive integer; a ciphertext x of the first client host and a ciphertext y of the second client host are split into k equal parts to generate multiple x _i values and multiple y _i values, The x _i value satisfies the ciphertext x=sum _i 2 ³²ⁱ x _i , and the y _i value satisfies the ciphertext y=sum _i 2 ³²ⁱ y _i , where k=P/32, i is a positive integer and satisfies 1 <=i<=k, 0<=x _i <2 ³² and 0<=y _i <2 ³² ; the first client host calculates a D _i value and an E _i value, and the D _i value is {x _i G+r _{A, i} M}, the value of E _i is {r _{A, i} G}, where G is the base point of the elliptic curve group, M is the public key of the first client host, and the second client host Calculate a V _i value and a Wi value, the V _i value is {y _i G+r _{B, i N} }, the Wi value is {r _{B, i G} }, where N is the second client The public key of the host; and the first client host and the second client host exchange the D _i value and the V _i value calculated by each other with each other, and then exchange the E _i value and the W i value in sequence. _i values until the sequential swapping stops. The threshold-based signature-based asset cross-chain exchange system of claim 1, wherein the first shard and the other first shard of the first new sharing unit, and the second shard of the second new sharing unit The shard and the other second shard are when the first client host and the second client host execute the distributed key generation function, the X coordinate and the level value of the fair end host are brought into the generated by the calculation. A method for asset cross-chain exchange based on threshold signature, the steps of which include: a first client host having a first asset in a first account of a first blockchain network, a second client host in A second account of a second blockchain network has a second asset, and a fair end host is interconnected with the first client host and the second client host; When the first client host and the second client host want to exchange the first asset and the second asset with each other, the first client host and the second client host jointly confirm the first client host with the fair host Whether the owners of an account and the second account are the first client host and the second client host respectively, and query whether the first account and the second account have the first asset and the second asset Ownership; the first client host and the second client host execute a distributed key generation function using Secure Multi-Party Computation (MPC) after confirming and querying the correct A block chain network generates a first temporary account and its corresponding multiple first sharing units with different levels, and generates a second temporary account and its corresponding and has a second block chain network. A plurality of second shared units of different levels, wherein the first client host stores the first shared unit of a low level and the second shared unit of a high level, and the second client host stores all the high level of the shared unit. The first sharing unit and the lower-level second sharing unit; the first client host transmits the first asset to the first temporary account in a blockchain transaction, and the second client host The second asset is sent to the second temporary account by means of a block chain transaction; the first client host and the second client host execute the distributed key generation function by means of secure multi-party computation, so as to respectively generate and A first fragment and another first fragment corresponding to the first sharing unit, and a second fragment and another second fragment corresponding to the second sharing unit are generated respectively, wherein the first fragment one guest The client host transmits the generated first segment and the second segment to the fair end host, and the second client host transmits the generated other first segment and the other second segment to the fair end host; the fair end forms a low-level first new shared unit according to the received first fragment and the other first fragment, and according to the received second fragment and the other The second fragment constitutes a second new shared unit of low level; and the first client host and the second client host are allowed to choose to perform threshold signing together with the fair end host to respectively according to the first The sharing unit and the first new sharing unit control the first asset of the first temporary account, and control the second asset of the second temporary account according to the second sharing unit and the second new sharing unit. The threshold-based signature-based asset cross-chain exchange method of claim 5, wherein the method further includes the first client host and the second client host choosing to execute a Gradual Exchange Protocol to enable the first client host to execute a Gradual Exchange Protocol. A client host and the second client host exchange the low-level first shared unit and the second shared unit respectively held by each other, and after the exchange is completed, the first client host allows the The second sharing unit of the lower level and the second sharing unit of the lower level control the second staging account and enable the second client host to allow all the first sharing units according to the higher level and the lower level Describe the steps of the first sharing unit controlling the first temporary account. As claimed in claim 6, the threshold-based signature-based asset cross-chain exchange method, wherein the step-by-step exchange agreement includes executing the following steps: causing the first client host and the second client host to randomly select a value of r _A,i respectively and a r _B,i value, and both are in the interval [0,P-1], where A represents the first client host, B represents the second client host, and P is the number of elliptic curve groups, and i is a positive integer; a ciphertext x of the first client host and a ciphertext y of the second client host are split into k equal parts to generate multiple x _i values and multiple y _i values, The x _i value satisfies the ciphertext x=sum _i 2 ³²ⁱ x _i , and the y _i value satisfies the ciphertext y=sum _i 2 ³²ⁱ y _i , where k=P/32, i is a positive integer and satisfies 1 <=i<=k, 0<=x _i <2 ³² and 0<=y _i <2 ³² ; the first client host calculates a D _i value and an E _i value, and the D _i value is {x _i G+r _{A, i} M}, the value of E _i is {r _{A, i} G}, where G is the base point of the elliptic curve group, M is the public key of the first client host, and the second client host Calculate a V _i value and a Wi value, the V _i value is {y _i G+r _{B, i N} }, the Wi value is {r _{B, i G} }, where N is the second client The public key of the host; and the first client host and the second client host exchange the D _i value and the V _i value calculated by each other with each other, and then exchange the E _i value and the W i value in sequence. _i values until the sequential swapping stops. The threshold-based signature-based asset cross-chain exchange method according to claim 5, wherein the first new sharing unit and the second new sharing unit are the first client host and the second client host executing the distributed When the key generation function is used, the X coordinate and the level value of the fair end host are brought into the calculation and generated.

Images