WO2019242340A1 - 一种防范对区块链网络进行短暂分叉双花攻击的方法 - Google Patents

一种防范对区块链网络进行短暂分叉双花攻击的方法 Download PDF

Info

Publication number
WO2019242340A1
WO2019242340A1 PCT/CN2019/077932 CN2019077932W WO2019242340A1 WO 2019242340 A1 WO2019242340 A1 WO 2019242340A1 CN 2019077932 W CN2019077932 W CN 2019077932W WO 2019242340 A1 WO2019242340 A1 WO 2019242340A1
Authority
WO
WIPO (PCT)
Prior art keywords
block
certificate
node
attack
malicious
Prior art date
Application number
PCT/CN2019/077932
Other languages
English (en)
French (fr)
Inventor
程文彬
郭光武
肖坤
Original Assignee
深圳前海益链网络科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳前海益链网络科技有限公司 filed Critical 深圳前海益链网络科技有限公司
Priority to US17/251,799 priority Critical patent/US11012229B2/en
Publication of WO2019242340A1 publication Critical patent/WO2019242340A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0643—Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562—Static detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3829—Payment protocols; Details thereof insuring higher security of transaction involving key management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/126—Applying verification of the received information the source of the received data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees

Definitions

  • the invention relates to the field of the Internet / IT / finance, and in particular to a method for preventing a transient bifurcation attack on a blockchain network.
  • Blockchain technology also known as distributed ledger technology, is an Internet database technology, which is characterized by decentralization, openness and transparency.
  • the earliest technology is bitcoin's underlying technology, and is currently widely used in finance and other fields.
  • the BTG network has been subjected to a short-term fork and double-spend attack, which has caused a large number of digital token losses to the exchange, making the focus on blockchain security again questioned.
  • a short bifurcation attack refers to:
  • a malicious user H initiates a digital token held by a specific user A (usually an exchange or a centralized wallet recharge) on the main chain (transaction T0), and H transfers the same digital token on the fork chain ( Transaction T1) to another wallet address under its control, forming a conflicting transaction;
  • the malicious user H broadcasts the fork chain chain1 block to the main chain chain network.
  • the fork chain has a computing power / equity advantage, according to the blockchain consensus rules, chain1 will eventually replace the chain, and then achieve the fork
  • the chain transaction T1 covers T0 on the main chain, and T2 continues to be recognized as a valid transaction to realize the theft of digital tokens from users on the main chain.
  • the present invention is Provides a method that can largely prevent a short-forked double-spend attack on a blockchain network.
  • An object of the present invention is to provide a method for preventing a transient bifurcation attack on a blockchain network, so as to solve the problems raised in the background art described above.
  • the present invention provides the following technical solutions:
  • a method for preventing a transient bifurcation attack on a blockchain network includes the following steps:
  • the CA certificate issuing and updating center will revoke the node certificate, broadcast to each node to complete the synchronization of the malicious node certificate, and the entire network will permanently reject the block created by the malicious node.
  • step S1 all nodes that want to participate in mining must submit a certificate issuance application to the CA certificate issuing and updating center, and the CA certificate issuing and updating center performs personal / organization real-name verification; CA certificate issuing And the update center is also responsible for revoking the CA certificate determined as a malicious node and broadcasting it to the entire network.
  • the broadcasted block includes the CA public key and private key signature of the block creator.
  • a node receives a block broadcast, first checks whether the block certificate is within the validity period, and then checks whether the block signature matches the certificate, thereby excluding blocks packed by illegal mining nodes.
  • step S5 if the following two conditions are met, it is judged that there is a risk of a transient bifurcation malicious double-spend attack:
  • the later received blocks are not on the main chain currently recognized by the node, but on the fork chain, and the fork point is more than X blocks from the current height;
  • the node After receiving a large amount of transactions in the block that exceeds the threshold, there is a double spend conflict with the current main chain block, and the large amount of transactions has been confirmed by X blocks, or the small amount of transactions has exceeded the threshold cumulatively; it is identified as a short-term Fork chain of fork attack risk, the node temporarily adds the packaged node certificate of the two conflicting blocks to the list of possible malicious nodes, and does not accept the broadcast blocks and forks received later.
  • step S7 for the missing malicious node, the CA certificate is revoked after being verified through the method of user loss report.
  • the present invention has the following beneficial effects: the original chain is relatively small and easy to implement; only adding the CA center and modifying and adding the necessary consensus algorithm can effectively reduce the possibility of short-term bifurcation attacks , Through the real-name system CA certificate, to provide effective real-name system evidence for judicial investigation after the fact.
  • a method for preventing a transient bifurcation attack on a blockchain network includes the following steps:
  • CA certificate issue and update center Add a CA certificate issue and update center on the blockchain network; all nodes that want to participate in mining must submit a certificate issue application to the CA certificate issue and update center, and the CA certificate issue and update center conducts personal / organization real-name system review; CA The certificate issuance and renewal center is also responsible for revoking the CA certificate determined as a malicious node and broadcasting it to the entire network;
  • the broadcasted block includes the CA public and private key signature of the block creator so that other nodes can verify the identity of the block creator;
  • a node receives a block broadcast, first checks whether the block certificate is within the validity period, and then checks whether the block signature matches the certificate. Exclude illegal mining (no certificate, certificate expired, certificate revoked) node packaged blocks;
  • the consensus improvement is to prevent a certificate from being maliciously mined for malicious exploitation of computing power / equity advantages A large number of blocks are generated in a short time; 2 A block with a time difference of less than half a period from a block's predecessor block is discarded as an illegal block. This consensus improvement avoids malicious use of computing power in multiple certificates / Equity advantages quickly mine a large number of blocks in a short time;
  • the consensus algorithm is improved to increase the height of the prohibited block Y. If the node considers the height of the main chain block Z and the height of the bifurcation point to be X, when ZX> Y, Accept the fork chain block. At the same time, the creator of the fork point block is marked as a malicious node;
  • the CA certificate issuing and updating center will revoke the node certificate, broadcast to each node to complete the synchronization of the malicious node certificate, and the entire network will permanently reject the block created by the malicious node ( (Following Article 3 consensus rules);
  • This method for preventing a short-forked double-spend attack on a blockchain network has minor changes to the original chain and is easy to implement. Only adding a CA center and modification to add necessary consensus algorithms can effectively reduce the short-forked double-spend attack. The possibility of providing real-name system evidence for subsequent judicial investigation through the real-name system CA certificate.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Accounting & Taxation (AREA)
  • Power Engineering (AREA)
  • Health & Medical Sciences (AREA)
  • Virology (AREA)
  • General Health & Medical Sciences (AREA)
  • Finance (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Computer And Data Communications (AREA)

Abstract

本发明公开了一种防范对区块链网络进行短暂分叉双花攻击的方法，包括以下步骤：在区块链网络增加一个CA证书发放及更新中心；改造区块数据结构，增加基于CA证书的签名和公钥字段；将签名和公钥的证书合法性验证加入到区块链网络节点的共识算法中；改进共识算法；在改进后的共识算法中增加短暂分叉恶意双花攻击风险识别。本发明对原有的链改动较小，容易实现，仅增加CA中心和修改添加必要的共识算法，可以有效降低短暂分叉双花攻击的可能性，通过实名制CA证书，为事后司法调查提供有效实名制证据。

Description

一种防范对区块链网络进行短暂分叉双花攻击的方法 技术领域
本发明涉及互联网/IT/金融领域，具体是一种防范对区块链网络进行短暂分叉双花攻击的方法。
背景技术
区块链技术也被称为分布式账本技术，是一种互联网数据库技术，其特点是去中心化、公开透明。最早是比特币的底层技术，目前广泛应用于金融等领域。目前，BTG网络受到短暂分叉双花攻击，给交易所造成了大量数字token的损失，使关注区块链安全性再次受到了质疑。
短暂分叉双花攻击，是指：
1)攻击者利用自己控制节点的算力(针对POW区块链网络)/权益(针对POS区块链网络)优势，分叉目标链(chain，分叉期间，不广播其创建的分叉链-chain1区块)，并确保两条链处于隔离状态；
2)恶意用户H在主链上发起向特定用户A(一般是交易所或中心化钱包充值)转账(交易T0)持有的数字token，而在分叉链上H将同一笔数字token转账(交易T1)至自己控制的另一个钱包地址，形成冲突交易；
3)等待X个区块后，主链A用户在完成收入确认后(T0被确认有效)，然后恶意用户H从中心化钱包向区块链自己控制的钱包地址提现(交易T2)；
4)然后恶意用户H将分叉链chain1区块广播到主链chain网络中，由于分叉链具有算力/权益优势，根据区块链共识规则，chain1最终会替代chain，进而实现用分叉链交易T1覆盖主链上的T0，T2继续确认为有效交易，实现对主链用户数字token的盗取。
目前在区块链网络(POW共识网络/POS共识网络)中没有一种行之有效的方法预防掌握大量资源的恶意个人或组织(一般是矿池)进行短暂分叉双花攻击，本发明就是提供一种可以在很大程度上预防对区块链网络发起短暂分叉双花攻击的方法。
发明内容
本发明的目的在于提供一种防范对区块链网络进行短暂分叉双花攻击的方法，以解决上述背景技术中提出的问题。
为实现上述目的，本发明提供如下技术方案：
一种防范对区块链网络进行短暂分叉双花攻击的方法，包括以下步骤：
S1，在区块链网络增加一个CA证书发放及更新中心；
S2，改造区块数据结构，增加基于CA证书的签名和公钥字段；
S3，将签名和公钥的证书合法性验证加入到区块链网络节点的共识算法中；
S4，改进共识算法：若连续两个区块，区块创建者证书相同，则认为后一个区块作为非法区块丢弃；将一个区块与该区块前驱区块时间差小于半个周期的区块作为非法区块丢弃；
S5，在改进后的共识算法中增加短暂分叉恶意双花攻击风险识别；
S6，增加禁止翻转区块高度Y，若本节点认为的主链区块高度为Z，分叉点高度为X，则当Z-X>Y时，不再接受该分叉链区块，同时，标记该分叉点区块创建者为恶意节点；
S7，若同一证书在多个高度被标记为恶意节点，则CA证书发放及更新中心会吊销该节点证书，向各个节点广播完成恶意节点证书同步，整个网络永久拒绝恶意节点创建的区块。
作为本发明进一步的方案：在步骤S1中，所有要想参与挖矿的节点，必须向CA证书发放及更新中心提交证书发放申请，CA证书发放及更新中心进行个人/组织实名制审核；CA证书发放及更新中心还负责将被判定为恶意节点的CA证书吊销，并向全网广播。
作为本发明进一步的方案：在步骤S2中，广播的区块中包括区块创建者的CA公钥和私钥签名。
作为本发明进一步的方案：在步骤S3中，一个节点接到区块广播，首先检查区块证书是否在有效期内，然后检查区块签名是否与证书匹配，排除非法挖矿节点打包的区块。
作为本发明进一步的方案：在步骤S5中，若符合以下两个条件则判断为存在短暂分叉恶意双花攻击风险：
后接收到的区块，不在节点当前认可的主链上，而是在分叉链上，且分叉点距当前高度超过X个区块；
后接收到的区块中有大额交易超过阈值与当前主链区块存在双花冲突，且该大额交易已经被X个区块确认，或小额交易冲突累计超过阈值；识别为短暂分叉攻击风险的分叉链，节点临时将两个冲突区块的打包节点证书列入可能恶意节点列表，不接受后接到的广播区块和分叉。
作为本发明进一步的方案：在步骤S7中，对于遗漏的恶意节点，通过用户损失举报的方式，经查证后吊销CA证书。
与现有技术相比，本发明的有益效果是：对原有的链改动较小，容易实现，仅增加CA中心和修改添加必要的共识算法，可以有效降低短暂分叉双花攻击的可能性，通过实名制CA证书，为事后司法调查提供有效实名制证据。
具体实施方式
下面将对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本发明实施例中，一种防范对区块链网络进行短暂分叉双花攻击的方法，包括以下步骤：
在区块链网络增加一个CA证书发放及更新中心；所有要想参与挖矿的节点，必须向CA证书发放及更新中心提交证书发放申请，CA证书发放及更新中心进行个人/组织实名制审核；CA证书发放及更新中心还负责将被判定为恶意节点的CA证书吊销，并向全网广播；
改造区块数据结构，增加基于CA证书的签名和公钥字段；广播的区块中包括区块创建者的CA公钥和私钥签名，以便其他节点可以验证区块创建者身份；
将签名和公钥的证书合法性验证加入到区块链网络节点的共识算法中：一个节点接到区块广播，首先检查区块证书是否在有效期内，然后检查区块签名是否与证书匹配，排除 非法挖矿(没有证书、证书过期、证书被吊销)节点打包的区块；
改进共识算法：①若连续两个区块，区块创建者证书相同，则认为后一个区块作为非法区块丢弃，该共识改进在于避免一个证书被恶意利用算力/权益优势进行恶意挖矿短时间生成大量区块的情况发生；②将一个区块与该区块前驱区块时间差小于半个周期的区块作为非法区块丢弃，该共识改进避免在多个证书被恶意利用算力/权益优势快速挖矿短时间生成大量区块的情况；
改进共识算法，在共识算法中增加短暂分叉恶意双花攻击风险识别，若符合以下两个条件则判断为存在短暂分叉恶意双花攻击风险：①后接收到的区块，不在节点当前认可的主链上，而是在分叉链上，且分叉点距当前高度超过X个区块；②后接收到的区块中有大额交易超过阈值(例如1万个Token)与当前主链区块存在双花冲突，且该大额交易已经被足够多的区块确认(假定为X个区块确认)，或小额交易冲突累计超过阈值(例如1万个Token，同样该批小额交易被X个区块确认)；识别为短暂分叉攻击风险的分叉链，节点临时将两个冲突区块的打包节点证书列入可能恶意节点列表(标记为恶意节点)，不接受后接到的广播区块和分叉；
为了避免恶意节点长时间隐藏攻击意图，改进共识算法，增加禁止翻转区块高度Y，若本节点认为的主链区块高度Z，分叉点高度为X，则当Z-X>Y时，不再接受该分叉链区块。同时，标记该分叉点区块创建者为恶意节点；
若同一证书在多个高度，被标记为恶意节点，则CA证书发放及更新中心会吊销该节点证书，向各个节点广播完成恶意节点证书同步，整个网络就会永久拒绝恶意节点创建的区块(遵循第3条共识规则)；
对于漏网之鱼(控制了多节点，交易冲突额度小的情况下可能会有漏网之鱼)，还可以通过用户损失举报方式，经查证后事后吊销CA证书，让公安机关介入调查等方式实现补救。
该防范对区块链网络进行短暂分叉双花攻击的方法，对原有的链改动较小，容易实现，仅增加CA中心和修改添加必要的共识算法，可以有效降低短暂分叉双花攻击的可能性， 通过实名制CA证书，为事后司法调查提供有效实名制证据。
以上的仅是本发明的优选实施方式，应当指出，对于本领域的技术人员来说，在不脱离本发明构思的前提下，还可以作出若干变形和改进，这些也应该视为本发明的保护范围，这些都不会影响本发明实施的效果和专利的实用性。

Claims (6)

  1. 一种防范对区块链网络进行短暂分叉双花攻击的方法，其特征在于，包括以下步骤：
    S1，在区块链网络增加一个CA证书发放及更新中心；
    S2，改造区块数据结构，增加基于CA证书的签名和公钥字段；
    S3，将签名和公钥的证书合法性验证加入到区块链网络节点的共识算法中；
    S4，改进共识算法：若连续两个区块，区块创建者证书相同，则认为后一个区块作为非法区块丢弃；将一个区块与该区块前驱区块时间差小于半个周期的区块作为非法区块丢弃；
    S5，在改进后的共识算法中增加短暂分叉恶意双花攻击风险识别；
    S6，增加禁止翻转区块高度Y，若本节点认为的主链区块高度为Z，分叉点高度为X，则当Z-X>Y时，不再接受该分叉链区块，同时，标记该分叉点区块创建者为恶意节点；
    S7，若同一证书在多个高度被标记为恶意节点，则CA证书发放及更新中心会吊销该节点证书，向各个节点广播完成恶意节点证书同步，整个网络永久拒绝恶意节点创建的区块。
  2. 根据权利要求1所述的防范对区块链网络进行短暂分叉双花攻击的方法，其特征在于，在步骤S1中，所有要想参与挖矿的节点，必须向CA证书发放及更新中心提交证书发放申请，CA证书发放及更新中心进行个人/组织实名制审核；CA证书发放及更新中心还负责将被判定为恶意节点的CA证书吊销，并向全网广播。
  3. 根据权利要求1所述的防范对区块链网络进行短暂分叉双花攻击的方法，其特征在于，在步骤S2中，广播的区块中包括区块创建者的CA公钥和私钥签名。
  4. 根据权利要求1所述的防范对区块链网络进行短暂分叉双花攻击的方法，其特征在于，在步骤S3中，一个节点接到区块广播，首先检查区块证书是否在有效期内，然后检查区块签名是否与证书匹配，排除非法挖矿节点打包的区块。
  5. 根据权利要求1所述的防范对区块链网络进行短暂分叉双花攻击的方法，其特征在于，在步骤S5中，若符合以下两个条件则判断为存在短暂分叉恶意双花攻击风险：
    后接收到的区块，不在节点当前认可的主链上，而是在分叉链上，且分叉点距当前高度超过X个区块；
    后接收到的区块中有大额交易超过阈值与当前主链区块存在双花冲突，且该大额交易已经被X个区块确认，或小额交易冲突累计超过阈值；识别为短暂分叉攻击风险的分叉链，节点临时将两个冲突区块的打包节点证书列入可能恶意节点列表，不接受后接到的广播区块和分叉。
  6. 根据权利要求1或5所述的防范对区块链网络进行短暂分叉双花攻击的方法，其特征在于，在步骤S7中，对于遗漏的恶意节点，通过用户损失举报的方式，经查证后吊销CA证书。
PCT/CN2019/077932 2018-06-22 2019-03-13 一种防范对区块链网络进行短暂分叉双花攻击的方法 WO2019242340A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US17/251,799 US11012229B2 (en) 2018-06-22 2019-03-13 Method for preventing short-term bifurcation and double-spend attack on block chain network

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810652782.5 2018-06-22
CN201810652782.5A CN109033832B (zh) 2018-06-22 2018-06-22 一种防范对区块链网络进行短暂分叉双花攻击的方法

Publications (1)

Publication Number Publication Date
WO2019242340A1 true WO2019242340A1 (zh) 2019-12-26

Family

ID=64610450

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/077932 WO2019242340A1 (zh) 2018-06-22 2019-03-13 一种防范对区块链网络进行短暂分叉双花攻击的方法

Country Status (3)

Country Link
US (1) US11012229B2 (zh)
CN (1) CN109033832B (zh)
WO (1) WO2019242340A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111371543A (zh) * 2020-01-08 2020-07-03 中国科学院重庆绿色智能技术研究院 基于双区块链结构的物联网设备访问控制方法
CN111538792A (zh) * 2020-07-10 2020-08-14 卓尔智联(武汉)研究院有限公司 一种联盟链数据处理方法、装置和电子设备
CN111639124A (zh) * 2020-04-29 2020-09-08 西安电子科技大学 安全时间同步方法、系统、存储介质、程序、智能设备
CN112653682A (zh) * 2020-12-16 2021-04-13 深圳前海微众银行股份有限公司 一种区块链日蚀攻击检测的方法及装置

Families Citing this family (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109033832B (zh) 2018-06-22 2021-02-09 深圳前海益链网络科技有限公司 一种防范对区块链网络进行短暂分叉双花攻击的方法
US11736271B2 (en) * 2018-09-21 2023-08-22 Nec Corporation Method for signing a new block in a decentralized blockchain consensus network
DE102019109560A1 (de) * 2019-04-11 2020-10-15 Infineon Technologies Ag Vertrauensanker-Blockketten-Verifizierung
CN111177796B (zh) * 2019-12-26 2022-03-15 西安电子科技大学 一种基于区块链的可溯源云存储系统的共识机制
CN113222590B (zh) * 2020-01-21 2023-10-31 富联精密电子(天津)有限公司 预防双花攻击的方法、装置及计算机可读存储介质
CN111445247B (zh) * 2020-04-09 2021-05-28 堡垒科技有限公司 用于防止区块链分叉的方法和设备
CN111813852B (zh) * 2020-05-29 2023-12-01 上海申铁信息工程有限公司 一种区块链网络的分叉控制方法和装置
CN111724164B (zh) * 2020-06-19 2023-07-14 中国联合网络通信集团有限公司 一种防止重放攻击的方法和装置
CN112532713B (zh) * 2020-11-25 2023-05-16 深圳前海微众银行股份有限公司 一种区块链的抗分叉检测方法及装置
CN114760316B (zh) * 2020-12-28 2023-09-26 富泰华工业（深圳）有限公司 区块链构建方法及相关设备
CN113722545B (zh) * 2021-06-30 2023-04-28 电子科技大学 一种许可链环境下的数据编校方法
CN113516557B (zh) * 2021-07-14 2022-09-23 桂林电子科技大学 一种有向无环图结构的区块链及其实现方法
CN114401099B (zh) * 2021-08-17 2023-05-09 同济大学 一种基于网络拓扑的区块链PoW自私共识抵抗方法
CN114978553B (zh) * 2022-06-30 2024-01-30 中国光大银行股份有限公司 一种联盟链密码算法切换方法、装置及联盟链系统
CN115913559B (zh) * 2022-07-05 2024-08-02 北京理工大学 一种基于网络延迟与算力延缓中本聪共识账本同步的方法
CN115021945B (zh) * 2022-08-08 2022-11-08 四块科技(深圳)有限公司 区块链交易处理方法和系统
CN116074035A (zh) * 2022-10-28 2023-05-05 国家电网有限公司 一种电能表全寿命周期质量管控数据互信上链方法
CN116112502B (zh) * 2022-11-20 2024-07-19 重庆理工大学 一种面向动态物联网环境的分布式账本优化部署方法

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106385315A (zh) * 2016-08-30 2017-02-08 北京三未信安科技发展有限公司 一种数字证书管理方法及系统
CN107507006A (zh) * 2017-08-11 2017-12-22 杭州秘猿科技有限公司 一种基于许可链的共识分叉处理方法
CN109033832A (zh) * 2018-06-22 2018-12-18 深圳前海益链网络科技有限公司 一种防范对区块链网络进行短暂分叉双花攻击的方法

Family Cites Families (25)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140310243A1 (en) * 2010-08-16 2014-10-16 Mr. Steven James McGee Heart beacon cycle
US9875510B1 (en) * 2015-02-03 2018-01-23 Lance Kasper Consensus system for tracking peer-to-peer digital records
US10304143B2 (en) * 2016-05-05 2019-05-28 Lance Timothy Kasper Consensus system for manipulation resistant digital record keeping
EP3125489B1 (en) * 2015-07-31 2017-08-09 BRITISH TELECOMMUNICATIONS public limited company Mitigating blockchain attack
JP6358658B2 (ja) * 2015-11-09 2018-07-18 日本電信電話株式会社 ブロックチェーン生成装置、ブロックチェーン生成方法、ブロックチェーン検証装置、ブロックチェーン検証方法およびプログラム
CN105931052A (zh) * 2016-04-21 2016-09-07 四川大学 一种基于区块链多因子交叉验证的虚拟货币交易验证方法
US10417217B2 (en) * 2016-08-05 2019-09-17 Chicago Mercantile Exchange Inc. Systems and methods for blockchain rule synchronization
US10785022B2 (en) * 2016-09-13 2020-09-22 Hiroshi Watanabe Network without abuse of a private key
US10587628B2 (en) * 2016-09-29 2020-03-10 Microsoft Technology Licensing, Llc Verifiable outsourced ledgers
US10733602B2 (en) * 2016-09-29 2020-08-04 Microsoft Technology Licensing, Llc. Heartbeats and consensus in verifiable outsourced ledgers
US12056691B2 (en) * 2016-09-30 2024-08-06 Cable Television Laboratories, Inc. Systems and methods for securely tracking consumable goods using a distributed ledger
US20180114218A1 (en) * 2016-10-26 2018-04-26 International Business Machines Corporation Blockchain: automatic fork protection
US10621510B2 (en) * 2016-11-09 2020-04-14 Cognitive Scale, Inc. Hybrid blockchain data architecture for use within a cognitive environment
US10554746B2 (en) * 2016-11-14 2020-02-04 International Business Machines Corporation Decentralized immutable storage blockchain configuration
CN106530072A (zh) * 2016-11-22 2017-03-22 天津米游科技有限公司 一种区块链共识机制
US20180158034A1 (en) * 2016-12-07 2018-06-07 International Business Machines Corporation Dynamic reordering of blockchain transactions to optimize performance and scalability
CN107078903B (zh) * 2016-12-23 2019-12-06 深圳前海达闼云端智能科技有限公司 区块链的挖矿方法、装置和节点设备
WO2018194736A1 (en) * 2017-04-18 2018-10-25 Tbcasoft, Inc. Anonymity and traceability of digital property transactions on a distributed transaction consensus network
CN107424066B (zh) * 2017-07-19 2020-11-10 武汉凤链科技有限公司 一种基于价值量建立共识机制的方法及其系统
US10601911B2 (en) * 2017-11-16 2020-03-24 International Business Machines Corporation Partitioning of a blockchain ledger
CN107908932B (zh) * 2017-12-10 2020-10-13 吕文华 一种基于l算法的数字货币防伪及验证方法、系统和设备
US10630463B2 (en) * 2018-02-26 2020-04-21 Ca, Inc. Meta block chain
US10764325B2 (en) * 2018-03-30 2020-09-01 Konica Minolta Laboratory U.S.A., Inc. Method for adjusting mining difficulty of a cryptocurrency blockchain system by monitoring malicious forks and implementing a miners blockchain
US10972279B2 (en) * 2018-06-07 2021-04-06 International Business Machines Corporation Efficient validation for blockchain
US11544712B2 (en) * 2018-06-11 2023-01-03 Tbol Inc. Secure multi-factor tokenization-based sub-cryptocurrency payment platform

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106385315A (zh) * 2016-08-30 2017-02-08 北京三未信安科技发展有限公司 一种数字证书管理方法及系统
CN107507006A (zh) * 2017-08-11 2017-12-22 杭州秘猿科技有限公司 一种基于许可链的共识分叉处理方法
CN109033832A (zh) * 2018-06-22 2018-12-18 深圳前海益链网络科技有限公司 一种防范对区块链网络进行短暂分叉双花攻击的方法

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111371543A (zh) * 2020-01-08 2020-07-03 中国科学院重庆绿色智能技术研究院 基于双区块链结构的物联网设备访问控制方法
CN111639124A (zh) * 2020-04-29 2020-09-08 西安电子科技大学 安全时间同步方法、系统、存储介质、程序、智能设备
CN111639124B (zh) * 2020-04-29 2023-02-24 西安电子科技大学 安全时间同步方法、系统、存储介质、程序、智能设备
CN111538792A (zh) * 2020-07-10 2020-08-14 卓尔智联(武汉)研究院有限公司 一种联盟链数据处理方法、装置和电子设备
CN112653682A (zh) * 2020-12-16 2021-04-13 深圳前海微众银行股份有限公司 一种区块链日蚀攻击检测的方法及装置
CN112653682B (zh) * 2020-12-16 2022-12-27 深圳前海微众银行股份有限公司 一种区块链日蚀攻击检测的方法及装置

Also Published As

Publication number Publication date
CN109033832A (zh) 2018-12-18
US20210119778A1 (en) 2021-04-22
US11012229B2 (en) 2021-05-18
CN109033832B (zh) 2021-02-09

Similar Documents

Publication Publication Date Title
WO2019242340A1 (zh) 一种防范对区块链网络进行短暂分叉双花攻击的方法
US12003616B2 (en) Rapid distributed consensus on blockchain
US12074963B2 (en) Blockchain for general computation
Zhang et al. Security and privacy on blockchain
KR102670611B1 (ko) 블록체인-구현 이벤트-잠금 암호화를 위한 방법 및 시스템
CN113239382B (zh) 一种基于区块链智能合约的可信身份模型
Tian et al. Enabling cross-chain transactions: A decentralized cryptocurrency exchange protocol
CN109842606B (zh) 基于一致性哈希算法的区块链共识算法和系统
WO2017082238A1 (ja) ブロックチェーン生成装置、ブロックチェーン生成方法、ブロックチェーン検証装置、ブロックチェーン検証方法およびプログラム
WO2017082237A1 (ja) ブロックチェーン生成装置、ブロックチェーン生成方法、ブロックチェーン検証装置、ブロックチェーン検証方法およびプログラム
Xu et al. K-time modifiable and epoch-based redactable blockchain
JP2022106942A (ja) ブロックチェーン・ネットワークにおける暗号座礁リソースを回避又は削減する方法、電子デバイス及び記憶媒体
CN107769925A (zh) 基于区块链的公钥基础设施系统及其证书管理方法
CN109840767B (zh) 基于区块链技术的多方公平合约存证方法和系统
GB2583770A (en) Methods and devices for registering and authenticating miner identity in a blockchain network
CN106920097A (zh) 一种量子链共识协议的生成时间块链方法
CN109743182A (zh) 基于区块链的智能合约核准方法及系统
Yu et al. Low powered blockchain consensus protocols based on consistent hash
Prabhakar et al. TCON-A lightweight Trust-dependent Consensus framework for blockchain
Zhao et al. Dynamic Notary Group Election Algorithm Based on Reputation Value
CN114461623B (zh) 一种许可链上授权的非交易有害数据完全擦除方法
Pawar Proof of Trust Protocol For Blockchain Consensus and a Generalized Trust Network

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19821878

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 07/05/2021)

122 Ep: pct application non-entry in european phase

Ref document number: 19821878

Country of ref document: EP

Kind code of ref document: A1