WO2021203853A1 - 密钥生成方法、装置、设备及介质 - Google Patents

密钥生成方法、装置、设备及介质 Download PDF

Info

Publication number
WO2021203853A1
WO2021203853A1 PCT/CN2021/077374 CN2021077374W WO2021203853A1 WO 2021203853 A1 WO2021203853 A1 WO 2021203853A1 CN 2021077374 W CN2021077374 W CN 2021077374W WO 2021203853 A1 WO2021203853 A1 WO 2021203853A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
component
signature
cooperative
private key
Prior art date
Application number
PCT/CN2021/077374
Other languages
English (en)
French (fr)
Inventor
李茂材
王宗友
张劲松
黄焕坤
周开班
时一防
刘区城
刘攀
蓝虎
杨常青
朱耿良
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Publication of WO2021203853A1 publication Critical patent/WO2021203853A1/zh
Priority to US17/720,274 priority Critical patent/US20220311607A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures

Definitions

  • This application relates to the field of Internet technology, in particular to the field of communication computing technology, and in particular to the key generation technology based on a blockchain network.
  • a key pair usually includes a public key and a private key; the private key can be used to sign data to obtain signature information, and the public key can be used to verify the signature information.
  • the private key can be used to sign data to obtain signature information
  • the public key can be used to verify the signature information.
  • how to improve the reliability and security of key pairs has become a research hotspot.
  • the embodiments of the present application provide a method, device, device, and medium for generating a key, which can effectively improve the reliability and security of a cooperative key pair.
  • an embodiment of the present application provides a method for generating a key based on a blockchain network, which is executed by a first device, and the method includes:
  • the second private key component in the cooperative key pair is held by the second device, and the shared public key is used to verify that the first private key component and the second private key component are used for a cooperative signature The validity of the obtained collaborative signature information;
  • the transaction data is sent to the second device, so that the second device uses the second private key component to sign the transaction data to obtain a second signature component, and according to the first signature component and The second signature component obtains collaborative signature information, and sends negotiation result data to the consensus node.
  • the negotiation result data includes the collaborative signature information, the shared public key, and the key verification parameter;
  • the consensus node makes a consensus on the negotiation result data, and after the negotiation result data passes the consensus, submits the negotiation result data to the blockchain of the blockchain network.
  • an embodiment of the present application provides a method for generating a key based on a blockchain network, which is executed by a second device, and the method includes:
  • Receive transaction data sent by the first device the transaction data is generated according to a first signature component and a key verification parameter, and the first signature component is used by the first device using the first private key component Obtained by signing the key verification parameter; the key verification parameter is returned by the consensus node in the blockchain network in response to the key agreement request sent by the first device;
  • the negotiation result data is sent to the consensus node, the negotiation result data includes the collaborative signature information, the shared public key, and the key verification parameter; so that the consensus node agrees on the negotiation result data , And submit the negotiation result data to the blockchain of the blockchain network after the negotiation result data has passed a consensus.
  • an embodiment of the present application provides a method for generating a key based on a blockchain network, which is executed by a consensus node in the blockchain network, and the method includes:
  • the first device and the second device can negotiate a cooperative key pair to obtain a first private key component, a second private key component, and a shared public key. Key; and make the first device and the second device respectively use the first private key component and the second private key component to perform collaborative signature on the key verification parameter to obtain collaborative signature information;
  • negotiation result data sent by the second device, where the negotiation result data includes the collaborative signature information, the shared public key, and the key verification parameter;
  • a consensus is made on the negotiation result data; if the consensus is passed, the negotiation result data is submitted to the blockchain of the blockchain network.
  • an embodiment of the present application provides a key generation device, the key generation device runs in a first device; the device includes:
  • the sending unit is used to send a key agreement request to the consensus node in the blockchain network to request the consensus node to return key verification parameters;
  • the processing unit is configured to, if the key verification parameter returned by the consensus node is received, negotiate the cooperative key pair with the second device to obtain the first private key component in the cooperative key pair And a shared public key; the second private key component in the cooperative key pair is held by the second device, and the shared public key is used to verify the use of the first private key component and the second private key The validity of the collaborative signature information obtained by the key component for collaborative signature;
  • the processing unit is further configured to use the first private key component to sign the key verification parameter to obtain a first signature component; and generate transaction data according to the first signature component and the key verification parameter ;
  • the sending unit is further configured to send the transaction data to the second device, so that the second device uses the second private key component to sign the transaction data to obtain a second signature component, and
  • the collaborative signature information is obtained according to the first signature component and the second signature component, and the negotiation result data is sent to the consensus node.
  • the negotiation result data includes the collaborative signature information, the shared public key, and the Key verification parameters; the consensus node makes a consensus on the negotiation result data, and after the negotiation result data passes the consensus, the negotiation result data is submitted to the blockchain of the blockchain network.
  • an embodiment of the present application provides a key generation device, the key generation device runs in a second device; the device includes:
  • the processing unit is used to negotiate a cooperative key pair with the first device to obtain the second private key component and the shared public key in the cooperative key pair; the first private key component in the cooperative key pair is determined by Held by the first device, and the shared public key is used to verify the validity of the collaborative signature information obtained by using the first private key component and the second private key component to perform a collaborative signature;
  • the receiving unit is configured to receive transaction data sent by the first device, where the transaction data is generated according to a first signature component and a key verification parameter, and the first signature component is used by the first device
  • the first private key component is obtained by signing the key verification parameter
  • the key verification parameter is returned by the consensus node in the blockchain network in response to the key agreement request sent by the first device
  • the processing unit is further configured to use the second private key component to sign the transaction data to obtain a second signature component, and to obtain collaborative signature information according to the first signature component and the second signature component;
  • the sending unit is configured to send negotiation result data to the consensus node, where the negotiation result data includes the collaborative signature information, the shared public key, and the key verification parameter;
  • the negotiation result data is subject to consensus, and after the negotiation result data passes the consensus, the negotiation result data is submitted to the blockchain of the blockchain network.
  • an embodiment of the present application provides a key generation device, the key generation device runs in a consensus node; the device includes:
  • a receiving unit configured to receive a key agreement request sent by the first device, where the key agreement request is used to request the consensus node to return key verification parameters;
  • the sending unit is configured to return the key verification parameter to the first device, so that the first device and the second device can negotiate a cooperative key pair to obtain the first private key component and the second private key. Key component and shared public key; and make the first device and the second device use the first private key component and the second private key component, respectively, to perform a collaborative signature on the key verification parameter to obtain a collaboration Signature information;
  • the receiving unit is further configured to receive negotiation result data sent by the second device, where the negotiation result data includes the cooperative signature information, the shared public key, and the key verification parameter;
  • the consensus unit is used to make a consensus on the negotiation result data; if the consensus is passed, submit the negotiation result data to the blockchain of the blockchain network.
  • an embodiment of the present application provides a computer device, the computer device is any one of the aforementioned first device, second device, and consensus node; the computer device includes an input interface and an output interface , The computer equipment further includes:
  • a processor suitable for implementing one or more instructions; and, a computer storage medium;
  • the computer storage medium stores one or more first instructions, and the one or more first instructions are suitable for being loaded by the processor and executed on the first device side. ⁇ key generation method;
  • the computer storage medium stores one or more second instructions, and the one or more second instructions are suitable for being loaded by the processor and executed on the second device side.
  • the computer storage medium stores one or more third instructions, and the one or more third instructions are suitable for being loaded by the processor and executing the key on the consensus node side Generation method.
  • an embodiment of the present application provides a computer storage medium.
  • the computer storage medium stores one or more first instructions, and the one or more first instructions are suitable for being loaded by a processor and executing the first instructions.
  • a method for generating a key executed by the device or, the computer storage medium stores one or more second instructions, and the one or more second instructions are suitable for being loaded by a processor and executed by the second device Key generation method; or, the computer storage medium stores one or more third instructions, and the one or more third instructions are suitable for being loaded by a processor and executing the key generation method executed by the consensus node.
  • an embodiment of the present application provides a computer program product or computer program.
  • the computer program product or computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium.
  • the processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction to cause the computer device to execute the key generation method on the first device side or the key generation method on the second device side. Method, or the key generation method on the side of the consensus node.
  • the first device in the embodiment of the present application can first send a key agreement request to the consensus node in the blockchain network; if it receives the key verification parameter returned by the consensus node, it can cooperate with the second device for key pairing Through negotiation, the first private key component and the shared public key in the cooperative key pair are obtained; the second private key component in the cooperative key pair is held by the second device. Secondly, the first device and the second device can respectively use the first private key component and the second private key component to cooperatively sign the key verification parameters to obtain the first signature component and the second signature component, and further based on the first signature component And the second signature component to obtain cooperative signature information.
  • the second device can send the negotiation result data carrying the cooperative signature information, the shared public key, and the key verification parameters to the consensus node, and the consensus node submits the negotiation result data to the blockchain after confirming that the negotiation result data passes the consensus.
  • the first device and the second device in the embodiment of this application each hold a private key component, neither device can hold a complete private key, which can effectively improve the security of the cooperative key pair; through the blockchain network
  • the key verification parameters issued by the consensus node can realize the chaining of the negotiation process and the negotiation result of the cooperative key pair, ensure the openness and transparency of the negotiation process, and improve the reliability and security of the cooperative key pair.
  • Figure 1a is a schematic structural diagram of a blockchain provided by an embodiment of the present application.
  • FIG. 1b is a schematic diagram of the architecture of a key generation system provided by an embodiment of the present application.
  • FIG. 1c is a schematic diagram of the architecture of a key generation system provided by an embodiment of the present application.
  • FIG. 1d is a schematic diagram of the architecture of a key generation system provided by an embodiment of the present application.
  • FIG. 2 is a schematic flowchart of a method for generating a key provided by an embodiment of the present application
  • FIG. 3 is a schematic flowchart of a key generation method provided by an embodiment of the present application.
  • FIG. 4a is a schematic diagram of packaging negotiation result data into a target block provided by an embodiment of the present application.
  • FIG. 4b is a schematic diagram of a process of adding a target block to a blockchain according to an embodiment of the present application
  • Figure 5 is a schematic structural diagram of a key generation device provided by an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a key generation device provided by an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of a key generation device provided by an embodiment of the present application.
  • Fig. 8 is a schematic structural diagram of a computer device provided by an embodiment of the present application.
  • the blockchain network is a network composed of a peer-to-peer network (P2P network) and a blockchain, which includes multiple node devices (referred to as nodes); the nodes in the blockchain network specifically refer to the computer equipment for data processing , Which can include, but is not limited to: smart terminals, tablet computers, desktop computers and other terminal devices, service devices (such as data servers, cloud servers), and so on.
  • the same blockchain is stored inside each node in the blockchain network.
  • the blockchain here is a computer technology implementation based on distributed data storage, point-to-point transmission (P2P transmission), consensus mechanism, encryption algorithm, etc.
  • P2P transmission point-to-point transmission
  • consensus mechanism such as data servers, cloud servers
  • the blockchain can be composed of multiple blocks; the block here refers to the data structure used to record the input information.
  • the genesis block (that is, the first block) includes a block header and a block body.
  • the block header stores the hash value, random number, version number, current timestamp, and current difficulty value of the input information.
  • the input information of the genesis block is stored in the main body.
  • the next block of the genesis block takes the genesis block as the parent block, and the next block also includes the block header and the block body; the block header stores the hash value and parent area of the input information of the current block Block hash value, random number, version number, current timestamp and current difficulty value, and the input information of the current block is stored in the block body.
  • the block data stored in each block in the blockchain is related to the block data stored in its parent block, which can effectively ensure the security of the input information stored in the block.
  • the version number refers to the version information of the relevant block protocol in the blockchain
  • the parent block hash value refers to the hash value of the block header of the previous block
  • the current timestamp refers to the block header that constitutes The system time at the time
  • the current difficulty value refers to the calculated difficulty value, which is a fixed value within a fixed time period, and is determined again after the fixed time period is exceeded.
  • the embodiment of the present application proposes a key generation system based on the blockchain network.
  • the key generation system may at least include: a first device 11, a second device 12, and a consensus node 13 in the blockchain network.
  • the first device 11 and the second device 12 can be any of the following: terminal devices such as smart terminals, tablet computers, and desktop computers, service devices (such as data servers, cloud servers), etc.;
  • the consensus node 13 refers to the district Nodes that can participate in consensus in the blockchain network.
  • the first device 11 can communicate with the second device 12 and the consensus node 13; in the same way, the second device 12 can also communicate with the first device 11 and the consensus node 13.
  • both the first device 11 and the second device 12 may be deployed outside the blockchain network; in this case, the schematic diagram of the key generation system can be seen in FIG. 1b.
  • the first device 11 can be deployed in the blockchain network, and the second device 12 can be deployed outside the blockchain network; in this case, the schematic diagram of the key generation system can be seen in Figure 1c Shown.
  • the first device 11 can be deployed outside the blockchain network, and the second device 12 can be deployed inside the blockchain network; in this case, the schematic diagram of the key generation system can be seen in Figure 1d Shown.
  • the specific architecture of the key generation system proposed in the implementation of this application is not limited to those shown in Figures 1b-1d; for example, both the first device 11 and the second device 12 can also be deployed on the blockchain.
  • the blockchain network can also include other nodes (such as SPV (Simplified Payment Verification) nodes that provide storage services, and business nodes that provide business processing services), and many more.
  • SPV Simple Payment Verification
  • an embodiment of the present application also proposes a key generation scheme.
  • the key generation scheme is mainly used to generate a cooperative key pair between the first device and the second device, so that the first device and the second device respectively hold part of the private key components in the cooperative key pair, so that the subsequent first device
  • the device and the second device can use their own private key components to collaboratively sign the same data.
  • the so-called collaborative signature refers to the process in which two or more participants use their own private key components to complete the process of signing a certain data in concert.
  • the general principle of the key generation scheme is as follows: First, any party (such as the first device or the second device) that has a cooperative signature requirement submits a key agreement request to the consensus node in the blockchain network to make the consensus The node generates a key verification parameter X for it. Then, the first device and the second device negotiate a cooperative key pair; the first device holds the first private key component and the shared public key in the cooperative key pair, and the second device holds the cooperative key pair. The second private key component and the shared public key. Furthermore, the first device and the second device may respectively use the first private key component and the second private key component to perform a collaborative signature on the key verification parameter X to obtain the collaborative signature information.
  • either party can send the collaborative signature information, the shared public key, and the key verification parameter X to the consensus node to indicate that both the first device and the second device agree to this secret.
  • the consensus node can make a consensus on the data sent by any party; and after the consensus is passed, the data is added to the blockchain for storage.
  • the key generation scheme proposed in the embodiments of this application can enable the first device and the second device to hold a private key component respectively, and neither device can hold a complete private key, which can effectively guarantee the cooperative key.
  • the consensus node in the blockchain network verifies the parameters through the key to realize the negotiation process of the cooperative key pair and the negotiation result on the chain, which can ensure the openness and transparency of the negotiation process, and improve the reliability and security of the cooperative key pair .
  • the key generation method may include the following steps S201-S208:
  • S201 The first device sends a key agreement request to a consensus node in the blockchain network.
  • the first device may first generate a key agreement request. Then, the first device may send the key agreement request to the consensus node in the blockchain network to request the consensus node to agree to the first device and the second device to negotiate a cooperative key pair, and return key verification parameters.
  • the smart contract can be called to randomly generate a key verification parameter, and the key verification parameter can be randomly generated through step S202. The key verification parameter is returned to the first device.
  • S203 If the first device receives the key verification parameter returned by the consensus node, it negotiates a cooperative key pair with the second device to obtain the first private key component and the shared public key in the cooperative key pair.
  • the first device receives the key verification parameter returned by the consensus node, it can determine that the consensus node has agreed to the first device and the second device to negotiate a cooperative key pair. At this time, the first device and the second device can negotiate a cooperative key pair to obtain the first private key component and the shared public key in the cooperative key pair.
  • the second device may also negotiate a collaborative key pair with the first device to obtain the second private key component and the shared public key in the collaborative key pair; that is, after negotiation, the The first private key component is held by the first device, and the second private key component in the cooperative key pair is held by the second device.
  • the shared public key in the cooperative key pair can be used to verify the validity of the cooperative signature information obtained by using the first private key component and the second private key component for cooperative signature.
  • step S203 may include the following steps: first, the first device may obtain a random number agreed between the first device and the second device; the random number is used by the first device or the second device using a random algorithm Generated. Secondly, the first device may use a key algorithm to generate a cooperative key pair based on a random number, and the cooperative key pair includes a private key and a public key. Specifically, the first device may determine the random number as the key length, and use a key algorithm (such as an asymmetric encryption algorithm) to generate a key-length cooperative key pair, that is, the length of the private key and the public key in the cooperative key pair The length of is equal to the length of the key. Alternatively, the first device may directly use the random number as the public key in the cooperative key pair, and use the key algorithm to calculate the private key corresponding to the public key, and the public key and the private key form the cooperative key pair.
  • a key algorithm such as an asymmetric encryption algorithm
  • the first device can use the public key in the cooperative key pair as the shared public key, and split the private key in the cooperative key pair into the first private key component and the second private key component;
  • the key component can be sent to the second device. That is, after the negotiation is completed, the first device can send the second private key component and the shared public key to the second device.
  • the second device and the first device negotiate a cooperative key pair to obtain the second private key component and the shared public key in the cooperative key pair.
  • the specific implementation manner may be: receiving the first The second private key component and shared public key sent by the device.
  • the shared public key is the public key in the cooperative key pair generated by the first device using the key algorithm based on random numbers
  • the second private key component is obtained by the first device splitting the private key in the cooperative key pair of.
  • step S203 may include the following steps: first, obtain a random number agreed between the first device and the second device; the random number is generated by the first device or the second device using a random algorithm. Secondly, the first device may use a key algorithm to generate the first private key component and the first public key according to the random number. Specifically, the first device may determine the random number as the key length, and use the key algorithm to generate the first private key component and the first public key of the key length, that is, the length of the first private key component and the first public key The length is equal to the key length.
  • the first device can receive the second public key sent by the second device, and generate a shared public key according to the first public key and the second public key; wherein, the second public key is used by the second device using a key algorithm according to the Random number generation. Then, the first device can integrate the first public key and the second public key to obtain the shared public key.
  • the first device may also send the shared public key to the second device; or, the first device may send the first public key to the second device, so that the second device integrates the first public key and the second public key , Get the shared public key.
  • the first device knows the first private key component and only the second device knows the second private key component, which can further improve the security and privacy of the private key component.
  • the second device and the first device negotiate a cooperative key pair to obtain the second private key component and the shared public key in the cooperative key pair.
  • the specific implementation manner may be: obtain the first The random number agreed between the device and the second device; the key algorithm is used to generate the second private key component and the second public key according to the random number; the second public key is sent to the first device, and the first device is based on the first public key.
  • the key and the second public key generate a shared public key, the first public key is generated by the first device using a key algorithm according to a random number; the shared public key returned by the first device is received.
  • the second device may also receive the first public key sent by the first device, and integrate the first public key and the second public key to obtain the shared public key.
  • the first device uses the first private key component to sign the key verification parameter to obtain the first signature component; and generates transaction data according to the first signature component and the key verification parameter.
  • S205 The first device sends the transaction data to the second device.
  • the first device can send the transaction data to the second device, so that the second device uses the second private key component to sign the transaction data to obtain the second signature component, and according to the first signature component and the second signature
  • the component gets the collaborative signature information, and the negotiation result data carrying the collaborative signature information, the shared public key and the key verification parameters are sent to the consensus node; the consensus node agrees on the negotiation result data, and after the negotiation result data passes the consensus, the negotiation will be negotiated
  • the result data is submitted to the blockchain of the blockchain network.
  • transaction data mentioned in the embodiments of the present application refers to data interacted between the first device and the second device, and does not refer to commercialized data.
  • the second device may perform steps S206-S207.
  • the transaction data is generated according to the first signature component and the key verification parameter
  • the first signature component is obtained by the first device using the first private key component to sign the key verification parameter
  • the key verification parameter is
  • the consensus node returns to the first device.
  • the second device uses the second private key component to sign the transaction data to obtain the second signature component, and obtains the collaborative signature information according to the first signature component and the second signature component.
  • the second device sends the negotiation result data carrying the cooperative signature information, the shared public key, and the key verification parameter to the consensus node.
  • the second device may first use the second private key component to sign the transaction data to obtain the second signature component. Specifically, the second device may directly use the second private key component to sign the transaction data to obtain the second signature component; it may also use the second private key component to sign the key verification parameters in the transaction data to obtain the second signature. Weight.
  • the second device can integrate the first signature component and the second signature component to obtain cooperative signature information. Then, the negotiation result data is generated according to the collaborative signature information, the shared public key and the key verification parameters, and the negotiation result data is sent to the consensus node.
  • the consensus node agrees on the negotiation result data, and after the negotiation result data passes the consensus, Submit the negotiation result data to the blockchain of the blockchain network.
  • the consensus node may receive the negotiation result data sent by the second device, and the negotiation result data carries the cooperative signature information, the shared public key, and key verification parameters. Then, the consensus node may perform the following step S208 on the negotiation result data: agree on the negotiation result data; if the consensus is passed, submit the negotiation result data to the blockchain of the blockchain network.
  • the second device may also return the collaborative signature information to the first device; the first device sends the negotiation result data carrying the collaborative signature information, the shared public key, and the key verification parameters To the consensus node.
  • the first device in the embodiment of the present application can first send a key agreement request to the consensus node in the blockchain network; if it receives the key verification parameter returned by the consensus node, it can cooperate with the second device for key pairing Through negotiation, the first private key component and the shared public key in the cooperative key pair are obtained; the second private key component in the cooperative key pair is held by the second device. Secondly, the first device and the second device can respectively use the first private key component and the second private key to cooperatively sign the key verification parameters to obtain the first signature component and the second signature component, and further based on the first signature component and The second signature component obtains the cooperative signature information.
  • the second device can send the negotiation result data carrying the cooperative signature information, the shared public key, and the key verification parameters to the consensus node, and the consensus node submits the negotiation result data to the blockchain after confirming that the negotiation result data passes the consensus.
  • the first device and the second device in the embodiment of this application each hold a private key component, and neither device can hold a complete private key, which can effectively improve the security of the cooperative key pair; through the blockchain
  • the key verification parameters issued by the consensus node in the network realize the negotiation process of the cooperative key pair and the negotiation result on the chain, which can ensure the openness and transparency of the negotiation process, and can improve the reliability and security of the cooperative key pair .
  • FIG. 3 is a schematic flowchart of a method for generating a key based on a blockchain network provided by an embodiment of the present application.
  • the key generation method may include the following steps S301-S314:
  • S301 The first device generates negotiation information.
  • S302 The first device generates a key agreement notification according to the negotiation information.
  • S303 The first device sends a key agreement notification to the second device.
  • the first device may first generate negotiation information; the negotiation information may be used to instruct the first device to request to communicate with the The second device negotiates a cooperative key pair. Then, a key agreement notification may be generated according to the negotiation information, and the key agreement notification may be sent to the second device.
  • the specific implementation manner of generating the key agreement notification according to the negotiation information may be: directly using the negotiation information as the key agreement notification.
  • the specific implementation manner of generating the key agreement notification based on the negotiation information may be: first use the system private key of the first device to sign the negotiation information to obtain the system digital signature of the first device; The system private key of the device may be randomly generated by the first device using a key algorithm. Then, the negotiation information and the system digital signature of the first device are used to generate a key agreement notification. That is, in this embodiment, the key agreement notification can carry the negotiation information and the system digital signature of the first device obtained by signing the negotiation information with the system private key of the first device; by adding the system digital signature of the first device In the key agreement notification, the second device can verify the identity of the first device according to the system digital signature of the first device, thereby improving security and reliability.
  • the second device may receive the key agreement notification of the first device, and the key agreement notification is generated according to the negotiation information. Then, the second device may decide whether to negotiate a cooperative key pair with the first device; if the second device agrees, the second device may perform step S304. If the second device does not agree, the second device can return a rejection notice to the first device and end this process. Wherein, the rejection notification is used to indicate that the second device does not agree to negotiate a cooperative key pair with the first device.
  • the second device may directly return response information to the first device; that is, the response information may be agreed by the second device and the first device It is sent directly after the coordination key pair is negotiated.
  • the second device can first The digital signature of the system performs identity verification on the first device, and after the first device passes the identity verification, a response message is sent to the first device.
  • the second device may first obtain the system public key of the first device, and use the system public key of the first device to verify the system digital signature of the first device; If the verification is successful, it can be determined that the first device has passed the identity verification, and at this time, a response message can be sent to the first device.
  • the second device can also use the system private key of the second device to sign the key agreement notification to obtain the system digital signature of the second device; and then according to the key agreement notification and the system digital signature of the second device Sign, generate response information, and send the response information to the first device. That is, the response information may also be sent after the second device agrees to negotiate a cooperative key pair with the first device, and the system public key of the first device is used to successfully verify the system digital signature of the first device.
  • the first device if the first device receives the response information returned by the second device, it can determine that the second device has agreed to negotiate a cooperative key pair with the first device, and at this time, it can directly generate a key agreement request.
  • step S305 may be: After receiving the response information returned by the second device, the system public key of the second device is obtained, and the system public key of the second device is used to verify the system digital signature of the second device; if the system digital signature of the second device is verified, then The system digital signature of the first device, the system digital signature of the second device, and the negotiation information are used to generate a key agreement request.
  • S306 The first device sends a key agreement request to the consensus node.
  • S307 The consensus node returns the key verification parameter to the first device.
  • the key agreement request is used to request the consensus node to agree to the first device and the second device to negotiate a cooperative key pair, and return key verification parameters. Therefore, after receiving the key agreement request sent by the first device, the consensus node can call the smart contract to generate a key verification parameter. Then, the key verification parameter can be returned to the first device, so that the first device and the second device can negotiate a cooperative key pair to obtain the first private key component, the second private key component, and the shared public key; A device and a second device respectively use the first private key component and the second private key component to sign the key verification parameters to obtain the first signature component and the second signature component, and then obtain the first signature component and the second signature component according to the first signature component and the second signature component. Collaborative signature information.
  • S308 If the first device receives the key verification parameter returned by the consensus node, it negotiates the cooperative key pair with the second device to obtain the first private key component and the shared public key in the cooperative key pair.
  • the second device can also obtain the second private key component and the shared public key in the collaborative key through the negotiation of the collaborative key pair with the first device.
  • the first device uses the first private key component to sign the key verification parameter to obtain the first signature component; and generates transaction data according to the first signature component and the key verification parameter.
  • the first device sends the transaction data to the second device; correspondingly, the second device can receive the transaction data sent by the first device.
  • the second device uses the second private key component to sign the transaction data to obtain the second signature component, and obtains the collaborative signature information according to the first signature component and the second signature component.
  • the second device sends the negotiation result data carrying the cooperative signature information, the shared public key, and the key verification parameter to the consensus node.
  • the consensus node may receive the negotiation result data sent by the second device, and execute steps S313-314.
  • S313 The consensus node makes a consensus on the negotiation result data.
  • the consensus node may first parse the negotiation result data to obtain the collaborative signature information, the shared public key, and key verification parameters. Then, the consensus node can use the shared public key to verify the validity of the collaborative signature information. If the verification is passed, it is determined that the negotiation result data passes the consensus; otherwise, it is determined that the negotiation result data does not pass the consensus.
  • the consensus node can directly determine that the negotiation result data passes the consensus after confirming that the collaborative signature information passes the validity check. If the blockchain network contains multiple consensus nodes, the multiple consensus nodes can vote on whether the negotiation result data passes the consensus based on their own verification results of the collaborative signature information; then, according to the consensus node’s Voting results (such as "support this collaborative signature information to pass verification” or "oppose this collaborative signature information to pass verification") to finally determine whether the negotiation result data passes the consensus. If the voting results of most consensus nodes (such as 2/3 of the consensus nodes) are "support this collaborative signature information to pass verification", then it can be determined that the negotiation result data passes the consensus.
  • the negotiation result data can be packaged into a target block first.
  • the specific process of packaging the negotiation result data into the target block is as follows: the consensus node can add the negotiation result data to the block body of the target block, as shown in Figure 4a.
  • the consensus node may also sign the negotiation result data, and then add the signature information of the negotiation result data and the negotiation result data to the block body of the target block.
  • the consensus node can use the Merkle Tree algorithm (Merkle Tree algorithm) to hash the negotiation result data in the block body to obtain the hash value of the negotiation result data. Then, the consensus node can use a random algorithm to generate a random number, and use the hash value, random number, version number, parent block hash value, current timestamp, and current difficulty value of the calculated negotiation result data to form the target block The header of the block.
  • Merkle Tree algorithm Merkle Tree algorithm
  • a feature value algorithm (such as the SHA256 algorithm) can be used to perform multiple hash operations on the content contained in the block header to obtain the hash value of the block header of the target block; the number of hash operations here can be Determined according to the difficulty of calculation, the greater the difficulty of calculation, the greater the number of hash operations. If the hash value of the block header of the target block is less than the preset threshold, it indicates that the block header of the target block is valid, and a valid target block can be obtained at this time.
  • the hash value of the block header of the target block is less than the preset threshold, it indicates that the block header of the target block is valid, and a valid target block can be obtained at this time.
  • the consensus node can add the target block to the blockchain of the blockchain network, as shown in Figure 4b.
  • the first device in the embodiment of the present application can first send a key agreement request to the consensus node in the blockchain network; if it receives the key verification parameter returned by the consensus node, it can cooperate with the second device for key pairing Through negotiation, the first private key component and the shared public key in the cooperative key pair are obtained; the second private key component in the cooperative key pair is held by the second device. Secondly, the first device and the second device can respectively use the first private key component and the second private key to cooperatively sign the key verification parameters to obtain the first signature component and the second signature component, and further based on the first signature component and The second signature component obtains the cooperative signature information.
  • the second device can send the negotiation result data carrying the cooperative signature information, the shared public key, and the key verification parameters to the consensus node, and the consensus node submits the negotiation result data to the blockchain after confirming that the negotiation result data passes the consensus.
  • the first device and the second device in the embodiment of this application each hold a private key component, and neither device can hold a complete private key, which can effectively improve the security of the cooperative key pair; through the blockchain
  • the key verification parameters issued by the consensus node in the network realize the negotiation process of the cooperative key pair and the negotiation result on the chain, which can ensure the openness and transparency of the negotiation process, and can improve the reliability and security of the cooperative key pair .
  • an embodiment of the present application also discloses a key generation device.
  • the key generation device may be a computer program (including program code) running in the first device, and the key generation device may execute part of the method steps shown in FIG. 2 and FIG. 3. Referring to Figure 5, the key generation device can run the following units:
  • the sending unit 501 is configured to send a key agreement request to the consensus node in the blockchain network to request the consensus node to return key verification parameters;
  • the processing unit 502 is configured to, if the key verification parameter returned by the consensus node is received, negotiate a cooperative key pair with the second device to obtain the first private key component and the shared public key in the cooperative key pair;
  • the second private key component in the key pair is held by the second device, and the shared public key is used to verify the validity of the collaborative signature information obtained by using the first private key component and the second private key component for collaborative signature;
  • the processing unit 502 is further configured to use the first private key component to sign the key verification parameter to obtain the first signature component; and generate transaction data according to the first signature component and the key verification parameter;
  • the sending unit 501 is also configured to send transaction data to the second device, so that the second device uses the second private key component to sign the transaction data to obtain the second signature component, and obtains the second signature component according to the first signature component and the second signature component Cooperative signature information, the negotiation result data is sent to the consensus node, the negotiation result data includes the cooperative signature information, the shared public key and the key verification parameter; the consensus node agrees on the negotiation result data, and after the negotiation result data passes the consensus , Submit the negotiation result data to the blockchain of the blockchain network.
  • the processing unit 502 when used to negotiate a cooperative key pair with the second device to obtain the first private key component and the shared public key in the cooperative key pair, it is specifically configured to: The random number agreed between the device and the second device.
  • the random number is generated by the first device or the second device using a random algorithm; the key algorithm is used to generate a cooperative key pair based on the random number, and the cooperative key pair includes a private key And a public key; the public key in the cooperative key pair is used as the shared public key, and the private key in the cooperative key pair is split into the first private key component and the second private key component; the second private key component is sent To the second device.
  • the processing unit 502 when used to negotiate a cooperative key pair with the second device to obtain the first private key component and the shared public key in the cooperative key pair, it may be specifically configured to: A random number agreed between a device and a second device, the random number is generated by the first device or the second device using a random algorithm; the key algorithm is used to generate the first private key component and the first public key according to the random number; receiving The second public key is sent by the second device, and a shared public key is generated according to the first public key and the second public key; wherein, the second public key is generated by the second device using a key algorithm according to a random number.
  • the processing unit 502 may be further configured to: generate negotiation information, which is used to instruct the first device to request the negotiation of a cooperative key pair with the second device; and generate a key agreement notification according to the negotiation information;
  • the sending unit 501 may also be used to: send a key agreement notification to the second device;
  • the processing unit 502 may also be configured to generate a key agreement request if the response information returned by the second device for the key agreement notification is received.
  • the processing unit 502 when configured to generate a key agreement notification based on the negotiation information, it may be specifically configured to: use the system private key of the first device to sign the negotiation information to obtain the system digital signature of the first device ; Use the negotiation information and the system digital signature of the first device to generate a key agreement notification; where the response information is that the second device agrees to negotiate a cooperative key pair with the first device, and the system public key of the first device is used to successfully verify the first device Sent after a device’s system is digitally signed.
  • the response message carries the system digital signature of the second device obtained by signing the key agreement notification with the system private key of the second device; correspondingly, the processing unit 502 is configured to: For the response information returned by the key agreement notification, when generating the key agreement request, it is specifically used to: if the response information returned by the second device for the key agreement notification is received, obtain the system public key of the second device, and use The system public key of the second device verifies the system digital signature of the second device; if the system digital signature of the second device is verified, the system digital signature of the first device, the system digital signature of the second device, and the negotiation information are used to generate the key Negotiation request.
  • part of the steps involved in the method shown in Fig. 2 or Fig. 3 may be executed by each unit in the key generation device shown in Fig. 5.
  • steps S201 and S205 shown in FIG. 2 may be executed by the sending unit 501 shown in FIG. 5, and steps S203 and S204 may be executed by the processing unit 502 shown in FIG. 5; for another example, as shown in FIG. 3 Steps S301, S302, S305, and S308-S309 can be executed by the processing unit 502 shown in FIG. 5, and steps S303, S306, and S310 can be executed by the sending unit 501 shown in FIG. 5.
  • the units in the key generation device shown in FIG. 5 can be separately or completely combined into one or several other units to form, or some unit(s) of them can also be used. It is divided into multiple functionally smaller units to form, which can achieve the same operation without affecting the realization of the technical effects of the embodiments of the present application.
  • the above-mentioned units are divided based on logical functions. In practical applications, the function of one unit may also be realized by multiple units, or the functions of multiple units may be realized by one unit. In other embodiments of the present application, the key-based generation device may also include other units. In actual applications, these functions may also be implemented with the assistance of other units, and may be implemented by multiple units in cooperation.
  • a computer program (including program code) that can execute part of the steps involved in the corresponding method shown in FIG. 2 or FIG. 3 can be run on a general-purpose computing device, and the general-purpose computing device may specifically It is a computer, which includes processing elements and storage elements such as a central processing unit (CPU), a random access storage medium (RAM), and a read-only storage medium (ROM). The cooperation of the processing element and the storage element can realize the Key generation method.
  • the computer program may be recorded on, for example, a computer-readable recording medium, and loaded into the above-mentioned general-purpose computing device through the computer-readable recording medium, and run in it.
  • an embodiment of the present application also discloses a key generation device.
  • the key generation device may be a computer program (including program code) running in the second device, and the key generation device may execute part of the method steps shown in FIG. 2 and FIG. 3.
  • the key generation device can run the following units:
  • the processing unit 601 is used to negotiate a cooperative key pair with the first device to obtain the second private key component and the shared public key in the cooperative key pair; the first private key component in the cooperative key pair is used by the first device Hold, the shared public key is used to verify the validity of the collaborative signature information obtained by using the first private key component and the second private key component for collaborative signature;
  • the receiving unit 602 is configured to receive transaction data sent by the first device.
  • the transaction data is generated according to the first signature component and the key verification parameter.
  • the first signature component is encrypted by the first device using the first private key component.
  • the key verification parameter is obtained by signing; the key verification parameter is returned by the consensus node in the blockchain network in response to the key agreement request sent by the first device;
  • the processing unit 601 is further configured to use the second private key component to sign the transaction data to obtain the second signature component, and to obtain the cooperative signature information according to the first signature component and the second signature component;
  • the sending unit 603 is used to send the negotiation result data to the consensus node.
  • the negotiation result data includes collaborative signature information, shared public key, and key verification parameters; the consensus node agrees on the negotiation result data, and the negotiation result data passes the consensus After that, the negotiation result data is submitted to the blockchain of the blockchain network.
  • the processing unit 601 when used to negotiate a cooperative key pair with the first device to obtain the second private key component and the shared public key in the cooperative key pair, it may be specifically used to: A second private key component and a shared public key sent by a device; where the shared public key is the public key in a cooperative key pair generated by the first device using a key algorithm based on a random number, and the second private key component is generated by the first device.
  • the device is obtained by splitting the private key in the cooperative key pair; the random number is agreed between the first device and the second device, and the random number is generated by the first device or the second device using a random algorithm.
  • the processing unit 601 when used to negotiate a cooperative key pair with the first device to obtain the second private key component and the shared public key in the cooperative key pair, it may be specifically used to: A random number agreed upon between a device and a second device, the random number is generated by the first device or the second device using a random algorithm; the key algorithm is used to generate the second private key component and the second public key according to the random number; The second public key is sent to the first device, and the first device generates a shared public key based on the first public key and the second public key. The first public key is generated by the first device using a key algorithm based on a random number; A shared public key returned by a device.
  • the receiving unit 602 may also be used to: receive a key agreement notification sent by the first device, the key agreement notification is generated based on negotiation information; the negotiation information is used to instruct the first device to request negotiation with the second device Cooperative key pair;
  • the sending unit 603 may also be configured to return response information to the first device if it agrees to negotiate a cooperative key pair with the first device.
  • the key agreement notification includes the negotiation information, and the system digital signature of the first device obtained by signing the negotiation information with the system private key of the first device; correspondingly, the sending unit 603 is used for When agreeing to negotiate a cooperative key pair with the first device, when returning response information to the first device, it can be specifically used to: if agreeing to negotiate a cooperative key pair with the first device, use the first device’s system public key pair first The system digital signature of the device is verified; if the verification is successful, a response message is sent to the first device.
  • the sending unit 603 when used to send response information to the first device if the verification is successful, it can be specifically used to: if the verification is successful, use the system private key of the second device to notify the key agreement Sign, obtain the system digital signature of the second device; generate response information according to the key agreement notification and the system digital signature of the second device; send the response information to the first device.
  • part of the steps involved in the method shown in FIG. 2 or FIG. 3 may be executed by each unit in the key generation device shown in FIG. 6.
  • step S206 shown in FIG. 2 may be executed by the processing unit 601 shown in FIG. 6, and step S207 may be executed by the sending unit 603 shown in FIG. 6; another example is S308 and S311 shown in FIG. It may be executed by the processing unit 601 shown in FIG. 6, and step S304 and step S312 may be executed by the sending unit 603 shown in FIG. 6.
  • each unit in the key generation device shown in FIG. 6 can be separately or all combined into one or several other units to form, or some of the units can be further It is divided into multiple functionally smaller units to form, which can achieve the same operation without affecting the realization of the technical effects of the embodiments of the present application.
  • the above-mentioned units are divided based on logical functions. In practical applications, the function of one unit may also be realized by multiple units, or the functions of multiple units may be realized by one unit. In other embodiments of the present application, the key-based generation device may also include other units. In actual applications, these functions may also be implemented with the assistance of other units, and may be implemented by multiple units in cooperation.
  • a computer program (including program code) that can execute part of the steps involved in the corresponding method shown in FIG. 2 or FIG. 3 can be run on a general-purpose computing device, and the general-purpose computing device may specifically It is a computer, which includes processing elements and storage elements such as a central processing unit (CPU), a random access storage medium (RAM), and a read-only storage medium (ROM). The cooperation of the processing element and the storage element can realize the Key generation method.
  • the computer program may be recorded on, for example, a computer-readable recording medium, and loaded into the above-mentioned general-purpose computing device through the computer-readable recording medium, and run in it.
  • an embodiment of the present application also discloses a key generation device.
  • the key generation device may be a computer program (including program code) running in a consensus node in the blockchain network, and the key generation device may execute part of the method steps shown in FIG. 2 and FIG. 3.
  • the key generation device can run the following units:
  • the receiving unit 701 is configured to receive a key agreement request sent by the first device, where the key agreement request is used to request the return of key verification parameters;
  • the sending unit 702 is configured to return key verification parameters to the first device, so that the first device and the second device can negotiate a cooperative key pair to obtain the first private key component, the second private key component, and the shared public key; And enable the first device and the second device to use the first private key component and the second private key component to perform collaborative signature on the key verification parameters to obtain collaborative signature information;
  • the receiving unit 701 is further configured to receive negotiation result data sent by the second device, where the negotiation result data carries collaborative signature information, shared public key, and key verification parameters;
  • the consensus unit 703 is used to make a consensus on the negotiation result data; if the consensus is passed, the negotiation result data is submitted to the blockchain of the blockchain network.
  • part of the steps involved in the method shown in FIG. 2 or FIG. 3 may be executed by various units in the key generation device shown in FIG. 7.
  • step S202 shown in FIG. 2 may be executed by the sending unit 702 shown in FIG. 7
  • step S208 may be executed by the consensus unit 703 shown in FIG. 7
  • step S307 shown in FIG. 3 may be executed by The sending unit 702 shown in FIG. 7
  • steps S313-S314 may be executed by the consensus unit 703 shown in FIG. 7.
  • the units in the key generation device shown in FIG. 7 can be separately or completely combined into one or several other units to form, or some unit(s) of them can also be formed. It is divided into multiple functionally smaller units to form, which can achieve the same operation without affecting the realization of the technical effects of the embodiments of the present application.
  • the above-mentioned units are divided based on logical functions. In practical applications, the function of one unit may also be realized by multiple units, or the functions of multiple units may be realized by one unit. In other embodiments of the present application, the key-based generation device may also include other units. In actual applications, these functions may also be implemented with the assistance of other units, and may be implemented by multiple units in cooperation.
  • a computer program (including program code) that can execute part of the steps involved in the corresponding method shown in FIG. 2 or FIG. 3 can be run on a general-purpose computing device, and the general-purpose computing device may specifically It is a computer, which includes processing elements and storage elements such as a central processing unit (CPU), a random access storage medium (RAM), and a read-only storage medium (ROM). The cooperation of the processing element and the storage element can realize the Key generation method.
  • the computer program may be recorded on, for example, a computer-readable recording medium, and loaded into the above-mentioned general-purpose computing device through the computer-readable recording medium, and run in it.
  • the first device and the second device in the embodiment of this application each hold a private key component, neither device can hold a complete private key, which can effectively improve the security of the cooperative key pair; through the blockchain network
  • the key verification parameters issued by the consensus node can realize the negotiation process and the negotiation result of the cooperative key pair on the chain, which can ensure the openness and transparency of the negotiation process, and can improve the reliability and security of the cooperative key pair.
  • the embodiments of the present application also provide a computer device; the computer device may be the first device, the second device, or the consensus node mentioned above.
  • the computer device at least includes a processor 801, an input interface 802, an output interface 803, and a computer storage medium 804.
  • the processor 801, the input interface 802, the output interface 803, and the computer storage medium 804 in the computer device may be connected by a bus or other methods.
  • the computer storage medium 804 may be stored in a memory of a computer device.
  • the computer storage medium 804 is used to store a computer program.
  • the computer program includes program instructions.
  • the processor 201 is used to execute the program stored in the computer storage medium 804. instruction.
  • the processor 801 (or CPU (Central Processing Unit, central processing unit)) is the computing core and control core of a computer device. It is suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions to achieve Corresponding method flow or corresponding function.
  • CPU Central Processing Unit
  • the processor 801 described in the embodiment of the present application may be used to execute the method for generating a key on the first device side, including: Send a key agreement request to request the consensus node to return the key verification parameters; if the key verification parameters returned by the consensus node are received, negotiate a collaborative key pair with the second device to obtain the first of the collaborative key pair The private key component and the shared public key; the second private key component in the cooperative key pair is held by the second device, and the shared public key is used to verify the cooperative signature obtained by using the first private key component and the second private key component The validity of the cooperative signature information; the first private key component is used to sign the key verification parameter to obtain the first signature component; and the transaction data is generated according to the first signature component and the key verification parameter; the transaction data is sent to the second device , So that the second device uses the second private key component to sign the transaction data to obtain the second signature component, and obtains the collaborative signature information according to the first signature component and the second signature component, and sends
  • the processor 801 described in the embodiment of the present application may be used to execute the key generation method on the second device side, including: performing a cooperative key pair with the first device
  • the second private key component and the shared public key in the cooperative key pair are obtained through negotiation; the first private key component in the cooperative key pair is held by the first device, and the shared public key is used to verify the use of the first private key
  • the validity of the cooperative signature information obtained by the cooperative signature of the component and the second private key component receiving the transaction data sent by the first device, the transaction data is generated according to the first signature component and the key verification parameter, the first signature component It is obtained by the first device using the first private key component to sign the key verification parameter; the key verification parameter is returned by the consensus node in the blockchain network in response to the key agreement request sent by the first device;
  • the two private key components sign the transaction data to obtain the second signature component, and obtain the cooperative signature information according to the first signature component and the second signature component; send the negotiation result data to the consensus node, and the negotiation
  • the processor 801 described in this embodiment of the application may be used to execute the method for generating a key on the side of the consensus node, including: receiving the first The key agreement request sent by the device, the key agreement request is used to request the consensus node to return key verification parameters; return the key verification parameters to the first device, so that the first device and the second device can negotiate a cooperative key pair, Obtain the first private key component, the second private key component, and the shared public key; and make the first device and the second device use the first private key component and the second private key component, respectively, to perform a collaborative signature on the key verification parameters to obtain a collaboration Signature information; receive the negotiation result data sent by the second device, the negotiation result data carries cooperative signature information, shared public key and key verification parameters; consensus on the negotiation result data; if the consensus is passed, the negotiation result data is submitted to the block In the blockchain of the chain network.
  • the embodiment of the present application also provides a computer storage medium (Memory).
  • the computer storage medium is a memory device in a computer device for storing programs and data. It can be understood that the computer storage medium herein may include a built-in storage medium in a computer device, or may include an extended storage medium supported by the computer device.
  • the computer storage medium provides storage space, and the storage space stores the operating system of the computer device.
  • one or more instructions suitable for being loaded and executed by the processor 801 are also stored in the storage space, and these instructions may be one or more computer programs (including program codes).
  • the computer storage medium here may be a high-speed RAM memory, or a non-volatile memory (non-volatile memory), such as at least one disk memory; optionally, it may also be at least one located far away from the foregoing
  • the processor is a computer storage medium.
  • one or more first instructions may be stored in the computer storage medium; and the processor 801 may load and execute one or more first instructions stored in the computer storage medium. An instruction to implement the corresponding steps in the key generation method on the first device side.
  • one or more second instructions may be stored in the computer storage medium; and the processor 801 may load and execute one or more second instructions stored in the computer storage medium. Two instructions to implement the corresponding steps in the key generation method on the second device side.
  • one or more third instructions can be stored in the computer storage medium; and the processor 801 can load and execute one or more third instructions stored in the computer storage medium. Instructions to implement the corresponding steps in the key generation method on the side of the consensus node.
  • the embodiments of the present application also provide a computer product, including instructions, which when run on a computer, cause the computer to execute the key generation method on the first device side, or the key generation method on the second device side, or consensus Key generation method on the node side.

Abstract

本申请公开一种密钥生成方法、装置、设备及介质；方法包括：第一设备向共识节点发送密钥协商请求；若接收到共识节点返回的密钥验证参数，则与第二设备进行协同密钥对的协商，得到第一私钥分量和共享公钥；采用第一私钥分量对密钥验证参数进行签名，得到第一签名分量；根据第一签名分量和密钥验证参数生成交易数据；将交易数据发送至第二设备，使第二设备采用第二私钥分量对交易数据进行签名得到第二签名分量，根据第一签名分量和第二签名分量得到协同签名信息，将携带协同签名信息、共享公钥及密钥验证参数的协商结果数据发送至共识节点；由共识节点在协商结果数据通过共识后，将协商结果数据提交至区块链；可提高协同密钥对的可靠性和安全性。

Description

密钥生成方法、装置、设备及介质
本申请要求于2020年04月09日提交中国专利局、申请号为2020102771165、申请名称为“密钥生成方法、装置、设备及介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及互联网技术领域，具体涉及通信计算技术领域，尤其涉及基于区块链网络的密钥生成技术。
背景技术
随着互联网技术的发展，基于密钥对的数字签名技术受到了广泛使用。密钥对中通常可包括一个公钥和一个私钥；私钥可被用于对数据进行签名得到签名信息，而公钥则可被用于对签名信息进行验证。目前，如何提高密钥对的可靠性和安全性成为了研究热点。
发明内容
本申请实施例提供了一种密钥生成方法、装置、设备及介质，可以有效提高协同密钥对的可靠性和安全性。
一方面，本申请实施例提供了一种基于区块链网络的密钥生成方法，由第一设备执行，所述方法包括：
向区块链网络中的共识节点发送密钥协商请求，以请求所述共识节点返回密钥验证参数；
若接收到所述共识节点返回的密钥验证参数，则与所述第二设备进行所述协同密钥对的协商，得到所述协同密钥对中的第一私钥分量和共享公钥；所述协同密钥对中的第二私钥分量由所述第二设备持有，所述共享公钥用于校验采用所述第一私钥分量和所述第二私钥分量进行协同签名得到的协同签名信息的有效性；
采用所述第一私钥分量对所述密钥验证参数进行签名，得到第一签名分量；并根据所述第一签名分量和所述密钥验证参数生成交易数据；
将所述交易数据发送至所述第二设备，以使所述第二设备采用所述第二私钥分量对所述交易数据进行签名得到第二签名分量，并根据所述第一签名分量和所述第二签名分量得到协同签名信息，将协商结果数据发送至所述共识节点，所述协商结果数据包括所述协同签名信息、所述共享公钥和所述密钥验证参数；由所述共识节点对所述协商结果数据进行共识，并在所述协商结果数据通过共识后，将所述协商结果数据提交至所述区块链网络的区块链中。
一方面，本申请实施例提供了一种基于区块链网络的密钥生成方法，由第二设备执行，所述方法包括：
与第一设备进行协同密钥对的协商，得到所述协同密钥对中的第二私钥分量和共享公钥；所述协同密钥对中的第一私钥分量由所述第一设备持有，所述共享公钥用于校验采用所述第一私钥分量和所述第二私钥分量进行协同签名得到的协同签名信息的有效性；
接收所述第一设备发送的交易数据，所述交易数据是根据第一签名分量和密钥验证参数生成的，所述第一签名分量是由所述第一设备采用所述第一私钥分量对密钥验证参数进行签名得到的；所述密钥验证参数是区块链网络中的共识节点响应于所述第一设备发送的密钥协商请求返回的；
采用所述第二私钥分量对所述交易数据进行签名得到第二签名分量，并根据所述第一签名分量和所述第二签名分量得到协同签名信息；
将协商结果数据发送至所述共识节点，所述协商结果数据包括所述协同签名信息、所述共享公钥以及所述密钥验证参数；以由所述共识节点对所述协商结果数据进行共识，并在所述协商结果数据通过共识后，将所述协商结果数据提交至所述区块链网络的区块链中。
一方面，本申请实施例提供了一种基于区块链网络的密钥生成方法，由区块链网络中的共识节点执行，所述方法包括：
接收第一设备发送的密钥协商请求，所述密钥协商请求用于请求所述共识节点返回密钥验证参数；
向所述第一设备返回所述密钥验证参数，以使所述第一设备与所述第二设备进行协同密钥对的协商，得到第一私钥分量、第二私钥分量以及共享公钥；并使所述第一设备和所述第二设备分别采用所述第一私钥分量和所述第二私钥分量，对所述密钥验证参数进行协同签名得到协同签名信息；
接收所述第二设备发送的协商结果数据，所述协商结果数据包括所述协同签名信息、所述共享公钥以及所述密钥验证参数；
对所述协商结果数据进行共识；若共识通过，则将所述协商结果数据提交至所述区块链网络的区块链中。
一方面，本申请实施例提供了一种密钥生成装置，所述密钥生成装置运行于第一设备中；所述装置包括：
发送单元，用于向区块链网络中的共识节点发送密钥协商请求，以请求共识节点返回密钥验证参数；
处理单元，用于若接收到所述共识节点返回的密钥验证参数，则与所述第二设备进行所述协同密钥对的协商，得到所述协同密钥对中的第一私钥分量和共享公钥；所述协同密钥对中的第二私钥分量由所述第二设备持有，所述共享公钥用于校验采用所述第一私钥分量和所述第二私钥分量进行协同签名得到的协同签名信息的有效性；
所述处理单元，还用于采用所述第一私钥分量对所述密钥验证参数进行签名，得到第一签名分量；并根据所述第一签名分量和所述密钥验证参数生 成交易数据；
所述发送单元，还用于将所述交易数据发送至所述第二设备，以使所述第二设备采用所述第二私钥分量对所述交易数据进行签名得到第二签名分量，并根据所述第一签名分量和所述第二签名分量得到协同签名信息，将协商结果数据发送至所述共识节点，所述协商结果数据包括所述协同签名信息、所述共享公钥和所述密钥验证参数；由所述共识节点对所述协商结果数据进行共识，并在所述协商结果数据通过共识后，将所述协商结果数据提交至所述区块链网络的区块链中。
一方面，本申请实施例提供了一种密钥生成装置，所述密钥生成装置运行于第二设备中；所述装置包括：
处理单元，用于与第一设备进行协同密钥对的协商，得到所述协同密钥对中的第二私钥分量和共享公钥；所述协同密钥对中的第一私钥分量由所述第一设备持有，所述共享公钥用于校验采用所述第一私钥分量和所述第二私钥分量进行协同签名得到的协同签名信息的有效性；
接收单元，用于接收所述第一设备发送的交易数据，所述交易数据是根据第一签名分量和密钥验证参数生成的，所述第一签名分量是由所述第一设备采用所述第一私钥分量对密钥验证参数进行签名得到的；所述密钥验证参数是区块链网络中的共识节点响应于所述第一设备发送密钥协商请求返回的；
处理单元，还用于采用所述第二私钥分量对所述交易数据进行签名得到第二签名分量，并根据所述第一签名分量和所述第二签名分量得到协同签名信息；
发送单元，用于将协商结果数据发送至所述共识节点，所述协商结果数据包括所述协同签名信息、所述共享公钥以及所述密钥验证参数；以由所述共识节点对所述协商结果数据进行共识，并在所述协商结果数据通过共识后，将所述协商结果数据提交至所述区块链网络的区块链中。
一方面，本申请实施例提供了一种密钥生成装置，所述密钥生成装置运行于共识节点中；所述装置包括：
接收单元，用于接收第一设备发送的密钥协商请求，所述密钥协商请求用于请求所述共识节点返回密钥验证参数；
发送单元，用于向所述第一设备返回所述密钥验证参数，以使所述第一设备与所述第二设备进行协同密钥对的协商，得到第一私钥分量、第二私钥分量以及共享公钥；并使所述第一设备和所述第二设备分别采用所述第一私钥分量和所述第二私钥分量，对所述密钥验证参数进行协同签名得到协同签名信息；
所述接收单元，还用于接收所述第二设备发送的协商结果数据，所述协商结果数据包括所述协同签名信息、所述共享公钥以及所述密钥验证参数；
共识单元，用于对所述协商结果数据进行共识；若共识通过，则将所述协商结果数据提交至所述区块链网络的区块链中。
一方面，本申请实施例提供了一种计算机设备，所述计算机设备为上述所提及的第一设备、第二设备和共识节点中的任意一者；所述计算机设备包括输入接口和输出接口，所述计算机设备还包括：
处理器，适于实现一条或多条指令；以及，计算机存储介质；
若所述计算机设备为第一设备，则所述计算机存储介质存储有一条或多条第一指令，所述一条或多条第一指令适于由所述处理器加载并执行上述第一设备侧的密钥生成方法；
若所述计算机设备为第二设备，则所述计算机存储介质存储有一条或多条第二指令，所述一条或多条第二指令适于由所述处理器加载并执行上述第二设备侧的密钥生成方法；
若所述计算机设备为共识节点，则所述计算机存储介质存储有一条或多条第三指令，所述一条或多条第三指令适于由所述处理器加载并执行共识节点侧的密钥生成方法。
一方面，本申请实施例提供了一种计算机存储介质，所述计算机存储介质存储有一条或多条第一指令，所述一条或多条第一指令适于由处理器加载并执行上述第一设备所执行的密钥生成方法；或者，所述计算机存储介质存储有一条或多条第二指令，所述一条或多条第二指令适于由处理器加载并执行上述第二设备所执行的密钥生成方法；或者，所述计算机存储介质存储有一条或多条第三指令，所述一条或多条第三指令适于由处理器加载并执行上述共识节点所执行的密钥生成方法。
一方面，本申请实施例提供了一种计算机程序产品或计算机程序，该计算机程序产品或计算机程序包括计算机指令，该计算机指令存储在计算机可读存储介质中。计算机设备的处理器从计算机可读存储介质读取该计算机指令，处理器执行该计算机指令，使得该计算机设备执行上述第一设备侧的密钥生成方法、或者上述第二设备侧的密钥生成方法、或者述共识节点侧的密钥生成方法。
本申请实施例中的第一设备可先向区块链网络中的共识节点发送密钥协商请求；若接收到共识节点返回的密钥验证参数，则可与第二设备进行协同密钥对的协商，得到协同密钥对中的第一私钥分量和共享公钥；该协同密钥对中的第二私钥分量由第二设备持有。其次，第一设备和第二设备可分别采用第一私钥分量和第二私钥分量对密钥验证参数进行协同签名，得到第一签名分量和第二签名分量，并进一步根据第一签名分量和第二签名分量得到协同签名信息。然后，第二设备可将携带协同签名信息、共享公钥以及密钥验证参数的协商结果数据发送至共识节点，由共识节点在确定协商结果数据通过共识后，将协商结果数据提交至区块链网络的区块链中。本申请实施例中 的第一设备和第二设备分别持有一个私钥分量，任一设备均无法持有完整的私钥，可有效提高协同密钥对的安全性；通过区块链网络中的共识节点下发的密钥验证参数，实现将协同密钥对的协商过程以及协商结果的上链，保证协商过程的公开透明，并且能够提高协同密钥对的可靠性和安全性。
附图说明
为了更清楚地说明本申请实施例技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1a是本申请实施例提供的一种区块链的结构示意图；
图1b是本申请实施例提供的一种密钥生成系统的架构示意图；
图1c是本申请实施例提供的一种密钥生成系统的架构示意图；
图1d是本申请实施例提供的一种密钥生成系统的架构示意图；
图2是本申请实施例提供的一种密钥生成方法的流程示意图；
图3是本申请实施例提供的一种密钥生成方法的流程示意图；
图4a是本申请实施例提供的一种将协商结果数据打包成目标区块的示意图；
图4b是本申请实施例提供的一种将目标区块添加至区块链的流程示意图；
图5是本申请实施例提供的一种密钥生成装置的结构示意图；
图6是本申请实施例提供的一种密钥生成装置的结构示意图；
图7是本申请实施例提供的一种密钥生成装置的结构示意图；
图8是本申请实施例提供的一种计算机设备的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述。
区块链网络是一种由点对点网络(P2P网络)和区块链构成的网络，其内部包括多个节点设备(简称节点)；区块链网络中的节点具体是指进行数据处理的计算机设备，其可以包括但不限于：智能终端、平板电脑以及台式计算机等终端设备、服务设备(如数据服务器、云服务器)等等。区块链网络中每个节点的内部均存储有相同的区块链，此处的区块链是一种基于分布式数据存储、点对点传输(P2P传输)、共识机制、加密算法等计算机技术实现的新型应用模式，其本质上是一个去中心化的数据库。
参见图1a所示，区块链可由多个区块组成；此处的区块是指用于记录输入信息的数据结构。其中，创世块(即第一个区块)中包括区块头和区块主体，区块头中存储有输入信息的哈希值、随机数、版本号、当前时间戳和当 前难度值，区块主体中存储有创世块的输入信息。创世块的下一区块以创世块为父区块，下一区块中同样包括区块头和区块主体；其区块头中存储有当前区块的输入信息的哈希值、父区块哈希值、随机数、版本号、当前时间戳和当前难度值，其区块主体中存储有当前区块的输入信息。以此类推，区块链中每个区块存储的区块数据均与其父区块存储的区块数据存在关联，可有效保证区块中存储的输入信息的安全性。其中，版本号是指区块链中相关区块协议的版本信息；父区块哈希值是指上一区块的区块头部的哈希值；当前时间戳是指组成区块头部时的系统时间；当前难度值是指计算的难度值，该难度值在固定时间段内为定值，并在超出固定时间段后再次进行确定。
由上述可知，区块链网络可有效保证区块中存储的各数据的安全性；基于此，本申请实施例提出了一种基于区块链网络的密钥生成系统。具体的，该密钥生成系统可至少包括：第一设备11、第二设备12以及区块链网络中的共识节点13。其中，第一设备11和第二设备12均可为以下任一种：智能终端、平板电脑以及台式计算机等终端设备、服务设备(如数据服务器、云服务器)等等；共识节点13是指区块链网络中可参与共识的节点。在具体实现中，第一设备11可与第二设备12以及共识节点13进行通信；同理，第二设备12也可与第一设备11以及共识节点13进行通信。
应理解的是，本申请实施例所提出的密钥生成系统的具体架构，可根据实际业务需求进行物理部署。在一种实施方式中，可将第一设备11和第二设备12均部署在区块链网络外；在此情况下，密钥生成系统的架构示意图可参见图1b所示。在一种实施方式中，可将第一设备11部署在区块链网络内，将第二设备12部署在区块链网络外；在此情况下，密钥生成系统的架构示意图可参见图1c所示。在一种实施方式中，可将第一设备11部署在区块链网络外，将第二设备12部署在区块链网络内；在此情况下，密钥生成系统的架构示意图可参见图1d所示。
应理解的是，本申请实施所提出的密钥生成系统的具体架构并不局限于图1b-图1d所示；例如，也可将第一设备11和第二设备12均部署在区块链网络内；又如，区块链网络除了可以包括共识节点13以外，还可包括其他节点(如提供存储服务的SPV(Simplified Payment Verification，简单支付验证)节点、提供业务处理服务的业务节点)，等等。
基于上述的密钥生成系统，本申请实施例还提出了一种密钥生成方案。该密钥生成方案主要用于在第一设备和第二设备之间生成协同密钥对，使得第一设备和第二设备分别持有协同密钥对中的部分私钥分量，以便后续第一设备和第二设备可采用各自持有的私钥分量对同一个数据进行协同签名。所谓的协同签名是指由两个或两个以上的参与者采用各自持有的私钥分量，协同一致地完成对某个数据进行签名的过程。
其中，该密钥生成方案的大致原理如下：首先，存在协同签名需求的任 一方(如第一设备或第二设备)，向区块链网络中的共识节点提交一个密钥协商请求，使得共识节点为其生成一个密钥验证参数X。接着，第一设备和第二设备进行协同密钥对的协商；使得第一设备持有协同密钥对中的第一私钥分量和共享公钥，第二设备持有协同密钥对中的第二私钥分量和共享公钥。进而，第一设备和第二设备可分别采用第一私钥分量和第二私钥分量对密钥验证参数X进行一次协同签名，得到协同签名信息。然后，任一方(如第一设备或第二设备)可将协同签名信息、共享公钥和密钥验证参数X一并发送给共识节点，以表示第一设备和第二设备均同意此次密钥协商的结果。相应的，共识节点可对任一方所发送的数据进行共识；并在共识通过后，将这些数据添加至区块链中进行存储。
由此可见，本申请实施例所提出的密钥生成方案可使得第一设备和第二设备分别持有一个私钥分量，任一设备均无法持有完整的私钥，可有效保证协同密钥对的安全性。区块链网络中的共识节点通过密钥验证参数，实现将协同密钥对的协商过程以及协商结果的上链，可保证协商过程的公开透明，并且提高协同密钥对的可靠性和安全性。
基于上述的描述，本申请实施例提出一种基于区块链网络的密钥生成方法。请参见图2，该密钥生成方法可包括以下步骤S201-S208：
S201，第一设备向区块链网络中的共识节点发送密钥协商请求。
在具体实现中，若第一设备和第二设备之间欲进行协同密钥对的协商，则第一设备可先生成一个密钥协商请求。然后，第一设备可向区块链网络中的共识节点发送该密钥协商请求，以请求共识节点同意第一设备与第二设备协商协同密钥对，并返回密钥验证参数。相应的，共识节点在接收到该密钥协商请求后，若同意第一设备和第二设备协商协同密钥对，则可调用智能合约随机生成一个密钥验证参数，并可通过步骤S202将该密钥验证参数返回给第一设备。
S202，共识节点返回密钥验证参数。
S203，第一设备若接收到共识节点返回的密钥验证参数，则与第二设备进行协同密钥对的协商，得到协同密钥对中的第一私钥分量和共享公钥。
第一设备若接收到共识节点返回的密钥验证参数，则可确定共识节点已同意第一设备和第二设备协商协同密钥对。此时，第一设备可与第二设备进行协同密钥对的协商，得到协同密钥对中的第一私钥分量和共享公钥。
应理解的是，第二设备也可与第一设备进行协同密钥对的协商，得到协同密钥对中的第二私钥分量和共享公钥；即经过协商之后，协同密钥对中的第一私钥分量由第一设备持有，协同密钥对中的第二私钥分量由第二设备持有。协同密钥对中的共享公钥可用于校验采用第一私钥分量和第二私钥分量进行协同签名得到的协同签名信息的有效性。
在一种实施方式中，步骤S203可包括如下步骤：首先，第一设备可获取第一设备和第二设备之间约定的随机数；该随机数是由第一设备或者第二设备采用随机算法生成的。其次，第一设备可采用密钥算法根据随机数生成协同密钥对，该协同密钥对包括一个私钥和一个公钥。具体的，第一设备可将随机数确定为密钥长度，采用密钥算法(如非对称加密算法)生成密钥长度的协同密钥对，即协同密钥对中私钥的长度和公钥的长度均等于密钥长度。或者，第一设备可直接将随机数作为协同密钥对中的公钥，并采用密钥算法计算出与该公钥相对应的私钥，该公钥和私钥组成协同密钥对。
然后，第一设备可将协同密钥对中的公钥作为共享公钥，并将协同密钥对中的私钥拆分成第一私钥分量和第二私钥分量；其中，第二私钥分量可被发送至第二设备。即在协商完成之后，第一设备可将第二私钥分量和共享公钥发送至第二设备。
相应的，在此实施方式下，第二设备与第一设备进行协同密钥对的协商，得到协同密钥对中的第二私钥分量和共享公钥的具体实施方式可以是：接收第一设备发送的第二私钥分量和共享公钥。其中，共享公钥是第一设备采用密钥算法根据随机数生成的协同密钥对中的公钥，第二私钥分量是由第一设备对协同密钥对中的私钥进行拆分得到的。
在一种实施方式中，步骤S203可包括如下步骤：首先，获取第一设备和第二设备之间约定的随机数；该随机数是由第一设备或者第二设备采用随机算法生成的。其次，第一设备可采用密钥算法根据随机数生成第一私钥分量和第一公钥。具体的，第一设备可将随机数确定为密钥长度，采用密钥算法生成密钥长度的第一私钥分量和第一公钥，即第一私钥分量的长度和第一公钥的长度均等于密钥长度。然后，第一设备可接收第二设备发送的第二公钥，并根据第一公钥和第二公钥生成共享公钥；其中，第二公钥是由第二设备采用密钥算法根据该随机数生成的。接着，第一设备可整合第一公钥和第二公钥，得到共享公钥。可选的，第一设备还可将共享公钥发送给第二设备；或者，第一设备可将第一公钥发送至第二设备，使得第二设备整合第一公钥和第二公钥，得到共享公钥。采用此实施方式，可使得只有第一设备知道第一私钥分量，且只有第二设备知道第二私钥分量，可进一步提高私钥分量的安全性和私密性。
相应的，在此实施方式下，第二设备与第一设备进行协同密钥对的协商，得到协同密钥对中的第二私钥分量和共享公钥的具体实施方式可以是：获取第一设备和第二设备之间约定的随机数；采用密钥算法根据随机数生成第二私钥分量和第二公钥；将第二公钥发送至第一设备，由第一设备根据第一公钥和第二公钥生成共享公钥，第一公钥是由第一设备采用密钥算法根据随机数生成的；接收第一设备返回的共享公钥。或者，第二设备也可接收第一设备发送的第一公钥，整合第一公钥和第二公钥，得到共享公钥。
S204，第一设备采用第一私钥分量对密钥验证参数进行签名，得到第一签名分量；并根据第一签名分量和密钥验证参数生成交易数据。
S205，第一设备将交易数据发送至第二设备。
在得到交易数据后，第一设备可将交易数据发送至第二设备，使得第二设备采用第二私钥分量对交易数据进行签名得到第二签名分量，并根据第一签名分量和第二签名分量得到协同签名信息，将携带协同签名信息、共享公钥以及密钥验证参数的协商结果数据发送至共识节点；由共识节点对协商结果数据进行共识，并在协商结果数据通过共识后，将协商结果数据提交至区块链网络的区块链中。
需要说明的是，本申请实施例所提及的交易数据是指第一设备和第二设备之间进行交互的数据，其并不是指商业化的数据。
相应的，第二设备接收到第一设备发送的交易数据后，可执行步骤S206-S207。其中，交易数据是根据第一签名分量和密钥验证参数生成的，该第一签名分量是由第一设备采用第一私钥分量对密钥验证参数进行签名得到的，该密钥验证参数是第一设备向区块链网络中的共识节点发送密钥协商请求后，由共识节点返回给第一设备的。
S206，第二设备采用第二私钥分量对交易数据进行签名得到第二签名分量，并根据第一签名分量和第二签名分量得到协同签名信息。
S207，第二设备将携带协同签名信息、共享公钥以及密钥验证参数的协商结果数据发送至共识节点。
在步骤S206-S207中，第二设备可先采用第二私钥分量对交易数据进行签名，得到第二签名分量。具体的，第二设备可直接采用第二私钥分量对交易数据进行签名，得到第二签名分量；也可采用第二私钥分量对交易数据中的密钥验证参数进行签名，得到第二签名分量。
其次，第二设备可整合第一签名分量和第二签名分量，得到协同签名信息。然后，根据协同签名信息、共享公钥以及密钥验证参数生成协商结果数据，并将该协商结果数据发送至共识节点，由共识节点对协商结果数据进行共识，并在协商结果数据通过共识后，将协商结果数据提交至区块链网络的区块链中。
相应的，共识节点可接收第二设备发送的协商结果数据，该协商结果数据携带协同签名信息、共享公钥以及密钥验证参数。然后，共识节点可对协商结果数据执行如下步骤S208：对协商结果数据进行共识；若共识通过，则将协商结果数据提交至区块链网络的区块链中。
应理解的是，第二设备在得到协同签名信息后，也可将协同签名信息返回给第一设备；由第一设备将携带协同签名信息、共享公钥以及密钥验证参数的协商结果数据发送至共识节点。
本申请实施例中的第一设备可先向区块链网络中的共识节点发送密钥协 商请求；若接收到共识节点返回的密钥验证参数，则可与第二设备进行协同密钥对的协商，得到协同密钥对中的第一私钥分量和共享公钥；该协同密钥对中的第二私钥分量由第二设备持有。其次，第一设备和第二设备可分别采用第一私钥分量和第二私钥对密钥验证参数进行协同签名，得到第一签名分量和第二签名分量，并进一步根据第一签名分量和第二签名分量得到协同签名信息。然后，第二设备可将携带协同签名信息、共享公钥以及密钥验证参数的协商结果数据发送至共识节点，由共识节点在确定协商结果数据通过共识后，将协商结果数据提交至区块链网络的区块链中。本申请实施例中的第一设备和第二设备分别持有一个私钥分量，且任一设备均无法持有完整的私钥，这可有效提高协同密钥对的安全性；通过区块链网络中的共识节点下发的密钥验证参数，实现将协同密钥对的协商过程以及协商结果的上链，可保证协商过程的公开透明，并且能够提高协同密钥对的可靠性和安全性。
请参见图3，是本申请实施例提供的一种基于区块链网络的密钥生成方法的流程示意图。请参见图3，该密钥生成方法可包括以下步骤S301-S314：
S301，第一设备生成协商信息。
S302，第一设备根据协商信息生成密钥协商通知。
S303，第一设备向第二设备发送密钥协商通知。
在步骤S301-S303中，若第一设备想要和第二设备之间进行协同密钥对的协商，则第一设备可先生成协商信息；该协商信息可用于指示第一设备请求与所述第二设备协商协同密钥对。然后，可根据协商信息生成密钥协商通知，并向第二设备发送密钥协商通知。
在一种具体实现中，根据协商信息生成密钥协商通知的具体实施方式可以是：直接将协商信息作为密钥协商通知。
在一种具体实现中，根据协商信息生成密钥协商通知的具体实施方式可以是：先采用第一设备的系统私钥对协商信息进行签名，得到第一设备的系统数字签名；其中，第一设备的系统私钥可以是由第一设备采用密钥算法随机生成的。然后，采用协商信息和第一设备的系统数字签名，生成密钥协商通知。即在此实施方式下，密钥协商通知可携带协商信息，以及采用第一设备的系统私钥对协商信息进行签名得到的第一设备的系统数字签名；通过将第一设备的系统数字签名添加至密钥协商通知中，可使得第二设备根据第一设备的系统数字签名对第一设备进行身份校验，提高安全性和可靠性。
相应的，第二设备可接收第一设备的密钥协商通知，该密钥协商通知是根据协商信息生成的。然后，第二设备可决定是否与第一设备协商协同密钥对；若第二设备同意，则第二设备可执行步骤S304。若第二设备不同意，则第二设备可向第一设备返回一个拒绝通知，并结束本流程。其中，拒绝通知用于指示第二设备不同意和第一设备协商协同密钥对。
S304，第二设备若同意和第一设备协商协同密钥对，则向第一设备返回响应信息。
在一种具体实现中，第二设备若同意和第一设备协商协同密钥对，则第二设备可直接向第一设备返回响应信息；即响应信息可以是由第二设备同意和第一设备协商协同密钥对之后直接发送的。
在一种具体实现中，若密钥协商通知携带协商信息，以及采用第一设备的系统私钥对协商信息进行签名得到的第一设备的系统数字签名；则第二设备可先根据第一设备的系统数字签名对第一设备进行身份校验，并在第一设备通过身份校验后，向第一设备发送响应信息。具体的，若同意和第一设备协商协同密钥对，则第二设备可先获取第一设备的系统公钥，并采用第一设备的系统公钥对第一设备的系统数字签名进行验证；若验证成功，则可确定第一设备通过身份校验，此时可向第一设备发送响应信息。
进一步的，若验证成功，第二设备还可采用第二设备的系统私钥对密钥协商通知进行签名，得到第二设备的系统数字签名；然后根据密钥协商通知和第二设备的系统数字签名，生成响应信息，并向第一设备发送该响应信息。即响应信息也可以是第二设备同意和第一设备协商协同密钥对，且采用第一设备的系统公钥成功验证第一设备的系统数字签名后发送的。
S305，第一设备若接收到第二设备返回的响应信息，则生成密钥协商请求。
在一种具体实现中，第一设备若接收到第二设备返回的响应信息，则可确定第二设备已同意和第一设备协商协同密钥对，此时可直接生成密钥协商请求。
在一种具体实现中，若响应信息携带采用第二设备的系统私钥对密钥协商通知进行签名得到的第二设备的系统数字签名；则步骤S305的具体实施方式可以是：第一设备若接收到第二设备返回的响应信息，则获取第二设备的系统公钥，并采用第二设备的系统公钥验证第二设备的系统数字签名；若第二设备的系统数字签名通过验证，则采用第一设备的系统数字签名、第二设备的系统数字签名以及协商信息生成密钥协商请求。
S306，第一设备向共识节点发送密钥协商请求。
S307，共识节点向第一设备返回密钥验证参数。
在步骤S306-S307中，由于密钥协商请求用于请求共识节点同意第一设备与第二设备协商协同密钥对，并返回密钥验证参数。因此，共识节点在接收到第一设备发送的密钥协商请求后，可调用智能合约生成一个密钥验证参数。然后，可向第一设备返回该密钥验证参数，使得第一设备与第二设备进行协同密钥对的协商，得到第一私钥分量、第二私钥分量以及共享公钥；并使得第一设备和第二设备分别采用第一私钥分量和第二私钥分量，对密钥验证参数进行签名得到第一签名分量和第二签名分量，进而根据第一签名分量 和第二签名分量得到协同签名信息。
S308，第一设备若接收到共识节点返回的密钥验证参数，则与第二设备进行协同密钥对的协商，得到协同密钥对中的第一私钥分量和共享公钥。相应的，第二设备也可通过和第一设备进行协同密钥对的协商，得到协同密钥中的第二私钥分量和共享公钥。
S309，第一设备采用第一私钥分量对密钥验证参数进行签名，得到第一签名分量；并根据第一签名分量和密钥验证参数生成交易数据。
S310，第一设备将交易数据发送至第二设备；相应的，第二设备可接收第一设备发送的交易数据。
S311，第二设备采用第二私钥分量对交易数据进行签名得到第二签名分量，并根据第一签名分量和第二签名分量得到协同签名信息。
S312，第二设备将携带协同签名信息、共享公钥以及密钥验证参数的协商结果数据发送至共识节点。相应的，共识节点可接收第二设备发送的协商结果数据，并执行步骤S313-314。
S313，共识节点对协商结果数据进行共识。
在具体实现中，共识节点可先解析协商结果数据，得到协同签名信息、所述共享公钥以及密钥验证参数。然后，共识节点可采用共享公钥对协同签名信息的有效性进行校验。若校验通过，则确定协商结果数据通过共识；否则，则确定协商结果数据未通过共识。
应理解的是，若区块链网络中只包含一个共识节点，则该共识节点在确定协同签名信息通过有效性校验后，便可直接确定协商结果数据通过共识。若区块链网络中包含多个共识节点，则这多个共识节点可根据自身对协同签名信息的有效性校验结果，对该协商结果数据是否通过共识进行投票；然后，根据各个共识节点的投票结果(如“支持此协同签名信息通过校验”或“反对此协同签名信息通过校验”)来最终确定协商结果数据是否通过共识。若大部分的共识节点(如2/3的共识节点)的投票结果均为“支持此协同签名信息通过校验”，则可确定协商结果数据通过共识。
S314，若共识通过，则共识节点将协商结果数据提交至区块链网络的区块链中。
在具体实现中，若协商结果数据通过共识，则可先将协商结果数据打包成目标区块。其中，将协商结果数据打包成目标区块的具体流程如下：共识节点可将协商结果数据添加至目标区块的区块主体中，如图4a所示。可选的，共识节点还可对协商结果数据进行签名，然后将协商结果数据的签名信息和协商结果数据一并添加至目标区块的区块主体中。
其次，共识节点可采用默克尔树算法(Merkle Tree算法)对区块主体中的协商结果数据进行哈希运算，得到协商结果数据的哈希值。然后，共识节点可采用随机算法生成一个随机数，并采用计算得到的协商结果数据的哈希 值、随机数、版本号、父区块哈希值、当前时间戳以及当前难度值组成目标区块的区块头部。
并可采用特征值算法(如SHA256算法)对区块头部所包含的内容进行多次哈希运算，得到目标区块的区块头部的哈希值；此处的哈希运算的次数可根据计算难度确定，计算难度越大，哈希运算的次数越多。若目标区块的区块头部的哈希值小于预设阈值，则表明目标区块的区块头部是有效的，此时便可得到有效的目标区块。若目标区块的区块头部的哈希值不小于预设阈值，则表明目标区块的区块头部是无效的；此时需要跳转至“采用随机算法生成一个随机数”的步骤，直至生成有效的区块头部。在得到目标区块之后，共识节点便可将目标区块添加至区块链网络的区块链中，如图4b所示。
本申请实施例中的第一设备可先向区块链网络中的共识节点发送密钥协商请求；若接收到共识节点返回的密钥验证参数，则可与第二设备进行协同密钥对的协商，得到协同密钥对中的第一私钥分量和共享公钥；该协同密钥对中的第二私钥分量由第二设备持有。其次，第一设备和第二设备可分别采用第一私钥分量和第二私钥对密钥验证参数进行协同签名，得到第一签名分量和第二签名分量，并进一步根据第一签名分量和第二签名分量得到协同签名信息。然后，第二设备可将携带协同签名信息、共享公钥以及密钥验证参数的协商结果数据发送至共识节点，由共识节点在确定协商结果数据通过共识后，将协商结果数据提交至区块链网络的区块链中。本申请实施例中的第一设备和第二设备分别持有一个私钥分量，且任一设备均无法持有完整的私钥，这可有效提高协同密钥对的安全性；通过区块链网络中的共识节点下发的密钥验证参数，实现将协同密钥对的协商过程以及协商结果的上链，可保证协商过程的公开透明，并且能够提高协同密钥对的可靠性和安全性。
基于上述方法实施例的描述，本申请实施例还公开了一种密钥生成装置。该密钥生成装置可以是运行于第一设备中的一个计算机程序(包括程序代码)，该密钥生成装置可以执行图2和图3所示的部分方法步骤。请参见图5，所述密钥生成装置可以运行如下单元：
发送单元501，用于向区块链网络中的共识节点发送密钥协商请求，以请求共识节点返回密钥验证参数；
处理单元502，用于若接收到共识节点返回的密钥验证参数，则与第二设备进行协同密钥对的协商，得到协同密钥对中的第一私钥分量和共享公钥；协同密钥对中的第二私钥分量由第二设备持有，共享公钥用于校验采用第一私钥分量和第二私钥分量进行协同签名得到的协同签名信息的有效性；
处理单元502，还用于采用第一私钥分量对密钥验证参数进行签名，得到第一签名分量；并根据第一签名分量和密钥验证参数生成交易数据；
发送单元501，还用于将交易数据发送至第二设备，以使第二设备采用 第二私钥分量对交易数据进行签名得到第二签名分量，并根据第一签名分量和第二签名分量得到协同签名信息，将协商结果数据发送至共识节点，所述协商结果数据包括协同签名信息、共享公钥和密钥验证参数；由共识节点对协商结果数据进行共识，并在协商结果数据通过共识后，将协商结果数据提交至区块链网络的区块链中。
在一种实施方式中，处理单元502在用于与第二设备进行协同密钥对的协商，得到协同密钥对中的第一私钥分量和共享公钥时，具体用于：获取第一设备和第二设备之间约定的随机数，随机数是由第一设备或者第二设备采用随机算法生成的；采用密钥算法根据随机数生成协同密钥对，协同密钥对包括一个私钥和一个公钥；将协同密钥对中的公钥作为共享公钥，将协同密钥对中的私钥拆分成第一私钥分量和第二私钥分量；第二私钥分量被发送至第二设备。
在一种实施方式中，处理单元502在用于与第二设备进行协同密钥对的协商，得到协同密钥对中的第一私钥分量和共享公钥时，可具体用于：获取第一设备和第二设备之间约定的随机数，随机数是由第一设备或者第二设备采用随机算法生成的；采用密钥算法根据随机数生成第一私钥分量和第一公钥；接收第二设备发送的第二公钥，并根据第一公钥和第二公钥生成共享公钥；其中，第二公钥是由第二设备采用密钥算法根据随机数生成的。
在一种实施方式中，处理单元502还可用于：生成协商信息，协商信息用于指示第一设备请求与第二设备协商协同密钥对；以及根据协商信息生成密钥协商通知；
发送单元501还可用于：向第二设备发送密钥协商通知；
处理单元502还可用于：若接收到第二设备针对密钥协商通知返回的响应信息，则生成密钥协商请求。
在一种实施方式中，处理单元502在用于根据协商信息生成密钥协商通知时，可具体用于：采用第一设备的系统私钥对协商信息进行签名，得到第一设备的系统数字签名；采用协商信息和第一设备的系统数字签名，生成密钥协商通知；其中，响应信息是第二设备同意和第一设备协商协同密钥对，且采用第一设备的系统公钥成功验证第一设备的系统数字签名后发送的。
在一种实施方式中，响应信息携带采用第二设备的系统私钥对密钥协商通知进行签名得到的第二设备的系统数字签名；相应的，处理单元502在用于若接收到第二设备针对密钥协商通知返回的响应信息，则生成密钥协商请求时，具体用于：若接收到第二设备针对密钥协商通知返回的响应信息，则获取第二设备的系统公钥，并采用第二设备的系统公钥验证第二设备的系统数字签名；若第二设备的系统数字签名通过验证，则采用第一设备的系统数字签名、第二设备的系统数字签名以及协商信息生成密钥协商请求。
根据本申请的一个实施例，图2或图3所示的方法所涉及的部分步骤可 以由图5所示的密钥生成装置中的各个单元来执行。例如，图2中所示的步骤S201和S205可由图5中所示的发送单元501来执行，步骤S203和S204可由图5中所示的处理单元502来执行；又如，图3中所示的步骤S301、S302、S305以及S308-S309均可由图5中所示的处理单元502来执行，步骤S303、S306以及S310可由图5中所示的发送单元501来执行。
根据本申请的另一个实施例，图5所示的密钥生成装置中的各个单元可以分别或全部合并为一个或若干个另外的单元来构成，或者其中的某个(些)单元还可以再拆分为功能上更小的多个单元来构成，这可以实现同样的操作，而不影响本申请的实施例的技术效果的实现。上述单元是基于逻辑功能划分的，在实际应用中，一个单元的功能也可以由多个单元来实现，或者多个单元的功能由一个单元实现。在本申请的其它实施例中，基于密钥生成装置也可以包括其它单元，在实际应用中，这些功能也可以由其它单元协助实现，并且可以由多个单元协作实现。
根据本申请的另一个实施例，可以在通用计算设备上运行能够执行如图2或图3中所示的相应方法所涉及的部分步骤的计算机程序(包括程序代码)，该通用计算设备具体可以为计算机等，其中包括中央处理单元(CPU)、随机存取存储介质(RAM)、只读存储介质(ROM)等处理元件和存储元件，处理元件和存储元件相配合可实现本申请实施例的密钥生成方法。所述计算机程序可以记载于例如计算机可读记录介质上，并通过计算机可读记录介质装载于上述通用计算设备中，并在其中运行。
基于上述方法实施例的描述，本申请实施例还公开了一种密钥生成装置。该密钥生成装置可以是运行于第二设备中的一个计算机程序(包括程序代码)，该密钥生成装置可以执行图2和图3所示的部分方法步骤。请参见图6，所述密钥生成装置可以运行如下单元：
处理单元601，用于与第一设备进行协同密钥对的协商，得到协同密钥对中的第二私钥分量和共享公钥；协同密钥对中的第一私钥分量由第一设备持有，共享公钥用于校验采用第一私钥分量和第二私钥分量进行协同签名得到的协同签名信息的有效性；
接收单元602，用于接收第一设备发送的交易数据，交易数据是根据第一签名分量和密钥验证参数生成的，所述第一签名分量是由第一设备采用第一私钥分量对密钥验证参数进行签名得到的；密钥验证参数是区块链网络中的共识节点响应于第一设备发送的密钥协商请求返回的；
处理单元601，还用于采用第二私钥分量对交易数据进行签名得到第二签名分量，并根据第一签名分量和第二签名分量得到协同签名信息；
发送单元603，用于将协商结果数据发送至共识节点，协商结果数据包括协同签名信息、共享公钥以及密钥验证参数；以由共识节点对协商结果数 据进行共识，并在协商结果数据通过共识后，将协商结果数据提交至区块链网络的区块链中。
在一种实施方式中，处理单元601在用于与第一设备进行协同密钥对的协商，得到协同密钥对中的第二私钥分量和共享公钥时，可具体用于：接收第一设备发送的第二私钥分量和共享公钥；其中，共享公钥是第一设备采用密钥算法根据随机数生成的协同密钥对中的公钥，第二私钥分量是由第一设备对协同密钥对中的私钥进行拆分得到的；随机数是第一设备与第二设备之间约定的，且随机数是由第一设备或者第二设备采用随机算法生成的。
在一种实施方式中，处理单元601在用于与第一设备进行协同密钥对的协商，得到协同密钥对中的第二私钥分量和共享公钥时，可具体用于：获取第一设备和第二设备之间约定的随机数，随机数是由第一设备或者第二设备采用随机算法生成的；采用密钥算法根据随机数生成第二私钥分量和第二公钥；将第二公钥发送至第一设备，由第一设备根据第一公钥和第二公钥生成共享公钥，第一公钥是由第一设备采用密钥算法根据随机数生成的；接收第一设备返回的共享公钥。
在一种实施方式中，接收单元602还可用于：接收第一设备发送的密钥协商通知，密钥协商通知是根据协商信息生成的；协商信息用于指示第一设备请求与第二设备协商协同密钥对；
发送单元603还可用于：若同意和第一设备协商协同密钥对，则向第一设备返回响应信息。
在一种实施方式中，密钥协商通知中包括协商信息，以及采用第一设备的系统私钥对协商信息进行签名得到的第一设备的系统数字签名；相应的，发送单元603在用于若同意和第一设备协商协同密钥对，则向第一设备返回响应信息时，可具体用于：若同意和第一设备协商协同密钥对，则采用第一设备的系统公钥对第一设备的系统数字签名进行验证；若验证成功，则向第一设备发送响应信息。
在一种实施方式中，发送单元603在用于若验证成功，则向第一设备发送响应信息时，可具体用于：若验证成功，则采用第二设备的系统私钥对密钥协商通知进行签名，得到第二设备的系统数字签名；根据密钥协商通知和第二设备的系统数字签名，生成响应信息；向第一设备发送响应信息。
根据本申请的一个实施例，图2或图3所示的方法所涉及的部分步骤可以由图6所示的密钥生成装置中的各个单元来执行。例如，图2中所示的步骤S206可由图6中所示的处理单元601来执行，步骤S207可由图6中所示的发送单元603来执行；又如，图3中所示的S308和S311可由图6中所示的处理单元601来执行，步骤S304和步骤S312可由图6中所示的发送单元603来执行。
根据本申请的另一个实施例，图6所示的密钥生成装置中的各个单元可 以分别或全部合并为一个或若干个另外的单元来构成，或者其中的某个(些)单元还可以再拆分为功能上更小的多个单元来构成，这可以实现同样的操作，而不影响本申请的实施例的技术效果的实现。上述单元是基于逻辑功能划分的，在实际应用中，一个单元的功能也可以由多个单元来实现，或者多个单元的功能由一个单元实现。在本申请的其它实施例中，基于密钥生成装置也可以包括其它单元，在实际应用中，这些功能也可以由其它单元协助实现，并且可以由多个单元协作实现。
根据本申请的另一个实施例，可以在通用计算设备上运行能够执行如图2或图3中所示的相应方法所涉及的部分步骤的计算机程序(包括程序代码)，该通用计算设备具体可以为计算机等，其中包括中央处理单元(CPU)、随机存取存储介质(RAM)、只读存储介质(ROM)等处理元件和存储元件，处理元件和存储元件相配合可实现本申请实施例的密钥生成方法。所述计算机程序可以记载于例如计算机可读记录介质上，并通过计算机可读记录介质装载于上述通用计算设备中，并在其中运行。
基于上述方法实施例的描述，本申请实施例还公开了一种密钥生成装置。该密钥生成装置可以是运行于区块链网络中的共识节点中的一个计算机程序(包括程序代码)，该密钥生成装置可以执行图2和图3所示的部分方法步骤。请参见图7，所述密钥生成装置可以运行如下单元：
接收单元701，用于接收第一设备发送的密钥协商请求，密钥协商请求用于请求返回密钥验证参数；
发送单元702，用于向第一设备返回密钥验证参数，以使第一设备与第二设备进行协同密钥对的协商，得到第一私钥分量、第二私钥分量以及共享公钥；并使第一设备和第二设备分别采用第一私钥分量和采用第二私钥分量，对密钥验证参数进行协同签名得到协同签名信息；
接收单元701，还用于接收第二设备发送的协商结果数据，协商结果数据携带协同签名信息、共享公钥以及密钥验证参数；
共识单元703，用于对协商结果数据进行共识；若共识通过，则将协商结果数据提交至区块链网络的区块链中。
根据本申请的一个实施例，图2或图3所示的方法所涉及的部分步骤可以是由图7所示的密钥生成装置中的各个单元来执行的。例如，图2中所示的步骤S202可由图7中所示的发送单元702来执行，步骤S208可由图7中所示的共识单元703来执行；又如，图3中所示的步骤S307可由图7中所示的发送单元702来执行，步骤S313-S314可由图7中所示的共识单元703来执行。
根据本申请的另一个实施例，图7所示的密钥生成装置中的各个单元可以分别或全部合并为一个或若干个另外的单元来构成，或者其中的某个(些) 单元还可以再拆分为功能上更小的多个单元来构成，这可以实现同样的操作，而不影响本申请的实施例的技术效果的实现。上述单元是基于逻辑功能划分的，在实际应用中，一个单元的功能也可以由多个单元来实现，或者多个单元的功能由一个单元实现。在本申请的其它实施例中，基于密钥生成装置也可以包括其它单元，在实际应用中，这些功能也可以由其它单元协助实现，并且可以由多个单元协作实现。
根据本申请的另一个实施例，可以在通用计算设备上运行能够执行如图2或图3中所示的相应方法所涉及的部分步骤的计算机程序(包括程序代码)，该通用计算设备具体可以为计算机等，其中包括中央处理单元(CPU)、随机存取存储介质(RAM)、只读存储介质(ROM)等处理元件和存储元件，处理元件和存储元件相配合可实现本申请实施例的密钥生成方法。所述计算机程序可以记载于例如计算机可读记录介质上，并通过计算机可读记录介质装载于上述通用计算设备中，并在其中运行。
本申请实施例中的第一设备和第二设备分别持有一个私钥分量，任一设备均无法持有完整的私钥，可有效提高协同密钥对的安全性；通过区块链网络中的共识节点下发的密钥验证参数，实现将协同密钥对的协商过程以及协商结果的上链，可保证协商过程的公开透明，并且能够提高协同密钥对的可靠性和安全性。
基于上述方法实施例以及装置实施例的描述，本申请实施例还提供一种计算机设备；该计算机设备可以是上述所提及的第一设备，第二设备或者共识节点。请参见图8，该计算机设备至少包括处理器801、输入接口802、输出接口803以及计算机存储介质804。其中，计算机设备内的处理器801、输入接口802、输出接口803以及计算机存储介质804可通过总线或其他方式连接。计算机存储介质804可以存储在计算机设备的存储器中，所述计算机存储介质804用于存储计算机程序，所述计算机程序包括程序指令，所述处理器201用于执行所述计算机存储介质804存储的程序指令。处理器801(或称CPU(Central Processing Unit，中央处理器))是计算机设备的计算核心以及控制核心，其适于实现一条或多条指令，具体适于加载并执行一条或多条指令从而实现相应方法流程或相应功能。
在一个实施例中，若计算机设备为第一设备，则本申请实施例所述的处理器801可以用于执行第一设备侧的密钥生成方法，包括：向区块链网络中的共识节点发送密钥协商请求，以请求共识节点返回密钥验证参数；若接收到共识节点返回的密钥验证参数，则与第二设备进行协同密钥对的协商，得到协同密钥对中的第一私钥分量和共享公钥；协同密钥对中的第二私钥分量由第二设备持有，共享公钥用于校验采用第一私钥分量和第二私钥分量进行协同签名得到的协同签名信息的有效性；采用第一私钥分量对密钥验证参数 进行签名，得到第一签名分量；并根据第一签名分量和密钥验证参数生成交易数据；将交易数据发送至第二设备，以使第二设备采用第二私钥分量对交易数据进行签名得到第二签名分量，并根据第一签名分量和第二签名分量得到协同签名信息，将协商结果数据发送至共识节点，协商结果数据包括协同签名信息、共享公钥和密钥验证参数；由共识节点对协商结果数据进行共识，并在协商结果数据通过共识后，将协商结果数据提交至区块链网络的区块链中，等等。
在一个实施例中，若计算机设备为第二设备，则本申请实施例所述的处理器801可以用于执行第二设备侧的密钥生成方法，包括：与第一设备进行协同密钥对的协商，得到协同密钥对中的第二私钥分量和共享公钥；协同密钥对中的第一私钥分量由第一设备持有，共享公钥用于校验采用第一私钥分量和第二私钥分量进行协同签名得到的协同签名信息的有效性；接收第一设备发送的交易数据，交易数据是根据第一签名分量和密钥验证参数生成的，所述第一签名分量是由第一设备采用第一私钥分量对密钥验证参数进行签名得到的；密钥验证参数是区块链网络中的共识节点响应于第一设备发送的密钥协商请求返回的；采用第二私钥分量对交易数据进行签名得到第二签名分量，并根据第一签名分量和第二签名分量得到协同签名信息；将协商结果数据发送至共识节点，协商结果数据包括协同签名信息、共享公钥以及密钥验证参数；以由共识节点对协商结果数据进行共识，并在协商结果数据通过共识后，将协商结果数据提交至区块链网络的区块链中，等等。
在一个实施例中，若所述计算机设备为区块链网络中的共识节点，则本申请实施例所述的处理器801可以用于执行共识节点侧的密钥生成方法，包括：接收第一设备发送的密钥协商请求，密钥协商请求用于请求共识节点返回密钥验证参数；向第一设备返回密钥验证参数，以使第一设备与第二设备进行协同密钥对的协商，得到第一私钥分量、第二私钥分量以及共享公钥；并使第一设备和第二设备分别采用第一私钥分量和第二私钥分量，对密钥验证参数进行协同签名得到协同签名信息；接收第二设备发送的协商结果数据，协商结果数据携带协同签名信息、共享公钥以及密钥验证参数；对协商结果数据进行共识；若共识通过，则将协商结果数据提交至区块链网络的区块链中。
本申请实施例还提供了一种计算机存储介质(Memory)，该计算机存储介质是计算机设备中的记忆设备，用于存放程序和数据。可以理解的是，此处的计算机存储介质既可以包括计算机设备中的内置存储介质，也可以包括计算机设备所支持的扩展存储介质。计算机存储介质提供存储空间，该存储空间存储了计算机设备的操作系统。并且，在该存储空间中还存放了适于被处理器801加载并执行的一条或多条的指令，这些指令可以是一个或一个以上的计算机程序(包括程序代码)。需要说明的是，此处的计算机存储介质可 以是高速RAM存储器，也可以是非不稳定的存储器(non-volatile memory)，例如至少一个磁盘存储器；可选的，其还可以是至少一个位于远离前述处理器的计算机存储介质。
在一个实施例中，若计算机设备为第一设备，则该计算机存储介质中可存储有一条或多条第一指令；且可由处理器801加载并执行计算机存储介质中存放的一条或多条第一指令，以实现上述第一设备侧的密钥生成方法中的相应步骤。
在一个实施例中，若计算机设备为第二设备，则该计算机存储介质中可存储有一条或多条第二指令；且可由处理器801加载并执行计算机存储介质中存放的一条或多条第二指令，以实现上述第二设备侧的密钥生成方法中的相应步骤。
在一个实施例中，若计算机设备为共识节点，则该计算机存储介质中可存储有一条或多条第三指令；且可由处理器801加载并执行计算机存储介质中存放的一条或多条第三指令，以实现上述共识节点侧的密钥生成方法中的相应步骤。
本申请实施例还提供了一种计算机产品，包括指令，当其在计算机上运行时，使得计算机执行上述第一设备侧的密钥生成方法、或者第二设备侧的密钥生成方法、或者共识节点侧的密钥生成方法。
以上所揭露的仅为本申请较佳实施例而已，当然不能以此来限定本申请之权利范围，因此依本申请权利要求所作的等同变化，仍属本申请所涵盖的范围。

Claims (19)

  1. 一种基于区块链网络的密钥生成方法，由第一设备执行，包括：
    向区块链网络中的共识节点发送密钥协商请求，以请求所述共识节点返回密钥验证参数；
    若接收到所述共识节点返回的所述密钥验证参数，则与第二设备进行协同密钥对的协商，得到所述协同密钥对中的第一私钥分量和共享公钥；所述协同密钥对中的第二私钥分量由所述第二设备持有，所述共享公钥用于校验采用所述第一私钥分量和所述第二私钥分量进行协同签名得到的协同签名信息的有效性；
    采用所述第一私钥分量对所述密钥验证参数进行签名，得到第一签名分量；并根据所述第一签名分量和所述密钥验证参数生成交易数据；
    将所述交易数据发送至所述第二设备，以使所述第二设备采用所述第二私钥分量对所述交易数据进行签名得到第二签名分量，并根据所述第一签名分量和所述第二签名分量得到协同签名信息，将协商结果数据发送至所述共识节点，所述协商结果数据包括所述协同签名信息、所述共享公钥和所述密钥验证参数；由所述共识节点对所述协商结果数据进行共识，并在所述协商结果数据通过共识后，将所述协商结果数据提交至所述区块链网络的区块链中。
  2. 如权利要求1所述的方法，所述与第二设备进行协同密钥对的协商，得到所述协同密钥对中的第一私钥分量和共享公钥，包括：
    获取所述第一设备和所述第二设备之间约定的随机数，所述随机数是由所述第一设备或者所述第二设备采用随机算法生成的；
    采用密钥算法根据所述随机数生成所述协同密钥对，所述协同密钥对包括一个私钥和一个公钥；
    将所述协同密钥对中的公钥作为所述共享公钥，并将所述协同密钥对中的私钥拆分成所述第一私钥分量和所述第二私钥分量；所述第二私钥分量被发送至所述第二设备。
  3. 如权利要求1所述的方法，所述与第二设备进行协同密钥对的协商，得到所述协同密钥对中的第一私钥分量和共享公钥，包括：
    获取所述第一设备和所述第二设备之间约定的随机数，所述随机数是由所述第一设备或者所述第二设备采用随机算法生成的；
    采用密钥算法根据所述随机数生成第一私钥分量和第一公钥；
    接收所述第二设备发送的第二公钥，并根据所述第一公钥和所述第二公钥生成所述共享公钥；其中，所述第二公钥是由所述第二设备采用密钥算法根据所述随机数生成的。
  4. 如权利要求1所述的方法，所述方法还包括：
    生成协商信息，所述协商信息用于指示所述第一设备请求与所述第二设 备协商所述协同密钥对；
    根据所述协商信息生成密钥协商通知，并向所述第二设备发送所述密钥协商通知；
    若接收到所述第二设备针对所述密钥协商通知返回的响应信息，则生成所述密钥协商请求。
  5. 如权利要求4所述的方法，所述根据所述协商信息生成密钥协商通知，包括：
    采用所述第一设备的系统私钥对所述协商信息进行签名，得到所述第一设备的系统数字签名；
    采用所述协商信息和所述第一设备的系统数字签名，生成所述密钥协商通知；所述响应信息是所述第二设备同意和所述第一设备协商所述协同密钥对，且采用所述第一设备的系统公钥成功验证所述第一设备的系统数字签名后发送的。
  6. 如权利要求5所述的方法，所述响应信息携带采用所述第二设备的系统私钥对所述密钥协商通知进行签名得到的所述第二设备的系统数字签名；
    所述若接收到所述第二设备针对所述密钥协商通知返回的响应信息，则生成所述密钥协商请求，包括：
    若接收到所述第二设备针对所述密钥协商通知返回的所述响应信息，则获取所述第二设备的系统公钥，并采用所述第二设备的系统公钥验证所述第二设备的系统数字签名；
    若所述第二设备的系统数字签名通过验证，则采用所述第一设备的系统数字签名、所述第二设备的系统数字签名以及所述协商信息生成所述密钥协商请求。
  7. 一种基于区块链网络的密钥生成方法，由第二设备执行，包括：
    与第一设备进行协同密钥对的协商，得到所述协同密钥对中的第二私钥分量和共享公钥；所述协同密钥对中的第一私钥分量由所述第一设备持有，所述共享公钥用于校验采用所述第一私钥分量和所述第二私钥分量进行协同签名得到的协同签名信息的有效性；
    接收所述第一设备发送的交易数据，所述交易数据是根据第一签名分量和密钥验证参数生成的，所述第一签名分量是由所述第一设备采用所述第一私钥分量对所述密钥验证参数进行签名得到的；所述密钥验证参数是区块链网络中的共识节点响应于所述第一设备发送的密钥协商请求返回的；
    采用所述第二私钥分量对所述交易数据进行签名得到第二签名分量，并根据所述第一签名分量和所述第二签名分量得到协同签名信息；
    将协商结果数据发送至所述共识节点，所述协商结果数据包括所述协同签名信息、所述共享公钥以及所述密钥验证参数；以由所述共识节点对所述协商结果数据进行共识，并在所述协商结果数据通过共识后，将所述协商结 果数据提交至所述区块链网络的区块链中。
  8. 如权利要求7所述的方法，所述与第一设备进行协同密钥对的协商，得到所述协同密钥对中的第二私钥分量和共享公钥，包括：
    接收所述第一设备发送的所述第二私钥分量和所述共享公钥；
    其中，所述共享公钥是所述第一设备采用密钥算法根据随机数生成的所述协同密钥对中的公钥，所述第二私钥分量是由所述第一设备对所述协同密钥对中的私钥进行拆分得到的；所述随机数是所述第一设备与所述第二设备之间约定的，且所述随机数是由所述第一设备或者所述第二设备采用随机算法生成的。
  9. 如权利要求7所述的方法，所述与第一设备进行协同密钥对的协商，得到所述协同密钥对中的第二私钥分量和共享公钥，包括：
    获取所述第一设备和所述第二设备之间约定的随机数，所述随机数是由所述第一设备或者所述第二设备采用随机算法生成的；
    采用密钥算法根据所述随机数生成所述第二私钥分量和第二公钥；
    将所述第二公钥发送至所述第一设备，由所述第一设备根据第一公钥和所述第二公钥生成所述共享公钥，所述第一公钥是由所述第一设备采用密钥算法根据所述随机数生成的；
    接收所述第一设备返回的所述共享公钥。
  10. 如权利要求7所述的方法，所述方法还包括：
    接收所述第一设备发送的密钥协商通知，所述密钥协商通知是根据协商信息生成的；所述协商信息用于指示所述第一设备请求与所述第二设备协商所述协同密钥对；
    若同意和所述第一设备协商所述协同密钥对，则向所述第一设备返回响应信息。
  11. 如权利要求10所述的方法，所述密钥协商通知中包括所述协商信息，以及采用所述第一设备的系统私钥对所述协商信息进行签名得到的所述第一设备的系统数字签名；
    所述若同意和所述第一设备协商所述协同密钥对，则向所述第一设备返回响应信息，包括：
    若同意和所述第一设备协商所述协同密钥对，则采用第一设备的系统公钥对所述第一设备的系统数字签名进行验证；
    若验证成功，则向所述第一设备发送所述响应信息。
  12. 如权利要求11所述的方法，所述若验证成功，则向所述第一设备发送所述响应信息，包括：
    若验证成功，则采用所述第二设备的系统私钥对所述密钥协商通知进行签名，得到所述第二设备的系统数字签名；
    根据所述密钥协商通知和所述第二设备的系统数字签名，生成所述响应 信息；
    向所述第一设备发送所述响应信息。
  13. 一种基于区块链网络的密钥生成方法，由区块链网络中的共识节点执行，包括：
    接收第一设备发送的密钥协商请求，所述密钥协商请求用于请求所述共识节点返回密钥验证参数；
    向所述第一设备返回所述密钥验证参数，以使所述第一设备与所述第二设备进行协同密钥对的协商，得到第一私钥分量、第二私钥分量以及共享公钥；并使所述第一设备和所述第二设备分别采用所述第一私钥分量和所述第二私钥分量，对所述密钥验证参数进行协同签名得到协同签名信息；
    接收所述第二设备发送的协商结果数据，所述协商结果数据包括所述协同签名信息、所述共享公钥以及所述密钥验证参数；
    对所述协商结果数据进行共识；若共识通过，则将所述协商结果数据提交至所述区块链网络的区块链中。
  14. 一种基于区块链网络的密钥生成装置，包括：
    发送单元，用于向区块链网络中的共识节点发送密钥协商请求，以请求所述共识节点返回密钥验证参数；
    处理单元，用于若接收到所述共识节点返回的所述密钥验证参数，则与第二设备进行协同密钥对的协商，得到所述协同密钥对中的第一私钥分量和共享公钥；所述协同密钥对中的第二私钥分量由第二设备持有，所述共享公钥用于校验采用所述第一私钥分量和所述第二私钥分量进行协同签名得到的协同签名信息的有效性；
    处理单元，还用于采用所述第一私钥分量对所述密钥验证参数进行签名，得到第一签名分量；并根据所述第一签名分量和所述密钥验证参数生成交易数据；
    发送单元，还用于将所述交易数据发送至所述第二设备，以使所述第二设备采用第二私钥分量对交易数据进行签名得到第二签名分量，并根据所述第一签名分量和所述第二签名分量得到协同签名信息，将协商结果数据发送至所述共识节点，所述协商结果数据包括所述协同签名信息、所述共享公钥和所述密钥验证参数；由所述共识节点对协商结果数据进行共识，并在所述协商结果数据通过共识后，将所述协商结果数据提交至所述区块链网络的区块链中。
  15. 一种基于区块链网络的密钥生成装置，包括：
    处理单元，用于与第一设备进行协同密钥对的协商，得到所述协同密钥对中的第二私钥分量和共享公钥；所述协同密钥对中的第一私钥分量由所述第一设备持有，所述共享公钥用于校验采用所述第一私钥分量和所述第二私钥分量进行协同签名得到的协同签名信息的有效性；
    接收单元，用于接收所述第一设备发送的交易数据，所述交易数据是根据第一签名分量和密钥验证参数生成的，所述第一签名分量是由所述第一设备采用所述第一私钥分量对所述密钥验证参数进行签名得到的；所述密钥验证参数是区块链网络中的共识节点响应于所述第一设备发送的密钥协商请求返回的；
    处理单元，还用于采用所述第二私钥分量对所述交易数据进行签名得到第二签名分量，并根据所述第一签名分量和所述第二签名分量得到协同签名信息；
    发送单元，用于将协商结果数据发送至所述共识节点，所述协商结果数据包括所述协同签名信息、所述共享公钥以及所述密钥验证参数；以由所述共识节点对所述协商结果数据进行共识，并在所述协商结果数据通过共识后，将所述协商结果数据提交至所述区块链网络的区块链中。
  16. 一种基于区块链网络的密钥生成装置，包括：
    接收单元，用于接收第一设备发送的密钥协商请求，所述密钥协商请求用于请求返回密钥验证参数；
    发送单元，用于向所述第一设备返回所述密钥验证参数，以使所述第一设备与第二设备进行协同密钥对的协商，得到第一私钥分量、第二私钥分量以及共享公钥；并使所述第一设备和所述第二设备分别采用所述第一私钥分量和采用所述第二私钥分量，对所述密钥验证参数进行协同签名得到协同签名信息；
    接收单元，还用于接收所述第二设备发送的协商结果数据，所述协商结果数据包括所述协同签名信息、所述共享公钥以及所述密钥验证参数；
    共识单元，用于对所述协商结果数据进行共识；若共识通过，则将所述协商结果数据提交至所述区块链网络的区块链中。
  17. 一种计算机设备，包括输入接口和输出接口，所述计算机设备为第一设备、第二设备和共识节点中的任意一者；所述计算机设备还包括：
    处理器，适于实现一条或多条指令；以及，计算机存储介质；
    若所述计算机设备为所述第一设备，则所述计算机存储介质存储有一条或多条第一指令，所述一条或多条第一指令适于由所述处理器加载并执行如权利要求1-6任一项所述的基于区块链网络的密钥生成方法；
    若所述计算机设备为所述第二设备，则所述计算机存储介质存储有一条或多条第二指令，所述一条或多条第二指令适于由所述处理器加载并执行如权利要求7-12任一项所述的基于区块链网络的密钥生成方法；
    若所述计算机设备为所述共识节点，则所述计算机存储介质存储有一条或多条第三指令，所述一条或多条第三指令适于由所述处理器加载并执行如权利要求13所述的基于区块链网络的密钥生成方法。
  18. 一种计算机存储介质，所述计算机存储介质存储有一条或多条第一 指令，所述一条或多条第一指令适于由所述处理器加载并执行如权利要求1-6任一项所述的基于区块链网络的密钥生成方法；
    或者，所述计算机存储介质存储有一条或多条第二指令，所述一条或多条第二指令适于由所述处理器加载并执行如权利要求7-12任一项所述的基于区块链网络的密钥生成方法；
    或者，所述计算机存储介质存储有一条或多条第三指令，所述一条或多条第三指令适于由所述处理器加载并执行如权利要求13所述的基于区块链网络的密钥生成方法。
  19. 一种计算机程序产品，包括指令，当其在计算机上运行时，使得计算机执行如权利要求1-6任一项所述的基于区块链网络的密钥生成方法，或权利要求7-12任一项所述的基于区块链网络的密钥生成方法，或权利要求13所述的基于区块链网络的密钥生成方法。
PCT/CN2021/077374 2020-04-09 2021-02-23 密钥生成方法、装置、设备及介质 WO2021203853A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US17/720,274 US20220311607A1 (en) 2020-04-09 2022-04-13 Key generation method and apparatus, device, and medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010277116.5A CN111490878B (zh) 2020-04-09 2020-04-09 密钥生成方法、装置、设备及介质
CN202010277116.5 2020-04-09

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/720,274 Continuation US20220311607A1 (en) 2020-04-09 2022-04-13 Key generation method and apparatus, device, and medium

Publications (1)

Publication Number Publication Date
WO2021203853A1 true WO2021203853A1 (zh) 2021-10-14

Family

ID=71812704

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/077374 WO2021203853A1 (zh) 2020-04-09 2021-02-23 密钥生成方法、装置、设备及介质

Country Status (3)

Country Link
US (1) US20220311607A1 (zh)
CN (1) CN111490878B (zh)
WO (1) WO2021203853A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114362946A (zh) * 2022-03-10 2022-04-15 北京得瑞领新科技有限公司 密钥协商方法及系统

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111490878B (zh) * 2020-04-09 2021-07-27 腾讯科技（深圳）有限公司 密钥生成方法、装置、设备及介质
CN112184441B (zh) * 2020-09-29 2024-01-19 平安科技（深圳）有限公司 数据处理方法、装置、节点设备及存储介质
CN112383395B (zh) * 2020-12-11 2024-01-23 海光信息技术股份有限公司 密钥协商方法及装置
CN113206851B (zh) * 2021-05-06 2022-04-05 杭州复杂美科技有限公司 平行链共识方法、计算机设备和存储介质
CN113688187B (zh) * 2021-10-26 2022-02-08 杭州宇链科技有限公司 危化安全生产数字化区块链监管平台
CN114070640B (zh) * 2021-11-25 2024-02-06 航天新通科技有限公司 一种安全通信方法及系统
CN114650136B (zh) * 2022-05-18 2022-10-04 杭州天谷信息科技有限公司 一种基于混合云的电子签名方法及装置

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107623569A (zh) * 2017-09-30 2018-01-23 矩阵元技术（深圳）有限公司 基于秘密共享技术的区块链密钥托管和恢复方法、装置
CN109934582A (zh) * 2019-02-25 2019-06-25 矩阵元技术（深圳）有限公司 数字货币交易数据处理方法、服务器、客户端及系统
CN110574059A (zh) * 2017-04-11 2019-12-13 区块链控股有限公司 关于区块链的快速分布式共识
US20200082405A1 (en) * 2018-09-12 2020-03-12 NEC Laboratories Europe GmbH Method and system for client support in a blockchain network
CN110933125A (zh) * 2018-09-19 2020-03-27 英飞凌科技股份有限公司 区块链实体、链下实体、认证设备及用于执行协作的方法
CN111490878A (zh) * 2020-04-09 2020-08-04 腾讯科技（深圳）有限公司 密钥生成方法、装置、设备及介质
CN111489159A (zh) * 2020-04-09 2020-08-04 腾讯科技（深圳）有限公司 数据处理方法、装置、计算机设备及介质

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105634742B (zh) * 2015-12-28 2019-03-05 飞天诚信科技股份有限公司 一种协商会话密钥的方法及智能密钥设备
EP4138339A1 (en) * 2016-07-29 2023-02-22 Magic Leap, Inc. Secure exchange of cryptographically signed records
CN107959566A (zh) * 2016-10-14 2018-04-24 阿里巴巴集团控股有限公司 量子数据密钥协商系统及量子数据密钥协商方法
CN106533675A (zh) * 2016-12-19 2017-03-22 北京洋浦伟业科技发展有限公司 数字签名方法及系统
GB201707788D0 (en) * 2017-05-15 2017-06-28 Nchain Holdings Ltd Computer-implemented system and method
CN107204846B (zh) * 2017-05-31 2020-11-27 北京中金国信科技有限公司 数字签名生成方法、系统及节点模块
CN109246129B (zh) * 2018-10-12 2020-12-25 天津赢达信科技有限公司 一种可验证客户端身份的sm2协同签名方法及系统
CN109005028A (zh) * 2018-11-02 2018-12-14 美的集团股份有限公司 密钥协商方法、云服务器、设备、存储介质以及系统
US10402823B1 (en) * 2018-12-30 2019-09-03 Alexander Vladimirovich Vlasov System for exchanging private keys for mutual settlements between users of a cryptocurrency outside blockchains
CN109861816A (zh) * 2019-02-22 2019-06-07 矩阵元技术（深圳）有限公司 数据处理方法和装置
CN109872155A (zh) * 2019-02-22 2019-06-11 矩阵元技术（深圳）有限公司 数据处理方法和装置
CN110278088A (zh) * 2019-07-18 2019-09-24 广州安研信息科技有限公司 一种sm2协同签名方法
US10790979B1 (en) * 2019-08-29 2020-09-29 Alibaba Group Holding Limited Providing high availability computing service by issuing a certificate
CN110932850B (zh) * 2019-11-29 2023-01-20 杭州安恒信息技术股份有限公司 通信加密方法及系统

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110574059A (zh) * 2017-04-11 2019-12-13 区块链控股有限公司 关于区块链的快速分布式共识
CN107623569A (zh) * 2017-09-30 2018-01-23 矩阵元技术（深圳）有限公司 基于秘密共享技术的区块链密钥托管和恢复方法、装置
US20200082405A1 (en) * 2018-09-12 2020-03-12 NEC Laboratories Europe GmbH Method and system for client support in a blockchain network
CN110933125A (zh) * 2018-09-19 2020-03-27 英飞凌科技股份有限公司 区块链实体、链下实体、认证设备及用于执行协作的方法
CN109934582A (zh) * 2019-02-25 2019-06-25 矩阵元技术（深圳）有限公司 数字货币交易数据处理方法、服务器、客户端及系统
CN111490878A (zh) * 2020-04-09 2020-08-04 腾讯科技（深圳）有限公司 密钥生成方法、装置、设备及介质
CN111489159A (zh) * 2020-04-09 2020-08-04 腾讯科技（深圳）有限公司 数据处理方法、装置、计算机设备及介质

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114362946A (zh) * 2022-03-10 2022-04-15 北京得瑞领新科技有限公司 密钥协商方法及系统
CN114362946B (zh) * 2022-03-10 2022-06-07 北京得瑞领新科技有限公司 密钥协商方法及系统

Also Published As

Publication number Publication date
US20220311607A1 (en) 2022-09-29
CN111490878B (zh) 2021-07-27
CN111490878A (zh) 2020-08-04

Similar Documents

Publication Publication Date Title
WO2021203853A1 (zh) 密钥生成方法、装置、设备及介质
US20230208630A1 (en) Credential generation and distribution method and system for a blockchain network
WO2020258912A1 (zh) 一种区块链共识方法、装置和系统
CN111489159B (zh) 数据处理方法、装置、计算机设备及介质
TW201830302A (zh) 業務處理方法、裝置、資料共享系統及儲存介質
CN110177124B (zh) 基于区块链的身份认证方法及相关设备
JP2022520844A (ja) ブロックチェーンネットワークを介した移転を実施するためのコンピュータで実施されるシステムおよび方法
US20230037932A1 (en) Data processing method and apparatus based on blockchain network, and computer device
WO2021082340A1 (zh) 数据处理方法、装置、系统和存储介质
CN111275555B (zh) 区块链交易处理方法、交易节点以及区块链系统
WO2023024886A1 (zh) 一种基于可靠广播的二元共识方法、装置、电子设备及存储介质
CN110149323B (zh) 一种具有千万级tps合约处理能力的处理装置
CN113255014B (zh) 一种基于区块链的数据处理方法以及相关设备
CN111767569A (zh) 区块链的访问授权方法及节点
JP6920442B2 (ja) ブロックチェーンシステムのノード間の通信を確立するための方法及びデバイス
CN111709053A (zh) 基于松散耦合交易网络的作业方法及作业装置
CN111401888A (zh) 一种生成多重签名钱包的方法及装置
JP2023532356A (ja) プロキシ方法、装置及びコンピュータ可読記憶媒体
CN116743377B (zh) 基于区块链密钥的数据处理方法、装置、设备及存储介质
WO2024007855A1 (zh) 一种基于区块链的数据处理方法、设备以及可读存储介质
Komo An efficient method to provide auditable messages exchanged in instant messaging applications.
Abdmeziem et al. Group key management in the Internet of Things: Handling asynchronicity
Al-Joboury et al. Proof of Good Service Based on DAGs-To-Blockchain for IoT Applications
CN117220881A (zh) 一种基于区块链的数据处理方法、设备以及可读存储介质
CN117495559A (zh) 一种交易处理方法、装置、设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21785100

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 24/02/2023)

122 Ep: pct application non-entry in european phase

Ref document number: 21785100

Country of ref document: EP

Kind code of ref document: A1