Credential generation and distribution method and system for a blockchain network
Methods and devices that manage the secure distribution of credentials from a group of autonomous specialized nodes to a requesting node. The secure distribution of credentials may uses secret share and a group private key that none of the nodes reconstructs or possesses. The credentials include an identifier for the requesting node and a secret point that the node assembles from portions of the secret point provided by each of a plurality of the specialized nodes, where the secret point is based on the group private key and a map-to-point hash of the requesting node's identifier.
1. A computer-implemented method for a node to obtain a credential indicative of a role of a blockchain node in a blockchain network from a group of specialized nodes, each of the specialized nodes having a private key share of a group private key, wherein the method comprises:
sending a request, from the node to a plurality of the specialized nodes, for the credential, wherein the request includes an identifier of the node, the identifier including an identifier string identifying the node and a role string identifying the role of the group of specialized nodes in the blockchain network, the role of the group defined as one of validation, storage, or mining;
receiving a portion of a secret point from a corresponding specialized node in the plurality of the specialized nodes, wherein the portion of the secret point is generated by the corresponding node in the plurality of the specialized nodes based at least in part on the identifier and the private key share of the corresponding specialized node; and
generating the secret point by combining received portions of the secret point, wherein the secret point comprises the group private key multiplied by a map-to-point hash of the identifier, and the credential comprises the identifier and the secret point,
and wherein none of the specialized nodes nor the node is required to obtain a complete copy of the group private key.
2. The method claimed in claim 1 , wherein sending the request includes sending a separate request to each of the plurality of the specialized nodes.
3. The method claimed in claim 1 , wherein the identifier string further includes an expiration time for the credential.
4. The method claimed in claim 1 , wherein sending a request includes sending the identifier string, and wherein receiving includes receiving the identifier from a node of the plurality of specialized nodes.
5. The method claimed in claim 1 , wherein generating the secret point uses a secret share to generate the secret point that is based on the group private key.
6. The method claimed in claim 5 , wherein the secret share uses Lagrange interpolation and private key shares of the plurality of the specialized nodes without reconstructing the group private key.
7. A node comprising:
a processor,
memory;
a network interface; and
an application containing processor-executable instructions to obtain a credential from a plurality of specialized nodes, the credential indicative of a role of a blockchain node in a blockchain network, each of the specialized nodes having a private key share of a group private key, wherein, when executed, the processor-executable instructions cause the node to:
send a request for the credential to a plurality of the specialized nodes, wherein the request includes an identifier of the node, the identifier including an identifier string identifying the specialized node and a role string identifying a role of the group of specialized nodes in the blockchain network;
receive, from a respective specialized node in the plurality of the specialized nodes, a respective portion of a secret point generated by the respective node in the plurality of specialized nodes based at least in part on the identifier and the private key share of each specialized node; and
generate the secret point by combining the received portions of the secret point, wherein the secret point comprises the group private key times a map-to-point hash of the identifier, and the credential comprises the identifier and the secret point,
and wherein none of the specialized nodes nor the node is required to obtain a complete copy of the group private key.
8. The node claimed in claim 7 , wherein the processor-executable instructions, when executed, cause the node to send the request by sending a separate request to each of the plurality of the specialized nodes.
9. The node claimed in claim 7 , wherein the identifier string further includes an expiration time for the credential.
10. The node claimed in claim 7 , wherein the processor-executable instructions, when executed, cause the node to send the request by sending the identifier string, and to receive by receiving the identifier from a node of the plurality of the specialized nodes.
11. The node claimed in claim 7 , wherein the processor-executable instructions, when executed, cause the node to generate the secret point using a secret share to generate the secret point that is based on the group private key.
12. The node claimed in claim 11 , wherein the secret share uses Lagrange interpolation and private key shares of the plurality of the specialized nodes without reconstructing the group private key.
13. A non-transitory processor-readable medium storing processor-executable instructions that, when executed by one or more processors, cause the one or more processors to carry out operations in the method claimed in claim 1 .