TW202042527A - Verification and management system for a digital certificate and method thereof - Google Patents

Abstract

A verification and management system for a digital certificate and method thereof is provided. The certificate authority publishes and stores the issue and revoke records of digital certificates on a blockchain system. A network application service device inquires and checks the issue and revoke records on the blockchain through a network. If the digital certificate is effective and not revoked, the network application service device verifies the digital certificate based on the certificate authority’s public key.

Description

Electronic certificate verification and management system and method

The present invention relates to an electronic certificate system, in particular to an electronic certificate verification and management system and method.

Currently, there is a public key infrastructure (Public Key Infrastructure, PKI) to manage digital certificates (Digital Certificates), which include Certificate Authority (CA) servers, Register Authority (RA) servers and directories Service (Directory Service, DS) server. The registration center server reviews the user's electronic certificate application, sends the electronic certificate application to the certification authority server and then issues the electronic certificate, and announces the electronic certificate to the directory service server. Among them, in the process of using the electronic certificate, in addition to verifying the electronic certificate, it is also necessary to confirm whether the electronic certificate has been revoked. Therefore, the electronic certificate revocation list (Certificate Revocation List, CRL) will be released at regular intervals to let the public confirm which electronic certificates have been revoked. However, this method is not immediacy and is prone to loopholes. When a distributed denial-of-service attack (DDOS) is encountered, the list of electronic certificate revocations cannot be obtained.

In view of this, the present invention proposes an electronic certificate verification and management system and method, which can record the issuance and revocation records of electronic certificates on the blockchain in real time, which has real-timeness, reliability and reliability.

An embodiment of the present invention provides an electronic certificate verification system including a blockchain and a network application service device. The blockchain stores the issuance and revocation records of the electronic certificate issued by the certificate certification authority. The network application service device receives the electronic certificate to query the issuance record and revocation record of the electronic certificate from the blockchain via the Internet, and when the electronic certificate has not been revoked, it checks the electronic certificate according to the issuance record.

Another embodiment of the present invention provides an electronic certificate management system, which includes a blockchain and a plural certificate authentication server. Each certificate authentication server generates an issue record corresponding to the issued electronic certificate, and uploads the issue record to the blockchain for storage.

Another embodiment of the present invention provides an electronic certificate verification method, including: obtaining an electronic certificate; querying the issuance record and revocation record of the electronic certificate from the blockchain via the network; Electronic certificate.

Another embodiment of the present invention provides an electronic certificate verification method, including: issuing an electronic certificate; generating an issuance record based on the issued electronic certificate; and transmitting the issuance record of the electronic certificate to the blockchain for storage.

In summary, the electronic certificate verification and management system and method according to the embodiments of the present invention can update the validity status of each electronic certificate in real time, and each certificate authentication server and network application service device does not need to passively wait for the electronic certificate. Revocation list. At the same time, the use of the characteristics of the blockchain can ensure that the issuance record and revocation record will not be tampered with, and will not be affected by DDOS attacks.

1, which is a schematic diagram of the structure of an electronic credential management system 100 according to an embodiment of the present invention. The electronic certificate management system 100 includes a plurality of certificate authentication servers 110 and a blockchain 120 belonging to different certificate authentication agencies. The certificate authentication server 110 and the blockchain 120 are connected through the network 300. The certificate authentication server 110 may be a server or a cluster of servers.

3 is a flowchart (1) of an electronic credential management method according to an embodiment of the present invention. Refer to Figure 1 and Figure 3 together. After each certificate authentication server 110 issues an electronic certificate (step S301), it generates an issuance record corresponding to the issued electronic certificate (step S302), and uploads the issuance record to the blockchain 120 for storage (step S303). Using the non-tamperable feature of blockchain technology, it can be confirmed whether the corresponding electronic certificate is actually issued. The issuance record can record the information recorded in the electronic certificate, such as the fingerprint of the electronic certificate, the fingerprint of the public key of the electronic certificate issuing organization, the ID of the issuing organization, the time of issuance, the activation time, the expiration time, and the public key fingerprint of the electronic certificate owner. Here, the blockchain 120 is a cluster composed of multiple connected devices (such as servers), and the data received by any one connected device will be instantly transmitted and stored in other connected devices. On the other hand, querying data on the blockchain 120 can also be querying any networked device.

Fig. 4 is a flowchart (2) of an electronic credential management method according to an embodiment of the present invention. Refer to Figure 1 and Figure 4 together. Each certificate authentication server 110 also generates a revocation record when revoking the electronic certificate (step S401), and uploads the revocation record to the blockchain 120 for storage (step S402). Using the non-tampering feature of blockchain technology, it can be confirmed whether the corresponding electronic certificate is indeed revoked. The revocation record can record information such as the fingerprint of the electronic certificate, the identification code of the revocation organization, and the revocation time.

The block chain 120 saves all electronic certificate issuance and revocation records. As long as the record is saved on the block chain 120, all the certificate authentication servers 110 and network application service devices 230 can be queried on the block chain 120. It has the immediacy of utility update.

2, which is a schematic diagram of the structure of an electronic certificate verification system 200 according to an embodiment of the present invention. The electronic certificate verification system 200 includes a blockchain 220 and a network application service device 230. The blockchain 220 and the network application service device 230 are connected through the network 300. The web application server 230 may be a server or a cluster of servers. The network application service device 230 provides network application services, including but not limited to social platforms, mail services, online financial services, and online shopping. When a user wants to use the web application service provided by the web application server 230, he needs to provide his electronic certificate to log in for the web application server 230 to recognize.

FIG. 5 is a flowchart (1) of an electronic certificate verification method according to an embodiment of the present invention. Refer to Figure 2 and Figure 5 together. As in the foregoing embodiment, the blockchain 220 has stored the issuance record and revocation record of the electronic certificate by the certificate authority. After the network application server 230 receives the electronic certificate provided by the user (step S501), in order to confirm whether the electronic certificate is indeed issued or revoked, it can check whether there is an electronic certificate from the blockchain 220 via the network 300 The issuance record and revocation record (step S502). If the revocation record is not found, it means that the electronic certificate has not been revoked, and the electronic certificate is checked according to the issuance record to confirm whether the issuance record is consistent with the relevant information of the received electronic certificate (step S503). For example, according to the information recorded in the issuance record, it can be verified whether the issuing unit, issuance time, and owner of the electronic certificate are correct. If any of them are different, it means that the electronic certificate may be tampered with or forged.

Fig. 6 is a flowchart (2) of an electronic certificate verification method according to an embodiment of the present invention. Refer to Figure 2 and Figure 6 together. If it is confirmed that the electronic certificate conforms to the issuance record and has not been revoked, its authenticity can be further verified. Since the blockchain 220 saves the public keys of all certificate certification authorities, the network application server 230 can go to the blockchain 220 to obtain the public key of the corresponding certificate certification authority (step S504) to use this public key for verification Electronic certificate (step S505). Specifically, the certificate authentication server 110 generates a data fingerprint (such as a hash value generated by a hash function) based on the electronic certificate information, and signs the data fingerprint with the private key of the certificate certificate authority and puts it into the electronic certificate. The network application service device 230 can restore the data fingerprint in the electronic certificate according to the public key of the certificate authority, and calculate the data fingerprint again according to the electronic certificate information, and check whether the two comparisons match, so as to confirm the received electronic certificate and the certificate The certification bodies issued are consistent.

In summary, the electronic certificate verification and management system according to the embodiment of the present invention can update the validity status of each electronic certificate in real time, and each certificate authentication server 110 and network application server 230 does not need to passively wait for the electronic certificate. Revocation list. At the same time, the use of the characteristics of the blockchain can ensure that the issuance record and revocation record will not be tampered with, and will not be affected by DDOS attacks. On the other hand, the public key of each certificate certification authority is stored on the blockchain 120, 220, in addition to avoiding tampering, when the public key is updated, the certification authority only needs to update the public key of the blockchain 120, 220. It is not necessary to update all the certificate authentication server 110 and the network application server 230.

100: Electronic certificate management system 110: certificate authentication server 120: Blockchain 200: Electronic certificate verification system 230: Web Application Service Device 220: Blockchain 300: Internet S301~S303: steps S401~S402: steps S501~S505: steps

[Figure 1] is a schematic diagram of an electronic credential management system architecture according to an embodiment of the present invention. [Figure 2] is a schematic diagram of an electronic credential verification system architecture according to an embodiment of the present invention. [Figure 3] is a flowchart (1) of an electronic credential management method according to an embodiment of the present invention. [Figure 4] is a flowchart (2) of an electronic credential management method according to an embodiment of the present invention. [Figure 5] is a flowchart (1) of an electronic certificate verification method according to an embodiment of the present invention. [Figure 6] is a flowchart (2) of an electronic certificate verification method according to an embodiment of the present invention.

200: Electronic certificate verification system

230: Web Application Service Device

220: Blockchain

300: Internet

Claims (10)

An electronic certificate verification system, including: A block chain, storing one of the issuance records and one revocation record of an electronic certificate by a certification authority; and A network application service device receives the electronic certificate to query the issuance record and the revocation record of the electronic certificate from the blockchain via a network, and when the electronic certificate has not been revoked, it is based on the issuance record Check the electronic certificate. The electronic certificate verification system according to claim 1, wherein the network application service device checks whether the issuing unit, issuing time, and owner of the electronic certificate are correct according to the issuing record. The electronic certificate verification system according to claim 1, wherein the blockchain also stores the public key of the certificate certification authority. An electronic certificate management system, including: A blockchain; and A plurality of certificate authentication servers, each of the certificate authentication servers generates an issue record corresponding to an electronic certificate issued, and uploads the issue record to the blockchain for storage. The electronic certificate management system according to claim 4, wherein each of the certificate authentication servers also generates a revocation record when revoking the electronic certificate, and uploads the revocation record to the blockchain for storage. An electronic certificate verification method, executed by a network application service device, includes: Obtain an electronic certificate; Query an issuance record and a revocation record of the electronic certificate from a blockchain via a network; and When it is found that the electronic certificate has not been revoked, the electronic certificate is checked according to the issuance record. According to the electronic certificate verification method of claim 6, wherein the verification of the electronic certificate according to the issuance record is to check whether the issuing unit, issuance time, and owner of the electronic certificate are correct according to the issuance record. The electronic certificate verification method as described in claim 6, further including: Obtain a public key of the certification authority from the blockchain; and Use the public key to verify the electronic certificate. An electronic certificate management method, executed by a certificate authentication server, includes: Issue an electronic certificate; Generate an issuance record based on the electronic certificate issued; and Send the issuance record of the electronic certificate to a blockchain for storage. The electronic certificate management method as described in claim 9 further includes: When revoking the electronic certificate, a revocation record is generated; and Send the revocation record of the electronic certificate to the blockchain for storage.

Images