WO2019196696A1 - 数字证书处理方法及装置、区块链节点、存储介质 - Google Patents

数字证书处理方法及装置、区块链节点、存储介质 Download PDF

Info

Publication number
WO2019196696A1
WO2019196696A1 PCT/CN2019/080881 CN2019080881W WO2019196696A1 WO 2019196696 A1 WO2019196696 A1 WO 2019196696A1 CN 2019080881 W CN2019080881 W CN 2019080881W WO 2019196696 A1 WO2019196696 A1 WO 2019196696A1
Authority
WO
WIPO (PCT)
Prior art keywords
digital certificate
effective time
receiving
validity period
verification result
Prior art date
Application number
PCT/CN2019/080881
Other languages
English (en)
French (fr)
Inventor
阎军智
Original Assignee
中国移动通信有限公司研究院
中国移动通信集团有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国移动通信有限公司研究院, 中国移动通信集团有限公司 filed Critical 中国移动通信有限公司研究院
Priority to US17/046,780 priority Critical patent/US11863692B2/en
Priority to EP19785467.2A priority patent/EP3780488B1/en
Publication of WO2019196696A1 publication Critical patent/WO2019196696A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3265—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate chains, trees or paths; Hierarchical trust model
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees

Definitions

  • the present application relates to the field of information security technologies, but is not limited to the field of information security technologies, and in particular, to a digital certificate processing method and apparatus, a blockchain node, and a storage medium.
  • PKI Public Key Infrastructure
  • the digital certificate is an important carrier in the implementation of PKI technology.
  • the content of the digital certificate generally includes: the information of the certificate holder, the information of the certificate issuing institution, the public key of the holder, the validity period of the certificate, the purpose of the certificate, and the issuing institution of the certificate.
  • Digital certificates are generally issued by an authority.
  • the process of issuing digital certificates can also be called a Certification Authority (CA) process.
  • CA Certification Authority
  • CA is the core of PKI and the starting point of trust. If you can control a CA, you can use the CA to arbitrarily issue digital certificates. Therefore, the core CA is vulnerable to attack. Once a CA is compromised, all digital certificates issued by the CA are no longer secure and cannot be used.
  • the blockchain technology is based on a distributed storage system, which is capable of verifying the issued digital certificates by a plurality of verification nodes based on a consensus mechanism and performing distributed storage after being verified. Therefore, if digital certificates are used in combination with blockchain technology, the above problems can be solved smoothly.
  • the embodiments of the present application are expected to provide a digital certificate processing method and apparatus, a blockchain node, and a storage medium, which at least partially solve the above problems.
  • an embodiment of the present application provides a digital certificate processing method, including:
  • the verified digital certificate is recorded to the blockchain according to the verification result.
  • an embodiment of the present application provides a digital certificate processing method, including:
  • an embodiment of the present application provides a digital certificate processing apparatus, including:
  • a first receiving module configured to receive a publishing request of a digital certificate, where the digital certificate does not include validity period information
  • a recording module configured to record the verified digital certificate to the blockchain according to the verification result if the effective time of the digital certificate is reached.
  • the embodiment of the present application provides a digital certificate verification apparatus, including:
  • a second receiving module configured to receive a publishing request of the digital certificate, where the digital certificate does not include validity period information
  • a verification module configured to verify that the digital certificate is validated when the digital certificate is validated
  • a publishing module configured to issue a verification result of the digital certificate.
  • an embodiment of the present application provides a blockchain node, including:
  • the transceiver is configured to send and receive information
  • a memory configured to store information and at least store computer executable instructions
  • a processor coupled to the transceiver and the memory, configured to control operation of the transceiver and the memory, and capable of implementing any of the first aspect or the second aspect by executing the computer executable instructions
  • the digital certificate processing method provided by the example.
  • the embodiment of the present application provides a computer storage medium, where the computer storage medium stores computer executable instructions; after the computer executable instructions are executed, the first aspect or the second aspect can be implemented.
  • the digital certificate processing method provided.
  • the digital certificate itself no longer contains the validity period information, so the amount of data is reduced relative to the digital certificate including the validity period information, and the amount of data is greatly reduced for storing a large number of digital certificates.
  • the blockchain generated by using the embodiment of the present application has the characteristics of small data volume and small occupied storage space;
  • the amount of data in the blockchain is reduced, the amount of data to be verified during the growth of the blockchain is also reduced, so that the amount of calculation and the resources consumed by the verification can be reduced, and the verification efficiency is improved. And save verification resources.
  • FIG. 1 is a schematic flowchart diagram of a first digital certificate processing method according to an embodiment of the present application
  • FIG. 2 is a schematic flowchart of a second digital certificate processing method according to an embodiment of the present application
  • FIG. 3 is a schematic flowchart of a third digital certificate processing method according to an embodiment of the present application.
  • FIG. 4 is a schematic structural diagram of a digital certificate processing apparatus according to an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of another digital certificate processing apparatus according to an embodiment of the present disclosure.
  • FIG. 6 is a schematic structural diagram of a blockchain node according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic structural diagram of a blockchain system according to an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of another blockchain system according to an embodiment of the present disclosure.
  • FIG. 9 is a blockchain storing a digital certificate according to an embodiment of the present application.
  • this embodiment provides a digital certificate processing method, including:
  • Step S110 Receive a publishing request of a digital certificate, where the digital certificate does not include validity period information
  • Step S120 Acquire a verification result of the digital certificate.
  • Step S130 Record the digital certificate that has passed the verification to the blockchain according to the verification result.
  • the step S130 may include: if the effective time of the digital certificate is reached, the verification result is verified according to the verification result.
  • the digital certificate is recorded to the blockchain.
  • the digital certificate processing method provided in this embodiment may be a method applied to a billing node in a blockchain system.
  • the digital certificate issued by the accounting node for requesting is not included in the digital certificate itself. Therefore, the digital certificate provided in this embodiment has less content than the digital certificate including the validity period information, and the amount of information occupied by the digital certificate itself is small.
  • the accounting node obtains the verification result of the digital certificate, and the verification result may be a verification result issued after the accounting node performs verification based on the consensus mechanism, and the verification result may indicate whether the digital certificate passes the verification.
  • step S130 the record of the verified digital certificate is recorded in the blockchain according to the verification result.
  • whether the digital certificate is passed according to the verification result and based on the consensus mechanism for example, there are N verification nodes participating in the digital certificate being verified, and only the verification result issued by the verification node reaching a predetermined ratio is obtained. Indicates that the digital certificate passes the verification, or the verification result provided by the verification node reaches a predetermined number indicates that the digital certificate passes the verification, and finally determines that the digital certificate passes the verification, and then performs the operation of recording the digital certificate into the blockchain. .
  • the digital certificates recorded in the blockchain in this embodiment have the following characteristics:
  • the digital certificate recorded in the blockchain itself does not contain the validity period information, and the digital certificate itself generates less data and occupies less storage space;
  • the digital certificates recorded in the blockchain have reached their effective time, that is, there will be no digital certificates in the blockchain that have not reached the effective time. Therefore, a large number of digital certificates that are not in effect are introduced in the blockchain. Therefore, the blockchain has a large number of blocks and a blockchain length. Thus, the problem of long verification time and large verification resource consumption in the block generation process of the blockchain can be reduced.
  • the accounting node In order to ensure that the digital certificate written in the blockchain has reached its effective time, in this embodiment, the accounting node needs to determine whether the current time reaches the effective time of the digital certificate, or when the verification node is in the effective time. Publish the verification results. In this way, the accounting node receives the verification result issued at the effective time, and the accounting node can default to the effective time of the digital certificate corresponding to the verification result.
  • the step S110 may include:
  • the issue request includes a digital certificate that needs to be issued and validity period information that is not included in the digital certificate but corresponds to the digital certificate.
  • the accounting node determines the effective time according to the validity period information in the publishing request.
  • the validity period information includes at least: indication information of the effective time of the digital certificate.
  • step S110 may include:
  • the effective time is based on pre-agreed.
  • the publishing request itself does not carry a digital certificate
  • the publishing request does not carry the validity period information
  • the accounting node may determine the zodiac time according to a predetermined agreement.
  • the accounting node may be based on the default.
  • the criterion determines the effective time, and the effective time may also be determined according to pre-negotiation with the publishing node.
  • the method includes:
  • Step S121 Determine the effective time according to the validity period information or a prior agreement.
  • the accounting node determines the effective time according to the validity period information carried in the publication request or the prior agreement. After determining the effective time, it is determined whether the effective time is currently reached. If the effective time is reached, the verified digital certificate is added to the blockchain.
  • the step S120 may include: obtaining the verification result that is issued when the effective time is reached.
  • the accounting node receives the verification result of the digital certificate issued by the verification node, indicating that the effective time has been reached, the accounting node can eliminate the need to verify the current self. If the effective time is reached, the verified digital certificate can be directly added to the blockchain according to the verification result. Thus, the digital certificate added to the blockchain also reaches its effective time.
  • this example provides a digital certificate processing method, including:
  • Step S210 Receive a publishing request of a digital certificate, where the digital certificate does not include validity period information
  • Step S220 determining an effective time of the digital certificate
  • Step S230 If the validity time of the digital certificate is reached, verify that the digital certificate obtains the verification result
  • Step S240 Publish the verification result of the digital certificate.
  • the digital certificate processing method provided in this embodiment may be applied to the method in the verification node, and the digital certificate carried in the publishing request received by the verification node does not carry the validity period information.
  • the verification node may directly perform verification based on the consensus mechanism on the digital certificate, and then issue the verification result in the blockchain network, and then the record node writes the verified digital certificate to the effective time.
  • the verification node determines the effective time of the digital certificate, and only validates the corresponding digital certificate when the effective time is reached, and issues the verification result. The validity time of the digital certificate corresponding to the verification result thus posted to the blockchain network has been reached.
  • the step S210 may include: receiving the publishing request that carries the validity period information; the step S220 may include: determining the effective time according to the validity period information.
  • the validity period information includes at least the indication information of the effective time, so that the effective time can be determined according to the validity period information.
  • the validity period information may further include: an end time of the digital certificate, and thus, the digital certificate is appropriately stopped. It is determined by the end time.
  • the step S210 may include: receiving a release request of the default validity period information; the step S220 may include: determining the effective time according to a predetermined agreement.
  • the publishing request does not carry explicit validity period information
  • the verification node determines the effective time according to a predetermined agreement.
  • the issue request is provided with a validity period field, where the validity period field is used to carry the validity period information, and if the value of the validity period field is a specified value, it indicates that the publishing node device defaults.
  • the validity period information the verification node needs to determine the effective time according to the prior agreement.
  • the specified value may be "0".
  • the digital certificates may be released one by one or in batches; however, in the embodiment of the present application, whether the digital certificates are issued one by one or the digital certificates are issued in batches; the digital certificates do not include the validity period information. . It is worth noting that if the digital certificate is released in batches, the publication request carrying the validity period information may only carry the common validity period information of the plurality of digital certificates issued in batches. Thus, when the effective time is reached, the accounting node can write the digital certificate issued in batches into the block of the blockchain.
  • the publishing node can also set the validity period information of the digital certificate issued in batch in the blockchain network, and the accounting node and the verification node can also determine the effective time of the digital certificate through the specially issued validity period information, in short. Regardless of how the digital certificate's effective time is determined, the accounting node will only record the corresponding digital certificate into the blockchain when the digital certificate's effective time is reached.
  • this embodiment provides a digital certificate processing apparatus, including:
  • the first receiving module 110 is configured to receive a publishing request for a digital certificate, where the digital certificate does not include validity period information;
  • the obtaining module 120 is configured to obtain a verification result of the digital certificate
  • the recording module 130 is configured to record the verified digital certificate to the blockchain according to the verification result.
  • the recording module 130 is configured to record the verified digital certificate to the blockchain according to the verification result if the effective time of the digital certificate is reached.
  • the digital certificate processing device can be applied to a billing node.
  • the first receiving module 110, the obtaining module 120, and the recording module 130 are all program modules. After the execution of the processor, the program modules can receive the release request, receive or automatically generate the verification result, and And the generation of blocks in the blockchain.
  • the billing node itself also functions as a verification node, and obtaining the verification result may include: self-verifying the digital certificate to obtain a verification result of the digital certificate.
  • the digital certificate itself does not carry the validity period information, and the accounting node only records the valid digital certificate into the blockchain, thereby avoiding a large number of the blockchains that are not yet effective.
  • the introduction of digital certificates can greatly reduce the amount of data in the blockchain, thereby reducing the storage resources occupied by the blockchain and the amount of verification data required for the blockchain to continue to grow.
  • the first receiving module 110 is configured to receive a publishing request that carries the validity period information, where the validity period information is used to determine the effective time.
  • the first receiving module 110 may be configured to receive a release request of the default validity period information; the effective time is based on a pre-agreed.
  • the apparatus further includes:
  • the effective time determining module is configured to determine the effective time according to the validity period information or a predetermined agreement.
  • the obtaining module 120 is further configured to obtain the verification result that is issued when the effective time is reached.
  • this embodiment provides a digital certificate processing apparatus, including:
  • the second receiving module 210 is configured to receive a publishing request of the digital certificate, where the digital certificate does not include validity period information;
  • the determining module 220 is configured to determine an effective time of the digital certificate
  • the verification module 230 is configured to verify that the digital certificate obtains the verification result if the digital certificate is valid.
  • the publishing module 240 is configured to issue a verification result of the digital certificate.
  • the second receiving module 210, the determining module 220, the verifying module 230, and the issuing module 240 in this embodiment may all correspond to program modules, and the program modules may be executed by a processor or a processing circuit, if executed by a processor or a processing circuit. After that, the operation of receiving the release request, determining the effective time, and verifying the digital certificate can be performed, so that the result of the verification of the digital certificate in the blockchain network is convenient for the accounting node to record the verified digital certificate to the blockchain. in.
  • the second receiving module 210 is configured to receive the publishing request that carries the validity period information; the determining module 220 is configured to determine the effective time according to the validity period information.
  • the second receiving module 210 may be further configured to receive a release request of the default validity period information; the determining module 220 may be further configured to determine the effective time according to a predetermined agreement.
  • the embodiment provides a blockchain node, including:
  • the transceiver 310 is configured to send and receive information
  • the memory 320 is configured to store information and at least store computer executable instructions
  • the processor 330 is coupled to the transceiver 310 and the memory 320, respectively, configured to control the operation of the transceiver 310 and the memory 320, and can be provided by executing any of the foregoing embodiments of the computer executable instructions
  • the digital certificate processing method for example, can implement one or more of the methods shown in FIGS. 1 through 3.
  • the blockchain node provided in this embodiment may be the foregoing billing node or verification node. If the blockchain node is the foregoing accounting node, at least one or more of the foregoing methods shown in FIG. 1 to FIG. 2 may be performed, and if the blockchain node is the foregoing verification node, at least The method shown in FIG. 3 can be performed.
  • the transceiver 310 can correspond to various types of communication interfaces, such as a wired interface or a wireless interface.
  • the memory 320 can include a storage medium that can store various information, such as computer-executable instructions executable by a processor, such as a target program and/or source program for execution by a computer.
  • the processor 330 can be separately connected to the memory and the transceiver through various bus structures such as an integrated circuit bus, so that the digital certificate recording and verification and the like provided by the one or more technical solutions can be implemented.
  • the embodiment of the present application further provides a computer storage medium, where the computer storage medium stores computer executable instructions; after the computer executable instructions are executed, the one or more provided digital certificate processing methods can be implemented, for example, One or more of the digital certificate processing methods shown in FIGS. 1 through 3.
  • the computer storage medium provided in this embodiment may be: a mobile storage device, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and the like, and the program code may be stored.
  • the computer storage medium may comprise a non-transitory storage medium.
  • the disclosed apparatus and methods may be implemented in other ways.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner such as: multiple units or components may be combined, or Can be integrated into another system, or some features can be ignored or not executed.
  • the coupling, or direct coupling, or communication connection of the components shown or discussed may be indirect coupling or communication connection through some interfaces, devices or units, and may be electrical, mechanical or other forms. of.
  • FIG. 7 shows a blockchain system comprising: a plurality of blockchain nodes; these blockchain nodes can be used for distributed storage of digital certificates.
  • FIG. 8 shows a blockchain system in which the blockchain nodes shown in FIG. 7 are divided into a billing node and a verification node.
  • Figure 7 illustrates that the blockchain system includes a plurality of blockchain nodes, for example, from blockchain node 1 to blockchain node n.
  • Figure 8 shows the Boaquet base station node, the verification node 1 to the verification node n in the blockchain system, and also the user nodes that are also shown.
  • the user node shown in FIG. 8 may correspond to the certificate entity user in FIG.
  • Blockchain node used to authenticate user requests and generate new blocks through consensus algorithms.
  • Certificate entity user The owner of the final entity certificate.
  • Certificate relying party A user who trusts the certificate system.
  • the above three types of nodes are all logical nodes.
  • This example uses a simplified digital certificate, which mainly includes user name, public key, extension, digital signature, etc., where the user name is used to identify the user's identity, and the public key is the certificate user's public key, extension.
  • the digital signature means that the certificate consumer signs the certificate with the corresponding private key.
  • the blockchain is linked by blocks, thereby forming a blockchain, and block 1 to block s are shown in FIG.
  • the block is divided into a block header and a block body, and the block header can store information such as a signature linked to the previous block.
  • the block contains several records, each of which includes the certificate information of a digital certificate and the status of the certificate.
  • the certificate information may be a value after the function is calculated by the function (for example, a hash function such as a hash function), or may be an untransformed certificate itself; the certificate status may be normal, logout, suspended, or the like.
  • the certificate information includes certificate content or information related to the certificate content.
  • the certificate entity user generates a digital certificate including user name, public key, signature, extension, and the like;
  • the certificate entity (corresponding to the aforementioned digital certificate issuing node) initiates a certificate issuance request to the blockchain network, the request including the digital certificate of the user and the effective time of the digital certificate desired by the user.
  • the default default effective time can also be agreed. If there is no effective time in the request, the default is taken as the standard.
  • the certificate issuance of the digital certificate may include:
  • Each blockchain node collects the digital certificate issuance request in the network, and verifies whether the digital certificate information is correct, including verifying the digital certificate, format check, and signature verification; and only if the digital certificate is in the correct format and verified by the signature, the digital certificate can be considered as a digital certificate. Pass the verification, otherwise it can be considered not to pass the verification.
  • Each blockchain node generates a new block based on the consensus mechanism.
  • Each node participating in the consensus checks the effective time of the digital certificate expected by the user, and records only the digital certificate and its status information that arrive at the effective time into the blockchain.
  • This example also provides for the use of a digital certificate, including:
  • the certificate entity user In the process of using digital certificates (for example, Security Layer Protocol (TLS), Internet Security Protocol (IPSec) and other security protocols), the certificate entity user needs to submit the certificate to the relying party, and the relying party checks the certificate. Effectiveness.
  • TLS Security Layer Protocol
  • IPSec Internet Security Protocol
  • the relying party stores complete blockchain information, you can look up the certificate and the status of the certificate in the blockchain: if the latest status of the digital certificate is normal, the digital certificate is valid; otherwise, the digital certificate is invalid (if the block If there is no certificate information in the chain, it means that the digital certificate or digital certificate is not yet valid. If there is a digital certificate but the status is logout or suspended, the digital certificate is not available.
  • the certificate query request may be initiated to the blockchain network, where the request includes the certificate information to be queried, for example, the value of the certificate after the function operation (for example, a hash function such as a hash function), It may be an untransformed digital certificate itself; a node in the blockchain (such as a verification node) feeds back the query result to the relying party, and the query result contains the latest state information of the digital certificate to be checked.
  • the function operation for example, a hash function such as a hash function
  • the digital certificate is valid; otherwise, the digital certificate is invalid (if there is no certificate information in the blockchain, it means that the digital certificate or digital certificate is not yet valid, if there is a digital certificate but the status is logout or Suspended, the digital certificate is not available).
  • This example also provides a method for logout, suspend, and recover digital certificates, including:
  • the certificate entity user submits a certificate logout, suspend, and resume request, and the request includes the user's certificate information, and information confirming the user's identity (such as the user's signature information), and may also include the expected logout, suspension, and recovery time. ;
  • the blockchain node collects the user's certificate logout, suspend, and resume requests, and verifies the user's identity according to the information submitted by the user;
  • Each blockchain node uses the consensus mechanism to generate a new block.
  • Each node participating in the consensus checks the digital certificate logout, suspend, and recovery time expected by the user, and only logs out, suspends, and The digital certificate information of the recovery time and its status information are recorded in the blockchain.
  • the digital certificate cancellation may be the use of a permanent termination digital certificate; the suspension of the digital certificate is: temporarily suspending the use of the digital certificate; the recovery of the digital certificate is: rewriting the startup of the suspended digital certificate use.
  • Each record includes certificate information and certificate status.
  • the certificate information may be a value obtained by the function of the certificate (for example, a hash function such as a hash function), or may be an untransformed certificate itself.
  • the status of the certificate recorded in the blockchain is logout, suspend, and normal.
  • this example provides a digital certificate; the digital certificate does not include the validity period information of the digital certificate, and only includes the user name, public key, extension, digital signature, and the like.
  • this example also provides a digital certificate issuance request: the user creates a digital certificate, publishes the digital certificate and the expected effective time to the blockchain network.
  • this example also provides a digital certificate issuance method: the blockchain node collects the digital certificate issuance request, verifies the validity of the certificate, and adds the digital certificate and its status to the effective time through the consensus mechanism. Omit the validity period information in the traditional certificate, submit the validity period information at the time of publication, make full use of the blockchain consensus mechanism, and record only the digital certificate that arrives at the effective time.
  • the units described above as separate components may or may not be physically separated, and the components displayed as the unit may or may not be physical units, that is, may be located in one place or distributed to multiple network units; Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing module, or each unit may be separately used as one unit, or two or more units may be integrated into one unit;
  • the unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

本申请实施例公开了一种数字证书处理方法及装置、区块链节点、存储介质。所述数字证书处理方法包括：接收数字证书的发布请求，其中，所述数字证书不包含有效期信息；获取所述数字证书的验证结果；根据所述验证结果将通过验证的数字证书记录到区块链。

Description

数字证书处理方法及装置、区块链节点、存储介质
相关申请的交叉引用
本申请基于申请号为201810327867.6、申请日为2018年04月12日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本申请涉及信息安全技术领域但不限于信息安全技术领域，尤其涉及一种数字证书处理方法及装置、区块链节点、存储介质。
背景技术
公钥基础设施(Public Key Infrastructure，PKI)在信息安全领域扮演着重要的角色，广泛应用于数据加密、解密、数据完整性保护、数字签名及身份认证等多种安全活动中。而数字证书是实现PKI技术中的重要载体，数字证书的内容一般包括：证书持有者的信息、证书签发机构的信息、持有者的公钥、证书有效期、证书用途、证书的签发机构。
数字证书一般是由权威机构颁发的，颁发数字证书的过程也可以称为认证授权(Certification Authority，CA)过程。现有PKI技术中，CA是PKI的核心，是信任的起点，如果能够控制一个CA，那么就可以利用该CA机构随意签发数字证书，因此，处于核心的CA极易遭受攻击。一旦某个CA被破坏，那么该CA签发的所有数字证书都不再安全，不能继续使用。
区块链技术是基于分布式存储系统，能够由多个验证节点对颁发的数字证书基于共识机制进行验证，并在通过验证之后进行分布式存储。故， 若将数字证书与区块链技术结合使用，可以顺利的解决上述问题。
区块链中却有一个很大的问题，区块链中会包含所有的历史数字证书，随着时间的推移，区块链中存储的数字证书会不断的增多，整个区块链存储的数据量会越来越大，需要验证节点的存储和计算资源也越来越多，给验证节点带来严重的负担，影响验证节点的运行和用户的体验。
故如何减少数字证书的区块链的数据存储量，一方面减少存储资源，另一方面减少区块链在后续生长过程中计算和验证所需的计算量和计算资源，是先有技术急需解决的技术问题。
发明内容
有鉴于此，本申请实施例期望提供一种数字证书处理方法及装置、区块链节点、存储介质，至少部分解决上述问题。
本申请的技术方案是这样实现的：
第一方面，本申请实施例提供一种数字证书处理方法，包括：
接收数字证书的发布请求，其中，所述数字证书不包含有效期信息；
获取所述数字证书的验证结果；
根据所述验证结果将通过验证的数字证书记录到区块链。
第二方面，本申请实施例提供一种数字证书处理方法，包括：
接收数字证书的发布请求，其中，所述数字证书不包含有效期信息；
确定所述数字证书的生效时间；
若达到所述数字证书的生效时间，验证所述数字证书获得验证结果；
发布所述数字证书的验证结果。
第三方面，本申请实施例提供一种数字证书处理装置，包括：
第一接收模块，配置为接收数字证书的发布请求，其中，所述数字证书不包含有效期信息；
获取模块，配置为获取所述数字证书的验证结果；
记录模块，配置为若达到所述数字证书的生效时间，根据所述验证结果将通过验证的数字证书记录到区块链。
第四方面，本申请实施例提供一种数字证书验证装置，包括：
第二接收模块，配置为接收数字证书的发布请求，其中，所述数字证书不包含有效期信息；
确定模块，配置为确定所述数字证书的生效时间；
验证模块，配置为若达到所述数字证书的生效时间，验证所述数字证书获得验证结果；
发布模块，配置为发布所述数字证书的验证结果。
第五方面，本申请实施例提供一种区块链节点，包括：
收发器，配置为信息收发；
存储器，配置为信息存储，且至少存储有计算机可执行指令；
处理器，分别于所述收发器及所述存储器连接，配置为控制所述收发器及所述存储器的运行，并能够通过执行所述计算机可执行指令实现第一方面或第二方面任意一个实施例提供的数字证书处理方法。
第六方面，本申请实施例提供一种计算机存储介质，所述计算机存储介质存储有计算机可执行指令；所述计算机可执行指令被执行后，能够实现第一方面或第二方面任意一个实施例提供的数字证书处理方法。
本申请实施例提供的数字证书处理方法及装置、区块链节点、存储介质。
一方面，数字证书自身不再包含有效期信息，故相对于包括有效期信息的数字证书减少了数据量，对于存储有海量的数字证书而言，大大减少了数据量。
另一方面，若达到生效时间，才将通过验证的数字证书记录到区块链中，记录到区块链中的数字证书是在达到生效时间的，避免了没有生效的 数字证书记录到区块链中导致区块链长及记录的信息多的问题，故利用本申请实施例生成的区块链具有数据量少及占用的存储空间小的特点；
再一方面，如区块链的数据量减少了，从而在区块链生长的过程中需要验证的数据量也减少了，故可以减少验证所产生的计算量及所消耗的资源，提升验证效率并节省验证资源。
附图说明
图1为本申请实施例提供的第一种数字证书处理方法的流程示意图；
图2为本申请实施例提供的第二种数字证书处理方法的流程示意图；
图3为本申请实施例提供的第三种数字证书处理方法的流程示意图；
图4为本申请实施例提供的一种数字证书处理装置的结构示意图；
图5为本申请实施例提供的另一种数字证书处理装置的结构示意图；
图6为本申请实施例提供的一种区块链节点的结构示意图；
图7为本申请实施例提供的一种区块链系统的结构示意图；
图8为本申请实施例提供的另一种区块链系统的结构示意图；
图9为本申请实施例提供的一种存储有数字证书的区块链。
具体实施方式
以下结合说明书附图及具体实施例对本申请的技术方案做进一步的详细阐述。
如图1所示，本实施例提供一种数字证书处理方法，包括：
步骤S110：接收数字证书的发布请求，其中，所述数字证书不包含有效期信息；
步骤S120：获取所述数字证书的验证结果；
步骤S130：根据所述验证结果将通过验证的数字证书记录到区块链；可选地，所述步骤S130可包括：若达到所述数字证书的生效时间，根据所述验证结果将通过验证的数字证书记录到区块链。
本实施例提供的数字证书处理方法，可为应用于区块链系统中记账节点的方法。在本实施例中记账节点接收到的请求发布的数字证书，该数字证书自身并不包含有效期信息。故本实施例提供的数字证书相对于包含有有效期信息的数字证书的内容少，数字证书自身的信息量上占用的存储空间少。
与此同时，记账节点会获取该数字证书的验证结果，该验证结果可为是记账节点基于共识机制进行验证之后发布的验证结果，该验证结果可表明该数字证书是否通过验证。
在步骤S130中在达到数字证书的生效时间时，才根据验证结果将通过验证的数字证书的记录到区块链中。
在一些实施例中，会根据验证结果并基于共识机制确定所述数字证书是否通过，例如，有N个验证节点参与所述数字证书是有验证，仅有达到预定比例的验证节点发布的验证结果表示该数字证书通过验证，或者，达到预定个数的验证节点提供的验证结果表明该数字证书通过验证，才最终确定该数字证书通过验证，才执行将该数字证书记录到区块链中的操作。
故本实施例中记录到区块链中的数字证书均具有以下特点：
第一：记录到区块链中的数字证书自身不包含有效期信息，数字证书自身产生的数据量少，占用的存储空间小；
第二：记录到区块链中的数字证书都已经达到其生效时间，即区块链中不会存在未达到生效时间的数字证书，如此，避免区块链中引入了大量没有生效的数字证书，从而导致区块链的区块多及区块链长的问题，如此，可以减少区块链的区块生成过程中验证时间长及验证资源消耗大的问题。
为了确保写入到区块链中的数字证书都已经达到其生效时间，在本实施例中，记账节点需要确定当前时间是否达到数字证书的生效时间，也可以由验证节点在生效时间时才发布验证结果。如此，记账节点接收到在生效时间发布的验证结果，则记账节点可默认当前时间已经达到该验证结果对应的数字证书的生效时间。
在一些实施例中，所述步骤S110可包括：
接收携带有所述有效期信息的发布请求，其中，所述有效期信息用于确定所述生效时间。
在本实施例中，所述发布请求包括需要发布的数字证书及不包含在数字证书内但是与数字证书对应的有效期信息。此时，记账节点在接收到发布请求之后，会根据发布请求中的有效期信息确定所述生效时间。
在一些实施例中所述有效期信息至少包括：所述数字证书的所述生效时间的指示信息。
在还有一实施例中，所述步骤S110可包括：
接收缺省所述有效期信息的发布请求；
所述生效时间是基于预先约定的。
在本实施例中所述发布请求自身并未携带有数字证书，且发布请求中也未携带有有效期信息，则记账节点可以根据预先约定确定所述生肖时间，例如，记账节点可以根据默认准则确定所述生效时间，也可以根据与发布节点的预先协商确定所述生效时间。
故如图2所示，所述方法，包括：
步骤S121：根据所述有效期信息或预先约定确定所述生效时间。
在本实施例中，记账节点在接收到发布请求和、或验证结果之后，会根据发布请求携带的有效期信息或者预先约定确定出生效时间。在确定出生效时间之后，确定当前是否达到所述生效时间，若达到生效时间，将验 证通过的数字证书添加到区块链中。
在另一些实施例中，所述步骤S120可包括：获取在达到所述生效时间时发布的所述验证结果。
若验证节点是在达到生效时间才发布验证结果，则记账节点一旦接收到验证节点发布的某一个数字证书的验证结果，表明当前已经达到生效时间，则记账节点就可以不用再自行验证当前是否达到生效时间，可以直接根据验证结果，将通过验证的数字证书加入到区块链中，如此，添加到区块链中的数字证书也是达到其生效时间的。
如图3所示，本示例提供一种数字证书处理方法，包括：
步骤S210：接收数字证书的发布请求，其中，所述数字证书不包含有效期信息；
步骤S220：确定所述数字证书的生效时间；
步骤S230：若达到所述数字证书的生效时间，验证所述数字证书获得验证结果；
步骤S240：发布所述数字证书的验证结果。
本实施例提供的数字证书处理方法可为应用于验证节点中的方法，验证节点接收到的发布请求中携带的数字证书自身是不携带有有效期信息的。
在一些实施例中验证节点可以直接对该数字证书进行基于共识机制的验证，然后在区块链网络中发布验证结果，再由记录节点在达到生效时间时，将通过验证的数字证书写入到区块链中。但是在本实施例中所述验证节点会确定数字证书的生效时间，只有在达到生效时间时，才对对应的数字证书进行验证，并发布验证结果。如此发布到区块链网络中的验证结果对应的数字证书的生效时间都已经达到。
在本实施例中所述验证所述数字证书包括以下至少之一：
验证所述数字证书的内容是否正确；
验证所述数字证书的内容是否完整；
验证所述数字证书是否还在有效期内。
可选地，所述步骤S210可包括：接收携带有所述有效期信息的所述发布请求；所述步骤S220可包括：根据所述有效期信息确定所述生效时间。
该有效期信息至少包括生效时间的指示信息，如此可以根据有效期信息确定出生效时间，在另一些实施例中，所述有效期信息还可包括：数字证书的结束时间，如此，该数字证书合适停止使用是决定于结束时间的。
在一些实施例中，所述步骤S210可包括：接收缺省所述有效期信息的发布请求；所述步骤S220可包括：根据预先约定确定所述生效时间。
在有些实施例中，所述发布请求中并未携带有明确的有效期信息，则所述验证节点会根据预先约定确定所述生效时间。
例如，在发明本实施例中，所述发布请求中设置有有有效期字段，该有效期字段用于承载所述有效期信息，若该有效期字段的取值为指定值，表示发布节点器缺省所述有效期信息，则验证节点需要根据预先约定确定所述生效时间。例如，所述指定值可为“0”。
在一些实施例中，所述数字证书可以逐一发布，也可以批量发布；但是在本申请实施例中不管是逐一发布的数字证书，还是批量发布的数字证书；所述数字证书均不包括有效期信息。值得注意的是，若数字证书批量发布，则携带有效期信息的发布请求，可以仅携带批量发布的多个数字证书的共同有效期信息。如此，在生效时间达到时，记账节点可以将批量发布的数字证书一同写入到区块链的区块中。由于批量发布数字证书，发布节点还可在区块链网络中设置批量发布的数字证书的有效期信息，则记账节点及验证节点还可以通过专门发布的有效期信息确定出数字证书的生效时间，总之不管数字证书的生效时间是如何确定的，记账节点仅会在达到 数字证书的生效时间时，才将对应的数字证书记录到区块链中。
如图4所示，本实施例提供一种数字证书处理装置，包括：
第一接收模块110，用于接收数字证书的发布请求，其中，所述数字证书不包含有效期信息；
获取模块120，配置为获取所述数字证书的验证结果；
记录模块130，配置为根据所述验证结果将通过验证的数字证书记录到区块链。
在一些实施例中，所述记录模块130，配置为若达到所述数字证书的生效时间，根据所述验证结果将通过验证的数字证书记录到区块链。
该数字证书处理装置可应用于记账节点。在本实施例中所述第一接收模块110、获取模块120及记录模块130均为程序模块，这些程序模块通过处理器的执行之后，能够实现发布请求的接收、验证结果的接收或自动生成、及区块链中区块的生成。
在一些实施例中，所述记账节点自身也充当验证节点，则获取所述验证结果可包括：自行验证所述数字证书，从而获得所述数字证书的验证结果。
总之，在本实施例中所述数字证书自身是不携带所述有效期信息的，且记账节点仅会将生效的数字证书记录到区块链中，从而避免了区块链中大量尚未生效的数字证书的引入，从而可以大大的减少区块链的数据量，从而减少区块链占用的存储资源及区块链继续生长所需要验证的验证数据量等。
所述第一接收模块110，配置为接收携带有所述有效期信息的发布请求，其中，所述有效期信息用于确定所述生效时间。
所述第一接收模块110，可配置为接收缺省所述有效期信息的发布请求；所述生效时间是基于预先约定的。
在还有一些实施例中，所述装置还包括：
生效时间确定模块，配置为根据所述有效期信息或预先约定确定所述生效时间。
在另一些实施例中，所述获取模块120，还配置为获取在达到所述生效时间时发布的所述验证结果。
如图5所示，本实施例提供一种数字证书处理装置，包括：
第二接收模块210，配置为接收数字证书的发布请求，其中，所述数字证书不包含有效期信息；
确定模块220，配置为确定所述数字证书的生效时间；
验证模块230，配置为若达到所述数字证书的生效时间，验证所述数字证书获得验证结果；
发布模块240，配置为发布所述数字证书的验证结果。
本实施例中的第二接收模块210、确定模块220、验证模块230及发布模块240，均可对应于程序模块，这些程序模块可以被处理器或处理电路执行，若被处理器或处理电路执行后，能够实现发布请求的接收、生效时间的确定及数字证书的验证等操作，从而使得区块链网络中有数字证书的验证结果，方便记账节点将通过验证的数字证书记录到区块链中。
所述第二接收模块210，配置为接收携带有所述有效期信息的所述发布请求；所述确定模块220，配置为根据所述有效期信息确定所述生效时间。
进一步地，所述第二接收模块210，还可配置为接收缺省所述有效期信息的发布请求；所述确定模块220还可配置为根据预先约定确定所述生效时间。
如图6所示，本实施例提供一种区块链节点，包括：
收发器310，配置为信息收发；
存储器320，配置为信息存储，且至少存储有计算机可执行指令；
处理器330，分别与所述收发器310及所述存储器320连接，配置为控制所述收发器310及所述存储器320的运行，并能够通过执行所述计算机可执行指令前述任意一个实施例提供的数字证书处理方法，例如，可实现图1至图3所示方法中的一个或多个。
本实施例提供的区块链节点可为前述的记账节点或者验证节点。若该区块链节点为前述的记账节点，则至少可以执行前述的图1至图2所示的方法中的一个或多个，若所述区块链节点为前述的验证节点，则至少可执行图3所示的方法。
所述收发器310可对应于各种类型的通信接口，例如，有线接口或无线接口等。
所述存储器320可包括存储介质，可以存储各种信息，例如，可供处理器执行的计算机可执行指令，例如，可供计算机执行的目标程序和、或源程序等。
所述处理器330可以通过集成电路总线等各种总线结构与所述存储器及收发器分别连接，从而能够实现前述一个或多个技术方案提供的数字证书记录及验证等处理。
本申请实施例还提供一种计算机存储介质，所述计算机存储介质存储有计算机可执行指令；所述计算机可执行指令被执行后，能够实现前述一个或多个提供的数字证书处理方法，例如，图1至图3所示数字证书处理方法中的一个或多个。
本实施例提供的计算机存储介质可为：移动存储设备、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质；可选地，所述计算机存储介质可包括：非瞬间存储介质。
在本申请所提供的几个实施例中，应该理解到，所揭露的设备和方 法，可以通过其它的方式实现。以上所描述的设备实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，如：多个单元或组件可以结合，或可以集成到另一个系统，或一些特征可以忽略，或不执行。另外，所显示或讨论的各组成部分相互之间的耦合、或直接耦合、或通信连接可以是通过一些接口，设备或单元的间接耦合或通信连接，可以是电性的、机械的或其它形式的。
以下结合上述任意实施例提供几个具体示例：
图7所示为一种区块链系统，包括：多个区块链节点；这些区块链节点可以用于分布式存储数字证书。图8所示为一种区块链系统，该区块链系统中将图7中所示区块链节点分为了记账节点及验证节点。图7展示了区块链系统包括多个区块链节点，例如，从区块链节点1至区块链节点n。图8展示了区块链系统中博阿凯基站节点、验证节点1至验证节点n，同时还展示的用户节点。图8所示的用户节点可对应于图7中的证书实体用户。
区块链节点：用于验证用户请求，通过共识算法产生新区块。
证书实体用户：最终实体证书的拥有者。
证书依赖方：信任证书系统的使用者。
上述三类节点均是逻辑节点。
本示例采用一种简化的数字证书，主要包括使用者名称、公钥、扩展项、数字签名等信息，其中使用者名称用于标识使用者身份，公钥是证书使用者的公钥，扩展项用以标记该证书基于区块链产生和使用，数字签名指证书使用者使用相应的私钥对该证书进行签名。
如图9所示，区块链由一个个的区块链接而成，从而形成了区块链，在图9中展示有区块1至区块s。区块分为区块头和区块体，区块头可 存储有链接到前一个区块的签名等信息。区块体中包含若干条记录，每一条记录包括一个数字证书的证书信息以及证书状态。证书信息可以是证书经过函数运算后的值(例如Hash函数等散列变换)，也可以是未经变换的证书本身；证书状态可以为正常、注销、挂起等。所述证书信息包括证书内容或与证书内容相关的信息。
证书实体用户生成一份数字证书，该数字证书包括使用者名称、公钥、签名、扩展项等信息；
证书实体(对应于前述的数字证书发布节点)用户向区块链网络发起证书发布请求，该请求中包括用户的数字证书，以及用户期望的数字证书的生效时间。在具体实施时，还可以约定默认的缺省生效时间，若请求中无生效时间则以默认为准。
所述数字证书的证书发布可包括：
每个区块链节点收集网络中数字证书发布请求，验证数字证书信息是否正确，包括验证数字证书逇格式检查及签名验证等内容；只有数字证书的格式正确且通过签名验证，则可认为数字证书通过验证，否则可认为不通过验证。
每个区块链节点基于共识机制生成一个新区块，参与共识的每个节点检查用户期望的数字证书生效时间，仅将到达生效时间的数字证书及其状态信息记录到区块链中。
本示例还提供一种数字证书的使用，包括：
在数字证书使用过程中(例如，安全传输层协议(Transport Layer Security，TLS)、英特网安全协议(IPSec)等安全协议)，证书实体用户需要将证书提交给依赖方，依赖方检查证书的有效性。
如果依赖方存储有完整的区块链信息，那么可以在区块链中查找证书以及证书的状态：若数字证书最新的状态为正常，则数字证书有效； 否则，该数字证书无效(若区块链中无证书信息，则说明无该数字证书或数字证书尚未生效，若有数字证书但状态为注销或挂起，则说明数字证书不可用)。
如果依赖方本地无区块链信息，那么可以向区块链网络发起证书查询请求，请求中包含待查询的证书信息，例如证书经过函数运算后的值(例如Hash函数等散列变换)，也可以是未经变换的数字证书本身；区块链中的节点(如验证节点)向依赖方反馈查询结果，查询结果中包含待查数字证书的最新状态信息。若数字证书最新状态为正常，则数字证书有效；否则，该数字证书无效(若区块链中无证书信息，则说明无该数字证书或数字证书尚未生效，若有数字证书但状态为注销或挂起，则说明数字证书不可用)。
本示例还提供一种数字证书的注销、挂起、恢复的方法，包括：
证书实体用户提交证书注销、挂起、恢复请求，该请求中包括用户的证书信息，以及证实用户身份的信息(例如用户的签名信息)，此外，还可以包含期望的注销、挂起、恢复时间；
区块链节点收集用户的证书注销、挂起、恢复请求，根据用户提交的信息验证用户身份；
每个区块链节点使用共识机制生成一个新区块，参与共识的每个节点检查用户期望的数字证书注销、挂起、恢复时间，仅将经过验证的、到达期望的数字证书注销、挂起、恢复时间的数字证书信息及其状态信息记录到区块链中。此处，所述数字证书注销可为永久终止数字证书的使用；所述数字证书的挂起为：暂时中止数字证书的使用；所述数字证书的恢复为：重写启动挂起的数字证书的使用。
每一条记录包括证书信息以及证书状态。其中证书信息可以是证书经过函数运算后的值(例如Hash函数等散列变换)，也可以是未经变换 的证书本身。
针对注销、挂起、恢复操作，记录到区块链中的证书状态分别为注销、挂起、正常。
总之，本示例提供了一种数字证书；该数字证书并不包括数字证书的有效期信息，仅包括使用者名称、公钥、扩展项、数字签名等信息。与此同时，本示例还提供了一种数字证书发布请求：用户制作数字证书，将数字证书以及期望的生效时间发布到区块链网络。此外，本示例还提供了一种数字证书发布方法：区块链节点收集数字证书发布请求，验证证书的合法性，通过共识机制将到达生效时间的数字证书及其状态加入到区块链中。省略传统证书中的有效期信息，在发布时提交有效期信息，充分利用区块链共识机制，仅记录到达生效时间的数字证书。
上述作为分离部件说明的单元可以是、或也可以不是物理上分开的，作为单元显示的部件可以是、或也可以不是物理单元，即可以位于一个地方，也可以分布到多个网络单元上；可以根据实际的需要选择其中的部分或全部单元来实现本实施例方案的目的。
另外，在本申请各实施例中的各功能单元可以全部集成在一个处理模块中，也可以是各单元分别单独作为一个单元，也可以两个或两个以上单元集成在一个单元中；上述集成的单元既可以采用硬件的形式实现，也可以采用硬件加软件功能单元的形式实现。
本领域普通技术人员可以理解：实现上述方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成，前述的程序可以存储于一计算机可读取存储介质中，该程序在执行时，执行包括上述方法实施例的步骤。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内， 可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (13)

  1. 一种数字证书处理方法，包括：
    接收数字证书的发布请求，其中，所述数字证书不包含有效期信息；
    获取所述数字证书的验证结果；
    根据所述验证结果将通过验证的数字证书记录到区块链。
  2. 根据权利要求1所述的方法，其中，所述根据所述验证结果将通过验证的数字证书记录到区块链，包括：
    若达到所述数字证书的生效时间，根据所述验证结果将通过验证的数字证书记录到区块链。
  3. 根据权利要求2所述的方法，其中，
    所述接收数字证书的发布请求，包括：
    接收携带有所述有效期信息的发布请求，其中，所述有效期信息用于确定所述生效时间。
  4. 根据权利要求2所述的方法，其中，
    所述接收数字证书的发布请求，包括：
    接收缺省所述有效期信息的发布请求；其中，所述生效时间是基于预先约定的。
  5. 根据权利要求3或4所述的方法，其中，
    所述方法，包括：
    根据所述有效期信息或预先约定确定所述生效时间。
  6. 根据权利要求2所述的方法，其中，
    所述获取所述数字证书的验证结果，包括：
    获取在达到所述生效时间时发布的所述验证结果。
  7. 一种数字证书处理方法，其中，包括：
    接收数字证书的发布请求，其中，所述数字证书不包含有效期信息；
    确定所述数字证书的生效时间；
    若达到所述数字证书的生效时间，验证所述数字证书获得验证结果；
    发布所述数字证书的验证结果。
  8. 根据权利要求7所述的方法，其中，
    所述接收数字证书的发布请求，包括：
    接收携带有所述有效期信息的所述发布请求；
    所述确定所述数字证书的生效时间，包括：
    根据所述有效期信息确定所述生效时间。
  9. 根据权利要求7所述的方法，其中，
    所述接收数字证书的发布请求，包括：
    接收缺省所述有效期信息的发布请求；
    所述确定所述数字证书的生效时间，包括：
    根据预先约定确定所述生效时间。
  10. 一种数字证书处理装置，包括：
    第一接收模块，配置为接收数字证书的发布请求，其中，所述数字证书不包含有效期信息；
    获取模块，配置为获取所述数字证书的验证结果；
    记录模块，配置为根据所述验证结果将通过验证的数字证书记录到区块链。
  11. 一种数字证书验证装置，包括：
    第二接收模块，配置为接收数字证书的发布请求，其中，所述数字证书不包含有效期信息；
    确定模块，配置为确定所述数字证书的生效时间；
    验证模块，配置为若达到所述数字证书的生效时间，验证所述数字证 书获得验证结果；
    发布模块，用于发布所述数字证书的验证结果。
  12. 一种区块链节点，包括：
    收发器，配置为信息收发；
    存储器，配置为信息存储，且至少存储有计算机可执行指令；
    处理器，分别与所述收发器及所述存储器连接，用于控制所述收发器及所述存储器的运行，并能够通过执行所述计算机可执行指令实现权利要求1至6或7至9任一项提供的数字证书处理方法。
  13. 一种计算机存储介质，所述计算机存储介质存储有计算机可执行指令；所述计算机可执行指令被执行后，能够实现权利要求1至6或7至9任一项提供的数字证书处理方法。
PCT/CN2019/080881 2018-04-12 2019-04-01 数字证书处理方法及装置、区块链节点、存储介质 WO2019196696A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US17/046,780 US11863692B2 (en) 2018-04-12 2019-04-01 Digital certificate processing method and device, blockchain node and storage medium
EP19785467.2A EP3780488B1 (en) 2018-04-12 2019-04-01 Digital certificate processing method and device, blockchain node and storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810327867.6A CN110380857B (zh) 2018-04-12 2018-04-12 数字证书处理方法及装置、区块链节点、存储介质
CN201810327867.6 2018-04-12

Publications (1)

Publication Number Publication Date
WO2019196696A1 true WO2019196696A1 (zh) 2019-10-17

Family

ID=68162790

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/080881 WO2019196696A1 (zh) 2018-04-12 2019-04-01 数字证书处理方法及装置、区块链节点、存储介质

Country Status (4)

Country Link
US (1) US11863692B2 (zh)
EP (1) EP3780488B1 (zh)
CN (1) CN110380857B (zh)
WO (1) WO2019196696A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2022049053A1 (en) * 2020-09-01 2022-03-10 Nagravision S.A. Media authentication

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113114463B (zh) * 2020-01-13 2023-04-07 中国移动通信有限公司研究院 一种证书注册方法、验证方法及设备
CN113541961A (zh) * 2021-07-16 2021-10-22 国家市场监督管理总局信息中心 一种强制检定信息监管方法及装置

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106385315A (zh) * 2016-08-30 2017-02-08 北京三未信安科技发展有限公司 一种数字证书管理方法及系统
CN107360001A (zh) * 2017-07-26 2017-11-17 阿里巴巴集团控股有限公司 一种数字证书管理方法、装置和系统
CN107508680A (zh) * 2017-07-26 2017-12-22 阿里巴巴集团控股有限公司 数字证书管理方法、装置及电子设备

Family Cites Families (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6839841B1 (en) * 1999-01-29 2005-01-04 General Instrument Corporation Self-generation of certificates using secure microprocessor in a device for transferring digital information
JP4758095B2 (ja) * 2004-01-09 2011-08-24 株式会社リコー 証明書無効化装置、通信装置、証明書無効化システム、プログラム及び記録媒体
US20050177715A1 (en) * 2004-02-09 2005-08-11 Microsoft Corporation Method and system for managing identities in a peer-to-peer networking environment
US8301877B2 (en) * 2008-03-10 2012-10-30 Secureauth Corporation System and method for configuring a valid duration period for a digital certificate
CN101860535A (zh) * 2010-05-26 2010-10-13 中兴通讯股份有限公司 管理家庭网关数字证书的方法及系统
US8954733B2 (en) * 2012-03-23 2015-02-10 International Business Machines Corporation Embedded extrinsic source for digital certificate validation
JP6034754B2 (ja) * 2013-06-12 2016-11-30 株式会社東芝 サーバ装置、通信システム、およびデータ発行方法
US9843452B2 (en) * 2014-12-15 2017-12-12 Amazon Technologies, Inc. Short-duration digital certificate issuance based on long-duration digital certificate validation
US20170324711A1 (en) * 2016-05-03 2017-11-09 The Real Mccoy, Llc Inc. Method for establishing, securing and transferring computer readable information using peer-to-peer public and private key cryptography
US10764067B2 (en) * 2016-05-23 2020-09-01 Pomian & Corella, Llc Operation of a certificate authority on a distributed ledger
US20170346639A1 (en) 2016-05-24 2017-11-30 Business Information Exchange System Corp. Public Key Infrastructure based on the Public Certificates Ledger
US10305694B2 (en) * 2016-05-27 2019-05-28 Mastercard International Incorporated Method and system for efficient distribution of configuration data utilizing permissioned blockchain technology
US10547457B1 (en) * 2016-10-21 2020-01-28 Wells Fargo Bank N.A. Systems and methods for notary agent for public key infrastructure names
US10615987B2 (en) * 2017-03-08 2020-04-07 Amazon Technologies, Inc. Digital certificate usage monitoring systems
US10102526B1 (en) * 2017-03-31 2018-10-16 Vijay K. Madisetti Method and system for blockchain-based combined identity, ownership, integrity and custody management
CN107368259B (zh) * 2017-05-25 2020-07-10 创新先进技术有限公司 一种向区块链系统中写入业务数据的方法和装置
CN107592293A (zh) * 2017-07-26 2018-01-16 阿里巴巴集团控股有限公司 区块链节点间通讯方法、数字证书管理方法、装置和电子设备
US10454690B1 (en) * 2017-08-04 2019-10-22 Amazon Technologies, Inc. Digital certificates with distributed usage information
CN107508682A (zh) * 2017-08-16 2017-12-22 努比亚技术有限公司 浏览器证书认证方法及移动终端
CN107769922B (zh) * 2017-10-31 2020-02-18 捷德（中国）信息科技有限公司 区块链安全管理系统及方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106385315A (zh) * 2016-08-30 2017-02-08 北京三未信安科技发展有限公司 一种数字证书管理方法及系统
CN107360001A (zh) * 2017-07-26 2017-11-17 阿里巴巴集团控股有限公司 一种数字证书管理方法、装置和系统
CN107508680A (zh) * 2017-07-26 2017-12-22 阿里巴巴集团控股有限公司 数字证书管理方法、装置及电子设备

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3780488A4 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2022049053A1 (en) * 2020-09-01 2022-03-10 Nagravision S.A. Media authentication

Also Published As

Publication number Publication date
US11863692B2 (en) 2024-01-02
EP3780488B1 (en) 2023-05-03
EP3780488A1 (en) 2021-02-17
CN110380857A (zh) 2019-10-25
EP3780488A4 (en) 2021-05-26
CN110380857B (zh) 2020-09-11
US20210167973A1 (en) 2021-06-03

Similar Documents

Publication Publication Date Title
US10728229B2 (en) Method and device for communicating securely between T-box device and ECU device in internet of vehicles system
CN114154135B (zh) 基于国密算法的车联网通信安全认证方法、系统及设备
US10067810B2 (en) Performing transactions between application containers
WO2018112940A1 (zh) 区块链节点的业务执行方法、装置及节点设备
CN108596588B (zh) 一种区块数据的处理方法、装置、计算设备和存储介质
WO2019011179A1 (zh) 证书管理方法、系统、网络设备及计算机可读存储介质
US9680827B2 (en) Geo-fencing cryptographic key material
US9654922B2 (en) Geo-fencing cryptographic key material
TWI782255B (zh) 解鎖方法、實現解鎖的設備及電腦可讀媒體
WO2019196696A1 (zh) 数字证书处理方法及装置、区块链节点、存储介质
EP2472772B1 (en) Method and system for entity public key acquiring, certificate validation and authentication by introducing an online credible third party
US9401911B2 (en) One-time password certificate renewal
WO2018184485A1 (zh) 数字证书的管理方法、装置、非易失性可读存储介质及服务终端
WO2019214068A1 (zh) 区块链系统上用户验证方法、装置、终端设备及存储介质
WO2018184447A1 (zh) 基于区块链的数字证书删除方法、装置及系统、存储介质
CN111130777B (zh) 一种用于短效证书的签发管理方法和系统
US20170257213A1 (en) Method and Apparatus for Managing Application Identifier
CN112073433B (zh) 一种ssl证书更新方法、装置、电子设备及存储介质
CN113472790A (zh) 基于https协议的信息传输方法、客户端及服务器
CN112887080B (zh) 基于sm2的密钥生成方法及系统
CN108632037B (zh) 公钥基础设施的公钥处理方法及装置
CN110705985A (zh) 用于存储信息的方法和装置
JP2022031777A (ja) 情報処理方法、情報処理プログラム、情報処理装置及び情報処理システム
CN111131160B (zh) 一种用户、服务及数据认证系统
JP6983685B2 (ja) 情報処理システム、クライアント装置、認証認可サーバー、制御方法とそのプログラム

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19785467

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2019785467

Country of ref document: EP

Effective date: 20201029