WO2019214068A1 - 区块链系统上用户验证方法、装置、终端设备及存储介质 - Google Patents

区块链系统上用户验证方法、装置、终端设备及存储介质 Download PDF

Info

Publication number
WO2019214068A1
WO2019214068A1 PCT/CN2018/095904 CN2018095904W WO2019214068A1 WO 2019214068 A1 WO2019214068 A1 WO 2019214068A1 CN 2018095904 W CN2018095904 W CN 2018095904W WO 2019214068 A1 WO2019214068 A1 WO 2019214068A1
Authority
WO
WIPO (PCT)
Prior art keywords
user
certificate
blockchain system
blockchain
root certificate
Prior art date
Application number
PCT/CN2018/095904
Other languages
English (en)
French (fr)
Inventor
贾牧
谢丹力
陆陈一帆
Original Assignee
深圳壹账通智能科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳壹账通智能科技有限公司 filed Critical 深圳壹账通智能科技有限公司
Publication of WO2019214068A1 publication Critical patent/WO2019214068A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4014—Identity check for transactions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions

Definitions

  • the present application relates to the field of blockchain applications, and in particular, to a user authentication method, device, terminal device and storage medium on a blockchain system.
  • the blockchain system uses the root certificate issued by the external third-party certificate issuing authority for user authentication, and the root certificate issued by the third-party certificate issuing authority is generally installed in the browser or the operating system, which means the certificate of the entire blockchain system.
  • Security is completely dependent on the security of third-party certificate issuing agencies.
  • the application scenario requires that the security of the entire blockchain system depends on a root authentication center that it can control, rather than an external third-party certificate issuing authority.
  • an external third-party certificate issuing authority issues the issued
  • the certificate information has a series of certification processes.
  • the certificate information applied cannot be authenticated by the certificate issuing authority, so that when the blockchain system uses the root certificate issued by an external third-party certificate issuing authority for user authentication, it will not be realized. User-authenticated functionality on the blockchain.
  • the embodiment of the present invention provides a user authentication method, a terminal device, and a storage medium on a blockchain system, so as to solve the problem that the current blockchain system adopts an external third party certificate issuing authority to issue a root certificate, and cannot perform user verification on the blockchain system.
  • the problem is a user authentication method, a terminal device, and a storage medium on a blockchain system, so as to solve the problem that the current blockchain system adopts an external third party certificate issuing authority to issue a root certificate, and cannot perform user verification on the blockchain system.
  • an embodiment of the present application provides a user verification method on a blockchain system, including:
  • User A and user B communicate on the blockchain system. If user A needs to authenticate user B, user A receives the user digital certificate sent by user B.
  • User A authenticates the user digital certificate of user B by using the system root certificate
  • an embodiment of the present application provides a user authentication apparatus on a blockchain system, including:
  • a root certificate setting module configured to set a system root certificate on the blockchain system by using an authoritative authentication node
  • a digital certificate generating module configured to generate, according to the system root certificate, a user digital certificate of all users on the blockchain system
  • a digital certificate sending module configured to communicate with user A and user B in the blockchain system, and if user A needs to authenticate user B, user A receives the user digital certificate sent by user B;
  • a verification module configured by user A to verify user digital certificate of user B by using the system root certificate
  • the determining module is configured to: if the verification passes, the user B is a legitimate user on the blockchain system.
  • an embodiment of the present application provides a terminal device, including a memory, a processor, and computer readable instructions stored in the memory and executable on the processor, where the processor executes the computer The following steps are implemented when reading the instruction:
  • User A and user B communicate on the blockchain system. If user A needs to authenticate user B, user A receives the user digital certificate sent by user B.
  • User A authenticates the user digital certificate of user B by using the system root certificate
  • the embodiment of the present application provides one or more non-volatile readable storage media storing computer readable instructions, when the computer readable instructions are executed by one or more processors, such that the one or Multiple processors perform the following steps:
  • User A and user B communicate on the blockchain system. If user A needs to authenticate user B, user A receives the user digital certificate sent by user B.
  • User A authenticates the user digital certificate of user B by using the system root certificate
  • the system root certificate is first set on the blockchain system through the authoritative authentication node, and is customized on the blockchain system.
  • the system root certificate is set so that the security of the entire blockchain system depends on the system root certificate of the custom setting, thereby improving the independence and security of the blockchain system.
  • the user digital certificate of all users on the blockchain system is generated according to the system root certificate, so that the user digital certificate generated by the customized system root certificate can be used for user authentication on the blockchain system.
  • User A and user B communicate on the last blockchain system. If user A needs to authenticate user B, user A receives the user digital certificate sent by user B. User A uses the system root certificate to authenticate User B's user digital certificate.
  • the user digital certificate generated based on the system root certificate customized on the blockchain system can implement an effective and secure user on the blockchain system.
  • Verification function The system root certificate customized on the blockchain system combines the characteristics of the blockchain. Based on the data sharing of the blockchain, the created system root certificate can be easily obtained and used by users on the blockchain system. To perform authentication between users on the blockchain; the data based on the blockchain cannot be modified, so that the created system root certificate cannot be maliciously modified; and the authoritative authentication node has specific authority and authority on the blockchain system. Sex, the system root certificate set by the authoritative authentication node on the blockchain system has authority, which ensures the security of the blockchain system.
  • Embodiment 1 is a flow chart of a method for user authentication on a blockchain system in Embodiment 1 of the present application.
  • FIG. 2 is a specific flow chart of step S10 of FIG. 1.
  • FIG. 3 is a specific flow chart of step S20 of FIG. 1.
  • step S40 of FIG. 1 is a specific flow chart of step S40 of FIG. 1.
  • FIG. 5 is a schematic block diagram of a user authentication apparatus on a blockchain system in Embodiment 2 of the present application.
  • FIG. 6 is a schematic diagram of a terminal device in Embodiment 4 of the present application.
  • FIG. 1 is a flow chart showing a user authentication method on a blockchain system in this embodiment.
  • the user authentication method on the blockchain system can be applied to the application system based on the blockchain technology, and is used for verifying the legality of the user identity on the blockchain system.
  • the user authentication method on the blockchain system includes the following steps:
  • the authoritative authentication node refers to a system administrator user node on the blockchain system, and the authoritative authentication node has higher-level permissions than ordinary users on the blockchain system, and can perform specific permission operations on the blockchain system.
  • Blockchain is a new application model based on computer technologies such as distributed data storage, consensus mechanisms and encryption algorithms.
  • the blockchain system is essentially a decentralized distributed database system. It should be noted that the user on the blockchain in this embodiment should be understood as each user node on the blockchain system, that is, each related terminal on the blockchain system, and the terminal may be connected through a blockchain network. Terminals such as mobile phones, computers, tablets, and servers, such as authoritative authentication nodes, are special users (user nodes) on the blockchain system. The user has specific permissions on the blockchain system, and the user is the blockchain system. System administrator.
  • the authoritative authentication node ie, the system administrator
  • the authoritative authentication node sets the system root certificate on the system, and the system root certificate is unique and can only be generated by the authoritative authentication node of the system.
  • the authoritative authentication node is similar to an external third-party certificate issuing authority (ie, CA, the abbreviation of Certificate Authority, also called “certificate certification center.”
  • CA is the issuing authority of the certificate, and is responsible for issuing certificates, certificates, and managing issued certificates. Institutions. CA needs to develop policies and specific steps to verify and identify users and sign user certificates to ensure the identity of the certificate holder and the ownership of the public key.
  • Authoritative authentication nodes on the blockchain system and external The difference between the third-party certificate issuing authority CA is that the authoritative authentication node is a user node with authoritative nature (specific authority) authenticated by the blockchain system itself, and the authoritative authentication node can set and create a root certificate according to the characteristics of the blockchain system. And generating (issuing) a user certificate for each user on the blockchain system according to the root certificate, and implementing a user verification process based on the blockchain system itself.
  • the authoritative authentication node (system administrator) of the blockchain system is on the system. Set the system root certificate, combined with the nature and characteristics of the blockchain system, to achieve the entire blockchain system Rely on their own controlled a root Certification Authority, rather than relying on third-party Certificate Authority, to improve the security of the entire block chain system.
  • step S10 the system root certificate is set on the blockchain system by the authoritative authentication node, which specifically includes the following steps:
  • S11 Create a transaction containing a system root certificate through an authoritative authentication node.
  • transaction is a basic concept of the blockchain system.
  • the blockchain system is essentially a decentralized distributed database system.
  • the transaction is the operation of creating, deleting and modifying data on the blockchain system. Reading does not change the data on the blockchain system, so the read operation is not a transaction).
  • a transaction is created on the blockchain system by the authoritative authentication node, and the content of the transaction includes a creation operation of creating a system root certificate.
  • the system root certificate obtained through the transaction creation is unique and authoritative, and can implement the function of user authentication on the blockchain system according to the system root certificate.
  • the blockchain system has two concepts: the block and the current data state (world state in the fabric, UTXO in the bitcoin).
  • the block is historical transaction information
  • the current data state is the state of the system data obtained by all historical exchanges. All the operations of creating, deleting or modifying in this embodiment are obtained by sending a transaction and verifying by the blockchain system itself to obtain a block. All users on the final blockchain will execute the transaction according to the block, and modify the current data state.
  • the trading action will be included in one block, there may be multiple transactions in one block; and the blockchain system will generate blocks at certain time intervals, each block containing all the transactions in this time interval. .
  • the authoritative authentication node on the blockchain sends the transaction to the blockchain system after creating the transaction containing the system root certificate, and waits for the verification of the blockchain system.
  • the transaction refers to a database transaction, which refers to a series of operations performed as a single logical unit of work, either completely or completely.
  • the consensus mechanism of the blockchain system is an important part of the blockchain technology. The validity and authenticity of the transactions on the blockchain system can be confirmed through the consensus mechanism.
  • the blockchain consensus mechanism can be implemented by a consensus mechanism such as Workload Proof (PoW) and Proof of Interest (PoS).
  • the transaction including the creation of the system root certificate is packaged into the block generated by the time interval of the transaction (ie, the current block of the transaction), based on the blockchain.
  • the consensus mechanism of the system all users in the blockchain can correctly and effectively obtain the current block containing the transaction to create the system root certificate. After obtaining the current block, accept the transaction in the current block and complete the setting of the system root certificate. It can be understood that the above process can be summarized as a transaction operation of setting (creating) a system root certificate on the blockchain system, and the transaction operation is verified by the blockchain itself (through a consensus mechanism) on the blockchain.
  • the user obtains the current block of the transaction and joins the original blockchain to form a new blockchain, and then actually executes the transaction according to the transaction recorded in the block, and finally The modification of the current data state of the user on the blockchain system is implemented, that is, the transaction of creating the system root certificate is executed, and the process of setting the system root certificate is completed.
  • step S11 the system root certificate is set on the blockchain system by the authoritative authentication node, which specifically includes:
  • ROOT represents the key of the system root certificate
  • cert represents the value of the system root certificate
  • the key-value is a data storage mode.
  • the value refers to the specifically stored data.
  • the key is the index of the data stored by it.
  • the value can be directly obtained by searching for the corresponding key.
  • the key value reflects a correspondence of data storage, and a data relationship pair composed of a key and its corresponding value is called a key value pair.
  • the system root certificate set by the authoritative authentication node on the blockchain system is created by using a key-value pair form, and the storage method of the key-value pair can well combine the characteristics of the blockchain system. According to the feature that the system on the blockchain is shared and cannot be tampered with, the user on the blockchain can conveniently read the root certificate set on the blockchain system. Since the root certificate is created by an authoritative authentication node (that is, a system administrator), it is authoritative and can not guarantee the security of the root certificate in combination with the fact that the data on the blockchain cannot be tampered with.
  • a key-value pair is created on the blockchain system, and the key-value pair is unique.
  • the blockchain system adopts a customized system root certificate, which can avoid other setting modes (such as setting and creating a blockchain system in this embodiment), which may cause inconsistency between multiple users. The situation does not ensure the consistency of multiple users.
  • the system root certificate customized by using the blockchain system does not have the problem, and the consistency of multiple users can be ensured.
  • S20 Generate a user digital certificate of all users on the blockchain system according to the system root certificate.
  • the user digital certificate is used for verification between users on the blockchain.
  • the system root certificate generates a user digital certificate of all users on the blockchain system based on the hash algorithm and the private key of the system root certificate on the blockchain system (the user on the blockchain does not have the system root certificate generated)
  • the user digital certificate will not be able to pass the identity verification, which will make it impossible to communicate with other users on the blockchain. It provides an important technical basis for the user-to-user authentication on the blockchain system based on the user digital certificate. .
  • step S20 the system root certificate is set on the blockchain system by the authoritative authentication node, which specifically includes the following steps:
  • the original user certificate refers to a certificate that is not encrypted by a digital signature, and the original user certificate includes the original certificate content.
  • the certificate can be a certificate standard using X.509V3.
  • the system root certificate creates the original user certificate of all users on the blockchain system, and provides a basis for subsequent generation of user digital certificates of all users on the blockchain system based on the original user certificate.
  • S22 Encrypt the original user certificate of all users by using the private key of the system root certificate, and generate a user digital certificate of all users on the blockchain system, and the user digital certificate includes the issuer digital signature.
  • the system root certificate includes a pair of corresponding public and private keys, the public key is used for user authentication, and the private key is used to encrypt the original user certificate.
  • the original user certificate includes the original certificate content.
  • the issuer digital signature is obtained by encrypting the hash content of the certificate content (that is, the information summary calculated by using the hash algorithm on the certificate content) by using the private key of the system root certificate.
  • the original user certificate of all users on the blockchain is encrypted by using the private key of the system root certificate, and the encryption process is specifically: the system root certificate uses a hash function (such as SHA256) to perform the certificate content included in the original user certificate.
  • a hash function such as SHA256
  • the calculation generates a summary of the original information, and then encrypts the original information digest with the private key of the system root certificate itself, and the encrypted original information digest is the digital signature of the issuer.
  • the original user certificate is signed by the system root certificate and issued to all users on the blockchain. Each user on the blockchain obtains the signed original user certificate, that is, the user digital certificate.
  • the system root certificate on the blockchain By using the system root certificate on the blockchain to generate the user digital certificate of each user on the blockchain, it can ensure that each generated digital certificate is safe and legal, and each user in the blockchain system can adopt itself.
  • the user digital certificate proves the identity legitimacy on the blockchain system.
  • step S21 and step S22 by using the system root certificate on the blockchain to generate a user digital certificate for each user on the blockchain, the security of each user's digital certificate can be guaranteed.
  • Each user on the blockchain system can use its own user digital certificate to prove identity legitimacy on the blockchain system.
  • the blockchain system includes any two common users: user A and user B. If User B wants to send data to User A, User A requests authentication of User B's identity. When user A authenticates user B, user B needs to send its own user digital certificate to user A. For subsequent user A, the user's digital certificate of user B is decrypted according to the public key of the system root certificate, and it is verified whether user B is Provides the foundation for legitimate users on the blockchain. It should be noted that the user B may also request to verify the identity of the user A, and the verification process may be bidirectional.
  • the user on the blockchain uses the system root certificate created on the blockchain, and uses the system root certificate to authenticate the user digital certificate of the user B.
  • the system root certificate is authoritative on the blockchain system. According to the user system root certificate, the accuracy of the verification result can be ensured, so that user A can implement identity verification for user B.
  • step S40 user A uses the system root certificate to verify the user digital certificate of user B, which specifically includes the following steps:
  • user A reads the system root certificate on the blockchain system, and the specific manner of reading is to query the block named ROOT on the blockchain, and the key ROOT and the value cert are a key value pair. Relationship, directly obtain the value cert according to the key ROOT, the value cert is the system root certificate.
  • the system root certificate includes a pair of corresponding public and private keys.
  • the public key is used for user authentication.
  • the private key is used to encrypt the original user certificate.
  • the user digital certificate of each user on the blockchain system uses the system root.
  • the private key of the certificate is obtained after encrypting the corresponding original user certificate. Therefore, the public key in the system root certificate needs to be obtained, so as to verify the user digital certificate based on the public key.
  • user A needs to authenticate user B. Therefore, user A needs to obtain the public key of the system root certificate from the system root certificate, so as to perform user identity legality verification on the blockchain according to the public key.
  • the public key is used to decrypt the user digital certificate of user B.
  • the decryption verification process is: user A first uses the system root certificate to generate the user. The same hash function used in the digital certificate, the first information digest is calculated for the certificate content of the user digital certificate of the user B, and then the digital signature of the issuer is decrypted by the public key of the system root certificate to calculate the second information.
  • the decryption process is considered successful, that is, user A can confirm that the issuer digital signature is issued by the system root certificate.
  • the certificate content of the user digital certificate of the user B is the same as the certificate content of the original user certificate.
  • the system root certificate digitally signs the original user certificate, but encrypts the original message digest and does not change the certificate content of the original user certificate.
  • the certificate content of the user digital certificate of the user B is calculated by using a hash function, and the first information digest is obtained, and compared with the second digest based on the first information digest. From the process of encryption (one-way hash property of the hash function), it can be known that if the user certificate of user B is issued by the system root certificate on the blockchain system, the first message digest must be the same as the second digest.
  • User A decrypts the user digital certificate of user B according to the public key of the system root certificate, thereby realizing user A's verification of user B on the blockchain system, and ensuring security when the user communicates on the blockchain system.
  • step S41 and step S42 when user A authenticates user B, user A uses a system root certificate with an authoritative nature in the blockchain, and decrypts the user digital certificate of user B through the public key of the system root certificate, according to the decryption.
  • the result whether the first information digest is the same as the second information digest determines the legitimacy of the user B, so that the user authentication based on the system root certificate is safer and more reliable on the blockchain system.
  • the authority of the system root certificate on the blockchain system is known, and the users on the system in the blockchain of the user digital certificate having the system root certificate encryption are legal on the blockchain.
  • the user can determine that User B is a legitimate user on the blockchain system, and User B can perform normal communication with User A.
  • the user A and the user B in the embodiment are any two ordinary users different from the authoritative authentication node on the blockchain system, and the verification between the users on the blockchain may be one-way. It can be bidirectional, user A can request authentication of user B's identity, and user B can also authenticate user A's identity.
  • the verification process needs to read the system root certificate through the blockchain system, and decrypt the user digital certificate according to the system root certificate to verify whether the user is a legitimate user on the blockchain system.
  • the system root certificate is first set on the blockchain system through the authoritative authentication node, and the system root is set on the blockchain system in combination with the characteristics of the blockchain itself.
  • the certificate makes the security of the entire blockchain system dependent on the system root certificate to ensure the security of the blockchain system.
  • the user digital certificate of all users on the blockchain system is generated according to the system root certificate, so that the user digital certificate generated by the system root certificate can be used to implement user verification on the blockchain system.
  • User A and user B communicate on the last blockchain system.
  • User A uses the public key of the system root certificate to verify user B's user digital certificate to determine whether user B is a legitimate user on the blockchain system.
  • the user can directly verify the root certificate set on the blockchain, and use the root certificate to verify the user digital certificate generated by the system root certificate customized on the blockchain system, thereby realizing the blockchain system.
  • the system root certificate customized on the blockchain system combines the characteristics of the blockchain. Based on the data sharing of the blockchain, the created system root certificate can be conveniently read by the user on the blockchain system. Used to perform authentication between users on the blockchain; the blockchain-based data cannot be modified, so that the created system root certificate cannot be maliciously modified; and the authoritative authentication node has specific permissions on the blockchain system and Authoritative, the system root certificate set by the authoritative authentication node on the blockchain system is authoritative, ensuring the security of the blockchain system.
  • Fig. 5 is a block diagram showing the principle of the user authentication management apparatus on the blockchain system corresponding to the user authentication method on the blockchain system in the first embodiment.
  • the user authentication device on the blockchain system includes a root certificate setting module 10, a digital certificate generating module 20, a digital certificate transmitting module 30, a verification module 40, and a determining module 50.
  • the implementation functions of the root certificate setting module 10, the digital certificate generating module 20, the digital certificate sending module 30, the verification module 40, and the determining module 50 correspond to the steps corresponding to the user authentication method on the blockchain system in Embodiment 1, In order to avoid redundancy, the present embodiment will not be described in detail.
  • the root certificate setting module 10 is configured to set a system root certificate on the blockchain system by using an authoritative authentication node.
  • the digital certificate generating module 20 is configured to generate a user digital certificate of all users on the blockchain system according to the system root certificate.
  • the digital certificate sending module 30 is configured to communicate between user A and user B in the blockchain system. If user A needs to authenticate user B, user A receives the user digital certificate sent by user B.
  • the verification module 40 is configured to verify, by the user A, the user digital certificate of the user B by using the system root certificate.
  • the determining module 50 is configured to: if the verification passes, the user B is a legitimate user on the blockchain system.
  • the root certificate setting module 10 includes a root certificate creating unit 11, a transaction transmitting unit 12, and a transaction receiving unit 13.
  • the root certificate creation unit 11 is configured to create a transaction including a system root certificate by using an authoritative authentication node.
  • the transaction sending unit 12 is configured to send the transaction to the blockchain system.
  • the transaction receiving unit 13 is configured to package the transaction into the current block based on the consensus mechanism of the blockchain system, and all users on the blockchain system obtain the current block and accept the transaction in the current block.
  • the digital certificate generation module 20 includes an original user certificate creation unit 21 and a user digital certificate acquisition unit 22.
  • the original certificate creation unit 21 is configured to create an original user certificate of all users on the blockchain system.
  • the digital certificate obtaining unit 22 is configured to encrypt the original user certificate of all users by using the private key of the system root certificate, and generate a user digital certificate of all users on the blockchain system, and the user digital certificate includes the issuer digital signature.
  • the verification module 40 includes a public key acquisition unit 41 and a decryption unit 42.
  • the public key obtaining unit 41 is configured to enable the user A to read the system root certificate on the blockchain system and obtain the public key of the system root certificate.
  • the decryption unit 42 is configured to enable the user A to decrypt the user digital certificate of the user B according to the public key of the system root certificate, and if the decryption is successful, the verification succeeds.
  • the root certificate setting module 10 can make the security of the entire blockchain system depend on the customized system root certificate, thereby improving the independence of the blockchain system. And security.
  • the digital certificate generation module 20 enables the user digital certificate generated by the customized system root certificate to be used for user authentication on the blockchain system.
  • the digital certificate sending module 30, the verification module 40 and the determining module 50 can implement an effective and secure user authentication function on the blockchain system based on the user digital certificate generated by the system root certificate customized on the blockchain system.
  • the system root certificate customized on the blockchain system combines the characteristics of the blockchain. Based on the data sharing of the blockchain, the created system root certificate can be easily obtained and used by users on the blockchain system.
  • the data based on the blockchain cannot be modified, so that the created system root certificate cannot be maliciously modified; and the authoritative authentication node has specific authority and authority on the blockchain system.
  • Sex the system root certificate set by the authoritative authentication node on the blockchain system has authority, which ensures the security of the blockchain system.
  • the embodiment provides one or more non-volatile readable storage media having computer readable instructions that, when executed by one or more processors, cause the one or more processors to execute The user authentication method on the blockchain system in Embodiment 1 is implemented. To avoid repetition, details are not described herein again. Alternatively, when the computer readable instructions are executed by one or more processors, causing the one or more processors to perform the functions of the modules/units in the user authentication device on the blockchain system of Embodiment 2, To avoid repetition, we will not repeat them here.
  • FIG. 6 is a schematic diagram of a terminal device in this embodiment.
  • terminal device 60 includes a processor 61, a memory 62, and computer readable instructions 63 stored in memory 62 and operative on processor 61.
  • the processor 61 implements the various steps of the user authentication method on the blockchain system of Embodiment 1 when the computer readable instructions 63 are executed, such as steps S10, S20, S30, S40, and S50 shown in FIG.
  • the processor 61 executes the computer readable instructions 63
  • the functions of the modules/units of the user authentication device on the blockchain system in Embodiment 2 are implemented, as shown in FIG. 5, the root certificate setting module 10, the digital certificate generating module 20, and the number.
  • the functions of the certificate sending module 30, the verification module 40, and the determining module 50 are implemented, as shown in FIG. 5, the root certificate setting module 10, the digital certificate generating module 20, and the number.
  • computer readable instructions 63 may be partitioned into one or more modules/units, one or more modules/units being stored in memory 62 and executed by processor 61 to complete the application.
  • the one or more modules/units can be an instruction segment of a series of computer readable instructions capable of performing a particular function for describing the execution of computer readable instructions 63 in the terminal device 60.
  • the computer readable instructions 63 can be divided into the root certificate setting module 10, the digital certificate generating module 20, the digital certificate sending module 30, the verification module 40, and the determining module 50 in Embodiment 2, and the specific functions of the modules are as in the embodiment. As shown in 2, to avoid repetition, we will not repeat them here.
  • the terminal device 60 can be a computing device such as a desktop computer, a notebook, a palmtop computer, and a cloud server.
  • the terminal device may include, but is not limited to, a processor 61, a memory 62. It will be understood by those skilled in the art that FIG. 6 is only an example of the terminal device 60, and does not constitute a limitation on the terminal device 60, and may include more or less components than those illustrated, or combine some components, or different components.
  • the terminal device may further include an input/output device, a network access device, a bus, and the like.
  • the processor 61 may be a central processing unit (CPU), or may be other general-purpose processors, a digital signal processor (DSP), an application specific integrated circuit (ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware components, etc.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the memory 62 may be an internal storage unit of the terminal device 60, such as a hard disk or memory of the terminal device 60.
  • the memory 62 may also be an external storage device of the terminal device 60, such as a plug-in hard disk provided on the terminal device 60, a smart memory card (SMC), a Secure Digital (SD) card, and a flash memory card (Flash). Card) and so on.
  • the memory 62 may also include both an internal storage unit of the terminal device 60 and an external storage device.
  • the memory 62 is used to store computer readable instructions 63 and other programs and data required by the terminal device.
  • the memory 62 can also be used to temporarily store data that has been or will be output.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated modules/units if implemented in the form of software functional units and sold or used as separate products, may be stored in a computer readable storage medium.
  • the present application implements all or part of the processes in the foregoing embodiments, and may also be implemented by computer readable instructions 63, which may be stored in a computer readable In the storage medium, the computer readable instructions 63, when executed by the processor, may implement the steps of the various method embodiments described above.
  • the computer readable instructions 63 include code of computer readable instructions 63, which may be in the form of source code, object code, executable or some intermediate form, and the like.
  • the computer readable medium can include any entity or device capable of carrying the code of the computer readable instructions 63, a recording medium, a USB flash drive, a removable hard drive, a magnetic disk, an optical disk, a computer memory, a read only memory (ROM, Read) -Only Memory), Random Access Memory (RAM), electrical carrier signals, telecommunications signals, and software distribution media.
  • ROM read only memory
  • RAM Random Access Memory

Abstract

一种区块链系统上用户验证方法、装置、终端设备及存储介质。该区块链系统上用户验证方法，包括：通过权威认证节点在区块链系统上设置系统根证书（S10）；根据所述系统根证书生成所述区块链系统上所有用户的用户数字证书（S20）；区块链系统上用户A和用户B进行通信，若用户A需要对用户B进行验证，则用户A接收用户B发送的所述用户数字证书（S30）；用户A采用所述系统根证书对用户B的用户数字证书进行验证（S40）；若验证通过，则确定用户B为所述区块链系统上的合法用户（S50）。采用该区块链系统上用户验证方法能够实现区块链系统上有效和安全的用户验证功能。

Description

区块链系统上用户验证方法、装置、终端设备及存储介质
本申请以2018年5月9日提交的申请号为201810436851.9，名称为“区块链系统上用户验证方法、装置、终端设备及存储介质”的中国发明专利申请为基础，并要求其优先权。
技术领域
本申请涉及区块链应用领域，尤其涉及一种区块链系统上用户验证方法、装置、终端设备及存储介质。
背景技术
目前区块链系统采用外部的第三方证书签发机构签发的根证书进行用户验证，而第三方证书签发机构签发的根证书一般安装在浏览器或操作系统中，意味着整个区块链系统的证书安全完全依赖于第三方证书签发机构的安全。在某些情形下，应用场景要求整个区块链系统的安全需依赖于自己可控的一个根认证中心，而不是外部的第三方证书签发机构，同时，外部的第三方证书签发机构对签发的证书信息有一系列的认证流程，某些情形下申请的证书信息无法通过证书签发机构的认证，使得当区块链系统采用外部的第三方证书签发机构签发的根证书进行用户验证时，将无法实现区块链上用户验证的功能。
发明内容
本申请实施例提供一种区块链系统上用户验证方法、终端设备及存储介质，以解决当前区块链系统采用外部的第三方证书签发机构签发的根证书无法实现区块链系统上用户验证的问题。
第一方面，本申请实施例提供一种区块链系统上用户验证方法，包括：
通过权威认证节点在区块链系统上设置系统根证书；
根据所述系统根证书生成所述区块链系统上所有用户的用户数字证书；
所述区块链系统上用户A和用户B进行通信，若用户A需要对用户B进行验证，则用户A接收用户B发送的所述用户数字证书；
用户A采用所述系统根证书对用户B的用户数字证书进行验证；
若验证通过，则确定用户B为所述区块链系统上的合法用户。
第二方面，本申请实施例提供一种区块链系统上用户验证装置，包括：
根证书设置模块，用于通过权威认证节点在区块链系统上设置系统根证书；
数字证书生成模块，用于根据所述系统根证书生成所述区块链系统上所有用户的用户数字证书；
数字证书发送模块，用于所述区块链系统上用户A和用户B进行通信，若用户A需要对用户B进行验证，则用户A接收用户B发送的所述用户数字证书；
验证模块，用于用户A采用所述系统根证书对用户B的用户数字证书进行验证；
确定模块，用于若验证通过，则用户B为所述区块链系统上的合法用户。
第三方面，本申请实施例提供一种终端设备，包括存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机可读指令，所述处理器执行所述计算机可读指令时实现如下步骤：
通过权威认证节点在区块链系统上设置系统根证书；
根据所述系统根证书生成所述区块链系统上所有用户的用户数字证书；
所述区块链系统上用户A和用户B进行通信，若用户A需要对用户B进行验证，则用户A接收用户B发送的所述用户数字证书；
用户A采用所述系统根证书对用户B的用户数字证书进行验证；
若验证通过，则确定用户B为所述区块链系统上的合法用户。
第四方面，本申请实施例提供一个或多个存储有计算机可读指令的非易失性可读存储介质，所述计算机可读指令被一个或多个处理器执行时，使得所述一个或多个处理器执行如下步骤：
通过权威认证节点在区块链系统上设置系统根证书；
根据所述系统根证书生成所述区块链系统上所有用户的用户数字证书；
所述区块链系统上用户A和用户B进行通信，若用户A需要对用户B进行验证，则用户A接收用户B发送的所述用户数字证书；
用户A采用所述系统根证书对用户B的用户数字证书进行验证；
若验证通过，则确定用户B为所述区块链系统上的合法用户。
本申请实施例所提供的区块链系统上用户验证方法、装置、终端设备及存储介质中，首先通过权威认证节点在区块链系统上设置系统根证书，自定义地在区块链系统上设置系统根证书，使得整个区块链系统的安全依赖于该自定义设置的系统根证书，提高区块链系 统的独立性和安全性。然后根据系统根证书生成区块链系统上所有用户的用户数字证书，使得通过自定义设置的系统根证书生成的用户数字证书能够用于区块链系统上的用户验证。最后区块链系统上用户A和用户B进行通信，若用户A需要对用户B进行验证，则用户A接收用户B发送的用户数字证书。用户A采用系统根证书对用户B的用户数字证书进行验证。若验证通过，则确定用户B为区块链系统上的合法用户，基于在区块链系统上自定义设置的系统根证书生成的用户数字证书，能实现区块链系统上有效和安全的用户验证功能。在区块链系统上自定义设置的系统根证书结合了区块链的特点，基于区块链的数据共享性，使得创建设置的系统根证书能够便捷地被区块链系统上用户获取和使用，以进行区块链上用户间的验证；基于区块链的数据不可篡改性，使得创建设置的系统根证书不能被恶意修改；并且，权威认证节点在区块链系统上拥有特定权限及权威性，由权威认证节点在区块链系统上设置的系统根证书拥有权威性，保证了区块链系统的安全性。
附图说明
为了更清楚地说明本申请实施例的技术方案，下面将对本申请实施例的描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1是本申请实施例1中区块链系统上用户验证方法的一流程图。
图2是图1中步骤S10的一具体流程图。
图3是图1中步骤S20的一具体流程图。
图4是图1中步骤S40的一具体流程图。
图5是本申请实施例2中区块链系统上用户验证装置的一原理框图。
图6是本申请实施例4中终端设备的一示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
实施例1
图1示出本实施例中区块链系统上用户验证方法的一流程图。该区块链系统上用户验证方法可应用在以区块链为技术基础的应用系统上，用于在区块链系统上实现用户身份的合法性验证功能。如图1所示，该区块链系统上用户验证方法包括如下步骤：
S10：通过权威认证节点在区块链系统上设置系统根证书。
其中，权威认证节点指区块链系统上的系统管理员用户节点，该权威认证节点拥有比区块链系统上普通用户更高级的权限，可以对区块链系统进行特定权限的操作。区块链是基于分布式数据存储、共识机制和加密算法等计算机技术的新型应用模式。区块链系统本质是一个去中心化的分布式数据库系统。需要说明的是，本实施例中区块链上的用户应理解为在区块链系统上的各个用户节点，即区块链系统上各个相关的终端，该终端可以是通过区块链网络相连的手机、电脑、平板和服务器等终端，如权威认证节点为区块链系统上特殊的用户(用户节点)，该用户拥有该区块链系统上的特定权限，该用户即区块链系统的系统管理员。
本实施例中，区块链系统上的权威认证节点(即系统管理员)在系统上设置系统根证书，该系统根证书是独一无二的，且只能由该系统的权威认证节点设置生成。该权威认证节点类似于外部的第三方证书签发机构(即CA，Certificate Authority的缩写，也叫“证书认证中心)。CA是证书的签发机构，是负责签发证书、认证证书和管理已颁发证书的机构。CA需要制定政策和具体步骤来验证和识别用户身份，并对用户证书进行签名，以确保证书持有者的身份和公钥的拥有权。区块链系统上的权威认证节点与外部的第三方证书签发机构CA的区别在于，权威认证节点是该区块链系统自身认证的具有权威性质(特定权限)的用户节点，权威认证节点可以根据区块链系统的特点设置和创建根证书，并根据该根证书生成(颁发)区块链系统上每一用户的用户证书，并基于区块链系统自身实现用户验证过程。通过区块链系统的权威认证节点(系统管理员)在系统上设置系统根证书，结合区块链系统自身的性质和特点，能够实现整个区块链系统依赖于自己可控的一个根认证中心，而不依赖于第三方证书签发机构，提高了整个区块链系统的安全性。
在一具体实施方式中，如图2所示，步骤S10中，通过权威认证节点在区块链系统上设置系统根证书，具体包括如下步骤：
S11：通过权威认证节点创建一个包含系统根证书的交易。
其中，“交易”是区块链系统一基本概念，区块链系统本质是一个去中心化的分布式数据库系统，交易即在该区块链系统上进行的创建、删除和修改数据的操作(读取不改变区块链系统上的数据，因此读取操作不属于交易)。
本实施例中，通过权威认证节点在区块链系统上创建一个交易，该交易的内容包含创建系统根证书的创建操作。通过该交易创建获取的系统根证书是独一无二且具有权威性的，能够根据该系统根证书实现区块链系统上用户验证的功能。
S12：将交易发送到区块链系统上。
其中，区块链系统有两个概念：区块和当前数据状态(fabric中的world state，比特币中的UTXO)。区块中是历史交易信息，当前数据状态是由所有的历史交易所得到的系统数据状态。本实施例中所有的创建、删除或修改等操作，都是通过发送一个交易，经过区块链系统本身的验证，得到一个区块。最终区块链上所有用户根据该区块将交易执行，实现对当前数据状态的修改。另外，交易动作会包含在一个区块中，一个区块中可能有多个交易；并且区块链系统会按照一定的时间间隔产生区块，每个区块中包含这个时间间隔中所有的交易。
本实施例中，区块链上的权威认证节点在创建该包含系统根证书交易后即把该交易发送到区块链系统上，并等待区块链系统的验证。
S13：基于区块链系统的共识机制，打包交易到当前所在区块中，区块链系统上所有用户得到当前所在区块，接受当前所在区块中的交易。
由于区块链系统上点对点网络存在较高的网络延迟，各个用户节点所观察到的交易的事务先后顺序不可能完全一致。因此区块链系统需要设计一种机制对在一时间间隔内发生的交易的事务先后顺序进行共识。这种对一个时间间隔内的交易的事务先后顺序达成共识的算法被称为“共识机制”。其中，该事务是指数据库事务，是指作为单个逻辑工作单元执行的一系列操作，要么完全地执行，要么完全地不执行。区块链系统的共识机制是区块链技术的重要组成部分，通过共识机制可以确认区块链系统上交易的有效性和真实性。具体地，区块链共识机制可以通过工作量证明(PoW)和权益证明(PoS)等共识机制的方法实现。
本实施例中，基于区块链系统的共识机制，将包含创建系统根证书的交易打包到该交易所在时间间隔产生的区块中(即该交易的当前所在区块)，基于区块链系统的共识机制，区块链上所有用户都能正确、有效地获取该包含创建系统根证书交易的当前所在区块。在获取该当前所在区块后，接受当前所在区块中的交易，完成系统根证书的设置。可以理解地，上述过程可以概括为在区块链系统上先进行设置(创建)系统根证书的交易操作，等该交易操作在区块链上经过区块链本身的验证(通过共识机制)后，区块链系统上用户得到该交易的当前所在区块，并加入到原有的区块链中形成新的区块链后，才根据该区块中 记载的交易去真正执行该交易，最后实现对区块链系统上用户的当前数据状态的修改，即执行该创建系统根证书的交易，完成系统根证书的设置过程。
在一具体实施方式中，步骤S11中，通过权威认证节点在区块链系统上设置系统根证书，具体包括：
通过权威认证节点创建一个键值对，该键值对的键为key＝ROOT，值为value＝cert，其中，ROOT代表系统根证书的键，cert代表系统根证书的值。
其中，键值(key-value)是一种数据存储方式，值指具体存储的数据，键即其存储的数据的索引，值可以通过查找其对应的键直接获取。键值反映的是一种数据存储的对应关系，由一个键及其对应的值所组成的数据关系对称为键值对。通过键key＝ROOT可以获取对应的值value＝cert。
本实施例中，权威认证节点在区块链系统上设置的系统根证书是采用键值对的形式设置创建的，键值对的存储方式可以很好地结合区块链系统的特点。根据区块链上系统是共享的、不可篡改的特点，区块链上用户可以便捷地读取设置在区块链系统上的根证书。由于该根证书是由权威认证节点(即系统管理员)设置创建的，具有权威性，结合区块链上数据不可篡改的特点，可以保证该根证书的安全性。本实施例中在区块链系统上创建一个键值对，该键值对是独一无二的，具体该键值对的键可以设为key＝ROOT，值设为value＝cert，用户后续在区块链系统上进行用户身份验证时，只需读取区块链系统上名为ROOT的键即可获取相应的根证书，利用根证书进行区块链上用户身份的合法性验证。
需要说明的是，区块链系统采用自定义设置的系统根证书，可以避免采用其他设置方式(如没有采用本实施例中结合区块链系统进行设置创建)可能造成多个用户之间不一致的情况发生，无法确保多用户的一致性。本实施例中，采用结合区块链系统自定义创建的系统根证书不会出现该问题，能够保证多用户的一致性。
S20：根据系统根证书生成区块链系统上所有用户的用户数字证书。
其中，用户数字证书用于进行区块链上用户间的验证。本实施例中，系统根证书在区块链系统上，基于哈希算法和系统根证书的私钥生成区块链系统上所有用户的用户数字证书(区块链上用户如果没有系统根证书生成的用户数字证书，将无法进行身份的合格验证，导致无法与区块链上的其他用户进行通信)，为基于该用户数字证书实现区块链系统上用户间的身份验证提供了重要的技术基础。
在一具体实施方式中，如图3，步骤S20中，通过权威认证节点在区块链系统上设置系统根证书，具体包括如下步骤：
S21：创建区块链系统上所有用户的原始用户证书。
其中，原始用户证书是指未经数字签名加密的证书，该原始用户证书包括原始证书内容。该证书可以是采用X.509V3的证书标准。本实施例中，系统根证书创建区块链系统上所有用户的原始用户证书，为后续基于该原始用户证书生成区块链系统上所有用户的用户数字证书提供了基础。
S22：采用系统根证书的私钥加密所有用户的原始用户证书，生成区块链系统上所有用户的用户数字证书，用户数字证书包括发行者数字签名。
其中，系统根证书包括一对相对应的公钥和私钥，公钥用于用户验证，私钥用于加密原始用户证书。原始用户证书包括原始证书内容。发行者数字签名是由证书内容的哈希摘要(即采用哈希算法对证书内容进行计算得到的信息摘要)采用系统根证书的私钥加密获取的。本实施例中，采用系统根证书的私钥对区块链上所有用户的原始用户证书进行加密，加密过程具体是系统根证书采用哈希函数(如SHA256)对原始用户证书包括的证书内容进行计算，生成原始信息摘要,然后采用系统根证书自身的私钥对该原始信息摘要进行加密，该加密后的原始信息摘要即发行者数字签名。原始用户证书经系统根证书签名后发放到区块链上的所有用户上。区块链上每一用户获取签名后的原始用户证书，即用户数字证书。通过采用区块链上的系统根证书生成区块链上每一用户的用户数字证书，能够保证生成的每一用户数字证书都是安全合法的，区块链系统上每一用户都可以采用自身的用户数字证书证明在该区块链系统上的身份合法性。
基于步骤S21和步骤S22，通过采用区块链上的系统根证书生成区块链上每一用户的用户数字证书，能够保证每一用户数字证书的安全性。区块链系统上每一用户都可以采用自身的用户数字证书证明在该区块链系统上的身份合法性。
S30：区块链系统上用户A和用户B进行通信，若用户A需要对用户B进行验证，则用户A接收用户B发送的用户数字证书。
本实施例中，区块链系统上包括任意两个普通用户：用户A和用户B。若用户B想要发送数据给用户A，用户A要求对用户B的身份进行验证。在用户A对用户B进行身份验证时，则用户B需发送自身的用户数字证书给用户A，为后续用户A根据系统根证书的公钥对用户B的用户数字证书进行解密，验证用户B是否为区块链上合法用户提供了基础。需要说明的是用户B也可以要求验证用户A的身份合法性，验证过程可以是双向的。
S40：用户A采用系统根证书对用户B的用户数字证书进行验证。
本实施例中，区块链上用户采用在区块链上创建的系统根证书，采用系统根证书对用 户B的用户数字证书进行验证。系统根证书在该区块链系统上具有权威性，根据用户系统根证书能够保证验证结果的准确性，使得用户A能够实现对用户B的身份验证。
在一具体实施方式中，如图4，步骤S40中，用户A采用系统根证书对用户B的用户数字证书进行验证，具体包括如下步骤：
S41：用户A在区块链系统上读取系统根证书，获取系统根证书的公钥。
本实施例中，用户A读取区块链系统上的系统根证书，具体读取的方式为在区块链上查询名为ROOT的键，由该键ROOT与值cert为一个键值对的关系，直接根据键ROOT获取值cert，该值cert即为系统根证书。系统根证书包括一对相对应的公钥和私钥，公钥用于用户验证，私钥用于加密原始用户证书，而区块链系统上的每一用户的用户数字证书均是采用系统根证书的私钥加密其对应的原始用户证书后获取的，因此，需获取系统根证书中的公钥，以便基于该公钥对用户数字证书进行验证。本实施例中，用户A需要对用户B进行验证，因此，用户A需从系统根证书中获取系统根证书的公钥，以根据该公钥进行区块链上用户身份合法性验证。
S42：用户A根据系统根证书的公钥对用户B的用户数字证书进行解密，若解密成功，则验证通过。
本实施例中，在用户A获取系统根证书的公钥后，采用该公钥对用户B的用户数字证书进行解密，具体地，该解密验证过程为：用户A首先采用与系统根证书生成用户数字证书时采用的相同的哈希函数，对用户B的用户数字证书的证书内容计算得到第一信息摘要，接着再用系统根证书的公钥对发行者数字签名进行解密，计算出第二信息摘要，如果第一信息摘要和第二信息摘要相同，则认为该解密过程是成功的，即用户A能够确认该发行者数字签名是系统根证书签发的。
需要说明的是，用户B的用户数字证书的证书内容和原始用户证书的证书内容是相同的。系统根证书对原始用户证书进行数字签名，只是对原始信息摘要进行加密，并不会改变原始用户证书的证书内容。根据哈希函数的单向散列性，采用哈希函数对用户B的用户数字证书的证书内容进行计算，获取第一信息摘要，并基于该第一信息摘要与第二摘要作比较。由加密的过程(哈希函数的单向散列性质)能够知道如果用户B的用户证书是区块链系统上的系统根证书发放的，第一信息摘要与第二摘要必定相同。通过用户A根据系统根证书的公钥对用户B的用户数字证书进行解密，实现了用户A在区块链系统上对用户B的验证，保证区块链系统上用户进行通信时的安全。
基于步骤S41和步骤S42，用户A在对用户B进行身份验证的时候，采用了区块链上 具有权威性质的系统根证书，通过系统根证书的公钥解密用户B的用户数字证书，根据解密结果(第一信息摘要是否和第二信息摘要相同)判断用户B的合法性，使得基于系统根证书的验证在区块链系统上的用户验证更加安全和可靠。
S50：若验证通过，则确定用户B为区块链系统上的合法用户。
本实施例中，若验证通过，由系统根证书在区块链系统上的权威性可知，拥有系统根证书加密的用户数字证书的区块链上系统上的用户都是区块链上的合法用户，则能够确定用户B为区块链系统上的合法用户，用户B能够与用户A进行正常的通信。
需要说明的是，本实施例中的用户A和用户B是区块链系统上任意的两个区别于权威认证节点的普通用户，区块链上的用户间进行验证可以是单向的，也可以是双向的，用户A可以要求对用户B的身份进行验证，用户B同样也可以对用户A的身份进行验证。验证过程都需要通过区块链系统读取系统根证书，根据系统根证书对用户数字证书进行解密，以验证用户是否为区块链系统上的合法用户。
本实施例所提供的区块链系统上用户验证方法中，首先通过权威认证节点在区块链系统上设置系统根证书，结合区块链自身特点自定义地在区块链系统上设置系统根证书，使得整个区块链系统的安全依赖于该系统根证书，保证区块链系统的安全性。然后根据系统根证书生成区块链系统上所有用户的用户数字证书，使得通过该系统根证书生成的用户数字证书能够用于实现区块链系统上的用户验证。最后区块链系统上用户A和用户B进行通信，用户A采用系统根证书的公钥对用户B的用户数字证书进行验证，以确定用户B是否为区块链系统上的合法用户。区块链上用户通过直接读取设置在区块链上的根证书，采用根证书对在区块链系统上自定义设置的系统根证书生成的用户数字证书进行验证，能够实现区块链系统上有效和安全的用户验证功能。在区块链系统上自定义设置的系统根证书结合了区块链的特点，基于区块链的数据共享性，使得创建设置的系统根证书能够便捷地被区块链系统上用户读取和使用，以进行区块链上用户间的验证；基于区块链的数据不可篡改性，使得创建设置的系统根证书不能被恶意修改；并且，权威认证节点在区块链系统上拥有特定权限及权威性，由权威认证节点在区块链系统上设置的系统根证书拥有权威性，保证了区块链系统的安全。
应理解，上述实施例中各步骤的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
实施例2
图5示出与实施例1中区块链系统上用户验证方法一一对应的区块链系统上用户验证 管理装置的原理框图。如图5所示，该区块链系统上用户验证装置包括根证书设置模块10、数字证书生成模块20、数字证书发送模块30、验证模块40和确定模块50。其中，根证书设置模块10、数字证书生成模块20、数字证书发送模块30、验证模块40和确定模块50的实现功能与实施例1中区块链系统上用户验证方法对应的步骤一一对应，为避免赘述，本实施例不一一详述。
根证书设置模块10，用于通过权威认证节点在区块链系统上设置系统根证书。
数字证书生成模块20，用于根据系统根证书生成区块链系统上所有用户的用户数字证书。
数字证书发送模块30，用于区块链系统上用户A和用户B进行通信，若用户A需要对用户B进行验证，则用户A接收用户B发送的用户数字证书。
验证模块40，用于用户A采用系统根证书对用户B的用户数字证书进行验证。
确定模块50，用于若验证通过，则用户B为区块链系统上的合法用户。
优选地，根证书设置模块10包括根证书创建单元11、交易发送单元12和交易接收单元13。
根证书创建单元11，用于通过权威认证节点创建一个包含系统根证书的交易。
交易发送单元12，用于将交易发送到区块链系统上。
交易接收单元13，用于基于区块链系统的共识机制，打包交易到当前所在区块中，区块链系统上所有用户得到当前所在区块，接受当前所在区块中的交易。
优选地，根证书创建单元11，用于通过权威认证节点创建一个键值对，键值对的键为key＝ROOT，值为value＝cert，其中，ROOT代表系统根证书的键，cert代表系统根证书的值。
优选地，数字证书生成模块20包括原始用户证书创建单元21和用户数字证书获取单元22。
原始证书创建单元21，用于创建区块链系统上所有用户的原始用户证书。
数字证书获取单元22，用于采用系统根证书的私钥加密所有用户的原始用户证书，生成区块链系统上所有用户的用户数字证书，用户数字证书包括发行者数字签名。
优选地，验证模块40包括公钥获取单元41和解密单元42。
公钥获取单元41，用于使用户A在区块链系统上读取系统根证书，获取系统根证书的公钥。
解密单元42，用于使用户A根据系统根证书的公钥对用户B的用户数字证书进行解密， 若解密成功，则验证通过。
本实施例所提供的区块链系统上用户验证装置中，根证书设置模块10，能够使得整个区块链系统的安全依赖于该自定义设置的系统根证书，提高区块链系统的独立性和安全性。数字证书生成模块20，使得通过自定义设置的系统根证书生成的用户数字证书能够用于区块链系统上的用户验证。数字证书发送模块30、验证模块40和确定模块50，基于在区块链系统上自定义设置的系统根证书生成的用户数字证书，能实现区块链系统上有效和安全的用户验证功能。在区块链系统上自定义设置的系统根证书结合了区块链的特点，基于区块链的数据共享性，使得创建设置的系统根证书能够便捷地被区块链系统上用户获取和使用，以进行区块链上用户间的验证；基于区块链的数据不可篡改性，使得创建设置的系统根证书不能被恶意修改；并且，权威认证节点在区块链系统上拥有特定权限及权威性，由权威认证节点在区块链系统上设置的系统根证书拥有权威性，保证了区块链系统的安全性。
实施例3
本实施例提供一个或多个存储有计算机可读指令的非易失性可读存储介质，所述计算机可读指令被一个或多个处理器执行时，使得所述一个或多个处理器执行时实现实施例1中区块链系统上用户验证方法，为避免重复，这里不再赘述。或者，所述计算机可读指令被一个或多个处理器执行时，使得所述一个或多个处理器执行时实现实施例2中区块链系统上用户验证装置中各模块/单元的功能，为避免重复，这里不再赘述。
实施例4
图6是本实施例中终端设备的示意图。如图6所示，终端设备60包括处理器61、存储器62以及存储在存储器62中并可在处理器61上运行的计算机可读指令63。处理器61执行计算机可读指令63时实现实施例1中区块链系统上用户验证方法的各个步骤，例如图1所示的步骤S10、S20、S30、S40和S50。或者，处理器61执行计算机可读指令63时实现实施例2中区块链系统上用户验证装置各模块/单元的功能，如图5所示根证书设置模块10、数字证书生成模块20、数字证书发送模块30、验证模块40和确定模块50的功能。
示例性的，计算机可读指令63可以被分割成一个或多个模块/单元，一个或者多个模块/单元被存储在存储器62中，并由处理器61执行，以完成本申请。一个或多个模块/单元可以是能够完成特定功能的一系列计算机可读指令的指令段，该指令段用于描述计算机可读指令63在终端设备60中的执行过程。例如，计算机可读指令63可被分割成实施例2 中的根证书设置模块10、数字证书生成模块20、数字证书发送模块30、验证模块40和确定模块50，各模块的具体功能如实施例2所示，为避免重复，此处不一一赘述。
终端设备60可以是桌上型计算机、笔记本、掌上电脑及云端服务器等计算设备。终端设备可包括，但不仅限于，处理器61、存储器62。本领域技术人员可以理解，图6仅仅是终端设备60的示例，并不构成对终端设备60的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件，例如终端设备还可以包括输入输出设备、网络接入设备、总线等。
所称处理器61可以是中央处理单元(Central Processing Unit，CPU)，还可以是其他通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现场可编程门阵列(Field-Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
存储器62可以是终端设备60的内部存储单元，例如终端设备60的硬盘或内存。存储器62也可以是终端设备60的外部存储设备，例如终端设备60上配备的插接式硬盘，智能存储卡(Smart Media Card,SMC)，安全数字(Secure Digital,SD)卡，闪存卡(Flash Card)等。进一步地，存储器62还可以既包括终端设备60的内部存储单元也包括外部存储设备。存储器62用于存储计算机可读指令63以及终端设备所需的其他程序和数据。存储器62还可以用于暂时地存储已经输出或者将要输出的数据。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，仅以上述各功能单元、模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能单元、模块完成，即将所述装置的内部结构划分成不同的功能单元或模块，以完成以上描述的全部或者部分功能。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的模块/单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请实现上述实施例方法中的全部或部分流程，也可以通过计算机可读指令63来指令相关的硬件来完成，所述的计算机可读指令63可存储于一计算机可读存储介质中，该计算机可读指令63在被处 理器执行时，可实现上述各个方法实施例的步骤。其中，所述计算机可读指令63包括计算机可读指令63的代码，所述计算机可读指令63的代码可以为源代码形式、对象代码形式、可执行文件或某些中间形式等。所述计算机可读介质可以包括：能够携带所述计算机可读指令63的代码的任何实体或装置、记录介质、U盘、移动硬盘、磁碟、光盘、计算机存储器、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、电载波信号、电信信号以及软件分发介质等。需要说明的是，所述计算机可读介质包含的内容可以根据司法管辖区内立法和专利实践的要求进行适当的增减，例如在某些司法管辖区，根据立法和专利实践，计算机可读介质不包括是电载波信号和电信信号。
以上所述实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围，均应包含在本申请的保护范围之内。

Claims (20)

  1. 一种区块链系统上用户验证方法，其特征在于，包括：
    通过权威认证节点在区块链系统上设置系统根证书；
    根据所述系统根证书生成所述区块链系统上所有用户的用户数字证书；
    所述区块链系统上用户A和用户B进行通信，若用户A需要对用户B进行验证，则用户A接收用户B发送的所述用户数字证书；
    用户A采用所述系统根证书对用户B的用户数字证书进行验证；
    若验证通过，则确定用户B为所述区块链系统上的合法用户。
  2. 根据权利要求1所述的区块链系统上用户验证方法，其特征在于，所述通过权威认证节点在区块链系统上设置系统根证书，包括：
    通过权威认证节点创建一个包含所述系统根证书的交易；
    将所述交易发送到所述区块链系统上；
    基于所述区块链系统的共识机制，打包所述交易到当前所在区块中，所述区块链系统上所有用户得到当前所在区块，接受当前所在区块中的所述交易。
  3. 根据权利要求2所述的区块链系统上用户验证方法，其特征在于，所述通过权威认证节点创建一个包含所述系统根证书的交易，包括：
    通过权威认证节点创建一个键值对，所述键值对的键为key＝ROOT，值为value＝cert，其中，所述ROOT代表所述系统根证书的键，所述cert代表所述系统根证书的值。
  4. 根据权利要求1所述的区块链系统上用户验证方法，其特征在于，所述根据所述系统根证书生成所述区块链系统上所有用户的用户数字证书，包括：
    创建区块链系统上所有用户的原始用户证书；
    采用所述系统根证书的私钥加密所有用户的所述原始用户证书，生成所述区块链系统上所有用户的用户数字证书，所述用户数字证书包括发行者数字签名。
  5. 根据权利要求4所述的区块链系统上用户验证方法，其特征在于，所述用户A采用所述系统根证书对用户B的用户数字证书进行验证，包括：
    用户A在区块链系统上读取所述系统根证书，获取所述系统根证书的公钥；
    用户A根据所述系统根证书的公钥对用户B的用户数字证书进行解密，若解密成功，则验证通过。
  6. 一种区块链系统上用户验证装置，其特征在于，包括：
    根证书设置模块，用于通过权威认证节点在区块链系统上设置系统根证书；
    数字证书生成模块，用于根据所述系统根证书生成所述区块链系统上所有用户的用户数字证书；
    数字证书发送模块，用于所述区块链系统上用户A和用户B进行通信，若用户A需要对用户B进行验证，则用户A接收用户B发送的所述用户数字证书；
    验证模块，用于用户A采用所述系统根证书对用户B的用户数字证书进行验证；
    确定模块，用于若验证通过，则用户B为所述区块链系统上的合法用户。
  7. 根据权利要求6所述的区块链系统上用户验证装置，其特征在于，所述根证书设置模块，包括：
    根证书创建单元，用于通过权威认证节点创建一个包含所述系统根证书的交易；
    交易发送单元，用于将所述交易发送到所述区块链系统上；
    交易接收单元，用于基于所述区块链系统的共识机制，打包所述交易到当前所在区块中，所述区块链系统上所有用户得到当前所在区块，接受当前所在区块中的所述交易。
  8. 根据权利要求7所述的区块链系统上用户验证装置，其特征在于，所述根证书创建单元，用于通过权威认证节点创建一个键值对，所述键值对的键为key＝ROOT，值为value＝cert，其中，所述ROOT代表所述系统根证书的键，所述cert代表所述系统根证书的值。
  9. 根据权利要求6所述的区块链系统上用户验证装置，其特征在于，所述数字证书生成模块包括：
    原始证书创建单元，用于创建区块链系统上所有用户的原始用户证书；
    数字证书获取单元，用于采用所述系统根证书的私钥加密所有用户的所述原始用户证书，生成所述区块链系统上所有用户的用户数字证书，所述用户数字证书包括发行者数字签名。
  10. 根据权利要求9所述的区块链系统上用户验证装置，其特征在于，所述验证模块，包括：
    公钥获取单元41，用于使用户A在区块链系统上读取所述系统根证书，获取所述系统根证书的公钥；
    解密单元42，用于使用户A根据所述系统根证书的公钥对用户B的用户数字证书进行解密，若解密成功，则验证通过。
  11. 一种终端设备，包括存储器、处理器以及存储在所述存储器中并可在所述处理器 上运行的计算机可读指令，其特征在于，所述处理器执行所述计算机可读指令时实现如下步骤：
    通过权威认证节点在区块链系统上设置系统根证书；
    根据所述系统根证书生成所述区块链系统上所有用户的用户数字证书；
    所述区块链系统上用户A和用户B进行通信，若用户A需要对用户B进行验证，则用户A接收用户B发送的所述用户数字证书；
    用户A采用所述系统根证书对用户B的用户数字证书进行验证；
    若验证通过，则确定用户B为所述区块链系统上的合法用户。
  12. 根据权利要求11所述的终端设备，其特征在于，所述通过权威认证节点在区块链系统上设置系统根证书，包括：
    通过权威认证节点创建一个包含所述系统根证书的交易；
    将所述交易发送到所述区块链系统上；
    基于所述区块链系统的共识机制，打包所述交易到当前所在区块中，所述区块链系统上所有用户得到当前所在区块，接受当前所在区块中的所述交易。
  13. 根据权利要求12所述的终端设备，其特征在于，所述通过权威认证节点创建一个包含所述系统根证书的交易，包括：
    通过权威认证节点创建一个键值对，所述键值对的键为key＝ROOT，值为value＝cert，其中，所述ROOT代表所述系统根证书的键，所述cert代表所述系统根证书的值。
  14. 根据权利要求11所述的终端设备，其特征在于，所述根据所述系统根证书生成所述区块链系统上所有用户的用户数字证书，包括：
    创建区块链系统上所有用户的原始用户证书；
    采用所述系统根证书的私钥加密所有用户的所述原始用户证书，生成所述区块链系统上所有用户的用户数字证书，所述用户数字证书包括发行者数字签名。
  15. 根据权利要求14所述的终端设备，其特征在于，所述用户A采用所述系统根证书对用户B的用户数字证书进行验证，包括：
    用户A在区块链系统上读取所述系统根证书，获取所述系统根证书的公钥；
    用户A根据所述系统根证书的公钥对用户B的用户数字证书进行解密，若解密成功，则验证通过。
  16. 一个或多个存储有计算机可读指令的非易失性可读存储介质，其特征在于，所述计算机可读指令被一个或多个处理器执行时，使得所述一个或多个处理器执行如下步骤：
    通过权威认证节点在区块链系统上设置系统根证书；
    根据所述系统根证书生成所述区块链系统上所有用户的用户数字证书；
    所述区块链系统上用户A和用户B进行通信，若用户A需要对用户B进行验证，则用户A接收用户B发送的所述用户数字证书；
    用户A采用所述系统根证书对用户B的用户数字证书进行验证；
    若验证通过，则确定用户B为所述区块链系统上的合法用户。
  17. 根据权利要求16所述的非易失性可读存储介质，其特征在于，所述通过权威认证节点在区块链系统上设置系统根证书，包括：
    通过权威认证节点创建一个包含所述系统根证书的交易；
    将所述交易发送到所述区块链系统上；
    基于所述区块链系统的共识机制，打包所述交易到当前所在区块中，所述区块链系统上所有用户得到当前所在区块，接受当前所在区块中的所述交易。
  18. 根据权利要求17所述的非易失性可读存储介质，其特征在于，所述通过权威认证节点创建一个包含所述系统根证书的交易，包括：
    通过权威认证节点创建一个键值对，所述键值对的键为key＝ROOT，值为value＝cert，其中，所述ROOT代表所述系统根证书的键，所述cert代表所述系统根证书的值。
  19. 根据权利要求16所述的非易失性可读存储介质，其特征在于，所述根据所述系统根证书生成所述区块链系统上所有用户的用户数字证书，包括：
    创建区块链系统上所有用户的原始用户证书；
    采用所述系统根证书的私钥加密所有用户的所述原始用户证书，生成所述区块链系统上所有用户的用户数字证书，所述用户数字证书包括发行者数字签名。
  20. 根据权利要求19所述的非易失性可读存储介质，其特征在于，所述用户A采用所述系统根证书对用户B的用户数字证书进行验证，包括：
    用户A在区块链系统上读取所述系统根证书，获取所述系统根证书的公钥；
    用户A根据所述系统根证书的公钥对用户B的用户数字证书进行解密，若解密成功，则验证通过。
PCT/CN2018/095904 2018-05-09 2018-07-17 区块链系统上用户验证方法、装置、终端设备及存储介质 WO2019214068A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810436851.9 2018-05-09
CN201810436851.9A CN108737106B (zh) 2018-05-09 2018-05-09 区块链系统上用户验证方法、装置、终端设备及存储介质

Publications (1)

Publication Number Publication Date
WO2019214068A1 true WO2019214068A1 (zh) 2019-11-14

Family

ID=63938068

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/095904 WO2019214068A1 (zh) 2018-05-09 2018-07-17 区块链系统上用户验证方法、装置、终端设备及存储介质

Country Status (2)

Country Link
CN (1) CN108737106B (zh)
WO (1) WO2019214068A1 (zh)

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109948348A (zh) * 2018-11-15 2019-06-28 陕西医链区块链集团有限公司 一种基于医疗区块链技术的身份证明系统及其使用方法
CN110086608B (zh) * 2019-03-21 2022-03-25 深圳壹账通智能科技有限公司 用户认证方法、装置、计算机设备及计算机可读存储介质
CN110163754B (zh) * 2019-04-26 2021-07-27 华中科技大学 Fabric区块链中实现铸币交易的方法、客户端、区块链及系统
CN112311547A (zh) * 2019-07-26 2021-02-02 南方电网科学研究院有限责任公司 一种基于国产密码技术的终端安全认证方法、装置
CN111130841B (zh) * 2019-11-21 2022-07-08 深圳壹账通智能科技有限公司 区块链网络部署方法、电子装置及计算机可读存储介质
CN111080296B (zh) * 2019-12-05 2023-12-01 深圳前海微众银行股份有限公司 一种基于区块链系统的验证方法及装置
CN112491847B (zh) * 2020-07-08 2022-02-22 支付宝(杭州)信息技术有限公司 区块链一体机及其自动建链方法、装置
CN111541552B (zh) * 2020-07-08 2021-06-22 支付宝(杭州)信息技术有限公司 区块链一体机及其节点自动加入方法、装置
CN111541724B (zh) 2020-07-08 2021-06-29 支付宝(杭州)信息技术有限公司 区块链一体机及其节点自动加入方法、装置
CN111818072B (zh) * 2020-07-16 2022-04-15 中国联合网络通信集团有限公司 数字证书的验证方法、用户节点及认证授权中心
CN116055069B (zh) * 2023-04-03 2023-06-27 北京微芯感知科技有限公司 一种基于区块链的分布式ca实现方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106301792A (zh) * 2016-08-31 2017-01-04 江苏通付盾科技有限公司 基于区块链的ca认证管理方法、装置及系统
CN106453636A (zh) * 2016-11-22 2017-02-22 深圳银链科技有限公司 可信区块生成方法及系统
US20170257358A1 (en) * 2016-03-04 2017-09-07 ShoCard, Inc. Method and System for Authenticated Login Using Static or Dynamic Codes
CN107426157A (zh) * 2017-04-21 2017-12-01 杭州趣链科技有限公司 一种基于数字证书以及ca认证体系的联盟链权限控制方法
CN107579817A (zh) * 2017-09-12 2018-01-12 广州广电运通金融电子股份有限公司 基于区块链的用户身份验证方法、装置及系统

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103729943B (zh) * 2013-03-15 2015-12-30 福建联迪商用设备有限公司 一种将传输密钥导入kms系统的方法及系统
US20170346639A1 (en) * 2016-05-24 2017-11-30 Business Information Exchange System Corp. Public Key Infrastructure based on the Public Certificates Ledger
CN106504091B (zh) * 2016-10-27 2018-06-29 深圳壹账通智能科技有限公司 区块链上交易的方法及装置
CN106790234B (zh) * 2017-01-18 2018-09-04 维沃移动通信有限公司 一种邮件发送方法、接收方法、第一终端和第二终端
CN107360001B (zh) * 2017-07-26 2021-12-14 创新先进技术有限公司 一种数字证书管理方法、装置和系统
CN107888382B (zh) * 2017-11-24 2019-11-19 中钞信用卡产业发展有限公司杭州区块链技术研究院 一种基于区块链的数字身份验证的方法、装置和系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170257358A1 (en) * 2016-03-04 2017-09-07 ShoCard, Inc. Method and System for Authenticated Login Using Static or Dynamic Codes
CN106301792A (zh) * 2016-08-31 2017-01-04 江苏通付盾科技有限公司 基于区块链的ca认证管理方法、装置及系统
CN106453636A (zh) * 2016-11-22 2017-02-22 深圳银链科技有限公司 可信区块生成方法及系统
CN107426157A (zh) * 2017-04-21 2017-12-01 杭州趣链科技有限公司 一种基于数字证书以及ca认证体系的联盟链权限控制方法
CN107579817A (zh) * 2017-09-12 2018-01-12 广州广电运通金融电子股份有限公司 基于区块链的用户身份验证方法、装置及系统

Also Published As

Publication number Publication date
CN108737106B (zh) 2021-06-01
CN108737106A (zh) 2018-11-02

Similar Documents

Publication Publication Date Title
WO2019214068A1 (zh) 区块链系统上用户验证方法、装置、终端设备及存储介质
EP3610624B1 (en) Retrieving access data for blockchain networks using highly available trusted execution environments
US11563567B2 (en) Secure shared key establishment for peer to peer communications
CN108292402B (zh) 用于信息的安全交换的公共秘密的确定和层级确定性密钥
US20190074968A1 (en) Method, apparatus and system for data encryption and decryption
CN110569674B (zh) 基于区块链网络的认证方法及装置
WO2019127278A1 (zh) 安全访问区块链的方法、装置、系统、存储介质及电子设备
US7526649B2 (en) Session key exchange
WO2019214070A1 (zh) 区块链上用户通信加密方法、装置、终端设备及存储介质
WO2020062668A1 (zh) 一种身份认证方法、身份认证装置及计算机可读介质
US20190295069A1 (en) Systems and methods for integrating cryptocurrency wallet identifiers with digital certificates
EP3596680A1 (en) Methods and systems for universal storage and access to user-owned credentials for trans-institutional digital authentication
US20140270179A1 (en) Method and system for key generation, backup, and migration based on trusted computing
TW202101165A (zh) 解鎖方法、實現解鎖的設備及電腦可讀媒體
CA2795428C (en) Trusted certificate authority to create certificates based on capabilities of processes
US11368314B2 (en) Secure digital signing
WO2023083007A1 (zh) 物联网设备身份认证方法、装置、系统及存储介质
WO2019110018A1 (zh) 通信网络系统的消息验证方法、通信方法和通信网络系统
CN108696518B (zh) 区块链上用户通信加密方法、装置、终端设备及存储介质
US20210306135A1 (en) Electronic device within blockchain based pki domain, electronic device within certification authority based pki domain, and cryptographic communication system including these electronic devices
WO2022134812A1 (zh) 基于联盟链的多机构数据处理方法、装置及相关设备
CN114357492A (zh) 一种基于区块链的医疗数据隐私融合方法及装置
CN110912892B (zh) 一种证书管理方法、装置、电子设备及存储介质
CN112948789B (zh) 身份认证方法及装置、存储介质及电子设备
CN113271207A (zh) 基于移动电子签名的托管密钥使用方法、系统、计算机设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18917939

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 26/03/2021)

122 Ep: pct application non-entry in european phase

Ref document number: 18917939

Country of ref document: EP

Kind code of ref document: A1