WO2020177518A1 - 为区块链节点发放身份证书的方法及相关装置 - Google Patents

为区块链节点发放身份证书的方法及相关装置 Download PDF

Info

Publication number
WO2020177518A1
WO2020177518A1 PCT/CN2020/075467 CN2020075467W WO2020177518A1 WO 2020177518 A1 WO2020177518 A1 WO 2020177518A1 CN 2020075467 W CN2020075467 W CN 2020075467W WO 2020177518 A1 WO2020177518 A1 WO 2020177518A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
node
certificate
identity certificate
unit
Prior art date
Application number
PCT/CN2020/075467
Other languages
English (en)
French (fr)
Inventor
李茂材
王宗友
周开班
杨常青
蓝虎
孔利
张劲松
时一防
朱耿良
刘区城
陈秋平
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Priority to JP2021518649A priority Critical patent/JP7113138B2/ja
Publication of WO2020177518A1 publication Critical patent/WO2020177518A1/zh
Priority to US17/337,029 priority patent/US11943373B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees

Definitions

  • This application relates to the field of blockchain, and specifically relates to the issuance of identity certificates for blockchain nodes in the tax blockchain network.
  • any node can join the consensus system and become an accounting node.
  • the alliance chain system only a few nodes are opened as accounting nodes, so that when ordinary nodes (that is, nodes other than accounting nodes) need to upload transaction information on the blockchain, the The ordinary node sends the information that needs to be chained to one of the few accounting nodes, and then the accounting node uploads the received information to the chain.
  • the consortium chain system in addition to ensuring the security of the user’s personal account information through the security of the user’s private key, it is also necessary to bind the user’s actual identity with the account information on the blockchain to achieve An access mechanism.
  • an enterprise node wants to join the consortium chain, it must first register as a member of the consortium chain before it can use the accounting node to upload information and query information.
  • the nodes of both parties When linking and querying through the bookkeeping node, the nodes of both parties first need to establish whether the other party is a member of the alliance chain. If they are members of the alliance chain, they can perform the linking and query normally.
  • To establish whether the identity of the other party is a member of the consortium chain it can take the form of message signature and the other party's verification signature. In order to sign and verify the signature, each node needs to be issued a unique public and private key.
  • each successfully registered node must be issued an identity certificate to ensure that the node is a node with the correct identity registered in the consortium chain. Therefore, for the alliance blockchain network, a mechanism for issuing and maintaining identity certificates for joining blockchain nodes is needed to ensure the verifiability of the identity information of each blockchain node in the communication.
  • the tax blockchain network is a relatively complex blockchain network, so how to implement the issuance of identity certificates in the tax blockchain network is still an urgent technical problem to be solved.
  • This application proposes a method, certificate authorization system, computer equipment and media for issuing identity certificates for blockchain nodes in the tax blockchain network, which can realize the issuance process of identity certificates in the tax blockchain network.
  • a method for issuing identity certificates for blockchain nodes in a tax blockchain network includes the terminal of the State Administration of Taxation and the local tax Bureau terminal, basic unit terminal, the method is executed by a certificate authorization system, the certificate authorization system includes a first-level certificate authorization node, a second-level certificate authorization node, and a basic-level unit certificate authorization node, the method includes:
  • a request for issuance of an identity certificate of a basic-level unit using the identity certificate of the local taxation bureau is received from a terminal of the local taxation bureau, and the request for issuance of the basic-level unit identity certificate is in response to the basic-level unit terminal to the local taxation bureau that already has the identity certificate of the local taxation bureau.
  • the basic-level unit certificate authorization node is used to issue the basic-level unit identity certificate to the local tax bureau terminal, so that the local tax bureau terminal forwards the basic-level unit identity certificate to the basic unit terminal.
  • a certificate authorization system for issuing identity certificates for blockchain nodes in a tax blockchain network.
  • the blockchain nodes in the tax blockchain network include the terminal of the State Administration of Taxation. , Local Taxation Bureau terminal, grassroots unit terminal, the certificate authorization system includes:
  • the first-level certificate authorization node is used to issue the SAT identity certificate to the SAT terminal;
  • the second-level certificate authorization node is used to respond to the local tax bureau identity certificate issuance request from the SAT terminal using the SAT identity certificate to issue the local tax bureau identity certificate to the SAT terminal so that the SAT terminal Forwarding the local tax bureau identity certificate to the local tax bureau terminal, wherein the local tax bureau identity certificate issuance request is generated in response to a registration request sent by the local tax bureau terminal to the state tax bureau terminal;
  • the base-level unit certificate authorization node is used to respond to a base-level unit identity certificate issuance request from a local tax bureau terminal using the local tax bureau’s identity certificate to issue a base-level unit identity certificate to the local tax bureau terminal so that the local tax bureau terminal
  • the basic-level unit identity certificate is forwarded to the basic-level unit terminal, wherein the basic-level unit identity certificate issuance request is in response to the registration request from the basic-level unit terminal to the local taxation bureau terminal that already has the local taxation bureau identity certificate. generate.
  • a computer device including: a memory storing computer-readable instructions; a processor, reading the computer-readable instructions stored in the memory, to execute the method described above.
  • a storage medium which is characterized in that the storage medium includes a stored program, wherein the method described above is executed when the program runs.
  • a computer program product including instructions, which when run on a computer, causes the computer to execute the above-mentioned method.
  • the certificate authorization system includes a first-level certificate authorization node, a second-level certificate authorization node, and a basic-level unit certificate authorization node.
  • the SAT identity certificate is issued to the SAT terminal.
  • the SAT terminal obtains the identity certificate, it represents it has the right to receive the registration request from the following local tax bureau terminals, and handle the local tax bureau identity certificate for the local tax bureau terminals.
  • the local tax bureau's identity certificate is issued by the second-level certificate authority node.
  • the SAT terminal requests the local tax bureau to issue a local tax bureau identity certificate based on the SAT identity certificate issued for itself, so that the issued local tax bureau identity certificate is guaranteed by a legal SAT terminal.
  • the local taxation bureau terminal After the local taxation bureau terminal obtains the local taxation bureau's identity certificate, it represents the right to receive registration requests from the following grassroots unit terminals and handle the grassroots unit identity certificate for each grassroots unit terminal.
  • the identity certificate of the basic unit is issued by the certificate authority node of the basic unit.
  • the local tax bureau terminal uses the local tax bureau identity certificate issued for itself to request the issuance of the basic unit identity certificate for the basic unit below it. In this way, the issued basic unit identity certificate is guaranteed by a legal local tax bureau terminal.
  • each level of identity certificate issuance is guaranteed by the identity certificate issued by the previous level, which guarantees the security of the issuance of identity certificates at different levels, and adapts to the different levels of blockchain nodes in the tax blockchain network.
  • the need for authority control improves the effectiveness of the internal authority control of the tax blockchain network.
  • FIG. 1A shows an overall architecture diagram of a blockchain network to which the method for issuing identity certificates by blockchain nodes in a tax blockchain network according to an embodiment of the present application is applied.
  • Fig. 1B shows a more detailed architecture diagram of the blockchain network of Fig. 1A according to an embodiment of the present application.
  • Fig. 2 shows an architecture diagram of a certificate authorization system according to an embodiment of the present application, and the architecture diagram shows the correspondence between each level of certificate authority nodes and various levels of blockchain nodes.
  • Figures 3A-K show that the method for issuing identity certificates for blockchain nodes in a tax blockchain network according to an embodiment of the application is applied to the issuance of identity certificates for blockchain nodes at all levels in the electronic invoice blockchain network Schematic interface diagram of the application scenario.
  • Fig. 4 shows a schematic structural diagram of a distributed certificate authority system according to an embodiment of the present application.
  • Fig. 5 shows a flow chart of a method for issuing identity certificates for blockchain nodes in a tax blockchain network according to an embodiment of the present application.
  • Fig. 6 shows a flowchart of a method for issuing identity certificates for blockchain nodes in a tax blockchain network according to an embodiment of the present application.
  • Fig. 7 shows a flowchart of a method for issuing identity certificates for blockchain nodes in a tax blockchain network according to an embodiment of the present application.
  • Fig. 8 shows a flowchart of a method for issuing identity certificates for blockchain nodes in a tax blockchain network according to an embodiment of the present application.
  • Fig. 9 shows a flowchart of a method for issuing identity certificates for blockchain nodes in a tax blockchain network according to an embodiment of the present application.
  • Fig. 10 shows a block diagram of a certificate authorization system for issuing identity certificates for blockchain nodes in a tax blockchain network according to an embodiment of the present application.
  • Fig. 11 shows a hardware diagram of a computer device according to an embodiment of the present application.
  • Blockchain network refers to a node network composed of all nodes that record and query data blocks on the blockchain.
  • Each node in the blockchain network is a blockchain node. It is a device that can record or query data blocks on the blockchain. It can be a mobile phone, desktop computer, laptop, PDA, or vehicle.
  • Various forms of terminals such as terminals.
  • the blockchain network is divided into a business node sub-network 101 and a billing node sub-network 102. Among them, the nodes in the business node sub-network 101 are called business nodes 103, and the nodes in the billing node sub-network 102 are called billing nodes 104.
  • the accounting node 104 can directly upload data blocks or query data blocks on the blockchain; however, the business node 103 cannot directly upload data blocks to the blockchain, nor can it directly query The data block on the blockchain, however, can request the accounting node 104 to upload and query the data block.
  • the specific process can be as follows: when there is transaction information in the business node 103, the business node 103 can upload The transaction information is sent to the accounting node 104 of the accounting node sub-network 102, so that the accounting node 104 uploads the transaction information to the chain; when the business node 103 needs to query the data block, the business node 103 can also use the accounting The node 104 makes a query.
  • the accounting node 104 is officially set in many cases, and private terminals can only serve as the business node 103.
  • the proxy node 105 is located between the service node sub-network 101 and the accounting node sub-network 102, and is an intermediary between the service node 103 and the accounting node 104.
  • the business node 103 can send the transaction information to the billing node 104 through the proxy node 105 for uploading on the chain.
  • the business node 103 needs to query the data block, it also queries the accounting node 104 through the proxy node 105.
  • FIG 1A is only the architecture of a general blockchain network
  • Figure 1B shows a more detailed architecture of the tax blockchain network.
  • Tax blockchain network refers to the blockchain network used to carry on the chain and query of electronic invoice-related transactions (such as receiving, issuing, reimbursing). Since electronic invoice-related transactions involve not only the government (tax bureaus at all levels), but also the invoicing companies (invoicing units, reimbursement units), and individuals (reimbursers), the business node sub-network 101 includes tax private networks 106.
  • the tax private network 106 is the sum of the business nodes of government departments involved in the electronic invoice transaction, including the terminal 1031 of the State Administration of Taxation and the terminal 1032 of the Local Taxation Bureau.
  • the shared cloud network 107 is the sum of the unit business nodes involved in the electronic invoice transaction, including the invoicing unit terminal 1033, the reimbursement unit terminal 1034, and the exclusive (KA) unit terminal 1035.
  • the invoicing unit terminal 1033 and the reimbursement unit terminal 1034 respectively refer to terminals that need to issue and reimburse electronic invoices, and can also serve as a business node 103 to request transaction block uploading or query from the accounting node 104. Not every terminal with electronic invoice issuance or reimbursement can be used as the business node 103 that sends a request to the accounting node 104.
  • the non-business node enterprise terminal 109 is a terminal that cannot be used as the business node 103 to send such a request to the accounting node 104.
  • the dedicated (KA) unit terminal 1035 is a dedicated terminal set up for some large settlement units that can issue invoices or reimburse.
  • the private cloud network 108 is the sum of the personal business nodes involved in the electronic invoice transaction, such as the mobile phone of the reimbursement person. It includes payment terminal 1036, transfer terminal 1037, and KA unit terminal 1038.
  • the payment terminal 1036 is a terminal used by a payer (reimburser) and capable of serving as a business node, such as a mobile phone of the reimburser.
  • the circulation terminal 1037 is a terminal that can be used as a business node in the role of circulation in the transaction process, such as the mobile phone of the courier (the courier first collects the electronic invoice on behalf of the end user, and then transfers the electronic invoice to the final In the user's mobile terminal).
  • the payment terminal 1033 and the transfer terminal 1034 of the node request the payment terminal 1033 and the transfer terminal 1034 to request the billing node 104 to be connected to the chain.
  • Such a terminal is called a personal terminal 110.
  • the KA unit terminal 1038 is a dedicated terminal set up for personal settlement of some large settlement units.
  • a plurality of sub-blockchain accounting branch networks 1021 are set in the accounting node sub-network 102.
  • Each sub-blockchain accounting branch network 1021 includes a group of accounting nodes 104, which are respectively used for the block of a sub-blockchain.
  • Sub-blockchain refers to the multiple sub-chains that divide the block chain, each sub-chain is recorded separately, but all belong to the entire block chain. In this way, when recording data blocks on the blockchain, you must first select which sub-blockchain to record on, and the sub-blockchain accounting branch network 1021 that is specifically responsible for recording to the sub-blockchain is responsible for the accounting.
  • the account node 104 records.
  • Each accounting node 104 has a permission contract 1041, a cache 1042 and a recorded block 1043 required to complete block generation and consensus. This part is not important to the discussion of this application, so it will not be described.
  • the proxy node 105 includes modules of an authentication service 1051, a certificate cache 1052, a routing service 1053, and a P2P service 1054, which are not important to the discussion in this application, so the description will not be expanded. It is worth mentioning that in the prior art, the identity certificate is issued through the proxy node 105.
  • a certificate authorization system 205 specifically applied to the tax blockchain network 212 is also provided in the embodiment of the application to complete the authorization and issuance of certificates.
  • the taxation blockchain network 212 in FIG. 2 includes the terminal 206 of the State Administration of Taxation, the terminal 207 of the local taxation bureau, and the terminal 211 of the basic unit.
  • the State Administration of Taxation terminal 206 is a terminal used by the State Administration of Taxation to handle transactions related to electronic invoices. It can be used as the business node 103. When there is a transaction, the terminal 206 of the State Administration of Taxation is used to record accounts.
  • the terminal 1031 of the State Administration of Taxation in Figure 1B can also be used as An accounting node, such as an accounting node 104 in FIG. 1B, directly uploads the block to the chain when there is a transaction.
  • the local tax bureau terminal 207 is a terminal used by the local tax bureau to handle transactions related to electronic invoices. It can be used as the business node 103. When there is a transaction, the local tax bureau terminal 1032 can also be used as a business node. An accounting node, such as an accounting node 104 in FIG. 1B, directly uploads the block to the chain when there is a transaction.
  • the base-level unit terminal 211 is a terminal used by the base-level unit to handle transactions related to electronic invoices, and includes a business node unit terminal 208, a non-business node unit terminal 209, and a personal terminal 210.
  • the business node unit terminal 208 is a terminal that can be used as the business node 103 to perform block upload and query to the accounting node 104, such as the billing unit terminal 1033, reimbursement unit terminal 1034, KA unit terminal 1035, and payment terminal 1033 in Figure 1B. , Circulation terminal 1034, KA unit terminal 1035.
  • the non-business node unit terminal 208 is a unit terminal that needs to upload and query blocks to the billing node 104 through the business node 103, and is not capable of uploading and querying, such as the non-business node enterprise terminal 109 in FIG. 1B.
  • the personal terminal 110 is a personal terminal that needs to upload and query blocks to the billing node 104 through the service node 103, and cannot log and query itself, such as the personal terminal 110 in Figure 1B.
  • the certificate authority system 205 in FIG. 2 includes a root certificate authority node 201, a primary certificate authority node 202, a secondary certificate authority node 203, and a basic unit certificate authority node 204.
  • the basic-level unit certificate authority node 204 includes a certificate authority node 2041 of a business node unit, a certificate authority node 2042 of a non-business node unit, and a personal certificate authority node 2043.
  • the root certificate authority node 201 is a node that generates the root certificate, and generates the first-level certificate authority node 202, the second-level certificate authority node 203, and the basic-level unit certificate authority node 204. It is generally only used during initialization.
  • the first-level certificate authorization node 202 is a node that issues an identity certificate of the State Administration of Taxation to the terminal 206 of the State Administration of Taxation. Generally, a batch of SAT identity certificates are issued to the SAT terminal 206 in advance, and then the first level certificate authorization node 202 is not used.
  • the secondary certificate authorization node 203 is a node that issues the local tax bureau's identity certificate to the local tax bureau terminal 207.
  • the second-level certificate authorization node 203 does not directly issue the local tax bureau identity certificate to the local tax bureau terminal 207, but requests issuance through the state tax bureau terminal 206. Since the SAT ID certificate is issued to the SAT terminal 206 in advance, the SAT terminal 206 can request the local tax bureau to issue the local tax bureau ID certificate with the SAT ID certificate to ensure the security of issuing the local tax bureau ID certificate.
  • the local taxation bureau identity certificate is first issued to the SAT terminal 206, and then transferred from the SAT terminal 206 to the local taxation bureau terminal 207.
  • the service node unit certificate authority node 2041 is a node that issues the service node unit identity certificate to the service node unit terminal 208.
  • the non-business node unit certificate authority node 2042 is a node that issues the non-business node unit identity certificate to the non-business node unit terminal 209.
  • the personal certificate authority node 2043 is a node that issues personal identity certificates to the personal terminal 210.
  • the business node unit certificate authority node 2041, the non-business node unit certificate authority node 2042, and the personal certificate authority node 2043 are collectively referred to as the basic unit certificate authority node 204, and issue the basic unit identity certificate to the basic unit terminal 211.
  • the base-level unit certificate authority node 204 does not directly issue the base-level unit identity certificate to the base-level unit terminal 211, but requests issuance through the local tax bureau terminal 207. Since the local taxation bureau's identity certificate is issued to the local taxation bureau terminal 207 in advance, the local taxation bureau terminal 207 can use the local taxation bureau's identity certificate to request the issuance of the basic-level unit identity certificate for its subordinate units to ensure the security of the issuance of the basic-level unit's identity certificate.
  • the identity certificate of the basic unit is first issued to the local taxation bureau terminal 207, and then transferred from the local taxation bureau terminal 207 to the basic unit terminal 211.
  • the following describes the general process of issuing identity certificates for each blockchain node under the blockchain network application scenario used by electronic invoices in conjunction with the interface diagrams of FIGS. 3A to 3K.
  • the first-level certificate authorization node 202 can first issue a batch of SAT identity certificates to the SAT terminal 206. At this time, on the interface of the State Administration of Taxation terminal 206, a prompt interface as shown in FIG. 3A appears, and the detailed information of the issued State Administration of Taxation identity certificate is displayed on the prompt interface.
  • the local tax bureau terminal 207 wants to obtain the local tax bureau identity certificate
  • the local tax bureau terminal 207 sends a registration request to the SAT terminal 206 that has obtained the SAT identity certificate.
  • the SAT terminal 206 The detailed information of the registration request is displayed on the interface of.
  • the SAT terminal 206 uses the SAT identity certificate to request the local tax bureau identity certificate for the local tax bureau terminal 207.
  • the specific process is: the SAT terminal 206 sends the SAT identity certificate it has obtained back to the certificate authorization system 205, as shown in Figure 3C As shown, and the SAT terminal 206 sends a local tax bureau identity certificate issuance request to the certificate authorization system 205.
  • the local tax bureau identity certificate issuance request has a signature with a private key corresponding to the public key in the SAT identity certificate, as shown in FIG. 3D Shown. Then, after the secondary certificate authority node 203 successfully verifies the signature, the local tax bureau identity certificate issued for the local tax bureau terminal 207 is sent to the tax bureau terminal 206. At this time, as shown in FIG. 3E, the interface of the tax bureau terminal 206 is displayed The detailed information of the local tax bureau's identity certificate, so that the SAT terminal 206 forwards the local tax bureau's identity certificate to the local tax bureau terminal 207, as shown in FIG. 3F.
  • the base-level unit terminal 211 wants to obtain the base-level unit identity certificate
  • the base-level unit terminal 211 sends a registration request to the local tax bureau terminal 207 that has obtained the local tax bureau identity certificate.
  • the local tax bureau terminal 207 The detailed information of the registration request is displayed on the interface.
  • the local taxation bureau terminal 207 uses the local taxation bureau identity certificate to request the local taxation bureau’s identity certificate for the basic unit terminal 211.
  • the local taxation bureau terminal 207 sends the local taxation bureau identity certificate it has obtained back to the certificate authorization system 205, as shown in Figure 3H
  • the local tax bureau terminal 207 sends a base-level unit identity certificate issuance request to the certificate authority system 205, and the base-level unit identity certificate issuance request has a signature with a private key corresponding to the public key in the local tax bureau’s identity certificate, as shown in Figure 3I Shown.
  • the basic unit certificate authority node 204 successfully verifies the signature
  • the basic unit identity certificate issued for the basic unit terminal 211 is sent to the local tax bureau terminal 207.
  • the interface of the local tax bureau terminal 207 is displayed The detailed information of the basic-level unit's identity certificate, so that the local tax bureau terminal 207 can forward the basic-level unit's identity certificate to the basic-level unit terminal 211, as shown in FIG. 3K.
  • Fig. 5 shows a flowchart of a method for issuing identity certificates for blockchain nodes in a tax blockchain network according to an embodiment of the present application.
  • the method is executed by the certificate authority system 205. As shown in Figure 5, the method includes:
  • Step 310 The certificate authorization system 205 issues the SAT identity certificate to the SAT terminal through the first-level certificate authorization node;
  • Step 320 The certificate authorization system 205 receives a local tax bureau identity certificate issuance request using the SAT identity certificate from the SAT terminal.
  • the local tax bureau identity certificate issuance request is in response to the registration sent from the local tax bureau terminal to the SAT terminal. Generated by request
  • Step 330 The certificate authorization system 205 issues the local tax bureau identity certificate to the SAT terminal through the secondary certificate authorization node, so that the SAT terminal forwards the local tax bureau identity certificate to the local tax bureau terminal;
  • Step 340 The certificate authorization system 205 receives a request for issuance of a basic-level unit's identity certificate using the local tax bureau's identity certificate from a local tax bureau terminal.
  • the identity certificate is generated by the registration request sent by the local tax bureau terminal;
  • Step 350 The certificate authorization system 205 issues a basic unit identity certificate to the local tax bureau terminal through the basic unit certificate authorization node, so that the local tax bureau terminal forwards the basic unit identity certificate to the basic unit terminal.
  • the method includes the following preliminary steps:
  • Step 302 The certificate authority system 205 generates the root certificate authority node
  • Step 304 The certificate authority system 205 generates a root certificate through the root certificate authority node;
  • Step 306 The certificate authority system 205 generates the first-level certificate authority node, the second-level certificate authority node, and the basic-level unit certificate authority node based on the root certificate.
  • the root certificate authority node is a node that uniformly initializes and authorizes all other certificate authority nodes in the certificate authority system 205. In other words, all nodes in the certificate authority system 205 are not generated at the same time. First generate an initial root certificate authority node, which is trusted. Then, the credibility of other nodes is guaranteed by the certificate.
  • a root certificate is a certificate issued by a root certificate authority node to ensure the legitimacy of subsequent authorized nodes.
  • the root certificate contains a root public key, and the root private key is generated simultaneously with the root public key.
  • step 306 may include the following process performed by the root certificate authority node:
  • the certificate authority system 205 generates the empty node of the first-level certificate authority node, the empty node of the second-level certificate authority node, and the empty node of the basic unit certificate authority node;
  • the certificate authority system 205 issues the root certificate and the root private key to the empty node of the primary certificate authority node, the empty node of the secondary certificate authority node, and the empty node of the basic unit certificate authority node;
  • the certificate authority system 205 receives the empty node of the first-level certificate authority node, or the empty node of the second-level certificate authority node, or the empty node of the basic-level unit certificate authority node, and uses the root certificate to perform the first-level certificate authority node certificate
  • the issuance request of the certificate of the secondary certificate authority, or the issuance request of the certificate of the basic unit certificate authority, the issuance request includes a signature performed with the root private key;
  • the certificate authority system 205 is an empty node of the first level certificate authority node, or the empty node of the second level certificate authority node, or the base unit certificate authority
  • the empty node of the node generates the public key and private key of the primary certificate authority node, or the secondary certificate authority node, or the basic unit certificate authority node, and puts the public key in the primary certificate authority node certificate, or The second-level certificate authority node certificate, or the base-level unit certificate authority node certificate;
  • the certificate authority system 205 combines the first-level certificate authority node certificate, or the second-level certificate authority node certificate, or the basic-level unit certificate authority node certificate, together with the private key of the first-level certificate authority node, or the second-level certificate
  • the private key of the authorized node or the private key of the certificate authority node of the basic unit is issued to the empty node of the first-level certificate authority node, or the empty node of the second-level certificate authority node, or the empty node of the certificate authority node of the basic unit node.
  • An empty node refers to a node that has a hardware carrier of a node, but does not have the corresponding work and therefore cannot work normally.
  • the empty node of the first-level certificate authority node, the empty node of the second-level certificate authority node, and the empty node of the basic-level unit certificate authority node mean that these nodes only have physical carriers, and because they are not issued certificates, they are not It has the authority to issue the identity certificate of the State Administration of Taxation, the identity certificate of the local taxation bureau, and the identity certificate of the basic unit.
  • the root certificate contains the root public key, and the root public key corresponds to the root private key.
  • the root certificate represents that they have the right to request the certificates of the primary certificate authority node, the secondary certificate authority node, and the certificate authority node of the basic unit.
  • the root authority node verifies the signature with the public key in the root certificate received in advance. If the verification succeeds, it means that the empty node is the empty node that has received its own authorized root certificate, and can issue its own certificates for the first-level certificate authority node, the second-level certificate authority node, and the basic-level unit certificate authority node.
  • the root authorized node is first The empty node of the primary certificate authority node, or the empty node of the secondary certificate authority node, or the empty node of the basic unit certificate authority node generates the public key and private key of the primary certificate authority node, or the secondary certificate authority node.
  • the public key and private key of the certificate authority node, or the public key and private key of the base-level unit certificate authority node and then put the public key into the first-level certificate authority node certificate, or the second-level certificate authority node certificate, Or in the certificate authority node certificate of the basic unit, the first-level certificate authority node certificate, or the second-level certificate authority node certificate, or the basic-level unit certificate authority node certificate together with the private key of the first-level certificate authority node, or The private key of the
  • the empty node obtains the certificate, it is no longer an empty node. It has the authority of the first-level certificate authority node, or the second-level certificate authority node, or the basic-level unit certificate authority node to issue identity certificates normally. The authority is granted by the first-level certificate authority node certificate, or the second-level certificate authority node certificate, or the basic-level unit certificate authority node certificate.
  • the advantage of the above-mentioned embodiment is that the generation of the first-level certificate authority node, or the second-level certificate authority node, or the base-level unit certificate authority node itself also depends on the authorization of the root certificate, which improves the authorization of each certificate authority system.
  • the rationality of the authority source of the node makes the authority source of the authorized node have rules to follow, makes the authority source of the authorized node also have a legal basis, and improves the reliability of the certificate authorization of the certificate authority system.
  • step 310 the certificate authorization system 205 issues an identity certificate of the State Administration of Taxation to the terminal of the State Administration of Taxation through the first-level certificate authorization node.
  • the steps 310 includes the following processes performed by the first-level certificate authority node:
  • the certificate authorization system 205 generates the public key and private key of the SAT terminal through the first-level certificate authorization node;
  • the certificate authorization system 205 generates a SAT identity certificate for the SAT terminal, and the SAT identity certificate contains the public key of the SAT terminal;
  • the certificate authorization system 205 sends the SAT identity certificate and the private key of the SAT terminal to the SAT terminal.
  • the first-level certificate authority node may adopt a predetermined public-private key pair generation algorithm to generate the public key and private key pair, which is not the focus of this application, so it will not be repeated.
  • the first-level certificate authority node can use the predetermined method of generating the identity certificate to generate the identity certificate of the State Administration of Taxation, so it will not be repeated.
  • the first-level certificate authorization node sends the identity certificate of the State Administration of Taxation and the private key of the terminal of the State Administration of Taxation to the terminal of the State Administration of Taxation.
  • the function of the private key of the terminal of the State Administration of Taxation is that when the terminal of the State Administration of Taxation needs to communicate with other blockchain nodes in the future, the private key can be used to sign, and the public key in the identity certificate of the State Administration of Taxation can be used to successfully verify The signature.
  • step 320 a request for issuance of a local tax bureau identity certificate using the SAT identity certificate is received from the SAT terminal, and the local tax bureau identity certificate issuance request is generated in response to a registration request from the local tax bureau terminal to the SAT terminal .
  • step 320 includes the following process performed by the secondary certificate authority node:
  • the local tax bureau identity certificate issuance request includes the registration information of the local tax bureau and the signature of the registration information of the local tax bureau with the private key of the tax bureau ;
  • the SAT terminal After the SAT terminal obtains the SAT identity certificate, the SAT terminal has the authority to apply for the local tax bureau identity certificate on behalf of its subordinate local tax bureau terminal. If the local taxation bureau wants to obtain the local taxation bureau's identity certificate, it must submit a registration request to the SAT terminal.
  • the registration request includes the information required to register to the tax blockchain network.
  • the SAT terminal After receiving the registration request, the SAT terminal sends its SAT identity certificate to the secondary certificate authority node, so that the secondary certificate authority node obtains the public key of the SAT terminal in the certificate.
  • the terminal of the State Administration of Taxation uses the private key of the State Administration of Taxation to sign the registration information of the local taxation bureau, and the registration information is placed in the local taxation bureau's identity certificate issuance request and sent to the secondary certificate authority node.
  • the second-level certificate authority node can then use the public key of the State Administration of Taxation in the identity certificate of the State Administration of Taxation to verify the signature in the request for issuance of the identity certificate of the State Administration of Taxation. Identity certificate.
  • the advantage of the above process is that by using the private key of the State Administration of Taxation terminal to encrypt the registration information and verifying with the public key in the State Administration of Taxation’s identity certificate, it is ensured that the legal State Administration of Taxation terminal requests the issuance of the local taxation bureau identity for its subordinate local taxation bureau terminal. Certificates to improve the security of the issuance of identity certificates by the Local Taxation Bureau.
  • step 330 the certificate authorization system 205 issues the local tax bureau identity certificate to the SAT terminal through the secondary certificate authorization node, so that the SAT terminal forwards the local tax bureau identity certificate to the local tax bureau terminal.
  • step 330 includes the following process performed by the secondary certificate authority node:
  • the certificate authority system 205 authenticates the registration information through the secondary certificate authority node
  • the certificate authorization system 205 If the authentication is passed, the certificate authorization system 205 generates the public key and private key of the local tax bureau terminal for the local tax bureau terminal;
  • the certificate authorization system 205 generates a local tax bureau identity certificate for the local tax bureau terminal, where the local tax bureau identity certificate contains the public key of the local tax bureau terminal;
  • the certificate authorization system 205 sends the local tax bureau identity certificate and the private key of the local tax bureau terminal to the SAT terminal, so that the SAT terminal forwards the local tax bureau identity certificate and the local tax bureau to the local tax bureau terminal.
  • the private key of the local taxation bureau terminal, the local taxation bureau identity certificate and the private key of the local taxation bureau terminal are used for the local taxation bureau terminal to communicate with other blockchain nodes in the taxation blockchain network.
  • authenticating the registration information includes checking whether the registration information meets the required legal requirements. You can write a script to check whether the legal requirements are met in advance according to the prescribed legal requirements. Execute this script during authentication to achieve authentication.
  • the process of generating and issuing the public and private key of the local taxation bureau terminal and the local taxation bureau identity certificate is similar to the process of generating and issuing the public and private key of the SAT terminal and the SAT identity certificate in the foregoing embodiment, so it will not be repeated.
  • the above method of generating public and private keys and local tax bureau identity certificate, and issuing the local tax bureau identity certificate and private key together provides a guarantee for the verification of identity when the local tax bureau terminal communicates with other blockchain nodes, and improves the local tax bureau terminal’s connection with other blockchain nodes.
  • the security of blockchain node communication is not limited to, but not limited to, but not limited to, but not limited to, but not limited to, but not limited to, but not limited to the local tax bureau identity certificate, and issuing the local tax bureau identity certificate and private key together.
  • the communication between the local taxation bureau terminal and other blockchain nodes in the taxation blockchain network includes the following processes performed by the local taxation bureau terminal:
  • the local tax bureau terminal sends the local tax bureau identity certificate to the other blockchain nodes;
  • the content to be sent by the local tax bureau terminal to the other blockchain nodes is signed with the private key of the local tax bureau terminal;
  • the local tax bureau terminal sends the content and the signature to the other blockchain nodes, so that the other blockchain nodes use the public key in the local tax bureau's identity certificate to verify the signature.
  • Other blockchain nodes refer to any node in the blockchain network except the local tax bureau terminal.
  • the local taxation bureau terminal will send the transaction information for issuing electronic invoices to the enterprise on the chain
  • the local taxation bureau terminal will send the transaction information to the bookkeeping node through the agent node to upload the chain.
  • the other blockchain nodes here refer to the agent node.
  • the content sent to the other blockchain nodes is the transaction information.
  • the other blockchain nodes here refer to the terminal of the State Taxation Administration
  • the content to be sent to the other blockchain nodes is the request for querying statistical data. .
  • the local tax bureau terminal first sends the local tax bureau identity certificate to the other blockchain node, so that the other blockchain node obtains the public key of the local tax bureau terminal in the certificate.
  • the local tax bureau terminal signs the content to be sent to the other blockchain nodes with the private key of the local tax bureau terminal, and sends the content and the signature to the other blockchain nodes.
  • the other blockchain nodes can use the public key in the identity certificate of the local tax bureau to verify the signature. In this way, it is ensured that when the local tax bureau terminal and other blockchain nodes in the blockchain network transfer information, the identities of both parties are verifiable, and the security of communication in the blockchain network is improved.
  • the certificate authorization system 205 receives a basic-level unit identity certificate issuance request using the local tax bureau’s identity certificate from a local tax bureau terminal.
  • the local tax bureau's identity certificate is generated by the registration request of the local tax bureau terminal.
  • step 340 includes the following process performed by the base-level unit certificate authority node:
  • the basic-level unit identity certificate issuance request includes the registration information of the basic unit and the signature of the registration information of the basic unit with the private key of the local tax bureau ;
  • step 320 The specific implementation and benefits of the above process are similar to the specific implementation and benefits of step 320, except that the receipt is received from the local tax bureau terminal, using the local tax bureau’s identity certificate to issue the identity certificate of the basic unit, not from the taxation bureau.
  • the request for issuing the local tax bureau's identity certificate using the said SAT's identity certificate on the terminal of the State Administration of Taxation will not be further described.
  • step 350 the certificate authority system 205 issues the basic unit identity certificate to the local tax bureau terminal through the basic unit certificate authorization node, so that the local tax bureau terminal forwards the basic unit identity certificate to the basic unit terminal.
  • step 350 includes the following process performed by the base-level unit certificate authority node:
  • the certificate authority system 205 authenticates the registration information of the basic unit through the certificate authority node of the basic unit;
  • the certificate authority system 205 If the authentication is passed, the certificate authority system 205 generates the public key and the private key of the base-level unit terminal for the base-level unit terminal;
  • the certificate authority system 205 generates a basic-level unit identity certificate for the basic-level unit terminal, where the basic-level unit identity certificate contains the public key of the basic-level unit terminal;
  • the certificate authorization system 205 sends the basic unit identity certificate and the private key of the basic unit terminal to the local tax bureau terminal, so that the local tax bureau terminal forwards the basic unit identity certificate and the basic unit terminal to the basic unit terminal.
  • the private key of the unit terminal, the base unit identity certificate and the private key of the base unit terminal are used for the base unit terminal to communicate with other blockchain nodes in the tax blockchain network.
  • step 330 The specific implementation and benefits of this process are similar to the specific implementation and benefits of step 330, except that the basic-level unit certificate authorization node is used to issue the basic-level unit identity certificate to the local tax bureau terminal so that the local tax bureau terminal can The basic-level unit terminal forwards, instead of issuing the local tax bureau identity certificate to the SAT terminal through the secondary certificate authorization node, so that the SAT terminal forwards the local tax bureau terminal to the local tax bureau terminal, so it is not repeated.
  • the communication between the basic unit terminal and other blockchain nodes in the taxation blockchain network includes:
  • the content to be sent by the basic unit terminal to the other blockchain nodes is signed with the private key of the basic unit terminal;
  • the base unit terminal sends the content and the signature to the other blockchain nodes, so that the other blockchain nodes use the public key in the base unit identity certificate to verify the signature.
  • other blockchain nodes here are different.
  • the basic unit is an invoicing unit
  • the information of the issued electronic invoice needs to be sent to the accounting node through the proxy node
  • the other blockchain nodes refer to the proxy node
  • the The content sent by the node refers to the information of the electronic invoice issued.
  • This process is similar to the process and benefits of the aforementioned local taxation bureau terminal communicating with other blockchain nodes in the taxation blockchain network. In order to save space, it will not be repeated.
  • the basic unit identity certificate includes a business node unit identity certificate, a non-business node unit identity certificate, and a personal identity certificate.
  • step 350 "issuing the basic unit identity certificate to the local tax bureau terminal so that the local tax bureau terminal forwards the basic unit identity certificate to the basic unit terminal" includes:
  • the business node unit identity certificate is issued to the local tax bureau terminal so that the local tax bureau terminal forwards the business node unit identity certificate to the business node unit terminal, so
  • the business node unit identity certificate is used for the communication of information on the chain between the business node and the agent node;
  • the base-level unit identity certificate issuance request is for a non-business node unit, issue the non-business node unit identity certificate to the local tax bureau terminal, so that the local tax bureau terminal forwards the non-business node unit to the non-business node unit terminal
  • a personal identity certificate is issued to the local taxation bureau terminal so that the local taxation bureau terminal forwards the personal identity certificate to the personal terminal, and the personal identity certificate is used in the individual Transfer of the basic information of the uplink information between the terminal and the business node unit terminal.
  • the base-level unit identity certificate issuance request is generated by the local tax bureau terminal in response to the registration request of the business node unit terminal, it is considered that the base-level unit identity certificate issuance request is for the business node unit. If the base-level unit identity certificate issuance request is generated by the local tax bureau terminal in response to the registration request of the non-business node unit terminal, it is considered that the base-level unit identity certificate issuance request is for the non-business node unit. If the basic-level unit identity certificate issuance request is generated by the local taxation bureau terminal in response to the registration request of the individual terminal, it is considered that the basic-level unit identity certificate issuance request is for an individual.
  • On-chain information refers to the information to be on-chain that the business node forwards to the billing node via the proxy node, such as information on issuing electronic invoices after the local tax bureau terminal issues electronic invoices to enterprises, and billing information after business nodes issue electronic invoices.
  • the basic information of the information on the chain refers to the information that is not sent by the business node to the agent node to be on the chain, but is the information that is the basis of the information to be on the chain.
  • the billing information can only be used as the basic information of the on-chain information and sent to a unit that can be used as a business node to be generated by the unit
  • the information on the chain is sent to the agent node.
  • the use of the business node unit identity certificate for the communication of on-chain information between the business node and the proxy node means that when the business node sends uplink information to the proxy node, the business node unit identity certificate is first sent To the proxy node, make the proxy node obtain the public key in the certificate; then, the business node needs to use the private key corresponding to the public key in the business node unit identity certificate to sign the information on the chain, and the signature and the information on the chain Send them to the proxy node together; after receiving the two, the proxy node verifies the signature with the public key in the certificate; if the verification is passed, it can forward the chaining information to the accounting node for chaining.
  • the non-business node unit identity certificate is used to transfer the basic information of the uplink information between the non-business node unit terminal and the service node unit terminal, which is similar to the above process, except that the information transmitted is not the uplink information. It is the basic information of the uplink information, and it is transferred between the non-business node unit terminal and the business node unit terminal. In order to save space, it is not repeated.
  • the personal identity certificate is used to transfer the basic information of the on-chain information between the personal terminal and the business node unit terminal, and is similar to the above process, so it will not be repeated.
  • the terminal of the State Administration of Taxation the terminal of the local taxation bureau, and the terminal of the grassroots unit are issued with their own identity certificates, so that they can verify their identity to the counterparty in the communication of the blockchain network, but as a blockchain network communication
  • the communication of the agent node should also be considered, and the corresponding communication certificate is also required to ensure the security of its communication.
  • the method further includes:
  • Step 380 The certificate authority system 205 issues the agent node startup identity certificate to the agent node through the first-level certificate authority node;
  • Step 390 The certificate authority system 205 receives a request for issuance of an agent node communication identity certificate from the agent node using the agent node's initiating identity certificate;
  • Step 395 The certificate authority system 205 issues a proxy node communication identity certificate to the proxy node through the secondary certificate authority node, and the proxy node communication identity certificate is used to communicate with the service node.
  • the situation of the proxy node is relatively special. It does not have an upper-level node to apply for an identity certificate for it. Therefore, it can only issue a batch of proxy node startup identity certificates to the proxy node through the first-level certificate authority node in advance to ensure subsequent proxy The node initiates the issuance of the identity certificate.
  • the proxy node startup identity certificate is a certificate that indicates that the proxy node has obtained the right to apply for the proxy node communication identity certificate. It contains the proxy node startup public key, and its corresponding is the proxy node startup private key.
  • the proxy node startup public and private key is a public and private key used to verify whether the proxy node has the right to apply for the proxy node communication identity certificate.
  • the proxy node communication identity certificate is a certificate that indicates that the proxy node has the right to communicate with the business nodes in the blockchain network. It contains the proxy node communication public key, and its corresponding is the proxy node communication private key.
  • the communication public and private key of the agent node is the public and private key used to verify the identity of the business node in the communication of the business node in the blockchain network.
  • step 380 includes the following process performed by the first-level certificate authority node:
  • the certificate authority system 205 generates the startup public key and the startup private key of the agent node through the first-level certificate authority node;
  • the certificate authority system 205 generates an agent node startup identity certificate for the agent node, and the agent node identity certificate contains the agent node's startup public key;
  • the certificate authority system 205 sends the agent node startup identity certificate and the agent node startup private key to the agent node.
  • step 310 This process is similar to the process of step 310, except that the agent node startup identity certificate is issued here, not the identity certificate of the State Administration of Taxation, so it is not repeated here.
  • step 390 includes the following process performed by the secondary certificate authority node:
  • the proxy node communication identity certificate issuance request includes the registration information of the proxy node and the registration information of the proxy node with the proxy node's startup private key Signature
  • the signature in the request for issuing the communication identity certificate of the proxy node is verified by using the start public key of the proxy node in the proxy node start identity certificate.
  • step 320 This process is similar to the process of step 320, except that what is received here is a request for issuance of an agent node communication identity certificate from the agent node using the agent node’s initiating identity certificate, rather than a terminal from the State Administration of Taxation using the tax
  • the local tax bureau’s identity certificate issuance request made by the State Administration’s identity certificate is not repeated here.
  • step 395 includes the following process performed by the secondary certificate authority node:
  • the certificate authority system 205 authenticates the registration information of the proxy node through the secondary certificate authority node;
  • the certificate authority system 205 If the authentication is passed, the certificate authority system 205 generates the communication public key and the communication private key of the agent node for the agent node;
  • the certificate authority system 205 generates an agent node communication identity certificate for the agent node, and the agent node communication identity certificate contains the communication public key of the agent node;
  • the certificate authority system 205 sends the proxy node’s communication identity certificate and the proxy node’s communication private key to the proxy node, and the proxy node’s communication identity certificate and the proxy node’s communication private key are used for the proxy node and Business node communication.
  • This process is similar to the process of step 330, except that the communication identity certificate of the agent node is issued here instead of the identity certificate of the local taxation bureau, so it will not be repeated.
  • the communication between the agent node and the service node includes the following process performed by the agent node:
  • the content to be sent by the proxy node to the service node is signed with the communication private key of the proxy node
  • the proxy node sends the content and the signature together to the service node, so that the service node verifies the signature with the communication public key in the communication identity certificate of the proxy node.
  • This process is similar to the communication process between the local tax bureau terminal and other blockchain nodes in the blockchain network, so it will not be repeated.
  • the terminal of the State Administration of Taxation has the highest authority. It can not only request the issuance of the local tax bureau's identity certificate for the local tax bureau's terminal, but also request the basic unit's identity certificate for the terminal of the basic unit.
  • the method further includes the following process performed by the base-level unit certificate authority node:
  • Step 360 The certificate authorization system 205 receives a request for issuance of an identity certificate of a basic-level unit using the identity certificate of the State Administration of Taxation from a terminal of the State Administration of Taxation. Generated by the registration request sent by the terminal;
  • Step 370 The certificate authorization system 205 issues a basic unit identity certificate to the SAT terminal through the basic unit certificate authorization node, so that the SAT terminal forwards the basic unit terminal to the basic unit terminal via the local tax bureau terminal.
  • Unit identity certificate
  • the basic-level unit terminal when the basic-level unit terminal needs to obtain the basic-level unit identity certificate, the basic-level unit terminal sends a registration request to the local tax bureau terminal, and the local tax bureau terminal sends the registration request to the SAT terminal, and the SAT terminal is the basic unit
  • the terminal issues a request for the issuance of the identity certificate of the basic unit.
  • steps 360 and 370 The execution process of steps 360 and 370 is similar to that of steps 320 and 330, except that in steps 360 and 370, the base-level unit certificate authority node issues the base-level unit identity certificate instead of the local tax bureau identity certificate issued by the secondary certificate authority node , And after receiving the certificate, the terminal of the State Administration of Taxation will forward it to the terminal of the grassroots unit via the terminal of the local tax bureau, so I won’t repeat it.
  • the advantage of this embodiment is that it realizes that the identity certificate of the grassroots unit can be issued by the terminal of tax authorities at all levels, which improves the flexibility of certificate issuance.
  • the root certificate authority node 201, the first level certificate authority node 202, the second level certificate authority node 203, and the basic unit certificate authority node 204 in the above embodiment may be separate hardware devices, or may be a module running on the hardware device. Multiple nodes can exist on a hardware device at the same time.
  • the certificate authorization system 205 includes a primary server 2051 and a secondary server 2052.
  • the first-level server 2051 is a server that is put into use during the initial setting and is basically stopped during the actual operation of the certificate authority system 205. It includes a root certificate authority node 201 and a first-level certificate authority node 202 operating as modules. Since the root certificate authority node 201 is only used to generate the first level certificate authority node 202, the second level certificate authority node 203, and the basic unit certificate authority node 204, it is only used during the initial operation of the certificate authority system 205, and due to the number of SAT terminals 206 Limited, therefore, it is only necessary for the first level certificate authority node 202 to issue a batch of SAT identity certificates to the SAT terminal 206 at the initial stage.
  • the level 1 server 2051 only includes the root certificate authority node 201 and the first level certificate authority node In the case of 202, it only needs to be used in the initialization process and will not be used in subsequent operations.
  • the first-level server 2051 also includes other lower-level certificate authorization nodes.
  • the certificate authorization system 205 when operating normally, it can also be used as a system for certificate authorization for local tax bureau terminals and basic unit terminals. As shown in Fig. 4, it may include a secondary certificate authority node 203 and a business node unit certificate authority node 2041.
  • the secondary server 2052 is the main server that performs certificate authorization for the local tax bureau terminal and the basic unit terminal when the certificate authorization system 205 is running normally.
  • Each secondary server 2051 may include a secondary certificate authority node 203 and a basic unit certificate authority node 204. As shown in FIG. 4, each secondary server 2052 includes a secondary certificate authority node 203, a business node unit certificate authority node 2041, a non-business node unit certificate authority node 2042, and a personal certificate authority node 2043.
  • the advantage of the above-mentioned embodiment is that the primary server 2051 and secondary server 2052 operate separately, making it possible that the primary server 2051 does not work when the certificate authorization system 205 is running normally, reducing the power consumption of the entire certificate authorization system 205, and at the same time, It is possible for the first-level server 2051 to be installed in a place far away from various units and tax bureaus, and the overall utilization efficiency of the system is provided.
  • each secondary server 2052 since there are multiple secondary servers 2052, it provides a basis for realizing the reasonable distribution of authorization tasks among different secondary certificate authority nodes and basic unit certificate authority nodes. Specifically, the processing load of each secondary certificate authority node and the certificate authority node of the basic unit can be balanced.
  • the certificate authority system 205 further includes a scheduling node 297.
  • the scheduling node 297 is a node that allocates the identity certificate issuance request to one of the one or more basic unit certificate authority nodes among the plurality of secondary certificate authority nodes.
  • the method further includes:
  • Step 325 The certificate authority system 205 dispatches the local tax bureau identity certificate issuance request to the secondary certificate authority node in one of the plurality of secondary servers through the dispatch node.
  • scheduling the local tax bureau's identity certificate issuance request to the secondary certificate authority node in one of the plurality of secondary servers includes:
  • each secondary certificate authority node determines the target secondary certificate authority node to be scheduled
  • to obtain the number of identity certificate issuance requests being processed by the second-level certificate authority node in the plurality of second-level servers may be adopted by the proxy node to actively send to the second-level certificate authority node in the plurality of second-level servers
  • each secondary certificate authority node returns a response to the number of identity certificate issuance requests being processed to the agent node.
  • obtaining the number of identity certificate issuance requests being processed by the secondary certificate authority node in the plurality of secondary servers may take the form of setting a counter at each secondary certificate authority node.
  • a counter is set in the second-level certificate authority node. The counter is initially set to 0.
  • the secondary certificate authority node receives an identity certificate issuance request (including the local tax bureau's identity certificate issuance request and the communication identity certificate issuance request of the agent node)
  • the counter is incremented by 1.
  • the secondary certificate authority node completes the issuance of an identity certificate (including the identity certificate of the local tax bureau and the identity certificate for communicating with the agent node)
  • the counter is decremented by one. In this way, the value of the counter reflects the number of identity certificate issuance requests currently being processed by the secondary certificate authority node.
  • the proxy node can directly read the number of identity certificate issuance requests being processed by the secondary certificate authority node corresponding to the counter from the counter.
  • determining the target secondary certificate authority node to be scheduled according to the number of acquired identity certificate issuance requests being processed by each secondary certificate authority node includes:
  • the second-level certificate authority node that has obtained the smallest number of identity certificate issuance requests being processed is used as the scheduled target second-level certificate authority node.
  • the new local tax bureau's identity certificate issuance request is allocated to the secondary certificate authority node with the least number of identity certificate issuance requests being processed, thereby balancing the number of identity certificate issuance requests being processed by each secondary certificate authority node , And the number of identity certificate issuance requests being processed represents the load status of each secondary certificate authority node. Therefore, this embodiment balances the processing load of each secondary certificate authority node.
  • each second-level certificate authority node as the scheduled target second-level certificate authority node, it includes:
  • Any one of the secondary certificate authority nodes whose number of acquired identity certificate issuance requests being processed is lower than the predetermined issuance request number threshold is selected as the scheduled target secondary certificate authority node.
  • the number of identity certificate issuance requests being processed is lower than the predetermined issuance request number threshold, and the load is relatively light.
  • One of them can be randomly selected as the scheduled target secondary certificate authority node.
  • the local tax bureau identity certificate issuance request can be allocated to the target secondary certificate authority node for processing.
  • the method further includes:
  • Step 345 The certificate authority system 205 schedules the base-level unit identity certificate issuance request to the base-level unit certificate authority node among one of the plurality of base-level unit certificate authority nodes through the scheduling node.
  • scheduling the basic-level unit identity certificate issuance request to the basic-level unit certificate authority node in one of the plurality of secondary servers includes:
  • each basic-level unit certificate authority node determines the target basic-level unit certificate authority node to be dispatched
  • the foregoing process is similar to the foregoing process of scheduling the local tax bureau's identity certificate issuance request to the second-level certificate authority node in one of the plurality of second-level servers through the scheduling node, except that the basic unit
  • the identity certificate issuance request is dispatched to the certificate authority node of the basic unit, instead of dispatching the local tax bureau's identity certificate issuance request to the secondary certificate authority node. In order to save space, the details are not repeated.
  • each secondary server 2052 also includes a local database 299 for storing certificates issued by each certificate authority node (secondary certificate authority node 203, basic unit certificate authority node 204) in the secondary server 2052 Identity certificates (identity certificates of the local taxation bureau, identity certificates of institutional units, etc.), and the issuance request for each identity certificate.
  • the issuance request for the identity certificate refers to the issuance request of the identity certificate in response to the issuance of the identity certificate. For example, if a local tax bureau identity certificate issuance request from the State Administration of Taxation terminal is received, and the secondary certificate authority node 203 issues a local tax bureau identity certificate, the local tax bureau identity certificate issuance request is a request for issuance of a local tax bureau identity certificate.
  • step 330 the method further includes:
  • the certificate authorization system 205 stores the issued local tax bureau identity certificate and the local tax bureau identity certificate issuance request for the local tax bureau identity certificate in the local database of the secondary server where the secondary certificate authority node is located.
  • the method further includes:
  • the certificate authority system 205 stores the issued basic unit identity certificate and the basic unit identity certificate issuance request for the basic unit identity certificate in the local database of the secondary server where the basic unit certificate authority node is located;
  • the data stored in the local database refers to the various levels of identity certificates stored on the local server and the issuance request for the identity certificate, including the above-mentioned local tax bureau identity certificate and the local tax bureau identity certificate issuance request for the local tax bureau identity certificate, and the aforementioned The issued basic-level unit's identity certificate and the basic-level unit's identity certificate issuance request.
  • Periodically synchronizing the data stored in the local database with the local databases of other secondary servers of the certificate authority system refers to sending the data stored in the local database to the other secondary servers of the certificate authority system every predetermined time period, so that Saved by other secondary servers.
  • each secondary server not only stores the identity certificate issued by itself and the targeted issuance request, but also the identity certificate issued by other secondary servers in the certificate authority system and the targeted issuance request.
  • the advantage of this is that the public and private keys in the identity certificates issued by the secondary servers in the certificate authority system will not be repeated.
  • each secondary server When each secondary server generates the public and private keys for the certificate, it must refer to the stored, all two in the certificate authority system.
  • the public and private keys in the identity certificate issued by the secondary server make the generated public and private keys different from the public and private keys stored in the identity certificates issued by all secondary servers in the certificate authority system, thereby improving the authority of the issued identity certificate.
  • the certificate authorization system 205 further includes a backup storage system 298.
  • the backup storage system is a backup storage space set up to prevent the data stored locally in each secondary server 2052 from being lost and unable to be retrieved.
  • the identity certificate generated by each secondary server 2052 and the issuance request for the identity certificate are not only stored in the local database 299 of each secondary server 2052, but also backed up in the backup storage system 298. The advantage of this is that once the data in the local database 299 is lost, the data can be retrieved from the backup storage system 298.
  • the method also includes:
  • the certificate authorization system 205 backs up the issued local tax bureau identity certificate and the local tax bureau identity certificate issuance request for the local tax bureau identity certificate to the backup storage area corresponding to the secondary server in the backup storage system.
  • the backup storage area refers to the area set for each secondary server in the backup storage system and used to store the data of the secondary server. For example, in the example in FIG. 4, there are three secondary servers 2052, and correspondingly, three corresponding backup storage areas are set in the backup storage system.
  • the method After storing the issued basic-level unit identity certificate and the basic-level unit identity certificate issuance request for which the basic-level unit identity certificate is directed to the local database of the secondary server where the basic-level unit certificate authority node is located, the method also includes:
  • the certificate authority system 205 backs up the issued primary-level unit identity certificate and the primary-level unit identity certificate issuance request for which the primary-level unit identity certificate is aimed, and stores them in the backup storage area corresponding to the secondary server in the backup storage system;
  • the certificate authorization system 205 allocates the local tax bureau's identity certificate issuance request and the basic unit identity certificate issuance request that the secondary server has not served up to other secondary servers through the scheduling node;
  • the certificate authority system 205 restores data from the backup storage area corresponding to the secondary server in the backup storage system to the local database of the secondary server in response to the recovery of the secondary server failure.
  • the failure of the secondary server can be detected by the scheduling node 297.
  • the detection method may include: the scheduling node 297 periodically sends a monitoring signal to each secondary server 299, and each secondary server 299 makes a monitoring response; if the monitoring signal is sent to the secondary server 299, the monitoring signal of the secondary server 299 is not received If it responds, it is considered that the secondary server 299 is faulty.
  • the local tax bureau's identity certificate issuance request and the basic-level unit identity certificate issuance request that the secondary server has not yet served are also obtained through the dispatch node 297.
  • a certificate issuance request list is set for each secondary server 299, and the certificate issuance requests allocated to the secondary server 299 are placed in the list.
  • Each certificate issuance request has two states, namely, unprocessed and processed.
  • the dispatching node 297 Before the dispatching node 297 assigns the local tax bureau’s identity certificate issuance request and the primary unit’s identity certificate issuance request to the secondary server, it records the local tax bureau’s identity certificate issuance request and the primary unit’s identity certificate issuance request in the certificate issuance request list, and The status of the certificate issuance request list is set to unprocessed. After the secondary certificate authority node 203 and the basic unit certificate authority node 204 in the secondary server 299 issue corresponding identity certificates in response to the certificate issuance request, they send a processing completion notification to the scheduling node 297. After receiving the processing completion notification, the scheduling node 297 sets the status of the corresponding certificate issuance request in the list to be processed.
  • the local tax bureau identity certificate issuance request and the basic-level unit identity certificate issuance request that the secondary server has not served up are assigned to other secondary servers through the scheduling node. Similar to the previous embodiment, they can be assigned to the certificates being processed in other secondary servers.
  • Detecting the recovery of the server failure may also adopt the above-mentioned manner of regularly sending monitoring signals. If the scheduling node 297 periodically sends a monitoring signal to the secondary server 2052 and does not receive the monitoring response from the secondary server 2052, it continues to periodically send monitoring information to the secondary server 2052. When receiving the monitoring response from the secondary server 2052, it is considered The secondary server 2052 failed to recover.
  • the data stored in the backup storage area corresponding to the secondary server 2052 in the backup storage system 298 is copied back to the local database of the secondary server 2052.
  • a certificate authorization system for issuing identity certificates for blockchain nodes in a tax blockchain network.
  • the blockchain nodes in the tax blockchain network include the terminal of the State Administration of Taxation, the terminal of the local taxation bureau, and the terminal of the community unit.
  • the certificate authorization system includes:
  • the first-level certificate authorization node 202 which issues the SAT identity certificate to the SAT terminal;
  • the second-level certificate authorization node 203 in response to a request from the State Administration of Taxation terminal for issuing an identity certificate of the local taxation bureau using the identity certificate of the State Administration of Taxation, issues the identity certificate of the local taxation bureau to the State Administration of Taxation terminal so that the SAT terminal can send
  • the local tax bureau terminal forwards the local tax bureau identity certificate, wherein the local tax bureau identity certificate issuance request is generated in response to a registration request sent by the local tax bureau terminal to the state tax bureau terminal;
  • the base-level unit certificate authorization node 204 in response to a base-level unit identity certificate issuance request from the local tax bureau terminal using the local tax bureau’s identity certificate, issues a base-level unit identity certificate to the local tax bureau terminal so that the local tax bureau terminal can send
  • the base-level unit terminal forwards the base-level unit identity certificate, wherein the base-level unit identity certificate issuance request is generated in response to a registration request sent by the base-level unit terminal to the local tax bureau terminal that already has the local tax bureau identity certificate.
  • the certificate authority system further includes a root certificate authority node, where the root certificate authority node is generated before the first level certificate authority node 202 issues the SAT identity certificate to the State Administration of Taxation terminal, and the root certificate
  • the authorization node is used to generate a root certificate, and based on the root certificate, generate the first-level certificate authorization node, the second-level certificate authorization node, and the basic unit certificate authorization node.
  • the certificate authority node 204 of the basic unit includes a certificate authority node of a business node unit, a certificate authority node of a non-business node unit, and a personal certificate authority node.
  • the basic unit terminal includes a business node unit terminal, a non-business node unit terminal, and a personal terminal.
  • the basic-level unit identity certificate includes a business node unit identity certificate, a non-business node unit identity certificate, and a personal identity certificate.
  • the blockchain nodes in the tax blockchain network also include agent nodes.
  • the certificate authority node of the business node unit is used to: if the basic-level unit identity certificate issuance request is for the business node unit, issue the business node unit identity certificate to the local tax bureau terminal so that the local tax bureau terminal can
  • the service node unit terminal forwards the service node unit identity certificate, and the service node unit identity certificate is used for the communication of on-chain information between the service node and the proxy node.
  • the certificate authority node of the non-business node unit is used to: if the basic-level unit’s identity certificate issuance request is for a non-business node unit, issue the non-business node unit’s identity certificate to the local tax bureau terminal so that the local tax
  • the office terminal forwards the non-business node unit identity certificate to the non-business node unit terminal, and the non-business node unit identity certificate is used for uploading information between the non-business node unit terminal and the service node unit terminal. Transmission of basic information;
  • the individual certificate authority node is used to: if the basic-level unit identity certificate issuance request is for an individual, issue a personal identity certificate to the local taxation bureau terminal, so that the local taxation bureau terminal can forward the local taxation bureau terminal to the personal terminal.
  • the personal identity certificate is used to transfer the basic information of the on-chain information between the personal terminal and the business node unit terminal.
  • the first level certificate authority node 202 is also used to issue the agent node startup identity certificate to the agent node; the second level certificate authority node 203 is also used to: receive information from the agent node that uses the agent node A communication identity certificate issuance request for an agent node to initiate an identity certificate; through the secondary certificate authority node, an agent node communication identity certificate is issued to the agent node, and the agent node communication identity certificate is used to communicate with the service node .
  • the secondary certificate authority node 203 is further configured to:
  • the first level certificate authority node 202 is further used to:
  • the identity certificate of the State Administration of Taxation and the private key of the terminal of the State Administration of Taxation are sent to the terminal of the State Administration of Taxation.
  • the secondary certificate authority node 203 is further used to:
  • the local tax bureau identity certificate issuance request includes the registration information of the local tax bureau and the signature of the registration information of the local tax bureau with the private key of the tax bureau ;
  • the secondary certificate authority node 203 is further used to:
  • the local tax bureau identity certificate and the private key of the local tax bureau terminal are used for the local tax bureau terminal to communicate with other blockchain nodes in the tax blockchain network.
  • the certificate authority node 204 of the basic unit is further used to:
  • the basic-level unit identity certificate issuance request includes the registration information of the basic unit and the signature of the registration information of the basic unit with the private key of the local tax bureau ;
  • the certificate authority node 204 of the basic unit is further used to:
  • the base-level unit's identity certificate and the private key of the base-level unit terminal are used for communication between the base-level unit terminal and other blockchain nodes in the taxation blockchain network.
  • the first level certificate authority node 202 is further configured to:
  • the secondary certificate authority node 203 is further configured to:
  • the proxy node communication identity certificate issuance request includes the registration information of the proxy node and the registration information of the proxy node with the proxy node's startup private key Signature
  • the communication identity certificate of the proxy node and the communication private key of the proxy node are sent to the proxy node, and the communication identity certificate of the proxy node and the communication private key of the proxy node are used for the communication between the proxy node and the service node.
  • the certificate authority system includes a primary server and a secondary server, wherein the primary server includes the root certificate authority node and the primary certificate authority node, and the secondary server includes all The second-level certificate authority node and the basic unit certificate authority node.
  • the certificate authority system includes multiple secondary servers, where each secondary server includes the secondary certificate authority node and the basic unit certificate authority node, and the certificate authority system further It includes a scheduling node, and the scheduling node is used to:
  • each secondary server further includes a local database, and the local database is used for:
  • the issued basic-level unit identity certificate and the basic-level unit identity certificate issued by the basic-level unit identity certificate are issued Request, wherein the data stored in the local database is periodically synchronized with the local databases of other secondary servers of the certificate authority system.
  • the certificate authorization system further includes a backup storage system
  • the backup storage system includes a backup storage area corresponding to each secondary server for:
  • the primary-level unit’s identity certificate is aimed at the primary-level unit’s identity certificate issuance request, wherein, in response to the secondary server failure, the local tax bureau’s identity certificate issuance request and the primary-level unit’s identity certificate issuance request that the secondary server has not served up are dispatched Nodes are allocated to other secondary servers; in response to the secondary server failure recovery, data is restored from the backup storage area corresponding to the secondary server in the backup storage system to the local database of the secondary server.
  • each of the root certificate authority node 201, the first level certificate authority node 202, the second level certificate authority node 203, the business node unit certificate authority node 2041, the non-business node unit certificate authority node 2042, and the personal certificate authority node 2043 in FIG. As a single hardware device, it is realized by the computer device 800 of FIG. 11.
  • the root certificate authority node 201, the first level certificate authority node 202, the second level certificate authority node 203, the business node unit certificate authority node 2041, the non-business node unit certificate authority node 2042, and the personal certificate authority node 2043 can each be used as a functional module It is stored on the same hardware device, and the hardware device is implemented as the computer device 800 in FIG. 11.
  • the computer device 800 according to an embodiment of the present application is described below with reference to FIG. 11.
  • the computer device 800 shown in FIG. 11 is only an example, and should not bring any limitation to the functions and scope of use of the embodiments of the present application.
  • the computer device 800 is represented in the form of a general-purpose computing device.
  • the components of the computer device 800 may include, but are not limited to: the aforementioned at least one processing unit 810, the aforementioned at least one storage unit 820, and a bus 830 connecting different system components (including the storage unit 820 and the processing unit 810).
  • the storage unit stores program code, and the program code can be executed by the processing unit 810, so that the processing unit 810 executes the various exemplary methods described in the description section of the exemplary method in this specification.
  • the processing unit 810 may perform various steps as shown in FIG. 5.
  • the storage unit 820 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 8201 and/or a cache storage unit 8202, and may further include a read-only storage unit (ROM) 8203.
  • RAM random access storage unit
  • ROM read-only storage unit
  • the storage unit 820 may also include a program/utility tool 8204 having a set (at least one) program module 8205.
  • program module 8205 includes but is not limited to: an operating system, one or more application programs, other program modules, and program data, Each of these examples or some combination may include the implementation of a network environment.
  • the bus 830 may represent one or more of several types of bus structures, including a storage unit bus or a storage unit controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local area using any bus structure among multiple bus structures. bus.
  • the computer device 800 can also communicate with one or more external devices 700 (such as keyboards, pointing devices, Bluetooth devices, etc.), and can also communicate with one or more devices that enable a user to interact with the computer device 800, and/or communicate with Any device (eg, router, modem, etc.) that enables the computer device 800 to communicate with one or more other computing devices. This communication can be performed through an input/output (I/O) interface 850.
  • the computer device 800 may also communicate with one or more networks (for example, a local area network (LAN), a wide area network (WAN), and/or a public network, such as the Internet) through the network adapter 860. As shown in the figure, the network adapter 860 communicates with other modules of the computer device 800 through the bus 830.
  • LAN local area network
  • WAN wide area network
  • public network such as the Internet
  • the embodiment of the present application also provides a storage medium, the storage medium is used to store a computer program, and the computer program is used to execute the method of issuing identity certificates for blockchain nodes in a tax blockchain network provided in the above embodiments.
  • the embodiment of the application also provides a computer program product including instructions, which when running on a server, causes the server to execute the method of issuing identity certificates for blockchain nodes in the tax blockchain network provided in the above embodiments.
  • the exemplary embodiments described herein can be implemented by software, or can be implemented by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (can be a CD-ROM, U disk, mobile hard disk, etc.) or on the network , Including several instructions to make a computing device (which may be a personal computer, server, terminal device, or network device, etc.) execute the method according to the embodiment of the present application.
  • a non-volatile storage medium can be a CD-ROM, U disk, mobile hard disk, etc.
  • Including several instructions to make a computing device which may be a personal computer, server, terminal device, or network device, etc.
  • a computer program medium is also provided, on which computer-readable instructions are stored, and when the computer-readable instructions are executed by the processor of the computer, the computer is caused to execute the foregoing method embodiments. Partially described methods.
  • a program product for implementing the method in the above method embodiment which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be used in the terminal Running on equipment, such as a personal computer.
  • CD-ROM portable compact disk read-only memory
  • the program product of this application is not limited to this.
  • the readable storage medium can be any tangible medium that contains or stores a program, and the program can be used by or combined with an instruction execution system, device, or device.
  • the program product can use any combination of one or more readable media.
  • the readable medium may be a readable signal medium or a readable storage medium.
  • the readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or a combination of any of the above. More specific examples (non-exhaustive list) of readable storage media include: electrical connections with one or more wires, portable disks, hard disks, random access memory (RAM), read only memory (ROM), erasable Type programmable read only memory (EPROM or flash memory), optical fiber, portable compact disk read only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.
  • the computer-readable signal medium may include a data signal propagated in baseband or as a part of a carrier wave, and readable program code is carried therein. This propagated data signal can take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing.
  • the readable signal medium may also be any readable medium other than a readable storage medium, and the readable medium may send, propagate, or transmit a program for use by or in combination with the instruction execution system, apparatus, or device.
  • the program code contained on the readable medium can be transmitted by any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.
  • the program code used to perform the operations of this application can be written in any combination of one or more programming languages.
  • the programming languages include object-oriented programming languages—such as Java, C++, etc., as well as conventional procedural Programming language-such as "C" language or similar programming language.
  • the program code can be executed entirely on the user's computing device, partly on the user's device, executed as an independent software package, partly on the user's computing device and partly executed on the remote computing device, or entirely on the remote computing device or server Executed on.
  • the remote computing device can be connected to a user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using Internet service providers) Business to connect via the Internet).
  • LAN local area network
  • WAN wide area network
  • Internet service providers Internet service providers
  • modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory.
  • the features and functions of two or more modules or units described above may be embodied in one module or unit.
  • the features and functions of a module or unit described above can be further divided into multiple modules or units to be embodied.
  • the exemplary embodiments described herein can be implemented by software, or can be implemented by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (can be a CD-ROM, U disk, mobile hard disk, etc.) or on the network , Including several instructions to make a computing device (which may be a personal computer, server, mobile terminal, or network device, etc.) execute the method according to the embodiment of the present application.
  • a non-volatile storage medium can be a CD-ROM, U disk, mobile hard disk, etc.
  • Including several instructions to make a computing device which may be a personal computer, server, mobile terminal, or network device, etc.

Abstract

本申请提供了一种为区块链节点发放身份证书的方法及相关装置。该方法包括：通过一级证书授权节点，向税务总局终端发放税务总局身份证书；接收来自税务总局终端的、利用所述税务总局身份证书进行的地税局身份证书发放请求；通过所述二级证书授权节点，向所述税务总局终端发放地税局身份证书；接收来自地税局终端的、利用所述地税局身份证书进行的基层单位身份证书发放请求；通过所述基层单位证书授权节点，向所述地税局终端发放基层单位身份证书，以便所述地税局终端向所述基层单位终端转发所述基层单位身份证书。本申请实施例能够应对区块链节点的不同权限控制的需要，提高税务区块链网络内部各节点权限控制的有效性。

Description

为区块链节点发放身份证书的方法及相关装置
本申请要求于2019年03月07日提交中国专利局、申请号为201910173224.5、申请名称为“为区块链节点发放身份证书的方法及相关装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及区块链领域，具体涉及为税务区块链网络中的区块链节点发放身份证书。
背景技术
在区块链技术体系中，分为公有链和联盟链两种设计方案。在公有链体系中，任意节点都可以加入共识体系中，成为记账节点。在联盟链体系中，只将少数节点开放为记账节点，使得当普通节点(也就是，除了记账节点以外的其他节点)需要将交易信息在区块链上进行上链时，先由该普通节点将需要上链的信息发送给该少数记账节点中的一个节点，再由该记账节点将接收到的信息进行上链。基于此可知，在联盟链体系中，除了通过用户的私钥安全来保证用户个人账户信息的安全性以外，还需要将用户的现实身份和其区块链上的账户信息进行绑定，从而实现一个准入机制。
一般来说，一个企业节点要加入联盟链，先要注册成为联盟链的成员，才能通过记账节点进行信息的上链和查询。在通过记账节点上链和查询时，双方节点首先需要确立对方的身份是否是联盟链成员，如果是联盟链成员才能正常进行上链和查询。确立对方的身份是否是联盟链成员可以采取消息签名并由对方验证签名的形式。为了签名和验证签名，需要为每个节点发放独有的公私钥。为了保证公私钥的权威性，要为每个注册成功的节点发放身份证书，以确保该节点是在联盟链中注册的身份正确的节点。因此，对于联盟区块链网络来说，需要一套为加盟的区块链节点发放并维护身份证书的机制，确保通信中每个区块链节点身份信息的可验证性。
税务区块链网络是一个比较复杂的区块链网络，使得如何实现税务区块链网络中身份证书的发放仍是一个亟待解决的技术问题。
发明内容
本申请提出一种为税务区块链网络中的区块链节点发放身份证书的方法、证书授权系统、计算机设备和介质，能够实现税务区块链网络中身份证书的发放过程。
根据本申请实施例的一方面，公开了一种为税务区块链网络中的区块链节点发放身份证书的方法，所述税务区块链网络中的区块链节点包括税务总局终端、地税局终端、基层单位终端，所述方法由证书授权系统执行，所述证书授权系统包括一级证书授权节点、二级证书授权节点、和基层单位证书授权节点，所述方法包括：
通过所述一级证书授权节点，向税务总局终端发放税务总局身份证书；
接收来自税务总局终端的、利用所述税务总局身份证书进行的地税局身份证书发放请求，所述地税局身份证书发放请求响应于地税局终端向税务总局终端发送的注册请求而生成；
通过所述二级证书授权节点，向所述税务总局终端发放地税局身份证书，以便所述税 务总局终端向所述地税局终端转发所述地税局身份证书；
接收来自地税局终端的、利用所述地税局身份证书进行的基层单位身份证书发放请求，所述基层单位身份证书发放请求响应于基层单位终端向已具有所述地税局身份证书的所述地税局终端发送的注册请求而生成；
通过所述基层单位证书授权节点，向所述地税局终端发放基层单位身份证书，以便所述地税局终端向所述基层单位终端转发所述基层单位身份证书。
根据本申请实施例的一方面，公开了一种为税务区块链网络中的区块链节点发放身份证书的证书授权系统，所述税务区块链网络中的区块链节点包括税务总局终端、地税局终端、基层单位终端，所述证书授权系统包括：
一级证书授权节点，用于向税务总局终端发放税务总局身份证书；
二级证书授权节点，用于响应于来自税务总局终端的、利用所述税务总局身份证书进行的地税局身份证书发放请求，向所述税务总局终端发放地税局身份证书，以便所述税务总局终端向所述地税局终端转发所述地税局身份证书，其中，所述地税局身份证书发放请求响应于地税局终端向税务总局终端发送的注册请求而生成；
基层单位证书授权节点，用于响应于来自地税局终端的、利用所述地税局身份证书进行的基层单位身份证书发放请求，向所述地税局终端发放基层单位身份证书，以便所述地税局终端向所述基层单位终端转发所述基层单位身份证书，其中，所述基层单位身份证书发放请求响应于基层单位终端向已具有所述地税局身份证书的所述地税局终端所述的注册请求而生成。
根据本申请实施例的一方面，公开了一种计算机设备，包括：存储器，存储有计算机可读指令；处理器，读取存储器存储的计算机可读指令，以执行如上所述的方法。
根据本申请实施例的一方面，公开了一种存储介质，其特征在于，所述存储介质包括存储的程序，其中，所述程序运行时执行如上所述的方法。
根据本申请实施例的一方面，还提供了一种包括指令的计算机程序产品，当其在计算机上运行时，使得所述计算机执行上述的方法。
本申请实施例中，所述证书授权系统中包括一级证书授权节点、二级证书授权节点、和基层单位证书授权节点。首先，通过所述一级证书授权节点，向税务总局终端发放税务总局身份证书。税务总局终端拿到该身份证书后，代表其有权接收下面各地税局终端的注册请求，为各地税局终端办理地税局身份证书。地税局身份证书是由二级证书授权节点发放的。税务总局终端凭为自己发放的税务总局身份证书，为其下面的地税局请求发放地税局身份证书，这样，发放下来的地税局身份证书是由一个合法的税务总局终端作保障的。地税局终端拿到地税局身份证书后，代表其有权接收下面各基层单位终端的注册请求，为各基层单位终端办理基层单位身份证书。基层单位身份证书是由基层单位证书授权节点发放的。地税局终端凭为自己发放的地税局身份证书，为其下面的基层单位请求发放基层单位身份证书，这样，发放下来的基层单位身份证书是由一个合法的地税局终端作保障的。通过这样每一层级的身份证书发放以前一层级已发放下来的身份证书作保障的方式，保障了不同层级身份证书发放的安全性，适应了税务区块链网络内部各级区块链节点的不同权 限控制的需要，提高了税务区块链网络内部权限控制的有效性。
本申请的其他特性和优点将通过下面的详细描述变得显然，或部分地通过本申请的实践而习得。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性的，并不能限制本申请。
附图说明
通过参照附图详细描述其示例实施例，本申请的上述和其它目标、特征及优点将变得更加显而易见。
图1A示出了根据本申请一个实施例的税务区块链网络中的区块链节点发放身份证书的方法所应用到的区块链网络的总体架构图。
图1B示出了根据本申请一个实施例的图1A的区块链网络的一个更详细的构架图。
图2示出了根据本申请一个实施例的证书授权系统的体系架构图，该体系架构图示出了各级证书授权节点与各级区块链节点的对应关系。
图3A-K示出了根据本申请一个实施例的为税务区块链网络中的区块链节点发放身份证书的方法应用到电子发票区块链网络中的各级区块链节点身份证书发放的应用场景的示意界面图。
图4示出了根据本申请一个实施例的分布式证书授权系统的结构示意图。
图5示出了根据本申请一个实施例的为税务区块链网络中的区块链节点发放身份证书的方法的流程图。
图6示出了根据本申请一个实施例的为税务区块链网络中的区块链节点发放身份证书的方法的流程图。
图7示出了根据本申请一个实施例的为税务区块链网络中的区块链节点发放身份证书的方法的流程图。
图8示出了根据本申请一个实施例的为税务区块链网络中的区块链节点发放身份证书的方法的流程图。
图9示出了根据本申请一个实施例的为税务区块链网络中的区块链节点发放身份证书的方法的流程图。
图10示出了根据本申请一个实施例的为税务区块链网络中的区块链节点发放身份证书的证书授权系统的框图。
图11示出了根据本申请一个实施例的计算机设备的硬件图。
具体实施方式
现在将参考附图更全面地描述示例实施方式。然而，示例实施方式能够以多种形式实施，且不应被理解为限于在此阐述的范例；相反，提供这些示例实施方式使得本申请的描述将更加全面和完整，并将示例实施方式的构思全面地传达给本领域的技术人员。附图仅为本申请的示意性图解，并非一定是按比例绘制。图中相同的附图标记表示相同或类似的部分，因而将省略对它们的重复描述。
此外，所描述的特征、结构或特性可以以任何合适的方式结合在一个或更多示例实施方式中。在下面的描述中，提供许多具体细节从而给出对本申请的示例实施方式的充分理 解。然而，本领域技术人员将意识到，可以实践本申请的技术方案而省略所述特定细节中的一个或更多，或者可以采用其它的方法、组元、步骤等。在其它情况下，不详细示出或描述公知结构、方法、实现或者操作以避免喧宾夺主而使得本申请的各方面变得模糊。
附图中所示的一些方框图是功能实体，不一定必须与物理或逻辑上独立的实体相对应。可以采用软件形式来实现这些功能实体，或在一个或多个硬件模块或集成电路中实现这些功能实体，或在不同网络和/或处理器装置和/或微控制器装置中实现这些功能实体。
下面先参照图1A-1B描述一下本申请实施例所应用的区块链网络的体系构架。
区块链网络是指对区块链上的数据区块进行记录和查询的所有节点构成的节点网络。区块链网络中的每个节点即区块链节点，是一台能够完成对区块链上的数据区块进行记录或查询的设备，它可以是手机、桌面电脑、笔记本电脑、PDA、车载终端等各种形式的终端。区块链网络分为业务节点子网络101和记账节点子网络102。其中，业务节点子网络101中的节点叫做业务节点103，记账节点子网络102中的节点叫做记账节点104。
另外，记账节点104能直接对数据区块进行上链，或查询区块链上的数据区块；但是，业务节点103不能直接对区块链进行数据区块的上链，也不能直接查询区块链上的数据区块，却可以通过请求记账节点104进行数据区块的上链和查询，其过程具体可以为：当业务节点103中有交易信息上链时，业务节点103可以将该交易信息发给记账节点子网络102的记账节点104，使得该记账节点104将该交易信息进行上链；当业务节点103需要查询数据区块时，业务节点103也可以通过记账节点104进行查询。此外，记账节点104在很多情况下是官方设置的，民间的终端只能作为业务节点103。
代理节点105位于业务节点子网络101和记账节点子网络102的中间，是业务节点103和记账节点104的中介。当业务节点103有交易信息上链时，业务节点103可以通过代理节点105将该交易信息发给记账节点104进行上链。当业务节点103需要查询数据区块时，也通过代理节点105向记账节点104查询。
图1A仅是一般的区块链网络的体系结构，图1B给出了税务区块链网络的更详细的体系结构。税务区块链网络是指用于进行电子发票相关交易(例如领取、开出、报销)的上链和查询的区块链网络。由于电子发票相关交易行为既涉及到政府(各级税务局)，也涉及到开票企业(开票单位、报销单位)，又涉及到个人(报销者)，因此，业务节点子网络101包括税务专网106、共有云网107、私有云网108。
税务专网106是电子发票交易所涉及的政府部门业务节点的总和，包括税务总局终端1031和地税局终端1032。
共有云网107是电子发票交易所涉及的单位业务节点的总和，包括开票单位终端1033、报销单位终端1034、专属(KA)单位终端1035。开票单位终端1033、报销单位终端1034分别是指有电子发票需要开出、报销，且本身也能作为一个业务节点103向记账节点104请求交易区块上链或查询的终端。不是每个有电子发票开出或报销的终端都能作为向记账节点104发出请求的业务节点103。非业务节点企业终端109就是不能作为业务节点103向记账节点104发出这样的请求的终端，其有电子发票需要开出、报销时，只能将其发送给开票单位终端1033、报销单位终端1034，由它们向记账节点104请求。专属(KA)单位终端1035是针 对一些大型结算单位设置的专用的既可以开票也可以报销的终端。
私有云网108是电子发票交易所涉及的个人业务节点的总和，例如报销人的手机。它包括支付终端1036、流转终端1037、KA单位终端1038。支付终端1036是支付者(报销人)使用的、能够作为业务节点的终端，例如报销人的手机。流转终端1037是在交易过程起到流转作用的角色使用的、能够作为业务节点的终端，例如快递员的手机(快递员先代替最终用户领取电子发票，然后通过快递的形式将电子发票转到最终用户的手机终端中)。另外，还有一些终端在交易过程中可能被个人用户(例如支付者、快递员)使用，但该终端本身不构成业务节点103，因而不能向记账节点104请求上链，需要向能够作为业务节点的支付终端1033、流转终端1034请求，由支付终端1033、流转终端1034再向记账节点104请求上链，这样的终端叫做个人终端110。KA单位终端1038是针对一些大型结算单位个人结算设置的专用终端。
记账节点子网络102中设置多个子区块链记账分支网络1021，每个子区块链记账分支网络1021分别包括一组记账节点104，分别用于一个子区块链的区块的上链和查询。子区块链是指将区块链分成的多个子链，每个子链单独记录，但都属于整个区块链。这样，区块链上的数据区块记录时，首先要选择记录在哪个子区块链上，由专门负责向该子区块链上进行记录的子区块链记账分支网络1021中的记账节点104进行记录。每个记账节点104中具有权限合约1041、完成区块生成和共识需要的高速缓存1042和记录的区块1043。这一部分不是本申请讨论的重要，故不展开描述。
代理节点105包括认证服务1051、证书缓存1052、路由服务1053、P2P服务1054的模块，其不是本申请讨论的重要，故不展开描述。值得一提的是，在现有技术中，身份证书是通过代理节点105发放的。
另外，如图2所示，在本申请实施例中还设置有专门应用于税务区块链网络212的证书授权系统205完成证书的授权和发放。其中，图2的税务区块链网络212包括税务总局终端206、地税局终端207、基层单位终端211。
税务总局终端206是税务总局办理与电子发票相关的交易时使用的终端，其可以作为业务节点103，有交易时通过记账节点104记账，如图1B中的税务总局终端1031，也可以作为记账节点，如图1B中的一个记账节点104，有交易时自己直接将区块上链。
地税局终端207是地税局办理与电子发票相关的交易时使用的终端，其可以作为业务节点103，有交易时通过记账节点104记账，如图1B中的地税局终端1032，也可以作为记账节点，如图1B中的一个记账节点104，有交易时自己直接将区块上链。
基层单位终端211是基层单位办理与电子发票相关的交易时使用的终端，其包括业务节点单位终端208、非业务节点单位终端209、个人终端210。业务节点单位终端208是能够作为业务节点103向记账节点104进行区块的上链和查询的终端，如图1B中的开票单位终端1033、报销单位终端1034、KA单位终端1035、支付终端1033、流转终端1034、KA单位终端1035。非业务节点单位终端208是要通过业务节点103向记账节点104进行区块的上链和查询、本身不能够上链和查询的单位终端，如图1B中的非业务节点企业终端109。个人终端110是要通过业务节点103向记账节点104进行区块的上链和查询、本身不能够上链和查询的个 人终端，如图1B中的个人终端110。
图2中的证书授权系统205包括根证书授权节点201、一级证书授权节点202、二级证书授权节点203、和基层单位证书授权节点204。其中，基层单位证书授权节点204包括业务节点单位的证书授权节点2041、非业务节点单位的证书授权节点2042、个人的证书授权节点2043。
根证书授权节点201是生成根证书，并以此生成一级证书授权节点202、二级证书授权节点203、和基层单位证书授权节点204的节点，它一般仅在初始化时使用。
一级证书授权节点202是向税务总局终端206发放税务总局身份证书的节点。一般预先向税务总局终端206发放一批税务总局身份证书，之后一级证书授权节点202也不使用。
二级证书授权节点203是向地税局终端207发放地税局身份证书的节点。二级证书授权节点203不是直接向地税局终端207发放地税局身份证书，而是通过税务总局终端206来请求发放。由于预先向税务总局终端206发放了税务总局身份证书，这样，税务总局终端206就可以凭该税务总局身份证书为下属的地税局请求发放地税局身份证书，保证地税局身份证书发放的安全性。地税局身份证书先发放到税务总局终端206，再由税务总局终端206转给地税局终端207。
业务节点单位证书授权节点2041是向业务节点单位终端208发放业务节点单位身份证书的节点。非业务节点单位证书授权节点2042是向非业务节点单位终端209发放非业务节点单位身份证书的节点。个人证书授权节点2043是向个人终端210发放个人身份证书的节点。业务节点单位证书授权节点2041、非业务节点单位证书授权节点2042、个人证书授权节点2043统称基层单位证书授权节点204，向基层单位终端211发放基层单位身份证书。
基层单位证书授权节点204不是直接向基层单位终端211发放基层单位身份证书，而是通过地税局终端207来请求发放。由于预先向地税局终端207发放了地税局身份证书，这样，地税局终端207就可以凭该地税局身份证书为下属的基层单位请求发放基层单位身份证书，保证基层单位身份证书发放的安全性。基层单位身份证书先发放到地税局终端207，再由地税局终端207转给基层单位终端211。
下面结合图3A至图3K的界面图，描述在电子发票使用的区块链网络应用场景之下，为各区块链节点发放身份证书的大致过程。
为了后续地税局、基层单位终端在请求身份证书时具有请求的基础，可以先通过一级证书授权节点202为税务总局终端206发放一批税务总局身份证书。这时，在税务总局终端206的界面上，出现图3A所示的提示界面，提示界面上显示发放的税务总局身份证书的详细信息。
当地税局终端207想要获得地税局身份证书时，首先，该地税局终端207向已经获得了税务总局身份证书的税务总局终端206发出注册请求，此时如图3B所示，税务总局终端206的界面上显示注册请求的详细信息。其次，税务总局终端206利用税务总局身份证书为地税局终端207请求地税局身份证书，该过程具体为：税务总局终端206将自己已经获得的税务总局身份证书发回证书授权系统205，如图3C所示，而且税务总局终端206向证书授权系统205发送地税局身份证书发放请求，所述地税局身份证书发放请求具有用税务总局身份证书 中的公钥对应的私钥进行的签名，如图3D所示。然后，在二级证书授权节点203对签名验证成功后，将为地税局终端207发放的地税局身份证书发送给税务总局终端206，此时如图3E所示，税务总局终端206的界面上显示地税局身份证书的详细信息，以便税务总局终端206将该地税局身份证书转发给地税局终端207，如图3F所示。
当基层单位终端211想要获得基层单位身份证书时，首先，基层单位终端211向已经获得了地税局身份证书的地税局终端207发出注册请求，此时如图3G所示，地税局终端207的界面上显示注册请求的详细信息。其次，地税局终端207利用地税局身份证书为基层单位终端211请求基层单位身份证书，该过程具体为：地税局终端207将自己已经获得的地税局身份证书发回证书授权系统205，如图3H所示，而且地税局终端207向证书授权系统205发送基层单位身份证书发放请求，所述基层单位身份证书发放请求具有用地税局身份证书中的公钥对应的私钥进行的签名，如图3I所示。然后，在基层单位证书授权节点204对签名验证成功后，将为基层单位终端211发放的基层单位身份证书发送给地税局终端207，此时如图3J所示，地税局终端207的界面上显示基层单位身份证书的详细信息，以便地税局终端207将该基层单位身份证书转发给基层单位终端211，如图3K所示。
图5示出了根据本申请一个实施例的一种为税务区块链网络中的区块链节点发放身份证书的方法的流程图。所述方法由证书授权系统205执行。如图5所示，所述方法包括：
步骤310、证书授权系统205通过所述一级证书授权节点，向税务总局终端发放税务总局身份证书；
步骤320、证书授权系统205接收来自税务总局终端的、利用所述税务总局身份证书进行的地税局身份证书发放请求，所述地税局身份证书发放请求响应于地税局终端向税务总局终端发送的注册请求而生成；
步骤330、证书授权系统205通过所述二级证书授权节点，向所述税务总局终端发放地税局身份证书，以便所述税务总局终端向所述地税局终端转发所述地税局身份证书；
步骤340、证书授权系统205接收来自地税局终端的、利用所述地税局身份证书进行的基层单位身份证书发放请求，所述基层单位身份证书发放请求响应于基层单位终端向已具有所述地税局身份证书的所述地税局终端发送的注册请求而生成；
步骤350、证书授权系统205通过所述基层单位证书授权节点，向所述地税局终端发放基层单位身份证书，以便所述地税局终端向所述基层单位终端转发所述基层单位身份证书。
在详细描述步骤310-350之前，结合图6描述一下步骤310之前方法执行的预备步骤302-306。如图6所示，在步骤310之前，在一个实施例中，所述方法包括以下预备步骤：
步骤302、证书授权系统205生成所述根证书授权节点；
步骤304、证书授权系统205通过所述根证书授权节点，生成根证书；
步骤306、证书授权系统205基于所述根证书，生成所述一级证书授权节点、所述二级证书授权节点、和所述基层单位证书授权节点。
根证书授权节点是对证书授权系统205中所有其它证书授权节点进行统一初始化授权的节点。也就是说，证书授权系统205中的所有节点也不是同时生成的。先生成最初的一个根证书授权节点，该根证书授权节点是可信的。然后，后续其它节点的可信度由证书来保 障。根证书是根证书授权节点发放的用于保证后续授权节点合法性的证书。根证书中含有一个根公钥，与根公钥同时生成根私钥。
在一个实施例中，步骤306可以包括由根证书授权节点执行的如下过程：
证书授权系统205生成一级证书授权节点的空节点、所述二级证书授权节点的空节点、和所述基层单位证书授权节点的空节点；
证书授权系统205向一级证书授权节点的空节点、所述二级证书授权节点的空节点、和所述基层单位证书授权节点的空节点发放所述根证书和根私钥；
证书授权系统205接收一级证书授权节点的空节点、或所述二级证书授权节点的空节点、或所述基层单位证书授权节点的空节点利用所述根证书进行的一级证书授权节点证书的发放请求、或所述二级证书授权节点证书的发放请求、或所述基层单位证书授权节点证书的发放请求，所述发放请求中包括用所述根私钥进行的签名；
如果用所述根证书中的根公钥验证所述签名成功，证书授权系统205为一级证书授权节点的空节点、或所述二级证书授权节点的空节点、或所述基层单位证书授权节点的空节点生成一级证书授权节点、或所述二级证书授权节点、或所述基层单位证书授权节点的公钥和私钥，将所述公钥放入一级证书授权节点证书、或所述二级证书授权节点证书、或所述基层单位证书授权节点证书中；
证书授权系统205将所述一级证书授权节点证书、或所述二级证书授权节点证书、或所述基层单位证书授权节点证书，连同一级证书授权节点的私钥、或所述二级证书授权节点的私钥、或所述基层单位证书授权节点的私钥发放给一级证书授权节点的空节点、或所述二级证书授权节点的空节点、或所述基层单位证书授权节点的空节点。
空节点是指具有节点的硬件载体，但不具有相应的工作因而无法正常工作的节点。一级证书授权节点的空节点、所述二级证书授权节点的空节点、和所述基层单位证书授权节点的空节点是指，这些节点仅具有物理载体，由于未给它们发放证书，因此不具有相应发放税务总局身份证书、地税局身份证书、基层单位身份证书的权限。
生成一级证书授权节点的空节点、所述二级证书授权节点的空节点、和所述基层单位证书授权节点的空节点后，向这些空节点发放所述根证书和根私钥，所述根证书中具有根公钥，根公钥和根私钥相对应。根证书代表了它们有权请求一级证书授权节点、所述二级证书授权节点、和所述基层单位证书授权节点自己的证书。一级证书授权节点的空节点、所述二级证书授权节点的空节点、和所述基层单位证书授权节点的空节点接收到根证书和根私钥后，当需要请求自己的证书时，其可以将所述根证书发送给根授权节点。然后，它们向根授权节点发送一级证书授权节点证书的发放请求、或所述二级证书授权节点证书的发放请求、或所述基层单位证书授权节点证书的发放请求，所述发放请求中包括用所述根私钥进行的签名。根授权节点用事先接收到的根证书中的公钥对所述签名进行验证。如果验证成功，说明该空节点就是接收到自己授权的根证书的空节点，可以为其发放一级证书授权节点、所述二级证书授权节点、和所述基层单位证书授权节点自己的证书。
由于证书发放的本质在于发放了一对公私钥，并用证书的形式对公私钥的合法性予以保障，从而得到证书的节点可以利用该公私钥进行与其它节点的通信，因此，根授权节点 首先为一级证书授权节点的空节点、或所述二级证书授权节点的空节点、或所述基层单位证书授权节点的空节点生成一级证书授权节点的公钥和私钥、或所述二级证书授权节点的公钥和私钥、或所述基层单位证书授权节点的公钥和私钥，然后将所述公钥放入一级证书授权节点证书、或所述二级证书授权节点证书、或所述基层单位证书授权节点证书中，将一级证书授权节点证书、或所述二级证书授权节点证书、或所述基层单位证书授权节点证书连同一级证书授权节点的私钥、或所述二级证书授权节点的私钥、或所述基层单位证书授权节点的私钥发放给一级证书授权节点的空节点、或所述二级证书授权节点的空节点、或所述基层单位证书授权节点的空节点。这样，空节点得到了证书后，就不再是空节点，其具有了一级证书授权节点、或所述二级证书授权节点、或所述基层单位证书授权节点正常的发放身份证书的权限，该权限是一级证书授权节点证书、或所述二级证书授权节点证书、或所述基层单位证书授权节点证书赋予的。
上述实施例的好处在于，一级证书授权节点、或所述二级证书授权节点、或所述基层单位证书授权节点本身的生成也依赖于根证书的授权，提高了证书授权系统中的各授权节点的权限来源的合理性，使得被授权的节点的权限来源有规则可循，使得授权节点的权限来源也具有合法的基础，提高了证书授权系统证书授权的可靠性。
在步骤310中，证书授权系统205通过所述一级证书授权节点，向税务总局终端发放税务总局身份证书。
由于证书发放方法的实质在于对区块链节点分配公私钥，并对公私钥的合法性进行证明，从而便于区块链节点与其它区块链节点的通信，因此，在一个实施例中，步骤310包括由一级证书授权节点执行的以下过程：
证书授权系统205通过所述一级证书授权节点，生成税务总局终端的公钥和私钥；
证书授权系统205为所述税务总局终端生成税务总局身份证书，所述税务总局身份证书中含有税务总局终端的公钥；
证书授权系统205将所述税务总局身份证书和所述税务总局终端的私钥发送给所述税务总局终端。
一级证书授权节点生成公钥和私钥对可以采取预定的公私钥对生成算法，其不是本申请重点关注的内容，故不赘述。一级证书授权节点生成税务总局身份证书可以采用预定的生成身份证书的方法，故不赘述。一级证书授权节点将所述税务总局身份证书和所述税务总局终端的私钥一起发送给所述税务总局终端。所述税务总局终端的私钥的作用是，在税务总局终端以后需要与其它区块链节点通信时，可以用该私钥签名，而利用其税务总局身份证书中的公钥，是可以成功验证该签名的。
在步骤320中，接收来自税务总局终端的、利用所述税务总局身份证书进行的地税局身份证书发放请求，所述地税局身份证书发放请求响应于地税局终端向税务总局终端的注册请求而生成。
在一个实施例中，步骤320包括由二级证书授权节点执行的以下过程：
接收来自税务总局终端的所述税务总局身份证书；
接收来自税务总局终端的所述地税局身份证书发放请求，所述地税局身份证书发放请 求包含所述地税局的注册信息和用所述税务总局的私钥对所述地税局的注册信息的签名；
用所述税务总局身份证书中的所述税务总局的公钥，对所述地税局身份证书发放请求中的签名进行验证。
在税务总局终端获得了税务总局身份证书之后，该税务总局终端就具有了代表其下属地税局终端申请地税局身份证书的权限。地税局如果想要获得地税局身份证书，就要向税务总局终端提交注册请求。注册请求包括注册到税务区块链网络中所需提供的信息。税务总局终端在接收到该注册请求之后，将自己的税务总局身份证书发送给二级证书授权节点，这样，二级证书授权节点就获得了证书中的税务总局终端的公钥。税务总局终端用税务总局的私钥对地税局的注册信息签名，连同注册信息放在地税局身份证书发放请求中，发送给二级证书授权节点。二级证书授权节点就可以用所述税务总局身份证书中的所述税务总局的公钥，对所述地税局身份证书发放请求中的签名进行验证，验证成功后，为地税局终端发放地税局身份证书。
上述过程的好处是，通过利用税务总局终端的私钥加密注册信息，用税务总局身份证书中的公钥验证的方式，保证了由合法的税务总局终端为其下属地税局终端请求发放地税局身份证书，提高地税局身份证书发放的安全性。
在步骤330中，证书授权系统205通过所述二级证书授权节点，向所述税务总局终端发放地税局身份证书，以便所述税务总局终端向所述地税局终端转发所述地税局身份证书。
由于发放身份证书本质上是发放公私钥，并利用证书对公私钥的合法性进行证明的过程，因此，在一个实施例中，步骤330包括由二级证书授权节点执行的如下过程：
证书授权系统205通过所述二级证书授权节点，对所述注册信息进行认证；
如果认证通过，证书授权系统205为所述地税局终端生成地税局终端的公钥和私钥；
证书授权系统205为所述地税局终端生成地税局身份证书，所述地税局身份证书含有所述地税局终端的公钥；
证书授权系统205向所述税务总局终端发送所述地税局身份证书和所述地税局终端的私钥，以便所述税务总局终端向所述地税局终端转发所述地税局身份证书和所述地税局终端的私钥，所述地税局身份证书和所述地税局终端的私钥用于所述地税局终端与所述税务区块链网络中的其它区块链节点通信。
其中，对所述注册信息进行认证包括对注册信息是否符合规定的法律要件进行核对。可以通过预先根据规定的法律要件，编写检查是否符合该法律要件的脚本。在认证时执行该脚本即可实现认证。
生成地税局终端的公私钥和地税局身份证书并发放的过程与前述实施例中生成税务总局终端的公私钥和税务总局身份证书并发放的过程类似，故不赘述。
上述生成公私钥和地税局身份证书，并将地税局身份证书和私钥一起发放的方式，为地税局终端后续与其它区块链节点通信时身份的验证提供了保障，提高地税局终端与其它区块链节点通信的安全性。
具体地，在一个实施例中，所述地税局终端与所述税务区块链网络中的其它区块链节点通信包括由地税局终端执行的以下过程：
所述地税局终端向所述其它区块链节点发送所述地税局身份证书；
所述地税局终端将要向所述其它区块链节点发送的内容用所述地税局终端的私钥签名；
所述地税局终端将所述内容和所述签名一起发送到所述其它区块链节点，以便所述其它区块链节点用所述地税局身份证书中的公钥对所述签名验证。
其它区块链节点是指区块链网络中除了地税局终端之外的任何节点。在地税局终端将向企业发放电子发票的交易信息上链的场景下，地税局终端将该交易信息通过代理节点发送给记账节点上链，这里的其它区块链节点是指代理节点，要向所述其它区块链节点发送的内容就是该交易信息。在地税局终端将税务总局终端发送查询统计数据的请求的场景下，这里的其它区块链节点是指税务总局终端，要向所述其它区块链节点发送的内容就是该查询统计数据的请求。
所述地税局终端先向所述其它区块链节点发送所述地税局身份证书，使得该其它区块链节点就获得了证书中的地税局终端的公钥。接着，地税局终端将要向所述其它区块链节点发送的内容用所述地税局终端的私钥签名，将所述内容和所述签名一起发送到所述其它区块链节点。此时，所述其它区块链节点就可以用所述地税局身份证书中的公钥对所述签名验证。通过这种方式，保障了在地税局终端与区块链网络中的其它区块链节点传递信息时，双方身份是可验证的，提高了区块链网络中通信的安全性。
在步骤340中，证书授权系统205接收来自地税局终端的、利用所述地税局身份证书进行的基层单位身份证书发放请求，所述基层单位身份证书发放请求响应于基层单位终端向已具有所述地税局身份证书的所述地税局终端的注册请求而生成。
在一个实施例中，步骤340包括由基层单位证书授权节点执行的以下过程：
接收来自地税局终端的所述地税局身份证书；
接收来自地税局终端的所述基层单位身份证书发放请求，所述基层单位身份证书发放请求包含所述基层单位的注册信息和用所述地税局的私钥对所述基层单位的注册信息的签名；
用所述地税局身份证书中的所述地税局的公钥，对所述基层单位身份证书发放请求中的签名进行验证。
上述过程的具体实施和好处分别与步骤320的具体实施和好处类似，只不过接收到的是来自地税局终端的、利用所述地税局身份证书进行的基层单位身份证书发放请求，而不是来自税务总局终端的、利用所述税务总局身份证书进行的地税局身份证书发放请求，为节约篇幅，不再展开描述。
在步骤350中，证书授权系统205通过所述基层单位证书授权节点，向所述地税局终端发放基层单位身份证书，以便所述地税局终端向所述基层单位终端转发所述基层单位身份证书。
在一个实施例中，步骤350包括由基层单位证书授权节点执行的以下过程：
证书授权系统205通过所述基层单位证书授权节点，对所述基层单位的注册信息进行认证；
如果认证通过，证书授权系统205为所述基层单位终端生成基层单位终端的公钥和私钥；
证书授权系统205为所述基层单位终端生成基层单位身份证书，所述基层单位身份证书含有所述基层单位终端的公钥；
证书授权系统205向所述地税局终端发送所述基层单位身份证书和所述基层单位终端的私钥，以便所述地税局终端向所述基层单位终端转发所述基层单位身份证书和所述基层单位终端的私钥，所述基层单位身份证书和所述基层单位终端的私钥用于所述基层单位终端与所述税务区块链网络中的其它区块链节点通信。
该过程的具体实施和好处分别与步骤330的具体实施和好处类似，只不过这里是通过所述基层单位证书授权节点，向所述地税局终端发放基层单位身份证书，以便所述地税局终端向所述基层单位终端转发，而不是通过所述二级证书授权节点，向所述税务总局终端发放地税局身份证书，以便所述税务总局终端向所述地税局终端转发，故不赘述。
在一个实施例中，所述基层单位终端与所述税务区块链网络中的其它区块链节点通信包括：
所述基层单位终端向所述其它区块链节点发送所述基层单位身份证书；
所述基层单位终端将要向所述其它区块链节点发送的内容用所述基层单位终端的私钥签名；
所述基层单位终端将所述内容和所述签名一起发送到所述其它区块链节点，以便所述其它区块链节点用所述基层单位身份证书中的公钥对所述签名验证。
在不同的通信场景下，这里的其它区块链节点不同。例如，在基层单位是开票单位，需要将开出的电子发票的信息通过代理节点发送给记账节点上链的场景下，其它区块链节点是指代理节点，要向所述其它区块链节点发送的内容是指开出的电子发票的信息。
该过程与前述地税局终端与所述税务区块链网络中的其它区块链节点通信的过程和好处类似，为节约篇幅，故不赘述。
在一个实施例中，所述基层单位身份证书包括业务节点单位身份证书、非业务节点单位身份证书、个人身份证书。步骤350中的“向所述地税局终端发放基层单位身份证书，以便所述地税局终端向所述基层单位终端转发所述基层单位身份证书”包括：
如果所述基层单位身份证书发放请求针对业务节点单位，向所述地税局终端发放业务节点单位身份证书，以便所述地税局终端向所述业务节点单位终端转发所述业务节点单位身份证书，所述业务节点单位身份证书用于所述业务节点与所述代理节点之间上链信息的通信；
如果所述基层单位身份证书发放请求针对非业务节点单位，向所述地税局终端发放非业务节点单位身份证书，以便所述地税局终端向所述非业务节点单位终端转发所述非业务节点单位身份证书，所述非业务节点单位身份证书用于所述非业务节点单位终端与业务节点单位终端之间所述上链信息的基础信息的传递；
如果所述基层单位身份证书发放请求针对个人，向所述地税局终端发放个人身份证书，以便所述地税局终端向所述个人终端转发所述个人身份证书，所述个人身份证书用于 在个人终端与业务节点单位终端之间所述上链信息的基础信息的传递。
如果所述基层单位身份证书发放请求是地税局终端响应于业务节点单位终端的注册请求生成的，则认为该所述基层单位身份证书发放请求针对业务节点单位。如果所述基层单位身份证书发放请求是地税局终端响应于非业务节点单位终端的注册请求生成的，则认为该所述基层单位身份证书发放请求针对非业务节点单位。如果所述基层单位身份证书发放请求是地税局终端响应于个人终端的注册请求生成的，则认为该所述基层单位身份证书发放请求针对个人。
上链信息是指业务节点经由代理节点向记账节点转发的要上链的信息，如地税局终端向企业发放电子发票后发放电子发票的信息、业务节点开出电子发票后的开票信息。上链信息的基础信息是指本身不是业务节点向代理节点发送的要上链的信息，但作为该要上链的信息的基础的信息。例如，如果一个不是业务节点的企业开出发票需要上链，但它不是业务节点，这个开票的信息只能作为上链信息的基础信息，发送到一个能够作为业务节点的单位，由该单位生成上链信息，发送给代理节点。
所述业务节点单位身份证书用于所述业务节点与所述代理节点之间上链信息的通信是指：业务节点向上链信息发送到代理节点的时候，先将所述业务节点单位身份证书发送给代理节点，使代理节点获取证书中的公钥；然后，业务节点要用所述业务节点单位身份证书中的公钥对应的私钥对上链信息进行签名，并将该签名与上链信息一并发送给代理节点；代理节点接收到两者后，用证书中的公钥对所述签名进行验证；如果验证通过，就可以将上链信息转发到记账节点进行上链。
所述非业务节点单位身份证书用于所述非业务节点单位终端与业务节点单位终端之间所述上链信息的基础信息的传递，与上述过程类似，只不过传递的不是上链信息，而是上链信息的基础信息，且是在所述非业务节点单位终端与业务节点单位终端之间传递。为节约篇幅，故不赘述。
所述个人身份证书用于在个人终端与业务节点单位终端之间所述上链信息的基础信息的传递，与上述过程也类似，故不赘述。
通过前述的过程，为税务总局终端、地税局终端、基层单位终端发放了各自的身份证书，使其在区块链网络的通信中能够向通信对方证实自己的身份，但作为区块链网络通信中很重要的一环，还应该考虑代理节点的通信，也需要相应的通信证书保证其通信的安全性。
如图9所示，在一个实施例中，所述方法还包括：
步骤380、证书授权系统205通过所述一级证书授权节点，向代理节点发放代理节点启动身份证书；
步骤390、证书授权系统205接收来自代理节点的、利用所述代理节点启动身份证书进行的代理节点通信身份证书发放请求；
步骤395、证书授权系统205通过所述二级证书授权节点，向所述代理节点发放代理节点通信身份证书，所述代理节点通信身份证书用于与所述业务节点进行通信。
虽然在图9中示出，这些步骤在步骤350之后执行，但本领域技术人员理解，其可以在 方法过程任何时间点执行，这是由于上述过程涉及代理节点通信身份证书的发放，独立于本申请的主要过程。
代理节点的情况相对比较特殊，其没有上一级节点为它申请身份证书，因此，只能预先通过所述一级证书授权节点，向代理节点发放一批代理节点启动身份证书，来保证后续代理节点启动身份证书的发放。
代理节点启动身份证书是表示代理节点得到了申请代理节点通信身份证书的权利的证书，它内部含有代理节点启动公钥，与其对应的是代理节点启动私钥。代理节点启动公私钥是用于验证代理节点是否有权申请代理节点通信身份证书的公私钥。
代理节点通信身份证书是表示代理节点有权与区块链网络中的业务节点进行通信的证书，它内部含有代理节点通信公钥，与其对应的是代理节点通信私钥。代理节点通信公私钥是在于区块链网络中的业务节点的通信中向业务节点验证自身身份的公私钥。
在一个实施例中，步骤380包括由一级证书授权节点执行的以下过程：
证书授权系统205通过所述一级证书授权节点，生成代理节点的启动公钥和启动私钥；
证书授权系统205为所述代理节点生成代理节点启动身份证书，所述代理节点身份证书中含有代理节点的启动公钥；
证书授权系统205将所述代理节点启动身份证书和所述代理节点的启动私钥发送给所述代理节点。
该过程与步骤310的过程类似，只不过这里发放的是代理节点启动身份证书，而不是税务总局身份证书，故不赘述。
在一个实施例中，步骤390包括由二级证书授权节点执行的以下过程：
接收来自代理节点的所述代理节点启动身份证书；
接收来自代理节点的所述代理节点通信身份证书发放请求，所述代理节点通信身份证书发放请求包含所述代理节点的注册信息和用所述代理节点的启动私钥对所述代理节点的注册信息的签名；
用所述代理节点启动身份证书中的所述代理节点的启动公钥，对所述代理节点通信身份证书发放请求中的签名进行验证。
该过程与步骤320的过程类似，只不过这里接收的是来自代理节点的、利用所述代理节点启动身份证书进行的代理节点通信身份证书发放请求，而不是来自税务总局终端的、利用所述税务总局身份证书进行的地税局身份证书发放请求，故不赘述。
在一个实施例中，步骤395包括由二级证书授权节点执行的以下过程：
证书授权系统205通过所述二级证书授权节点，对所述代理节点的注册信息进行认证；
如果认证通过，证书授权系统205为所述代理节点生成代理节点的通信公钥和通信私钥；
证书授权系统205为所述代理节点生成代理节点通信身份证书，所述代理节点通信身份证书含有所述代理节点的通信公钥；
证书授权系统205向所述代理节点发送所述代理节点通信身份证书和所述代理节点的通信私钥，所述代理节点通信身份证书和所述代理节点的通信私钥用于所述代理节点与业 务节点通信。
该过程与步骤330的过程类似，只不过这里发放的是代理节点通信身份证书，而不是地税局身份证书，故不赘述。
在一个实施例中，所述代理节点与所述业务节点通信包括由代理节点执行的以下过程：
所述代理节点向所述业务节点发送所述代理节点通信身份证书；
所述代理节点将要向所述业务节点发送的内容用所述代理节点的通信私钥签名；
所述代理节点将所述内容和所述签名一起发送到所述业务节点，以便所述业务节点用所述代理节点通信身份证书中的通信公钥对所述签名验证。
该过程与前述地税局终端与区块链网络中的其它区块链节点通信的过程类似，故不赘述。
下面是总结出的各身份证书的相关信息的列表。
Figure PCTCN2020075467-appb-000001
表1各身份证书的相关信息的列表
另外，税务总局终端具有最高的权限，不但可以为地税局终端请求颁发地税局身份证书，还可以为基层单位终端请求基层单位身份证书。
如图7所示，在步骤310之后，在一个实施例中，所述方法还包括由基层单位证书授权 节点执行的以下过程：
步骤360、证书授权系统205接收来自税务总局终端的、利用所述税务总局身份证书进行的基层单位身份证书发放请求，所述基层单位身份证书发放请求响应于基层单位终端经由地税局终端向税务总局终端发送的注册请求而生成；
步骤370、证书授权系统205通过所述基层单位证书授权节点，向所述税务总局终端发放基层单位身份证书，以便所述税务总局终端经由所述地税局终端向所述基层单位终端转发所述基层单位身份证书。
在该实施例中，在基层单位终端需要获得基层单位身份证书时，基层单位终端将注册请求发送给地税局终端，由地税局终端将注册请求发送到税务总局终端，由税务总局终端为基层单位终端发出基层单位身份证书发放请求。
步骤360和370的执行过程与步骤320和330大体类似，只不过在步骤360和370中，是由基层单位证书授权节点发放基层单位身份证书，而不是由二级证书授权节点发放地税局身份证书，且税务总局终端接到该证书后要经由地税局终端转发给基层单位终端，因此不多赘述。
该实施例的好处是，实现了基层单位身份证书可以由各级税务机关终端请求发放，提高证书发放的灵活性。
上述实施例的根证书授权节点201、一级证书授权节点202、二级证书授权节点203、基层单位证书授权节点204可以分别是单独的硬件设备，也可以是一个运行在硬件设备上的模块。可以多个节点同时存在于一个硬件设备上。
在一个实施例中，如图4所示，所述证书授权系统205包含一级服务器2051和二级服务器2052。
一级服务器2051是在初始化设置时投入使用，在证书授权系统205实际运行时基本停止使用的一个服务器，其上包括作为模块运行的根证书授权节点201和一级证书授权节点202。由于根证书授权节点201仅是为了生成一级证书授权节点202、二级证书授权节点203、基层单位证书授权节点204，仅在证书授权系统205初始运营时使用，而由于税务总局终端206的数量有限，因此，仅需要在初期由一级证书授权节点202为税务总局终端206发放一批税务总局身份证书即可，因此，如果一级服务器2051仅包括根证书授权节点201和一级证书授权节点202的话，其只需在初始化过程中使用，在后续投入运行时不再使用。一级服务器2051也包括其它的更低层的证书授权节点，在这种情况下，在证书授权系统205正常运行时也可以作为为地税局终端、基层单位终端进行证书授权的系统而使用，此时，如图4中，其可以包括二级证书授权节点203和业务节点单位证书授权节点2041。
二级服务器2052是在证书授权系统205正常运行时为地税局终端、基层单位终端进行证书授权的主要服务器。每个二级服务器2051可以包括二级证书授权节点203、和基层单位证书授权节点204。如图4所示，每个二级服务器2052都包括二级证书授权节点203、业务节点单位证书授权节点2041、非业务节点单位证书授权节点2042、个人证书授权节点2043。
上述实施例的优点是，一级服务器2051和二级服务器2052分开运行，使得在证书授权系统205正常运行时一级服务器2051不工作成为可能，降低了整个证书授权系统205的功耗， 同时，为一级服务器2051安装在距离各种单位和税局比较远的地方提供了可能，并提供了系统整体的利用效率。
另外，由于二级服务器2052有多个，为实现授权任务在不同二级证书授权节点、基层单位证书授权节点上的合理分配提供了基础。具体地说，可以通过均衡各二级证书授权节点、基层单位证书授权节点的处理负荷。
在该实施例中，所述证书授权系统205还包括调度节点297。调度节点297是将身份证书发放请求分配到多个二级证书授权节点中的一个或多个基层单位证书授权节点中的一个的节点。
在该实施例中，如图8所示，在步骤320之后，所述方法还包括：
步骤325、证书授权系统205通过所述调度节点，将所述地税局身份证书发放请求调度到所述多个二级服务器之一中的二级证书授权节点。
在一个实施例中，将所述地税局身份证书发放请求调度到所述多个二级服务器之一中的二级证书授权节点，包括：
获取所述多个二级服务器中的二级证书授权节点正在处理的身份证书发放请求数目；
根据获取的每个二级证书授权节点正在处理的身份证书发放请求数目，确定调度到的目标二级证书授权节点；
将所述地税局身份证书发放请求调度到所述目标二级证书授权节点。
在一个实施例中，获取所述多个二级服务器中的二级证书授权节点正在处理的身份证书发放请求数目可以采取由代理节点主动向所述多个二级服务器中的二级证书授权节点发出查询请求，由每个二级证书授权节点向代理节点返回正在处理的身份证书发放请求数目的应答的方式。
在另一个实施例中，获取所述多个二级服务器中的二级证书授权节点正在处理的身份证书发放请求数目可以采取在每个二级证书授权节点设置计数器的形式。在二级证书授权节点内部分别设置一个计数器。计数器初始置0。每当二级证书授权节点接收到一个身份证书发放请求(包括地税局身份证书发放请求、和代理节点通信身份证书发放请求)，就将计数器加1。每当二级证书授权节点完成了一个身份证书(包括地税局身份证书、和代理节点通信身份证书)的发放，就将计数器减1。这样，该计数器的值就反映了当前该二级证书授权节点正在处理的身份证书发放请求数目。代理节点直接从该计数器中可以读出该计数器对应的二级证书授权节点正在处理的身份证书发放请求数目。
在一个实施例中，根据获取的每个二级证书授权节点正在处理的身份证书发放请求数目，确定调度到的目标二级证书授权节点，包括：
将获取的正在处理的身份证书发放请求数目最少的二级证书授权节点，作为调度到的目标二级证书授权节点。
该实施例将新的地税局身份证书发放请求分配到正在处理的身份证书发放请求数目最少的二级证书授权节点，起到了均衡每个二级证书授权节点正在处理的身份证书发放请求数目的作用，而正在处理的身份证书发放请求数目代表了每个二级证书授权节点的负荷状况，因此，该实施例均衡了每个二级证书授权节点的处理负荷。
在另一个实施例中，根据获取的每个二级证书授权节点正在处理的身份证书发放请求数目，作为调度到的目标二级证书授权节点，包括：
从获取的正在处理的身份证书发放请求数目低于预定发放请求数目阈值的二级证书授权节点中任取一个，作为调度到的目标二级证书授权节点。
在该实施例中，认为正在处理的身份证书发放请求数目低于预定发放请求数目阈值，其负荷都是比较轻的，可以从中随机选取一个，作为调度到的目标二级证书授权节点。
如此在确定出目标二级证书授权节点之后，可以将所述地税局身份证书发放请求分配到所述目标二级证书授权节点进行处理。
在一个实施例中，如图8所示，在步骤340之后，所述方法还包括：
步骤345、证书授权系统205通过所述调度节点，将所述基层单位身份证书发放请求调度到所述多个基层单位证书授权节点之一中的基层单位证书授权节点。
在一个实施例中，将所述基层单位身份证书发放请求调度到所述多个二级服务器之一中的基层单位证书授权节点，包括：
获取所述多个二级服务器中的基层单位证书授权节点正在处理的基层单位身份证书发放请求数目；
根据获取的每个基层单位证书授权节点正在处理的基层单位身份证书发放请求数目，确定调度到的目标基层单位证书授权节点；
将所述基层单位身份证书发放请求调度到所述目标基层单位证书授权节点。
上述过程与前述通过所述调度节点，将所述地税局身份证书发放请求调度到所述多个二级服务器之一中的二级证书授权节点的过程类似，只不过这里是将所述基层单位身份证书发放请求调度到基层单位证书授权节点，而不是将所述地税局身份证书发放请求调度到二级证书授权节点，为节约篇幅，故不赘述。
另外，在一个实施例中，每个二级服务器2052还包括本地数据库299，用于存储二级服务器2052中的各证书授权节点(二级证书授权节点203、基层单位证书授权节点204)发放的身份证书(地税局身份证书、基层单位身份证书等)、以及各身份证书针对的发放请求。身份证书针对的发放请求是指发放该身份证书所响应的身份证书发放请求。例如，接收到税务总局终端的地税局身份证书发放请求，二级证书授权节点203发放地税局身份证书，则地税局身份证书发放请求是发放地税局身份证书针对的发放请求。
在该实施例中，在步骤330之后，所述方法还包括：
证书授权系统205将发放的地税局身份证书和该地税局身份证书针对的地税局身份证书发放请求存储在所述二级证书授权节点所在的二级服务器的本地数据库。
在该实施例中，在步骤350之后，所述方法还包括：
证书授权系统205将发放的基层单位身份证书和该基层单位身份证书针对的基层单位身份证书发放请求存储在所述基层单位证书授权节点所在的二级服务器的本地数据库；
定期将本地数据库存储的数据向所述证书授权系统的其它二级服务器的本地数据库同步。
本地数据库存储的数据是指本地服务器存储的各级身份证书和身份证书针对的发放 请求，包括上述的发放的地税局身份证书和该地税局身份证书针对的地税局身份证书发放请求、和上述的发放的基层单位身份证书和该基层单位身份证书针对的基层单位身份证书发放请求。
定期将本地数据库存储的数据向所述证书授权系统的其它二级服务器的本地数据库同步是指，每隔预定时间段将本地数据库存储的数据发送到所述证书授权系统的其它二级服务器，以便其它二级服务器保存。这样，每个二级服务器不但存储着自身发放的身份证书和针对的发放请求，还存储着证书授权系统中其它二级服务器发放的身份证书和针对的发放请求。这样做的好处是，使得证书授权系统中各二级服务器发放的身份证书中的公私钥不至于重复，每个二级服务器为证书生成公私钥时要参照存储的、该证书授权系统中所有二级服务器发放的身份证书中的公私钥，使得生成的公私钥与存储的、该证书授权系统中所有二级服务器发放的身份证书中的公私钥不同，从而实现提高发放的身份证书的权威性。
在一个实施例中，如图4所示，所述证书授权系统205还包括备份存储系统298。备份存储系统是为了防止各二级服务器2052本地存储的数据丢失无法找回而设置的备份存储空间。各二级服务器2052生成的身份证书和身份证书针对的发放请求不但存储在各二级服务器2052的本地数据库299，还在备份存储系统298中备份。这样做的好处是，一旦本地数据库299的数据丢失，就可以到备份存储系统298中找回数据。
在该实施例中，在将发放的地税局身份证书和该地税局身份证书针对的地税局身份证书发放请求存储在所述二级证书授权节点所在的二级服务器的本地数据库之后，所述方法还包括：
证书授权系统205将发放的地税局身份证书和该地税局身份证书针对的地税局身份证书发放请求备份存储到备份存储系统中与该二级服务器对应的备份存储区。
备份存储区是指备份存储系统中为各二级服务器设置的、用于存储该二级服务器的数据的区域。例如，在图4中例子中有三个二级服务器2052，相对应地，在备份存储系统中设置相应的三个备份存储区。
在该实施例中，在将发放的基层单位身份证书和该基层单位身份证书针对的基层单位身份证书发放请求存储在所述基层单位证书授权节点所在的二级服务器的本地数据库之后，所述方法还包括：
证书授权系统205将发放的基层单位身份证书和该基层单位身份证书针对的基层单位身份证书发放请求备份存储到备份存储系统中与该二级服务器对应的备份存储区；
证书授权系统205响应于所述二级服务器故障，将该二级服务器尚未服务完的地税局身份证书发放请求、基层单位身份证书发放请求，通过调度节点，分配给其它二级服务器；
证书授权系统205响应于所述二级服务器故障恢复，从备份存储系统中与该二级服务器对应的备份存储区恢复数据到该二级服务器的本地数据库。
在一个实施例中，在图4中具有调度节点297的情况下，二级服务器故障可以由调度节点297进行检测。检测的方法可以包括：调度节点297定期向各二级服务器299发出监听信号，由各二级服务器299作出监听应答；如果向二级服务器299发出监听信号之后，没有接到二 级服务器299的监听应答，则认为二级服务器299故障。
在一个实施例中，该二级服务器尚未服务完的地税局身份证书发放请求、基层单位身份证书发放请求也通过调度节点297获取。在调度节点297内部为各二级服务器299设置证书发放请求列表，列表中放置分配给二级服务器299处理的证书发放请求，每个证书发放请求有两种状态，即未处理、和处理完。当调度节点297将地税局身份证书发放请求、基层单位身份证书发放请求分配给二级服务器之前，将地税局身份证书发放请求、基层单位身份证书发放请求记录在该证书发放请求列表中，并将该证书发放请求列表的状态设置为未处理。当二级服务器299中的二级证书授权节点203和基层单位证书授权节点204响应于该证书发放请求发放了相应身份证书后，向调度节点297发出处理完成通知。调度节点297接到该处理完成通知后，将列表中相应证书发放请求的状态设置为处理完。这样，通过查找证书发放请求列表中状态为未处理的证书发放请求，就可以确定二级服务器尚未服务完的地税局身份证书发放请求、基层单位身份证书发放请求。
将二级服务器尚未服务完的地税局身份证书发放请求、基层单位身份证书发放请求，通过调度节点，分配给其它二级服务器，可以与前述实施例类似，分配给其它二级服务器中正处理的证书发放请求数最少的二级服务器，或者其它二级服务器中正处理的证书发放请求数低于预定证书发放请求数阈值的二级服务器中任意的一个，从而达到均衡处理负荷的作用。
检测所述服务器故障恢复也可以采取上述定期发监听信号的方式。如果调度节点297定期向二级服务器2052发送监听信号，没有接收到二级服务器2052的监听应答，仍然继续定期向二级服务器2052发放监听信息，当接收到二级服务器2052的监听应答时，认为二级服务器2052故障恢复。
当检测到二级服务器2052故障恢复后，将备份存储系统298中与该二级服务器2052对应的备份存储区中存储的数据，复制回该二级服务器2052的本地数据库。
通过上述实施例，达到了在二级服务器故障后，仍然能恢复其中存储的身份证书相关数据的效果，提高了证书授权系统的安全性。
在一个实施例中，如图10所示，提供了一种为税务区块链网络中的区块链节点发放身份证书的证书授权系统。所述税务区块链网络中的区块链节点包括税务总局终端、地税局终端、基层单位终端。所述证书授权系统包括：
一级证书授权节点202，向税务总局终端发放税务总局身份证书；
二级证书授权节点203，响应于来自税务总局终端的、利用所述税务总局身份证书进行的地税局身份证书发放请求，向所述税务总局终端发放地税局身份证书，以便所述税务总局终端向所述地税局终端转发所述地税局身份证书，其中，所述地税局身份证书发放请求响应于地税局终端向税务总局终端发送的注册请求而生成；
基层单位证书授权节点204，响应于来自地税局终端的、利用所述地税局身份证书进行的基层单位身份证书发放请求，向所述地税局终端发放基层单位身份证书，以便所述地税局终端向所述基层单位终端转发所述基层单位身份证书，其中，所述基层单位身份证书发放请求响应于基层单位终端向已具有所述地税局身份证书的所述地税局终端发送的注册 请求而生成。
在一个实施例中，所述证书授权系统还包括根证书授权节点，其中，所述根证书授权节点在一级证书授权节点202向税务总局终端发放税务总局身份证书之前生成，而且所述根证书授权节点用于生成根证书，并基于所述根证书，生成所述一级证书授权节点、所述二级证书授权节点、和所述基层单位证书授权节点。
在一个实施例中，所述基层单位证书授权节点204包括业务节点单位的证书授权节点、非业务节点单位的证书授权节点、个人的证书授权节点。所述基层单位终端包括业务节点单位终端、非业务节点单位终端、个人终端。所述基层单位身份证书包括业务节点单位身份证书、非业务节点单位身份证书、个人身份证书。所述税务区块链网络中的区块链节点还包括代理节点。
在该实施例中，业务节点单位的证书授权节点用于：如果所述基层单位身份证书发放请求针对业务节点单位，向所述地税局终端发放业务节点单位身份证书，以便所述地税局终端向所述业务节点单位终端转发所述业务节点单位身份证书，所述业务节点单位身份证书用于所述业务节点与所述代理节点之间上链信息的通信。
在该实施例中，非业务节点单位的证书授权节点用于：如果所述基层单位身份证书发放请求针对非业务节点单位，向所述地税局终端发放非业务节点单位身份证书，以便所述地税局终端向所述非业务节点单位终端转发所述非业务节点单位身份证书，所述非业务节点单位身份证书用于所述非业务节点单位终端与业务节点单位终端之间所述上链信息的基础信息的传递；
在该实施例中，个人的证书授权节点用于：如果所述基层单位身份证书发放请求针对个人，向所述地税局终端发放个人身份证书，以便所述地税局终端向所述个人终端转发所述个人身份证书，所述个人身份证书用于在个人终端与业务节点单位终端之间所述上链信息的基础信息的传递。
在一个实施例中，所述一级证书授权节点202还用于向代理节点发放代理节点启动身份证书；所述二级证书授权节点203还用于：接收来自代理节点的、利用所述代理节点启动身份证书进行的代理节点通信身份证书发放请求；通过所述二级证书授权节点，向所述代理节点发放代理节点通信身份证书，所述代理节点通信身份证书用于与所述业务节点进行通信。
在一个实施例中，所述二级证书授权节点203进一步用于：
接收来自税务总局终端的、利用所述税务总局身份证书进行的基层单位身份证书发放请求，所述基层单位身份证书发放请求响应于基层单位终端经由地税局终端向税务总局终端发送的注册请求而生成；
向所述税务总局终端发放基层单位身份证书，以便所述税务总局终端经由所述地税局终端向所述基层单位终端转发所述基层单位身份证书。
在一个实施例中，一级证书授权节点202进一步用于：
生成税务总局终端的公钥和私钥；
为所述税务总局终端生成税务总局身份证书，所述税务总局身份证书中含有税务总局 终端的公钥；
将所述税务总局身份证书和所述税务总局终端的私钥发送给所述税务总局终端。
在该实施例中，二级证书授权节点203进一步用于：
接收来自税务总局终端的所述税务总局身份证书；
接收来自税务总局终端的所述地税局身份证书发放请求，所述地税局身份证书发放请求包含所述地税局的注册信息和用所述税务总局的私钥对所述地税局的注册信息的签名；
用所述税务总局身份证书中的所述税务总局的公钥，对所述地税局身份证书发放请求中的签名进行验证。
在该实施例中，二级证书授权节点203进一步用于：
对所述注册信息进行认证；
如果认证通过，为所述地税局终端生成地税局终端的公钥和私钥；
为所述地税局终端生成地税局身份证书，所述地税局身份证书含有所述地税局终端的公钥；
向所述税务总局终端发送所述地税局身份证书和所述地税局终端的私钥，以便所述税务总局终端向所述地税局终端转发所述地税局身份证书和所述地税局终端的私钥，所述地税局身份证书和所述地税局终端的私钥用于所述地税局终端与所述税务区块链网络中的其它区块链节点通信。
在一个实施例中，基层单位证书授权节点204进一步用于：
接收来自地税局终端的所述地税局身份证书；
接收来自地税局终端的所述基层单位身份证书发放请求，所述基层单位身份证书发放请求包含所述基层单位的注册信息和用所述地税局的私钥对所述基层单位的注册信息的签名；
用所述地税局身份证书中的所述地税局的公钥，对所述基层单位身份证书发放请求中的签名进行验证。
在一个实施例中，基层单位证书授权节点204进一步用于：
对所述基层单位的注册信息进行认证；
如果认证通过，为所述基层单位终端生成基层单位终端的公钥和私钥；
为所述基层单位终端生成基层单位身份证书，所述基层单位身份证书含有所述基层单位终端的公钥；
向所述地税局终端发送所述基层单位身份证书和所述基层单位终端的私钥，以便所述地税局终端向所述基层单位终端转发所述基层单位身份证书和所述基层单位终端的私钥，所述基层单位身份证书和所述基层单位终端的私钥用于所述基层单位终端与所述税务区块链网络中的其它区块链节点通信。
在一个实施例中，所述一级证书授权节点202进一步用于：
生成代理节点的启动公钥和启动私钥；
为所述代理节点生成代理节点启动身份证书，所述代理节点身份证书中含有代理节点的启动公钥；
将所述代理节点启动身份证书和所述代理节点的启动私钥发送给所述代理节点。
在该实施例中，所述二级证书授权节点203进一步用于：
接收来自代理节点的所述代理节点启动身份证书；
接收来自代理节点的所述代理节点通信身份证书发放请求，所述代理节点通信身份证书发放请求包含所述代理节点的注册信息和用所述代理节点的启动私钥对所述代理节点的注册信息的签名；
用所述代理节点启动身份证书中的所述代理节点的启动公钥，对所述代理节点通信身份证书发放请求中的签名进行验证；
对所述代理节点的注册信息进行认证；
如果认证通过，为所述代理节点生成代理节点的通信公钥和通信私钥；
为所述代理节点生成代理节点通信身份证书，所述代理节点通信身份证书含有所述代理节点的通信公钥；
向所述代理节点发送所述代理节点通信身份证书和所述代理节点的通信私钥，所述代理节点通信身份证书和所述代理节点的通信私钥用于所述代理节点与业务节点通信。
在一个实施例中，所述证书授权系统包含一级服务器和二级服务器，其中，所述一级服务器包括所述根证书授权节点和所述一级证书授权节点，所述二级服务器包括所述二级证书授权节点、和所述基层单位证书授权节点。
在一个实施例中，所述证书授权系统包括的二级服务器有多个，其中每个二级服务器包括所述二级证书授权节点、和所述基层单位证书授权节点，所述证书授权系统还包括调度节点，所述调度节点用于：
在接收来自税务总局终端的、利用所述税务总局身份证书进行的地税局身份证书发放请求之后，将所述地税局身份证书发放请求调度到所述多个二级服务器之一中的二级证书授权节点；
在接收来自地税局终端的、利用所述地税局身份证书进行的基层单位身份证书发放请求之后，将所述基层单位身份证书发放请求调度到所述多个二级服务器之一中的基层单位证书授权节点。
在一个实施例中，每个二级服务器还包括本地数据库，所述本地数据库用于：
在通过本地数据库所在的二级服务器中的二级证书授权节点，向所述税务总局终端发放地税局身份证书之后，存储发放的地税局身份证书和该地税局身份证书针对的地税局身份证书发放请求；
在通过本地数据库所在的二级服务器中的基层单位证书授权节点，向所述地税局终端发放基层单位身份证书之后，存储发放的基层单位身份证书和该基层单位身份证书针对的基层单位身份证书发放请求，其中，本地数据库存储的数据定期向所述证书授权系统的其它二级服务器的本地数据库同步。
在一个实施例中，所述证书授权系统还包括备份存储系统，所述备份存储系统包括与每个二级服务器对应的备份存储区，用于：
在将发放的地税局身份证书和该地税局身份证书针对的地税局身份证书发放请求存储 在所述二级证书授权节点所在的二级服务器的本地数据库之后，存储备份过来的地税局身份证书和该地税局身份证书针对的地税局身份证书发放请求；
在将发放的基层单位身份证书和该基层单位身份证书针对的基层单位身份证书发放请求存储在所述基层单位证书授权节点所在的二级服务器的本地数据库之后，存储备份过来的基层单位身份证书和该基层单位身份证书针对的基层单位身份证书发放请求，其中，响应于所述二级服务器故障，将该二级服务器尚未服务完的地税局身份证书发放请求、基层单位身份证书发放请求，通过调度节点，分配给其它二级服务器；响应于所述二级服务器故障恢复，从备份存储系统中与该二级服务器对应的备份存储区恢复数据到该二级服务器的本地数据库。
图2中的根证书授权节点201、一级证书授权节点202、二级证书授权节点203、业务节点单位证书授权节点2041、非业务节点单位证书授权节点2042、个人证书授权节点2043的每一个可以作为单独的一个硬件设备由图11的计算机设备800实现。另外，根证书授权节点201、一级证书授权节点202、二级证书授权节点203、业务节点单位证书授权节点2041、非业务节点单位证书授权节点2042、个人证书授权节点2043可以分别作为一个功能模块存储在同一个硬件设备上，该硬件设备作为图11的计算机设备800实现。
下面参照图11来描述根据本申请实施例的计算机设备800。图11显示的计算机设备800仅仅是一个示例，不应对本申请实施例的功能和使用范围带来任何限制。
如图11所示，计算机设备800以通用计算设备的形式表现。计算机设备800的组件可以包括但不限于：上述至少一个处理单元810、上述至少一个存储单元820、连接不同系统组件(包括存储单元820和处理单元810)的总线830。
其中，所述存储单元存储有程序代码，所述程序代码可以被所述处理单元810执行，使得所述处理单元810执行本说明书上述示例性方法的描述部分中描述的根据本申请各种示例性实施方式的步骤。例如，所述处理单元810可以执行如图5中所示的各个步骤。
存储单元820可以包括易失性存储单元形式的可读介质，例如随机存取存储单元(RAM)8201和/或高速缓存存储单元8202，还可以进一步包括只读存储单元(ROM)8203。
存储单元820还可以包括具有一组(至少一个)程序模块8205的程序/实用工具8204，这样的程序模块8205包括但不限于：操作系统、一个或者多个应用程序、其它程序模块以及程序数据，这些示例中的每一个或某种组合中可能包括网络环境的实现。
总线830可以为表示几类总线结构中的一种或多种，包括存储单元总线或者存储单元控制器、外围总线、图形加速端口、处理单元或者使用多种总线结构中的任意总线结构的局域总线。
计算机设备800也可以与一个或多个外部设备700(例如键盘、指向设备、蓝牙设备等)通信，还可与一个或者多个使得用户能与该计算机设备800交互的设备通信，和/或与使得该计算机设备800能与一个或多个其它计算设备进行通信的任何设备(例如路由器、调制解调器等等)通信。这种通信可以通过输入/输出(I/O)接口850进行。并且，计算机设备800还可以通过网络适配器860与一个或者多个网络(例如局域网(LAN)， 广域网(WAN)和/或公共网络，例如因特网)通信。如图所示，网络适配器860通过总线830与计算机设备800的其它模块通信。应当明白，尽管图中未示出，可以结合计算机设备800使用其它硬件和/或软件模块，包括但不限于：微代码、设备驱动器、冗余处理单元、外部磁盘驱动阵列、RAID系统、磁带驱动器以及数据备份存储系统等。
另外，本申请实施例还提供了一种存储介质，存储介质用于存储计算机程序，计算机程序用于执行上述实施例提供的为税务区块链网络中的区块链节点发放身份证书的方法。
本申请实施例还提供了一种包括指令的计算机程序产品，当其在服务器上运行时，使得服务器执行上述实施例提供的为税务区块链网络中的区块链节点发放身份证书的方法。
通过以上的实施方式的描述，本领域的技术人员易于理解，这里描述的示例实施方式可以通过软件实现，也可以通过软件结合必要的硬件的方式来实现。因此，根据本申请实施方式的技术方案可以以软件产品的形式体现出来，该软件产品可以存储在一个非易失性存储介质(可以是CD-ROM，U盘，移动硬盘等)中或网络上，包括若干指令以使得一台计算设备(可以是个人计算机、服务器、终端装置、或者网络设备等)执行根据本申请实施方式的方法。
在本申请的示例性实施例中，还提供了一种计算机程序介质，其上存储有计算机可读指令，当所述计算机可读指令被计算机的处理器执行时，使计算机执行上述方法实施例部分描述的方法。
根据本申请的一个实施例，还提供了一种用于实现上述方法实施例中的方法的程序产品，其可以采用便携式紧凑盘只读存储器(CD-ROM)并包括程序代码，并可以在终端设备，例如个人电脑上运行。然而，本申请的程序产品不限于此，在本文件中，可读存储介质可以是任何包含或存储程序的有形介质，该程序可以被指令执行系统、装置或者器件使用或者与其结合使用。
所述程序产品可以采用一个或多个可读介质的任意组合。可读介质可以是可读信号介质或者可读存储介质。可读存储介质例如可以为但不限于电、磁、光、电磁、红外线、或半导体的系统、装置或器件，或者任意以上的组合。可读存储介质的更具体的例子(非穷举的列表)包括：具有一个或多个导线的电连接、便携式盘、硬盘、随机存取存储器(RAM)、只读存储器(ROM)、可擦式可编程只读存储器(EPROM或闪存)、光纤、便携式紧凑盘只读存储器(CD-ROM)、光存储器件、磁存储器件、或者上述的任意合适的组合。
计算机可读信号介质可以包括在基带中或者作为载波一部分传播的数据信号，其中承载了可读程序代码。这种传播的数据信号可以采用多种形式，包括但不限于电磁信号、光信号或上述的任意合适的组合。可读信号介质还可以是可读存储介质以外的任何可读介质，该可读介质可以发送、传播或者传输用于由指令执行系统、装置或者器件使用或者与其结合使用的程序。
可读介质上包含的程序代码可以用任何适当的介质传输，包括但不限于无线、有线、光缆、RF等等，或者上述的任意合适的组合。
可以以一种或多种程序设计语言的任意组合来编写用于执行本申请操作的程序代码，所述程序设计语言包括面向对象的程序设计语言—诸如Java、C++等，还包括常规的 过程式程序设计语言—诸如“C”语言或类似的程序设计语言。程序代码可以完全地在用户计算设备上执行、部分地在用户设备上执行、作为一个独立的软件包执行、部分在用户计算设备上部分在远程计算设备上执行、或者完全在远程计算设备或服务器上执行。在涉及远程计算设备的情形中，远程计算设备可以通过任意种类的网络，包括局域网(LAN)或广域网(WAN)，连接到用户计算设备，或者，可以连接到外部计算设备(例如利用因特网服务提供商来通过因特网连接)。
应当注意，尽管在上文详细描述中提及了用于动作执行的设备的若干模块或者单元，但是这种划分并非强制性的。实际上，根据本申请的实施方式，上文描述的两个或更多模块或者单元的特征和功能可以在一个模块或者单元中具体化。反之，上文描述的一个模块或者单元的特征和功能可以进一步划分为由多个模块或者单元来具体化。
此外，尽管在附图中以特定顺序描述了本申请中方法的各个步骤，但是，这并非要求或者暗示必须按照该特定顺序来执行这些步骤，或是必须执行全部所示的步骤才能实现期望的结果。附加的或备选的，可以省略某些步骤，将多个步骤合并为一个步骤执行，以及/或者将一个步骤分解为多个步骤执行等。
通过以上的实施方式的描述，本领域的技术人员易于理解，这里描述的示例实施方式可以通过软件实现，也可以通过软件结合必要的硬件的方式来实现。因此，根据本申请实施方式的技术方案可以以软件产品的形式体现出来，该软件产品可以存储在一个非易失性存储介质(可以是CD-ROM，U盘，移动硬盘等)中或网络上，包括若干指令以使得一台计算设备(可以是个人计算机、服务器、移动终端、或者网络设备等)执行根据本申请实施方式的方法。
本领域技术人员在考虑说明书及实践这里公开的实施例后，将容易想到本申请的其它实施方案。本申请旨在涵盖本申请的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本申请的一般性原理并包括本申请未公开的本技术领域中的公知常识或惯用技术手段。说明书和实施例仅被视为示例性的，本申请的真正范围和精神由所附的权利要求指出。

Claims (16)

  1. 一种为税务区块链网络中的区块链节点发放身份证书的方法，所述税务区块链网络中的区块链节点包括税务总局终端、地税局终端、基层单位终端，所述方法由证书授权系统执行，所述证书授权系统包括一级证书授权节点、二级证书授权节点、和基层单位证书授权节点，所述方法包括：
    通过所述一级证书授权节点，向税务总局终端发放税务总局身份证书；
    接收来自税务总局终端的、利用所述税务总局身份证书进行的地税局身份证书发放请求，所述地税局身份证书发放请求响应于地税局终端向税务总局终端发送的注册请求而生成；
    通过所述二级证书授权节点，向所述税务总局终端发放地税局身份证书，以便所述税务总局终端向所述地税局终端转发所述地税局身份证书；
    接收来自地税局终端的、利用所述地税局身份证书进行的基层单位身份证书发放请求，所述基层单位身份证书发放请求响应于基层单位终端向已具有所述地税局身份证书的所述地税局终端发送的注册请求而生成；
    通过所述基层单位证书授权节点，向所述地税局终端发放基层单位身份证书，以便所述地税局终端向所述基层单位终端转发所述基层单位身份证书。
  2. 根据权利要求1所述的方法，所述证书授权系统还包括根证书授权节点，在通过所述一级证书授权节点，向税务总局终端发放税务总局身份证书之前，所述方法还包括：
    生成所述根证书授权节点；
    通过所述根证书授权节点，生成根证书；
    基于所述根证书，生成所述一级证书授权节点、所述二级证书授权节点、和所述基层单位证书授权节点。
  3. 根据权利要求1所述的方法，所述基层单位证书授权节点包括业务节点单位的证书授权节点、非业务节点单位的证书授权节点、个人的证书授权节点，所述基层单位终端包括业务节点单位终端、非业务节点单位终端、个人终端，所述基层单位身份证书包括业务节点单位身份证书、非业务节点单位身份证书、个人身份证书，所述税务区块链网络中的区块链节点还包括代理节点，
    所述向所述地税局终端发放基层单位身份证书，以便所述地税局终端向所述基层单位终端转发所述基层单位身份证书，包括：
    如果所述基层单位身份证书发放请求针对业务节点单位，向所述地税局终端发放业务节点单位身份证书，以便所述地税局终端向所述业务节点单位终端转发所述业务节点单位身份证书，所述业务节点单位身份证书用于所述业务节点与所述代理节点之间上链信息的通信；
    如果所述基层单位身份证书发放请求针对非业务节点单位，向所述地税局终端发放非业务节点单位身份证书，以便所述地税局终端向所述非业务节点单位终端转发所述非业务节点单位身份证书，所述非业务节点单位身份证书用于所述非业务节点单位终端与业务节点单位终端之间所述上链信息的基础信息的传递；
    如果所述基层单位身份证书发放请求针对个人，向所述地税局终端发放个人身份证书，以便所述地税局终端向所述个人终端转发所述个人身份证书，所述个人身份证书用于在个人终端与业务节点单位终端之间所述上链信息的基础信息的传递。
  4. 根据权利要求3所述的方法，所述方法还包括：
    通过所述一级证书授权节点，向代理节点发放代理节点启动身份证书；
    接收来自代理节点的、利用所述代理节点启动身份证书进行的代理节点通信身份证书发放请求；
    通过所述二级证书授权节点，向所述代理节点发放代理节点通信身份证书，所述代理节点通信身份证书用于与所述业务节点进行通信。
  5. 根据权利要求1所述的方法，在通过所述一级证书授权节点，向税务总局终端发放税务总局身份证书之后，所述方法还包括：
    接收来自税务总局终端的、利用所述税务总局身份证书进行的基层单位身份证书发放请求，所述基层单位身份证书发放请求响应于基层单位终端经由地税局终端向税务总局终端发送的注册请求而生成；
    通过所述基层单位证书授权节点，向所述税务总局终端发放基层单位身份证书，以便所述税务总局终端经由所述地税局终端向所述基层单位终端转发所述基层单位身份证书。
  6. 根据权利要求1所述的方法，所述通过所述一级证书授权节点，向税务总局终端发放税务总局身份证书，包括：
    通过所述一级证书授权节点，生成税务总局终端的公钥和私钥；
    为所述税务总局终端生成税务总局身份证书，所述税务总局身份证书中含有税务总局终端的公钥；
    将所述税务总局身份证书和所述税务总局终端的私钥发送给所述税务总局终端，
    所述接收来自税务总局终端的、利用所述税务总局身份证书进行的地税局身份证书发放请求，包括：
    接收来自税务总局终端的所述税务总局身份证书；
    接收来自税务总局终端的所述地税局身份证书发放请求，所述地税局身份证书发放请求包含所述地税局的注册信息和用所述税务总局的私钥对所述地税局的注册信息的签名；
    用所述税务总局身份证书中的所述税务总局的公钥，对所述地税局身份证书发放请求中的签名进行验证。
  7. 根据权利要求1所述的方法，所述通过所述二级证书授权节点，向所述税务总局终端发放地税局身份证书，以便所述税务总局终端向所述地税局终端转发所述地税局身份证书，包括：
    通过所述二级证书授权节点，对所述注册信息进行认证；
    如果认证通过，为所述地税局终端生成地税局终端的公钥和私钥；
    为所述地税局终端生成地税局身份证书，所述地税局身份证书含有所述地税局终端的公钥；
    向所述税务总局终端发送所述地税局身份证书和所述地税局终端的私钥，以便所述税 务总局终端向所述地税局终端转发所述地税局身份证书和所述地税局终端的私钥，所述地税局身份证书和所述地税局终端的私钥用于所述地税局终端与所述税务区块链网络中的其它区块链节点通信。
  8. 根据权利要求7所述的方法，所述地税局终端与所述税务区块链网络中的其它区块链节点通信包括：
    所述地税局终端向所述其它区块链节点发送所述地税局身份证书；
    所述地税局终端将要向所述其它区块链节点发送的内容用所述地税局终端的私钥签名；
    所述地税局终端将所述内容和所述签名一起发送到所述其它区块链节点，以便所述其它区块链节点用所述地税局身份证书中的公钥对所述签名验证。
  9. 根据权利要求7所述的方法，所述接收来自地税局终端的、利用所述地税局身份证书进行的基层单位身份证书发放请求，包括：
    接收来自地税局终端的所述地税局身份证书；
    接收来自地税局终端的所述基层单位身份证书发放请求，所述基层单位身份证书发放请求包含所述基层单位的注册信息和用所述地税局的私钥对所述基层单位的注册信息的签名；
    用所述地税局身份证书中的所述地税局的公钥，对所述基层单位身份证书发放请求中的签名进行验证。
  10. 根据权利要求1所述的方法，所述通过所述基层单位证书授权节点，向所述地税局终端发放基层单位身份证书，以便所述地税局终端向所述基层单位终端转发所述基层单位身份证书，包括：
    通过所述基层单位证书授权节点，对所述基层单位的注册信息进行认证；
    如果认证通过，为所述基层单位终端生成基层单位终端的公钥和私钥；
    为所述基层单位终端生成基层单位身份证书，所述基层单位身份证书含有所述基层单位终端的公钥；
    向所述地税局终端发送所述基层单位身份证书和所述基层单位终端的私钥，以便所述地税局终端向所述基层单位终端转发所述基层单位身份证书和所述基层单位终端的私钥，所述基层单位身份证书和所述基层单位终端的私钥用于所述基层单位终端与所述税务区块链网络中的其它区块链节点通信。
  11. 根据权利要求10所述的方法，所述基层单位终端与所述税务区块链网络中的其它区块链节点通信包括：
    所述基层单位终端向所述其它区块链节点发送所述基层单位身份证书；
    所述基层单位终端将要向所述其它区块链节点发送的内容用所述基层单位终端的私钥签名；
    所述基层单位终端将所述内容和所述签名一起发送到所述其它区块链节点，以便所述其它区块链节点用所述基层单位身份证书中的公钥对所述签名验证。
  12. 根据权利要求4所述的方法，所述通过所述一级证书授权节点，向代理节点发放 代理节点启动身份证书，包括：
    通过所述一级证书授权节点，生成代理节点的启动公钥和启动私钥；
    为所述代理节点生成代理节点启动身份证书，所述代理节点身份证书中含有代理节点的启动公钥；
    将所述代理节点启动身份证书和所述代理节点的启动私钥发送给所述代理节点，
    所述接收来自代理节点的、利用所述代理节点启动身份证书进行的代理节点通信身份证书发放请求，包括：
    接收来自代理节点的所述代理节点启动身份证书；
    接收来自代理节点的所述代理节点通信身份证书发放请求，所述代理节点通信身份证书发放请求包含所述代理节点的注册信息和用所述代理节点的启动私钥对所述代理节点的注册信息的签名；
    用所述代理节点启动身份证书中的所述代理节点的启动公钥，对所述代理节点通信身份证书发放请求中的签名进行验证，
    所述通过所述二级证书授权节点，向所述代理节点发放代理节点通信身份证书，包括：
    通过所述二级证书授权节点，对所述代理节点的注册信息进行认证；
    如果认证通过，为所述代理节点生成代理节点的通信公钥和通信私钥；
    为所述代理节点生成代理节点通信身份证书，所述代理节点通信身份证书含有所述代理节点的通信公钥；
    向所述代理节点发送所述代理节点通信身份证书和所述代理节点的通信私钥，所述代理节点通信身份证书和所述代理节点的通信私钥用于所述代理节点与业务节点通信。
  13. 一种为税务区块链网络中的区块链节点发放身份证书的证书授权系统，所述税务区块链网络中的区块链节点包括税务总局终端、地税局终端、基层单位终端，所述证书授权系统包括：
    一级证书授权节点，向税务总局终端发放税务总局身份证书；
    二级证书授权节点，响应于来自税务总局终端的、利用所述税务总局身份证书进行的地税局身份证书发放请求，向所述税务总局终端发放地税局身份证书，以便所述税务总局终端向所述地税局终端转发所述地税局身份证书，其中，所述地税局身份证书发放请求响应于地税局终端向税务总局终端发送的注册请求而生成；
    基层单位证书授权节点，响应于来自地税局终端的、利用所述地税局身份证书进行的基层单位身份证书发放请求，向所述地税局终端发放基层单位身份证书，以便所述地税局终端向所述基层单位终端转发所述基层单位身份证书，其中，所述基层单位身份证书发放请求响应于基层单位终端向已具有所述地税局身份证书的所述地税局终端发送的注册请求而生成。
  14. 一种计算机设备，包括：
    存储器，存储有计算机可读指令；
    处理器，读取存储器存储的计算机可读指令，以执行权利要求1-12中的任一个所述的方法。
  15. 一种存储介质，其特征在于，所述存储介质包括存储的程序，其中，所述程序运行时执行上述权利要求1-12任一项中所述的方法。
  16. 一种包括指令的计算机程序产品，当其在计算机上运行时，使得所述计算机执行权利要求1-12任意一项所述的方法。
PCT/CN2020/075467 2019-03-07 2020-02-17 为区块链节点发放身份证书的方法及相关装置 WO2020177518A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
JP2021518649A JP7113138B2 (ja) 2019-03-07 2020-02-17 ブロックチェーンノードへのアイデンティティ証明書の発行方法及び関連装置
US17/337,029 US11943373B2 (en) 2019-03-07 2021-06-02 Method for issuing identity certificate to blockchain node and related apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910173224.5A CN109948371B (zh) 2019-03-07 2019-03-07 为区块链节点发放身份证书的方法及相关装置
CN201910173224.5 2019-03-07

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/337,029 Continuation US11943373B2 (en) 2019-03-07 2021-06-02 Method for issuing identity certificate to blockchain node and related apparatus

Publications (1)

Publication Number Publication Date
WO2020177518A1 true WO2020177518A1 (zh) 2020-09-10

Family

ID=67008650

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/075467 WO2020177518A1 (zh) 2019-03-07 2020-02-17 为区块链节点发放身份证书的方法及相关装置

Country Status (4)

Country Link
US (1) US11943373B2 (zh)
JP (1) JP7113138B2 (zh)
CN (1) CN109948371B (zh)
WO (1) WO2020177518A1 (zh)

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110458582B (zh) * 2019-01-29 2023-12-12 深圳市智税链科技有限公司 基于区块链系统的业务处理方法、装置、介质及电子设备
CN109948371B (zh) * 2019-03-07 2021-06-25 深圳市智税链科技有限公司 为区块链节点发放身份证书的方法及相关装置
CN110290144B (zh) * 2019-07-01 2022-02-25 深圳市元征科技股份有限公司 一种用户权限信息更新方法、系统、存储介质及电子设备
CN110535659B (zh) * 2019-09-03 2020-11-03 北京海益同展信息科技有限公司 用于处理数据请求的方法、装置、电子设备和计算机可读介质
CN110598375B (zh) * 2019-09-20 2021-03-16 腾讯科技（深圳）有限公司 一种数据处理方法、装置及存储介质
CN110958118B (zh) * 2019-10-12 2021-09-28 深圳赛安特技术服务有限公司 证书认证管理方法、装置、设备及计算机可读存储介质
CN112231741B (zh) * 2020-12-14 2021-03-19 腾讯科技（深圳）有限公司 基于区块链系统的数据处理方法、装置、介质及电子设备
CN113472783B (zh) * 2021-06-30 2023-04-07 杭州云象网络技术有限公司 区块链密码证书服务方法、系统、存储介质及装置
CN113626850B (zh) * 2021-10-13 2022-03-11 北京百度网讯科技有限公司 基于联盟链的请求处理方法、装置、设备和存储介质
CN113867690B (zh) * 2021-12-07 2022-03-04 中移(上海)信息通信科技有限公司 一种区块链中随机数的生成方法、装置及区块链节点
CN115102695A (zh) * 2022-06-16 2022-09-23 西安电子科技大学 基于区块链的车联网证书认证方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107426157A (zh) * 2017-04-21 2017-12-01 杭州趣链科技有限公司 一种基于数字证书以及ca认证体系的联盟链权限控制方法
CN107592293A (zh) * 2017-07-26 2018-01-16 阿里巴巴集团控股有限公司 区块链节点间通讯方法、数字证书管理方法、装置和电子设备
CN108881252A (zh) * 2018-06-28 2018-11-23 腾讯科技（深圳）有限公司 身份认证数据处理方法、装置、计算机设备和存储介质
CN109948371A (zh) * 2019-03-07 2019-06-28 深圳市智税链科技有限公司 为区块链节点发放身份证书的方法及相关装置

Family Cites Families (27)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
SE327364B (zh) * 1966-01-17 1970-08-17 Akerlund & Rausing Ab
JPH10215245A (ja) * 1997-01-29 1998-08-11 Nippon Telegr & Teleph Corp <Ntt> 公開鍵認証方法
ES2432018T3 (es) * 2008-08-06 2013-11-29 Eli Lilly And Company Anticuerpos selectivos anti-hepcidina-25 y usos de los mismos
US9676845B2 (en) * 2009-06-16 2017-06-13 Hoffmann-La Roche, Inc. Bispecific antigen binding proteins
US8342458B2 (en) * 2009-07-14 2013-01-01 Daniel Robert Shepard Electric device cord handler
JP2011191562A (ja) * 2010-03-15 2011-09-29 Seiko Instruments Inc 駆動モジュール及び電子機器
CN105635049B (zh) * 2014-10-29 2019-07-09 航天信息股份有限公司 基于客户端标识密码的防伪税控方法和装置
US10079682B2 (en) * 2015-12-22 2018-09-18 Gemalto Sa Method for managing a trusted identity
US10547457B1 (en) * 2016-10-21 2020-01-28 Wells Fargo Bank N.A. Systems and methods for notary agent for public key infrastructure names
CN106452796B (zh) * 2016-11-29 2019-07-16 深圳微众税银信息服务有限公司 认证授权方法、涉税业务平台和相关设备
KR101877333B1 (ko) * 2017-01-02 2018-08-09 주식회사 코인플러그 블록체인 기반의 모바일 아이디를 이용하여 사용자를 비대면 인증하는 방법, 단말 및 이를 이용한 서버
CN113435994A (zh) * 2017-03-31 2021-09-24 唐晓领 基于区块链的金融借贷多方共享交易元数据信息的方法、装置及系统
JP6340107B1 (ja) * 2017-04-10 2018-06-06 アイビーシー株式会社 電子証明システム
KR101919590B1 (ko) * 2017-05-10 2019-02-08 주식회사 코인플러그 블록체인 데이터베이스 및 이와 연동하는 머클 트리 구조를 통해 사물 인터넷 기기에 대한 비용을 결제하는 방법, 이를 이용한 서버, 서비스 제공 단말, 및 사용자 전자 지갑
CN107425981B (zh) * 2017-06-12 2020-11-03 湖南岳麓山数据科学与技术研究院有限公司 一种基于区块链的数字证书管理方法及系统
CN108234457A (zh) * 2017-12-18 2018-06-29 苏州涞泽信息科技有限公司 一种基于区块链的可信政务数据共享网络系统及共享方法
CN108200046B (zh) 2017-12-28 2020-12-08 新华三技术有限公司 终端设备的注册方法、装置、终端设备和代理服务器
US11063760B2 (en) * 2018-08-22 2021-07-13 Sasken Technologies Ltd Method for ensuring security of an internet of things network
CN109325359B (zh) * 2018-09-03 2023-06-02 平安科技（深圳）有限公司 账户体系设置方法、系统、计算机设备和存储介质
JP6824366B2 (ja) * 2018-12-05 2021-02-03 株式会社デンソーエアシステムズ 内部熱交換器及び内部熱交換器を備える冷凍サイクル装置
CN110011988B (zh) * 2019-03-21 2021-08-10 平安科技（深圳）有限公司 基于区块链的证书验证方法及装置、存储介质、电子装置
CN110189190B (zh) * 2019-04-25 2024-01-26 平安科技（深圳）有限公司 基于区块链的招标方法、装置、计算机设备和存储介质
CN111222174A (zh) * 2019-12-31 2020-06-02 远光软件股份有限公司 区块链节点的加入方法、验证方法、设备和存储介质
WO2021172684A1 (ko) * 2020-02-28 2021-09-02 엘지전자 주식회사 전송 계층 보안을 위한 방법 및 장치
EP4027677A4 (en) * 2020-11-27 2022-08-17 CloudMinds Robotics Co., Ltd. SYSTEM, METHOD, STORAGE MEDIA AND EQUIPMENT FOR MOBILE NETWORK ACCESS
CN114755790A (zh) * 2020-12-29 2022-07-15 新思考电机有限公司 透镜驱动装置、照相机装置以及电子设备
CN115146320A (zh) * 2021-03-31 2022-10-04 华为技术有限公司 一种证书查询方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107426157A (zh) * 2017-04-21 2017-12-01 杭州趣链科技有限公司 一种基于数字证书以及ca认证体系的联盟链权限控制方法
CN107592293A (zh) * 2017-07-26 2018-01-16 阿里巴巴集团控股有限公司 区块链节点间通讯方法、数字证书管理方法、装置和电子设备
CN108881252A (zh) * 2018-06-28 2018-11-23 腾讯科技（深圳）有限公司 身份认证数据处理方法、装置、计算机设备和存储介质
CN109948371A (zh) * 2019-03-07 2019-06-28 深圳市智税链科技有限公司 为区块链节点发放身份证书的方法及相关装置

Also Published As

Publication number Publication date
JP2022522386A (ja) 2022-04-19
US20210288819A1 (en) 2021-09-16
CN109948371B (zh) 2021-06-25
JP7113138B2 (ja) 2022-08-04
US11943373B2 (en) 2024-03-26
CN109948371A (zh) 2019-06-28

Similar Documents

Publication Publication Date Title
WO2020177518A1 (zh) 为区块链节点发放身份证书的方法及相关装置
US11025435B2 (en) System and method for blockchain-based cross-entity authentication
JP7461417B2 (ja) セキュアなオフチェーンのブロックチェーントランザクション
EP3540628B1 (en) Mechanism for efficient validation of finality proof in lightweight distributed ledger clients
US10756885B2 (en) System and method for blockchain-based cross entity authentication
US20240144280A1 (en) Blockchain architecture with record security
WO2021000420A1 (en) System and method for blockchain-based cross-entity authentication
US9083702B2 (en) System and method for providing internal services to external enterprises
JP2019160312A (ja) ブロックチェーン・ノード、ブロックチェーン・ノードの方法、およびブロックチェーン・ノードのコンピュータ・プログラム
EP3788523A1 (en) System and method for blockchain-based cross-entity authentication
TWI720918B (zh) 基於錯誤校正碼之共用區塊鏈資料儲存的共識
CN110754061A (zh) 用于避免或减少区块链网络上的加密滞留资源的系统和方法
US20220084031A1 (en) Backend architecture method and system for aggregate payment, computer device, and storage medium
TW202119243A (zh) 優先化共用區塊鏈資料儲存
US11917088B2 (en) Integrating device identity into a permissioning framework of a blockchain
US20220156725A1 (en) Cross-chain settlement mechanism
CN110635915B (zh) 一种基于多ca的高并发数字证书注册管理方法
CN110276693B (zh) 保险理赔方法及系统
CN112187453A (zh) 一种数字证书更新方法、系统、电子设备和可读存储介质
US20230068597A1 (en) Cryptocurrency system and method for performing financial transactions
CN117220884A (zh) 一种数字签名交互验证方法、系统、设备和介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20766133

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2021518649

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20766133

Country of ref document: EP

Kind code of ref document: A1