WO2020186788A1 - 基于区块链的证书验证方法及装置、存储介质、电子装置 - Google Patents

基于区块链的证书验证方法及装置、存储介质、电子装置 Download PDF

Info

Publication number
WO2020186788A1
WO2020186788A1 PCT/CN2019/118397 CN2019118397W WO2020186788A1 WO 2020186788 A1 WO2020186788 A1 WO 2020186788A1 CN 2019118397 W CN2019118397 W CN 2019118397W WO 2020186788 A1 WO2020186788 A1 WO 2020186788A1
Authority
WO
WIPO (PCT)
Prior art keywords
certificate
chain
blockchain
target terminal
identification information
Prior art date
Application number
PCT/CN2019/118397
Other languages
English (en)
French (fr)
Inventor
霍云
Original Assignee
平安科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 平安科技（深圳）有限公司 filed Critical 平安科技（深圳）有限公司
Publication of WO2020186788A1 publication Critical patent/WO2020186788A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1097—Protocols in which an application is distributed across nodes in the network for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Definitions

  • This application relates to the computer field, and specifically to a blockchain-based certificate verification method and device, storage medium, and electronic device.
  • LDAP Lightweight Directory Access Protocol
  • HTTP HyperText Transfer Protocol
  • third parties can access LDAP or
  • the HTTP service obtains the public key certificate, usually using the user DN or the unique user ID or the certificate serial number as the retrieval condition, but for the application scenario of multiple CAs, the application service needs to access the LDAP or HTTP services of each CA to obtain the certificate to verify the terminal certificate.
  • the application needs to connect to the LDAP service or HTTP service of different CAs according to the issuer of the terminal certificate.
  • the reliability of the existing technology in business applications depends on the network and the service capabilities of each CA.
  • the LDAP storage capabilities and performance cannot be satisfied.
  • Demands result in low efficiency in verifying terminal certificates, which cannot meet the explosive demand of the Internet.
  • the embodiments of the present application provide a blockchain-based certificate verification method and device, storage medium, and electronic device to solve the technical problem of low effectiveness in verifying terminal certificates in the prior art.
  • a blockchain-based certificate verification method which includes: receiving a verification request for a terminal certificate, wherein the verification request carries identification information of one or more target terminal certificates, and The target terminal certificate is a private key certificate; the certificate chain of the target terminal certificate is queried on the blockchain according to the identification information, wherein the certificate chain includes a private key certificate and a public key certificate, and the public key certificate includes: Issue the CA certificate of the private key certificate, issue the superior root certificate of the CA certificate, and issue the self-signed root certificate of the root certificate; verify whether the target terminal certificate is legal according to the certificate chain.
  • a blockchain-based certificate verification device including: a receiving module for receiving a verification request for a terminal certificate, wherein the verification request carries one or more target terminal certificates
  • the terminal certificate is a private key certificate
  • the query module is used to query the certificate chain of the target terminal certificate on the blockchain according to the identification information, where the certificate chain includes a private key certificate and a public key certificate.
  • the public key certificate includes: the CA certificate for issuing the terminal certificate, the superior root certificate for issuing the CA certificate, and the self-signed root certificate for issuing the root certificate
  • the verification module is used to verify the certificate chain according to the certificate chain. Whether the target terminal certificate is legal.
  • a storage medium in which a computer program is stored, wherein the computer program is configured to execute the steps in any one of the foregoing method embodiments when running.
  • an electronic device including a memory and a processor, the memory is stored with a computer program, and the processor is configured to run the computer program to execute any of the above Steps in the method embodiment.
  • FIG. 1 is a block diagram of the hardware structure of a blockchain-based certificate verification server according to an embodiment of the present application
  • Figure 2 is a flowchart of a blockchain-based certificate verification method according to an embodiment of the present application
  • FIG. 3 is a schematic diagram of a process of verifying whether a terminal certificate is legal in an embodiment of the application
  • Fig. 4 is a schematic diagram of an exemplary book chain implemented according to the present application.
  • Fig. 5 is a structural block diagram of a blockchain-based certificate verification device according to an embodiment of the present application.
  • FIG. 1 is a hardware structural block diagram of a blockchain-based certificate verification server according to an embodiment of the present application.
  • the server 10 may include one or more (only one is shown in FIG. 1) processor 102 (the processor 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA) And the memory 104 for storing data.
  • the aforementioned server may also include a transmission device 106 and an input/output device 108 for communication functions.
  • FIG. 1 is only for illustration, and it does not limit the structure of the foregoing server.
  • the server 10 may also include more or fewer components than shown in FIG. 1, or have a different configuration from that shown in FIG.
  • the memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as a computer program corresponding to a blockchain-based certificate verification method in the embodiment of the present application.
  • the processor 102 is stored in the memory 104 by running The computer program to perform various functional applications and data processing, that is, to achieve the above methods.
  • the memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory.
  • the storage 104 may further include storage remotely provided with respect to the processor 102, and these remote storages may be connected to the server 10 through a network. Examples of the aforementioned networks include but are not limited to the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.
  • the transmission device 106 is used to receive or send data via a network.
  • the foregoing specific examples of the network may include a wireless network provided by the communication provider of the server 10.
  • the transmission device 106 includes a network adapter (Network Interface Controller, NIC for short), which can be connected to other network devices through a base station to communicate with the Internet.
  • the transmission device 106 may be a radio frequency (Radio Frequency, referred to as RF) module, which is used to communicate with the Internet in a wireless manner.
  • RF Radio Frequency
  • FIG. 2 is a flowchart of a blockchain-based certificate verification method according to an embodiment of the application. As shown in FIG. 2, the process includes The following steps:
  • Step S202 Receive a verification request for a terminal certificate, where the verification request carries identification information of one or more target terminal certificates, and the target terminal certificate is a private key certificate;
  • the private key certificate is a digital certificate used on the user side. It is generated based on a public key certificate. One private key certificate matches one public key certificate, but one public key certificate may match multiple private key certificates.
  • the identification information of the target terminal certificate corresponds to the target terminal certificate, and is the unique identifier of the target terminal certificate, such as the certificate serial number;
  • Step S204 Query the certificate chain of the target terminal certificate on the blockchain according to the identification information, wherein the certificate chain includes a private key certificate and a public key certificate, and the public key certificate includes: issuing the private key The CA certificate of the certificate, the superior root certificate of the CA certificate issued, and the self-signed root certificate of the root certificate issued;
  • the certificate chain of this embodiment has been published on the blockchain in advance, and the target terminal certificate is the private key certificate of the requesting terminal. It is issued by the certificate center and generated based on the root certificate. It can be any standard digital certificate, such as CA certificate, CA Refers to the CA certification center (Certificate Authority).
  • CA certificate contains the user identity information and the public key used by the user. The certificate does not contain the private key, and the private key should be kept secret by the user and cannot be disclosed.
  • the CA certificate binds the value of the public key to the identity of the person, device, or service that holds the corresponding private key.
  • Step S206 Verify whether the target terminal certificate is legal according to the certificate chain.
  • querying the certificate chain of the target terminal certificate on the blockchain according to the identification information includes:
  • the target terminal certificate in this embodiment may be various types of X.509 standard certificates such as client certificates and node certificates.
  • a smart contract is a program that runs in a blockchain network node and can be called by the client. In response to a query request from the client, the smart contract can query the qualified certificate information in the blockchain network and return it to the client.
  • the certificate chain is composed of a private key certificate and multiple public key certificates, forming a level-to-level relationship.
  • the upper level certificate in the certificate chain issues the next level certificate adjacent to it, so the next level certificate can be used to retrieve the upper level certificate.
  • the private key certificate can be queried through the identification information, and then the high-level public key certificate can be queried through the private key certificate.
  • verification requests can be triggered in multiple scenarios.
  • the blockchain management platform verifies whether the identity of the node on the chain is legal, and when both nodes communicate , To verify whether the identity of the other party is legal, and to verify whether the identity of the other party is legal when the two nodes are trading.
  • Figure 3 is a schematic diagram of the process of verifying the validity of the terminal certificate in an embodiment of this application.
  • the terminal carrying the terminal certificate is the block node to be connected to the chain
  • the verification request includes The block node uses the private key to sign the identification information of the target terminal certificate.
  • verifying whether the terminal certificate is legal according to the certificate chain includes:
  • Step S302 After the certificate chain of the target terminal certificate is queried on the blockchain, it is judged whether the target terminal certificate matches the CA certificate of the certificate chain;
  • the CA certificate since the CA certificate may issue multiple terminal certificates, only when the target terminal certificate is included in the private key certificate set in the certificate chain, the target terminal certificate matches the CA certificate of the certificate chain;
  • Step S304 When the target terminal certificate matches the CA certificate of the certificate chain, judge whether the certificate chain is complete from the terminal certificate at the most downstream to the self-signed root certificate at the most upstream;
  • the certificate chain from the most downstream terminal certificate to the most upstream self-signed root certificate is complete, that is, the surface certificate chain is complete, indicating that the terminal certificate is traceable and is not a forged or modified certificate;
  • Step S306 When the certificate chain from the most downstream terminal certificate to the most upstream self-signed root certificate is complete, it is determined that the terminal certificate is legal.
  • querying the certificate chain of the target terminal certificate on the blockchain according to the identification information includes: querying the identification information at the most downstream of the certificate chain on the blockchain according to the direction of the certificate chain Corresponding to the target terminal certificate, query the CA certificate that issued the target terminal certificate, query the superior root certificate that issued the CA certificate according to the CA certificate, until the self-signed root certificate that issued the root certificate is traced back.
  • Fig. 4 is a schematic diagram of an example book chain implemented according to this application, in which the intermediate root certificate includes one or more levels, and is a root certificate between a self-signed root certificate and a CA certificate.
  • the blockchain management platform verifies whether the identity of the chain node is legal, it receives the chain request (a form of verification request) sent by the chain node, and the digital certificate chain request contains the private key used by the node
  • the identification information of the target terminal certificate to be verified is generated by the signature; the certificate chain is used to verify whether the target terminal certificate is legal; according to the verification result, it is determined whether to connect the node to the blockchain.
  • Using the certificate chain to verify the validity of the target certificate includes: judging whether there is a public key certificate matching the private key in the target terminal certificate, if there is a public key certificate, further judging whether the certificate chain where the public key certificate is located is complete, if the certificate chain If it is complete, the verification is passed.
  • the target terminal certificate Before judging whether the certificate chain where the public key certificate is located is complete, you can first query whether the target terminal certificate has a query record on the blockchain. If there is a query record, there is a certificate chain, and you can further query whether the certificate chain is complete. If there is no query record, there is no certificate chain of the target terminal certificate. In addition to the chain request, it can also be other requests carrying the private key identifier. When it is legal, the chain is allowed, and the chain time, hash value, and hash value of the node connected to the node are recorded.
  • a complete certificate chain includes the terminal certificate (client or node), the CA certificate that issues the terminal certificate, and the upper-level root certificate that issues the CA certificate, up to the top self-signed root certificate.
  • the certificate chain contains all the certificates on the trust chain, usually assembled in the PKCS#7 file format, and stored on the blockchain, as the node data of multiple block nodes.
  • the method before querying the certificate chain of the target terminal certificate on the blockchain according to the identification information, the method further includes: collecting multiple certificates of the multiple terminal certificates from the certificate server based on the identification information of the terminal certificate Chain; summarize the multiple certificate chains to obtain a certificate chain entry corresponding to the identification information of the multiple terminal certificates, and publish it to the blockchain.
  • the root certificate of each CA is published on the blockchain for storage, and then the certificate issued by the CA is published on the blockchain for storage.
  • the CA certificate and terminal certificate are stored on the blockchain network in the form of a certificate chain.
  • Each terminal certificate corresponds to a certificate chain.
  • Each certificate chain contains multiple digital certificates, which can be recorded by query later. To identify (the query record includes the unique identifier of the terminal certificate).
  • the certificate chain is obtained, which utilizes the sharing characteristics of the blockchain and improves the concurrent ability of verifying digital certificates.
  • the traditional certificate is managed by the CA itself, so it is scattered on the platform of each CA organization.
  • This solution combines the root certificates and issued certificates of all CAs through a certificate chain to obtain multiple certificate chains.
  • the CA certificate on the certificate chain contains Public key certificate (the public key certificate matches the private key certificate privately stored by the public account one by one).
  • the certificate user can obtain the public key certificates of all CAs through the blockchain network, without having to interface with various CA institutions.
  • the solution of this embodiment further includes:
  • judging whether the verification request is valid according to the request content of the verification request includes: parsing the address information carried in the verification request from the request content; sending or forwarding the verification request between the carried address information and When the requested client address or node address is the same, the verification request is determined to be valid, and when the carried address information is not the same as the client address or node address that sends or forwards the verification request, the verification request is determined to be invalid .
  • the query record has a one-to-one correspondence with the identification information of the target terminal certificate.
  • the query record When querying the certificate chain of the target terminal certificate for the first time, if the query is successful, another query record will be published on the blockchain or the query record will be updated to the state of successful query.
  • the query record itself can tell the entire blockchain this time.
  • the query operation is performed on the blockchain, but in this embodiment, it is issued when the query is successful, and the query record can be used to indicate whether the certificate chain on the blockchain corresponds to the identification information.
  • Querying the certificate chain on the blockchain includes triggering a query request based on the verification request, and querying the certificate chain on the blockchain.
  • the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, of course, it can also be implemented by hardware, but in many cases the former is Better implementation.
  • the technical solution of this application essentially or the part that contributes to the existing technology can be embodied in the form of a software product, and the computer software product is stored in a storage medium (such as ROM/RAM, magnetic disk, The optical disc) includes several instructions to enable a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the method described in each embodiment of the present application.
  • a blockchain-based certificate verification device is also provided, which may be a terminal or a server.
  • the device is used to implement the above-mentioned embodiments and preferred implementations, and the descriptions that have been described will not be repeated.
  • the term "module" can implement a combination of software and/or hardware with predetermined functions.
  • the devices described in the following embodiments are preferably implemented by software, hardware or a combination of software and hardware is also possible and conceived.
  • Fig. 5 is a structural block diagram of a blockchain-based certificate verification device according to an embodiment of the present application, which can be applied to a client or a server. As shown in Fig. 5, the device includes: a receiving module 50, a query module 52, and a verification module 54 of which,
  • the receiving module 50 is configured to receive a verification request for a terminal certificate, where the verification request carries identification information of one or more terminal certificates, and the terminal certificate is a private key certificate;
  • the query module 52 is configured to query the certificate chain of the terminal certificate on the blockchain according to the identification information, wherein the certificate chain includes a private key certificate and a public key certificate, and the public key certificate includes: The CA certificate of the terminal certificate, the superior root certificate of the CA certificate is issued, and the self-signed root certificate of the root certificate is issued;
  • the verification module 54 is configured to verify whether the terminal certificate is legal according to the certificate chain.
  • the query module includes: a trigger unit, which is used to respond to the verification request and trigger a smart contract program on the blockchain; and a retrieval unit, which is used to call the smart contract program to perform the following steps:
  • the identification information retrieves the corresponding private key certificate, and after the private key certificate is retrieved, the private key certificate is used to query the public key certificate of the certificate chain where the private key certificate is located.
  • the verification module includes: a first judging unit for judging the target terminal certificate and the CA certificate of the certificate chain after obtaining the certificate chain of the target terminal certificate on the blockchain Whether it matches; a second judging unit for judging whether the certificate chain from the most downstream terminal certificate to the most upstream self-signed root certificate is complete when the target terminal certificate matches the CA certificate of the certificate chain; The unit is used to determine that the terminal certificate is legal when the certificate chain is complete from the most downstream terminal certificate to the most upstream self-signed root certificate.
  • the query module includes: a query unit configured to query the target terminal certificate corresponding to the identification information at the most downstream of the certificate chain on the blockchain according to the direction of the certificate chain, and query the issuing office According to the CA certificate of the target terminal certificate, query the upper-level root certificate that issued the CA certificate according to the CA certificate, until it traces back to the self-signed root certificate that issued the root certificate.
  • the device further includes: a collection module, configured to collect from the certificate server based on the identification information of the terminal certificate before the query module queries the certificate chain of the terminal certificate on the blockchain according to the identification information Multiple certificate chains of multiple terminal certificates; an issuing module for summarizing the multiple certificate chains to obtain certificate chain entries corresponding to the identification information of the multiple terminal certificates, and publishing them to the blockchain.
  • a collection module configured to collect from the certificate server based on the identification information of the terminal certificate before the query module queries the certificate chain of the terminal certificate on the blockchain according to the identification information Multiple certificate chains of multiple terminal certificates
  • an issuing module for summarizing the multiple certificate chains to obtain certificate chain entries corresponding to the identification information of the multiple terminal certificates, and publishing them to the blockchain.
  • the device further includes: a judgment module, configured to judge according to the request content of the verification request before the query module queries the certificate chain of the target terminal certificate on the blockchain according to the identification information Whether the verification request is valid; the processing module is used to determine when the verification request is valid, determine the certificate chain of the target terminal certificate to be queried according to the identification information, and generate a query record corresponding to the verification request, and The query record is published to the blockchain.
  • a judgment module configured to judge according to the request content of the verification request before the query module queries the certificate chain of the target terminal certificate on the blockchain according to the identification information Whether the verification request is valid
  • the processing module is used to determine when the verification request is valid, determine the certificate chain of the target terminal certificate to be queried according to the identification information, and generate a query record corresponding to the verification request, and The query record is published to the blockchain.
  • the judgment module includes: a parsing unit, configured to parse the address information carried in the verification request from the request content; and a determining unit, configured to send or forward the verification request between the carried address information and When the requested client address or node address is the same, the verification request is determined to be valid, and when the carried address information is not the same as the client address or node address that sends or forwards the verification request, the verification request is determined to be invalid .
  • terminal and the server are only the differences in the execution subject of the solution, and the various examples and optional solutions in the above identification terminal are also adapted to the server and produce the same technical effect.
  • each of the above modules can be implemented by software or hardware.
  • it can be implemented in the following manner, but not limited to this: the above modules are all located in the same processor; or, the above modules are combined in any combination The forms are located in different processors.
  • the embodiment of the present application also provides a storage medium in which a computer program is stored, wherein the computer program is configured to execute the steps in any of the foregoing method embodiments when running.
  • the foregoing storage medium may be configured to store a computer program for executing the following steps:
  • S1. Receive a verification request for a terminal certificate, where the verification request carries identification information of one or more target terminal certificates, and the target terminal certificate is a private key certificate;
  • the foregoing storage medium may include, but is not limited to: U disk, Read-Only Memory (Read-Only Memory, ROM for short), Random Access Memory (Random Access Memory, RAM for short), Various media that can store computer programs, such as mobile hard disks, magnetic disks, or optical disks.
  • the embodiment of the present application also provides an electronic device, including a memory and a processor, the memory is stored with a computer program, and the processor is configured to run the computer program to execute the steps in any of the foregoing method embodiments.
  • the aforementioned electronic device may further include a transmission device and an input-output device, wherein the transmission device is connected to the aforementioned processor, and the input-output device is connected to the aforementioned processor.
  • the foregoing processor may be configured to execute the following steps through a computer program:
  • S1. Receive a verification request for a terminal certificate, where the verification request carries identification information of one or more target terminal certificates, and the target terminal certificate is a private key certificate;
  • the disclosed technical content can be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division.
  • multiple units or components may be combined or may be Integrate into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of units or modules, and may be in electrical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • each unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solution of this application essentially or the part that contributes to the existing technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , Including several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present application.
  • the aforementioned storage media include: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program code .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Storage Device Security (AREA)

Abstract

本申请提供了一种基于区块链的证书验证方法及装置、存储介质、电子装置，其中，该方法包括：接收终端证书的验证请求，其中，所述验证请求携带一个或多个目标终端证书的标识信息，所述目标终端证书为私钥证书；根据所述标识信息在区块链上查询所述目标终端证书的证书链，其中，所述证书链包括私钥证书和公钥证书，所述公钥证书包括：签发所述私钥证书的CA证书，签发所述CA证书的上级根证书，签发根证书的自签名根证书；根据所述证书链验证所述目标终端证书是否合法。通过本申请，解决了现有技术中验证终端证书时效果低下的技术问题。

Description

基于区块链的证书验证方法及装置、存储介质、电子装置 技术领域
本申请涉及计算机领域，具体而言，涉及一种基于区块链的证书验证方法及装置、存储介质、电子装置。
背景技术
现有技术中，传统数字证书由各CA签发，可以通过轻量目录访问协议(Lightweight Directory Access Protocol，LDAP)或超文本传输协议(HTTP，Hyper Text Transfer Protocol)方式发布，第三方通过访问LDAP或HTTP服务获取公钥证书，通常使用用户DN或用户唯一标识或证书序列号作为检索条件，但对于多CA的应用场景，应用服务需要访问各CA的LDAP或HTTP服务以获取证书来验证终端证书，应用需要根据终端证书的颁发者连接不同CA的LDAP服务或HTTP服务。
现有技术在业务应用的可靠性取决于网络和各CA服务能力，复杂网络场景中，很难保证各CA的性能和可靠性，尤其是在海量用户场景中，LDAP存储能力和性能都无法满足需求，导致验证终端证书的效率低下，不能满足互联网的爆炸性需求。
针对现有技术中存在的上述问题，目前尚未发现有效的解决方案。
发明内容
本申请实施例提供了一种基于区块链的证书验证方法及装置、存储介质、电子装置，以解决现有技术中验证终端证书时效果低下的技术问题。
根据本申请的一个实施例，提供了一种基于区块链的证书验证方法，包括：接收终端证书的验证请求，其中，所述验证请求携带一个或多个目标终端证书的标识信息，所述目标终端证书为私钥证书；根据所述标识信息在区块链上查询所述目标终端证书的证书链，其中，所述证书链包括私钥证书和公钥证书，所述公钥证书包括：签发所述私钥证书的CA证书，签发所述CA证书的上级根证书，签发根证书的自签名根证书；根据所述证书链验证所述目标终端证书是否合法。
根据本申请的另一个实施例，提供了一种基于区块链的证书验证装置， 包括：接收模块，用于接收终端证书的验证请求，其中，所述验证请求携带一个或多个目标终端证书的标识信息，所述终端证书为私钥证书；查询模块，用于根据所述标识信息在区块链上查询所述目标终端证书的证书链，其中，所述证书链包括私钥证书和公钥证书，所述公钥证书包括：签发所述终端证书的CA证书，签发所述CA证书的上级根证书，签发根证书的自签名根证书；验证模块，用于根据所述证书链验证所述目标终端证书是否合法。
根据本申请的又一个实施例，还提供了一种存储介质，所述存储介质中存储有计算机程序，其中，所述计算机程序被设置为运行时执行上述任一项方法实施例中的步骤。
根据本申请的又一个实施例，还提供了一种电子装置，包括存储器和处理器，所述存储器中存储有计算机程序，所述处理器被设置为运行所述计算机程序以执行上述任一项方法实施例中的步骤。
通过本申请，根据所述标识信息在区块链上查询所述目标终端证书的证书链并根据所述证书链验证所述目标终端证书是否合法，通过区块链的共享特性可以同时处理多个目标终端证书的多个证书验证请求，利用区块链上的证书链，提高了验证数字证书的并发能力，能够避免CA服务器的服务能力不足或网络单点故障引起的服务失效，提高了验证效率，解决了现有技术中验证终端证书时效果低下的技术问题。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1是本申请实施例的一种基于区块链的证书验证服务器的硬件结构框图；
图2是根据本申请实施例的一种基于区块链的证书验证方法的流程图；
图3是本申请实施例验证终端证书是否合法的流程示意图；
图4是根据本申请实施例证书链的示意图。
图5是根据本申请实施例的基于区块链的证书验证装置的结构框图。
具体实施方式
为了使本技术领域的人员更好地理解本申请方案，下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分的实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都应当属于本申请保护的范围。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
需要说明的是，本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本申请的实施例能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
实施例1
本申请实施例一所提供的方法实施例可以在移动终端、计算机终端、服务器或者类似的运算装置中执行。以运行在服务器上为例，图1是本申请实施例的一种基于区块链的证书验证服务器的硬件结构框图。如图1所示，服务器10可以包括一个或多个(图1中仅示出一个)处理器102(处理器102可以包括但不限于微处理器MCU或可编程逻辑器件FPGA等的处理装置)和用于存储数据的存储器104，可选地，上述服务器还可以包括用于通信功能的传输设备106以及输入输出设备108。本领域普通技术人员可以理解，图1所示的结构仅为示意，其并不对上述服务器的结构造成限定。例如，服务器10还可包括比图1中所示更多或者更少的组件，或者具有与图1所示不同的配置。
存储器104可用于存储计算机程序，例如，应用软件的软件程序以及模块，如本申请实施例中的一种基于区块链的证书验证方法对应的计算机程序，处理器102通过运行存储在存储器104内的计算机程序，从而执行各种功能应用以及数据处理，即实现上述的方法。存储器104可包括高速随机存储器， 还可包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器104可进一步包括相对于处理器102远程设置的存储器，这些远程存储器可以通过网络连接至服务器10。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
传输装置106用于经由一个网络接收或者发送数据。上述的网络具体实例可包括服务器10的通信供应商提供的无线网络。在一个实例中，传输装置106包括一个网络适配器(Network Interface Controller，简称为NIC)，其可通过基站与其他网络设备相连从而可与互联网进行通讯。在一个实例中，传输装置106可以为射频(Radio Frequency，简称为RF)模块，其用于通过无线方式与互联网进行通讯。
在本实施例中提供了一种基于区块链的证书验证方法，图2是根据本申请实施例的一种基于区块链的证书验证方法的流程图，如图2所示，该流程包括如下步骤：
步骤S202，接收终端证书的验证请求，其中，所述验证请求携带一个或多个目标终端证书的标识信息，所述目标终端证书为私钥证书；
私钥证书为在用户端使用的数字证书，基于公钥证书生成，一个私钥证书匹配一个公钥证书，但是一个公钥证书有可能与多个私钥证书匹配。目标终端证书的标识信息与目标终端证书对应，为目标终端证书的唯一标识符，如证书序列号；
步骤S204，根据所述标识信息在区块链上查询所述目标终端证书的证书链，其中，所述证书链包括私钥证书和公钥证书，所述公钥证书包括：签发所述私钥证书的CA证书，签发所述CA证书的上级根证书，签发根证书的自签名根证书；
本实施例的证书链预先已经发布到区块链上，目标终端证书是请求终端的私钥证书，由证书中心签发，基于根证书生成，可以是任一标准的数字证书，如CA证书，CA指CA认证中心(Certificate Authority)，CA签发的指公钥证书中包含用户身份信息及用户使用的公钥，证书中不包含私钥，而私钥应由用户秘密保存，不可公开。CA证书将公钥的值绑定到持有对应私钥的个人、设备或服务的身份。
步骤S206，根据所述证书链验证所述目标终端证书是否合法。
通过上述步骤，根据所述标识信息在区块链上查询所述目标终端证书的证书链并根据所述证书链验证所述目标终端证书是否合法，通过区块链的共享特性可以同时处理多个目标终端证书的多个证书验证请求，利用区块链上的证书链，提高了验证数字证书的并发能力，能够避免CA服务器的服务能力不足或网络单点故障引起的服务失效，提高了验证效率，解决了现有技术中验证终端证书时效果低下的技术问题。
本实施例中，根据所述标识信息在区块链上查询所述目标终端证书的证书链包括：
S11，响应所述验证请求，触发所述区块链上的智能合约程序；
本实施例的目标终端证书可以为客户端证书，节点证书等各种类型的X.509标准证书。智能合约为运行于区块链网络节点中的程序，能够被客户端调用，响应根据客户端的查询请求，智能合约可以在区块链网络中查询符合条件的证书信息，并返回给客户端。
S12，调用所述智能合约程序执行以下步骤：根据所述标识信息检索对应的私钥证书，在检索得到所述私钥证书后，使用所述私钥证书查询所述私钥证书所在的证书链的公钥证书。
证书链由私钥证书和多个公钥证书组成，形成一级一级的关系，证书链中的上一级证书签发与其相邻的下一级证书，因此可以使用下一级证书来检索上一级证书，由于私钥证书的级别最低，所以可以先通过标识信息查询私钥证书，再通过私钥证书来查询高级别的公钥证书。
本实施例在使用区块链上的证书链验证目标终端证书是否合法时，可以在多个场景触发验证请求，如，区块链管理平台验证上链节点的身份是否合法，在节点双方通信时，验证对方的身份是否合法，在节点双方交易时，验证对方的身份是否合法等。
图3是本申请实施例验证终端证书是否合法的流程示意图，在本实施例的一个实施场景中，携带所述终端证书的终端为待上链的区块节点，所述验证请求中包含由所述区块节点使用私钥签名生成的目标终端证书的标识信息。在接收到该区块节点发送的验证请求后，根据所述证书链验证所述终端证书是否合法包括：
步骤S302，在所述区块链上查询得到所述目标终端证书的证书链之后，判断所述目标终端证书与所述证书链的CA证书是否匹配；
在本实施例中，由于CA证书可能签发多个终端证书，因此只有在目标终端证书包含在证书链中私钥证书集合中时，所述目标终端证书与所述证书链的CA证书匹配；
步骤S304，在所述目标终端证书与所述证书链的CA证书匹配时，判断所述证书链从最下游的终端证书到最上游的自签名根证书是否完整；
所述证书链从最下游的终端证书到最上游的自签名根证书完整即表面证书链完整，说明终端证书有源可溯，不是伪造或者修改后的证书；
步骤S306，在所述证书链从最下游的终端证书到最上游的自签名根证书均完整时，确定所述终端证书合法。
在确定合法时，同意将所述区块节点接入所述区块链。
具体的，根据所述标识信息在区块链上查询所述目标终端证书的证书链包括：在所述区块链上根据证书链的方向在所述证书链的最下游查询与所述标识信息对应的目标终端证书，查询签发所述目标终端证书的CA证书，根据所述CA证书查询签发所述CA证书的上级根证书，直到上溯至签发根证书的自签名根证书。图4是根据本申请实施例证书链的示意图，其中，中间根证书包括一级或多级，为自签名根证书到CA证书之间的根证书。
在区块链管理平台验证上链节点的身份是否合法时，接收区块链节点发送的上链请求(验证请求的一个形式)，所述数字证书上链请求中包含由所述节点使用私钥签名生成的待校验的目标终端证书的标识信息；使用证书链验证目标终端证书是否合法；依据校验结果，确定是否将节点接入所述区块链。使用证书链验证目标证书是否合法包括：判断是否存在与该目标终端证书中的私钥匹配的公钥证书，若存在公钥证书，进一步判断该公钥证书所在的证书链是否完整，若证书链完整，则验证通过。在判断该公钥证书所在的证书链是否完整之前，可以先在区块链上查询该目标终端证书是否存在查询记录，若存在查询记录，则存在证书链，可以进一步查询证书链是否完整，若不存在查询记录，则不存在该目标终端证书的证书链。此处除了是上链请求之外，还可以是携带私钥标识的其他请求。在合法时，允许上链，并记录该节点的上链时间，哈希值，与该节点连接的节点的哈希值等。
本实施例中，一个完整的证书链包括终端证书(客户端的或节点的)，签发出终端证书的CA证书，及签发出CA证书的上级根证书，直到最顶层的自签名根证书，由此组成一个信任链，证书链包含信任链上的所有证书，通常以PKCS#7文件格式组装，并存储在区块链上，作为一个多个区块节点的节点数据保存。所以根据证书链的方向来查询，先查询最下游的数字证书，即终端证书，然后一步步上溯，使用终端证书的上级身份信息(签发该终端证书的颁发者信息)查询得到签发出终端证书的CA证书，进而使用CA证书查询签发出CA证书的上级根证书，一直查询得到最顶层的自签名根证书。
可选的，在根据所述标识信息在区块链上查询所述目标终端证书的证书链之前，所述方法还包括：基于终端证书的标识信息从证书服务器采集多个终端证书的多个证书链；对所述多个证书链进行汇总得到与多个终端证书的标识信息一一对应的证书链条目，并发布到所述区块链。各CA的根证书发布到区块链上保存，然后将CA签发的证书发布到区块链上保存。
在采集得到证书链后，将CA证书和终端证书以证书链的形式保存在区块链网络上，每个终端证书对应一条证书链，每个证书链包含多个数字证书，后续可以通过查询记录来标识(该查询记录包括终端证书的唯一标识符)。
通过将根证书及其相关证书发布到区块链上，并管理汇总区块链上的数字证书得到证书链，利用了区块链的共享特性，提高了验证数字证书的并发能力。
传统的证书由CA机构自己管理，因此分散在各CA机构的平台中，本方案通过证书链将所有CA的根证书和签发的证书汇总起来，得到多条证书链，证书链上的CA证书包含公钥证书(该公钥证书与公户私下保存的私钥证书一一匹配)，证书使用者可通过区块链网络获得所有CA的公钥证书，不必与各CA机构对接。
可选的，在根据所述标识信息在区块链上查询所述目标终端证书的证书链之前，本实施例的方案还包括：
S21，根据所述验证请求的请求内容判断所述验证请求是否有效；
具体的，根据所述验证请求的请求内容判断所述验证请求是否有效包括：从所述请求内容中解析所述验证请求携带的地址信息；在所述携带的地址信息与发送或转发所述验证请求的客户端地址或节点地址相同时，确定所述验 证请求有效，在所述携带的地址信息与发送或转发所述验证请求的客户端地址或节点地址不相同时，确定所述验证请求无效。
S22，在所述验证请求有效时，确定根据所述标识信息在区块链上查询所述目标终端证书的证书链，并生成与所述验证请求对应的查询记录，将所述查询记录公布到所述区块链。
在本实施例中，查询记录与目标终端证书的标识信息一一对应。在第一次查询目标终端证书的证书链时，如果查询成功，则在区块链上再发布一条查询记录或者更新查询记录为查询成功的状态，查询记录本身是可以告诉整个区块链本次对区块链执行了查询操作，但本实施例中，在查询成功时发布，可以用查询记录来指示区块链上是否与标识信息对应的证书链。
在区块链上查询证书链包括，根据验证请求触发查询请求，在区块链上查询证书链。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本申请各个实施例所述的方法。
实施例2
在本实施例中还提供了一种基于区块链的证书验证装置，可以是终端或服务器，该装置用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图5是根据本申请实施例的基于区块链的证书验证装置的结构框图，可以应用在客户端或服务器中，如图5所示，该装置包括：接收模块50，查询模块52，验证模块54，其中，
接收模块50，用于接收终端证书的验证请求，其中，所述验证请求携带一个或多个终端证书的标识信息，所述终端证书为私钥证书；
查询模块52，用于根据所述标识信息在区块链上查询所述终端证书的证书链，其中，所述证书链包括私钥证书和公钥证书，所述公钥证书包括：签发所述终端证书的CA证书，签发所述CA证书的上级根证书，签发根证书的自签名根证书；
验证模块54，用于根据所述证书链验证所述终端证书是否合法。
可选的，所述查询模块包括：触发单元，用于响应所述验证请求，触发所述区块链上的智能合约程序；检索单元，用于调用所述智能合约程序执行以下步骤：根据所述标识信息检索对应的私钥证书，在检索得到所述私钥证书后，使用所述私钥证书查询所述私钥证书所在的证书链的公钥证书。
可选的，所述验证模块包括：第一判断单元，用于在所述区块链上查询得到所述目标终端证书的证书链之后，判断所述目标终端证书与所述证书链的CA证书是否匹配；第二判断单元，用于在所述目标终端证书与所述证书链的CA证书匹配时，判断所述证书链从最下游的终端证书到最上游的自签名根证书是否完整；确定单元，用于在所述证书链从最下游的终端证书到最上游的自签名根证书均完整时，确定所述终端证书合法。
可选的，所述查询模块包括：查询单元，用于在所述区块链上根据证书链的方向在所述证书链的最下游查询与所述标识信息对应的目标终端证书，查询签发所述目标终端证书的CA证书，根据所述CA证书查询签发所述CA证书的上级根证书，直到上溯至签发根证书的自签名根证书。
可选的，所述装置还包括：采集模块，用于在所述查询模块根据所述标识信息在区块链上查询所述终端证书的证书链之前，基于终端证书的标识信息从证书服务器采集多个终端证书的多个证书链；发布模块，用于对所述多个证书链进行汇总得到与多个终端证书的标识信息一一对应的证书链条目，并发布到所述区块链。
可选的，所述装置还包括：判断模块，用于在所述查询模块根据所述标识信息在区块链上查询所述目标终端证书的证书链之前，根据所述验证请求的请求内容判断所述验证请求是否有效；处理模块，用于在所述验证请求有效时，确定根据所述标识信息查询所述目标终端证书的证书链，并生成与所述验证请求对应的查询记录，将所述查询记录公布到区块链。
可选的，所述判断模块包括：解析单元，用于从所述请求内容中解析所 述验证请求携带的地址信息；确定单元，用于在所述携带的地址信息与发送或转发所述验证请求的客户端地址或节点地址相同时，确定所述验证请求有效，在所述携带的地址信息与发送或转发所述验证请求的客户端地址或节点地址不相同时，确定所述验证请求无效。
需要说明的是，终端和服务器仅是方案在执行主体上的差异，上述识别终端中的各个示例和可选方案同样适应在服务器中，并产生相同的技术效果。
需要说明的是，上述各个模块是可以通过软件或硬件来实现的，对于后者，可以通过以下方式实现，但不限于此：上述模块均位于同一处理器中；或者，上述各个模块以任意组合的形式分别位于不同的处理器中。
实施例3
本申请的实施例还提供了一种存储介质，该存储介质中存储有计算机程序，其中，该计算机程序被设置为运行时执行上述任一项方法实施例中的步骤。
可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的计算机程序：
S1，接收终端证书的验证请求，其中，所述验证请求携带一个或多个目标终端证书的标识信息，所述目标终端证书为私钥证书；
S2，根据所述标识信息在区块链上查询所述目标终端证书的证书链，其中，所述证书链包括私钥证书和公钥证书，所述公钥证书包括：签发所述私钥证书的CA证书，签发所述CA证书的上级根证书，签发根证书的自签名根证书；
S3，根据所述证书链验证所述目标终端证书是否合法。
可选地，在本实施例中，上述存储介质可以包括但不限于：U盘、只读存储器(Read-Only Memory，简称为ROM)、随机存取存储器(Random Access Memory，简称为RAM)、移动硬盘、磁碟或者光盘等各种可以存储计算机程序的介质。
本申请的实施例还提供了一种电子装置，包括存储器和处理器，该存储器中存储有计算机程序，该处理器被设置为运行计算机程序以执行上述任一项方法实施例中的步骤。
可选地，上述电子装置还可以包括传输设备以及输入输出设备，其中，该传输设备和上述处理器连接，该输入输出设备和上述处理器连接。
可选地，在本实施例中，上述处理器可以被设置为通过计算机程序执行以下步骤：
S1，接收终端证书的验证请求，其中，所述验证请求携带一个或多个目标终端证书的标识信息，所述目标终端证书为私钥证书；
S2，根据所述标识信息在区块链上查询所述目标终端证书的证书链，其中，所述证书链包括私钥证书和公钥证书，所述公钥证书包括：签发所述私钥证书的CA证书，签发所述CA证书的上级根证书，签发根证书的自签名根证书；
S3，根据所述证书链验证所述目标终端证书是否合法。
可选地，本实施例中的具体示例可以参考上述实施例及可选实施方式中所描述的示例，本实施例在此不再赘述。
上述本申请实施例序号仅仅为了描述，不代表实施例的优劣。
在本申请的上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
在本申请所提供的几个实施例中，应该理解到，所揭露的技术内容，可通过其它的方式实现。其中，以上所描述的装置实施例仅仅是示意性的，例如所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，单元或模块的间接耦合或通信连接，可以是电性或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单 元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可为个人计算机、服务器或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述仅是本申请的优选实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本申请原理的前提下，还可以做出若干改进和润饰，这些改进和润饰也应视为本申请的保护范围。

Claims (20)

  1. 一种基于区块链的证书验证方法，其中，包括：
    接收终端证书的验证请求，其中，所述验证请求携带一个或多个目标终端证书的标识信息，所述目标终端证书为私钥证书；
    根据所述标识信息在区块链上查询所述目标终端证书的证书链，其中，所述证书链包括私钥证书和公钥证书，所述公钥证书包括：签发所述私钥证书的CA证书，签发所述CA证书的上级根证书，签发根证书的自签名根证书；
    根据所述证书链验证所述目标终端证书是否合法。
  2. 根据权利要求1所述的方法，根据所述标识信息在区块链上查询所述目标终端证书的证书链包括：
    响应所述验证请求，触发所述区块链上的智能合约程序；
    调用所述智能合约程序执行以下步骤：根据所述标识信息检索对应的私钥证书，在检索得到所述私钥证书后，使用所述私钥证书查询所述私钥证书所在的证书链的公钥证书。
  3. 根据权利要求1所述的方法，根据所述标识信息在区块链上查询所述目标终端证书的证书链包括：
    在所述区块链上根据证书链的方向在所述证书链的最下游查询与所述标识信息对应的目标终端证书，查询签发所述目标终端证书的CA证书，根据所述CA证书查询签发所述CA证书的上级根证书，直到上溯至签发根证书的自签名根证书。
  4. 根据权利要求1所述的方法，根据所述证书链验证所述终端证书是否合法包括：
    在所述区块链上查询得到所述目标终端证书的证书链之后，判断所述目标终端证书与所述证书链的CA证书是否匹配；
    在所述目标终端证书与所述证书链的CA证书匹配时，判断所述证书链从最下游的终端证书到最上游的自签名根证书是否完整；
    在所述证书链从最下游的终端证书到最上游的自签名根证书均完整时，确定所述终端证书合法。
  5. 根据权利要求1所述的方法，在根据所述标识信息在区块链上查询所述目标终端证书的证书链之前，所述方法还包括：
    基于终端证书的标识信息从证书服务器采集多个终端证书的多个证书链；
    对所述多个证书链进行汇总得到与多个终端证书的标识信息一一对应的证书链条目，并发布到所述区块链。
  6. 根据权利要求1所述的方法，在根据所述标识信息在区块链上查询所述目标终端证书的证书链之前，所述方法还包括：
    根据所述验证请求的请求内容判断所述验证请求是否有效；
    在所述验证请求有效时，确定根据所述标识信息在区块链上查询所述目标终端证书的证书链，并生成与所述验证请求对应的查询记录，将所述查询记录公布到所述区块链。
  7. 根据权利要求6所述的方法，根据所述验证请求的请求内容判断所述验证请求是否有效包括：
    从所述请求内容中解析所述验证请求携带的地址信息；
    在所述携带的地址信息与发送或转发所述验证请求的客户端地址或节点地址相同时，确定所述验证请求有效，在所述携带的地址信息与发送或转发所述验证请求的客户端地址或节点地址不相同时，确定所述验证请求无效。
  8. 一种基于区块链的证书验证装置，其中，包括：
    接收模块，用于接收终端证书的验证请求，其中，所述验证请求携带一个或多个终端证书的标识信息，所述终端证书为私钥证书；
    查询模块，用于根据所述标识信息在区块链上查询所述终端证书的证书链，其中，所述证书链包括私钥证书和公钥证书，所述公钥证书包括：签发所述终端证书的CA证书，签发所述CA证书的上级根证书，签发根证书的自签名根证书；
    验证模块，用于根据所述证书链验证所述终端证书是否合法。
  9. 根据权利要求8所述的装置，所述查询模块包括：
    触发单元，用于响应所述验证请求，触发所述区块链上的智能合约程序；
    检索单元，用于调用所述智能合约程序执行以下步骤：根据所述标识信息检索对应的私钥证书，在检索得到所述私钥证书后，使用所述私钥证书查询所述私钥证书所在的证书链的公钥证书。
  10. 根据权利要求8所述的装置，所述验证模块包括：
    第一判断单元，用于在所述区块链上查询得到所述目标终端证书的证书链之后，判断所述目标终端证书与所述证书链的CA证书是否匹配；
    第二判断单元，用于在所述目标终端证书与所述证书链的CA证书匹配时，判断所述证书链从最下游的终端证书到最上游的自签名根证书是否完整；
    确定单元，用于在所述证书链从最下游的终端证书到最上游的自签名根证书均完整时，确定所述终端证书合法。
  11. 根据权利要求8所述的装置，所述查询模块包括：
    查询单元，用于在所述区块链上根据证书链的方向在所述证书链的最下游查询与所述标识信息对应的目标终端证书，查询签发所述目标终端证书的CA证书，根据所述CA证书查询签发所述CA证书的上级根证书，直到上溯至签发根证书的自签名根证书。
  12. 根据权利要求8所述的装置，所述装置还包括：
    采集模块，用于在所述查询模块根据所述标识信息在区块链上查询所述终端证书的证书链之前，基于终端证书的标识信息从证书服务器采集多个终端证书的多个证书链；
    发布模块，用于对所述多个证书链进行汇总得到与多个终端证书的标识信息一一对应的证书链条目，并发布到所述区块链。
  13. 根据权利要求8所述的装置，所述装置还包括：
    判断模块，用于在所述查询模块根据所述标识信息在区块链上查询所述目标终端证书的证书链之前，根据所述验证请求的请求内容判断所述验证请求是否有效；
    处理模块，用于在所述验证请求有效时，确定根据所述标识信息查询所述目标终端证书的证书链，并生成与所述验证请求对应的查询记录，将所述查询记录公布到区块链。
  14. 根据权利要求13所述的装置，所述判断模块包括：
    解析单元，用于从所述请求内容中解析所述验证请求携带的地址信息；
    确定单元，用于在所述携带的地址信息与发送或转发所述验证请求的客户端地址或节点地址相同时，确定所述验证请求有效，在所述携带的地址信息与发送或转发所述验证请求的客户端地址或节点地址不相同时，确定所述验证请求无效。
  15. 一种存储介质，所述存储介质中存储有计算机程序，其中，所述计算机程序被设置为运行时执行一种基于区块链的证书验证方法的步骤，包括：
    接收终端证书的验证请求，其中，所述验证请求携带一个或多个目标终端证书的标识信息，所述目标终端证书为私钥证书；
    根据所述标识信息在区块链上查询所述目标终端证书的证书链，其中，所述证书链包括私钥证书和公钥证书，所述公钥证书包括：签发所述私钥证书的CA证书，签发所述CA证书的上级根证书，签发根证书的自签名根证书；
    根据所述证书链验证所述目标终端证书是否合法。
  16. 根据权利要求15所述的存储介质，根据所述标识信息在区块链上查询所述目标终端证书的证书链包括：
    响应所述验证请求，触发所述区块链上的智能合约程序；
    调用所述智能合约程序执行以下步骤：根据所述标识信息检索对应 的私钥证书，在检索得到所述私钥证书后，使用所述私钥证书查询所述私钥证书所在的证书链的公钥证书。
  17. 根据权利要求15所述的存储介质，根据所述标识信息在区块链上查询所述目标终端证书的证书链包括：
    在所述区块链上根据证书链的方向在所述证书链的最下游查询与所述标识信息对应的目标终端证书，查询签发所述目标终端证书的CA证书，根据所述CA证书查询签发所述CA证书的上级根证书，直到上溯至签发根证书的自签名根证书。
  18. 一种电子装置，包括存储器和处理器，所述存储器中存储有计算机程序，所述处理器被设置为运行一种基于区块链的证书验证方法的步骤，包括：接收终端证书的验证请求，其中，所述验证请求携带一个或多个目标终端证书的标识信息，所述目标终端证书为私钥证书；
    根据所述标识信息在区块链上查询所述目标终端证书的证书链，其中，所述证书链包括私钥证书和公钥证书，所述公钥证书包括：签发所述私钥证书的CA证书，签发所述CA证书的上级根证书，签发根证书的自签名根证书；
    根据所述证书链验证所述目标终端证书是否合法。
  19. 根据权利要求18所述的电子装置，根据所述标识信息在区块链上查询所述目标终端证书的证书链包括：
    响应所述验证请求，触发所述区块链上的智能合约程序；
    调用所述智能合约程序执行以下步骤：根据所述标识信息检索对应的私钥证书，在检索得到所述私钥证书后，使用所述私钥证书查询所述私钥证书所在的证书链的公钥证书。
  20. 根据权利要求18所述的电子装置，根据所述标识信息在区块链上查询所述目标终端证书的证书链包括：
    在所述区块链上根据证书链的方向在所述证书链的最下游查询与所述标识信息对应的目标终端证书，查询签发所述目标终端证书的CA证书，根据所述CA证书查询签发所述CA证书的上级根证书，直到上溯至签发根证书的自签名根证书。
PCT/CN2019/118397 2019-03-21 2019-11-14 基于区块链的证书验证方法及装置、存储介质、电子装置 WO2020186788A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910219138.3A CN110011988B (zh) 2019-03-21 2019-03-21 基于区块链的证书验证方法及装置、存储介质、电子装置
CN201910219138.3 2019-03-21

Publications (1)

Publication Number Publication Date
WO2020186788A1 true WO2020186788A1 (zh) 2020-09-24

Family

ID=67167754

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/118397 WO2020186788A1 (zh) 2019-03-21 2019-11-14 基于区块链的证书验证方法及装置、存储介质、电子装置

Country Status (2)

Country Link
CN (1) CN110011988B (zh)
WO (1) WO2020186788A1 (zh)

Families Citing this family (22)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109948371B (zh) * 2019-03-07 2021-06-25 深圳市智税链科技有限公司 为区块链节点发放身份证书的方法及相关装置
CN110011988B (zh) * 2019-03-21 2021-08-10 平安科技（深圳）有限公司 基于区块链的证书验证方法及装置、存储介质、电子装置
CN110516417B (zh) * 2019-08-09 2021-04-16 中国银联股份有限公司 一种智能合约的权限验证方法及装置
US11038699B2 (en) 2019-08-29 2021-06-15 Advanced New Technologies Co., Ltd. Method and apparatus for performing multi-party secure computing based-on issuing certificate
CN110535628B (zh) * 2019-08-29 2020-07-17 阿里巴巴集团控股有限公司 通过证书签发进行多方安全计算的方法及装置
CN112926972B (zh) * 2019-12-05 2024-04-09 中移物联网有限公司 一种基于区块链的信息处理方法、区块链系统及终端
CN111092737B (zh) * 2019-12-27 2023-04-07 上海市数字证书认证中心有限公司 数字证书管理方法、装置及区块链节点
CN111210348B (zh) * 2019-12-31 2024-04-19 远光软件股份有限公司 区块链的交易方法、电子设备和存储介质
CN111222174A (zh) * 2019-12-31 2020-06-02 远光软件股份有限公司 区块链节点的加入方法、验证方法、设备和存储介质
CN113114463B (zh) * 2020-01-13 2023-04-07 中国移动通信有限公司研究院 一种证书注册方法、验证方法及设备
CN111291369B (zh) * 2020-01-20 2022-05-20 北京无限光场科技有限公司 一种信息检测方法和电子设备
CN111314085B (zh) * 2020-01-22 2023-05-23 维沃移动通信有限公司 数字证书验证方法及装置
CN111698097B (zh) * 2020-06-29 2024-03-08 北京达佳互联信息技术有限公司 一种证书认证方法及装置
CN111737766B (zh) * 2020-08-03 2020-12-04 南京金宁汇科技有限公司 一种在区块链中判断数字证书签名数据合法性的方法
CN111934870B (zh) * 2020-09-22 2020-12-29 腾讯科技（深圳）有限公司 区块链网络中的根证书更新方法、装置、设备以及介质
CN112560005A (zh) * 2020-12-01 2021-03-26 杭州趣链科技有限公司 身份可信服务系统、方法、电子设备和计算机可读介质
CN112445865B (zh) * 2021-01-29 2021-05-18 支付宝(杭州)信息技术有限公司 自动化部署区块链网络的方法、装置及云计算平台
CN113806711B (zh) * 2021-09-30 2022-11-15 北京航星永志科技有限公司 一种基于区块链系统的登录验证方法、装置及电子设备
CN113824566B (zh) * 2021-10-19 2022-12-02 恒宝股份有限公司 证书认证方法、码号下载方法、装置、服务器及存储介质
CN114640467A (zh) * 2022-03-15 2022-06-17 微位（深圳）网络科技有限公司 基于业务的数字证书查询方法及系统
CN114826570A (zh) * 2022-03-30 2022-07-29 微位（深圳）网络科技有限公司 证书获取方法、装置、设备及存储介质
CN117156440B (zh) * 2023-10-27 2024-01-30 中电科网络安全科技股份有限公司 一种证书认证方法、系统、存储介质和电子设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180322491A1 (en) * 2017-03-31 2018-11-08 Vijay K. Madisetti Method and System for Blockchain-Based Combined Identity, Ownership, Integrity and Custody Management
CN108964924A (zh) * 2018-07-24 2018-12-07 腾讯科技（深圳）有限公司 数字证书校验方法、装置、计算机设备和存储介质
CN109067539A (zh) * 2018-06-13 2018-12-21 深圳前海微众银行股份有限公司 联盟链交易方法、设备及计算机可读存储介质
CN110011988A (zh) * 2019-03-21 2019-07-12 平安科技（深圳）有限公司 基于区块链的证书验证方法及装置、存储介质、电子装置

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105701372B (zh) * 2015-12-18 2019-04-09 布比（北京）网络技术有限公司 一种区块链身份构建及验证方法
CN106301792B (zh) * 2016-08-31 2019-10-18 江苏通付盾科技有限公司 基于区块链的ca认证管理方法、装置及系统
CN107425981B (zh) * 2017-06-12 2020-11-03 湖南岳麓山数据科学与技术研究院有限公司 一种基于区块链的数字证书管理方法及系统
CN107395343B (zh) * 2017-07-10 2019-10-25 腾讯科技（深圳）有限公司 证书管理方法及系统
CN109495490B (zh) * 2018-12-04 2021-04-09 中国电子科技集团公司第三十研究所 一种基于区块链的统一身份认证方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180322491A1 (en) * 2017-03-31 2018-11-08 Vijay K. Madisetti Method and System for Blockchain-Based Combined Identity, Ownership, Integrity and Custody Management
CN109067539A (zh) * 2018-06-13 2018-12-21 深圳前海微众银行股份有限公司 联盟链交易方法、设备及计算机可读存储介质
CN108964924A (zh) * 2018-07-24 2018-12-07 腾讯科技（深圳）有限公司 数字证书校验方法、装置、计算机设备和存储介质
CN110011988A (zh) * 2019-03-21 2019-07-12 平安科技（深圳）有限公司 基于区块链的证书验证方法及装置、存储介质、电子装置

Also Published As

Publication number Publication date
CN110011988B (zh) 2021-08-10
CN110011988A (zh) 2019-07-12

Similar Documents

Publication Publication Date Title
WO2020186788A1 (zh) 基于区块链的证书验证方法及装置、存储介质、电子装置
CN108681965B (zh) 离线节点的区块链网络交易处理方法和装置
AU2022204148B2 (en) Methods and apparatus for providing blockchain participant identity binding
CN110569675B (zh) 一种基于区块链技术的多Agent交易信息保护方法
US10944574B2 (en) Method for providing virtual asset service based on decentralized identifier and virtual asset service providing server using them
CN113972986B (zh) 基于区块链的工业互联网标识信息解析方法以及相关装置
CN110633963B (zh) 电子票据处理方法、装置、计算机可读存储介质和设备
WO2019114096A1 (zh) 基于区块链的存储系统
WO2022121538A1 (zh) 基于区块链的数据同步方法、系统及相关设备
CN110537346A (zh) 安全去中心化域名系统
CN111444550A (zh) 基于区块链的业务数据的验证方法、装置及可读存储介质
TW200424866A (en) Method and system for peer-to-peer authorization
JP2016521932A (ja) 端末識別方法、ならびにマシン識別コードを登録する方法、システム及び装置
CN110599342B (zh) 基于区块链的身份信息的授权方法及装置
CN105007301A (zh) 基于社交平台的电子证据处理系统及处理方法
JP2023542681A (ja) ブロックチェーンの許可フレームワークへのデバイスアイデンティティの統合
CN112308561A (zh) 基于区块链的存证方法、系统、计算机设备和存储介质
Dwivedi et al. Smart contract and ipfs-based trustworthy secure data storage and device authentication scheme in fog computing environment
CN112966253A (zh) 一种第三方应用集成登录方法、登录装置及平台
CN113129008B (zh) 数据处理方法、装置、计算机可读介质及电子设备
CN114519197A (zh) 一种基于区块链和云服务的数据存储架构和方法
He et al. DIV-SC: A data integrity verification scheme for centralized database using smart contract
TWI717071B (zh) 憑證管理系統及其方法
CN113300853B (zh) 金融征信信息管理方法、装置、电子设备及存储介质
CN114499896B (zh) 一种基于区块链的实名认证方法及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19920208

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19920208

Country of ref document: EP

Kind code of ref document: A1