WO2021218334A1 - 过期数字证书管控方法、系统、装置及存储介质 - Google Patents

过期数字证书管控方法、系统、装置及存储介质 Download PDF

Info

Publication number
WO2021218334A1
WO2021218334A1 PCT/CN2021/078111 CN2021078111W WO2021218334A1 WO 2021218334 A1 WO2021218334 A1 WO 2021218334A1 CN 2021078111 W CN2021078111 W CN 2021078111W WO 2021218334 A1 WO2021218334 A1 WO 2021218334A1
Authority
WO
WIPO (PCT)
Prior art keywords
digital certificate
certificate
data node
transaction
block height
Prior art date
Application number
PCT/CN2021/078111
Other languages
English (en)
French (fr)
Inventor
薛明策
Original Assignee
深圳壹账通智能科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳壹账通智能科技有限公司 filed Critical 深圳壹账通智能科技有限公司
Publication of WO2021218334A1 publication Critical patent/WO2021218334A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3821—Electronic credentials
    • G06Q20/38215—Use of certificates or encrypted proofs of transaction rights
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3825—Use of electronic signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3829—Payment protocols; Details thereof insuring higher security of transaction involving key management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures

Definitions

  • This application relates to the field of blockchain technology, and in particular to an expired digital certificate management and control method, system, device, and computer-readable storage medium.
  • Hyperledger Fabric as an excellent alliance chain framework, has a comprehensive and universal design in terms of identity management, access control, and permission policy management.
  • the Fabric blockchain network includes participants and roles such as Peer, Orderer, Client, and Admin.
  • Each participant has a digital identity that can be verified and managed by a trusted organization, and each participant has Belonging to a certification body, each agency can issue digital certificates to participants.
  • Whether the identity information of the participant is reliable can be judged by a valid digital certificate. Whether the digital certificate is valid or not needs to be judged whether the digital certificate has expired or not.
  • the verification of the validity time of the digital certificate may produce inconsistent results due to different nodes.
  • the time in the digital certificate corresponds to the physical time.
  • the verification of the same certificate by different physical machines may produce different results, so that the traditional method of judging whether the digital certificate has expired is complicated to perform and has low effectiveness.
  • This application provides an expired digital certificate management and control method, system, electronic device, and computer-readable storage medium. Its main purpose is to send a certificate request file to the CA by making the identity information and associated information of the data node form a certificate application request file, and adding a preset certificate
  • the expired block height HC generates a digital certificate.
  • the data node judges whether the digital certificate of the data node of the transaction counterparty is issued by a trusted organization; if it is not issued by a trusted organization, the transaction is invalid and the transaction processing ends.
  • a trusted organization If it is issued by a trusted organization, obtain the certificate expiration block height HC of the associated information in the digital certificate, and determine whether HB is greater than HC, if it is greater, the transaction is invalid, if it is not greater, the transaction data meets the constraints, and the transaction is placed in valid Transaction pool.
  • This method of using block height to determine whether a digital certificate has expired solves the problem that the time of each physical machine in the same block system in the traditional method is not exactly the same.
  • the verification of the valid time of the digital certificate may be caused by different data nodes. The problem of producing different results ensures the consistency of the time judgment standards of each data node in the blockchain distributed system, and improves the accuracy and validity of judging whether the digital certificate has expired.
  • the expired digital certificate management and control method provided in this application is applied to an electronic device, and the expired digital certificate management and control method includes:
  • a public-private key pair is generated at the data node.
  • the public key in the public-private key pair combines the identity information of the data node and the associated information to form a certificate application request file and sends it to the CA.
  • the CA uses the CA’s own private key to pair the certificate Sign the public key in the application request file and add the preset certificate expiration block height HC to generate a digital certificate with certificate expiration block height HC;
  • the data node judges whether the digital certificate of the data node of the transaction counterparty is issued by a trusted organization; if it is not issued by a trusted organization, the transaction is invalid and the transaction processing ends; if it is issued by a trusted organization, the certificate of the associated information in the digital certificate is obtained Expired block height HC;
  • the transactions in the transaction pool are packaged into blocks to reach a consensus, and the block height of the blockchain where the data node is located is increased by one, and the transaction processing is ended.
  • this application also provides an expired digital certificate management and control system, including a digital certificate generation unit, a credible judgment unit, an expired judgment unit, and a post-processing unit;
  • the digital certificate generation unit is used to generate a public-private key pair at a data node, and make the public key in the public-private key pair combine with the identity information of the data node and associated information to form a certificate application request file and send it to the CA.
  • the CA's own private key signs the public key in the certificate application request file, and adds a preset certificate expiration block height HC to generate a digital certificate containing the certificate expiration block height HC;
  • the credibility determination unit is used to enable the data node to determine whether the digital certificate of the counterparty in the CA's digital certificate list is issued by a trusted organization; if it is not issued by a trusted organization, the transaction is invalid and the transaction processing ends, if it is issued by a trusted organization , Then obtain the certificate expiration block height HC of the associated information in the digital certificate;
  • the expiration judging unit is used to obtain the block height HB in the blockchain system where the data node is currently located, and judge whether the HB is greater than the HC, if it is greater than the HC, the transaction is invalid, and if it is not greater than the transaction data Satisfy the constraints and put the transaction into the effective transaction pool;
  • the post-processing unit is used to package the transactions in the transaction pool to generate blocks and write them into the ledger, and add one to the block height of the blockchain where the data node is located, and terminate the transaction processing.
  • the present application also provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and running on the processor, and the processor executes the computer The right to implement the steps in the aforementioned expired digital certificate management and control method.
  • this application also provides a computer-readable storage medium that stores an expired digital certificate management and control program.
  • the expired digital certificate management and control program is executed by a processor, the aforementioned The steps of the method for managing and controlling expired digital certificates.
  • the expired digital certificate management and control method, system, electronic device, and computer-readable storage medium proposed in this application use the block height as the time standard, and compare the block height HB in the blockchain system where the data node is currently located with the advance preset
  • the size of the certificate expiration block height HC is used to determine whether the digital certificate has expired, avoiding the physical time as the time standard in the traditional method. Different physical machines may produce different results when verifying the same certificate.
  • the method for judging whether a digital certificate has expired is complicated to implement and has low effectiveness. It ensures the consistency of the time judgment standards of each data node in the blockchain distributed system, and improves the accuracy and effectiveness of judging whether a digital certificate has expired.
  • Fig. 1 is a flowchart of a method for managing and controlling an expired digital certificate according to an embodiment of the present application
  • Figure 2 is a system framework diagram of a method for managing and controlling expired digital certificates according to an embodiment of the present application
  • Fig. 3 is a schematic structural diagram of an electronic device according to an embodiment of the present application.
  • the time of each physical machine is not exactly the same.
  • the verification of the valid time of the digital certificate may produce inconsistent results due to different data nodes.
  • the time in the digital certificate corresponds to the physical time.
  • the verification of the same certificate by different physical machines may produce different results, so that the traditional method of judging whether the digital certificate has expired is complicated to perform and has low effectiveness.
  • this application provides a method for managing and controlling expired digital certificates.
  • the block height is used as the time standard, and the block height HB in the blockchain system where the data node is currently located is compared with the certificate expiration block height preset in advance.
  • the size of the HC is used to determine whether the digital certificate has expired, to ensure the consistency of the time judgment standards of each data node in the blockchain distributed system, and to improve the accuracy and effectiveness of judging whether the digital certificate has expired.
  • this application provides an expired digital certificate management and control method, which is applied to an electronic device 30.
  • Fig. 1 is a flowchart according to an embodiment of the present application. As shown in Figure 1, in this embodiment, the following steps are included:
  • S110 Generate a public-private key pair at the data node.
  • the public key in the public-private key pair combines the identity information and associated information of the data node to form a certificate application request file and send it to the CA.
  • the CA uses the CA's own private key to request the certificate application.
  • the public key in the file is signed, and the preset certificate expiration block height HC is added to generate a digital certificate with the certificate expiration block height HC;
  • the block height is an identifier of the block chain.
  • the block height is used as the standard, and the block height is used as a reference value to measure the time of the block chain.
  • the expired block height HC is a preset threshold value in advance. If the block height of the blockchain where the data node is currently located is greater than the threshold, it means that the blockchain where the data node is currently located has exceeded the preset time in advance, that is, the time of the data node’s digital certificate exceeds the preset time in advance. Set the time to determine the expiration of the digital certificate;
  • the public and private key pair uses blockchain distributed ledger technology, and enters the identity information of each data node into the server cluster according to the predefined structure of the X.509 certificate.
  • the identity information of the data node includes: host model, related configuration, asset number, etc. ;
  • CA Certificate Authority
  • CA Certificate Authority
  • the process of issuing a digital certificate is that the certificate authority uses the private key of the certificate authority to perform the related information of the data node.
  • the process of digital signature that is, the CA uses the private key of the certificate authority to digitally sign the associated information of the data node during the issuance of the digital certificate;
  • the process of generating a digital certificate by the CA includes: the CA verifies the information in the certificate application request file of the data node, and if the identity information in the information is verified, the CA issues a primary digital certificate, and then the primary digital certificate is issued by the CA. Set the certificate expiration block height HC on the certificate to generate a digital certificate;
  • the certificate expiration block height HC is the block height threshold preset in advance.
  • the block height threshold is used to determine whether the digital certificate has expired. If the block height is greater than the block height threshold, the digital certificate expires; the size of the threshold depends on the distribution The type system depends on the specific situation, and there is no specific limitation here.
  • the user registration system when verifying the user's identity contained in the information, the user registration system is generally used, such as the company's internal employee system, through which the validity of the user's identity can be verified;
  • the associated information includes: the organization, IP address, public key information of the data node, and the block height HB in the current blockchain system.
  • S120 The data node judges whether the digital certificate of the counterparty's data node in the CA's digital certificate list is issued by a trusted organization; if it is not issued by a trusted organization, the transaction is invalid and the transaction processing ends. If it is issued by a trusted organization, then Obtain the certificate expiration block height HC of the associated information in the digital certificate;
  • the data node verifies the digital signature of each digital certificate in the digital certificate list in turn, thereby determining whether the digital certificate of the counterparty in the digital certificate list of the CA is issued by a trusted organization.
  • each data node maintains a list of trusted CA digital certificates.
  • the digital certificate list contains all the digital certificates of the CA itself.
  • Each node agrees that the digital certificate in the list corresponds to the CA
  • the issued digital certificate is the basic premise of credibility. Therefore, the method of verifying whether the digital certificate in the transaction is issued by a trusted authority is: sequentially verify the signature in the digital certificate in the transaction through the digital certificates in the certificate list, So as to determine whether the certificate in the transaction is issued by a trusted CA;
  • the HC set when the digital certificate was generated can be obtained from the digital certificate; HC, as a basic information in the digital certificate, can be used to determine whether the digital certificate is in the region.
  • the effective time range on the blockchain system After confirming that the digital certificate in the transaction is issued by a trusted CA, the HC set when the digital certificate was generated can be obtained from the digital certificate; HC, as a basic information in the digital certificate, can be used to determine whether the digital certificate is in the region.
  • S130 Obtain the block height HB in the blockchain system where the data node is currently located, and determine whether the HB is greater than the HC. If it is greater, the transaction is invalid; if it is not greater, the transaction data meets the constraint, that is, the transaction is valid, and Put the transaction into the effective transaction pool.
  • the blockchain system includes one or more blockchains.
  • the data chain system where the data node is currently located is the blockchain system where the data node is located;
  • the process of judging whether the HB is greater than the HC includes:
  • the HB is greater than the HC, which means that the current block height of the data node in the digital certificate of the counterparty's digital certificate is greater than the certificate expiration block height.
  • the counterparty's digital certificate has expired, and the digital certificate expires, the transaction will be processed. invalid;
  • the HB is smaller than the HC, which means that the current block height of the data node shown in the counterparty’s digital certificate is smaller than the certificate expiration block height.
  • the counterparty’s digital certificate has not expired, and the digital certificate has not expired. The transaction is valid.
  • each data node (Peer node) in the blockchain obtains the HB in the current ledger where the data node is located, and then the data node verifies whether the HB is greater than the HC. If it is greater than, it indicates that the identity of the initiator of the transaction (digital certificate) has expired, and the transaction is invalid; otherwise, the identity of the initiator of the transaction is valid; among them, since the verification process of the transaction is carried out sequentially, during the verification period, HB will not Change;
  • the ledger (Ledgerium) is a distributed digital ledger that efficiently records transactions between parties in a verifiable and permanent manner;
  • MVCC verification of the transaction information is performed to prevent the transaction from being read during execution
  • the data value on the blockchain has not been changed before the verification is completed.
  • a flag bit is used to indicate whether the transaction is valid, and the transaction is placed in a transaction pool.
  • the process of checking whether the transaction itself is valid includes, in Fabric, the Peer in the data node verifies whether the transaction meets the endorsement policy through the VSCC system smart contract, that is, only transactions that meet certain rules can pass the verification.
  • the transaction rules are based on the specific transaction. It depends. For example, if there are three institutions, the endorsement policy can be set to be signed by a majority of the three institutions before the transaction can be considered legal, that is, any two institutions need to sign the transaction to be legal.
  • S140 Pack the transactions in the transaction pool into blocks to reach a consensus, add one to the block height of the blockchain where the data node is located, and end transaction processing.
  • the process of packaging the transactions in the transaction pool into blocks to reach a consensus includes:
  • the consensus module of the blockchain system packages multiple consecutive transactions in the transaction pool into blocks according to custom rules
  • a consensus vote is carried out. After all nodes reach a consensus, the block is broadcast to all data nodes; the consensus algorithm includes the PBFT algorithm and the RAFT algorithm;
  • the data node receives the block and writes the block to the local blockchain ledger.
  • the block is processed;
  • the rules when packaged into blocks according to custom rules, in Fabric, can be the time when the transaction is generated, or the size of the continuous transaction. For example, three seconds after the first transaction is generated, the first transaction and three All transactions generated in a second are packaged into a block; blocks can also be generated according to the size of continuous transactions, such as setting the total transaction size in the block to 4M, and when the total transaction size exceeds 4M in the transaction pool, the transaction All transactions in the pool are packaged into a block.
  • This application starts from the block height and uses the block height as the time standard to determine the number by comparing the block height HB in the blockchain system where the data node is currently located with the pre-set certificate expiration block height HC. Whether the certificate has expired or not, avoiding the use of physical time as the time standard in the traditional method. Different physical machines may produce different results when verifying the same certificate. As a result, the traditional method of judging whether a digital certificate has expired is complicated and effective. The problem of low performance ensures the consistency of the time discrimination standards of each data node in the blockchain distributed system, and improves the accuracy and validity of judging whether the digital certificate has expired.
  • FIG. 2 is a framework diagram of an expired digital certificate management and control system 200 according to an embodiment of the present application.
  • the system corresponds to an expired digital certificate management and control method and is placed in an expired digital certificate management and control electronic device 30.
  • the system 200 includes a digital certificate generation unit 210 for generating a digital certificate, a credibility determination unit 220 for credibility determination of the digital certificate generated by the digital certificate generation unit 210, and a credibility determination unit 220 for determining that the credibility determination unit 220 is An expiration judging unit 230 for judging whether a trusted digital certificate has expired, and a post-processing unit 240 for post-processing the transaction of the data node to which the non-expired digital certificate belongs;
  • the digital certificate generation unit 210 is used to generate a public-private key pair at a data node, and make the public key in the public-private key pair combine with the identity information and associated information of the data node to form a certificate application request file and send it to the CA.
  • the CA uses the CA's own The private key signs the public key in the certificate application request file, and adds the preset certificate expiration block height HC to generate a digital certificate containing the certificate expiration block height HC;
  • the digital certificate generation unit 210 includes a request file module 211, a verification module 212, and a block height preset module 213.
  • the request file module 211 is used to make the data node locally generate a public and private key pair, and generate a data node associated information.
  • Certificate application request file; the verification module 212 is used to send the certificate application request file to the CA to make the CA read the information in the request and check whether the information in the request is legal;
  • the block height preset module 213 is used to preset the certificate expiration Block height, and set the certificate expiration block height in the initial digital certificate to generate a digital certificate;
  • the credibility determination unit 220 is used to enable the data node to determine whether the digital certificate of the counterparty in the CA's digital certificate list is issued by a trusted organization; if it is not issued by a trusted organization, the transaction is invalid and the transaction processing ends. If it is issued by a trusted organization, Obtain the certificate expiration block height HC of the associated information in the digital certificate;
  • the expiration judging unit 230 is used to obtain the block height HB in the blockchain system where the data node is currently located, and judge whether the HB is greater than the HC.
  • the transaction is placed in the effective transaction pool;
  • the post-processing unit 240 is used to package the transactions in the transaction pool to generate blocks and write them into the ledger.
  • the block height of the blockchain where the data node is located is increased by one to end the transaction processing.
  • the electronic device 30 may be a terminal device with arithmetic functions such as a server, a tablet computer, a portable computer, or a desktop computer.
  • the electronic device 30 includes a processor 31, a memory 32, a computer program 33, a network interface, and a communication bus.
  • the electronic device 30 may be a tablet computer, a desktop computer, or a smart phone, but is not limited thereto.
  • the memory 32 includes at least one type of readable storage medium.
  • the at least one type of readable storage medium may be a non-volatile storage medium such as flash memory, hard disk, multimedia card, card-type memory, and the like.
  • the readable storage medium may be an internal storage unit of the electronic device 30, such as a hard disk of the electronic device 30.
  • the readable storage medium may also be an external memory of the electronic device 30, such as a plug-in hard disk equipped on the electronic device 30, or a smart memory card (Smart Memory Card).
  • the readable storage medium of the memory 32 is generally used to store the computer program 33 installed in the electronic device 30 and the like.
  • the processor 31 may be a central processing unit (Central Processing Unit) in some embodiments.
  • Central Processing Unit CPU
  • CPU central processing unit
  • microprocessor microprocessor or other data processing chip, used to run the program code or processing data stored in the memory 32, such as an expired digital certificate management and control program.
  • the network interface may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface), and is generally used to establish a communication connection between the electronic device 30 and other electronic devices.
  • a standard wired interface such as a WI-FI interface
  • WI-FI interface wireless interface
  • the communication bus is used to realize the connection and communication between these components.
  • FIG. 3 only shows the electronic device 30 with the components 31-33, but it should be understood that it is not required to implement all the illustrated components, and more or fewer components may be implemented instead.
  • the memory 32 as a computer storage medium may include an operating system and an expired digital certificate management and control program; the processor 31 executes the expired digital certificate management and control program stored in the memory 32. The following steps:
  • the public key in the public-private key pair combines the identity information of the data node and the associated information to form a certificate application request file and send it to the CA.
  • the CA uses the CA's own private key in the certificate application request file
  • the public key of the certificate is signed, and the preset certificate expiration block height HC is added to generate a digital certificate with the certificate expiration block height HC;
  • the data node judges whether the digital certificate of the data node of the transaction counterparty is issued by a trusted organization; if it is not issued by a trusted organization, the transaction is invalid and the transaction processing ends; if it is issued by a trusted organization, the certificate for obtaining the associated information in the digital certificate expires Block height HC;
  • the transaction in the transaction pool is packaged into a block to reach a consensus, and the block height of the block chain where the data node is located is increased by one, and the transaction processing is ended.
  • the CA is used to issue a digital certificate to the data node to indicate that the data node is a qualified identity.
  • the CA uses the private key of the certification authority to digitally sign the associated information of the data node.
  • the associated information includes: the organization, IP address, public key information of the data node, and the block height HB in the current blockchain system.
  • the CA verifies the information in the certificate application request file of the data node, and if the identity information in the information is verified, the CA issues a primary digital certificate;
  • the data node determines whether the digital certificate of the counterparty in the digital certificate list of the CA is issued by a trusted organization by sequentially verifying the digital signatures of each digital certificate in the digital certificate list.
  • the process of judging whether the HB is greater than the HC includes:
  • HB is greater than the HC, it means that the current block height of the data node in the blockchain system shown in the counterparty's digital certificate is greater than the certificate expiration block height, and the counterparty's digital certificate has expired and the transaction is invalid;
  • the HB is smaller than the HC, it means that the block height of the current blockchain system of the data node shown in the counterparty's digital certificate is smaller than the certificate expiration block height, and the counterparty's digital certificate has not expired and the transaction is valid.
  • the process of packaging the transactions in the transaction pool into blocks to reach a consensus includes:
  • the consensus module of the blockchain system packages multiple consecutive transactions in the transaction pool into blocks according to custom rules
  • a consensus vote is carried out. After all nodes reach a consensus, the block is broadcast to all data nodes;
  • the data node receives the block and writes the block to the local blockchain.
  • the height of the block in the current blockchain system is increased by one.
  • the consensus algorithm includes PBFT algorithm and RAFT algorithm.
  • the embodiment of the present application also proposes a computer-readable storage medium.
  • the computer-readable storage medium may be non-volatile or volatile.
  • the computer-readable storage medium includes an expired digital certificate management and control program. The steps of implementing the expired digital certificate management and control method when the expired digital certificate management and control program is executed by the processor:
  • the public key in the public-private key pair combines the identity information of the data node and the associated information to form a certificate application request file and send it to the CA.
  • the CA uses the CA's own private key in the certificate application request file Sign the public key of, and add the preset certificate expiration block height HC to generate a digital certificate with a digital expiration block height HC;
  • the data node judges whether the digital certificate of the data node of the transaction counterparty is issued by a trusted organization; if it is not issued by a trusted organization, the transaction is invalid and the transaction processing ends; if it is issued by a trusted organization, the certificate for obtaining the associated information in the digital certificate expires Block height HC;
  • the transaction in the transaction pool is packaged into a block to reach a consensus, and the block height of the block chain where the data node is located is increased by one, and the transaction processing is ended.
  • the specific implementation of the computer-readable storage medium of the present application is substantially the same as the specific implementation of the expired digital certificate management and control method, system, and electronic device, and will not be repeated here.

Landscapes

  • Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Computer Security & Cryptography (AREA)
  • Accounting & Taxation (AREA)
  • Theoretical Computer Science (AREA)
  • Strategic Management (AREA)
  • Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Finance (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

提出一种过期数字证书管控方法、系统、装置及计算机可读存储介质，涉及区块链技术领域，该方法包括：公钥结合数据节点的身份信息以及关联信息构成证书申请请求文件发送到CA，CA添加预设的证书过期区块高度HC生成数字证书；数据节点判断交易对方的数字证书是否是可信机构颁发；若不是可信机构颁发，则交易无效，交易处理结束，若是可信机构颁发，则获取数字证书中关联信息的证书过期区块高度HC；获取数据节点当前所处区块链系统中的区块高度HB，判断HB是否大于HC，若不大于，则将交易放入有效交易池；将所述交易池中的交易打包成区块达成共识，所述数据节点所处区块链的区块高度加一，结束交易处理。

Description

过期数字证书管控方法、系统、装置及存储介质
本申请要求于2020年4月27日提交中国专利局、申请号为202010345455.2，发明名称为“过期数字证书管控方法、系统、装置及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及区块链技术领域，尤其涉及一种过期数字证书管控方法、系统、装置及计算机可读存储介质。
 背景技术
超级账本Hyperledger Fabric作为一个出色的联盟链框架，在身份管理、接入控制和权限策略管控方面有着全面且通用的设计。在Fabric区块链网络下，包含Peer、Orderer、Client和Admin等参与者和角色，每个参与者都拥有一个数字身份，该身份可验证且由可信机构管理控制，并且每个参与者都属于某个认证机构，每个机构均可为参与者颁发数字证书。
参与者的身份信息是否可靠可以通过有效数字证书来判断，数字证书是否有效需要首先判别该数字证书有无过期，判断数字证书有无过期的过程中均需要预先设置多个提醒时间阈值以及与之相对应的检索进程，然后再根据提醒时间阈值、预设的检索间隔时间以及当前时间确定各个检索进程的时间检索范围、截止日期等，再分别查询即将在各个检索进程的截止日期、截止时间检索范围内到期的数字证书，根据查询结果获取有效期与多个提醒时间阈值相对应的数字证书，发明人发现在一个分布式的系统中，各个物理机器的时间并不完全相同，当一个证书将要过期时，对数字证书有效时间的验证有可能会因不同节点而产生不一致的结果。数字证书中的时间对应的是物理时间，不同的物理机器对同一个证书的验证可能会产生不同的结果，以致传统的判别数字证书有无过期的方法执行复杂，且有效性低。
因此，亟须一种过期数字证书管控方法，以保证区块链分布式系统中各个数据节点时间判别标准的一致性，提高判别数字证书有无过期的准确、有效性。
 技术问题
本申请提供一种过期数字证书管控方法、系统、电子装置及计算机可读存储介质，其主要目的在于通过使数据节点的身份信息以及关联信息构成证书申请请求文件发送到CA，添加预设的证书过期区块高度HC生成数字证书，在数据节点进行双方交易时，数据节点判断交易对方的数据节点的数字证书是否是可信机构颁发；若不是可信机构颁发，则交易无效，交易处理结束，若是可信机构颁发，则获取数字证书中关联信息的证书过期区块高度HC，并判断HB是否大于HC，若大于，则交易无效，若不大于，则交易数据满足约束，将交易放入有效交易池，这种利用区块高度判定数字证书有无过期的方法解决了传统方法中相同区块系统各个物理机器的时间不完全相同，对数字证书有效时间的验证有可能会因不同数据节点而产生不同结果的问题，保证区块链分布式系统中各个数据节点时间判别标准的一致性，提高判别数字证书有无过期的准确、有效性。
为实现上述目的，本申请提供的过期数字证书管控方法，应用于电子装置，所述过期数字证书管控方法包括：
在数据节点生成公私钥对，所述公私钥对中的公钥结合所述数据节点的身份信息以及关联信息构成证书申请请求文件发送到CA，所述CA通过CA自身的私钥对所述证书申请请求文件中的公钥进行签名，并添加预设的证书过期区块高度HC，以生成设有证书过期区块高度HC的数字证书；
所述数据节点判断交易对方的数据节点的数字证书是否是可信机构颁发；若不是可信机构颁发，则交易无效，交易处理结束，若是可信机构颁发，则获取数字证书中关联信息的证书过期区块高度HC；
获取所述数据节点当前所处区块链系统中的区块高度HB，判断所述HB是否大于所述HC，若大于，则交易无效，若不大于，则交易有效，并将所述交易放入有效交易池；
将所述交易池中的交易打包成区块达成共识，所述数据节点所处区块链的区块高度加一，结束交易处理。
为实现上述目的，本申请还提供一种过期数字证书管控系统，包括数字证书生成单元、可信判断单元、过期判断单元和后期处理单元；
所述数字证书生成单元用于在数据节点生成公私钥对，令所述公私钥对中的公钥结合所述数据节点的身份信息以及关联信息构成证书申请请求文件发送到CA，所述CA通过CA自身的私钥对所述证书申请请求文件中的公钥进行签名，并添加预设的证书过期区块高度HC，以生成含有证书过期区块高度HC的数字证书；
所述可信判断单元用于使数据节点判断CA的数字证书列表中交易对方的数字证书是否是可信机构颁发；若不是可信机构颁发，则交易无效，交易处理结束，若是可信机构颁发，则获取数字证书中关联信息的证书过期区块高度HC；
所述过期判断单元用于获取所述数据节点当前所处区块链系统中的区块高度HB，判断所述HB是否大于所述HC，若大于，则交易无效，若不大于，则交易数据满足约束，将交易放入有效交易池；
所述后期处理单元用于将交易池中的交易打包生成区块并写入账本，并使所述数据节点所处区块链的区块高度加一，结束交易处处理。
为实现上述目的，本申请还提供一种电子装置，该装置包括：存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机程序，所述处理器执行所述计算机程序时实现权前述的过期数字证书管控方法中的步骤。
此外，为实现上述目的，本申请还提供一种计算机可读存储介质，所述计算机可读存储介质中存储有过期数字证书管控程序，所述过期数字证书管控程序被处理器执行时，实现前述的过期数字证书管控方法的步骤。
本申请提出的过期数字证书管控方法、系统、电子装置及计算机可读存储介质，以区块高度作为时间标准，通过比较数据节点当前所处区块链系统中的区块高度HB与提前预设的证书过期区块高度HC的大小，来判定数字证书有无过期，避免了传统方法中以物理时间为时间标准，不同的物理机器对同一个证书的验证可能会产生不同的结果，以致传统的判别数字证书有无过期的方法执行复杂，且有效性低的问题，保证区块链分布式系统中各个数据节点时间判别标准的一致性，提高判别数字证书有无过期的准确、有效性。
 技术解决方案
在此处键入技术解决方案描述段落。
 有益效果
在此处键入有益效果描述段落。
 附图说明
图1为根据本申请实施例的过期数字证书管控方法的流程图；
图2为根据本申请实施例的过期数字证书管控方法的系统框架图；
图3为根据本申请实施例的电子装置的结构示意图。
本申请目的的实现、功能特点及优点将结合实施例，参照附图做进一步说明。
 本发明的最佳实施方式
在此处键入本发明的最佳实施方式描述段落。
 本发明的实施方式
应当理解，此处所描述的具体实施例仅用以解释本申请，并不用于限定本申请。
在一个分布式的系统中，各个物理机器的时间并不完全相同，当一个证书将要过期时，对数字证书有效时间的验证有可能会因数据节点的不同而产生不一致的结果。数字证书中的时间对应的是物理时间，不同的物理机器对同一个证书的验证可能会产生不同的结果，以致传统的判别数字证书有无过期的方法执行复杂，且有效性低。
基于上述问题，本申请提供一种过期数字证书管控方法，以区块高度作为时间标准，通过比较数据节点当前所处区块链系统中的区块高度HB与提前预设的证书过期区块高度HC的大小，来判定数字证书有无过期，保证区块链分布式系统中各个数据节点时间判别标准的一致性，提高判别数字证书有无过期的准确、有效性。
具体的，本申请提供一种过期数字证书管控方法，应用于一种电子装置30。
图1为根据本申请实施例的的流程图。如图1所示，在本实施例中，包括如下步骤：
S110：在数据节点生成公私钥对，该公私钥对中的公钥结合该数据节点的身份信息以及关联信息构成证书申请请求文件发送到CA，该CA通过CA自身的私钥对该证书申请请求文件中的公钥进行签名，并添加预设的证书过期区块高度HC，以生成设有证书过期区块高度HC的数字证书；
区块高度为区块链的一种标识符，在此以区块高度为标准，将区块高度作为衡量区块链时间的一个参考值，该过期区块高度HC为提前预设的一个阈值，若数据节点当前所处区块链的区块高度大于该阈值，则说明数据节点当前所处区块链已经超出了提前预设的时间，即该数据节点的数字证书的时间超过了提前预设的时间，进而判定该数字证书过期；
该公私钥对采用区块链分布式账本技术，按照X.509证书的预定义结构将各数据节点的身份信息录入服务器集群中，数据节点的身份信息包括：主机型号，相关配置，资产编号等；
CA（CertificateAuthorities，证书颁发机构）用于为该数据节点颁发数字证书以表明该数据节点为合格身份，颁发数字证书的过程为证书颁发机构通过证书颁发机构本身的私钥对数据节点的关联信息进行数字签名的过程，即CA在颁发数字证书的过程中通过证书颁发机构本身的私钥对数据节点的关联信息进行数字签名；
该CA生成数字证书的过程包括：该CA对该数据节点的证书申请请求文件中的信息进行核实验证，若该信息中的身份信息验证通过，则该CA签发初级数字证书，然后在该初级数字证书上设置证书过期区块高度HC，生成数字证书；
证书过期区块高度HC为提前预设的区块高度阈值，该区块高度阈值用于判定数字证书有无过期，若区块高度大于该区块高度阈值则数字证书过期；阈值的大小依据分布式系统具体情况而定，在此不作具体限定。
其中，在核实信息中包含的用户身份时，一般通过用户注册系统，如公司内部的员工系统，通过该系统可以验证用户身份的有效性；
该关联信息包括：该数据节点的所属机构、IP地址、公钥信息以及当前所处区块链系统中的区块高度HB。
S120：该数据节点判断交易对方的数据节点在CA的数字证书列表中的数字证书是否是可信机构颁发；若不是可信机构颁发，则交易无效，交易处理结束，若是可信机构颁发，则获取数字证书中关联信息的证书过期区块高度HC；
该数据节点通过依次验证该数字证书列表中各个数字证书的数字签名，从而判断CA的数字证书列表中交易对方的数字证书是否是可信机构颁发。
在区块链系统中，每个数据节点均会维护一份可信CA的数字证书列表，在该数字证书列表中包含所有CA本身的数字证书，每个节点认同由该列表中数字证书对应CA签发的数字证书是可信的这一基本前提，因此，验证交易中的数字证书是否由可信机构颁发的方法为：通过该证书列表中的数字证书依次验证交易中的数字证书中的签名，从而确定交易中的证书是否由可信CA签发；
当确认交易中的数字证书是由可信CA机构颁发后，则可以从数字证书中获取该数字证书生成时设置的HC；HC作为数字证书中的一个基本信息，可以用来判断数字证书在区块链系统上的有效时间范围。
S130：获取该数据节点当前所处区块链系统中的区块高度HB，判断该HB是否大于该HC，若大于，则交易无效，若不大于，则交易数据满足约束，即交易有效，并将交易放入有效交易池，区块链系统包括一个或多个区块链，数据节点当前所处的数据链系统为数据节点所处区块链所在的区块链系统；
在判断该HB是否大于该HC的过程中，包括：
该HB大于该HC，代表交易对方的数字证书中出示的数据节点当前所处区块链系统中的区块高度比证书过期区块高度大，交易对方的数字证书已过期，数字证书过期则交易无效；
该HB小于该HC，代表交易对方的数字证书中出示的数据节点当前所处区块链系统中的区块高度比证书过期区块高度小，交易对方的数字证书未过期，数字证书未过期则交易有效。
具体的，区块链中每个数据节点（Peer节点）获取数据节点所处当前账本中的HB，然后该数据节点验证该HB是否大于HC。如果大于，则表明交易的发起方的身份(数字证书)已经过期，交易无效；否则，交易的发起方身份有效；其中，由于交易的验证过程是顺序地进行的，因此验证期间， HB不会改变；其中，该账本（Ledgerium）为一种分布式数字分类账，以可验证和永久的方式高效地记录各方之间的交易；
若数字证书未过期（交易的发起者身份确认有效），则检查交易本身是否有效，另外，为了防止双花（双方消耗），对交易的信息进行MVCC验证，从而防止交易在执行期间读取到的区块链上的数据值，在完成验证之前没有被更改过，当交易验证完成后，通过一个标志位标示该交易是否有效，并将该交易放入一个交易池中。
其中，检查交易本身是否有效的过程包括，在Fabric中，数据节点中的 Peer通过VSCC系统智能合约验证交易是否满足背书策略，即只有满足一定规则的交易才可以通过该验证，交易规则根据交易具体而定，比如如果有三个机构，可以设置背书策略为三个机构中的多数签名，才能认为交易合法，即需要任意两个机构为该交易签名才能合法。
S140：将该交易池中的交易打包成区块达成共识，该数据节点所处区块链的区块高度加一，结束交易处理。
将该交易池中的交易打包成区块达成共识的过程，包括：
区块链系统的共识模块将该交易池中连续的多个交易按照自定义规则打包成区块；
基于共识算法，进行共识表决，在所有节点达成共识后，将该区块广播至所有数据节点；该共识算法包括PBFT算法、RAFT算法；
该数据节点接收该区块，并将该区块写入至本地的区块链账本上，当前所处区块链系统中的区块高度随之加一；具体的，节点收到区块后，首先将区块写入到本地的区块链上，此时区块的高度加一，即HB=HB+1。然后依次取出区块中的交易，并将标志位为有效的交易中的数据值提交到状态数据库中，完成最终区块链上数据值状态的更新，当区块中的所有交易处理完成后，该区块处理完毕；
其中，按照自定义规则打包成区块时，在Fabric中，规则可以是产生交易的时间，也可以是连续交易的大小，如当第一个交易产生三秒后，将第一个交易以及三秒中产生的所有交易打包成一个区块；也可以根据连续交易的大小生成区块，如设置区块中交易总大小设置成4M，当交易池中当交易总大小超过4M时，则将交易池中的所有交易打包成一个区块。
本申请从区块高度入手，以区块高度作为时间标准，通过比较数据节点当前所处区块链系统中的区块高度HB与提前预设的证书过期区块高度HC的大小，来判定数字证书有无过期，避免了传统方法中以物理时间为时间标准，不同的物理机器对同一个证书的验证可能会产生不同的结果，以致传统的判别数字证书有无过期的方法执行复杂，且有效性低的问题，保证区块链分布式系统中各个数据节点时间判别标准的一致性，提高判别数字证书有无过期的准确、有效性。
图2为根据本申请实施例的过期数字证书管控系统200的框架图，该系统对应于过期数字证书管控方法，置于过期数字证书管控电子装置30中。该系统200包括用于生成数字证书的数字证书生成单元210，用于对数字证书生成单元210所生成的数字证书进行可信判断的可信判断单元220，用于对可信判断单元220判断为可信的数字证书进行有无过期判断的过期判断单元230，和用于对未过期的数字证书的所属数据节点的交易进行后期处理的后期处理单元240；
数字证书生成单元210用于在数据节点生成公私钥对，令该公私钥对中的公钥结合所述数据节点的身份信息以及关联信息构成证书申请请求文件发送到CA，该CA通过CA自身的私钥对该证书申请请求文件中的公钥进行签名，并添加预设的证书过期区块高度HC，以生成含有证书过期区块高度HC的数字证书；
具体的，该数字证书生成单元210包括请求文件模块211、验证模块212和区块高度预设模块213，请求文件模块211用于令数据节点本地生成公私钥对，将数据节点的关联信息生成一个证书申请请求文件；验证模块212用于将该证书申请请求文件发送到CA，令CA读取请求中的信息，检查请求中的信息是否合法；区块高度预设模块213用于预设证书过期区块高度，并在最初数字证书中设置证书过期区块高度，生成数字证书；
可信判断单元220用于使数据节点判断CA的数字证书列表中交易对方的数字证书是否是可信机构颁发；若不是可信机构颁发，则交易无效，交易处理结束，若是可信机构颁发，则获取数字证书中关联信息的证书过期区块高度HC；
过期判断单元230用于获取该数据节点当前所处区块链系统中的区块高度HB，判断该HB是否大于该HC，若大于，则交易无效，若不大于，则交易数据满足约束，将交易放入有效交易池；
后期处理单元240用于将交易池中的交易打包生成区块并写入账本，数据节点所处区块链的区块高度加一，结束交易处处理。
图3为根据本申请实施例的电子装置的逻辑结构示意图，在本实施例中，电子装置30可以是服务器、平板计算机、便携计算机、桌上型计算机等具有运算功能的终端设备。
该电子装置30包括：处理器31、存储器32、计算机程序33、网络接口及通信总线。
电子装置30可以是平板电脑、台式电脑、智能手机，但不限于此。
存储器32包括至少一种类型的可读存储介质。至少一种类型的可读存储介质可为如闪存、硬盘、多媒体卡、卡型存储器等的非易失性存储介质。在一些实施例中，可读存储介质可以是电子装置30的内部存储单元，例如该电子装置30的硬盘。在另一些实施例中，可读存储介质也可以是电子装置30的外部存储器，例如电子装置30上配备的插接式硬盘，智能存储卡（Smart Media Card, SMC），安全数字（Secure Digital, SD）卡，闪存卡（Flash Card）等。
在本实施例中，存储器32的可读存储介质通常用于存储安装于电子装置30的计算机程序33等。
处理器31在一些实施例中可以是一中央处理器（Central Processing Unit, CPU），微处理器或其他数据处理芯片，用于运行存储器32中存储的程序代码或处理数据，例如过期数字证书管控程序等。
网络接口可选地可以包括标准的有线接口、无线接口（如WI-FI接口），通常用于在该电子装置30与其他电子设备之间建立通信连接。
通信总线用于实现这些组件之间的连接通信。
图3仅示出了具有组件31-33的电子装置30，但是应理解的是，并不要求实施所有示出的组件，可以替代的实施更多或者更少的组件。
在图3所示的电子装置实施例中，作为一种计算机存储介质的存储器32中可以包括操作系统、以及过期数字证书管控程序；处理器31执行存储器32中存储的过期数字证书管控程序时实现如下步骤：
在数据节点生成公私钥对，该公私钥对中的公钥结合该数据节点的身份信息以及关联信息构成证书申请请求文件发送到CA，该CA通过CA自身的私钥对该证书申请请求文件中的公钥进行签名，并添加预设的证书过期区块高度HC，以生成设有证书过期区块高度HC的数字证书；
该数据节点判断交易对方的数据节点的数字证书是否是可信机构颁发；若不是可信机构颁发，则交易无效，交易处理结束，若是可信机构颁发，则获取数字证书中关联信息的证书过期区块高度HC；
获取该数据节点当前所处区块链系统中的区块高度HB，判断该HB是否大于该HC，若大于，则交易无效，若不大于，则交易有效，并将交易放入有效交易池；
将该交易池中的交易打包成区块达成共识，该数据节点所处区块链的区块高度加一，结束交易处理。
该CA用于为该数据节点颁发数字证书以表明该数据节点为合格身份，该CA在颁发数字证书的过程中通过证书颁发机构本身的私钥对数据节点的关联信息进行数字签名。
该关联信息包括：该数据节点的所属机构、IP地址、公钥信息以及当前所处区块链系统中的区块高度HB。
CA对该数据节点的证书申请请求文件中的信息进行核实验证，若该信息中的身份信息验证通过，则该CA签发初级数字证书；
在该初级数字证书上设置证书过期区块高度HC，生成数字证书。
该数据节点通过依次验证该数字证书列表中各个数字证书的数字签名，判断CA的数字证书列表中交易对方的数字证书是否是可信机构颁发。
在判断该HB是否大于该HC的过程中，包括：
若该HB大于该HC，代表交易对方的数字证书中出示的数据节点当前所处区块链系统中的区块高度比证书过期区块高度大，交易对方的数字证书已过期，交易无效；
若该HB小于该HC，代表交易对方的数字证书中出示的数据节点当前所处区块链系统中的区块高度比证书过期区块高度小，交易对方的数字证书未过期，交易有效。
将该交易池中的交易打包成区块达成共识的过程，包括：
区块链系统的共识模块将该交易池中连续的多个交易按照自定义规则打包成区块；
基于共识算法，进行共识表决，在所有节点达成共识后，将该区块广播至所有数据节点；
该数据节点接收该区块，并将该区块写入至本地的区块链上，当前所处区块链系统中的区块高度加一。
该共识算法包括PBFT算法、RAFT算法。
此外，本申请实施例还提出一种计算机可读存储介质，所述计算机可读存储介质可以是非易失性，也可以是易失性，该计算机可读存储介质中包括过期数字证书管控程序，该过期数字证书管控程序被处理器执行时实现过期数字证书管控方法的步骤：
在数据节点生成公私钥对，该公私钥对中的公钥结合该数据节点的身份信息以及关联信息构成证书申请请求文件发送到CA，该CA通过CA自身的私钥对该证书申请请求文件中的公钥进行签名，并添加预设的证书过期区块高度HC，以生成设有数字过期区块高度HC的数字证书；
该数据节点判断交易对方的数据节点的数字证书是否是可信机构颁发；若不是可信机构颁发，则交易无效，交易处理结束，若是可信机构颁发，则获取数字证书中关联信息的证书过期区块高度HC；
获取该数据节点当前所处区块链系统中的区块高度HB，判断该HB是否大于该HC，若大于，则交易无效，若不大于，则交易有效，并将交易放入有效交易池；
将该交易池中的交易打包成区块达成共识，该数据节点所处区块链的区块高度加一，结束交易处理。
本申请之计算机可读存储介质的具体实施方式与过期数字证书管控方法、系统、电子装置的具体实施方式大致相同，在此不再赘述。
需要说明的是，在本文中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、装置、物品或者方法不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、装置、物品或者方法所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、装置、物品或者方法中还存在另外的相同要素。
上述本申请实施例序号仅仅为了描述，不代表实施例的优劣。通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到上述实施例方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在如上所述的一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是计算机，服务器，或者网络设备等)执行本申请各个实施例所述的方法。
以上仅为本申请的优选实施例，并非因此限制本申请的专利范围，凡是利用本申请说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，均同理包括在本申请的专利保护范围内。
 工业实用性
在此处键入工业实用性描述段落。
 序列表自由内容
在此处键入序列表自由内容描述段落。

Claims (20)

  1. 一种过期数字证书管控方法，应用于电子装置，其中，所述方法包括：
    在数据节点生成公私钥对，所述公私钥对中的公钥结合所述数据节点的身份信息以及关联信息构成证书申请请求文件发送到CA，所述CA通过CA自身的私钥对所述证书申请请求文件中的公钥进行签名，并添加预设的证书过期区块高度HC，以生成设有证书过期区块高度HC的数字证书；
    所述数据节点判断交易对方的数据节点的数字证书是否是可信机构颁发；若不是可信机构颁发，则交易无效，交易处理结束，若是可信机构颁发，则获取数字证书中关联信息的证书过期区块高度HC；
    获取所述数据节点当前所处区块链系统中的区块高度HB，判断所述HB是否大于所述HC，若大于，则交易无效，若不大于，则交易有效，并将所述交易放入有效交易池；
    将所述交易池中的交易打包成区块达成共识，所述数据节点所处区块链的区块高度加一，结束交易处理。
  2. 根据权利要求1所述的过期数字证书管控方法，其中，所述CA用于为所述数据节点颁发数字证书以表明所述数据节点为合格身份，所述CA在颁发数字证书的过程中通过证书颁发机构本身的私钥对数据节点的关联信息进行数字签名。
  3. 根据权利要求2所述的过期数字证书管控方法，其中，
    所述关联信息包括：所述数据节点的所属机构、IP地址、公钥信息以及当前所处区块链系统中的区块高度HB。
  4. 根据权利要求1所述的过期数字证书管控方法，其中，生成数字证书的过程，包括：
    所述CA对所述数据节点的证书申请请求文件中的信息进行核实验证，若所述信息中的身份信息验证通过，则所述CA签发初级数字证书；
    在所述初级数字证书上设置证书过期区块高度HC，生成数字证书。
  5. 根据权利要求1所述的过期数字证书管控方法，其中，所述数据节点通过依次验证所述数字证书列表中各个数字证书的数字签名，判断CA的数字证书列表中交易对方的数字证书是否是可信机构颁发。
  6. 根据权利要求1所述的过期数字证书管控方法，其中，在判断所述HB是否大于所述HC的过程中，包括：
    若所述HB大于所述HC，代表交易对方的数字证书中出示的数据节点当前所处区块链系统中的区块高度比证书过期区块高度大，交易对方的数字证书已过期，交易无效；
    若所述HB小于所述HC，代表交易对方的数字证书中出示的数据节点当前所处区块链系统中的区块高度比证书过期区块高度小，交易对方的数字证书未过期，交易有效。
  7. 根据权利要求1所述的过期数字证书管控方法，其中，将所述交易池中的交易打包成区块达成共识的过程，包括：
    区块链系统的共识模块将所述交易池中连续的多个交易按照自定义规则打包成区块；
    基于共识算法，进行共识表决，在所有节点达成共识后，将所述区块广播至所有数据节点；
    所述数据节点接收所述区块，并将所述区块写入至本地的区块链上，当前所处区块链系统中的区块高度加一。
  8. 一种过期数字证书管控系统，其中，包括数字证书生成单元、可信判断单元、过期判断单元和后期处理单元；
    所述数字证书生成单元用于在数据节点生成公私钥对，令所述公私钥对中的公钥结合所述数据节点的身份信息以及关联信息构成证书申请请求文件发送到CA，所述CA通过CA自身的私钥对所述证书申请请求文件中的公钥进行签名，并添加预设的证书过期区块高度HC，以生成含有证书过期区块高度HC的数字证书；
    所述可信判断单元用于使数据节点判断CA的数字证书列表中交易对方的数字证书是否是可信机构颁发；若不是可信机构颁发，则交易无效，交易处理结束，若是可信机构颁发，则获取数字证书中关联信息的证书过期区块高度HC；
    所述过期判断单元用于获取所述数据节点当前所处区块链系统中的区块高度HB，判断所述HB是否大于所述HC，若大于，则交易无效，若不大于，则交易数据满足约束，将交易放入有效交易池；
    所述后期处理单元用于将交易池中的交易打包生成区块并写入账本，并使所述数据节点所处区块链的区块高度加一，结束交易处处理。
  9. 一种电子装置，其中，该电子装置包括：存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机程序，所述处理器执行所述计算机程序时实现以下步骤：
    在数据节点生成公私钥对，所述公私钥对中的公钥结合所述数据节点的身份信息以及关联信息构成证书申请请求文件发送到CA，所述CA通过CA自身的私钥对所述证书申请请求文件中的公钥进行签名，并添加预设的证书过期区块高度HC，以生成设有证书过期区块高度HC的数字证书；
    所述数据节点判断交易对方的数据节点的数字证书是否是可信机构颁发；若不是可信机构颁发，则交易无效，交易处理结束，若是可信机构颁发，则获取数字证书中关联信息的证书过期区块高度HC；
    获取所述数据节点当前所处区块链系统中的区块高度HB，判断所述HB是否大于所述HC，若大于，则交易无效，若不大于，则交易有效，并将所述交易放入有效交易池；
    将所述交易池中的交易打包成区块达成共识，所述数据节点所处区块链的区块高度加一，结束交易处理。
  10. 根据权利要求9所述的电子装置，其中，所述CA用于为所述数据节点颁发数字证书以表明所述数据节点为合格身份，所述CA在颁发数字证书的过程中通过证书颁发机构本身的私钥对数据节点的关联信息进行数字签名。
  11. 根据权利要求10所述的电子装置，其中，所述关联信息包括：所述数据节点的所属机构、IP地址、公钥信息以及当前所处区块链系统中的区块高度HB。
  12. 根据权利要求9所述的电子装置，其中，所述处理器执行所述计算机程序时实现的生成数字证书的步骤包括：所述CA对所述数据节点的证书申请请求文件中的信息进行核实验证，若所述信息中的身份信息验证通过，则所述CA签发初级数字证书；
    在所述初级数字证书上设置证书过期区块高度HC，生成数字证书。
  13. 根据权利要求9所述的电子装置，其中，所述数据节点通过依次验证所述数字证书列表中各个数字证书的数字签名，判断CA的数字证书列表中交易对方的数字证书是否是可信机构颁发。
  14. 根据权利要求9所述的电子装置，其中，所述处理器执行所述计算机程序时实现的判断所述HB是否大于所述HC的步骤包括：
    若所述HB大于所述HC，代表交易对方的数字证书中出示的数据节点当前所处区块链系统中的区块高度比证书过期区块高度大，交易对方的数字证书已过期，交易无效；
    若所述HB小于所述HC，代表交易对方的数字证书中出示的数据节点当前所处区块链系统中的区块高度比证书过期区块高度小，交易对方的数字证书未过期，交易有效。
  15. 根据权利要求9所述的电子装置，其中，所述处理器执行所述计算机程序时实现的将所述交易池中的交易打包成区块达成共识的步骤包括：
    区块链系统的共识模块将所述交易池中连续的多个交易按照自定义规则打包成区块；
    基于共识算法，进行共识表决，在所有节点达成共识后，将所述区块广播至所有数据节点；
    所述数据节点接收所述区块，并将所述区块写入至本地的区块链上，当前所处区块链系统中的区块高度加一。
  16. 一种计算机可读存储介质，其中，所述计算机可读存储介质中存储有过期数字证书管控程序，所述过期数字证书管控程序被处理器执行时，实现以下步骤：
    在数据节点生成公私钥对，所述公私钥对中的公钥结合所述数据节点的身份信息以及关联信息构成证书申请请求文件发送到CA，所述CA通过CA自身的私钥对所述证书申请请求文件中的公钥进行签名，并添加预设的证书过期区块高度HC，以生成设有证书过期区块高度HC的数字证书；
    所述数据节点判断交易对方的数据节点的数字证书是否是可信机构颁发；若不是可信机构颁发，则交易无效，交易处理结束，若是可信机构颁发，则获取数字证书中关联信息的证书过期区块高度HC；
    获取所述数据节点当前所处区块链系统中的区块高度HB，判断所述HB是否大于所述HC，若大于，则交易无效，若不大于，则交易有效，并将所述交易放入有效交易池；
    将所述交易池中的交易打包成区块达成共识，所述数据节点所处区块链的区块高度加一，结束交易处理。
  17. 根据权利要求16所述的计算机可读存储介质，其中，所述CA用于为所述数据节点颁发数字证书以表明所述数据节点为合格身份，所述CA在颁发数字证书的过程中通过证书颁发机构本身的私钥对数据节点的关联信息进行数字签名。
  18. 根据权利要求16所述的计算机可读存储介质，其中，所述处理器执行所述计算机程序时实现的生成数字证书的步骤包括：所述CA对所述数据节点的证书申请请求文件中的信息进行核实验证，若所述信息中的身份信息验证通过，则所述CA签发初级数字证书；
    在所述初级数字证书上设置证书过期区块高度HC，生成数字证书。
  19. 根据权利要求16所述的计算机可读存储介质，其中，所述数据节点通过依次验证所述数字证书列表中各个数字证书的数字签名，判断CA的数字证书列表中交易对方的数字证书是否是可信机构颁发。
  20. 根据权利要求16所述的计算机可读存储介质，其中，所述处理器执行所述计算机程序时实现的将所述交易池中的交易打包成区块达成共识的步骤包括：
    区块链系统的共识模块将所述交易池中连续的多个交易按照自定义规则打包成区块；
    基于共识算法，进行共识表决，在所有节点达成共识后，将所述区块广播至所有数据节点；
    所述数据节点接收所述区块，并将所述区块写入至本地的区块链上，当前所处区块链系统中的区块高度加一。
PCT/CN2021/078111 2020-04-27 2021-02-26 过期数字证书管控方法、系统、装置及存储介质 WO2021218334A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010345455.2 2020-04-27
CN202010345455.2A CN111612456A (zh) 2020-04-27 2020-04-27 过期数字证书管控方法、系统、装置及存储介质

Publications (1)

Publication Number Publication Date
WO2021218334A1 true WO2021218334A1 (zh) 2021-11-04

Family

ID=72199948

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/078111 WO2021218334A1 (zh) 2020-04-27 2021-02-26 过期数字证书管控方法、系统、装置及存储介质

Country Status (2)

Country Link
CN (1) CN111612456A (zh)
WO (1) WO2021218334A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114189341A (zh) * 2021-12-10 2022-03-15 北京泰尔英福科技有限公司 基于区块链标识的数字证书分级处理方法及装置

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111612456A (zh) * 2020-04-27 2020-09-01 深圳壹账通智能科技有限公司 过期数字证书管控方法、系统、装置及存储介质
CN112560005B (zh) * 2020-12-01 2024-08-30 杭州趣链科技有限公司 身份可信服务系统、方法、电子设备和计算机可读介质
CN112788106B (zh) * 2020-12-28 2022-12-27 深圳前海益链网络科技有限公司 一种应用于区块链的区块生成控制方法及相关装置
CN113259125A (zh) * 2021-06-10 2021-08-13 国网浙江省电力有限公司物资分公司 基于区块链的国网数字证书管理方法、装置和电子设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106789090A (zh) * 2017-02-24 2017-05-31 陈晶 基于区块链的公钥基础设施系统及半随机联合证书签名方法
CN109067539A (zh) * 2018-06-13 2018-12-21 深圳前海微众银行股份有限公司 联盟链交易方法、设备及计算机可读存储介质
CN110598375A (zh) * 2019-09-20 2019-12-20 腾讯科技（深圳）有限公司 一种数据处理方法、装置及存储介质
CN110730081A (zh) * 2019-12-17 2020-01-24 腾讯科技（深圳）有限公司 基于区块链网络的证书吊销方法、相关设备及介质
CN111612456A (zh) * 2020-04-27 2020-09-01 深圳壹账通智能科技有限公司 过期数字证书管控方法、系统、装置及存储介质

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107360001B (zh) * 2017-07-26 2021-12-14 创新先进技术有限公司 一种数字证书管理方法、装置和系统
CN108390872B (zh) * 2018-02-09 2021-02-26 北京京东尚科信息技术有限公司 证书管理方法、装置、介质及电子设备
CN108933667B (zh) * 2018-05-03 2021-08-10 深圳市京兰健康医疗大数据有限公司 一种基于区块链的公钥证书的管理方法及管理系统
CN108777684B (zh) * 2018-05-30 2021-07-13 招商银行股份有限公司 身份认证方法、系统及计算机可读存储介质
CN109905360B (zh) * 2019-01-07 2021-12-03 平安科技（深圳）有限公司 数据验证方法及终端设备
CN110532809A (zh) * 2019-08-21 2019-12-03 杭州趣链科技有限公司 一种基于配置区块的区块链多级签名方法
CN110636051B (zh) * 2019-08-29 2022-04-15 中芯昊月(深圳)科技控股有限公司 一种基于多用户ca数字证书的区块链交易方法
CN110598482B (zh) * 2019-09-30 2023-09-15 腾讯科技（深圳）有限公司 基于区块链的数字证书管理方法、装置、设备及存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106789090A (zh) * 2017-02-24 2017-05-31 陈晶 基于区块链的公钥基础设施系统及半随机联合证书签名方法
CN109067539A (zh) * 2018-06-13 2018-12-21 深圳前海微众银行股份有限公司 联盟链交易方法、设备及计算机可读存储介质
CN110598375A (zh) * 2019-09-20 2019-12-20 腾讯科技（深圳）有限公司 一种数据处理方法、装置及存储介质
CN110730081A (zh) * 2019-12-17 2020-01-24 腾讯科技（深圳）有限公司 基于区块链网络的证书吊销方法、相关设备及介质
CN111612456A (zh) * 2020-04-27 2020-09-01 深圳壹账通智能科技有限公司 过期数字证书管控方法、系统、装置及存储介质

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114189341A (zh) * 2021-12-10 2022-03-15 北京泰尔英福科技有限公司 基于区块链标识的数字证书分级处理方法及装置

Also Published As

Publication number Publication date
CN111612456A (zh) 2020-09-01

Similar Documents

Publication Publication Date Title
WO2021218334A1 (zh) 过期数字证书管控方法、系统、装置及存储介质
TWI741314B (zh) 基於區塊鏈的資料存證方法及裝置、電子設備
US11170092B1 (en) Document authentication certification with blockchain and distributed ledger techniques
CN111046352B (zh) 一种基于区块链的身份信息安全授权系统与方法
CN110785981B (zh) 使用区块链分类账保护对机密数据的访问
EP3654577B1 (en) Certificate management method, system, network device and computer readable storage medium
US10915552B2 (en) Delegating credentials with a blockchain member service
WO2018090331A1 (zh) 区块链网络、物品交易方法、装置及节点设备
CN110771095B (zh) 用于实现基于区块链的数字证书的系统和方法
WO2020134942A1 (zh) 身份核实方法及其系统
CN110800254B (zh) 用于生成数字标记的系统和方法
CN112651052A (zh) 一种基于区块链技术的数据确权方法及系统
CN108696358B (zh) 数字证书的管理方法、装置、可读存储介质及服务终端
WO2021068619A1 (zh) 证书认证管理方法、装置、设备及计算机可读存储介质
EP3779760B1 (en) Blockchain-based data processing method and apparatus, and electronic device
US9037849B2 (en) System and method for managing network access based on a history of a certificate
US11341267B1 (en) Death certificate information processing techniques
WO2020000770A1 (zh) 基于区块链查询质押信息方法、装置及计算机设备
WO2022205963A1 (zh) 一种跨链访问控制方法和装置
WO2020173019A1 (zh) 访问凭证验证方法、装置、计算机设备及存储介质
CN112001701A (zh) 用于管理营业执照的方法和装置
JP6742558B2 (ja) 認証システムおよび認証プログラム
Kwame et al. V-chain: A blockchain-based car lease platform
WO2021184642A1 (zh) 基于区块链的交易方法、装置、电子设备及可读存储介质
CN111915308A (zh) 一种区块链网络的交易处理方法及区块链网络

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21795742

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 20/02/2023)

122 Ep: pct application non-entry in european phase

Ref document number: 21795742

Country of ref document: EP

Kind code of ref document: A1