WO2022206247A1 - 一种证书查询方法及装置 - Google Patents
一种证书查询方法及装置 Download PDFInfo
- Publication number
- WO2022206247A1 WO2022206247A1 PCT/CN2022/078223 CN2022078223W WO2022206247A1 WO 2022206247 A1 WO2022206247 A1 WO 2022206247A1 CN 2022078223 W CN2022078223 W CN 2022078223W WO 2022206247 A1 WO2022206247 A1 WO 2022206247A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- certificate
- block
- blockchain
- management device
- information
- Prior art date
Links
- 238000000034 method Methods 0.000 title claims abstract description 120
- 238000013507 mapping Methods 0.000 claims abstract description 347
- 238000004891 communication Methods 0.000 claims description 60
- 238000003860 storage Methods 0.000 claims description 22
- 238000004590 computer program Methods 0.000 claims description 18
- 238000012546 transfer Methods 0.000 claims description 2
- 238000007726 management method Methods 0.000 description 324
- 238000013461 design Methods 0.000 description 78
- 230000006870 function Effects 0.000 description 42
- 238000004422 calculation algorithm Methods 0.000 description 38
- 230000008569 process Effects 0.000 description 36
- 238000012545 processing Methods 0.000 description 33
- 230000007246 mechanism Effects 0.000 description 25
- 230000015654 memory Effects 0.000 description 25
- 238000012790 confirmation Methods 0.000 description 23
- 238000012423 maintenance Methods 0.000 description 22
- 238000010586 diagram Methods 0.000 description 19
- 238000005516 engineering process Methods 0.000 description 10
- 230000008859 change Effects 0.000 description 8
- 238000012795 verification Methods 0.000 description 6
- 101000759879 Homo sapiens Tetraspanin-10 Proteins 0.000 description 4
- 102100024990 Tetraspanin-10 Human genes 0.000 description 4
- 230000005540 biological transmission Effects 0.000 description 4
- 238000012986 modification Methods 0.000 description 3
- 230000004048 modification Effects 0.000 description 3
- 230000008878 coupling Effects 0.000 description 2
- 238000010168 coupling process Methods 0.000 description 2
- 238000005859 coupling reaction Methods 0.000 description 2
- 238000001514 detection method Methods 0.000 description 2
- 230000000977 initiatory effect Effects 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 238000013475 authorization Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000013500 data storage Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000009826 distribution Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000000802 evaporation-induced self-assembly Methods 0.000 description 1
- 230000010354 integration Effects 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 238000002955 isolation Methods 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 239000013307 optical fiber Substances 0.000 description 1
- 230000002093 peripheral effect Effects 0.000 description 1
- 239000004065 semiconductor Substances 0.000 description 1
- 230000011664 signaling Effects 0.000 description 1
- 239000007787 solid Substances 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
- G06F21/645—Protecting data integrity, e.g. using checksums, certificates or signatures using a third party
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/22—Indexing; Data structures therefor; Storage structures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/22—Indexing; Data structures therefor; Storage structures
- G06F16/2228—Indexing structures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/245—Query processing
- G06F16/2455—Query execution
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
Definitions
- the embodiments of the present application relate to the field of wireless communications, and in particular, to a method and apparatus for querying a certificate.
- the public and private keys are used to encrypt messages and generate digital signatures, respectively.
- the public key can be sent to the network while the private key must exist within the holder.
- Public key infrastructure PKI is used to realize functions such as generation, management, storage, distribution and revocation of public and private keys and digital certificates (certificates), among which digital certificates are used for identification in digital communication. Digital authentication information of a party's identity and ownership of the public key held.
- the PKI architecture can be a tree structure.
- the nodes in the PKI architecture include the anchor root certificate authority (CA) (hereinafter referred to as the root CA), the multi-level leaf CA (that is, other CAs except the root CA in Figure 1) and the underlying network element.
- CA anchor root certificate authority
- the root CA is responsible for issuing certificates to itself (self-signed certificate) and the next layer of leaf CAs, the next layer of leaf CAs then issue certificates to the next layer of CAs, and so on, and finally the last layer of leaf CAs issue certificates to network elements Issue a certificate.
- Step 1 The network element A1 sends a message to the network element B1, where the message includes the certificate of the network element A1 and the certificate included in the certificate chain corresponding to the network element A1.
- the message is digitally signed with the private key of the network element A1.
- the certificate chain corresponding to network element A1 is: ⁇ network element A1 certificate, CA-A1 certificate, CA-A certificate, root CA certificate ⁇ .
- Step 2 The network element B1 sequentially confirms whether the root CA certificate, the CA-A certificate, the CA-A1 certificate and the network element A1 certificate are revoked.
- the network element B1 may sequentially confirm whether the above certificates are revoked by querying the certificate revocation list (certificate revocation list, CRL) or the online certificate status protocol (online certificate status protocol, OCSP).
- CRL certificate revocation list
- OCSP online certificate status protocol
- the update period of the CRL is relatively long (for example, about one hour), and the long update period will lead to the poor timeliness of the certificate revocation record queried by the node.
- OCSP needs to use a specific node ID as the query index, which has potential privacy problems.
- Embodiments of the present application provide a certificate query method and device, which are used to optimize the query process of querying whether a certificate is revoked.
- an embodiment of the present application provides a certificate query method, which includes:
- the management device receives first information from the second device, where the first information includes an identifier of the certificate of the first device, and the management device determines the first information according to the identifier of the certificate of the first device and the first mapping relationship. Certificate status information of a certificate of a device, and the management device sends the certificate status information to the second device.
- the first mapping relationship indicates a correspondence between an identifier of the certificate of the first device and the certificate status information, where the certificate status information is used to indicate whether the certificate of the first device is revoked.
- the management device can locally query the management device for the certificate status information of the certificate of the first device for the second device according to the first mapping relationship, and notify the second device of the certificate status information queried.
- the second device does not need to download the CRL and can obtain the latest certificate status information, which avoids the inability to obtain the latest certificate status information due to the poor timeliness of the CRL; It is necessary to use a specific node ID as the query index to avoid the risk of privacy leakage.
- the first information includes the identification of the certificate of the first device, or the first information includes the certificate of the first device, wherein the certificate of the first device includes the identification of the certificate of the first device.
- the certificate status information indicates that the certificate of the first device is not revoked, or the revocation reason value of the certificate of the first device; or the certificate status information indicates that the first device The certificate of the first device is not revoked, or the certificate of the first device is revoked and the revocation reason value of the certificate of the first device.
- the certificate status information can have multiple implementations.
- the first mapping relationship specifically indicates the corresponding relationship between the identity of the certificate of the first device, the identity information of the first blockchain, and the identity information of the first block, wherein the The first block is on the first blockchain, and the first block stores the certificate status information.
- the management device determining the certificate status information according to the identification of the certificate of the first device and the first mapping relationship specifically includes: the management device determines the certificate status information according to the identification of the certificate of the first device and the The first mapping relationship determines the identification information of the first block chain and the identification information of the first block, and the management device determines the identification information of the first block chain according to the identification information of the first block chain and the identification of the first block The information obtains the certificate status information from the first block.
- the first mapping relationship indicates the identity of the certificate, the corresponding relationship between the block chain and the block identity, and through the above corresponding relationship, the management device can use the identity of the certificate as an index to query the first mapping relationship to determine the area where the certificate status information is stored block from which the certificate status information is obtained.
- the first mapping relationship relies on the distributed consensus and distributed ledger mechanism of the blockchain.
- the blockchain network can be independently operated by the network operator, thereby realizing the operator's intranet query for certificate status information, eliminating the need for cross-network query steps.
- the first mapping relationship specifically indicates the identity of the revoked certificate, the identity information of the blockchain where the block storing the revocation cause value of the revoked certificate is located, and the storage location.
- the corresponding relationship between the identification information of the block of the revocation cause value of the revoked certificate is described.
- the first mapping relationship here can be understood as a set of mapping relationships.
- the management device determines that the certificate status information according to the identity of the certificate of the first device and the above-mentioned first mapping relationship specifically includes two cases: Case 1: the identity of the revoked certificate does not include When identifying the certificate of the first device, the management device determines the certificate status information, the certificate status information indicating that the first certificate is not revoked.
- Case 2 When the identity of the revoked certificate includes the identity of the certificate of the first device, the first mapping relationship includes a fourth mapping relationship, and the fourth mapping relationship indicates the certificate of the first device , the identification information of the second block chain, and the identification information of the second block, wherein the second block is on the second block chain, and the second block stores the revoked certificate
- the management device determines the identification information of the second blockchain and the fourth mapping relationship according to the identification of the certificate of the first device and the fourth mapping relationship.
- the management device obtains the revocation of the certificate of the first device from the second block according to the identification information of the second block chain and the identification information of the second block.
- the reason value the management device determines the certificate status information, the certificate status information indicates the revocation reason value of the certificate of the first device.
- the first mapping relationship indicates the identity of the revoked certificate, and the corresponding relationship between the block chain and the block identity.
- the management device can use the identity of the certificate as an index to query whether the certificate exists in the first mapping relationship. Identify the corresponding mapping relationship to determine whether the certificate is revoked. If there is a mapping relationship corresponding to the certificate identification in the first mapping relationship, the management device can further determine the block for storing the certificate status information according to the certificate identification and obtain from the block. Certificate status information.
- the first mapping relationship relies on the distributed consensus and distributed ledger mechanism of the blockchain.
- the blockchain network can be independently operated by the network operator, thereby realizing the operator's intranet query for certificate status information, eliminating the need for cross-network query steps.
- the method further includes: the management device obtains the public key of the first CA, and the management device sends the public key of the first CA to the second device.
- the first CA refers to the CA that issued the certificate of the first device for the first device.
- the management device also needs to send the public key of the first CA to the second device, so that the second device can check whether the digital signature of the certificate of the first device is valid.
- the management device before the management device determines the certificate status information according to the identity of the certificate of the first device and the first mapping relationship, the management device obtains the public key of the first CA, and the management device obtains the public key of the first CA. The management device determines that the digital signature of the certificate of the first device is valid according to the public key of the first CA.
- the first CA refers to the CA that issued the certificate of the first device for the first device.
- the management device executes the query for the certificate status information, so as to save the digital signature of the certificate of the first device when the management device determines that the digital signature of the certificate of the first device is invalid.
- the subsequent steps of querying the certificate status information save processing resources.
- the management device when the management device determines that the certificate status information indicates that the certificate of the first device is not revoked, the management device obtains the public key of the first CA, the first CA is Refers to the CA that issued the first device's certificate for the first device. The management device determines whether the digital signature of the certificate of the first device is valid according to the public key of the first CA, and the management device sends second information to the first device, the second information indicating the Whether the digital signature of the certificate of the first device is valid.
- the management device when the management device determines that the certificate status information indicates that the certificate of the first device is not revoked, the management device obtains the public key of the first CA to determine whether the digital signature of the certificate of the first device is valid, and sends the judgment result to the first device.
- Second device to obtain the public key of the first CA to verify the validity of the signature of the digital certificate of the first device when the management device determines that the certificate of the first device is not revoked, and to verify the validity of the digital certificate of the first device only when the management device determines that the certificate of the first device is valid
- a device digital certificate signature validity saving processing resources.
- the first information includes an identification of the certificate of the first CA.
- the management device may use the following method to obtain the public key of the first CA: the management device determines the identification information of the third block chain and the identification information of the third block according to the identification of the certificate of the first CA and the second mapping relationship , and obtain the public key of the first CA from the third block according to the identification information of the third block chain and the identification information of the third block.
- the second mapping relationship indicates the corresponding relationship between the identification of the certificate of the first CA, the identification information of the third block chain, and the identification information of the third block, and the third block is in the On the third block chain, the third block stores the certificate of the first CA.
- the certificate of the first CA includes the public key of the first CA.
- the management device determines the block storing the certificate of the first CA according to the second mapping relationship and the identity of the certificate of the first CA, and obtains the public key of the first CA from the block.
- the distributed ledger nature of blockchain ensures that the same blockchain, blocks and block transactions are stored on all management devices, which can realize the function of trust anchor.
- the centralized trust mechanism of the PKI architecture has become a decentralized trust mechanism.
- the trust anchors are all anchored on the blockchain.
- the second device can query the nearest network element (ie, the management device) operating the blockchain to obtain information with the first A device trust relationship.
- Use blockchain to simplify the PKI architecture change the original centralized root trust mechanism into a decentralized trust mechanism, simplify the certificate verification mechanism, and prevent the need to verify multiple certificates to determine whether there is a multi-layer CA PKI architecture.
- Common trust anchor and the problem of not being able to verify the certificate because there is no common trust anchor.
- the management device determines, according to the identifier of the certificate of the first device and a third mapping relationship, the certificate of the first CA identification; the third mapping relationship indicates a corresponding relationship between the identification of the certificate of the first device and the identification of the certificate of the first CA.
- the management device may obtain the public key of the first CA by using the following method: the management device obtains the identity of the certificate of the first CA and the second mapping relationship according to the following method: Determine the identification information of the third block chain and the identification information of the third block, and obtain the first block from the third block according to the identification information of the third block chain and the identification information of the third block.
- a CA's public key indicates the corresponding relationship between the identification of the certificate of the first CA, the identification information of the third block chain, and the identification information of the third block, and the third block is in the On the third block chain, the third block stores the certificate of the first CA.
- the certificate of the first CA includes the public key of the first CA.
- the management device determines the identity of the certificate of the first CA through the identity of the certificate of the first device and the third mapping relationship, and then determines to obtain the public key of the first CA according to the identity of the certificate of the first CA and the second mapping relationship .
- the management device receives a first broadcast message, where the first broadcast message indicates the second mapping relationship.
- the management device obtains the second mapping relationship through a broadcast message.
- the management device before the management device receives the first broadcast message, the management device receives third information from the first CA, where the third information includes a certificate of the first CA .
- the management device determines the identification information of the third blockchain, and the management device publishes the certificate of the first CA to the blockchain network corresponding to the identification information of the third blockchain.
- the management device sends fourth information to the first CA, the fourth information indicating that the certificate of the first CA has been published to the third blockchain The identification information corresponding to the blockchain network.
- the management device realizes saving the certificate of the first CA through the blockchain network by publishing the certificate of the first CA to the blockchain network.
- the third information further includes information used to indicate the scope of application of the certificate of the first CA
- the management device can indicate the scope of application of the certificate of the first CA according to the information used to indicate the scope of application of the certificate of the first CA.
- the information determines the identification information of the third blockchain.
- the management device can determine the identification information of the blockchain according to the scope of application of the certificate of the first CA.
- the management device receives a second broadcast message, where the second broadcast message indicates the first mapping relationship.
- the management device obtains the first mapping relationship through a broadcast message.
- the management device before the management device receives the second broadcast message, receives fifth information from the first CA, where the fifth information includes the certificate of the first device and the certificate status information indicating that the certificate of the first device is not revoked.
- the management device determines the identification information of the first blockchain, and the management device publishes the certificate of the first device and the certificate status information to the block corresponding to the identification information of the first blockchain chain network.
- the management device sends sixth information to the first CA, the sixth information indicating that the certificate status information has been published to the identity of the first blockchain The blockchain network corresponding to the information.
- the management device can save the certificate and certificate status information of the first device through the blockchain network by publishing the certificate and certificate status information of the first device to the blockchain network.
- the fifth information further includes an identifier of the certificate of the first CA.
- the management device publishes the identification of the certificate of the first CA, the certificate of the first device, and the certificate status information to the blockchain network corresponding to the identification information of the first blockchain, and the management The device receives a second broadcast message, where the second broadcast message further indicates a correspondence between the identity of the certificate of the first device and the identity of the certificate of the first CA.
- the management device can simultaneously publish the identity of the certificate of the first CA to the blockchain network.
- the fifth information further includes information used for indicating the scope of application of the certificate of the first device, and the management device is based on the information used to indicate the scope of application of the certificate of the first device.
- the information determines the first blockchain.
- the management device can determine the identification information of the blockchain according to the scope of application of the certificate of the first device.
- the management device receives a third broadcast message, the third broadcast message indicates an updated first mapping relationship, and the updated first mapping relationship indicates a certificate of the first device
- the corresponding relationship between the identification of the first block chain, the identification information of the first block chain, and the identification information of the fourth block, the fourth block is on the first block chain, and the fourth block stores The identity of the certificate of the first device and the updated certificate status information, the updated certificate status information indicating the revocation reason value of the certificate of the first device.
- the management device obtains the updated first mapping relationship through a broadcast message.
- the management device before the management device receives the third broadcast message, receives seventh information from the first CA, where the seventh information includes the certificate of the first device and the updated certificate status information.
- the management device determines the identification information of the first blockchain according to the identification of the certificate of the first device and the first mapping relationship.
- the management device publishes the updated certificate status information and the identity of the certificate of the first device to the blockchain network corresponding to the identity information of the first blockchain.
- the management device sends eighth information to the first CA, the eighth information indicating that the updated certificate status information has been published to the first block The blockchain network corresponding to the identification information of the chain.
- the management device can update the first mapping relationship in time through the blockchain network by publishing the certificate of the first device and the updated certificate status information to the blockchain network.
- the management device receives a fourth broadcast message, the fourth broadcast message indicates a fourth mapping relationship, the first mapping relationship includes the fourth mapping relationship, and the fourth mapping relationship Indicates the correspondence between the identity of the certificate of the first device, the identity information of the second block chain, and the identity information of the second block.
- the management device obtains the fourth mapping relationship through a broadcast message.
- the management device before the management device receives the fourth broadcast message, receives ninth information from the first CA, where the ninth information includes the certificate of the first device and the certificate status information indicating the revocation reason value of the certificate of the first device.
- the management device determines the identification information of the second blockchain, and the management device publishes the identification of the certificate of the first device and the certificate status information to the corresponding identification information of the second blockchain. blockchain network.
- the management device sends tenth information to the first CA, the tenth information indicating that the certificate status information has been published to the identity of the second blockchain The blockchain network corresponding to the information.
- the management device can save the revoked certificate through the blockchain network by publishing the certificate of the first device and the certificate status information (the certificate status information indicates the revocation reason value of the certificate of the first device) to the blockchain network. certificate status information.
- the ninth information further includes information for indicating the scope of application of the certificate of the first device.
- the management device determines the second blockchain according to the information indicating the scope of application of the certificate of the first device.
- the management device can determine the identification information of the blockchain according to the scope of application of the certificate of the first device.
- an embodiment of the present application provides a certificate query device, the device includes a transceiver unit and a processing unit: the transceiver unit is configured to receive first information from a second device, where the first information includes a certificate of the first device
- the processing unit is configured to determine the certificate status information of the certificate of the first device according to the identifier of the certificate of the first device and the first mapping relationship, and the transceiver unit is configured to send the certificate status to the second device information.
- the first mapping relationship indicates a correspondence between an identifier of the certificate of the first device and the certificate status information, where the certificate status information is used to indicate whether the certificate of the first device is revoked.
- the certificate status information indicates that the certificate of the first device is not revoked, or the revocation reason value of the certificate of the first device; or the certificate status information indicates that the first device The certificate of the first device is not revoked, or the certificate of the first device is revoked and the revocation reason value of the certificate of the first device.
- the first mapping relationship specifically indicates the corresponding relationship between the identity of the certificate of the first device, the identity information of the first blockchain, and the identity information of the first block, wherein the The first block is on the first blockchain, and the first block stores the certificate status information.
- the processing unit is configured to, when determining the certificate status information according to the identification of the certificate of the first device and the first mapping relationship, determine the first mapping relationship according to the identification of the certificate of the first device and the first mapping relationship.
- the identification information of a block chain and the identification information of the first block, and the certificate is obtained from the first block according to the identification information of the first block chain and the identification information of the first block status information.
- the first mapping relationship specifically indicates the identity of the revoked certificate, the identity information of the blockchain where the block storing the revocation cause value of the revoked certificate is located, and the storage location.
- the corresponding relationship between the identification information of the block of the revocation cause value of the revoked certificate is described.
- the first mapping relationship here can be understood as a set of mapping relationships.
- the processing unit is configured to, when determining the certificate status information according to the identity of the certificate of the first device and the first mapping relationship, when the identity of the revoked certificate does not include the identity of the certificate of the first device , determine the certificate status information, the certificate status information indicates that the first certificate is not revoked; or, when the identity of the revoked certificate includes the identity of the certificate of the first device, the first certificate
- the mapping relationship includes a fourth mapping relationship, and the fourth mapping relationship indicates the identification of the certificate of the first device, the identification information of the second blockchain, and the identification information of the second block, wherein the second block On the second blockchain, the second block stores the identifier of the revoked certificate and the revocation reason value corresponding to the revoked certificate, according to the identifier of the certificate of the first device and the The fourth mapping relationship determines the identification information of the second block chain and the identification information of the second block, according to the identification information of the second block chain and the identification information of the second block from the The second block acquires the
- the method further includes: the processing unit is configured to obtain the public key of the first CA, and send the public key of the first CA to the second device.
- the first CA refers to the CA that issued the certificate of the first device for the first device.
- the processing unit before the certificate status information is determined according to the identity of the certificate of the first device and the first mapping relationship, the processing unit is configured to obtain the public key of the first CA, according to the first CA The public key of the first device determines that the digital signature of the certificate of the first device is valid.
- the first CA refers to the CA that issued the certificate of the first device for the first device.
- the processing unit when it is determined that the certificate status information indicates that the certificate of the first device has not been revoked, the processing unit is configured to obtain the public key of the first CA, and determine according to the public key of the first CA Whether the digital signature of the certificate of the first device is valid, the transceiver unit is configured to send second information to the first device, and the first CA refers to the certificate issued by the first device for the first device. CA, the second information indicates whether the digital signature of the certificate of the first device is valid.
- the first information includes an identification of the certificate of the first CA.
- the processing unit may use the following method to obtain the public key of the first CA: determine the identification information of the third block chain and the identification information of the third block according to the identification of the certificate of the first CA and the second mapping relationship;
- the identification information of the blockchain and the identification information of the third block obtain the public key of the first CA from the third block.
- the second mapping relationship indicates the corresponding relationship between the identification of the certificate of the first CA, the identification information of the third block chain, and the identification information of the third block, and the third block is in the On the third block chain, the third block stores the certificate of the first CA.
- the certificate of the first CA includes the public key of the first CA.
- the processing unit before the management device acquires the public key of the first CA, the processing unit is configured to determine, according to the identifier of the certificate of the first device and the third mapping relationship, the certificate of the first CA identifier, and the third mapping relationship indicates a corresponding relationship between the identifier of the certificate of the first device and the identifier of the certificate of the first CA.
- the processing unit determines the identification information of the third blockchain and the identification information of the third block according to the identification of the certificate of the first CA and the second mapping relationship , the second mapping relationship indicates the corresponding relationship between the identification of the certificate of the first CA, the identification information of the third block chain and the identification information of the third block;
- the third block stores the certificate of the first CA;
- the certificate of the first CA includes the public key of the first CA.
- the processing unit acquires the public key of the first CA from the third block according to the identification information of the third block chain and the identification information of the third block.
- the transceiver unit is configured to receive a first broadcast message, where the first broadcast message indicates the second mapping relationship.
- the transceiver unit before receiving the first broadcast message, is configured to receive third information from the first CA, where the third information includes a certificate of the first CA.
- the processing unit is configured to determine the identification information of the third blockchain, and publish the certificate of the first CA to the blockchain network corresponding to the identification information of the third blockchain through the transceiver unit.
- the transceiver unit After receiving the first broadcast message, is configured to send fourth information to the first CA, where the fourth information indicates that the certificate of the first CA has been published to the identification information corresponding to the third blockchain of the blockchain network.
- the third information further includes information used to indicate the scope of application of the certificate of the first CA
- the processing unit is configured to use the information used to indicate the scope of application of the certificate of the first CA to The information determines the identification information of the third blockchain.
- the transceiver unit is configured to receive a second broadcast message, where the second broadcast message indicates the first mapping relationship.
- the transceiver unit before receiving the second broadcast message, is configured to receive fifth information from the first CA, where the fifth information includes the certificate of the first device and the certificate Status information, the certificate status information indicating that the certificate of the first device is not revoked.
- the processing unit is configured to determine the identification information of the first blockchain, and the management device publishes the certificate of the first device and the certificate status information to the block corresponding to the identification information of the first blockchain chain network.
- the transceiver unit After receiving the second broadcast message, is configured to send sixth information to the first CA, where the sixth information indicates that the certificate status information has been published to the area corresponding to the identification information of the first blockchain blockchain network.
- the fifth information further includes an identifier of the certificate of the first CA.
- the processing unit is configured to publish the identification of the certificate of the first CA, the certificate of the first device, and the certificate status information to the blockchain network corresponding to the identification information of the first blockchain through the transceiver unit.
- the transceiver unit is configured to receive a second broadcast message, where the second broadcast message further indicates a correspondence between the identity of the certificate of the first device and the identity of the certificate of the first CA.
- the fifth information further includes information used to indicate the scope of application of the certificate of the first device
- the processing unit is configured to use the information used to indicate the scope of application of the certificate of the first device to The information determines the first blockchain.
- the transceiver unit is configured to receive a third broadcast message, where the third broadcast message indicates an updated first mapping relationship, and the updated first mapping relationship indicates a certificate of the first device
- the corresponding relationship between the identification of the first block chain, the identification information of the first block chain, and the identification information of the fourth block, the fourth block is on the first block chain, and the fourth block stores The identity of the certificate of the first device and the updated certificate status information, the updated certificate status information indicating the revocation reason value of the certificate of the first device.
- the transceiver unit before receiving the third broadcast message, is configured to receive seventh information from the first CA, where the seventh information includes an identifier of the certificate of the first device and all Describe the updated certificate status information.
- the processing unit is configured to determine the identification information of the first blockchain according to the identification of the certificate of the first device and the first mapping relationship.
- the updated certificate status information and the identity of the certificate of the first device are published to the blockchain network corresponding to the identity information of the first blockchain through the transceiver unit.
- the transceiver unit After receiving the third broadcast message, is configured to send eighth information to the first CA, where the eighth information indicates that the updated certificate status information has been published to the identification information of the first blockchain The corresponding blockchain network.
- the transceiver unit is configured to receive a fourth broadcast message, where the fourth broadcast message indicates a fourth mapping relationship, the first mapping relationship includes the fourth mapping relationship, and the fourth mapping relationship Indicates the correspondence between the identity of the certificate of the first device, the identity information of the second block chain, and the identity information of the second block.
- the transceiver unit before receiving the fourth broadcast message, is configured to receive ninth information from the first CA, where the ninth information includes an identifier of the certificate of the first device and all and the certificate status information indicating the revocation reason value of the certificate of the first device.
- the processing unit is configured to determine the identification information of the second blockchain, and publish the identification of the certificate of the first device and the certificate status information to the blockchain network corresponding to the identification information of the second blockchain .
- the transceiver unit After receiving the fourth broadcast message, is configured to send tenth information to the first CA, where the tenth information indicates that the certificate status information has been published to the area corresponding to the identification information of the second blockchain blockchain network.
- the ninth information further includes information for indicating the scope of application of the certificate of the first device.
- the processing unit is configured to determine the second blockchain according to the information indicating the scope of application of the certificate of the first device.
- an embodiment of the present application provides a method for querying a certificate public key.
- the method includes: a management device obtains a second mapping relationship, where the second mapping relationship indicates the identity of the certificate of the first CA and the identity of the third blockchain.
- the correspondence between the identification information and the identification information of the third block, the third block is on the third block chain, the third block stores the certificate of the first CA, the first CA
- the certificate includes the public key of the first CA.
- the management device determines the identification information of the third block chain and the identification information of the third block according to the identification of the certificate of the first CA and the second mapping relationship, and the management device determines the identification information of the third block according to the The identification information of the third blockchain and the identification information of the third block obtain the public key of the first CA from the third block.
- the management device determines the block storing the certificate of the first CA according to the second mapping relationship and the identity of the certificate of the first CA, and obtains the public key of the first CA from the block.
- the number of CAs can be reduced, the original multi-level PKI architecture can be flattened, and equipment investment and operation and maintenance costs can be reduced.
- the distributed ledger nature of blockchain ensures that the same blockchain, blocks and block transactions are stored on all management devices, which can realize the function of trust anchor.
- the centralized trust mechanism of the PKI architecture has become a decentralized trust mechanism, and the trust anchors are anchored on the blockchain.
- Use blockchain to simplify the PKI architecture change the original centralized root trust mechanism into a decentralized trust mechanism, simplify the certificate verification mechanism, and prevent the need to verify multiple certificates to determine whether there is a multi-layer CA PKI architecture.
- Common trust anchor and the problem of not being able to verify the certificate because there is no common trust anchor.
- the management device may acquire the second mapping relationship in the following manner: the management device receives a first broadcast message, where the first broadcast message indicates the second mapping relationship.
- the management device obtains the second mapping relationship through a broadcast message.
- the management device before the management device receives the first broadcast message, the management device receives third information from the first CA, where the third information includes a certificate of the first CA .
- the management device determines the identification information of the third blockchain, and the management device publishes the certificate of the first CA to the blockchain network corresponding to the identification information of the third blockchain.
- the management device sends fourth information to the first CA, the fourth information indicating that the certificate of the first CA has been published to the third blockchain The identification information of the corresponding blockchain network.
- the management device realizes saving the certificate of the first CA through the blockchain network by publishing the certificate of the first CA to the blockchain network.
- an embodiment of the present application provides a method for querying a certificate public key, the method comprising:
- the first CA sends third information to the management device, the third information including the certificate of the first CA.
- the first CA receives fourth information from the management device, the fourth information indicating that the first CA's certificate has been published to the blockchain network.
- the distributed ledger nature of blockchain ensures that the same blockchain, blocks and block transactions are stored on all management devices, which can realize the function of trust anchor.
- the centralized trust mechanism of the PKI architecture has become a decentralized trust mechanism, and the trust anchors are anchored on the blockchain.
- Use blockchain to simplify the PKI architecture change the original centralized root trust mechanism into a decentralized trust mechanism, simplify the certificate verification mechanism, and prevent the need to verify multiple certificates to determine whether there is a multi-layer CA PKI architecture.
- Common trust anchor and the problem of not being able to verify the certificate because there is no common trust anchor.
- the present application further provides an apparatus.
- the device can perform the above-mentioned method design.
- the apparatus may be a chip or circuit capable of performing the functions corresponding to the above method, or a device including the chip or circuit.
- the apparatus includes: a memory for storing computer-executable program code; and a processor coupled to the memory.
- the program code stored in the memory includes instructions that, when executed by the processor, cause the apparatus or a device on which the apparatus is installed to perform the method in the first aspect or any possible design of the first aspect, or The third aspect or the method in any possible design of the third aspect, or the method in the fourth aspect or any possible design of the fourth aspect.
- the device may further include a communication interface, which may be a transceiver, or if the device is a chip or a circuit, the communication interface may be an input/output interface of the chip, such as input/output pins.
- a communication interface which may be a transceiver, or if the device is a chip or a circuit, the communication interface may be an input/output interface of the chip, such as input/output pins.
- the device includes corresponding functional units, which are respectively used to implement the steps in the above method.
- the functions can be implemented by hardware, or by executing corresponding software by hardware.
- the hardware or software includes one or more units corresponding to the above-mentioned functions.
- embodiments of the present application provide a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium, and when the computer program runs on an apparatus, the first aspect or the first aspect is executed.
- the method in any one possible design, or the method in any one possible design of the third aspect or the third aspect, or the method in any one possible design of the fourth aspect or the fourth aspect.
- an embodiment of the present application provides a computer program product, the computer program product includes a computer program, when the computer program runs on an apparatus, executes the first aspect or any one of the possible possibilities of the first aspect The method in the design, or the method in the third aspect or any one possible design of the third aspect, or the method in the fourth aspect or any one possible design of the fourth aspect.
- FIG. 1 is a schematic diagram of the architecture of a PKI system in the background of the application
- FIG. 2 is a schematic diagram of a chain structure of a blockchain in an embodiment of the application
- 4A is one of the schematic diagrams illustrating the certificate query process by taking NRF maintaining multiple blockchains as an example in the embodiment of the application;
- 4B is the second schematic diagram illustrating the certificate query process by taking NRF maintaining multiple blockchains as an example in the embodiment of the application;
- 5A is the third schematic diagram illustrating the certificate query process by taking the NRF maintaining multiple blockchains as an example in the embodiment of the application;
- 5B is the fourth schematic diagram illustrating the certificate query process by taking the NRF maintaining multiple blockchains as an example in the embodiment of the application;
- 6A is one of the schematic diagrams illustrating the certificate query process by taking NRF maintaining only one blockchain as an example in the embodiment of the application;
- 6B is the second schematic diagram illustrating the certificate query process by taking NRF maintaining only one blockchain as an example in the embodiment of the application;
- 7A is the fifth schematic diagram illustrating the certificate query process by taking NRF maintaining multiple blockchains as an example in the embodiment of the application;
- 7B is the sixth schematic diagram illustrating the certificate query process by taking NRF maintaining multiple blockchains as an example in the embodiment of the application;
- FIG. 8 is one of the schematic structural diagrams of a device in an embodiment of the present application.
- FIG. 9 is a second schematic structural diagram of an apparatus in an embodiment of the present application.
- a typical PKI system may include one or more CAs.
- CAs are responsible for managing the entire life cycle of certificates, including issuing certificates, defining certificate validity periods, and revoking certificates.
- Nodes in the PKI architecture may include network elements and CAs in the communication network, that is, CAs may be responsible for managing certificates for network elements, such as CA-A1 and CA-B1 in Figure 1, and may also be responsible for managing certificates for other CAs, for example, CA-A and CA-B in Figure 1.
- the PKI architecture can be used to display the trust relationship between any two nodes under the PKI architecture. If two nodes can find a common trust anchor under the same PKI architecture, the two nodes can trust each other, that is, under the PKI architecture, The fact that any two nodes can trust the peer is based on the existence of certificates issued by a common trust anchor in the certificates held by the two nodes. For example, all nodes in Figure 1 hold certificates issued by the root CA, then the root CA can be Trust anchors for other nodes in the PKI architecture shown in Figure 1.
- the certificates held by a node include the node's own certificate, as well as the certificates of all nodes on the path from the node's certificate issuer to the trust anchor in the PKI architecture, wherein the node's own certificate and the certificate in the PKI architecture
- the trust anchor needs to be in an absolutely secure location to ensure secure isolation and as little communication interaction as possible.
- the application scope of the certificate can be divided.
- the network elements in Beijing and the network elements in Shanghai use different leaf CAs to issue certificates, or the network elements used for public services and the network elements used for private services.
- Meta uses different leaf CAs to issue certificates. Therefore, when a leaf CA is attacked, it will not cause the failure and collapse of the entire PKI system, which is beneficial to the stability of the entire PKI system.
- Step A The node generates the paired public key and private key locally, and passes the public key and its own identity information to the CA.
- Step B The CA determines whether to agree to issue a certificate for the node, and if so, generates a certificate and uses the CA's private key to generate a digital signature for the certificate.
- the certificate includes at least the information shown in Table 1:
- Step C The node obtains the certificate issued by the CA for the node from the CA.
- the node also obtains the address for querying certificate revocation information and other certificate information in the certificate chain from the CA.
- the address for querying certificate revocation may be the CRL storage address or OCSP server address for querying and recording certificate revocation information, and the certificate chain is used to display sequentially from the node to the trust anchor in the PKI architecture, so as to make other network elements sequentially Find a trust anchor in common with this node.
- the certificate chain corresponding to the network element A1 is: ⁇ network element A1 certificate, CA-A1 certificate, CA-A certificate, root CA certificate ⁇ .
- the certificate chain corresponding to network element B1 is: ⁇ network element B1 certificate, CA-B1 certificate, CA-B certificate, root CA certificate ⁇ .
- NE B1 also needs to verify whether the digital signature of the CA-A certificate is valid according to the public key of the root CA in the root CA certificate in the certificate chain, and verify CA-A1 according to the public key of CA-A in the CA-A certificate in the certificate chain Whether the digital signature of the certificate is valid, verify whether the digital signature of the NE A1 certificate is valid according to the public key of CA-A1 in the CA-A1 certificate in the certificate chain, and verify whether the digital signature of the NE A1 certificate is valid according to Step 1 Whether the digital signature of the message sent by NE A1 is valid.
- the network element B1 sends the certificate of the network element B1 and the certificate included in the certificate chain corresponding to the network element B1 to the network element A1, and the network element A1 needs to perform a process similar to that of the network element B1.
- the verification overhead of the certificate chain is relatively large.
- the network element A1 and the network element B1 are not under the same PKI architecture, they cannot rely on the certificate chain to address to a common trust anchor.
- a large number of certificate cross-certifications are required, resulting in low certificate verification efficiency.
- such a scenario generally occurs between operators and requires a single operator to sign a point-to-point roaming agreement and an interworking agreement with all other operators to achieve cross-authorization.
- 5G needs to configure one or more certificates for different network elements, which further increases the demand for certificates in 5G networks.
- these certificates may include communication with other network function virtualization (NFV), and other Certificates used for secure transport layer protocol (TLS) and/or internet protocol security (IPSec) connections between elements, etc.
- NFV network function virtualization
- TLS secure transport layer protocol
- IPSec internet protocol security
- the CA serving the server is configured with certificates for the server, and the CA serving the client is configured with different certificates. Configure certificates for clients. Therefore, a PKI architecture composed of multiple CAs and multi-level CAs is further required. If an operator needs a PKI architecture for self-built and self-maintained networks, the operator needs to pay a huge cost. For the above reasons, operators now tend to lease to third-party companies that provide PKI full-time to control costs (but the costs are still high). In addition, the operator leases a complete set of PKI equipment from the third party, including the corresponding certificate query solution, and the CRL and OCSP maintained by the third party are maintained on the operator's external network (ie, the third-party network domain). Therefore, the implementation of certificate query requires the operator to frequently interact with the internal and external networks, which violates the operator's requirement to isolate the internal and external networks.
- Blockchain technology also known as distributed ledger technology, is an Internet database technology that is characterized by decentralization, openness and transparency, and immutability.
- Blockchain technology is to use block chain data structure to verify and store data, use distributed node consensus algorithm to generate and update data, use cryptography to ensure the security of data transmission and access, and use automated script code to form smart contracts.
- Blockchain technology was originally the basic technology of Bitcoin, and there have been studies applying it in the fields of finance and supply chain.
- Blockchain mainly includes:
- Transaction An operation that results in a change in the state of the ledger, such as adding a record
- Block Records transactions and status results that occurred within a period of time, which is a consensus on the current ledger status
- Chain It is formed by concatenating blocks in the order in which they occur, and is a log record of the entire state change.
- each transaction is an attempt to change the state
- the block generated by each consensus is the participant's confirmation of the result of the state change caused by all the transaction contents in the block.
- Blockchain is a chained data structure that combines data blocks in a sequential manner according to time sequence, and is a cryptographically guaranteed untamperable and unforgeable distributed ledger.
- the original data recording mechanism only exists between two points of communication, while the distributed ledger technology represented by the blockchain will publish the data that needs to be recorded, and all the nodes that can receive it will participate in the recording.
- the chain structure of the blockchain is shown in Figure 2 below.
- the parent block ID in each block represents the identity of the previous block in the blockchain, and the current block ID is the same as the parent block ID in the next block in the blockchain. (that is, a chained data structure is formed in a sequential manner).
- Consensus credentials are used to identify that the block is generated through some consensus mechanism (cryptographically untamperable and unforgeable).
- the devices involved in the embodiments of the present application may include a first device, a second device, a CA, and a management device.
- the first device and the second device may be two network elements.
- the network element can be specifically used to realize the network processing function used by 3GPP or defined by 3GPP.
- a network element may be a network element on dedicated hardware (eg, a base station), a software instance operating on dedicated hardware (eg, instantiating multiple NRF instances on hardware dedicated to a network repository function (NRF)) Or as a virtualized function instantiated at the platform provider (eg instantiating NRF and other functional network elements on cloud infrastructure).
- dedicated hardware eg, a base station
- a software instance operating on dedicated hardware eg, instantiating multiple NRF instances on hardware dedicated to a network repository function (NRF)
- NRF network repository function
- virtualized function instantiated at the platform provider eg instantiating NRF and other functional network elements on cloud infrastructure.
- the first device and the second device may also be extended to the terminal device and the terminal device. between a terminal device and a network element, which is not limited in this embodiment of the present application.
- the first device may be a terminal device, for example, the terminal device may be a mobile phone, a smart terminal, a vehicle-mounted terminal, a drone, a wearable device, a multimedia device, a streaming media device, or the like.
- the first device may also be an access network device, for example, the access network device may be a base station, a relay station, an access point, a vehicle-mounted device, a network-side device, and the like.
- the present application does not limit the specific forms of the first device and the second device.
- CAs are responsible for managing the entire life cycle of certificates, including issuing certificates, defining certificate validity periods, and revoking certificates. It should be noted that the CA may also include a registration authority (RA), and the RA is used to make a certificate issuance request to the CA after obtaining and authenticating the user's identity. Among them, the RA can be a function integrated in the CA, or the function of the RA can be deployed separately. This embodiment of the present application does not limit the specific form of the CA.
- the management device is the device that undertakes the function of interacting with the blockchain network and maintaining the blockchain.
- the management device may be an independent blockchain maintenance network element, deployed together with other network elements to implement the blockchain maintenance function, or it may be an NRF.
- the NRF is responsible for the registration and management of network elements. Due to the large number of network elements in 5G, it is necessary to use NRF to automatically manage network elements.
- Each network element provides external services through a service-oriented interface, and allows other network elements to access or invoke its own services. Among them, the network element that provides services is called “network element service provider", and the network element that accesses or invokes the service is called “network element service user”.
- the above activities require the management and monitoring of NRF. When each network element starts up, it needs to register with the NRF before it can provide services. If a network element wants to request the service of another network element, it needs to go to the NRF for service discovery.
- the blockchain network may be operated by multiple NRFs, which may connect to the blockchain network as blockchain network elements, maintain the blockchain, generate new blocks, and publish content to the blockchain network.
- the blockchain functional network element can be deployed independently or co-located with other network elements.
- the identification information of the blockchain may include at least one of the ID of the blockchain, the address of the blockchain, and the version number of the blockchain.
- the identification information of the block may include at least one of a block ID, a block hash value, a block transaction number, and a block transaction hash value. It can be understood that the embodiments of this application do not limit the specific forms of the identification information of the blockchain and the identification information of the block. In the following, only the identification information of the blockchain includes the ID of the blockchain, and the identification information of the block includes: The block ID is used as an example for description.
- an embodiment of the present application provides a certificate query method, as shown in FIG. 3 , the method includes:
- Step 300 The management device receives the first information from the second device.
- the first information may include a certificate of the first device or an identifier of the certificate of the first device.
- the first certificate includes the identifier of the first certificate.
- the first information here is used to request to query the validity of the first certificate (ie, certificate status information of the first certificate), and may also be TLS connection establishment information.
- Step 310 The management device determines the certificate status information of the certificate of the first device according to the identifier of the certificate of the first device and the first mapping relationship.
- the first mapping relationship indicates a corresponding relationship between the identity of the certificate of the first device and the certificate status information.
- the certificate status information is used to indicate whether the certificate of the first device is revoked.
- the certificate status information indicates that the certificate of the first device is not revoked, or the revocation reason value of the certificate of the first device, or the certificate status information indicates that the certificate of the first device is not revoked, or the certificate of the first device is revoked and the revocation reason value.
- the revocation reason value of the certificate of the first device may be that the private key of the first device has been leaked, or the first device is a malicious user, or the like. This embodiment of the present application does not limit the revocation cause value of the certificate of the first device.
- Step 320 The management device sends certificate status information to the second device.
- the first mapping relationship may display the corresponding relationship between the identifier indicating the certificate of the first device and the certificate state information, or implicitly indicate the corresponding relationship between the identifier indicating the certificate of the first device and the certificate state information.
- the following only uses Example 1 and Example 2 as examples to describe the first mapping relationship.
- the first mapping relationship may also have other various implementation forms, which are not limited in this embodiment of the present application.
- the first mapping relationship may indicate the corresponding relationship between the identification of the certificate of the first device, the identification information of the first blockchain, and the identification information of the first block, where the first block is on the first blockchain , the first block stores the first certificate and the certificate status information, or the first block stores the identifier of the first certificate and the certificate status information.
- the management device determines the first mapping relationship according to the identification of the certificate of the first device and the first mapping relationship.
- the identification information of a block chain and the identification information of the first block the first block is determined according to the identification information of the first block chain and the identification information of the first block, and the management device is based on the identification of the certificate of the first device.
- the first block obtains certificate status information.
- the certificate status information may directly indicate that the certificate of the first device is not revoked, or directly indicate that the certificate of the first device is revoked.
- the certificate status information may also include the certificate of the first device.
- the certificate status information may directly indicate that the certificate of the first device is not revoked, or the certificate status information includes a revocation reason value of the certificate of the first device.
- the certificate status information is empty, indicating that the certificate of the first device is not revoked, or the certificate status information includes a revocation reason value of the certificate of the first device.
- the first mapping relationship may indicate the corresponding relationship between the identity of the certificate of the first device, the identity information of the first block chain, the identity information of the first block and the certificate state information of the first device.
- Example 2 The first mapping relationship indicates the corresponding relationship between the identity of the revoked certificate, the identity information of the blockchain where the block storing the revoked certificate is located, and the identity information of the block storing the revoked certificate.
- the first mapping relationship shown in Example 2 may include one or more mapping relationships, and when the first mapping relationship includes multiple mapping relationships, the first mapping relationship may be regarded as a set of multiple mapping relationships. For example, when the certificate of network element A is revoked and the certificate of network element B is revoked, the first mapping relationship includes the identity of the certificate of network element A and the area where the block storing the revocation reason value of the certificate of network element A is located.
- the identifier of the block chain (referred to as block chain 1), and the identifier of the block (referred to as block 1) that stores the revocation reason value of the certificate of network element A, where block 1 is on blockchain 1, and block 1 stores The identity of the certificate of network element A and the revocation reason value of the certificate of network element A.
- the first mapping relationship also includes the identity of the certificate of network element B, and the block chain where the block that stores the revocation reason value of the certificate of network element B is located.
- block chain 1 the identifier of the block (referred to as block 2) that stores the revocation reason value of the certificate of network element B, where block 2 is on blockchain 1, and block 2 stores network element The ID of B's certificate and the revocation reason value of NE B's certificate.
- the management device determines the certificate status information according to the identity of the certificate of the first device and the first mapping relationship, including two cases:
- Case 1 When the identity of the revoked certificate does not include the identity of the certificate of the first device, the management device determines certificate status information indicating that the first certificate is not revoked. Therefore, through the first mapping relationship shown in Example 2, it can be implicitly determined that the certificate is not revoked.
- Case 2 When the identity of the revoked certificate includes the identity of the certificate of the first device, the first mapping relationship includes a fourth mapping relationship, and the fourth mapping relationship indicates the identity of the certificate of the first device and the identity of the second blockchain information and the identification information of the second block, wherein the second block is on the second block chain, and the second block stores the identification of the revoked certificate and the revocation reason value corresponding to the revoked certificate.
- the management device determines the identification information of the second block chain and the identification information of the second block according to the identification of the certificate of the first device and the first mapping relationship, and determines the identification information of the second block chain and the identification information of the second block according to the identification information of the second block chain.
- the second block is determined, the management device obtains the revocation reason value of the certificate of the first device from the second block according to the identification of the certificate of the first device, the management device determines the certificate status information, and the certificate status information indicates the revocation of the certificate of the first device The reason value or the first device's certificate was revoked.
- the management device may obtain the first mapping relationship in the following manner.
- the management device obtaining the first mapping relationship may include the following two scenarios:
- Scenario 1 When the management device is a management device that publishes the certificate status information to the blockchain network, the management device obtains the first mapping relationship through the following process:
- Step 1 The management device receives fifth information from the first CA, where the fifth information includes the certificate of the first device and certificate status information, and the certificate status information indicates that the certificate of the first device is not revoked.
- the fifth information includes an identification of the certificate of the first device and certificate status information, the certificate status information indicating that the certificate of the first device is not revoked.
- the fifth information includes the first device's certificate or an identification of the first device's certificate, but does not include certificate status information, in which case the management device defaults to the certificate status of the first device's certificate The information indicates that the certificate of the first device is not revoked.
- Step 2 The management device determines the identification information of the first blockchain.
- the management device is responsible for the maintenance of multiple blockchains for multiple usage scenarios, that is, the management device maintains multiple blockchains.
- the management device maintains the blockchain for scenarios such as TLS communication and IPSec communication at the same time, and certificates or certificate identifiers (such as TLS certificates or IPSec certificates) for different usage scenarios can be maintained on different blockchains.
- the management device may determine, based on the applicable scope of the certificate, the blockchain corresponding to the applicable scope as the blockchain for storing the certificate. If the fifth information further includes information indicating the scope of application of the certificate of the first device, the management device determines the identification information of the first blockchain according to the information indicating the scope of application of the certificate of the first device.
- the management device can determine the blockchain corresponding to the scope of application based on the scope of application of the certificate corresponding to the identifier of the certificate, as the storage device for the certificate. Identified blockchain.
- the fifth information further includes information used to indicate the scope of application of the certificate corresponding to the identity of the certificate of the first device
- the management device can use the information used to indicate the scope of application of the certificate corresponding to the identity of the certificate of the first device. Determine the identification information of the first blockchain.
- the management device may be responsible for the maintenance of multiple blockchains in a single specific scenario, but the certificates or certificate identifiers of different types of network elements in the same scenario are maintained on different blockchains. For example, the management device maintains the CA's certificate and the base station's certificate or certificate identity on different blockchains.
- the first CA may select the management device according to the scope of application of the certificate, and the first CA may not carry the scope of application of the certificate.
- the management device determines the identification information of the first blockchain according to the category of the network element corresponding to the certificate of the first device.
- the management device may be responsible for the maintenance of a single blockchain for multiple usage scenarios, ie the management device maintains only one blockchain.
- the management device maintains the blockchain for scenarios such as TLS communication and IPSec communication at the same time, but the certificates corresponding to these scenarios are maintained on a blockchain, that is, the certificates or certificate identifiers for different usage scenarios (such as TLS certificates or IPSec certificates). certificates) can be maintained on the same blockchain.
- the first CA may select the management device according to the scope of application of the certificate, and the first CA may not carry the scope of application of the certificate.
- the management device may be responsible for the maintenance of a single blockchain in a single specific scenario, that is, the management device only maintains one blockchain, then the first CA may select the management device according to the scope of application of the certificate, and the first CA may The scope of application of the certificate is not carried.
- Step 3 When the fifth information includes the certificate of the first device and the certificate status information, the management device publishes the certificate of the first device and the certificate status information to the blockchain network corresponding to the identification information of the first blockchain.
- a blockchain network can maintain one or more blockchains.
- the management device broadcasts the certificate and certificate status information of the first device to the blockchain network in the form of a block transaction, and the block transaction includes the first device.
- Device certificate and certificate status information when the blockchain network maintains a blockchain, the management device broadcasts the certificate and certificate status information of the first device to the blockchain network in the form of a block transaction, and the block transaction includes the first device. Device certificate and certificate status information.
- the management device may broadcast the certificate of the first device, the certificate status information, and the identification information of the first blockchain to the blockchain in the form of a block transaction
- the block chain network the block transaction includes the certificate of the first device, the certificate status information and the identification information of the first block chain.
- the management device may broadcast the certificate and certificate status information of the first device to the blockchain network in the form of a block transaction, and the block transaction includes the first device's certificate. certificate, certificate status information, and at the same time, the management device also broadcasts the identification information of the first blockchain to the blockchain network.
- the node in the block chain network corresponding to the identification information of the first block chain uses a consensus algorithm to form a new block, and the new block includes the block transaction, the identification information of the new block and the first block.
- the identification information of a blockchain In the blockchain network corresponding to the identification information of the first blockchain, the node that generates the new block the fastest broadcasts the new block to the blockchain network in the form of a second broadcast message, and the remaining nodes receive the second broadcast message.
- use the consensus algorithm to verify the new block, if the new block is valid, stop generating a new block according to the block transaction, and the new block is recorded as the first block.
- the block transaction can be identified by a block transaction identifier and/or a block transaction hash value identifier.
- the first block stores the first certificate, certificate status information, identification information of the first block, and identification information of the first blockchain.
- the first certificate includes the identifier of the first certificate.
- the management device publishes the identification of the certificate of the first device and the certificate status information to the blockchain corresponding to the identification information of the first blockchain
- the first block stores the identification of the first certificate, the certificate status information, the identification information of the first block, and the identification information of the first blockchain.
- Step 4 the management device obtains the second broadcast message, the second broadcast message indicates the first mapping relationship, and the first mapping relationship indicates the identification of the certificate of the first device, the identification information of the first blockchain, and the identification information of the first block corresponding relationship.
- the second broadcast message includes a first block
- the management device saves the first block and updates the first block to the end of the first blockchain.
- the management device may determine the first mapping relationship according to the first block.
- the management device saves the above-mentioned first mapping relationship.
- the fifth information may further include the identity of the certificate of the first CA.
- the management device transmits the identity of the certificate of the first CA, the certificate of the first device, and the certificate status in the form of a block transaction.
- the information is published to the blockchain network corresponding to the identification information of the first blockchain.
- the first block stores the identification of the certificate of the first CA, the first certificate, the certificate status information, the identification information of the first block, and the identification information of the first blockchain.
- the management device publishes the identity of the certificate of the first CA, the identity of the certificate of the first device, and the certificate status information to the blockchain network corresponding to the identity information of the first blockchain
- the first block stores the identification of the certificate of the first CA, the identification of the first certificate, the certificate status information, the identification information of the first block, and the identification information of the first blockchain.
- the second broadcast message acquired by the management device also indicates the third mapping relationship.
- the third mapping relationship indicates a corresponding relationship between the identity of the certificate of the first device and the identity of the certificate of the first CA.
- the first mapping relationship and the third mapping relationship may exist independently, and the first mapping relationship and the third mapping relationship may be sent separately or combined into one piece of information and sent. Alternatively, the first mapping relationship and the third mapping relationship may be combined into one mapping relationship.
- Step 5 The management device sends sixth information to the first CA, where the sixth information indicates that the certificate status information has been published to the blockchain network corresponding to the identification information of the first blockchain.
- Scenario 2 When the management device is not the management device that publishes the certificate status information to the blockchain network, the management device obtains the second broadcast message.
- the second broadcast message indicates the first mapping relationship, or the first mapping relationship and the third mapping relationship.
- the second broadcast message includes a first block
- the management device saves the first block and updates the first block to the end of the first blockchain.
- the management device can determine the first mapping relationship according to the first block, and the management device saves the first mapping relationship, or the management device can determine the first mapping relationship and the third mapping relationship according to the first block, and the management device saves the first mapping relationship. relationship and a third mapping relationship.
- the management device when the certificate state information changes, the management device also needs to acquire the updated first mapping relationship. Specifically, obtaining the updated first mapping relationship by the management device may include the following two scenarios:
- Scenario 1 When the management device publishes the updated certificate status information to the blockchain network, the management device obtains the updated first mapping relationship through the following process:
- Step 1 the management device receives the seventh information from the first CA, the seventh information includes the identification of the certificate of the first device and the certificate status information, and the updated certificate status information indicates the revocation reason value of the certificate of the first device.
- Step 2 The management device determines the identification information of the first blockchain according to the identification of the certificate of the first device and the first mapping relationship.
- the management device According to the description of the first mapping relationship obtained by the management device, the management device currently has the first mapping relationship. Therefore, the management device can determine the first block according to the identity of the certificate of the first device and the stored first mapping relationship. The identification information of the chain.
- Step 3 The management device publishes the identification of the certificate of the first device and the updated certificate status information to the blockchain network corresponding to the identification information of the first blockchain.
- the management device broadcasts the identity of the certificate of the first device and the updated certificate status information to the blockchain network in the form of a block transaction.
- the block transaction includes the identity of the certificate of the first device and the updated certificate status information.
- the management device may transfer the identification of the certificate of the first device, the updated certificate status information and the identification information of the first blockchain through block transactions
- the block transaction includes the identification of the certificate of the first device, the updated certificate status information and the identification information of the first block chain.
- the management device can broadcast the identity of the certificate of the first device and the updated certificate status information to the blockchain network in the form of a block transaction. It includes the identity of the certificate of the first device and the updated certificate status information. At the same time, the management device also broadcasts the identification information of the first blockchain to the blockchain network.
- the nodes in the blockchain network use a consensus algorithm to form a new block, and the new block includes the block transaction, the identification information of the new block and the identification information of the first blockchain.
- the node that generates the new block the fastest broadcasts the new block to the blockchain network in the form of a third broadcast message, and the remaining nodes use the consensus algorithm to verify the third broadcast message after receiving the third broadcast message.
- New block if the new block is valid, stop generating a new block according to the block transaction, and this new block is recorded as the fourth block.
- the block transaction can be identified by a block transaction identifier and/or a block transaction hash value identifier.
- the fourth block stores the identification of the first certificate, the updated certificate status information, the identification information of the fourth block, and the identification information of the fourth blockchain.
- Step 4 The management device acquires the third broadcast message, the third broadcast message includes the updated first mapping relationship, and the updated first mapping relationship indicates the identity of the certificate of the first device, the identity information of the first blockchain, and the first mapping relationship. The correspondence between the identification information of the four blocks.
- the third broadcast message includes a fourth block
- the management device saves the fourth block and updates the fourth block to the end of the first blockchain.
- the management device may determine the updated first mapping relationship according to the fourth block.
- the management device saves the updated first mapping relationship.
- Step 5 The management device sends eighth information to the first CA, where the eighth information indicates that the updated certificate status information has been published to the blockchain network corresponding to the identification information of the first blockchain.
- Scenario 2 When the management device is not the management device that publishes the updated certificate status information to the blockchain network, the management device obtains the third broadcast message, and the third broadcast message indicates the updated first mapping relationship.
- the updated first mapping relationship indicates the corresponding relationship between the identity of the certificate of the first device, the identity information of the first block chain, and the identity information of the fourth block.
- the third broadcast message includes a fourth block
- the management device saves the fourth block and updates the fourth block to the end of the first blockchain.
- the management device may determine the updated first mapping relationship according to the fourth block, and the management device saves the above-mentioned updated first mapping relationship.
- the management device obtaining the first mapping relationship may include the following two scenarios:
- Scenario 1 When the management device publishes the identity of the certificate of the first device and the certificate status information (the certificate status information indicates the revocation reason value of the certificate of the first device) to the management device of the blockchain network, the management device goes through the following process A fourth mapping relationship is obtained, where the fourth mapping relationship indicates a corresponding relationship between the identification of the certificate of the first device, the identification information of the second blockchain, and the identification information of the second block.
- the first mapping relationship includes a fourth mapping relationship.
- Step 1 The management device receives ninth information from the first CA, where the ninth information includes an identifier of the certificate of the first device and certificate status information.
- Step 2 The management device determines the identification information of the second blockchain.
- the management device is responsible for the maintenance of multiple blockchains for multiple usage scenarios, that is, the management device maintains multiple blockchains.
- the management device maintains the blockchain for scenarios such as TLS communication and IPSec communication at the same time, and the identity of certificates for different usage scenarios (such as TLS certificates or IPSec certificates) can be maintained on different blockchains.
- the management device can determine the blockchain corresponding to the applicable scope based on the applicable scope of the certificate corresponding to the identifier of the certificate, as the area for storing the identifier of the certificate blockchain.
- the ninth information further includes information used to indicate the scope of application of the certificate corresponding to the identifier of the certificate of the first device
- the management device can use the information used to indicate the scope of application of the certificate corresponding to the identifier of the certificate of the first device. Determine the identification information of the first blockchain.
- the management device may be responsible for the maintenance of multiple blockchains in a single specific scenario, but the certificates or certificate identifiers of different types of network elements in the same scenario are maintained on different blockchains. For example, the management device maintains the certificate identity of the CA and the certificate identity of the base station on different blockchains respectively.
- the first CA may select the management device according to the scope of application of the certificate, and the first CA may not carry the scope of application of the certificate.
- the management device determines the identification information of the first blockchain according to the category of the network element corresponding to the certificate corresponding to the certificate identification of the first device.
- the management device may be responsible for the maintenance of a single blockchain for multiple usage scenarios, ie the management device maintains only one blockchain.
- the management device maintains the blockchain for scenarios such as TLS communication and IPSec communication at the same time, but the certificates corresponding to these scenarios are maintained on a blockchain, that is, the identification of certificates for different usage scenarios (such as TLS certificates or IPSec certificates) Can be maintained on the same blockchain.
- the first CA may select the management device according to the scope of application of the certificate, and the first CA may not carry the scope of application of the certificate.
- the management device may be responsible for the maintenance of a single blockchain in a single specific scenario, that is, the management device only maintains one blockchain, then the first CA may select the management device according to the scope of application of the certificate, and the first CA may The scope of application of the certificate is not carried.
- Step 3 The management device publishes the identification of the certificate of the first device, the certificate status information, and the identification information of the second blockchain to the blockchain network corresponding to the identification information of the second blockchain.
- a blockchain network can maintain one or more blockchains.
- the management device broadcasts the identity of the certificate of the first device and the certificate status information to the blockchain network in the form of a block transaction, where the block transaction includes The identity of the certificate of the first device, and the certificate status information.
- the management device may broadcast the identification of the certificate of the first device, the certificate status information and the identification information of the first blockchain in the form of block transactions
- the block transaction includes the identification of the certificate of the first device, the certificate status information and the identification information of the second blockchain.
- the management device may broadcast the identification of the certificate of the first device and the certificate status information to the blockchain network in the form of a block transaction, where the block transaction includes the first device. The identity and certificate status information of the device's certificate.
- the management device also broadcasts the identification information of the second blockchain to the blockchain network.
- the node in the block chain network corresponding to the identification information of the first block chain uses a consensus algorithm to form a new block, and the new block includes the block transaction, the identification information of the new block and the first block. 2.
- the identification information of the blockchain In the blockchain network corresponding to the identification information of the first blockchain, the node that generates the new block the fastest broadcasts the new block to the blockchain network in the form of a second broadcast message, and other nodes receive the second broadcast message. Broadcast the message, use the consensus algorithm to verify the new block, if the new block is valid, stop generating a new block based on the block transaction, and the new block is recorded as the second block.
- the block transaction can be identified by a block transaction identifier and/or a block transaction hash value identifier.
- the second block stores the identification of the certificate of the first device, the certificate status information, the identification information of the second block, and the identification information of the second blockchain.
- Step 4 The management device acquires the second broadcast message.
- the second broadcast message indicates a fourth mapping relationship, and the fourth mapping relationship indicates a corresponding relationship between the identification of the certificate of the first device, the identification information of the second blockchain, and the identification information of the second block.
- the third broadcast message includes the second block, and the management device saves the second block and updates the second block to the end of the second block chain.
- the management device may determine the fourth mapping relationship according to the second block, and the management device saves the fourth mapping relationship.
- Step 5 The management device sends eighth information to the first CA, where the eighth information indicates that the certificate status information has been published to the blockchain network corresponding to the identification information of the second blockchain.
- Scenario 2 When the management device is not the management device that publishes the identity of the certificate of the first device and the certificate status information (the certificate status information indicates the revocation cause value of the certificate of the first device) to the blockchain network, the management device obtains the second broadcast message.
- the second broadcast message indicates a fourth mapping relationship, and the fourth mapping relationship indicates a corresponding relationship between the identification of the certificate of the first device, the identification information of the second blockchain, and the identification information of the second block.
- the third broadcast message includes the second block, and the management device saves the second block and updates the second block to the end of the second block chain.
- the management device may determine the fourth mapping relationship according to the second block, and the management device saves the fourth mapping relationship.
- the first mapping relationship relies on the distributed consensus and distributed ledger mechanism of the blockchain, and is responsible for determining the certificate status information.
- the certificate status information can be stored in the blockchain within the blockchain network, and the blockchain network is independently operated by the network operator, so it is possible to query the certificate status information within the operator's intranet, eliminating the need for cross-network query steps.
- the management device In addition to determining the certificate status information of the certificate of the first device, the management device also needs to obtain the public key of the first CA to verify whether the digital signature of the certificate of the first device is valid.
- the first CA refers to a CA that issues a certificate of the first device for the first device. It should be noted that the embodiments of the present application do not limit the specific manner in which the management device obtains the public key of the first CA.
- the management device obtains the public key of the first CA and sends the public key of the first CA to the second device, so that the second device verifies the digital signature of the certificate of the first device according to the public key of the first CA is it effective.
- the public key of the first CA may be sent to the second device at the same time as the certificate status information of the first certificate or sent to the second device separately.
- the management device may obtain the public key of the first CA and send the public key of the first CA to the second device after determining the certificate status information of the certificate of the first device, or the management device may determine the public key of the first device after determining the certificate status information of the first device.
- the public key of the first CA is obtained, and after it is subsequently determined that the certificate status of the certificate of the first device is valid, the public key of the first CA is sent to the second device.
- the management device when the management device determines that the certificate status information of the certificate of the first device indicates that the certificate of the first device is not revoked, the management device sends the public key of the first CA to the second device.
- the management device determines that the certificate status information of the certificate of the first device indicates that the certificate of the first device is revoked, the management device does not send the public key of the first CA to the second device.
- the management device may first obtain the public key of the first CA, and when it is determined that the certificate status information of the certificate of the first device indicates that the certificate of the first device has not been revoked, the management device sends the public key of the first CA to the second device. key.
- the management device obtains the public key of the first CA, and the management device determines whether the digital signature of the certificate of the first device is valid according to the public key of the first CA.
- the management device may determine whether the digital signature of the certificate of the first device is valid according to the public key of the first CA. Or, before determining the certificate status information of the certificate of the first device, the management device may determine whether the digital signature of the certificate of the first device is valid according to the public key of the first CA.
- the management device determines whether the digital signature of the certificate of the first device is valid according to the public key of the first CA. Further, if the management device determines that the digital signature of the certificate of the first device is valid according to the public key of the first CA, the management device determines the certificate status information of the certificate of the first device according to the identity of the certificate of the first device and the first mapping relationship. . If the management device determines that the digital signature of the certificate of the first device is invalid according to the public key of the first CA, the management device may not need to determine the certificate status information of the certificate of the first device according to the identification of the certificate of the first device and the first mapping relationship. .
- the management device determines that the certificate status information indicates that the certificate of the first device is not revoked
- the management device obtains the public key of the first CA
- the management device determines the digital signature of the certificate of the first device according to the public key of the first CA. Whether it is valid, the management device sends second information to the first device, where the second information indicates whether the digital signature of the certificate of the first device is valid.
- the management device may not need to obtain the public key of the first CA, nor need to determine whether the digital signature of the certificate of the first device is valid.
- the management device needs to obtain the public key of the first CA based on the second mapping relationship.
- the second mapping relationship indicates the corresponding relationship between the identity of the certificate of the first CA, the identity information of the third block chain, and the identity information of the third block.
- Obtaining the second mapping relationship by the management device may include the following two scenarios:
- Scenario 1 When the management device is the management device that publishes the certificate of the first CA to the blockchain network, the management device obtains the second mapping relationship through the following process:
- Step 1 The management device receives third information from the first CA, where the third information includes the certificate of the first CA.
- Step 2 The management device determines the identification information of the third blockchain.
- the management device is responsible for the maintenance of multiple blockchains for multiple usage scenarios, that is, the management device maintains multiple blockchains.
- the management device maintains the blockchain for scenarios such as TLS communication and IPSec communication at the same time, and the identity of certificates for different usage scenarios (such as TLS certificates or IPSec certificates) can be maintained on different blockchains.
- the management device can determine the blockchain corresponding to the applicable scope based on the applicable scope of the certificate corresponding to the identifier of the certificate, as the area for storing the identifier of the certificate blockchain.
- the third information further includes information indicating the scope of application of the certificate corresponding to the certificate of the first CA
- the management device determines the third area according to the information indicating the scope of application of the certificate corresponding to the certificate of the first CA.
- the identification information of the blockchain is a configurabled.
- the management device may be responsible for the maintenance of multiple blockchains in a single specific scenario, but the certificates or certificate identifiers of different types of network elements in the same scenario are maintained on different blockchains. For example, the management device maintains the certificate identity of the CA and the certificate identity of the base station on different blockchains respectively.
- the first CA may select the management device according to the scope of application of the certificate, and the first CA may not carry the scope of application of the certificate.
- the management device determines the identification information of the third blockchain according to the category of the network element corresponding to the certificate of the first CA.
- the management device may be responsible for the maintenance of a single blockchain for multiple usage scenarios, ie the management device maintains only one blockchain.
- the management device maintains the blockchain for scenarios such as TLS communication and IPSec communication at the same time, but the certificates corresponding to these scenarios are maintained on a blockchain, that is, the identification of certificates for different usage scenarios (such as TLS certificates or IPSec certificates) Can be maintained on the same blockchain.
- the first CA may select the management device according to the scope of application of the certificate, and the first CA may not carry the scope of application of the certificate.
- the management device may be responsible for the maintenance of a single blockchain in a single specific scenario, that is, the management device only maintains one blockchain, then the first CA may select the management device according to the scope of application of the certificate, and the first CA may The scope of application of the certificate is not carried.
- the third blockchain and the first blockchain may be the same blockchain or different blockchains.
- the third blockchain and the second blockchain may be the same blockchain or different blockchains.
- the third blockchain and the first blockchain (or the second blockchain) may be the same Different blockchains with different scopes, or different blockchains with different scopes.
- Step 3 The management device publishes the certificate of the first CA to the blockchain network corresponding to the identification information of the third blockchain.
- a blockchain network can maintain one or more blockchains.
- the management device broadcasts the certificate of the first CA to the blockchain network in the form of a block transaction including the certificate of the first CA.
- the management device may broadcast the certificate of the first CA and the identification information of the first blockchain to the blockchain network in the form of block transactions,
- the block transaction includes the certificate of the first CA and the identification information of the third blockchain.
- the management device may broadcast the certificate of the first CA to the blockchain network in the form of a block transaction, and the block transaction includes the certificate of the first CA.
- the management device also broadcasts the identification information of the third blockchain to the blockchain network.
- the node in the block chain network corresponding to the identification information of the third block chain uses a consensus algorithm to form a new block, and the new block includes the block transaction, the identification information of the new block and the first block.
- Three blockchain identification information In the blockchain network corresponding to the identification information of the third blockchain, the node that generates the new block the fastest broadcasts the new block to the blockchain network in the form of a first broadcast message, and other nodes receive the first broadcast message. Broadcast the message, use the consensus algorithm to verify that the new block is valid, stop generating a new block based on the block transaction, and this new block is recorded as the third block.
- the block transaction can be identified by a block transaction identifier and/or a block transaction hash value identifier.
- the third block stores the certificate of the first CA, the identification of the third block and the identification information of the third blockchain.
- Step 4 the management device obtains the first broadcast message, the first broadcast message indicates the second mapping relationship, and the second mapping relationship indicates the identification of the certificate of the first CA, the identification information of the third blockchain, and the identification information of the third block corresponding relationship.
- the first broadcast information includes a third block
- the management device saves the third block, and updates the third block to the end of the third block chain.
- the management device may determine the second mapping relationship according to the third block.
- the management device saves the above-mentioned second mapping relationship.
- Step 5 The management device sends fourth information to the first CA, where the fourth information indicates that the certificate of the first CA has been published to the blockchain network corresponding to the identification information of the third blockchain.
- Scenario 2 When the management device is not the management device that publishes the certificate of the first CA to the blockchain network, the management device obtains the first broadcast message, the first broadcast message indicates the second mapping relationship, and the second mapping relationship indicates the first CA The corresponding relationship between the identity of the certificate, the identity information of the third block chain and the identity information of the third block.
- the first broadcast information includes a third block
- the management device saves the third block, and updates the third block to the end of the third block chain.
- the management device may determine the second mapping relationship according to the third block.
- the management device saves the above-mentioned second mapping relationship.
- the management device may obtain the public key of the first CA in the following manner.
- Mode 1 When the first information does not include the identity of the certificate of the first CA, the management device needs to first determine the identity of the certificate of the first CA according to the identity of the certificate of the first device and the third mapping relationship, and the third mapping relationship indicates the first CA certificate. A corresponding relationship between the identity of the certificate of the device and the identity of the certificate of the first CA, and then the management device determines the identity information of the third blockchain and the identity of the third block according to the identity of the certificate of the first CA and the second mapping relationship information, and the second mapping relationship indicates the corresponding relationship between the identity of the certificate of the first CA, the identity information of the third block chain, and the identity information of the third block. The management device determines the third block according to the identification information of the third blockchain and the identification information of the third block, and the management device obtains the public key of the first CA from the third block according to the identification of the certificate of the first CA.
- the method 1 may be applicable to the embodiment corresponding to the first mapping relationship shown in example 1.
- Mode 2 when the first information includes the identification of the certificate of the first CA, the management device determines the identification information of the third block chain and the identification information of the third block according to the identification of the certificate of the first CA and the second mapping relationship, The second mapping relationship indicates the corresponding relationship between the identity of the certificate of the first CA, the identity information of the third block chain, and the identity information of the third block. Then the management device determines the third block according to the identification information of the third block chain and the identification information of the third block, and the management device obtains the public key of the first CA from the third block according to the identification of the certificate of the first CA.
- Manner 2 may be applicable to the embodiment corresponding to the first mapping relationship shown in Example 2.
- the distributed ledger nature of blockchain ensures that the same blockchain, blocks and block transactions are stored on all management devices, which can realize the function of trust anchor.
- the centralized trust mechanism of the PKI architecture has become a decentralized trust mechanism.
- the trust anchors are all anchored on the blockchain.
- the second device can query the nearest network element (ie, the management device) operating the blockchain to obtain information with the first A device trust relationship.
- Use blockchain to simplify the PKI architecture change the original centralized root trust mechanism into a decentralized trust mechanism, simplify the certificate verification mechanism, and prevent the need to verify multiple certificates to determine whether there is a multi-layer CA PKI architecture.
- a common trust anchor, and the certificate cannot be verified because there is no common trust anchor.
- the following takes NRF maintaining multiple blockchains as an example to illustrate the certificate query process, as shown in FIG. 4A and FIG. 4B .
- Step 1 CA-A generates a self-signed certificate.
- CA-A independently generates a private key and a corresponding public key, and generates its own certificate, and the CA-A certificate is self-signed using CA-A's private key.
- the CA-A certificate can include the content in Table 2:
- Step 2 The CA-A sends the CA-A certificate and the certificate scope of the CA-A certificate to the NRF.
- NRF can be responsible for the maintenance of multiple blockchains for multiple usage scenarios, and certificates and/or certificate identifiers (such as TLS certificates or IPSec certificates) for different usage scenarios can be maintained in different blocks.
- CA-A can carry the certificate application scope of CA-A certificate, and NRF can determine the corresponding blockchain identifier according to the certificate application scope of CA-A certificate.
- the certificate application scope of the CA-A certificate is used to indicate the certificate usage of the CA-A certificate, for example, the CA-A certificate can be used for TLS communication, IPSec communication, or inter-operator communication.
- NRF can be responsible for the maintenance of multiple blockchains in a single specific scenario, but the certificates and/or certificate identifiers of different types of network elements in the same scenario are maintained on different blockchains.
- CA-A can select NRF according to the scope of application of the certificate, and CA-A may not carry the scope of application of the certificate.
- the NRF determines the corresponding blockchain identifier according to the category of the network element corresponding to the CA-A certificate.
- Step 3 NRF determines the corresponding blockchain identifier according to the certificate application scope of the CA-A certificate, which is recorded as the identifier of blockchain A here. NRF publishes the CA-A certificate to the blockchain network corresponding to the blockchain identity.
- the CA-A certificate is broadcast to the blockchain network in the form of a block transaction that includes the CA-A certificate.
- the CA-A certificate and the blockchain identity are broadcast to the blockchain network in the form of a block transaction that includes the CA-A certificate and the blockchain.
- Blockchain logo when the blockchain network maintains multiple blockchains, the CA-A certificate is broadcast to the blockchain network in the form of a block transaction that includes the CA-A certificate.
- the NRF broadcasts the blockchain identification at the same time.
- the nodes in the blockchain network use a consensus algorithm to form a new block, and the new block includes the block transaction, the new block identifier and the blockchain identifier.
- the node that generates the new block the fastest broadcasts the new block to the blockchain network in the form of a broadcast message, and the remaining nodes receive the broadcast message and use the consensus algorithm to verify that the new block is valid and then store it.
- the block and the corresponding block chain are updated to stop generating a new block according to the block transaction, wherein the new block is identified as the block A1 identification and the blockchain identification is the block chain A identification.
- the block transaction can be identified by a block transaction identifier and/or a block transaction hash value identifier.
- Step 4 The NRF receives the broadcast information and saves the CA certificate mapping relationship of the CA-A certificate.
- the NRF receives the broadcast message including the block A1 in step 3, and the broadcast message indicates the corresponding relationship between the block chain identifier, the block identifier and the ID of the CA-A certificate, wherein the block chain identifier is the block chain A
- the identifier of the block is the identifier of block A1. Therefore, the NRF can determine the corresponding relationship as shown in Table 3, which is denoted as the CA certificate mapping relationship of the CA-A certificate.
- NRF saves block A1 and updates block A1 to the end of block chain A.
- the NRF can determine the above-mentioned mapping relationship according to block A1, and the NRF stores the above-mentioned mapping relationship.
- the correspondence between the block chain identifier, the block identifier and the ID of the CA-A certificate may correspond to the above-mentioned second mapping relationship.
- Step 5 NRF sends an uplink confirmation message to CA-A.
- This on-chain confirmation message is used to indicate that CA-A's certificate has been published to the blockchain network.
- CA-B and NRF perform steps 6-10 similar to steps 1-5. It can be understood that, the embodiment of the present application does not limit the sequence of steps 1-5 and steps 6-10.
- Step 6 CA-B generates a self-signed certificate.
- CA-B independently generates a private key and a corresponding public key, and generates its own certificate, and the CA-B certificate uses CA-B's private key to self-sign.
- the CA-B certificate can include the content in Table 4:
- Step 7 The CA-B sends the CA-B certificate and the certificate scope of the CA-B certificate to the NRF.
- step 2 it may be made to the relevant description of step 2 here, and the following only takes the scope of application of the certificate carried by CA-B as an example for description.
- Step 8 NRF selects the corresponding blockchain identifier according to the certificate application scope of the CA-B certificate. NRF publishes the CA-B certificate to the blockchain network corresponding to the blockchain identity.
- the CA-B certificate is broadcast to the blockchain network in the form of a block transaction that includes the CA-B certificate.
- the CA-B certificate and the blockchain identity are broadcast to the blockchain network in the form of a block transaction that includes the CA-B certificate and the blockchain.
- Blockchain logo when the blockchain network maintains multiple blockchains, the CA-B certificate is broadcast to the blockchain network in the form of a block transaction that includes the CA-B certificate.
- the NRF broadcasts the blockchain identification at the same time.
- the nodes in the blockchain network use a consensus algorithm to form a new block, and the new block includes the block transaction, the new block identifier and the blockchain identifier.
- the node that generates the new block the fastest broadcasts the new block to the blockchain network in the form of a broadcast message, and the remaining nodes receive the broadcast message and use the consensus algorithm to verify that the new block is valid and then store it.
- the block and the corresponding block chain are updated, and the generation of new blocks according to the block transaction is stopped, wherein the new block is identified as the block A2 logo and the blockchain logo is the block chain A logo.
- the block transaction can be identified by a block transaction identifier and/or a block transaction hash value identifier.
- Step 9 The NRF receives the broadcast information and saves the CA certificate mapping relationship of the CA-B certificate.
- the NRF receives the broadcast message including the block A2 in step 3, and the broadcast message includes the corresponding relationship between the block chain identifier, the block identifier and the ID of the CA-B certificate, wherein the block chain identifier is the block chain A
- the identifier of the block is the identifier of block A2. Therefore, the NRF can determine the corresponding relationship as shown in Table 5, which is denoted as the CA certificate mapping relationship of the CA-B certificate.
- NRF saves block A2 and updates block A2 to the end of blockchain A.
- the NRF can determine the above-mentioned mapping relationship according to block A2, and the NRF stores the above-mentioned mapping relationship.
- the block A2 and the block A1 may be the same block or different blocks.
- nodes in the blockchain network can use consensus algorithms to form new blocks for all block transactions received within a period of time, when both CA-B certificates and CA-A certificates are published to the district within this period of time.
- block A2 and block A1 can be the same block, otherwise block A2 and block A1 are different blocks.
- the corresponding relationship between the identifier of the blockchain A, the identifier of the block A2 and the ID of the CA-B certificate may correspond to the above-mentioned second mapping relationship.
- Step 10 NRF sends an uplink confirmation message to CA-B.
- This on-chain confirmation message is used to indicate that CA-B's certificate has been published to the blockchain network.
- Step 11 Network element A generates its own public key and private key locally, and sends the public key to CA-A to request CA-A to issue a certificate for network element A.
- Step 12 CA-A generates a certificate of network element A according to the public key of network element A, and sends the certificate of network element A to network element A.
- the NE A certificate may include the information shown in Table 6A:
- network element B executes steps 13-14 to obtain the certificate of network element B from CA-B.
- Step 13 Network element B generates its own public key and private key locally, and sends the public key to CA-B to request CA-B to issue a certificate for network element B.
- Step 14 CA-B generates a certificate of network element B according to the public key of network element B, and sends the certificate of network element B to network element B.
- the network element B certificate may include the information shown in Table 6B:
- CA-B is the content of the certificate issued by network element B
- Step 15 CA-A will send the certificate of network element A, the certificate status information of the certificate of network element A, and the certificate ID of CA-A to the NRF.
- the certificate status information of the NE A certificate indicates that the NE A certificate has not been revoked, or that the NE A certificate is valid.
- the CA-A may simultaneously send the certificate application scope of the network element A's certificate to the NRF.
- the relevant description of step 2 here and the following only takes the application scope of the certificate of the network element A carried by the CA-A as an example for description.
- NRF can query the CA certificate mapping relationship (as shown in Table 3) according to the ID of the CA-A certificate to obtain the blockchain ID and block ID (respectively, the ID of blockchain A and the ID of block A1). ), obtain the block A1 from the block chain A through the obtained identification of the block chain A and the block A1, and obtain the public key of CA-A.
- the CA-A public key is used to verify whether the digital signature in the certificate of network element A is valid. After confirming that the digital signature in the certificate of network element A is valid, continue to perform the following steps.
- the CA-A may also send the identification of the network element A certificate (the ID of the network element A certificate) instead of the network element A certificate to the NRF in the process of this step.
- Step 16 The NRF selects the corresponding blockchain identifier according to the certificate application scope of the certificate of the network element A, which is recorded as the identifier of the blockchain B.
- the NRF publishes the CA-A certificate ID, the NE A certificate, and the certificate status information of the NE A certificate to the blockchain network corresponding to the blockchain ID.
- NRF can also query the CA certificate mapping relationship according to the CA-A certificate ID to obtain the blockchain identifier.
- the blockchain network corresponding to the blockchain identifier is used as the blockchain network that publishes the CA-A certificate ID, the NE A certificate, and the certificate status information of the NE A certificate.
- the CA-A certificate ID, the NE A certificate, and the certificate status information of the NE A certificate are broadcast to the blockchain network in the form of block transactions.
- the block transaction includes the CA-A certificate ID, the NE A certificate, and the certificate status information of the NE A certificate.
- the CA-A certificate ID, the network element A certificate, the certificate status information of the network element A certificate, and the blockchain identification are broadcast to the district in the form of block transactions.
- the block chain network the block transaction includes the CA-A certificate ID, the network element A certificate, the certificate status information of the network element A certificate, and the block chain identification.
- the CA-A certificate ID, the NE A certificate, and the certificate status information of the NE A certificate are broadcast to the blockchain network in the form of block transactions.
- the transaction includes the CA-A certificate ID, the NE A certificate, and the certificate status information of the NE A certificate.
- the NRF broadcasts the blockchain identification at the same time.
- the nodes in the blockchain network use a consensus algorithm to form a new block, and the new block includes the block transaction, the new block identifier and the blockchain identifier.
- the node that generates the new block the fastest broadcasts the new block to the blockchain network in the form of a broadcast message, and the remaining nodes receive the broadcast message and use the consensus algorithm to verify that the new block is valid and then store it.
- the block and the corresponding block chain are updated, and the generation of a new block according to the block transaction is stopped, wherein the new block is identified as the block B1 identification and the blockchain identification is the blockchain B identification.
- the block transaction can be identified by a block transaction identifier and/or a block transaction hash value identifier.
- blockchain B is different from blockchain A.
- the NRF may also publish the identity of the network element A certificate (the network element A certificate ID) instead of the network element A certificate to the blockchain network in the above process of this step.
- the block transaction and the new block B1 include the identity of the network element A certificate, but not the network element A certificate.
- Step 17 The NRF receives the broadcast information, and stores the network element certificate mapping relationship of the network element A.
- the NRF receiving step 16 includes the broadcast message of block B1, and the broadcast message indicates the correspondence between the block chain identifier, the block identifier, the CA-A certificate ID and the network element A certificate ID, wherein the block chain identifier is The identifier of blockchain B, and the block identifier is the identifier of block B1.
- the broadcast message indicates the correspondence between the blockchain identifier, the block identifier, the CA-A certificate ID, the network element A certificate ID, and the certificate status information of the network element A certificate, wherein the blockchain identifier is the blockchain B
- the identifier of the block is the identifier of the block B1.
- the corresponding relationship indicated by the above broadcast message corresponds to the first mapping relationship and the third mapping relationship shown in the above example 1, as shown in Table 7A.
- NRF saves block B1 and updates block B1 to the end of blockchain B.
- the NRF can determine the above-mentioned mapping relationship according to the block B1, and the NRF stores the above-mentioned mapping relationship.
- Step 18 The NRF sends an on-chain confirmation message to CA-A, where the on-chain confirmation message is used to indicate that the certificate status information of the certificate of network element A has been published to the blockchain network.
- CA-B and NRF perform similar steps 19-22 to publish the certificate of network element B or the identity of the certificate of network element B (the ID of the certificate of network element B) to the blockchain network.
- the NRF receives a broadcast message, the broadcast message indicates the CA-A certificate ID, block chain ID, block ID, CA-B certificate ID, the corresponding relationship between the network element B certificate ID, or, the broadcast message indicates the CA-A certificate ID , block chain identification, block identification, CA-B certificate ID, network element B certificate ID and the corresponding relationship of the certificate status information of network element B certificate, wherein, the blockchain identification is the identification of blockchain B, the area The block identification is the identification of block B2, as shown in Table 7B.
- NRF saves block B2 and updates block B2 to the end of blockchain B.
- the NRF can determine the above-mentioned mapping relationship according to the block B2, and the NRF stores the above-mentioned mapping relationship.
- the block B2 and the block B1 can be the same block or different blocks.
- a node in a blockchain network can use a consensus algorithm to form a new block for all block transactions received within a period of time.
- block B1 and block B2 can be the same block, otherwise block B1 and block B2 are different blocks.
- the NRF may also publish the CA-A certificate ID, the identity of the certificate of network element A, and the certificate status information of the certificate of network element A to the corresponding block chain identity
- the specific process is similar to that of NRF publishing the CA-A certificate ID, the certificate of network element A, and the certificate status information of the certificate of network element A to the blockchain network, and the repetition will not be repeated.
- the NRF can also publish the CA-A certificate ID, the identity of the certificate of network element B, and the certificate status information of the certificate of network element B to the blockchain network corresponding to the blockchain identity.
- the specific process is the same as that of the NRF. Publishing the CA-A certificate ID, the certificate of network element B, and the certificate status information of the certificate of network element B to the blockchain network corresponding to the blockchain identifier is similar, and the repetition will not be repeated.
- Step 23 The CA-B triggers the revocation of the certificate of the network element B, and the CA-B sends the certificate ID of the network element B and the certificate status information to the NRF.
- the certificate status information indicates the CA-B certificate's revocation reason value. It should be noted that at this time, taking the CA-B triggering the revocation of the certificate of network element B as an example, in actual situations, any CA can revoke the certificate of the network element under its jurisdiction.
- Step 24 The NRF searches the network element certificate mapping relationship according to the network element B certificate ID to obtain the block chain identifier (block chain B identifier), and publishes the network element B certificate ID and certificate status information to the block corresponding to the block chain identifier chain network.
- the network element B certificate ID and certificate status information are broadcast to the blockchain network in the form of a block transaction, and the block transaction includes the network element B certificate ID, Certificate status information.
- the network element B certificate ID, certificate status information and blockchain identification are broadcast to the blockchain network in the form of block transactions
- the block transactions include Meta B certificate ID, certificate status information, and blockchain identity.
- the certificate ID and certificate status information of network element B are broadcast to the blockchain network in the form of a block transaction, and the block transaction includes the certificate ID and certificate status of network element B. information.
- the NRF broadcasts the blockchain identification at the same time.
- the nodes in the blockchain network After receiving the block transaction, the nodes in the blockchain network use the consensus algorithm to form a new block, and the new block contains the block transaction, the new block identification information and the blockchain identification information.
- the node that generates the new block the fastest broadcasts the new block to the blockchain network in the form of a broadcast message, and the remaining nodes receive the broadcast message and use the consensus algorithm to verify that the new block is valid and then store it.
- the block and the corresponding blockchain are updated to stop generating a new block according to the block transaction, wherein the new block is identified as the identification of block B3 and the blockchain identification is the identification of blockchain B.
- the block transaction can be identified by a block transaction identifier and/or a block transaction hash value identifier.
- Step 25 The NRF receives the broadcast information, and saves the updated mapping relationship of the network element certificate of the network element B.
- the NRF receiving step 24 includes the broadcast message of block B3, the broadcast message indicates the block chain identifier, the block identifier, the corresponding relationship between the CA-B certificate ID and the network element B certificate ID, or the broadcast message indicates the block chain identifier , block identifier, the corresponding relationship between CA-B certificate ID, network element B certificate ID and certificate status information of network element B certificate, wherein the block chain identifier is the identifier of blockchain B, and the block identifier is the block identifier B3's logo.
- the corresponding relationship indicated by the above broadcast message corresponds to the updated first mapping relationship and the third mapping relationship shown in the above example 1, wherein the third mapping relationship is not updated, as shown in Table 8.
- NRF saves block B3 and updates block B3 to the end of blockchain B.
- the NRF can determine the above-mentioned mapping relationship according to block B3, and the NRF stores the above-mentioned mapping relationship.
- Step 26 NRF sends an uplink confirmation message to CA-B.
- the on-chain confirmation message is used to indicate that the certificate status information of the certificate of the network element B has been published to the blockchain network.
- Step 27 The network element A and the network element B initiate a connection request, in which the local certificate is exchanged with each other, which is used to identify the local identity and the ownership of the public key held.
- the message carrying the certificate may be the certificate carried by the server certificate (server certificate) or the user certificate (client certificate) during the handshake of the TLS connection establishment, or the certificate may be carried in the IKE_AUTH message for the IPSec connection establishment, or it may be any other certificate that needs to be carried. scene, which is not limited here.
- Step 28 After network element A obtains the certificate of network element B, network element A sends the certificate of network element B or the ID of the certificate of network element B to the NRF, so as to request the NRF to verify whether the certificate of network element B is revoked and to verify the digital number of the certificate of network element B. Whether the signature is valid.
- the network element B certificate may be carried by a network element status notification subscription (Nnrf_NFManagement_NFStatusSubscribe) message of the NRF or a network element discovery (Nnrf_NFDiscovery) message of the NRF.
- Nnrf_NFManagement_NFStatusSubscribe a network element status notification subscription
- Nnrf_NFDiscovery a network element discovery
- Step 29 The NRF searches the updated network element certificate mapping relationship of network element B (as shown in Table 8) according to the network element B certificate ID in the network element B certificate to obtain certificate status information.
- the NRF searches the network element certificate mapping relationship according to the certificate ID of network element B to obtain the blockchain identifier and block identifier (respectively the identifier and block identifier of blockchain B). ID of B3), obtain block B3 from blockchain B by obtaining the ID of blockchain B and the ID of block B3, and query the ID of the certificate of network element B through the ID of the certificate of network element B in this block B3 Certificate status information.
- the NRF determines that the certificate status information indicates that the certificate of network element B has been revoked and the revocation reason value of the certificate of network element B, such as the private key of network element B has been leaked, or the value of network element B Malicious users, etc., are not limited here.
- Step 30 The NRF searches the updated NE B certificate mapping relationship (as shown in Table 8) according to the NE B certificate ID in the NE B certificate to obtain the CA certificate ID, that is, the CA-B certificate ID, and uses this as an index Find the CA certificate mapping relationship of the CA-B certificate (as shown in Table 5) to obtain the public key of CA-B. Specifically, use the CA-B certificate ID as an index to find the CA certificate mapping relationship of the CA-B certificate (as shown in Table 5) to obtain the blockchain identifier and block identifier (respectively, the identifier of blockchain A and the identifier of block A2). ), obtain block A2 from block chain A through the obtained identification of block chain A and block A2, and query the certificate of CA-B through CA-B certificate ID in block A2, CA-B The certificate includes CA-B's public key.
- Step 31 The NRF verifies whether the digital signature of the network element B certificate is valid.
- Step 32 The NRF sends the certificate status information searched in step 29 and the result of whether the digital signature of the certificate of the network element B is valid to the network element A.
- the NRF does not locally verify the digital signature of the network element B certificate after obtaining the CA-B public key, and the NRF sends the CA-B public key and the certificate status information searched in step 29 to the network element A, NE A verifies the validity of the digital signature of the NE B certificate.
- the NRF determines that the certificate status information of the certificate of network element B indicates that the certificate of network element B is revoked, then the NRF may not execute the acquisition of the CA-B public key, and thus does not need to verify the digital number of the certificate of network element B. Signature validity.
- the message shown in step 32 may be a network element status notification (Nnrf_NFManagement_NFStatusNotify) message of the NRF or a reply message of the Nnrf_NFDiscovery message.
- Nnrf_NFManagement_NFStatusNotify a network element status notification (Nnrf_NFManagement_NFStatusNotify) message of the NRF or a reply message of the Nnrf_NFDiscovery message.
- Step 33 The network element A determines that the certificate of the network element B is revoked according to the certificate status information returned by the NRF, stops the connection establishment process with the network element B, and disconnects the connection.
- the network element A continues the subsequent connection establishment process.
- network element A learns that the digital signature of the certificate of network element B is valid, it can be informed by the NRF, or it can use the CA-B public key locally to verify the digital signature of the certificate of network element B.
- NE B also verifies the certificate sent by NE A. Since CA-A has not revoked NE A's certificate, NE B learns from the NRF that NE A's certificate has not been revoked and the digital signature of NE A's certificate is valid. .
- steps 28-33 can be executed during the connection establishment between network element A and network element B. If the certificate is revoked or the digital signature of the certificate is invalid, the connection establishment will be stopped, or it may be executed after the connection is established. The connection is torn down if the digital signature of the revoked or invalid certificate is invalid.
- steps 23-33 are illustrated by taking CA-B to revoke the certificate of NE B, and then NE A requests to verify the revoked NE certificate as an example.
- CA-A can also revoke the certificate of NE A.
- CA-B may not revoke the certificate of network element B, which will not be repeated here.
- the management device can maintain the CA certificate mapping relationship and the network element certificate mapping relationship in a blockchain manner, and query the latest certificate status information and CA public key based on the maintained mapping relationship.
- Embodiment 2 is a diagrammatic representation of Embodiment 1:
- Step 11 Network element A generates its own public key and private key locally, and sends the public key to CA-A to request CA-A to issue a certificate for network element A.
- Step 12 CA-A generates a certificate of network element A according to the public key of network element A, and sends the generated certificate and CA-A certificate ID to network element A.
- the network element A certificate may include the information shown in Table 6A.
- network element B executes steps 13-14 to obtain the certificate of network element B from CA-B.
- Step 13 Network element B generates its own public key and private key locally, and sends the public key to CA-B to request CA-B to issue a certificate for network element B.
- the network element B book may include information as shown in Table 6B.
- Step 14 CA-B generates a certificate of network element B according to the public key of network element B, and sends the generated certificate and CA-B certificate ID to network element B.
- the network element B certificate may include the information shown in Table 6B.
- Step 15 The CA-B triggers the revocation of the certificate of the network element B, and the CA-B sends the certificate ID of the network element B, the certificate status information and the scope of application of the certificate of the network element B to the NRF.
- the certificate status information indicates the CA-B certificate's revocation reason value. It should be noted that at this time, taking the CA-B triggering the revocation of the certificate of network element B as an example, in actual situations, any CA can revoke the certificate of the network element under its jurisdiction.
- step 2 in Embodiment 1 Similarly, reference may be made here to the relevant description of step 2 in Embodiment 1, and the following only takes the application scope of the certificate of the network element B carried by the CA-B as an example for description.
- Step 16 The NRF determines the corresponding blockchain identifier according to the scope of application of the certificate of network element B, which is denoted as the identifier of blockchain B here. NRF publishes the certificate ID and certificate status information of network element B to the blockchain network corresponding to the blockchain ID. NRF publishes the certificate ID and certificate status information of network element B to the blockchain network.
- the blockchain when the blockchain network maintains only one blockchain, the blockchain is blockchain B, and the certificate ID and certificate status information of network element B are broadcast to the blockchain network in the form of block transactions.
- the block transaction includes network element B certificate ID and certificate status information.
- the identification information of the blockchain may be the identification information of the blockchain network.
- the network element B certificate ID, certificate status information and blockchain identification are broadcast to the blockchain network in the form of block transactions
- the block transactions include Meta B certificate ID, certificate status information, and blockchain identity.
- the certificate ID and certificate status information of network element B are broadcast to the blockchain network in the form of a block transaction
- the block transaction includes the certificate ID and certificate status of network element B. information, in addition, the NRF simultaneously broadcasts the blockchain identity.
- the nodes in the blockchain network After receiving the block transaction, the nodes in the blockchain network use the consensus algorithm to form a new block, and the new block contains the block transaction, the new block ID and the blockchain ID.
- the node that generates the new block the fastest broadcasts the new block to the blockchain network in the form of a broadcast message, and the remaining nodes receive the broadcast message and use the consensus algorithm to verify that the new block is valid and then store it.
- the block and the corresponding block chain are updated to stop generating a new block according to the block transaction, wherein the new block is identified as the block B1 identification and the blockchain identification is the blockchain B identification.
- the block transaction can be identified by a block transaction identifier and/or a block transaction hash value identifier.
- Step 17 The NRF receives the broadcast information, and stores the network element certificate mapping relationship of the network element B.
- the NRF receiving step 16 includes the broadcast message of block B1, and the broadcast message indicates the correspondence between the block chain identifier, the block identifier and the certificate ID of the network element B, wherein the block chain identifier is the identifier of the block chain B , the block identifier is the identifier of block B1.
- the NRF can determine the corresponding relationship as shown in Table 9, which is recorded as the network element certificate mapping relationship of the network element B maintained by the NRF after the certificate of the network element B is revoked. NRF saves block B1 and updates block B1 to the end of blockchain B as the last block of blockchain B. The NRF can determine the above-mentioned mapping relationship according to the block B1, and the NRF stores the above-mentioned mapping relationship.
- step 15 the CA-B sends the network element B certificate ID, certificate status information, the applicable scope of the network element B certificate and the CA-B certificate ID to the NRF.
- the certificate status information indicates the CA-B certificate's revocation reason value.
- step 16 the NRF publishes the network element B certificate ID, certificate status information and CA-B certificate ID to the blockchain network, then in step 17, the NRF can determine the corresponding relationship as shown in Table 10.
- Step 18 NRF sends an uplink confirmation message to CA-B.
- the on-chain confirmation message is used to indicate that the certificate status information of the certificate of the network element B has been published to the blockchain network.
- Step 19 The network element A and the network element B initiate a connection request, in which the local certificate is exchanged with each other, which is used to identify the local identity and the ownership of the public key held.
- the network element also needs to send the CA certificate ID obtained when obtaining its own certificate to the peer.
- network element A obtains the certificate of network element A and the CA-A certificate ID in step 12.
- NE A When initiating a connection request with NE B, NE A needs to send NE A's certificate and CA-A certificate ID to NE B; NE B obtains NE B's certificate in step 14, and the CA-A certificate ID is B certificate ID, then when network element A and network element B initiate a connection request, network element B needs to send network element B's certificate and CA-B certificate ID to network element A together.
- Step 20 After network element A obtains the certificate of network element B, network element A sends the certificate of network element B and the ID of the CA-B certificate to the NRF, or network element A sends the certificate of network element B and the ID of the CA-B certificate to the NRF. To request the NRF to verify whether the certificate of network element B is revoked and to verify whether the digital signature of the certificate of network element B is valid.
- Step 21 The NRF searches the CA certificate mapping relationship of the CA-B certificate (as shown in Table 5) according to the CA-B certificate ID to obtain the public key of CA-B. Specifically, NRF looks up Table 5 according to the CA-B certificate ID, and obtains the blockchain identification and block identification (respectively, the identification of blockchain A and the identification of block A2). The identity of block A2 is obtained from block A2 from block chain A, and the certificate of CA-B is queried in block A2 through the ID of CA-B certificate, and the certificate of CA-B includes the public key of CA-B. nRF.
- Step 22 The NRF sends the CA-B public key to the network element A.
- NE A verifies the validity of the digital signature of the NE B certificate.
- the NRF verifies whether the digital signature of the certificate of the network element B is valid, and the NRF sends the certificate status information found in step 24 and the result of whether the digital signature of the certificate of the network element B is valid to the network element A.
- Step 23 The NRF searches the network element certificate mapping relationship of network element B (eg, Table 9 or Table 10) according to the network element B certificate ID in the network element B certificate to obtain certificate status information.
- network element B eg, Table 9 or Table
- the NRF searches the network element certificate mapping relationship according to the certificate ID of network element B to obtain the blockchain identifier and block identifier (respectively the identifier and block identifier of blockchain B). ID of B1), obtain block B1 from blockchain B through the obtained ID of blockchain B and ID of block B1, and query and obtain network element B through the ID of the certificate of network element B in this block B3
- the certificate status information corresponding to the certificate is a part of the certificate.
- the NRF determines that the certificate status information indicates the revocation reason value of the certificate of network element B, for example, the private key of network element B has been leaked, or network element B is a malicious user, etc., There is no limitation here.
- the NRF determines that the certificate status information of the certificate of network element B indicates that the certificate of network element B is revoked, then the NRF may not perform the acquisition of the CA-B public key, and thus does not need to verify the certificate of network element B. Digital signature validity.
- Step 24 The NRF sends the certificate status information to the network element A.
- Step 25 The network element A determines that the certificate of the network element B is revoked according to the certificate status information returned by the NRF, stops the connection establishment process with the network element B, and disconnects the connection.
- the network element A continues the subsequent connection establishment process.
- network element A learns that the digital signature of the certificate of network element B is valid, it can be informed by the NRF, or it can use the CA-B public key locally to verify the digital signature of the certificate of network element B.
- network element B also verifies the certificate sent by network element A. Since CA-A has not revoked the certificate of network element A, the NRF query table 9 or table 10 cannot obtain the identification of network element A, and thus the certificate of network element A cannot be obtained. Corresponding certificate status information. In this case, the NRF determines by default that the certificate of network element A has not been revoked.
- steps 20-24 can be executed during the connection establishment between network element A and network element B. If the certificate is revoked or the digital signature of the certificate is invalid, the connection establishment will be stopped, or it may be executed after the connection is established. The connection is torn down if the digital signature of the revoked or invalid certificate is invalid.
- steps 15-24 are illustrated by taking CA-B to revoke the certificate of network element B, and subsequent request of network element A to verify the certificate of the revoked network element. , CA-B may not revoke the certificate of network element B, which will not be repeated here.
- the management device can maintain the CA certificate mapping relationship and the certificate mapping relationship of the revoked network element through the block chain, and query the latest certificate status information and CA public key based on the maintained mapping relationship.
- the signaling overhead required for the certificate chaining of the network elements that have not been revoked can be saved.
- NRF maintaining only one blockchain for example, blockchain A
- blockchain A for example, blockchain A
- Step 1 CA-A generates a self-signed certificate.
- CA-A independently generates a private key and a corresponding public key, and generates its own certificate, and the CA-A certificate is self-signed using CA-A's private key.
- the CA-A certificate may include the content in Table 2.
- Step 2 CA-A sends CA-A certificate to NRF.
- the NRF may be responsible for the maintenance of a single blockchain for multiple usage scenarios, ie the NRF maintains only one blockchain.
- NRF maintains the blockchain for scenarios such as TLS communication and IPSec communication at the same time, but the certificates corresponding to these scenarios are maintained on a blockchain, that is, the certificates and/or certificate identifiers for different usage scenarios (such as TLS certificates or IPSec certificates) certificates) can be maintained on the same blockchain.
- the NRF is selected by the CA-A according to the certificate scope of the CA-A certificate.
- the NRF may be responsible for the maintenance of a single blockchain for a single specific scenario, that is, the NRF maintains only one blockchain, and the first CA selects the NRF according to the scope of application of the certificate.
- NRF specializes in serving the blockchain for TLS communication scenarios. All certificates corresponding to TLS scenarios are maintained on a blockchain. When the CA uploads the network element certificate to the chain, the certificate is used in the TLS scenario. NRF for TLS communication scenarios.
- Step 3 NRF publishes the CA-A certificate to the blockchain network.
- the CA-A certificate is broadcast to the blockchain network in the form of a block transaction that includes the CA-A certificate.
- the nodes in the blockchain network use the consensus algorithm to form a new block, and the new block contains the block transaction and the new block identifier.
- the node that generates the new block the fastest broadcasts the new block to the blockchain network in the form of a broadcast message, and the remaining nodes receive the broadcast message and use the consensus algorithm to verify that the new block is valid and then store it.
- the block update the corresponding block chain and stop generating a new block according to the block transaction, wherein the new block is identified as the identification of the block A1.
- the block transaction can be identified by a block transaction identifier and/or a block transaction hash value identifier.
- Step 4 The NRF receives the broadcast message and saves the CA certificate mapping relationship of the CA-A certificate.
- the NRF receiving step 3 includes the broadcast message of block A1, and the broadcast message indicates the corresponding relationship between the block identifier and the ID of the CA-A certificate, wherein the block identifier is the identifier of block A1. Therefore, the NRF can determine the corresponding relationship as shown in Table 11, which is denoted as the CA certificate mapping relationship of the CA-A certificate. NRF saves block A1 and updates block A1 to the end of block chain A. The NRF can determine the above-mentioned mapping relationship according to block A1, and the NRF stores the above-mentioned mapping relationship.
- the corresponding relationship between the block identifier and the ID of the CA-A certificate may correspond to the above-mentioned second mapping relationship.
- Step 5 NRF sends a certificate on-chain confirmation message to CA-A.
- This on-chain confirmation message is used to indicate that CA-A's certificate has been published to the blockchain network.
- CA-B and NRF perform steps 6-10 similar to steps 1-5. It can be understood that, the embodiment of the present application does not limit the sequence of steps 1-5 and steps 6-10.
- Step 6 CA-B independently generates the private key and the corresponding public key, and generates its own certificate.
- the CA-B certificate uses CA-B's private key to self-sign.
- Step 7 CA-B sends CA-B certificate to NRF.
- Step 8 The NRF publishes the CA-B certificate to the blockchain network.
- the CA-B certificate is broadcast to the blockchain network in the form of a block transaction that includes the CA-B certificate.
- the nodes in the blockchain network use the consensus algorithm to form a new block, and the new block contains the block transaction and the new block identifier.
- the node that generates the new block the fastest broadcasts the new block to the blockchain network in the form of a broadcast message, and the remaining nodes receive the broadcast message and use the consensus algorithm to verify that the new block is valid and then store it.
- the block update the corresponding block chain and stop generating a new block according to the block transaction, wherein the new block is identified as the identification of the block A2.
- the block transaction can be identified by a block transaction identifier and/or a block transaction hash value identifier.
- Step 9 The NRF receives the broadcast message and saves the CA certificate mapping relationship of the CA-B certificate.
- the NRF receiving step 8 includes the broadcast message of the block A2, and the broadcast message includes the corresponding relationship between the block identifier and the ID of the CA-B certificate, wherein the block identifier is the identifier of the block A2. Therefore, the NRF can determine the corresponding relationship as shown in Table 12, which is denoted as the CA certificate mapping relationship of the CA-B certificate. NRF saves block A2 and updates block A2 to the end of blockchain A. The NRF can determine the above-mentioned mapping relationship according to block A2, and the NRF stores the above-mentioned mapping relationship.
- the block A2 and the block A1 may be the same block or different blocks.
- nodes in the blockchain network can use consensus algorithms to form new blocks for all block transactions received within a period of time, when both CA-B certificates and CA-A certificates are published to the district within this period of time.
- block A2 and block A1 can be the same block, otherwise block A2 and block A1 are different blocks.
- Step 10 NRF sends an uplink confirmation message to CA-B.
- This on-chain confirmation message is used to indicate that CA-B's certificate has been published to the blockchain network.
- Step 11 Network element A generates its own public key and private key locally, and sends the public key to CA-A to request CA-A to issue a certificate for network element A.
- Step 12 CA-A generates a certificate according to the public key of network element A, and sends the certificate to network element A.
- the network element A certificate may include the information shown in Table 6A.
- network element B executes steps 13-14 to obtain the certificate of network element B from CA-B.
- Step 13 Network element B generates its own public key and private key locally, and sends the public key to CA-B to request CA-B to issue a certificate for network element B.
- the network element B certificate may include the information shown in Table 6B.
- Step 14 CA-B generates a certificate according to the public key of network element B, and sends the certificate to network element B.
- Step 15 CA-A will send the certificate of network element A, the certificate status information of the certificate of network element A, and the certificate ID of CA-A to the NRF.
- the certificate status information of the NE A certificate indicates that the NE A certificate has not been revoked, or that the NE A certificate is valid.
- the CA-A may also send the identification of the network element A certificate (the ID of the network element A certificate) instead of the network element A certificate to the NRF in the process of this step.
- Step 16 The NRF publishes the network element A certificate and the certificate status information of the network element A certificate to the blockchain network.
- the NE A certificate and the certificate status information of the NE A certificate are broadcast to the blockchain network in the form of a block transaction, and the block transaction includes the NE A certificate and the certificate status information of the NE A certificate.
- the nodes in the blockchain network use the consensus algorithm to form a new block, and the new block contains the block transaction and the new block identifier.
- the node that generates the new block the fastest broadcasts the new block to the blockchain network in the form of a broadcast message.
- the other nodes After the other nodes receive the broadcast message, they use the consensus algorithm to verify that the new block is valid and store it.
- the block and the corresponding block chain are updated, and the generation of a new block according to the block transaction is stopped, wherein the new block is identified as the identification of the block B1.
- the block transaction can be identified by a block transaction identifier and/or a block transaction hash value identifier.
- the NRF may also publish the identity of the network element A certificate (the network element A certificate ID) instead of the network element A certificate to the blockchain network in the above process of this step.
- the block transaction and the new block B1 include the identity of the network element A certificate, but not the network element A certificate.
- Step 17 The NRF receives the broadcast information, and stores the network element certificate mapping relationship of the network element A.
- the NRF receiving step 16 includes the broadcast message of block B1, the broadcast message indicates the corresponding relationship between the block identifier, the CA-A certificate ID and the network element A certificate ID, wherein the block identifier is the identifier of the block B1.
- the broadcast message indicates the correspondence between the block identifier, the CA-A certificate ID, the network element A certificate ID, and the certificate status information of the network element A certificate, wherein the block identifier is the identifier of the block B1.
- the corresponding relationship indicated by the above broadcast message corresponds to the first mapping relationship and the third mapping relationship shown in the above example 1, as shown in Table 13A.
- NRF saves block B1 and updates block B1 to the end of block chain A.
- the NRF can determine the above-mentioned mapping relationship according to the block B1, and the NRF stores the above-mentioned mapping relationship.
- Step 18 The NRF sends an on-chain confirmation message to CA-A, where the on-chain confirmation message is used to indicate that the certificate status information of the certificate of network element A has been published to the blockchain network.
- CA-B and NRF perform similar steps 19-22 to publish the certificate of network element B or the identity of the certificate of network element B to the blockchain network.
- the NRF receives a broadcast message, the broadcast message indicates the block identifier, the corresponding relationship between the CA-B certificate ID and the network element B certificate ID, or the broadcast message indicates the block identifier, the CA-B certificate ID, the network element B certificate ID and The corresponding relationship of the certificate status information of the certificate of network element B is shown in Table 13B.
- the block identifier is the identifier of block B2.
- NRF saves block B2 and updates block B2 to the end of blockchain A.
- the NRF can determine the above-mentioned mapping relationship according to the block B2, and the NRF stores the above-mentioned mapping relationship.
- the block B2 and the block B1 can be the same block or different blocks.
- a node in a blockchain network can use a consensus algorithm to form a new block for all block transactions received within a period of time.
- block B1 and block B2 can be the same block, otherwise block B1 and block B2 are different blocks.
- Step 23 The CA-B triggers the revocation of the certificate of the network element B, and the CA-B sends the certificate ID of the network element B and the certificate status information to the NRF.
- the certificate status information indicates the CA-B certificate's revocation reason value.
- Step 24 The NRF publishes the network element B certificate ID and certificate status information to the blockchain network.
- the certificate ID and certificate status information of network element B are broadcast to the blockchain network in the form of a block transaction, and the block transaction includes the certificate ID and certificate status information of network element B.
- the nodes in the blockchain network use the consensus algorithm to form a new block, and the new block contains the block transaction and the new block identification information.
- the node that generates the new block the fastest broadcasts the new block to the blockchain network in the form of a broadcast message.
- the other nodes After the other nodes receive the broadcast message, they use the consensus algorithm to verify that the new block is valid and store it.
- This block update the corresponding blockchain and stop generating a new block according to the block transaction, where the new block is identified as the identification of block B3.
- the block transaction can be identified by a block transaction identifier and/or a block transaction hash value identifier.
- Step 25 The NRF receives the broadcast information, and saves the updated mapping relationship of the network element certificate of the network element B.
- the NRF receiving step 24 includes the broadcast message of the block B3, the broadcast message indicates the block identifier, the corresponding relationship between the CA-B certificate ID and the network element B certificate ID, or the broadcast message indicates the block identifier, the CA-B certificate ID , the corresponding relationship between the certificate ID of the network element B and the certificate status information of the certificate of the network element B, wherein the block identifier is the identifier of the block B3.
- the corresponding relationship indicated by the above broadcast message corresponds to the updated first mapping relationship and the third mapping relationship shown in the above example 1, wherein the third mapping relationship is not updated, as shown in Table 14.
- NRF saves block B3 and updates block B3 to the end of blockchain A.
- the NRF can determine the above-mentioned mapping relationship according to block B3, and the NRF stores the above-mentioned mapping relationship.
- Step 26 The NRF sends a network element certificate on-chain confirmation message to CA-B.
- the on-chain confirmation message is used to indicate that the certificate status information of the certificate of the network element B has been published to the blockchain network.
- Step 27 The network element A and the network element B initiate a connection request, in which the local certificate is exchanged with each other, which is used to identify the local identity and the ownership of the public key held.
- Step 28 After network element A obtains the certificate of network element B, network element A sends the certificate of network element B to the NRF to request the NRF to verify whether the certificate of network element B is revoked and to verify whether the digital signature of the certificate of network element B is valid.
- Step 29 The NRF searches the updated network element certificate mapping relationship of network element B (as shown in Table 14) according to the network element B certificate ID in the network element B certificate to obtain certificate status information.
- the NRF searches the network element certificate mapping relationship according to the certificate ID of network element B to obtain the block identifier (the identifier of block B3).
- the block B3 is obtained in the blockchain A, and the certificate status information of the certificate of the network element B is queried and obtained in the block B3 through the certificate ID of the network element B.
- the NRF determines that the certificate status information indicates that the certificate of network element B has been revoked and the revocation reason value of the certificate of network element B, such as the private key of network element B has been leaked, or the value of network element B Malicious users, etc., are not limited here.
- Step 30 The NRF searches the updated NE B certificate mapping relationship (as shown in Table 14) according to the NE B certificate ID in the NE B certificate to obtain the CA certificate ID, that is, the CA-B certificate ID, and uses this as an index Find the CA certificate mapping relationship of the CA-B certificate (as shown in Table 12) to obtain the public key of CA-B.
- NRF uses the CA-B certificate ID as an index to look up the CA certificate mapping relationship (as shown in Table 12) to obtain the block identifier (the identifier of block A2), and obtains the block from blockchain A through the acquired identifier of block A2 Block A2, and query CA-B's certificate through CA-B certificate ID in block A2, CA-B's certificate includes CA-B's public key.
- the management device can maintain the CA certificate mapping relationship and the network element certificate mapping relationship in a blockchain manner, and query the latest certificate status information and CA public key based on the maintained mapping relationship.
- Embodiment 4 is a diagrammatic representation of Embodiment 4:
- step 1 and step 10 reference may be made to the relevant descriptions of the above-mentioned Embodiment 1, and repeated descriptions will not be repeated.
- Step 11 Network element A generates its own public key and private key locally, and sends the public key to CA-A to request CA-A to issue a certificate for network element A.
- Step 12 CA-A generates a certificate according to the public key of network element A, and sends the certificate to network element A.
- the network element A certificate may include the information shown in Table 15A. Compared with the information shown in Table 6, the CA certificate ID, that is, the CA-A certificate ID, is newly added in Table 15A.
- network element B executes steps 13-14 to obtain the certificate of network element B from CA-B.
- Step 13 Network element B generates its own public key and private key locally, and sends the public key to CA-B to request CA-B to issue a certificate for network element B.
- Step 14 CA-B generates a certificate according to the public key of network element B, and sends the certificate to network element B.
- CA-B is a certificate generated by network element B, and the CA certificate ID, that is, the CA-B certificate ID, is also added, as shown in Table 15B.
- Step 15 The CA-A sends the network element A certificate, the certificate status information of the network element A certificate, and the scope of application of the network element A certificate to the NRF.
- the certificate status information of the NE A certificate indicates that the NE A certificate has not been revoked, or that the NE A certificate is valid.
- step 2 in the first embodiment, and the following only takes the applicable scope of the certificate of the network element A carried by the CA-A as an example for description.
- NRF can query the CA certificate mapping relationship (as shown in Table 3) according to the ID of the CA-A certificate to obtain the blockchain ID and block ID (respectively, the ID of blockchain A and the ID of block A1). ), obtain the block A1 from the block chain A through the obtained identification of the block chain A and the block A1, and obtain the public key of CA-A.
- the CA-A public key is used to verify whether the digital signature in the certificate of network element A is valid. After confirming that the digital signature in the certificate of network element A is valid, continue to perform the following steps.
- Step 16 NRF selects the corresponding blockchain identifier according to the scope of application of the certificate of network element A, which is recorded as the identifier of blockchain B.
- the NRF publishes the NE A certificate and the certificate status information of the NE A certificate to the blockchain network corresponding to the blockchain ID.
- the NE A certificate, the certificate status information of the NE A certificate, and the blockchain identity are broadcast to the blockchain network in the form of a block transaction, which includes the NE A certificate, the certificate status information of the NE A certificate, and Blockchain logo.
- the nodes in the blockchain network use the consensus algorithm to form a new block, and the new block contains the block transaction, the new block ID and the blockchain ID.
- the node that generates the new block the fastest broadcasts the new block to the blockchain network in the form of a broadcast message, and the remaining nodes receive the broadcast message and use the consensus algorithm to verify that the new block is valid and then store it.
- the block and the corresponding block chain are updated, and the generation of a new block according to the block transaction is stopped, wherein the new block is identified as the block B1 identification and the blockchain identification is the blockchain B identification.
- the block transaction can be identified by a block transaction identifier and/or a block transaction hash value identifier.
- blockchain B is different from blockchain A.
- Step 17 The NRF receives the broadcast information, and saves the updated mapping relationship of the network element certificate of the network element A.
- the NRF receiving step 16 includes the broadcast message of block B1, the broadcast message indicates the corresponding relationship between the block chain identifier, the block identifier and the certificate ID of the network element A, wherein the block chain identifier is the identifier of the block chain B, and the block chain identifier is the identifier of the block chain B.
- the identification is the identification of the block B1.
- the broadcast message indicates the corresponding relationship between the blockchain ID, the block ID, the ID of the NE A certificate, and the certificate status information of the NE A certificate, where the blockchain ID is the ID of the blockchain B, and the block ID is the ID of the blockchain B. is the identifier of block B1.
- the corresponding relationship indicated by the above broadcast message corresponds to the first mapping relationship and the third mapping relationship shown in the above example 1, as shown in Table 16A.
- NRF saves block B1 and updates block B1 to the end of blockchain B.
- the NRF can determine the above-mentioned mapping relationship according to the block B1, and the NRF stores the above-mentioned mapping relationship.
- Step 18 The NRF sends an on-chain confirmation message to CA-A, where the on-chain confirmation message is used to indicate that the certificate status information of the certificate of network element A has been published to the blockchain network.
- CA-B and NRF perform similar steps 19-22 to publish the certificate of network element B to the blockchain network.
- the NRF receives a broadcast message, and the broadcast message refers to the corresponding relationship between the block chain identifier, block identifier, CA-B certificate ID, and network element B certificate ID, or the broadcast message indicates the block chain identifier, block identifier, CA-B certificate ID
- NRF saves block B2 and updates block B2 to the end of blockchain B.
- the NRF can determine the above-mentioned mapping relationship according to block B2, and the NRF stores the above-mentioned mapping relationship, as shown in Table 16B.
- the block B2 and the block B1 can be the same block or different blocks.
- the nodes in the blockchain network can use the consensus algorithm to form new blocks of all block transactions received within a period of time, when both the network element A certificate and the network element B certificate are published to the district within the period of time.
- block B1 and block B2 can be the same block, otherwise block B1 and block B2 are different blocks.
- Step 23 The CA-B triggers the revocation of the certificate of the network element B, and the CA-B sends the certificate of the network element B and the certificate status information to the NRF.
- the certificate status information indicates the CA-B certificate's revocation reason value.
- the network element B certificate includes the network element B certificate ID information.
- Step 24 The NRF searches the network element certificate mapping relationship according to the network element B certificate ID in the network element B certificate to obtain the blockchain identifier (the identifier of the blockchain B), and publishes the network element B certificate and certificate status information to the blockchain Identifies the corresponding blockchain network.
- the network element B certificate and certificate status information are broadcast to the blockchain network in the form of a block transaction, and the block transaction includes the network element B certificate and certificate status. information.
- the network element B certificate, certificate status information, and blockchain identification are broadcast to the blockchain network in the form of block transactions that include network elements.
- the NE B certificate and certificate status information are broadcast to the blockchain network in the form of a block transaction, and the block transaction includes the NE B certificate and certificate status information.
- the NRF broadcasts the blockchain identification at the same time.
- the nodes in the blockchain network After receiving the block transaction, the nodes in the blockchain network use the consensus algorithm to form a new block, and the new block contains the block transaction, the new block identification information and the blockchain identification information.
- the node that generates the new block the fastest broadcasts the new block to the blockchain network in the form of a broadcast message, and the remaining nodes receive the broadcast message and use the consensus algorithm to verify that the new block is valid and then store it.
- the block and the corresponding blockchain are updated to stop generating a new block according to the block transaction, wherein the new block is identified as the identification of block B3 and the blockchain identification is the identification of blockchain B.
- the block transaction can be identified by a block transaction identifier and/or a block transaction hash value identifier.
- Step 25 The NRF receives the broadcast information, and saves the updated mapping relationship of the network element certificate of the network element B.
- the NRF receiving step 24 includes the broadcast message of block B3, the broadcast message indicates the corresponding relationship between the block chain identifier, the block identifier, and the network element B certificate ID, or the broadcast message indicates the block chain identifier, block identifier, network
- the corresponding relationship indicated by the above broadcast message corresponds to the updated first mapping relationship and the third mapping relationship shown in the above example 1, wherein the third mapping relationship is not updated, as shown in Table 17.
- NRF saves block B3 and updates block B3 to the end of blockchain B.
- the NRF can determine the above-mentioned mapping relationship according to block B3, and the NRF stores the above-mentioned mapping relationship.
- Step 26 NRF sends an uplink confirmation message to CA-B.
- the on-chain confirmation message is used to indicate that the certificate status information of the certificate of the network element B has been published to the blockchain network.
- Step 27 The network element A and the network element B initiate a connection request, in which the local certificate is exchanged with each other, which is used to identify the local identity and the ownership of the public key held.
- network element A may include but not be limited to the following two implementations:
- the first implementation implements the following steps 28a to 30a
- the second implementation implements the following steps 28b to 30b.
- the first implementation method :
- Step 28a After network element A obtains the certificate of network element B, network element A sends the certificate of network element B to the NRF to request the NRF to verify whether the certificate of network element B is revoked and to verify whether the digital signature of the certificate of network element B is valid.
- Step 29a The NRF searches the updated network element certificate mapping relationship of network element B (see Table 17) according to the network element B certificate ID in the network element B certificate to obtain certificate status information.
- the NRF searches the network element certificate mapping relationship according to the certificate ID of network element B to obtain the blockchain identifier and block identifier (respectively the identifier and block identifier of blockchain B). ID of B3), obtain block B3 from blockchain B by obtaining the ID of blockchain B and the ID of block B3, and query the ID of the certificate of network element B through the ID of the certificate of network element B in this block B3 Certificate status information.
- the NRF determines that the certificate status information indicates that the certificate of network element B has been revoked and the revocation reason value of the certificate of network element B, such as the private key of network element B has been leaked, or the value of network element B Malicious users, etc., are not limited here.
- Step 30a The NRF obtains the public key of CA-B according to the CA certificate ID in the certificate of network element B, that is, the CA-B certificate ID, and uses this as an index to find the CA certificate mapping relationship of the CA-B certificate (as shown in Table 5).
- NRF uses the CA-B certificate ID as the index to find the CA certificate mapping relationship of the CA-B certificate (as shown in Table 5) to obtain the blockchain ID and block ID (respectively, the ID of blockchain A and the ID of block A2), Obtain block A2 from block chain A through the obtained identification of block chain A and block A2, and query CA-B's certificate and CA-B's certificate in block A2 through CA-B certificate ID Include the public key of CA-B.
- Step 28b After network element A obtains the certificate of network element B, network element A sends the certificate ID of network element B to the NRF to request the NRF to verify whether the certificate of network element B is revoked and to verify whether the digital signature of the certificate of network element B is valid.
- Step 29b The NRF searches the updated network element certificate mapping relationship of network element B (as shown in Table 17) according to the certificate ID of network element B to obtain certificate status information.
- the NRF searches the network element certificate mapping relationship according to the certificate ID of network element B to obtain the blockchain identifier and block identifier (respectively the identifier and block identifier of blockchain B). ID of B3), obtain block B3 from blockchain B by obtaining the ID of blockchain B and the ID of block B3, and query the ID of the certificate of network element B through the ID of the certificate of network element B in this block B3 Certificate status information.
- the NRF determines that the certificate status information indicates that the certificate of network element B has been revoked and the revocation reason value of the certificate of network element B, such as the private key of network element B has been leaked, or the value of network element B Malicious users, etc., are not limited here.
- Step 30b The NRF searches the updated network element certificate mapping relationship of network element B (as shown in Table 17) according to the certificate ID of network element B, and obtains the block chain identifier and block identifier (respectively the identifier of block chain B and block B3). ID), obtain the block B3 from the blockchain B by obtaining the ID of the blockchain B and the ID of the block B3, and query the certificate of the network element B through the certificate ID of the network element B in the block B3.
- the CA certificate ID in the certificate of network element B that is, the CA-B certificate ID
- NRF uses this as an index to find the CA certificate mapping relationship (as shown in Table 5) to obtain the blockchain ID and block ID (respectively the ID of blockchain A).
- ID and the ID of block A2) obtain block A2 from blockchain A through the obtained ID of blockchain A and ID of block A2, and query CA- B's certificate, CA-B's certificate includes CA-B's public key.
- step 31 to step 33 reference may be made to the relevant content of Embodiment 1, and repeated descriptions will not be repeated.
- the management device can maintain the CA certificate mapping relationship and the network element certificate mapping relationship in a blockchain manner, and query the latest certificate status information based on the maintained network element certificate mapping relationship. Since the certificate of the network element is newly added with the certificate of the CA that issued the certificate, the management device obtains the identifier of the CA certificate through the certificate of the network element, and queries the CA public key based on the maintained CA certificate mapping relationship.
- the embodiments of the present application further provide an apparatus for implementing the above methods.
- the apparatus may include hardware structures and/or software modules, and implement the above functions in the form of hardware structures, software modules, or hardware structures plus software modules. Whether one of the above functions is performed in the form of a hardware structure, a software module, or a hardware structure plus a software module depends on the specific application and design constraints of the technical solution.
- the apparatus provided in this embodiment of the present application may be a chip or circuit capable of performing functions corresponding to the above method, and the chip or circuit may be provided in a device such as a processor. Further, the apparatuses provided in the embodiments of the present application can also be implemented in hardware or a combination of hardware and computer software. Whether a function is performed by hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Experts may use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of the embodiments of the present application.
- the apparatus provided in this embodiment of the present application may divide functional modules, for example, each functional module may be divided into each function, or two or more functions may be integrated into one processing module.
- the above-mentioned integrated modules can be implemented in the form of hardware, or can be implemented in the form of software function modules. It should be noted that, the division of modules in the embodiments of the present application is schematic, and is only a logical function division, and there may be other division manners in actual implementation.
- FIG. 8 a schematic structural diagram of a certificate query apparatus is provided in an embodiment of the present application.
- the apparatus may be a processor or an apparatus within a processor.
- the apparatus 800 may include: a processing module 81 and a communication module 82 .
- the apparatus 800 may also include other modules, which are not limited in the embodiments of the present application, and only main functional modules are shown.
- the communication module 82 is configured to receive first information from the second device, where the first information includes an identifier of the certificate of the first device, and the processing module 81 is configured to use the identifier of the certificate of the first device and the first mapping relationship Determine the certificate status information of the certificate of the first device, and the communication module 82 is configured to send the certificate status information to the second device.
- the first mapping relationship indicates a correspondence between an identifier of the certificate of the first device and the certificate status information, where the certificate status information is used to indicate whether the certificate of the first device is revoked.
- the processing module 81 in this embodiment of the present application may be implemented by a processor or a processor-related circuit component
- the communication module 82 may be implemented by a communication interface or a communication interface-related circuit component or a communication interface.
- the communication interface may include, for example, a transmitter and a receiver, the processor, the transmitter and the receiver being coupled to each other, wherein the transmitter and receiver are implemented, for example, by an antenna, feeder, codec, etc., or, if the device For a chip provided in the device, the transmitter and the receiver are, for example, communication interfaces in the chip, and the communication interface is connected to the radio frequency transceiver component in the device to realize information transmission and reception through the radio frequency transceiver component.
- FIG. 9 the apparatus 900 provided by the embodiment of the present application is shown, and the apparatus shown in FIG. 9 may be a hardware circuit implementation of the apparatus shown in FIG. 8 .
- the apparatus can be used to perform the functions of the management device in the flowchart shown in FIG. 3 .
- FIG. 9 shows only the main components of the device.
- the apparatus shown in FIG. 9 may be a chip or circuit capable of performing functions corresponding to the foregoing method, or may be a device including the foregoing chip or circuit, which is not limited in this embodiment of the present application.
- the apparatus 900 shown in FIG. 9 includes at least one processor 920, configured to implement the function of the management device in FIG. 3 provided by the embodiment of the present application.
- the apparatus 900 may also include at least one memory 930 for storing program instructions and/or data.
- Memory 930 is coupled to processor 920 .
- the coupling in the embodiments of the present application is an indirect coupling or communication connection between devices, units or modules, which may be in electrical, mechanical or other forms, and is used for information exchange between devices, units or modules.
- Processor 920 may cooperate with memory 930 .
- Processor 920 may execute program instructions stored in memory 930 . At least one of the at least one memory may be included in the processor.
- the device 900 may also not include the memory 930, and the processor 920 may read the instructions (programs or codes) in the memory outside the chip or the circuit to realize the instructions shown in FIG. 3 .
- the functions of the management device provided by the embodiments of .
- the apparatus 900 may also include a communication interface 910 for communicating with other devices through a transmission medium, so that the apparatus used in the apparatus 900 may communicate with other devices.
- the communication interface may be a transceiver, a circuit, a bus, a module, or other types of communication interfaces.
- the transceiver may be an independent receiver, an independent transmitter, a transceiver with integrated transceiver functions, or an interface circuit.
- the processor 920 uses the communication interface 910 to send and receive data, and is used to implement the functions of the processor in the embodiment shown in FIG. 3 . For details, reference may be made to the foregoing description, which will not be repeated here.
- the apparatus 900 may also include a communication bus 940 .
- the communication interface 910, the processor 920 and the memory 930 can be connected to each other through a communication bus 940;
- the communication bus 940 can be a peripheral component interconnect (PCI for short) bus or an extended industry standard architecture (extended industry standard architecture). , referred to as EISA) bus and so on.
- PCI peripheral component interconnect
- EISA extended industry standard architecture
- the communication bus 940 can be divided into an address bus, a data bus, a control bus, and the like. For ease of presentation, only one thick line is used in FIG. 9, but it does not mean that there is only one bus or one type of bus.
- the apparatus provided in the embodiments of the present application when implemented using software, it may be implemented in whole or in part in the form of a computer program product.
- the computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are realized.
- the computer may be a general purpose computer, special purpose computer, computer network, or other programmable device.
- the computer instructions may be stored in or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions may be downloaded from a website site, computer, server or data center Transmission to another website site, computer, server, or data center by wire (eg, coaxial cable, optical fiber, digital subscriber line, DSL) or wireless (eg, infrared, wireless, microwave, etc.).
- the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that includes an integration of one or more available media.
- the usable media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVDs), or semiconductor media (eg, solid state disks (SSDs)), and the like.
- the processor included in the above-mentioned apparatus for executing the method provided by the embodiment of the present application may be a central processing unit (central processing unit, CPU), a general-purpose processor, a digital signal processor (digital signal processor, DSP), application-specific integrated circuit (ASIC), field programmable gate array (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute the various exemplary logical blocks, modules and circuits described in connection with this disclosure.
- the processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.
- the steps of the method or algorithm described in conjunction with the embodiments of the present application may be implemented in a hardware manner, or may be implemented in a manner in which a processor executes software instructions.
- Software instructions can be composed of corresponding software modules, and software modules can be stored in random access memory (RAM), flash memory, read-only memory (ROM) memory, erasable programmable read-only memory Memory (erasable programmable read-only memory, EPROM), electrically erasable programmable read-only memory (electrically erasable programmable read-only memory, EEPROM), registers, hard disks, mobile hard disks, compact disc read-only memory , CD-ROM) or any other form of storage medium known in the art.
- RAM random access memory
- ROM read-only memory
- EPROM erasable programmable read-only memory
- EEPROM electrically erasable programmable read-only memory
- registers hard disks, mobile hard disks, compact disc read-only memory , CD-ROM or any other form of
- An exemplary storage medium is coupled to the processor, such that the processor can read information from, and write information to, the storage medium.
- the storage medium can also be an integral part of the processor.
- the processor and storage medium may reside in an ASIC.
- the ASIC may be located in the radar device or in the detection equipment in which the radar device is installed.
- the processor and the storage medium may also be present as discrete components in the radar device or the detection device in which the radar device is installed.
- FIGS. 8 to 9 only show a simplified design of the device.
- the apparatus provided by the embodiments of the present application may include any number of transmitters, receivers, processors, controllers, memories, and other possible elements.
- An embodiment of the present application further provides a chip, which is connected to a memory and used to read and execute a software program stored in the memory.
- the chip realizes The function of the processor in Figure 3.
- Embodiments of the present application further provide a computer-readable storage medium, including instructions, which, when the instructions are executed on a computer, enable the computer to implement the function of the management device in FIG. 3 .
- the embodiments of the present application may be provided as a method, a system, or a computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
- computer-usable storage media including, but not limited to, disk storage, CD-ROM, optical storage, etc.
- These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions
- the apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Physics & Mathematics (AREA)
- Databases & Information Systems (AREA)
- Data Mining & Analysis (AREA)
- Computer Security & Cryptography (AREA)
- Software Systems (AREA)
- Computational Linguistics (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Computer Hardware Design (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
一种证书查询方法及装置,该方法包括:管理设备接收来自于第二设备的第一信息,第一信息包括第一设备的证书的标识。管理设备根据第一设备的证书的标识和第一映射关系确定第一设备的证书的证书状态信息,管理设备向第二设备发送证书状态信息。第一映射关系指示第一设备的证书的标识与证书状态信息的对应关系,证书状态信息用于指示第一设备的证书是否被吊销。采用上述方法,管理设备可以根据第一映射关系为第二设备查询第一设备的证书的证书状态信息,并告知第二设备查询到的证书状态信息,实现较为简便查询证书的证书状态信息。
Description
相关申请的交叉引用
本申请要求在2021年03月31日提交中国专利局、申请号为202110346361.1、申请名称为“一种证书查询方法及装置”的中国专利申请的优先权,其全部内容通过引用结合在本申请中。
本申请实施例涉及无线通信领域,尤其涉及一种证书查询方法及装置。
公钥和私钥分别用于对消息进行加密和生成数字签名。公钥可以发到网络中而私钥必须存在于持有者内部。公钥基础设施(public key infrastructure,PKI)用于实现基于公私钥的密钥和数字证书(certificate)的产生、管理、存储、分发和撤销等功能,其中,数字证书是用于数字通讯中标识一方身份和所持公钥所有权的数字认证信息。
为了便于管理证书,PKI架构可以为树状结构。如图1所示,PKI架构中的节点包括锚点根证书颁发机构(certificate authority,CA)(以下简称根CA)、多级叶CA(即图1上除根CA外的其他CA)和底层的网元。其中,根CA负责对自己(自签名证书)和下一层叶CA签发证书,下一层叶CA再对其下一层CA签发证书,以此类推,最后由最后一层叶CA对网元签发证书。
当前,在网元之间建立初始通信时,通信双方需要分别将本端证书发送给对端以验证证书是否为被吊销,并根据证书中的公钥建立安全连接。具体步骤如下,以图1中网元A1发起同网元B1的通信建立为例:
步骤1:网元A1向网元B1发送消息,该消息包括网元A1的证书和网元A1对应的证书链包括的证书。该消息用网元A1的私钥进行数字签名。
网元A1对应的证书链为:{网元A1证书,CA-A1证书,CA-A证书,根CA证书}。
步骤2:网元B1依次确认根CA证书、CA-A证书、CA-A1证书和网元A1证书是否被吊销。
具体的,网元B1可以通过查询证书吊销列表(certificate revocation list,CRL)或线证书状态协议(online certificate status protocol,OCSP)依次确认上述证书是否被吊销。其中,CRL的更新周期较长(例如约为一小时),而较长的更新周期将会导致节点查询到的证书吊销记录的时效性较差。而OCSP需要以特定节点ID作为查询索引,存在潜在的隐私问题。
发明内容
本申请实施例提供一种证书查询方法及装置,用以优化查询证书是否被吊销的查询过程。
第一方面,本申请实施例提供一种证书查询方法,该方法包括:
管理设备接收来自于第二设备的第一信息,所述第一信息包括第一设备的证书的标识,所述管理设备根据所述第一设备的证书的标识和第一映射关系确定所述第一设备的证书的证书状态信息,所述管理设备向所述第二设备发送所述证书状态信息。所述第一映射关系指示所述第一设备的证书的标识与所述证书状态信息的对应关系,所述证书状态信息用于指示所述第一设备的证书是否被吊销。
采用上述方法,管理设备可以根据第一映射关系在管理设备本地为第二设备查询第一设备的证书的证书状态信息,并告知第二设备查询到的证书状态信息。相较于现有的查询CRL的方法,第二设备不需要下载CRL且可获得最新的证书状态信息,避免了CRL时效性不佳导致无法获取最新的证书状态信息;相较于查询OCSP,不需要以特定节点ID为查询索引,避免了隐私泄露的风险。
示例性地,第一信息包括第一设备的证书的标识,或者第一信息包括第一设备的证书,其中,第一设备的证书包括第一设备的证书的标识。
在一种可能的设计中,所述证书状态信息指示所述第一设备的证书未被吊销,或者所述第一设备的证书的吊销原因值;或者所述证书状态信息指示所述第一设备的证书未被吊销,或者所述第一设备的证书被吊销和所述第一设备的证书的吊销原因值。
采用上述设计,证书状态信息可以具有多种实现方式。
在一种可能的设计中,所述第一映射关系具体指示所述第一设备的证书的标识、第一区块链的标识信息和第一区块的标识信息的对应关系,其中,所述第一区块在所述第一区块链上,所述第一区块存储所述证书状态信息。示例性地,所述管理设备根据所述第一设备的证书的标识和上述第一映射关系确定所述证书状态信息具体包括:所述管理设备根据所述第一设备的证书的标识和所述第一映射关系确定所述第一区块链的标识信息和所述第一区块的标识信息,所述管理设备根据所述第一区块链的标识信息和所述第一区块的标识信息从所述第一区块获取所述证书状态信息。
采用上述设计,第一映射关系指示证书的标识,区块链和区块标识的对应关系,通过上述对应关系,管理设备可以通过证书的标识作为索引查询第一映射关系确定存储证书状态信息的区块,从该区块中获取证书状态信息。第一映射关系依赖区块链的分布式共识和分布式账本机制,区块链网络可以由网络运营商独立运营,进而实现运营商内网查询证书状态信息,省去跨网查询步骤。
在一种可能的设计中,所述第一映射关系具体指示被吊销的证书的标识、存储所述被吊销的证书的吊销原因值的区块所在的区块链的标识信息和所述存储所述被吊销的证书的吊销原因值的区块的标识信息的对应关系。这里的第一映射关系可以理解为一个映射关系的集合。
示例性地,所述管理设备根据所述第一设备的证书的标识和上述第一映射关系确定所述证书状态信息具体包括两种情况:情况1:在所述被吊销的证书的标识不包括所述第一设备的证书的标识时,所述管理设备确定所述证书状态信息,所述证书状态信息指示所述第一证书未被吊销。情况2:在所述被吊销的证书的标识包括所述第一设备的证书的标识时,所述第一映射关系包括第四映射关系,所述第四映射关系指示所述第一设备的证书的标识、第二区块链的标识信息和第二区块的标识信息,其中,所述第二区块在所述第二区块链上,所述第二区块存储所述被吊销证书的标识和所述被吊销的证书对应的吊销原因值,所述管理设备根据所述第一设备的证书的标识和所述第四映射关系确定所述第二区块链 的标识信息和所述第二区块的标识信息,所述管理设备根据所述第二区块链的标识信息和所述第二区块的标识信息从所述第二区块获取所述第一设备的证书的吊销原因值,所述管理设备确定所述证书状态信息,所述证书状态信息指示所述第一设备的证书的吊销原因值。
采用上述设计,第一映射关系指示被吊销证书的标识,区块链和区块标识的对应关系,通过上述对应关系,管理设备可以通过证书的标识作为索引查询第一映射关系中是否存在该证书标识对应的映射关系以确定证书是否被吊销,如果第一映射关系中存在该证书标识对应的映射关系,管理设备可以进一步根据该证书标识确定存储证书状态信息的区块并从该区块中获取证书状态信息。第一映射关系依赖区块链的分布式共识和分布式账本机制,区块链网络可以由网络运营商独立运营,进而实现运营商内网查询证书状态信息,省去跨网查询步骤。
在一种可能的设计中,还包括:所述管理设备获取第一CA的公钥,所述管理设备向所述第二设备发送所述第一CA的公钥。所述第一CA是指为所述第一设备签发所述第一设备的证书的CA。
采用上述设计,管理设备还需向第二设备发送第一CA的公钥,以实现第二设备检查第一设备的证书的数字签名是否有效。
在一种可能的设计中,在所述管理设备根据所述第一设备的证书的标识和第一映射关系确定所述证书状态信息之前,所述管理设备获取第一CA的公钥,所述管理设备根据所述第一CA的公钥确定所述第一设备的证书的数字签名有效。所述第一CA是指为所述第一设备签发所述第一设备的证书的CA。
采用上述设计,管理设备在根据第一CA的公钥确定第一设备的证书的数字签名有效时,管理设备执行查询证书状态信息,以实现在管理设备确定第一设备证书数字签名无效时省去后续查询证书状态信息的步骤,节省处理资源。
在一种可能的设计中,在所述管理设备确定所述证书状态信息指示所述第一设备的证书未被吊销时,所述管理设备获取第一CA的公钥,所述第一CA是指为所述第一设备签发所述第一设备的证书的CA。所述管理设备根据所述第一CA的公钥判断所述第一设备的证书的数字签名是否有效,所述管理设备向所述第一设备发送第二信息,所述第二信息指示所述第一设备的证书的数字签名是否有效。
采用上述设计,管理设备在确定证书状态信息指示第一设备的证书未被吊销时,管理设备获取第一CA的公钥判断第一设备的证书的数字签名是否有效,并将判断结果发送至第二设备,以实现在管理设备确定第一设备证书未被吊销时再获取第一CA的公钥以验证第一设备数字证书签名有效性,只在管理设备确定第一设备证书有效时再验证第一设备数字证书签名有效性,节省处理资源。
在一种可能的设计中,所述第一信息包括所述第一CA的证书的标识。所述管理设备获取第一CA的公钥可以采用以下方法:所述管理设备根据第一CA的证书的标识和第二映射关系确定第三区块链的标识信息和第三区块的标识信息,根据所述第三区块链的标识信息和所述第三区块的标识信息从所述第三区块获取所述第一CA的公钥。所述第二映射关系指示所述第一CA的证书的标识、所述第三区块链的标识信息和所述第三区块的标识信息的对应关系,所述第三区块在所述第三区块链上,所述第三区块存储所述第一CA的证书。所述第一CA的证书包括所述第一CA的公钥。
采用上述设计,管理设备根据第二映射关系和第一CA的证书的标识确定存储第一CA 的证书的区块,并从该区块获取第一CA的公钥。通过上述方法可以实现减少CA的数量,将原有多层级的PKI架构扁平化,减少了设备投入和运维成本。区块链的分布式账本性质保证所有管理设备上均存储同样的区块链、区块和区块交易,可以实现信任锚点的功能。PKI架构中心化信任机制变为去中心化信任机制,信任锚点均锚定在区块链上,第二设备任意查询最近的运营区块链的网元(即管理设备)便可以获取与第一设备的信任关系。使用区块链简化PKI架构,将原有中心化的根信任机制,变为去中心化的信任机制,简化证书验证机制,防止因多层CA的PKI架构导致需要验证多个证书以确定是否存在共同信任锚点,和因没有共同的信任锚点导致无法验证证书的问题。
在一种可能的设计中,在所述管理设备获取第一CA的公钥之前,所述管理设备根据所述第一设备的证书的标识和第三映射关系确定所述第一CA的证书的标识;所述第三映射关系指示所述第一设备的证书的标识和所述第一CA的证书的标识的对应关系。在所述管理设备获取第一CA的证书的标识之后,所述管理设备获取第一CA的公钥可以采用以下方法:所述管理设备根据所述第一CA的证书的标识和第二映射关系确定第三区块链的标识信息和第三区块的标识信息,根据所述第三区块链的标识信息和所述第三区块的标识信息从所述第三区块获取所述第一CA的公钥。所述第二映射关系指示所述第一CA的证书的标识、所述第三区块链的标识信息和所述第三区块的标识信息的对应关系,所述第三区块在所述第三区块链上,所述第三区块存储所述第一CA的证书。所述第一CA的证书包括所述第一CA的公钥。
采用上述设计,管理设备通过第一设备的证书的标识和第三映射关系确定第一CA的证书的标识,进而确定根据第一CA的证书的标识和第二映射关系获取第一CA的公钥。
在一种可能的设计中,所述管理设备接收第一广播消息,所述第一广播消息指示所述第二映射关系。
采用上述设计,管理设备通过广播消息获取第二映射关系。
在一种可能的设计中,在所述管理设备接收第一广播消息之前,所述管理设备接收来自于所述第一CA的第三信息,所述第三信息包括所述第一CA的证书。所述管理设备确定所述第三区块链的标识信息,所述管理设备将所述第一CA的证书公布至所述第三区块链的标识信息对应的区块链网络。在所述管理设备接收第一广播消息之后,所述管理设备向所述第一CA发送第四信息,所述第四信息指示所述第一CA的证书已公布至所述第三区块链的标识信息对应的所述区块链网络。
采用上述设计,管理设备通过将第一CA的证书公布至区块链网络,实现通过区块链网络保存第一CA的证书。
在一种可能的设计中,所述第三信息还包括用于指示所述第一CA的证书的适用范围的信息,所述管理设备根据用于指示所述第一CA的证书的适用范围的信息确定所述第三区块链的标识信息。
采用上述设计,管理设备可以根据第一CA的证书的适用范围确定区块链的标识信息。
在一种可能的设计中,所述管理设备接收第二广播消息,所述第二广播消息指示所述第一映射关系。
采用上述设计,管理设备通过广播消息获取第一映射关系。
在一种可能的设计中,在所述管理设备接收第二广播消息之前,所述管理设备接收来自于所述第一CA的第五信息,所述第五信息包括所述第一设备的证书和所述证书状态信 息,所述证书状态信息指示所述第一设备的证书未被吊销。所述管理设备确定所述第一区块链的标识信息,所述管理设备将所述第一设备的证书、所述证书状态信息公布至所述第一区块链的标识信息对应的区块链网络。在所述管理设备接收第二广播消息之后,所述管理设备向所述第一CA发送第六信息,所述第六信息指示所述证书状态信息已公布至所述第一区块链的标识信息对应的区块链网络。
采用上述设计,管理设备通过将第一设备的证书和证书状态信息公布至区块链网络,实现通过区块链网络保存第一设备的证书和证书状态信息。
在一种可能的设计中,所述第五信息还包括所述第一CA的证书的标识。所述管理设备将所述第一CA的证书的标识、所述第一设备的证书、所述证书状态信息公布至所述第一区块链的标识信息对应的区块链网络,所述管理设备接收第二广播消息,所述第二广播消息还指示所述第一设备的证书的标识和所述第一CA的证书的标识的对应关系。
采用上述设计,管理设备可以同时将第一CA的证书的标识公布至区块链网络。
在一种可能的设计中,所述第五信息还包括用于指示所述第一设备的证书的适用范围的信息,所述管理设备根据用于指示所述第一设备的证书的适用范围的信息确定所述第一区块链。
采用上述设计,管理设备可以根据第一设备的证书的适用范围确定区块链的标识信息。
在一种可能的设计中,所述管理设备接收第三广播消息,所述第三广播消息指示更新后的第一映射关系,所述更新后的第一映射关系指示所述第一设备的证书的标识、所述第一区块链的标识信息和所述第四区块的标识信息的对应关系,所述第四区块在所述第一区块链上,所述第四区块存储所述第一设备的证书的标识和更新后的证书状态信息,所述更新后的证书状态信息指示所述第一设备的证书的吊销原因值。
采用上述设计,管理设备通过广播消息获取更新后的第一映射关系。
在一种可能的设计中,在所述管理设备接收第三广播消息之前,所述管理设备接收来自于所述第一CA的第七信息,所述第七信息包括所述第一设备的证书的标识和所述更新后的证书状态信息。所述管理设备根据所述第一设备的证书的标识和所述第一映射关系确定所述第一区块链的标识信息。所述管理设备将所述更新后的证书状态信息、所述第一设备的证书的标识公布至所述第一区块链的标识信息对应的所述区块链网络。在所述管理设备接收第三广播消息之后,所述管理设备向所述第一CA发送第八信息,所述第八信息指示所述更新后的证书状态信息已公布至所述第一区块链的标识信息对应的区块链网络。
采用上述设计,管理设备通过将第一设备的证书和更新后的证书状态信息公布至区块链网络,实现通过区块链网络及时更新第一映射关系。
在一种可能的设计中,所述管理设备接收第四广播消息,所述第四广播消息指示第四映射关系,所述第一映射关系包括所述第四映射关系,所述第四映射关系指示所述第一设备的证书的标识、所述第二区块链的标识信息和所述第二区块的标识信息的对应关系。
采用上述设计,管理设备通过广播消息获取第四映射关系。
在一种可能的设计中,在所述管理设备接收第四广播消息之前,所述管理设备接收来自于所述第一CA的第九信息,所述第九信息包括所述第一设备的证书的标识和所述证书状态信息,所述证书状态信息指示所述第一设备的证书的吊销原因值。所述管理设备确定所述第二区块链的标识信息,所述管理设备将所述第一设备的证书的标识、所述证书状态信息公布至所述第二区块链的标识信息对应的区块链网络。在所述管理设备接收第四广播 消息之后,所述管理设备向所述第一CA发送第十信息,所述第十信息指示所述证书状态信息已公布至所述第二区块链的标识信息对应的区块链网络。
采用上述设计,管理设备通过将第一设备的证书和证书状态信息(证书状态信息指示第一设备的证书的吊销原因值)公布至区块链网络,实现通过区块链网络保存被吊销的证书的证书状态信息。
在一种可能的设计中,所述第九信息还包括用于指示所述第一设备的证书的适用范围的信息。所述管理设备根据用于指示所述第一设备的证书的适用范围的信息确定所述第二区块链。
采用上述设计,管理设备可以根据第一设备的证书的适用范围确定区块链的标识信息。
第二方面,本申请实施例提供一种证书查询装置,该装置包括收发单元和处理单元:收发单元用于接收来自于第二设备的第一信息,所述第一信息包括第一设备的证书的标识,处理单元用于根据所述第一设备的证书的标识和第一映射关系确定所述第一设备的证书的证书状态信息,收发单元用于向所述第二设备发送所述证书状态信息。所述第一映射关系指示所述第一设备的证书的标识与所述证书状态信息的对应关系,所述证书状态信息用于指示所述第一设备的证书是否被吊销。
在一种可能的设计中,所述证书状态信息指示所述第一设备的证书未被吊销,或者所述第一设备的证书的吊销原因值;或者所述证书状态信息指示所述第一设备的证书未被吊销,或者所述第一设备的证书被吊销和所述第一设备的证书的吊销原因值。
在一种可能的设计中,所述第一映射关系具体指示所述第一设备的证书的标识、第一区块链的标识信息和第一区块的标识信息的对应关系,其中,所述第一区块在所述第一区块链上,所述第一区块存储所述证书状态信息。处理单元用于在根据所述第一设备的证书的标识和上述第一映射关系确定所述证书状态信息时,根据所述第一设备的证书的标识和所述第一映射关系确定所述第一区块链的标识信息和所述第一区块的标识信息,根据所述第一区块链的标识信息和所述第一区块的标识信息从所述第一区块获取所述证书状态信息。
在一种可能的设计中,所述第一映射关系具体指示被吊销的证书的标识、存储所述被吊销的证书的吊销原因值的区块所在的区块链的标识信息和所述存储所述被吊销的证书的吊销原因值的区块的标识信息的对应关系。这里的第一映射关系可以理解为一个映射关系的集合。处理单元用于在根据所述第一设备的证书的标识和上述第一映射关系确定所述证书状态信息时,在所述被吊销的证书的标识不包括所述第一设备的证书的标识时,确定所述证书状态信息,所述证书状态信息指示所述第一证书未被吊销;或者,在所述被吊销的证书的标识包括所述第一设备的证书的标识时,所述第一映射关系包括第四映射关系,所述第四映射关系指示所述第一设备的证书的标识、第二区块链的标识信息和第二区块的标识信息,其中,所述第二区块在所述第二区块链上,所述第二区块存储所述被吊销证书的标识和所述被吊销的证书对应的吊销原因值,根据所述第一设备的证书的标识和所述第四映射关系确定所述第二区块链的标识信息和所述第二区块的标识信息,根据所述第二区块链的标识信息和所述第二区块的标识信息从所述第二区块获取所述第一设备的证书的吊销原因值,确定所述证书状态信息,所述证书状态信息指示所述第一设备的证书的吊销原因值。
在一种可能的设计中,还包括:处理单元用于获取第一CA的公钥,向所述第二设备 发送所述第一CA的公钥。所述第一CA是指为所述第一设备签发所述第一设备的证书的CA。
在一种可能的设计中,在根据所述第一设备的证书的标识和第一映射关系确定所述证书状态信息之前,处理单元用于获取第一CA的公钥,根据所述第一CA的公钥确定所述第一设备的证书的数字签名有效。所述第一CA是指为所述第一设备签发所述第一设备的证书的CA。
在一种可能的设计中,在确定所述证书状态信息指示所述第一设备的证书未被吊销时,处理单元用于获取第一CA的公钥,根据所述第一CA的公钥判断所述第一设备的证书的数字签名是否有效,收发单元用于向所述第一设备发送第二信息,所述第一CA是指为所述第一设备签发所述第一设备的证书的CA,所述第二信息指示所述第一设备的证书的数字签名是否有效。
在一种可能的设计中,所述第一信息包括所述第一CA的证书的标识。处理单元获取第一CA的公钥可以采用以下方法:根据第一CA的证书的标识和第二映射关系确定第三区块链的标识信息和第三区块的标识信息,根据所述第三区块链的标识信息和所述第三区块的标识信息从所述第三区块获取所述第一CA的公钥。所述第二映射关系指示所述第一CA的证书的标识、所述第三区块链的标识信息和所述第三区块的标识信息的对应关系,所述第三区块在所述第三区块链上,所述第三区块存储所述第一CA的证书。所述第一CA的证书包括所述第一CA的公钥。
在一种可能的设计中,在所述管理设备获取第一CA的公钥之前,处理单元用于根据所述第一设备的证书的标识和第三映射关系确定所述第一CA的证书的标识,所述第三映射关系指示所述第一设备的证书的标识和所述第一CA的证书的标识的对应关系。在所述处理单元获取第一CA的公钥时,所述处理单元根据所述第一CA的证书的标识和第二映射关系确定第三区块链的标识信息和第三区块的标识信息,所述第二映射关系指示所述第一CA的证书的标识、所述第三区块链的标识信息和所述第三区块的标识信息的对应关系;所述第三区块在所述第三区块链上,所述第三区块存储所述第一CA的证书;所述第一CA的证书包括所述第一CA的公钥。所述处理单元根据所述第三区块链的标识信息和所述第三区块的标识信息从所述第三区块获取所述第一CA的公钥。
在一种可能的设计中,收发单元用于接收第一广播消息,所述第一广播消息指示所述第二映射关系。
在一种可能的设计中,在接收第一广播消息之前,收发单元用于接收来自于所述第一CA的第三信息,所述第三信息包括所述第一CA的证书。处理单元用于确定所述第三区块链的标识信息,通过收发单元将所述第一CA的证书公布至所述第三区块链的标识信息对应的区块链网络。在接收第一广播消息之后,收发单元用于向所述第一CA发送第四信息,所述第四信息指示所述第一CA的证书已公布至所述第三区块链的标识信息对应的所述区块链网络。
在一种可能的设计中,所述第三信息还包括用于指示所述第一CA的证书的适用范围的信息,处理单元用于根据用于指示所述第一CA的证书的适用范围的信息确定所述第三区块链的标识信息。
在一种可能的设计中,收发单元用于接收第二广播消息,所述第二广播消息指示所述第一映射关系。
在一种可能的设计中,在接收第二广播消息之前,收发单元用于接收来自于所述第一CA的第五信息,所述第五信息包括所述第一设备的证书和所述证书状态信息,所述证书状态信息指示所述第一设备的证书未被吊销。处理单元用于确定所述第一区块链的标识信息,所述管理设备将所述第一设备的证书、所述证书状态信息公布至所述第一区块链的标识信息对应的区块链网络。在接收第二广播消息之后,收发单元用于向所述第一CA发送第六信息,所述第六信息指示所述证书状态信息已公布至所述第一区块链的标识信息对应的区块链网络。
在一种可能的设计中,所述第五信息还包括所述第一CA的证书的标识。处理单元用于通过收发单元将所述第一CA的证书的标识、所述第一设备的证书、所述证书状态信息公布至所述第一区块链的标识信息对应的区块链网络。收发单元用于接收第二广播消息,所述第二广播消息还指示所述第一设备的证书的标识和所述第一CA的证书的标识的对应关系。
在一种可能的设计中,所述第五信息还包括用于指示所述第一设备的证书的适用范围的信息,处理单元用于根据用于指示所述第一设备的证书的适用范围的信息确定所述第一区块链。
在一种可能的设计中,收发单元用于接收第三广播消息,所述第三广播消息指示更新后的第一映射关系,所述更新后的第一映射关系指示所述第一设备的证书的标识、所述第一区块链的标识信息和所述第四区块的标识信息的对应关系,所述第四区块在所述第一区块链上,所述第四区块存储所述第一设备的证书的标识和更新后的证书状态信息,所述更新后的证书状态信息指示所述第一设备的证书的吊销原因值。
在一种可能的设计中,在接收第三广播消息之前,收发单元用于接收来自于所述第一CA的第七信息,所述第七信息包括所述第一设备的证书的标识和所述更新后的证书状态信息。处理单元用于根据所述第一设备的证书的标识和所述第一映射关系确定所述第一区块链的标识信息。通过收发单元将所述更新后的证书状态信息、所述第一设备的证书的标识公布至所述第一区块链的标识信息对应的所述区块链网络。在接收第三广播消息之后,收发单元用于向所述第一CA发送第八信息,所述第八信息指示所述更新后的证书状态信息已公布至所述第一区块链的标识信息对应的区块链网络。
在一种可能的设计中,收发单元用于接收第四广播消息,所述第四广播消息指示第四映射关系,所述第一映射关系包括所述第四映射关系,所述第四映射关系指示所述第一设备的证书的标识、所述第二区块链的标识信息和所述第二区块的标识信息的对应关系。
在一种可能的设计中,在接收第四广播消息之前,收发单元用于接收来自于所述第一CA的第九信息,所述第九信息包括所述第一设备的证书的标识和所述证书状态信息,所述证书状态信息指示所述第一设备的证书的吊销原因值。处理单元用于确定所述第二区块链的标识信息,将所述第一设备的证书的标识、所述证书状态信息公布至所述第二区块链的标识信息对应的区块链网络。在接收第四广播消息之后,收发单元用于向所述第一CA发送第十信息,所述第十信息指示所述证书状态信息已公布至所述第二区块链的标识信息对应的区块链网络。
在一种可能的设计中,所述第九信息还包括用于指示所述第一设备的证书的适用范围的信息。处理单元用于根据用于指示所述第一设备的证书的适用范围的信息确定所述第二区块链。
第三方面,本申请实施例提供一种证书公钥查询方法,该方法包括:管理设备获取第二映射关系,所述第二映射关系指示第一CA的证书的标识、第三区块链的标识信息和第三区块的标识信息的对应关系,所述第三区块在所述第三区块链上,所述第三区块存储所述第一CA的证书,所述第一CA的证书包括所述第一CA的公钥。所述管理设备根据所述第一CA的证书的标识和所述第二映射关系确定所述第三区块链的标识信息和所述第三区块的标识信息,所述管理设备根据所述第三区块链的标识信息和所述第三区块的标识信息从所述第三区块获取所述第一CA的公钥。
采用上述方法,管理设备根据第二映射关系和第一CA的证书的标识确定存储第一CA的证书的区块,并从该区块获取第一CA的公钥。通过上述方法可以实现减少CA的数量,将原有多层级的PKI架构扁平化,减少了设备投入和运维成本。区块链的分布式账本性质保证所有管理设备上均存储同样的区块链、区块和区块交易,可以实现信任锚点的功能。PKI架构中心化信任机制变为去中心化信任机制,信任锚点均锚定在区块链上。使用区块链简化PKI架构,将原有中心化的根信任机制,变为去中心化的信任机制,简化证书验证机制,防止因多层CA的PKI架构导致需要验证多个证书以确定是否存在共同信任锚点,和因没有共同的信任锚点导致无法验证证书的问题。
在一种可能的设计中,管理设备获取第二映射关系可以通过以下方式:所述管理设备接收第一广播消息,所述第一广播消息指示所述第二映射关系。
采用上述设计,管理设备通过广播消息获取第二映射关系。
在一种可能的设计中,在所述管理设备接收第一广播消息之前,所述管理设备接收来自于所述第一CA的第三信息,所述第三信息包括所述第一CA的证书。所述管理设备确定所述第三区块链的标识信息,所述管理设备将所述第一CA的证书公布至所述第三区块链的标识信息对应的区块链网络。在所述管理设备接收第一广播消息之后,所述管理设备向所述第一CA发送第四信息,所述第四信息指示所述第一CA的证书已公布至所述第三区块链的标识信息对应的区块链网络。
采用上述设计,管理设备通过将第一CA的证书公布至区块链网络,实现通过区块链网络保存第一CA的证书。
第四方面,本申请实施例提供一种证书公钥查询方法,该方法包括:
第一CA向管理设备发送第三信息,所述第三信息包括所述第一CA的证书。所述第一CA接收来自于所述管理设备的第四信息,所述第四信息指示所述第一CA的证书已公布至区块链网络。
通过上述方法可以实现减少CA的数量,将原有多层级的PKI架构扁平化,减少了设备投入和运维成本。区块链的分布式账本性质保证所有管理设备上均存储同样的区块链、区块和区块交易,可以实现信任锚点的功能。PKI架构中心化信任机制变为去中心化信任机制,信任锚点均锚定在区块链上。使用区块链简化PKI架构,将原有中心化的根信任机制,变为去中心化的信任机制,简化证书验证机制,防止因多层CA的PKI架构导致需要验证多个证书以确定是否存在共同信任锚点,和因没有共同的信任锚点导致无法验证证书的问题。
第五方面,本申请还提供一种装置。该装置可以执行上述方法设计。该装置可以是能够执行上述方法对应的功能的芯片或电路,或者是包括该芯片或电路的设备。
在一种可能的实现方式中,该装置包括:存储器,用于存储计算机可执行程序代码; 以及处理器,处理器与存储器耦合。其中存储器所存储的程序代码包括指令,当处理器执行所述指令时,使该装置或者安装有该装置的设备执行上述第一方面或第一方面的任意一种可能的设计中的方法,或者第三方面或第三方面的任意一种可能的设计中的方法,或者第四方面或第四方面的任意一种可能的设计中的方法。
其中,该装置还可以包括通信接口,该通信接口可以是收发器,或者,如果该装置为芯片或电路,则通信接口可以是该芯片的输入/输出接口,例如输入/输出管脚等。
在一种可能的设计中,该装置包括相应的功能单元,分别用于实现以上方法中的步骤。功能可以通过硬件实现,也可以通过硬件执行相应的软件实现。硬件或软件包括一个或多个与上述功能相对应的单元。
第六方面,本申请实施例提供一种计算机可读存储介质,所述计算机可读存储介质存储有计算机程序,当所述计算机程序在装置上运行时,执行如第一方面或第一方面的任意一种可能的设计中的方法,或者第三方面或第三方面的任意一种可能的设计中的方法,或者第四方面或第四方面的任意一种可能的设计中的方法。
第七方面,本申请实施例提供一种计算机程序产品,所述计算机程序产品包括计算机程序,当所述计算机程序在装置上运行时,执行如第一方面或第一方面的任意一种可能的设计中的方法,或者第三方面或第三方面的任意一种可能的设计中的方法,或者第四方面或第四方面的任意一种可能的设计中的方法。
图1为本申请背景技术中PKI系统的架构示意图;
图2为本申请实施例中区块链的链状结构的示意图;
图3为本申请实施例中证书查询方法的概述流程图;
图4A为本申请实施例中以NRF维护多个区块链为例进行说明证书查询过程的示意图之一;
图4B为本申请实施例中以NRF维护多个区块链为例进行说明证书查询过程的示意图之二;
图5A为本申请实施例中以NRF维护多个区块链为例进行说明证书查询过程的示意图之三;
图5B为本申请实施例中以NRF维护多个区块链为例进行说明证书查询过程的示意图之四;
图6A为本申请实施例中以NRF仅维护一个区块链为例进行说明证书查询过程的示意图之一;
图6B为本申请实施例中以NRF仅维护一个区块链为例进行说明证书查询过程的示意图之二;
图7A为本申请实施例中以NRF维护多个区块链为例进行说明证书查询过程的示意图之五;
图7B为本申请实施例中以NRF维护多个区块链为例进行说明证书查询过程的示意图之六;
图8为本申请实施例中一种装置的结构示意图之一;
图9为本申请实施例中一种装置的结构示意图之二。
首先,下面对本申请实施例所涉及的技术概念进行简要说明。
1、PKI
一个典型的PKI系统可以包括一个或多个CA。CA负责管理证书的整个生命周期,包括发放证书、定义证书有效期和吊销证书。PKI架构中的节点可包括通信网络中的网元和CA,即CA可以负责为网元管理证书,例如图1中的CA-A1和CA-B1,也可以负责为其他CA管理证书,例如,图1中的CA-A和CA-B。
PKI架构可以用于显示该PKI架构下任意两个节点的信任关系,如果两个节点可以在同一PKI架构下找到共同的信任锚点,则这两个节点可以信任对方,即在PKI架构下,任意两个节点可以信任对端是基于两个节点所持有的证书中存在由共同的信任锚点颁发的证书,例如图1中所有节点均持有根CA签发的证书,则根CA可以为图1所示的PKI架构中其他节点的信任锚点。因此,一个节点所持有的证书包括该节点自己的证书,也包括PKI架构中该节点证书颁发者到信任锚点的路径上所有节点的证书,其中,该节点自己的证书和PKI架构中该节点证书颁发者到信任锚点的路径上所有节点的证书,共同组成证书链。
需要说明的是,信任锚点需要处于绝对安全的位置,保证安全隔离和尽量少的通信交互。借助多级叶CA可以实现对证书的适用范围的划分,例如,北京的网元和上海的网元使用不同的叶CA下发证书,或用于公共业务的网元和用于私有业务的网元使用不同的叶CA下发证书。因此,当某个叶CA被攻击时,不会导致整个PKI系统失效和崩溃,有利于整个PKI系统的稳定性。
示例性地,节点向CA请求签发证书的流程具体如下:
步骤A:节点本地生成配对的公钥和私钥,将公钥和自己的身份信息交给CA。
步骤B:CA确定是否同意为该节点签发证书,如果同意则生成证书并使用CA的私钥对该证书生成数字签名。其中,该证书中至少包括如表1所示的信息:
表1.一般的证书格式
步骤C:节点从CA处获取CA为该节点签发的证书。同时,除从CA获取该节点证书外,节点还从CA处获取查询证书吊销信息的地址和证书链中其他证书信息。其中,查询证书吊销的地址可以是查询记录证书吊销信息的CRL存储地址或OCSP服务器地址,证 书链用于从PKI架构中从该节点循序向上一直显示到信任锚点,用以使其他网元循序找到与该节点共同的信任锚点。例如,对于图1中网元A1和网元B1,他们的证书分别由CA-A1和CA-B1签发,因此,这两个网元证书无法独立显示共同的信任锚点。这时需要借助各自的证书链来显示共同的信任锚点为根CA。其中,网元A1对应的证书链为:{网元A1证书,CA-A1证书,CA-A证书,根CA证书}。网元B1对应的证书链为:{网元B1证书,CA-B1证书,CA-B证书,根CA证书}。
此外,对于上述背景技术中提到的网元A1发起的与网元B1的通信建立的过程,若网元B1依次确认根CA、CA-A、CA-A1证书和网元A1证书未被吊销,网元B1还需根据证书链中根CA证书内的根CA的公钥验证CA-A证书的数字签名是否有效,根据证书链中CA-A证书内的CA-A的公钥验证CA-A1证书的数字签名是否有效,根据证书链中CA-A1证书内的CA-A1的公钥验证网元A1证书的数字签名是否有效,以及根据网元A1证书中网元A1的公钥验证步骤1中网元A1发送的消息的数字签名是否有效。如果证书链更长,则以此类推需要从信任锚点向下一步验证。同理,网元B1向网元A1发送网元B1的证书和网元B1对应的证书链包括的证书,网元A1需要执行与网元B1类似的过程。由上可知,证书链的验证开销较大。
若网元A1和网元B1不在同一PKI架构下,则无法依赖证书链寻址到共同的信任锚点。而要实现不同PKI架构下的网元互通,需要大量的证书交叉认证,导致证书验证效率过低。例如,此种场景一般出现在运营商与运营商之间,需要单个运营商与其他所有运营商点对点的签订漫游协议和互通协议以实现交叉授权。
此外,在实际工程实现中,通信网络中使用的证书为了保证安全性能,证书的生成依赖高复杂度的加密算法以确保安全性能,因此需要特定安全能力的CA来生成证书,进一步导致了CA的高昂成本。5G对不同网元分别需要配置一个或多个证书,导致5G网络对证书的需求进一步加大,例如,这些证书可能包括与其他网络虚拟化功能(network function virtualization,NFV)之间、与其他网元之间的安全传输层协议(transport layer security,TLS)和/或互联网安全协议(internet protocol security,IPSec)连接使用的证书等。对于TLS场景,同一网元还要对该网元在TLS通信中的不同角色由专有的CA来配置不同证书,例如,为服务端服务的CA为服务端配置证书,为客户端服务的CA为客户端配置证书。因此,进一步地导致需要多台CA和多级CA组成的PKI架构,如果运营商需要自建和自维护网络的PKI架构,则运营商需要付出巨大成本。基于以上原因,现在运营商均倾向于向专职提供PKI的第三方公司租用以控制成本(但是成本依然高昂)。此外,运营商向第三方租用整套PKI设备,其中包括对应的证书查询解决方案,而第三方维护的CRL和OCSP均在运营商外网(即第三方网域)维护。因此,实现证书查询需要运营商进行频繁内外网交互,违背运营商内外网隔离的需求。
2、区块链技术(Blockchain)。
区块链技术也被称为分布式账本技术,是一种互联网数据库技术,其特点是去中心化、公开透明、不可篡改。区块链技术是利用块链式数据结构来验证与存储数据、利用分布式节点共识算法来生成和更新数据、利用密码学的方式保证数据传输和访问的安全、利用自动化脚本代码组成的智能合约来编程和操作数据的一种全新的分布式架构。区块链技术最早是比特币的基础技术,目前已有研究将其应用在金融和供应链等领域。
区块链主要包括:
交易(Transaction):一次操作,导致账本状态的一次改变,如添加一条记录;
区块(Block):记录一段时间内发生的交易和状态结果,是对当前账本状态的一次共识;
链(Chain):由一个个区块按照发生顺序串联而成,是整个状态变化的日志记录。
如果把区块链作为一个状态机,则每次交易就是试图改变一次状态,而每次共识生成的区块,就是参与者对于区块中所有交易内容导致状态改变的结果进行确认。
区块链是一种按照时间顺序将数据区块以顺序相连的方式组合成的一种链式数据结构,并以密码学方式保证的不可篡改和不可伪造的分布式账本。举例来说,原有数据记录机制只存在于通信的两点之间,而区块链代表的分布式账本技术将需要记录的数据公布,由所有可接收到的节点参与记录。
示例性地,区块链的链状结构如下图2所示。每个区块中父区块ID表示该区块在区块链中前一区块的标识,而本区块ID则与该区块在区块链中后一区块内父区块ID相同(即顺序相连方式组成链式数据结构)。共识凭证用于标识该区块通过某种共识机制生成(密码学方式不可篡改和不可伪造)。
本申请实施例涉及的设备可以包括第一设备、第二设备、CA和管理设备。
其中,第一设备和第二设备可以为两个网元。其中,该网元具体可以用于实现3GPP使用或3GPP定义的网络处理功能。例如,网元可以作为专用硬件上的网元(例如基站)、在专用硬件上运营的软件实例(例如在专用于网络存储功能(network repository function,NRF)的硬件上实例化多个NRF实例)或作为在平台商实例化的虚拟化功能(例如在云基础设施上实例化出NRF和其他功能网元)。可以理解的是,下述实施例仅以网元之间使用证书建立连接的过程为例进行说明,但随着未来技术发展,第一设备和第二设备还可能扩展到终端设备与终端设备之间,或者终端设备与网元之间,本申请实施例对此不做限定。以第一设备为例,第一设备可以为终端设备,例如,终端设备可以是手机、智能终端、车载终端、无人机、可穿戴设备、多媒体设备、流媒体设备等。第一设备还可以为接入网设备,例如,接入网设备可以是基站、中继站、接入点、车载设备以及网络侧设备等。本申请对第一设备和第二设备的具体形式不做限定。
CA负责管理证书的整个生命周期,包括发放证书、定义证书有效期和吊销证书。需要说明的是,CA还可以包括注册机构(registration authority,RA),RA用于在获取并认证用户身份后向CA提出证书签发请求。其中,RA可以是集成在CA的一项功能,也可单独部署RA的功能。本申请实施例对CA的具体形式不做限定。
管理设备为承担与区块链网络交互和维护区块链的功能的设备。示例性地,管理设备可以为独立的区块链维护网元,与其他网元共同部署实现区块链维护功能,也可以是NRF。其中,NRF负责网元的登记和管理。由于5G的网元数量多,因此需要用NRF来实现自动化管理网元。每个网元都通过服务化接口对外提供服务,并允许其他网元访问或调用自身的服务。其中,提供服务的网元被称作“网元服务提供者”,访问或调用服务的网元被称作“网元服务使用者”,上述活动需要NRF的管理和监控。每个网元启动时,需要到NRF进行注册登记才能提供服务。一个网元想请求另一个网元的服务,需要到NRF来进行服务发现。
在一些实施例中,区块链网络可以由多个NRF负责运营,NRF可以作为区块链网元连接到区块链网络、维护区块链、生成新区块和向区块链网络发布内容。需要注意的是, 该区块链功能网元可为独立部署或与其他网元合设。
此外,在本申请实施例中,区块链的标识信息可以包括区块链的ID、区块链地址,区块链的版本号中的至少一种。区块的标识信息可以包括区块的ID、区块的哈希值、区块交易编号和区块交易哈希值中的至少一种。可以理解的是,本申请实施例对区块链的标识信息和区块的标识信息的具体形式不做限定,以下仅区块链的标识信息包括区块链的ID,区块的标识信息包括区块的ID为例进行说明。
基于此,本申请实施例提供一种证书查询方法,如图3所示,该方法包括:
步骤300:管理设备接收来自于第二设备的第一信息。
其中,第一信息可以包括第一设备的证书或第一设备的证书的标识。其中,第一证书包括第一证书的标识。
示例性地,这里的第一信息用于请求查询第一证书的有效性(即第一证书的证书状态信息),也可以为TLS连接建立信息。
步骤310:管理设备根据第一设备的证书的标识和第一映射关系确定第一设备的证书的证书状态信息。其中,第一映射关系指示第一设备的证书的标识与证书状态信息的对应关系。
其中,证书状态信息用于指示第一设备的证书是否被吊销。示例性地,证书状态信息指示第一设备的证书未被吊销,或者第一设备的证书的吊销原因值,或者证书状态信息指示第一设备的证书未被吊销,或者第一设备的证书被吊销和吊销原因值。其中,第一设备的证书的吊销原因值可能为第一设备的私钥已泄露,或者第一设备为恶意用户等。本申请实施例对第一设备的证书的吊销原因值不做限定。
步骤320:管理设备向第二设备发送证书状态信息。
针对上述步骤310,第一映射关系可以显示指示第一设备的证书的标识与证书状态信息的对应关系,或者隐示指示第一设备的证书的标识与证书状态信息的对应关系。以下仅以示例1和示例2为例说明第一映射关系,此外,第一映射关系还可以具有其他多种实现形式,本申请实施例对此不做限定。
示例1:第一映射关系可以指示第一设备的证书的标识、第一区块链的标识信息和第一区块的标识信息的对应关系,其中,第一区块在第一区块链上,第一区块存储第一证书和证书状态信息,或者第一区块存储第一证书的标识和证书状态信息。
基于示例1所示的第一映射关系,在管理设备根据第一设备的证书的标识和第一映射关系确定证书状态信息时,管理设备根据第一设备的证书的标识和第一映射关系确定第一区块链的标识信息和第一区块的标识信息,根据第一区块链的标识信息和第一区块的标识信息确定第一区块,管理设备根据第一设备的证书的标识从第一区块获取证书状态信息。
需要说明的是,在示例1中,证书状态信息可以直接指示第一设备的证书未被吊销,或者直接指示第一设备的证书被吊销,此时,证书状态信息可以同时包括第一设备的证书的吊销原因值,或者不包括第一设备的证书的吊销原因值。或者,证书状态信息可以直接指示第一设备的证书未被吊销,或者证书状态信息包括第一设备的证书的吊销原因值。或者证书状态信息为空,则表明第一设备的证书未被吊销,或者证书状态信息包括第一设备的证书的吊销原因值。
此外,第一映射关系可以指示第一设备的证书的标识、第一区块链的标识信息和第一 区块的标识信息和第一设备的证书状态信息的对应关系。
示例2:第一映射关系指示被吊销的证书的标识、存储被吊销的证书的区块所在的区块链的标识信息和存储被吊销的证书的区块的标识信息的对应关系。
可以理解的是,示例2所示的第一映射关系可以包括一个或多个映射关系,当第一映射关系包括多个映射关系时,第一映射关系可以看做多个映射关系的集合。例如,当网元A的证书被吊销且网元B的证书被吊销时,则第一映射关系包括网元A的证书的标识、存储网元A的证书的吊销原因值的区块所在的区块链(简称区块链1)的标识、存储网元A的证书的吊销原因值的区块(简称区块1)的标识,其中,区块1在区块链1上,区块1存储网元A的证书的标识和网元A的证书的吊销原因值,第一映射关系还包括网元B的证书的标识、存储网元B的证书的吊销原因值的区块所在的区块链(简称区块链1)的标识、存储网元B的证书的吊销原因值的区块(简称区块2)的标识,其中,区块2在区块链1上,区块2存储网元B的证书的标识和网元B的证书的吊销原因值。
基于示例2所示的第一映射关系,管理设备根据第一设备的证书的标识和第一映射关系确定证书状态信息包括两种情况:
情况1:在被吊销的证书的标识不包括第一设备的证书的标识时,管理设备确定证书状态信息,证书状态信息指示第一证书未被吊销。因此,通过示例2所示的第一映射关系可以隐示确定证书未被吊销。
情况2:在被吊销的证书的标识包括第一设备的证书的标识时,第一映射关系包括第四映射关系,第四映射关系指示第一设备的证书的标识、第二区块链的标识信息和第二区块的标识信息,其中,第二区块在第二区块链上,第二区块存储被吊销证书的标识和被吊销的证书对应的吊销原因值。管理设备根据第一设备的证书的标识和第一映射关系确定第二区块链的标识信息和第二区块的标识信息,根据第二区块链的标识信息和第二区块的标识信息确定第二区块,管理设备根据第一设备的证书的标识从第二区块获取第一设备的证书的吊销原因值,管理设备确定证书状态信息,证书状态信息指示第一设备的证书的吊销原因值或第一设备的证书被吊销。
进一步地,对应于上述示例1和示例2,管理设备可以通过以下方式获得第一映射关系。
对应于上述示例1所示的第一映射关系,管理设备获得第一映射关系可以包括以下两种场景:
场景1:当管理设备为将证书状态信息公布至区块链网络的管理设备时,管理设备通过以下过程获得第一映射关系:
步骤1:管理设备接收来自于第一CA的第五信息,第五信息包括第一设备的证书和证书状态信息,证书状态信息指示第一设备的证书未被吊销。或者第五信息包括第一设备的证书的标识和证书状态信息,证书状态信息指示第一设备的证书未被吊销。
此外,在一些实施例中,第五信息包括第一设备的证书或第一设备的证书的标识,但未包括证书状态信息,在这种情况下,管理设备默认第一设备的证书的证书状态信息指示第一设备的证书未被吊销。
步骤2:管理设备确定第一区块链的标识信息。
在一些实施例中,管理设备负责多个使用场景的多个区块链维护,即管理设备维护多 个区块链。例如,管理设备同时为TLS通信、IPSec通信等场景维护区块链,不同使用场景的证书或证书的标识(例如TLS证书或IPSec的证书)可以维护在不同的区块链上。
示例性地,当不同使用场景的证书维护在不同的区块链上时,管理设备可以基于证书的适用范围确定与该适用范围对应的区块链,作为存储该证书的区块链。若第五信息还包括用于指示第一设备的证书的适用范围的信息,管理设备根据用于指示第一设备的证书的适用范围的信息确定第一区块链的标识信息。
同理,当不同使用场景的证书的标识维护在不同的区块链上时,管理设备可以基于证书的标识对应的证书的适用范围确定与该适用范围对应的区块链,作为存储该证书的标识的区块链。示例性地,若第五信息还包括用于指示第一设备的证书的标识对应的证书的适用范围的信息,管理设备根据用于指示第一设备的证书的标识对应的证书的适用范围的信息确定第一区块链的标识信息。
在一些实施例中,管理设备可以负责单一特定场景的多个区块链维护,但是同一场景下不同类别的网元的证书或证书标识维护在不同区块链之上。例如,管理设备将CA的证书和基站的证书或证书标识分别维护在不同区块链之上。此时,可以由第一CA根据证书适用范围选择管理设备,第一CA可以不携带证书适用范围。管理设备根据第一设备的证书所对应的网元的类别确定第一区块链的标识信息。
在一些实施例中,管理设备可以负责多个使用场景的单个区块链维护,即管理设备仅维护一个区块链。例如,管理设备同时为TLS通信、IPSec通信等场景维护区块链,但是这些场景所对应的证书维护在一条区块链上,即不同使用场景的证书或证书的标识(例如TLS证书或IPSec的证书)可以维护在同一个区块链上。此时可以由第一CA根据证书适用范围选择管理设备,第一CA可以不携带证书适用范围。
在一些实施例中,管理设备可以负责单一特定场景的单一区块链维护,即管理设备仅维护一个区块链,则此时可以由第一CA根据证书适用范围选择管理设备,第一CA可以不携带证书适用范围。
步骤3:当第五信息包括第一设备的证书和证书状态信息时,管理设备将第一设备的证书、证书状态信息公布至第一区块链的标识信息对应的区块链网络。
可以理解的是,区块链网络可以维护一个或多个区块链。在一些实施例中,当区块链网络维护一个区块链时,管理设备将第一设备的证书、证书状态信息通过区块交易的形式广播到区块链网络,该区块交易包括第一设备的证书、证书状态信息。
在一些实施例中,当区块链网络维护多个区块链时,管理设备可以将第一设备的证书、证书状态信息和第一区块链的标识信息通过区块交易的形式广播到区块链网络,该区块交易包括第一设备的证书、证书状态信息和第一区块链的标识信息。或者,当区块链网络维护多个区块链时,管理设备可以将第一设备的证书、证书状态信息通过区块交易的形式广播到区块链网络,该区块交易包括第一设备的证书、证书状态信息,同时,管理设备还向区块链网络广播第一区块链的标识信息。
进一步地,第一区块链的标识信息对应的区块链网络中的节点接收到该区块交易后使用共识算法形成新区块,该新区块包含该区块交易、新区块的标识信息和第一区块链的标识信息。在第一区块链的标识信息对应的区块链网络中,最快生成新区块的节点将该新区块以第二广播消息的形式广播到该区块链网络,其余节点在接收到该第二广播消息后,使 用共识算法验证该新区块,若该新区块有效,则停止根据该区块交易生成新区块,该新区块记为第一区块。其中,该区块交易可以通过区块交易标识和/或区块交易哈希值标识来识别。在这种情况下,第一区块存储第一证书、证书状态信息、第一区块的标识信息和第一区块链的标识信息。其中,第一证书包括第一证书的标识。
类似的,当第五信息包括第一设备的证书的标识和证书状态信息时,管理设备将第一设备的证书的标识、证书状态信息公布至第一区块链的标识信息对应的区块链网络,可以参考上述过程,此处不再赘述。在这种情况下,第一区块存储第一证书的标识、证书状态信息、第一区块的标识信息和第一区块链的标识信息。
步骤4:管理设备获取第二广播消息,第二广播消息指示第一映射关系,第一映射关系指示第一设备的证书的标识、第一区块链的标识信息和第一区块的标识信息的对应关系。
具体的,第二广播消息包括第一区块,管理设备保存上述第一区块,将该第一区块更新到第一区块链末端。管理设备根据第一区块可以确定第一映射关系。管理设备保存上述第一映射关系。
此外,在一些实施例中,第五信息还可以包括第一CA的证书的标识,此时,管理设备通过区块交易的形式将第一CA的证书的标识、第一设备的证书、证书状态信息公布至第一区块链的标识信息对应的区块链网络。在这种情况下,第一区块存储第一CA的证书的标识、第一证书、证书状态信息、第一区块的标识信息和第一区块链的标识信息。
类似的,管理设备将第一CA的证书的标识、第一设备的证书的标识、证书状态信息公布至第一区块链的标识信息对应的区块链网络,可以参考上述过程,此处不再赘述。在这种情况下,第一区块存储第一CA的证书的标识、第一证书的标识、证书状态信息、第一区块的标识信息和第一区块链的标识信息。
此时,管理设备获取的第二广播消息还指示第三映射关系。第三映射关系指示第一设备的证书的标识和第一CA的证书的标识的对应关系。示例性地,第一映射关系和第三映射关系可以独立存在,第一映射关系和第三映射关系可以分开发送或者合并到一条信息中发送。又或者,第一映射关系和第三映射关系可以合并为一条映射关系。
步骤5:管理设备向第一CA发送第六信息,第六信息指示证书状态信息已公布至第一区块链的标识信息对应的区块链网络。
场景2:当管理设备不是将证书状态信息公布至区块链网络的管理设备时,管理设备获取第二广播消息。第二广播消息指示第一映射关系,或者第一映射关系和第三映射关系。
具体可以参阅上述对应示例1的场景1中步骤3和步骤4的相关内容,重复之处不再赘述。具体的,第二广播消息包括第一区块,管理设备保存上述第一区块,将该第一区块更新到第一区块链末端。管理设备根据第一区块可以确定第一映射关系,管理设备保存上述第一映射关系,或者管理设备根据第一区块可以确定第一映射关系和第三映射关系,管理设备保存上述第一映射关系和第三映射关系。
进一步地,在证书状态信息发生改变时,管理设备还需要获取更新后的第一映射关系。具体的,管理设备获得更新后的第一映射关系可以包括以下两种场景:
场景1:当管理设备是将更新后的证书状态信息公布至区块链网络的管理设备时,管理设备通过以下过程获得更新后的第一映射关系:
步骤1:管理设备接收来自于第一CA的第七信息,第七信息包括第一设备的证书的 标识和证书状态信息,更新后的证书状态信息指示第一设备的证书的吊销原因值。
步骤2:管理设备根据第一设备的证书的标识和第一映射关系确定第一区块链的标识信息。
通过上述管理设备获得第一映射关系的相关描述可知,管理设备当前已保存第一映射关系,因此,管理设备可以根据第一设备的证书的标识和已保存的第一映射关系确定第一区块链的标识信息。
步骤3:管理设备将第一设备的证书的标识、更新后的证书状态信息公布至第一区块链的标识信息对应的区块链网络。
在一些实施例中,当区块链网络维护一个区块链时,管理设备将第一设备的证书的标识、更新后的证书状态信息通过区块交易的形式广播到区块链网络,该区块交易包括第一设备的证书的标识、更新后的证书状态信息。
在一些实施例中,当区块链网络维护多个区块链时,管理设备可以将第一设备的证书的标识、更新后的证书状态信息和第一区块链的标识信息通过区块交易的形式广播到区块链网络,该区块交易包括第一设备的证书的标识、更新后的证书状态信息和第一区块链的标识信息。或者,当区块链网络维护多个区块链时,管理设备可以将第一设备的证书的标识、更新后的证书状态信息通过区块交易的形式广播到区块链网络,该区块交易包括第一设备的证书的标识、更新后的证书状态信息。同时,管理设备还向区块链网络广播第一区块链的标识信息。
进一步地,区块链网络中的节点接收到该区块交易后使用共识算法形成新区块,该新区块包含该区块交易、新区块的标识信息和第一区块链的标识信息。在区块链网络中,最快生成新区块的节点将该新区块以第三广播消息的形式广播到该区块链网络,其余节点在接收到该第三广播消息后,使用共识算法验证该新区块,若该新区块有效,则停止根据该区块交易生成新区块,该新区块记为第四区块。其中,该区块交易可以通过区块交易标识和/或区块交易哈希值标识来识别。在这种情况下,第四区块存储第一证书的标识、更新后的证书状态信息、第四区块的标识信息和第四区块链的标识信息。
步骤4:管理设备获取第三广播消息,第三广播消息包括更新后的第一映射关系,更新后的第一映射关系指示第一设备的证书的标识、第一区块链的标识信息和第四区块的标识信息的对应关系。
具体的,第三广播消息包括第四区块,管理设备保存上述第四区块,将该第四区块更新到第一区块链末端。管理设备根据第四区块可以确定更新后的第一映射关系。管理设备保存更新后的第一映射关系。
步骤5:管理设备向第一CA发送第八信息,第八信息指示更新后的证书状态信息已公布至第一区块链的标识信息对应的区块链网络。
场景2:当管理设备不是将更新后的证书状态信息公布至区块链网络的管理设备时,管理设备获取第三广播消息,第三广播消息指示更新后的第一映射关系。更新后的第一映射关系指示第一设备的证书的标识、第一区块链的标识信息和第四区块的标识信息的对应关系。
具体的,第三广播消息包括第四区块,管理设备保存上述第四区块,将该第四区块更新到第一区块链末端。管理设备根据第四区块可以确定更新后的第一映射关系,管理设备保存上述更新后的第一映射关系。
对应于上述示例2所示的第一映射关系,管理设备获得第一映射关系可以包括以下两种场景:
场景1:当管理设备为将第一设备的证书的标识和证书状态信息(证书状态信息指示第一设备的证书的吊销原因值)公布至区块链网络的管理设备时,管理设备通过以下过程获得第四映射关系,第四映射关系指示第一设备的证书的标识、第二区块链的标识信息和第二区块的标识信息的对应关系。第一映射关系包括第四映射关系。
步骤1:管理设备接收来自于第一CA的第九信息,第九信息包括第一设备的证书的标识和证书状态信息。
步骤2:管理设备确定第二区块链的标识信息。
在一些实施例中,管理设备负责多个使用场景的多个区块链维护,即管理设备维护多个区块链。例如,管理设备同时为TLS通信、IPSec通信等场景维护区块链,不同使用场景的证书的标识(例如TLS证书或IPSec的证书)可以维护在不同的区块链上。
当不同使用场景的证书的标识维护在不同的区块链上时,管理设备可以基于证书的标识对应的证书的适用范围确定与该适用范围对应的区块链,作为存储该证书的标识的区块链。示例性地,若第九信息还包括用于指示第一设备的证书的标识对应的证书的适用范围的信息,管理设备根据用于指示第一设备的证书的标识对应的证书的适用范围的信息确定第一区块链的标识信息。
在一些实施例中,管理设备可以负责单一特定场景的多个区块链维护,但是同一场景下不同类别的网元的证书或证书标识维护在不同区块链之上。例如,管理设备将CA的证书标识和基站的证书标识分别维护在不同区块链之上。此时,可以由第一CA根据证书适用范围选择管理设备,第一CA可以不携带证书适用范围。管理设备根据第一设备的证书标识对应的证书所对应的网元的类别确定第一区块链的标识信息。
在一些实施例中,管理设备可以负责多个使用场景的单个区块链维护,即管理设备仅维护一个区块链。例如,管理设备同时为TLS通信、IPSec通信等场景维护区块链,但是这些场景所对应的证书维护在一条区块链上,即不同使用场景的证书的标识(例如TLS证书或IPSec的证书)可以维护在同一个区块链上。此时可以由第一CA根据证书适用范围选择管理设备,第一CA可以不携带证书适用范围。
在一些实施例中,管理设备可以负责单一特定场景的单一区块链维护,即管理设备仅维护一个区块链,则此时可以由第一CA根据证书适用范围选择管理设备,第一CA可以不携带证书适用范围。
步骤3:管理设备将第一设备的证书的标识、证书状态信息和第二区块链的标识信息公布至第二区块链的标识信息对应的区块链网络。
可以理解的是,区块链网络可以维护一个或多个区块链。在一些实施例中,当区块链网络维护一个区块链时,管理设备将第一设备的证书的标识、证书状态信息通过区块交易的形式广播到区块链网络,该区块交易包括第一设备的证书的标识、证书状态信息。
在一些实施例中,当区块链网络维护多个区块链时,管理设备可以将第一设备的证书的标识、证书状态信息和第一区块链的标识信息通过区块交易的形式广播到区块链网络,该区块交易包括第一设备的证书的标识、证书状态信息和第二区块链的标识信息。或者,当区块链网络维护多个区块链时,管理设备可以将第一设备的证书的标识、证书状态信息 通过区块交易的形式广播到区块链网络,该区块交易包括第一设备的证书的标识、证书状态信息。同时,管理设备还向区块链网络广播第二区块链的标识信息。
进一步地,第一区块链的标识信息对应的区块链网络中的节点接收到该区块交易后使用共识算法形成新区块,该新区块包含该区块交易、新区块的标识信息和第二区块链的标识信息。在第一区块链的标识信息对应的区块链网络中,最快生成新区块的节点将该新区块以第二广播消息的形式广播到该区块链网络,其余节点接收到该第二广播消息,使用共识算法验证该新区块,若新区块有效,则停止根据该区块交易生成新区块,新区块记为第二区块。其中,该区块交易可以通过区块交易标识和/或区块交易哈希值标识来识别。在这种情况下,第二区块存储第一设备的证书的标识、证书状态信息、第二区块的标识信息和第二区块链的标识信息。
步骤4:管理设备获取第二广播消息。第二广播消息指示第四映射关系,第四映射关系指示第一设备的证书的标识、第二区块链的标识信息和第二区块的标识信息的对应关系。
具体的,第三广播消息包括第二区块,管理设备保存上述第二区块,将第二区块更新到第二区块链末端。管理设备根据第二区块可以确定第四映射关系,管理设备保存第四映射关系。
步骤5:管理设备向第一CA发送第八信息,第八信息指示证书状态信息已公布至第二区块链的标识信息对应的区块链网络。
场景2:当管理设备不是将第一设备的证书的标识和证书状态信息(证书状态信息指示第一设备的证书的吊销原因值)公布至区块链网络的管理设备时,管理设备获取第二广播消息。第二广播消息指示第四映射关系,第四映射关系指示第一设备的证书的标识、第二区块链的标识信息和第二区块的标识信息的对应关系。
具体的,第三广播消息包括第二区块,管理设备保存上述第二区块,将第二区块更新到第二区块链末端。管理设备根据第二区块可以确定第四映射关系,管理设备保存第四映射关系。
通过上述过程,第一映射关系依赖区块链的分布式共识和分布式账本机制,负责确定证书状态信息。证书状态信息可以存储在区块链网络内的区块链中,区块链网络由网络运营商独立运营,因此可以实现运营商内网查询证书状态信息,省去跨网查询步骤。
管理设备除了需要确定第一设备的证书的证书状态信息,管理设备还需获得第一CA的公钥,以验证第一设备的证书的数字签名是否有效。其中,第一CA是指为第一设备签发第一设备的证书的CA。需要说明的是,本申请实施例不限定管理设备获得第一CA的公钥的具体方式。
在一些实施例中,管理设备获取第一CA的公钥,并向第二设备发送第一CA的公钥,以使第二设备根据第一CA的公钥验证第一设备的证书的数字签名是否有效。其中,第一CA的公钥可以与第一证书的证书状态信息同时发送给第二设备或者分开发送给第二设备。
示例性地,管理设备可以在确定第一设备的证书的证书状态信息之后,获取第一CA的公钥并向第二设备发送第一CA的公钥,或者管理设备可以在确定第一设备的证书的证书状态信息之前,获取第一CA的公钥,在后续确定第一设备的证书的证书状态有效后向第二设备发送第一CA的公钥。
示例性地,管理设备在确定第一设备的证书的证书状态信息指示第一设备的证书未被 吊销时,管理设备向第二设备发送第一CA的公钥。管理设备在确定第一设备的证书的证书状态信息指示第一设备的证书被吊销时,管理设备不向第二设备发送第一CA的公钥。示例性的,管理设备可以先获取第一CA的公钥,在确定第一设备的证书的证书状态信息指示第一设备的证书未被吊销时,管理设备向第二设备发送第一CA的公钥。
在一些实施例中,管理设备获取第一CA的公钥,管理设备根据第一CA的公钥确定第一设备的证书的数字签名是否有效。
示例性地,管理设备可以在确定第一设备的证书的证书状态信息之后,根据第一CA的公钥确定第一设备的证书的数字签名是否有效。或者管理设备可以在确定第一设备的证书的证书状态信息之前,根据第一CA的公钥确定第一设备的证书的数字签名是否有效。
示例性地,在管理设备确定第一设备的证书的证书状态信息之前,管理设备根据第一CA的公钥确定第一设备的证书的数字签名是否有效。进一步地,若管理设备根据第一CA的公钥确定第一设备的证书的数字签名有效,管理设备执行根据第一设备的证书的标识和第一映射关系确定第一设备的证书的证书状态信息。若管理设备根据第一CA的公钥确定第一设备的证书的数字签名无效,管理设备可以不需要执行根据第一设备的证书的标识和第一映射关系确定第一设备的证书的证书状态信息。
示例性地,在管理设备确定证书状态信息指示第一设备的证书未被吊销时,管理设备获取第一CA的公钥,管理设备根据第一CA的公钥判断第一设备的证书的数字签名是否有效,管理设备向第一设备发送第二信息,第二信息指示第一设备的证书的数字签名是否有效。在管理设备确定证书状态信息指示第一设备的证书被吊销时,管理设备可以不需要获取第一CA的公钥,也不需要判断第一设备的证书的数字签名是否有效。
在一些实施例中,管理设备获得第一CA的公钥,需要基于第二映射关系。第二映射关系指示第一CA的证书的标识、第三区块链的标识信息和第三区块的标识信息的对应关系。管理设备获得第二映射关系可以包括以下两种场景:
场景1:当管理设备是将第一CA的证书公布至区块链网络的管理设备时,管理设备通过以下过程获得第二映射关系:
步骤1:管理设备接收来自于第一CA的第三信息,第三信息包括第一CA的证书。
步骤2:管理设备确定第三区块链的标识信息。
在一些实施例中,管理设备负责多个使用场景的多个区块链维护,即管理设备维护多个区块链。例如,管理设备同时为TLS通信、IPSec通信等场景维护区块链,不同使用场景的证书的标识(例如TLS证书或IPSec的证书)可以维护在不同的区块链上。
当不同使用场景的证书的标识维护在不同的区块链上时,管理设备可以基于证书的标识对应的证书的适用范围确定与该适用范围对应的区块链,作为存储该证书的标识的区块链。示例性地,若第三信息还包括用于指示第一CA的证书对应的证书的适用范围的信息,管理设备根据用于指示第一CA的证书对应的证书的适用范围的信息确定第三区块链的标识信息。
在一些实施例中,管理设备可以负责单一特定场景的多个区块链维护,但是同一场景下不同类别的网元的证书或证书标识维护在不同区块链之上。例如,管理设备将CA的证书标识和基站的证书标识分别维护在不同区块链之上。此时,可以由第一CA根据证书适用范围选择管理设备,第一CA可以不携带证书适用范围。管理设备根据第一CA的证书 所对应的网元的类别确定第三区块链的标识信息。
在一些实施例中,管理设备可以负责多个使用场景的单个区块链维护,即管理设备仅维护一个区块链。例如,管理设备同时为TLS通信、IPSec通信等场景维护区块链,但是这些场景所对应的证书维护在一条区块链上,即不同使用场景的证书的标识(例如TLS证书或IPSec的证书)可以维护在同一个区块链上。此时可以由第一CA根据证书适用范围选择管理设备,第一CA可以不携带证书适用范围。
在一些实施例中,管理设备可以负责单一特定场景的单一区块链维护,即管理设备仅维护一个区块链,则此时可以由第一CA根据证书适用范围选择管理设备,第一CA可以不携带证书适用范围。
需要说明的是,第三区块链与第一区块链可以是相同的区块链或者不同的区块链。或者,第三区块链与第二区块链可以是相同的区块链或者不同的区块链。当第三区块链与第一区块链(或第二区块链)是不同的区块链时,第三区块链与第一区块链(或第二区块链)可以是相同适用范围的不同区块链,或者,不同适用范围的不同区块链。
步骤3:管理设备将第一CA的证书公布至第三区块链的标识信息对应的区块链网络。
可以理解的是,区块链网络可以维护一个或多个区块链。在一些实施例中,当区块链网络维护一个区块链时,管理设备将第一CA的证书通过区块交易的形式广播到区块链网络,该区块交易包括第一CA的证书。
在一些实施例中,当区块链网络维护多个区块链时,管理设备可以将第一CA的证书和第一区块链的标识信息通过区块交易的形式广播到区块链网络,该区块交易包括第一CA的证书和第三区块链的标识信息。或者,当区块链网络维护多个区块链时,管理设备可以将第一CA的证书通过区块交易的形式广播到区块链网络,该区块交易包括第一CA的证书。同时,管理设备还向区块链网络广播第三区块链的标识信息。
进一步地,第三区块链的标识信息对应的区块链网络中的节点接收到该区块交易后使用共识算法形成新区块,该新区块包含该区块交易、新区块的标识信息和第三区块链的标识信息。在第三区块链的标识信息对应的区块链网络中,最快生成新区块的节点将该新区块以第一广播消息的形式广播到该区块链网络,其余节点接收到该第一广播消息,使用共识算法验证该新区块有效后,停止根据该区块交易生成新区块,该新区块记为第三区块。其中,该区块交易可以通过区块交易标识和/或区块交易哈希值标识来识别。在这种情况下,第三区块存储第一CA的证书、第三区块的标识和第三区块链的标识信息。
步骤4:管理设备获取第一广播消息,第一广播消息指示第二映射关系,第二映射关系指示第一CA的证书的标识、第三区块链的标识信息和第三区块的标识信息的对应关系。
具体的,第一广播信息包括第三区块,管理设备保存上述第三区块,将该第三区块更新到第三区块链末端。管理设备根据第三区块可以确定第二映射关系。管理设备保存上述第二映射关系。
步骤5:管理设备向第一CA发送第四信息,第四信息指示第一CA的证书已公布至第三区块链的标识信息对应的区块链网络。
场景2:当管理设备不是将第一CA的证书公布至区块链网络的管理设备时,管理设备获取第一广播消息,第一广播消息指示第二映射关系,第二映射关系指示第一CA的证书的标识、第三区块链的标识信息和第三区块的标识信息的对应关系。
具体的,第一广播信息包括第三区块,管理设备保存上述第三区块,将该第三区块更 新到第三区块链末端。管理设备根据第三区块可以确定第二映射关系。管理设备保存上述第二映射关系。
进一步地,在获得第二映射关系之后,管理设备可以具体采用以下方式获取第一CA的公钥。
方式1:在第一信息不包括第一CA的证书的标识时,管理设备需要首先根据第一设备的证书的标识和第三映射关系确定第一CA的证书的标识,第三映射关系指示第一设备的证书的标识和第一CA的证书的标识的对应关系,然后管理设备根据第一CA的证书的标识和第二映射关系确定第三区块链的标识信息和第三区块的标识信息,第二映射关系指示第一CA的证书的标识、第三区块链的标识信息和第三区块的标识信息的对应关系。管理设备根据第三区块链的标识信息和第三区块的标识信息确定第三区块,管理设备根据第一CA的证书的标识从第三区块获取第一CA的公钥。
其中,方式1可以适用于示例1所示的第一映射关系对应的实施例。
方式2:在第一信息包括第一CA的证书的标识时,管理设备根据第一CA的证书的标识和第二映射关系确定第三区块链的标识信息和第三区块的标识信息,第二映射关系指示第一CA的证书的标识、第三区块链的标识信息和第三区块的标识信息的对应关系。然后管理设备根据第三区块链的标识信息和第三区块的标识信息确定第三区块,管理设备根据第一CA的证书的标识从第三区块获取第一CA的公钥。
其中,方式2可以适用于示例2所示的第一映射关系对应的实施例。
通过上述方法可以实现减少CA的数量,将原有多层级的PKI架构扁平化,减少了设备投入和运维成本。区块链的分布式账本性质保证所有管理设备上均存储同样的区块链、区块和区块交易,可以实现信任锚点的功能。PKI架构中心化信任机制变为去中心化信任机制,信任锚点均锚定在区块链上,第二设备任意查询最近的运营区块链的网元(即管理设备)便可以获取与第一设备的信任关系。使用区块链简化PKI架构,将原有中心化的根信任机制,变为去中心化的信任机制,简化证书验证机制,防止因多层CA的PKI架构导致需要验证多个证书以确定是否存在共同信任锚点,和因没有共同的信任锚点导致无法验证证书。
下面结合具体示例对上述内容进行详细说明。
实施例一:
以下以NRF维护多个区块链为例进行说明证书查询过程,如图4A和图4B所示。
步骤1:CA-A生成自签名的证书。其中,CA-A独立生成私钥和对应的公钥,并生成自己的证书,CA-A证书使用CA-A的私钥进行自签名。其中,CA-A证书可以包括如表2中内容:
表2.CA-A证书
步骤2:CA-A向NRF发送CA-A证书和CA-A证书的证书适用范围。
可以理解的是,第一,NRF可以负责多个使用场景的多个区块链维护,不同使用场景的证书和/或证书的标识(例如TLS证书或IPSec的证书)可以维护在不同的区块链上。CA-A可以携带CA-A证书的证书适用范围,NRF可以根据CA-A证书的证书适用范围确定对应的区块链标识。示例性地,CA-A证书的证书适用范围用于指示CA-A证书的证书用途,例如,CA-A证书可以用于TLS通信、IPSec通信或是运营商之间通信等。
第二,NRF可以负责单一特定场景的多个区块链维护,但是同一场景下不同类别的网元的证书和/或证书标识维护在不同区块链之上。此时,可以由CA-A根据证书适用范围选择NRF,CA-A可以不携带证书适用范围。NRF根据CA-A证书所对应的网元的类别确定对应的区块链标识。
以下仅以CA-A携带CA-A证书的证书适用范围为例进行说明。
步骤3:NRF根据CA-A证书的证书适用范围确定对应的区块链标识,此处记为区块链A的标识。NRF将CA-A证书公布到区块链标识对应的区块链网络。
示例性地,当区块链网络仅维护一个区块链时,CA-A证书通过区块交易的形式广播到区块链网络,该区块交易包括CA-A证书。
示例性地,当区块链网络维护多个区块链时,CA-A证书和区块链标识通过区块交易的形式广播到区块链网络,该区块交易包括CA-A证书和区块链标识。或者,当区块链网络维护多个区块链时,CA-A证书通过区块交易的形式广播到区块链网络,该区块交易包括CA-A证书。NRF同时广播区块链标识。
进一步地,区块链网络中的节点接收到该区块交易后使用共识算法形成新区块,该新区块包含该区块交易、新区块标识和区块链标识。在区块链网络中,最快生成新区块的节点将该新区块以广播消息的形式广播到该区块链网络,其余节点接收到该广播消息,并使用共识算法验证该新区块有效后存储该区块并更新对应区块链停止根据该区块交易生成新区块,其中,新区块标识为区块A1的标识和区块链标识为区块链A的标识。其中,该区块交易可以通过区块交易标识和/或区块交易哈希值标识来识别。
步骤4:NRF接收广播信息,保存CA-A证书的CA证书映射关系。
具体的,NRF接收步骤3中包括区块A1的广播消息,该广播消息指示区块链标识、区块标识和CA-A证书的ID的对应关系,其中该区块链标识为区块链A的标识,区块标识为区块A1的标识。因此,NRF可以确定具体如表3所示的对应关系,记为CA-A证书的CA证书映射关系。NRF保存区块A1,将区块A1更新到区块链A末端。NRF根据区块A1可以确定上述映射关系,NRF保存上述映射关系。
表3.CA-A证书的CA证书映射关系
其中,区块链标识、区块标识和CA-A证书的ID的对应关系可以对应上述第二映射关系。
步骤5:NRF向CA-A发送上链确认消息。该上链确认消息用于指示CA-A的证书已公布到区块链网络。
同理,CA-B和NRF执行类似步骤1-5的步骤6-10。可以理解的是,本申请实施例不限定步骤1-5与步骤6-10的先后顺序。
步骤6:CA-B生成自签名的证书。其中,CA-B独立生成私钥和对应的公钥,并生成自己的证书,CA-B证书使用CA-B的私钥进行自签名。其中,CA-B证书可以包括如表4中内容:
表4.CA-B证书
步骤7:CA-B向NRF发送CA-B证书和CA-B证书的证书适用范围。
类似的,这里可以参考步骤2的相关描述,以下仅以CA-B携带CA-B证书的证书适用范围为例进行说明。
步骤8:NRF根据CA-B证书的证书适用范围选择对应的区块链标识。NRF将CA-B证书公布到区块链标识对应的区块链网络。
这里可以假设CA-A的证书的证书适用范围与CA-B的证书的证书适用范围相同,NRF根据CA-B证书的证书适用范围确定区块链A的标识。
示例性地,当区块链网络仅维护一个区块链时,CA-B证书通过区块交易的形式广播到区块链网络,该区块交易包括CA-B证书。
示例性地,当区块链网络维护多个区块链时,CA-B证书和区块链标识通过区块交易的形式广播到区块链网络,该区块交易包括CA-B证书和区块链标识。或者,当区块链网络维护多个区块链时,CA-B证书通过区块交易的形式广播到区块链网络,该区块交易包括CA-B证书。NRF同时广播区块链标识。
进一步地,区块链网络中的节点接收到该区块交易后使用共识算法形成新区块,该新区块包含该区块交易、新区块标识和区块链标识。在区块链网络中,最快生成新区块的节点将该新区块以广播消息的形式广播到该区块链网络,其余节点接收到该广播消息,并使用共识算法验证该新区块有效后存储该区块并更新对应区块链,停止根据该区块交易生成新区块,其中新区块标识为区块A2的标识和区块链标识为区块链A的标识。其中,该区块交易可以通过区块交易标识和/或区块交易哈希值标识来识别。
步骤9:NRF接收广播信息,保存CA-B证书的CA证书映射关系。
具体的,NRF接收步骤3中包括区块A2的广播消息,该广播消息包括区块链标识、区块标识和CA-B证书的ID的对应关系,其中该区块链标识为区块链A的标识,区块标识为区块A2的标识。因此,NRF可以确定具体如表5所示的对应关系,记为CA-B证书的CA证书映射关系。NRF保存区块A2,将区块A2更新到区块链A末端。NRF根据区块A2可以确定上述映射关系,NRF保存上述映射关系。
其中,区块A2和区块A1可为同一区块,也可为不同区块。示例性地,区块链网络中的节点可将一段时间内接收到的所有区块交易使用共识算法形成新区块,当CA-B证书和CA-A证书在该段时间内均被公布到区块链网络时,区块A2和区块A1可以为同一区块,否则区块A2和区块A1是不同的区块。
表5.CA-B证书的CA证书映射关系
其中,区块链A的标识、区块A2的标识和CA-B证书的ID的对应关系可以对应上述第二映射关系。
步骤10:NRF向CA-B发送上链确认消息。该上链确认消息用于指示CA-B的证书已公布到区块链网络。
步骤11:网元A在本地生成自己的公钥和私钥,并将公钥发送给CA-A以请求CA-A为网元A签发证书。
步骤12:CA-A根据网元A的公钥生成网元A的证书,并将网元A的证书发送给网元A。其中网元A证书可以包括如表6A所示的信息:
表6A.CA-A为网元A签发的证书内容
同样的,网元B执行步骤13-14,从CA-B获取网元B的证书。
步骤13:网元B在本地生成自己的公钥和私钥,并将公钥发送给CA-B以请求CA-B为网元B签发证书。
步骤14:CA-B根据网元B的公钥生成网元B的证书,并将网元B的证书发送给网元B。其中网元B证书可以包括如表6B所示的信息:
表6B.CA-B为网元B签发的证书内容
步骤15:CA-A向NRF将发送网元A证书、网元A证书的证书状态信息和CA-A的证书ID。网元A证书的证书状态信息指示网元A证书未被吊销,或者网元A证书有效。
示例性地,CA-A可以同时向NRF发送网元A证书的证书适用范围。类似的,这里可以参考步骤2的相关描述,以下仅以CA-A携带网元A证书的证书适用范围为例进行说明。
需要说明的是,NRF可以根据CA-A证书的ID查询CA证书映射关系(如表3所示)获取区块链标识和区块标识(分别为区块链A的标识和区块A1的标识),通过获取的区块链A的标识和区块A1的标识从区块链A中获取区块A1,得到CA-A的公钥。该CA-A公钥用于验证网元A证书中的数字签名是否有效。在确认网元A证书中的数字签名有效时,继续执行下述步骤。
可选的,CA-A也可在本步骤流程中,将网元A证书的标识(网元A证书ID)而非网元A证书发送给NRF。
步骤16:NRF根据网元A证书的证书适用范围选择对应的区块链标识,记为区块链B的标识。NRF将CA-A证书ID、网元A证书、网元A证书的证书状态信息公布到区块链标识对应的区块链网络。
可选的,如果NRF对同一场景不同网元的证书或证书的标识均维护在同一条区块链上,此时NRF也可根据CA-A证书ID查询CA证书映射关系获得区块链标识,将此区块链标识对应的区块链网络作为公布CA-A证书ID、网元A证书、网元A证书的证书状态信息的区块链网络。
示例性地,当区块链网络仅维护一个区块链时,CA-A证书ID、网元A证书、网元A证书的证书状态信息通过区块交易的形式广播到区块链网络,该区块交易包括CA-A证书ID、网元A证书、网元A证书的证书状态信息。
示例性地,当区块链网络维护多个区块链时,CA-A证书ID、网元A证书、网元A证书的证书状态信息和区块链标识通过区块交易的形式广播到区块链网络,该区块交易包括CA-A证书ID、网元A证书、网元A证书的证书状态信息和区块链标识。或者,当区块链网络维护多个区块链时,CA-A证书ID、网元A证书、网元A证书的证书状态信息通过区块交易的形式广播到区块链网络,该区块交易包括CA-A证书ID、网元A证书、网元A证书的证书状态信息。NRF同时广播区块链标识。
进一步地,区块链网络中的节点接收到该区块交易后使用共识算法形成新区块,该新区块包含该区块交易、新区块标识和区块链标识。在区块链网络中,最快生成新区块的节点将该新区块以广播消息的形式广播到该区块链网络,其余节点接收到该广播消息,并使用共识算法验证该新区块有效后存储该区块并更新对应区块链,停止根据该区块交易生成新区块,其中新区块标识为区块B1的标识和区块链标识为区块链B的标识。其中,该区块交易可以通过区块交易标识和/或区块交易哈希值标识来识别。
需要说明的是,基于上述假设2,区块链B与区块链A不同。
可选的,NRF也可在本步骤上述流程中,将网元A证书的标识(网元A证书ID)而非网元A证书公布到区块链网络。该区块交易和新区块B1包括网元A证书的标识,而不包括网元A证书。
步骤17:NRF接收广播信息,保存网元A的网元证书映射关系。
具体的,NRF接收步骤16中包括区块B1的广播消息,该广播消息指示区块链标识、区块标识、CA-A证书ID和网元A证书ID对应关系,其中该区块链标识为区块链B的标识,区块标识为区块B1的标识。或者,该广播消息指示区块链标识、区块标识、CA-A证书ID、网元A证书ID和网元A证书的证书状态信息的对应关系,其中该区块链标识为区块链B的标识,区块标识为区块B1的标识。
其中,上述广播消息所指示的对应关系对应上述示例1所示的第一映射关系和第三映射关系,具体如表7A所示。NRF保存区块B1,将区块B1更新到区块链B末端。NRF根据区块B1可以确定上述映射关系,NRF保存上述映射关系。
表7A.NRF对网元A的网元证书映射关系
步骤18:NRF向CA-A发送上链确认消息,该上链确认消息用于指示网元A的证书的证书状态信息已公布到区块链网络。
同样的,CA-B和NRF执行类似步骤19-22,将网元B的证书或网元B的证书的标识(网元B证书ID)公布到区块链网络。NRF接收广播消息,该广播消息指示CA-A证书ID、区块链标识,区块标识,CA-B证书ID、网元B证书ID的对应关系,或者,该广播消息指示CA-A证书ID、区块链标识,区块标识,CA-B证书ID、网元B证书ID和网元B证书的证书状态信息的对应关系,其中,该区块链标识为区块链B的标识,区块标识为区块B2的标识,如表7B所示。NRF保存区块B2,将区块B2更新到区块链B末端。NRF根据区块B2可以确定上述映射关系,NRF保存上述映射关系。
区块B2和区块B1可为同一区块,也可为不同区块。示例性地,区块链网络中的节点可将一段时间内接收到的所有区块交易使用共识算法形成新区块,当网元A证书和网元B证书,或网元A证书的标识和网元B证书的标识在该段时间内均被公布到区块链网络时,区块B1和区块B2可以为同一区块,否则区块B1和区块B2是不同的区块。
表7B.NRF对网元B的网元证书映射关系
在另一种可能的实现中,对于步骤16-18,NRF还可以将CA-A证书ID、网元A的证书的标识和网元A的证书的证书状态信息公布至区块链标识对应的区块链网络,具体过程与NRF将CA-A证书ID、网元A的证书和网元A的证书的证书状态信息公布至区块链网络类似,重复之处不再赘述。对于步骤19-22,NRF还可以将CA-A证书ID、网元B的证书的标识和网元B的证书的证书状态信息公布至区块链标识对应的区块链网络,具体过程与NRF将CA-A证书ID、网元B的证书和网元B的证书的证书状态信息公布至区块链标识对应的区块链网络类似,重复之处不再赘述。
步骤23:CA-B触发对网元B证书执行吊销,CA-B向NRF发送网元B证书ID和证书状态信息。证书状态信息指示CA-B证书的吊销原因值。需要说明的是,此时以CA-B触发对网元B证书吊销为例,实际情况中任何CA都可吊销其管辖的网元的证书。
步骤24:NRF根据网元B证书ID查找网元证书映射关系获取区块链标识(区块链B的标识),将网元B证书ID、证书状态信息公布到区块链标识对应的区块链网络。
示例性地,当区块链网络仅维护一个区块链时,网元B证书ID、证书状态信息通过区块交易的形式广播到区块链网络,该区块交易包括网元B证书ID、证书状态信息。
示例性地,当区块链网络维护多个区块链时,网元B证书ID、证书状态信息和区块链标识通过区块交易的形式广播到区块链网络,该区块交易包括网元B证书ID、证书状态信息和区块链标识。或者,当区块链网络维护多个区块链时,网元B证书ID、证书状态信息通过区块交易的形式广播到区块链网络,该区块交易包括网元B证书ID、证书状态信息。NRF同时广播区块链标识。
区块链网络中的节点接收到该区块交易后使用共识算法形成新区块,该新区块包含该区块交易、新区块标识信息和区块链标识信息。在区块链网络中,最快生成新区块的节点将该新区块以广播消息的形式广播到该区块链网络,其余节点接收到该广播消息,并使用共识算法验证该新区块有效后存储该区块并更新对应区块链停止根据该区块交易生成新区块,其中新区块标识为区块B3的标识和区块链标识为区块链B的标识。其中,该区块交易可以通过区块交易标识和/或区块交易哈希值标识来识别。
步骤25:NRF接收广播信息,保存更新后的网元B的网元证书映射关系。
NRF接收步骤24包含区块B3的广播消息,该广播消息指示区块链标识,区块标识,CA-B证书ID、网元B证书ID的对应关系,或者,该广播消息指示区块链标识,区块标识,CA-B证书ID、网元B证书ID和网元B证书的证书状态信息的对应关系,其中,该区块链标识为区块链B的标识,区块标识为区块B3的标识。
其中,上述广播消息所指示的对应关系对应上述示例1所示的更新后的第一映射关系,以及第三映射关系,其中,第三映射关系未更新,具体如表8所示。NRF保存区块B3,将区块B3更新到区块链B末端。NRF根据区块B3可以确定上述映射关系,NRF保存上述映射关系。
表8.NRF更新过后(吊销网元B证书后)的网元B的网元证书映射关系
步骤26:NRF向CA-B发送上链确认消息。该上链确认消息用于指示网元B的证书的证书状态信息已公布到区块链网络。
步骤27:网元A和网元B发起连接请求,其中互相交互本端证书,用于标识本端身份和所持公钥所有权。其中,携带证书的消息可以是TLS连接建立握手期间通过服务证书(server certificate)或用户证书(client certificate)携带证书,也可为IPSec连接建立在IKE_AUTH消息中携带证书,也可以是其他需要携带证书的场景,此处不做限定。
步骤28:网元A获取网元B证书后,网元A向NRF发送网元B证书或网元B证书ID,用以向NRF请求验证网元B证书是否吊销和验证网元B证书的数字签名是否有效。
示例性地,网元B证书可以由NRF的网元状态通知订阅(Nnrf_NFManagement_NFStatusSubscribe)消息或NRF的网元发现(Nnrf_NFDiscovery)消息承载。
步骤29:NRF根据网元B证书中的网元B证书ID查找更新后的网元B的网元证书映射关系(如表8)获取证书状态信息。
具体的,如果网元证书映射关系不包括证书状态信息,则NRF根据网元B证书ID查找网元证书映射关系获取区块链标识和区块标识(分别为区块链B的标识和区块B3的标识),通过获取区块链B的标识和区块B3的标识从区块链B中获取区块B3,并在该区块B3内通过网元B证书ID查询网元B的证书的证书状态信息。由于在步骤23中CA-B已吊销网元B证书,NRF确定证书状态信息指示网元B证书已吊销和网元B证书的吊销原因值,例如网元B私钥已泄露,或网元B为恶意用户等,此处不做限定。
步骤30:NRF根据网元B证书中的网元B证书ID查找更新后的网元B的网元证书映射关系(如表8)获取CA证书ID,即CA-B证书ID,以此为索引查找CA-B证书的CA证书映射关系(如表5)获取CA-B的公钥。具体的,以CA-B证书ID为索引查找CA-B证书的CA证书映射关系(如表5)获取区块链标识和区块标识(分别为区块链A的标识和区块A2的标识),通过获取的区块链A的标识和区块A2的标识从区块链A中获取区块A2,并在区块A2内通过CA-B证书ID查询CA-B的证书,CA-B的证书包括CA-B的公钥。
步骤31:NRF验证网元B证书的数字签名是否有效。
步骤32:NRF将步骤29中查找的证书状态信息和网元B证书的数字签名是否有效的结果发送给网元A。
此外,作为一种可能的实现方式,NRF在获取CA-B公钥后不在本地验证网元B证书 的数字签名,NRF将CA-B公钥和步骤29中查找的证书状态信息发送给网元A,由网元A验证网元B证书的数字签名有效性。
作为一种可能的实现方式中,NRF确定网元B证书的证书状态信息指示网元B的证书被吊销,则NRF可以不执行获取CA-B公钥,进而不需要验证网元B证书的数字签名有效性。
其中,步骤32所示的消息可以是NRF的网元状态通知(Nnrf_NFManagement_NFStatusNotify)消息或Nnrf_NFDiscovery消息的回复消息。
步骤33:网元A根据NRF返回的证书状态信息确定网元B证书被吊销,停止与网元B的连接建立流程并拆除连接。
需要说明的是,只有在NRF返回的证书状态信息显示证书有效,且网元B证书的数字签名有效的情况下,网元A才继续后续的连接建立流程。网元A获知网元B证书的数字签名有效可以是由NRF告知,也可以是自己本地使用CA-B公钥对网元B证书的数字签名进行验证。
对应的,网元B也验证网元A发来的证书,由于CA-A没有吊销网元A证书,所以网元B从NRF获知网元A证书未被吊销且网元A证书的数字签名有效。
需要说明的是,步骤28-33可以在网元A和网元B连接建立中执行,如证书被吊销或证书的数字签名无效则停止连接建立,也可在连接建立后再执行,如证书被吊销或证书的数字签名无效则拆除连接。
需要说明的是,步骤23-33以CA-B吊销网元B证书,后续网元A请求验证该被吊销的网元证书为例进行说明,实际情况CA-A也可吊销网元A的证书,CA-B也可不吊销网元B证书,此处不再赘述。
采用上述实施例1,管理设备可以通过区块链方式维护CA证书映射关系和网元证书映射关系,并基于维护的上述映射关系查询最新的证书状态信息和CA公钥。
实施例二:
以下以NRF维护多个区块链为例进行说明证书查询过程,如图5A和图5B所示。
步骤1至步骤10可以参考上述实施例一的相关描述,重复之处不再赘述。
步骤11:网元A在本地生成自己的公钥和私钥,并将公钥发送给CA-A以请求CA-A为网元A签发证书。
步骤12:CA-A根据网元A的公钥生成网元A的证书,并将生成的证书和CA-A证书ID发送给网元A。其中网元A证书可以包括如表6A所示的信息。
同样的,网元B执行步骤13-14,从CA-B获取网元B的证书。
步骤13:网元B在本地生成自己的公钥和私钥,并将公钥发送给CA-B以请求CA-B为网元B签发证书。其中网元B书可以包括如表6B的信息。
步骤14:CA-B根据网元B的公钥生成网元B的证书,并将生成的证书和CA-B证书ID发送给网元B。其中网元B证书可以包括如表6B所示的信息。
步骤15:CA-B触发对网元B证书执行吊销,CA-B向NRF发送网元B证书ID、证书状态信息和网元B证书的适用范围。证书状态信息指示CA-B证书的吊销原因值。需要说明的是,此时以CA-B触发对网元B证书吊销为例,实际情况中任何CA都可吊销其管辖的网元的证书。
类似的,这里可以参考实施例一中的步骤2的相关描述,以下仅以CA-B携带网元B证书的证书适用范围为例进行说明。
步骤16:NRF根据网元B证书的适用范围确定对应的区块链标识,此处记为区块链B的标识。NRF将网元B证书ID和证书状态信息公布到区块链标识对应的区块链网络。NRF将网元B证书ID、证书状态信息公布到区块链网络。
示例性地,当区块链网络仅维护一个区块链时,该区块链即区块链B,网元B证书ID、证书状态信息通过区块交易的形式广播到区块链网络,该区块交易包括网元B证书ID、证书状态信息。可选的,如果区块链网络进维护一个区块链,此时区块链的标识信息可为区块链网络的标识信息。
示例性地,当区块链网络维护多个区块链时,网元B证书ID、证书状态信息和区块链标识通过区块交易的形式广播到区块链网络,该区块交易包括网元B证书ID、证书状态信息和区块链标识。或者,当区块链网络维护多个区块链时,网元B证书ID、证书状态信息通过区块交易的形式广播到区块链网络,该区块交易包括网元B证书ID、证书状态信息,此外,NRF同时广播区块链标识。
区块链网络中的节点接收到该区块交易后使用共识算法形成新区块,该新区块包含该区块交易、新区块标识和区块链标识。在区块链网络中,最快生成新区块的节点将该新区块以广播消息的形式广播到该区块链网络,其余节点接收到该广播消息,并使用共识算法验证该新区块有效后存储该区块并更新对应区块链停止根据该区块交易生成新区块,其中,新区块标识为区块B1的标识和区块链标识为区块链B的标识。其中,该区块交易可以通过区块交易标识和/或区块交易哈希值标识来识别。
步骤17:NRF接收广播信息,保存网元B的网元证书映射关系。
其中,NRF接收步骤16中包括区块B1的广播消息,该广播消息指示区块链标识、区块标识和网元B证书ID的对应关系,其中该区块链标识为区块链B的标识,区块标识为区块B1的标识。
因此,NRF可以确定具体如表9所示的对应关系,记为NRF在网元B证书吊销后维护的网元B的网元证书映射关系。NRF保存区块B1,将区块B1更新到区块链B末端作为区块链B最后一个区块。NRF根据区块B1可以确定上述映射关系,NRF保存上述映射关系。
表9.NRF在网元B证书吊销后维护的网元B的网元证书映射关系
在另一种可能的实现方式中,在步骤15中,CA-B向NRF发送网元B证书ID、证书状态信息、网元B证书的适用范围和CA-B证书ID。证书状态信息指示CA-B证书的吊销原因值。在步骤16中,NRF将网元B证书ID、证书状态信息和CA-B证书ID公布到区 块链网络,则在步骤17中,NRF可以确定具体如表10所示的对应关系。
表10NRF在网元B证书吊销后维护的网元B的网元证书映射关系
步骤18:NRF向CA-B发送上链确认消息。该上链确认消息用于指示网元B的证书的证书状态信息已公布到区块链网络。
步骤19:网元A和网元B发起连接请求,其中互相交互本端证书,用于标识本端身份和所持公钥所有权。网元还需将获取自己证书时一同获取的CA证书ID发送给对端,具体的,网元A在步骤12中获取了网元A的证书,和CA-A证书ID,则在网元A和网元B发起连接请求时,网元A需将网元A的证书和CA-A证书ID一同发送给网元B;网元B在步骤14中获取了网元B的证书,和CA-B证书ID,则在网元A和网元B发起连接请求时,网元B需将网元B的证书和CA-B证书ID一同发送给网元A。
步骤20:网元A获取网元B证书后,网元A向NRF发送网元B证书和CA-B证书ID,或者网元A向NRF发送网元B证书ID和CA-B证书ID,用以向NRF请求验证网元B证书是否吊销和验证网元B证书的数字签名是否有效。
步骤21:NRF根据CA-B证书ID查找CA-B证书的CA证书映射关系(如表5)获取CA-B的公钥。具体的,NRF根据CA-B证书ID查找表5,获取区块链标识和区块标识(分别为区块链A的标识和区块A2的标识),通过获取的区块链A的标识和区块A2的标识从区块链A中获取区块A2,并在区块A2内通过CA-B证书ID查询CA-B的证书,CA-B的证书包括CA-B的公钥。NRF。
步骤22:NRF将CA-B公钥发送给网元A。由网元A验证网元B证书的数字签名有效性。
此外,在另一种可能的实现方式中,NRF验证网元B证书的数字签名是否有效,NRF将步骤24中查找的证书状态信息和网元B证书的数字签名是否有效的结果发送给网元A。
步骤23:NRF根据网元B证书中的网元B证书ID查找网元B的网元证书映射关系(如表9或表10)获取证书状态信息。
具体的,如果网元证书映射关系不包括证书状态信息,则NRF根据网元B证书ID查找网元证书映射关系获取区块链标识和区块标识(分别为区块链B的标识和区块B1的标识),通过获取的区块链B的标识和区块B1的标识从区块链B中获取区块B1,并在该区块B3内通过网元B证书ID查询并获取网元B的证书对应的证书状态信息。由于在步骤15-18中CA-B已吊销网元B证书,NRF确定证书状态信息指示网元B证书的吊销原因值,例如网元B私钥已泄露,或网元B为恶意用户等,此处不做限定。
在另一种可能的实现方式中,NRF确定网元B证书的证书状态信息指示网元B的证书被吊销,则NRF可以不执行获取CA-B公钥,进而不需要验证网元B证书的数字签名有效性。
步骤24:NRF向网元A发送证书状态信息。
步骤25:网元A根据NRF返回的证书状态信息确定网元B证书被吊销,停止与网元B的连接建立流程并拆除连接。
需要说明的是,只有在NRF返回的证书状态信息显示证书有效,且网元B证书的数字签名有效的情况下,网元A才继续后续的连接建立流程。网元A获知网元B证书的数字签名有效可以是由NRF告知,也可以是自己本地使用CA-B公钥对网元B证书的数字签名进行验证。
对应的,网元B也验证网元A发来的证书,由于CA-A没有吊销网元A证书,NRF查询表9或表10无法获得网元A的标识,进而无法获得网元A的证书对应的证书状态信息,在这种情况下NRF默认确定网元A证书未被吊销。
需要说明的是,步骤20-24可以在网元A和网元B连接建立中执行,如证书被吊销或证书的数字签名无效则停止连接建立,也可在连接建立后再执行,如证书被吊销或证书的数字签名无效则拆除连接。
需要说明的是,步骤15-24以CA-B吊销网元B证书,后续网元A请求验证该被吊销的网元证书为例进行说明,实际情况CA-A也可吊销网元A的证书,CA-B也可不吊销网元B证书,此处不再赘述。
采用上述实施例2,管理设备可以通过区块链方式维护CA证书映射关系和被吊销的网元的证书映射关系,并基于维护的上述映射关系查询最新的证书状态信息和CA公钥,相较于实施例1可以节省未被吊销的网元的证书上链所需的信令开销。
实施例三:
以下以NRF仅维护一个区块链(例如区块链A)为例进行说明证书查询过程,如图6A和图6B所示。
步骤1:CA-A生成自签名的证书。其中,CA-A独立生成私钥和对应的公钥,并生成自己的证书,CA-A证书使用CA-A的私钥进行自签名。其中,CA-A证书可以包括如表2中内容。
步骤2:CA-A向NRF发送CA-A证书。
在一些实施例中,NRF可以负责多个使用场景的单个区块链维护,即NRF仅维护一个区块链。例如,NRF同时为TLS通信、IPSec通信等场景维护区块链,但是这些场景所对应的证书维护在一条区块链上,即不同使用场景的证书和/或证书的标识(例如TLS证书或IPSec的证书)可以维护在同一个区块链上。由CA-A根据CA-A证书的证书适用范围选择NRF。
在一些实施例中,NRF可以负责单一特定场景的单一区块链维护,即NRF仅维护一个区块链,由第一CA根据证书适用范围选择NRF。例如,NRF专门服务TLS通信场景的区块链,所有TLS场景对应的证书均维护在一条区块链之上,在CA将网元证书上链时,根据证书是在TLS场景使用,选择专门负责TLS通信场景的NRF。
步骤3:NRF将CA-A证书公布到区块链网络。
CA-A证书通过区块交易的形式广播到区块链网络,该区块交易包括CA-A证书。区块链网络中的节点接收到该区块交易后使用共识算法形成新区块,该新区块包含该区块交易、新区块标识。在区块链网络中,最快生成新区块的节点将该新区块以广播消息的形式广播到该区块链网络,其余节点接收到该广播消息,并使用共识算法验证该新区块有效后存储该区块、更新对应区块链并停止根据该区块交易生成新区块,其中,新区块标识为区块A1的标识。其中,该区块交易可以通过区块交易标识和/或区块交易哈希值标识来识别。
步骤4:NRF接收广播消息,保存CA-A证书的CA证书映射关系。
其中,NRF接收步骤3中包括区块A1的广播消息,该广播消息指示区块标识和CA-A证书的ID的对应关系,其中,区块标识为区块A1的标识。因此,NRF可以确定具体如表11所示的对应关系,记为CA-A证书的CA证书映射关系。NRF保存区块A1,将区块A1更新到区块链A末端。NRF根据区块A1可以确定上述映射关系,NRF保存上述映射关系。
表11.NRF对CA-A证书的CA证书映射关系
其中,区块标识和CA-A证书的ID的对应关系可以对应上述第二映射关系。
步骤5:NRF向CA-A发送证书上链确认消息。该上链确认消息用于指示CA-A的证书已公布到区块链网络。
同理,CA-B和NRF执行类似步骤1-5的步骤6-10。可以理解的是,本申请实施例不限定步骤1-5与步骤6-10的先后顺序。
步骤6:CA-B独立生成私钥和对应的公钥,并生成自己的证书,CA-B证书使用CA-B的私钥进行自签名。
步骤7:CA-B向NRF发送CA-B证书。
类似于上述步骤2的相关内容,重复之处不再赘述。
步骤8:NRF将CA-B证书公布到区块链网络。
CA-B证书通过区块交易的形式广播到区块链网络,该区块交易包括CA-B证书。区块链网络中的节点接收到该区块交易后使用共识算法形成新区块,该新区块包含该区块交易、新区块标识。在区块链网络中,最快生成新区块的节点将该新区块以广播消息的形式广播到该区块链网络,其余节点接收到该广播消息,并使用共识算法验证该新区块有效后存储该区块、更新对应区块链并停止根据该区块交易生成新区块,其中,新区块标识为区块A2的标识。其中,该区块交易可以通过区块交易标识和/或区块交易哈希值标识来识别。
步骤9:NRF接收广播消息,保存CA-B证书的CA证书映射关系。
其中,NRF接收步骤8中包括区块A2的广播消息,该广播消息包括区块标识和CA-B证书的ID的对应关系,其中,区块标识为区块A2的标识。因此,NRF可以确定具体如表12所示的对应关系,记为CA-B证书的CA证书映射关系。NRF保存区块A2,将区块A2更新到区块链A末端。NRF根据区块A2可以确定上述映射关系,NRF保存上述映射关系。
其中,区块A2和区块A1可为同一区块,也可为不同区块。示例性地,区块链网络中的节点可将一段时间内接收到的所有区块交易使用共识算法形成新区块,当CA-B证书和 CA-A证书在该段时间内均被公布到区块链网络时,区块A2和区块A1可以为同一区块,否则区块A2和区块A1是不同的区块。
表12.NRF对CA-B证书的CA证书映射关系
步骤10:NRF向CA-B发送上链确认消息。该上链确认消息用于指示CA-B的证书已公布到区块链网络。
步骤11:网元A在本地生成自己的公钥和私钥,并将公钥发送给CA-A以请求CA-A为网元A签发证书。
步骤12:CA-A根据网元A的公钥生成证书,并将证书发送给网元A。其中网元A证书可以包括如表6A示的信息。
同样的,网元B执行步骤13-14,从CA-B获取网元B的证书。
步骤13:网元B在本地生成自己的公钥和私钥,并将公钥发送给CA-B以请求CA-B为网元B签发证书。其中网元B证书可以包括如表6B示的信息。
步骤14:CA-B根据网元B的公钥生成证书,并将证书发送给网元B。
步骤15:CA-A向NRF将发送网元A证书、网元A证书的证书状态信息和CA-A的证书ID。网元A证书的证书状态信息指示网元A证书未被吊销,或者网元A证书有效。
类似于上述步骤2的相关内容,重复之处不再赘述。
可选的,CA-A也可在本步骤流程中,将网元A证书的标识(网元A证书ID)而非网元A证书发送给NRF。
步骤16:NRF将网元A证书、网元A证书的证书状态信息公布到区块链网络。
网元A证书、网元A证书的证书状态信息通过区块交易的形式广播到区块链网络,该区块交易包括网元A证书、网元A证书的证书状态信息。区块链网络中的节点接收到该区块交易后使用共识算法形成新区块,该新区块包含该区块交易、新区块标识。在区块链网络中,最快生成新区块的节点将该新区块以广播消息的形式广播到该区块链网络,其余节点接收到该广播消息后,使用共识算法验证该新区块有效后存储该区块并更新对应区块链,停止根据该区块交易生成新区块,其中,新区块标识为区块B1的标识。其中,该区块交易可以通过区块交易标识和/或区块交易哈希值标识来识别。
可选的,NRF也可在本步骤上述流程中,将网元A证书的标识(网元A证书ID)而非网元A证书公布到区块链网络。该区块交易和新区块B1包括网元A证书的标识,而不包括网元A证书。
步骤17:NRF接收广播信息,保存网元A的网元证书映射关系。
其中,NRF接收步骤16中包括区块B1的广播消息,该广播消息指示区块标识、CA-A证书ID和网元A证书ID对应关系,其中,区块标识为区块B1的标识。或者,该广播消息指示区块标识、CA-A证书ID、网元A证书ID和网元A证书的证书状态信息的对应关系,其中,区块标识为区块B1的标识。其中,上述广播消息所指示的对应关系对应上述示例1所示的第一映射关系和第三映射关系,具体如表13A所示。NRF保存区块B1,将 区块B1更新到区块链A末端。NRF根据区块B1可以确定上述映射关系,NRF保存上述映射关系。
表13A.NRF对网元A的网元证书映射关系
步骤18:NRF向CA-A发送上链确认消息,该上链确认消息用于指示网元A的证书的证书状态信息已公布到区块链网络。
同样的,CA-B和NRF执行类似步骤19-22,将网元B的证书或网元B的证书的标识公布到区块链网络。NRF接收广播消息,该广播消息指示区块标识,CA-B证书ID、网元B证书ID的对应关系,或者,该广播消息指示区块标识,CA-B证书ID、网元B证书ID和网元B证书的证书状态信息的对应关系,如表13B所示。其中,区块标识为区块B2的标识。NRF保存区块B2,将区块B2更新到区块链A末端。NRF根据区块B2可以确定上述映射关系,NRF保存上述映射关系。
表13B.NRF对网元B的网元证书映射关系
区块B2和区块B1可为同一区块,也可为不同区块。示例性地,区块链网络中的节点可将一段时间内接收到的所有区块交易使用共识算法形成新区块,当网元A证书和网元B证书,或网元A证书的标识和网元B证书的标识在该段时间内均被公布到区块链网络时,区块B1和区块B2可以为同一区块,否则区块B1和区块B2是不同的区块。
步骤23:CA-B触发对网元B证书执行吊销,CA-B向NRF发送网元B证书ID和证书状态信息。证书状态信息指示CA-B证书的吊销原因值。
步骤24:NRF将网元B证书ID、证书状态信息公布到区块链网络。
网元B证书ID、证书状态信息通过区块交易的形式广播到区块链网络,该区块交易包括网元B证书ID和证书状态信息。区块链网络中的节点接收到该区块交易后使用共识算法形成新区块,该新区块包含该区块交易、新区块标识信息。在区块链网络中,最快生成新区块的节点将该新区块以广播消息的形式广播到该区块链网络,其余节点接收到该广播消息后,使用共识算法验证该新区块有效后存储该区块、更新对应区块链并停止根据该区 块交易生成新区块,其中新区块标识为区块B3的标识。其中,该区块交易可以通过区块交易标识和/或区块交易哈希值标识来识别。
步骤25:NRF接收广播信息,保存更新后的网元B的网元证书映射关系。
NRF接收步骤24包含区块B3的广播消息,该广播消息指示区块标识,CA-B证书ID、网元B证书ID的对应关系,或者,该广播消息指示区块标识,CA-B证书ID、网元B证书ID和网元B证书的证书状态信息的对应关系,其中,区块标识为区块B3的标识。其中,上述广播消息所指示的对应关系对应上述示例1所示的更新后的第一映射关系,以及第三映射关系,其中,第三映射关系未更新,具体如表14所示。NRF保存区块B3,将区块B3更新到区块链A末端。NRF根据区块B3可以确定上述映射关系,NRF保存上述映射关系。
表14.NRF更新过后(吊销网元B证书后)的网元B的网元证书映射关系
步骤26:NRF向CA-B发送网元证书上链确认消息。该上链确认消息用于指示网元B的证书的证书状态信息已公布到区块链网络。
步骤27:网元A和网元B发起连接请求,其中互相交互本端证书,用于标识本端身份和所持公钥所有权。
步骤28:网元A获取网元B证书后,网元A向NRF发送网元B证书,用以向NRF请求验证网元B证书是否吊销和验证网元B证书的数字签名是否有效。
步骤29:NRF根据网元B证书中的网元B证书ID查找更新后的网元B的网元证书映射关系(如表14)获取证书状态信息。
具体的,如果网元证书映射关系不包括证书状态信息,则NRF根据网元B证书ID查找网元证书映射关系获取区块标识(区块B3的标识),通过获取的区块B3的标识从区块链A中获取区块B3,并在该区块B3内通过网元B证书ID查询并获取网元B的证书的证书状态信息。
由于在步骤23中CA-B已吊销网元B证书,NRF确定证书状态信息指示网元B证书已吊销和网元B证书的吊销原因值,例如网元B私钥已泄露,或网元B为恶意用户等,此处不做限定。
步骤30:NRF根据网元B证书中的网元B证书ID查找更新后的网元B的网元证书映射关系(如表14)获取CA证书ID,即CA-B证书ID,以此为索引查找CA-B证书的CA证书映射关系(如表12)获取CA-B的公钥。
具体的,NRF以CA-B证书ID为索引查找CA证书映射关系(如表12)获取区块标识(区块A2的标识),通过获取的区块A2的标识从区块链A中获取区块A2,并在区块A2内通过CA-B证书ID查询CA-B的证书,CA-B的证书包括CA-B的公钥。
步骤31至步骤33可以参考上述实施例一的相关描述,重复之处不再赘述。
采用上述实施例3,管理设备可以通过区块链方式维护CA证书映射关系和网元证书映射关系,并基于维护的上述映射关系查询最新的证书状态信息和CA公钥。
实施例四:
以下以NRF维护多个区块链为例进行说明证书查询过程,如图7A和图7B所示。
步骤1步骤10可以参考上述实施例一的相关描述,重复之处不再赘述。
步骤11:网元A在本地生成自己的公钥和私钥,并将公钥发送给CA-A以请求CA-A为网元A签发证书。
步骤12:CA-A根据网元A的公钥生成证书,并将证书发送给网元A。其中网元A证书可以包括如表15A所示的信息。相比表6所示的信息,表15A新增了CA证书ID,即CA-A证书ID。
表15A.CA-A为网元A签发的证书内容
同样的,网元B执行步骤13-14,从CA-B获取网元B的证书。
步骤13:网元B在本地生成自己的公钥和私钥,并将公钥发送给CA-B以请求CA-B为网元B签发证书。
步骤14:CA-B根据网元B的公钥生成证书,并将证书发送给网元B。
同理,CA-B为网元B的生成的证书,也新增了CA证书ID,即CA-B证书ID,如表15B所示。
表15B.CA-B为网元B签发的证书内容
步骤15:CA-A向NRF发送网元A证书、网元A证书的证书状态信息和网元A证书的适用范围。网元A证书的证书状态信息指示网元A证书未被吊销,或者网元A证书有效。
类似的,这里可以参考实施例一中的步骤2的相关描述,以下仅以CA-A携带网元A证书的证书适用范围为例进行说明。
需要说明的是,NRF可以根据CA-A证书的ID查询CA证书映射关系(如表3所示)获取区块链标识和区块标识(分别为区块链A的标识和区块A1的标识),通过获取的区块链A的标识和区块A1的标识从区块链A中获取区块A1,得到CA-A的公钥。该CA-A公钥用于验证网元A证书中的数字签名是否有效。在确认网元A证书中的数字签名有效时,继续执行下述步骤。
步骤16:NRF根据网元A证书的适用范围选择对应的区块链标识,记为区块链B的标识。NRF将网元A证书、网元A证书的证书状态信息公布到区块链标识对应的区块链网络。
网元A证书、网元A证书的证书状态信息和区块链标识通过区块交易的形式广播到区块链网络,该区块交易包括网元A证书、网元A证书的证书状态信息和区块链标识。区块链网络中的节点接收到该区块交易后使用共识算法形成新区块,该新区块包含该区块交易、新区块标识和区块链标识。在区块链网络中,最快生成新区块的节点将该新区块以广播消息的形式广播到该区块链网络,其余节点接收到该广播消息,并使用共识算法验证该新区块有效后存储该区块并更新对应区块链,停止根据该区块交易生成新区块,其中新区块标识为区块B1的标识和区块链标识为区块链B的标识。其中,该区块交易可以通过区块交易标识和/或区块交易哈希值标识来识别。
需要说明的是,基于上述假设2,区块链B与区块链A不同。
步骤17:NRF接收广播信息,保存更新后的网元A的网元证书映射关系。
NRF接收步骤16中包括区块B1的广播消息,该广播消息指示区块链标识、区块标识和网元A证书ID对应关系,其中该区块链标识为区块链B的标识,区块标识为区块B1的标识。或者,该广播消息指示区块链标识、区块标识、网元A证书ID和网元A证书的证书状态信息的对应关系,其中该区块链标识为区块链B的标识,区块标识为区块B1的标识。
其中,上述广播消息所指示的对应关系对应上述示例1所示的第一映射关系和第三映射关系,具体如表16A所示。NRF保存区块B1,将区块B1更新到区块链B末端。NRF根据区块B1可以确定上述映射关系,NRF保存上述映射关系。
表16A.NRF对网元A的网元证书映射关系
步骤18:NRF向CA-A发送上链确认消息,该上链确认消息用于指示网元A的证书的证书状态信息已公布到区块链网络。
同样的,CA-B和NRF执行类似步骤19-22,将网元B的证书公布到区块链网络。NRF接收广播消息,该广播消息指区块链标识,区块标识,CA-B证书ID、网元B证书ID的对应关系,或者,该广播消息指示区块链标识,区块标识,CA-B证书ID、网元B证书ID和网元B证书的证书状态信息的对应关系,其中,该区块链标识为区块链B的标识,区块标识为区块B2的标识。NRF保存区块B2,将区块B2更新到区块链B末端。NRF根据区块B2可以确定上述映射关系,NRF保存上述映射关系,如表16B所示。
表16B.NRF对网元B的网元证书映射关系
区块B2和区块B1可为同一区块,也可为不同区块。示例性地,区块链网络中的节点可将一段时间内接收到的所有区块交易使用共识算法形成新区块,当网元A证书和网元B证书在该段时间内均被公布到区块链网络时,区块B1和区块B2可以为同一区块,否则区块B1和区块B2是不同的区块。
步骤23:CA-B触发对网元B证书执行吊销,CA-B向NRF发送网元B证书和证书状态信息。证书状态信息指示CA-B证书的吊销原因值。其中,网元B证书包括网元B证书ID信息。
步骤24:NRF根据网元B证书中的网元B证书ID查找网元证书映射关系获取区块链标识(区块链B的标识),将网元B证书、证书状态信息公布到区块链标识对应的区块链网络。
示例性地,当区块链网络仅维护一个区块链时,网元B证书、证书状态信息通过区块交易的形式广播到区块链网络,该区块交易包括网元B证书、证书状态信息。
示例性地,当区块链网络维护多个区块链时,网元B证书、证书状态信息和区块链标识通过区块交易的形式广播到区块链网络,该区块交易包括网元B证书、证书状态信息和区块链标识。或者,当区块链网络维护多个区块链时,网元B证书、证书状态信息通过区块交易的形式广播到区块链网络,该区块交易包括网元B证书、证书状态信息,NRF同时广播区块链标识。
区块链网络中的节点接收到该区块交易后使用共识算法形成新区块,该新区块包含该区块交易、新区块标识信息和区块链标识信息。在区块链网络中,最快生成新区块的节点将该新区块以广播消息的形式广播到该区块链网络,其余节点接收到该广播消息,并使用共识算法验证该新区块有效后存储该区块并更新对应区块链停止根据该区块交易生成新区块,其中新区块标识为区块B3的标识和区块链标识为区块链B的标识。其中,该区块交易可以通过区块交易标识和/或区块交易哈希值标识来识别。
步骤25:NRF接收广播信息,保存更新后的网元B的网元证书映射关系。
NRF接收步骤24包含区块B3的广播消息,该广播消息指示区块链标识,区块标识,网元B证书ID的对应关系,或者,该广播消息指示区块链标识,区块标识,网元B证书ID和网元B证书的证书状态信息的对应关系,其中,该区块链标识为区块链B的标识,区块标识为区块B3的标识。其中,上述广播消息所指示的对应关系对应上述示例1所示的更新后的第一映射关系,以及第三映射关系,其中,第三映射关系未更新,具体如表17所示。NRF保存区块B3,将区块B3更新到区块链B末端。NRF根据区块B3可以确定上述映射关系,NRF保存上述映射关系。
表17.NRF更新过后(吊销网元B证书后)的网元B的网元证书映射关系
步骤26:NRF向CA-B发送上链确认消息。该上链确认消息用于指示网元B的证书的证书状态信息已公布到区块链网络。
步骤27:网元A和网元B发起连接请求,其中互相交互本端证书,用于标识本端身份和所持公钥所有权。
根据网元A向NRF发送的内容不同,可以包括但不限于以下两种实现方式:
第一种实现方式执行下述步骤28a至步骤30a,第二种实现方式执行下述步骤28b至步骤30b。
第一种实现方式:
步骤28a:网元A获取网元B证书后,网元A向NRF发送网元B证书,用以向NRF请求验证网元B证书是否吊销和验证网元B证书的数字签名是否有效。
步骤29a:NRF根据网元B证书中的网元B证书ID查找更新后的网元B的网元证书映射关系(如表17)获取证书状态信息。
具体的,如果网元证书映射关系不包括证书状态信息,则NRF根据网元B证书ID查找网元证书映射关系获取区块链标识和区块标识(分别为区块链B的标识和区块B3的标识),通过获取区块链B的标识和区块B3的标识从区块链B中获取区块B3,并在该区块B3内通过网元B证书ID查询网元B的证书的证书状态信息。由于在步骤23中CA-B已吊销网元B证书,NRF确定证书状态信息指示网元B证书已吊销和网元B证书的吊销原因值,例如网元B私钥已泄露,或网元B为恶意用户等,此处不做限定。
步骤30a:NRF根据网元B证书中的CA证书ID,即CA-B证书ID,以此为索引查找CA-B证书的CA证书映射关系(如表5)获取CA-B的公钥。
NRF以CA-B证书ID为索引查找CA-B证书的CA证书映射关系(如表5)获取区块链标识和区块标识(分别为区块链A的标识和区块A2的标识),通过获取的区块链A的标识和区块A2的标识从区块链A中获取区块A2,并在区块A2内通过CA-B证书ID查询CA-B的证书,CA-B的证书包括CA-B的公钥。
第二种实现方式:
步骤28b:网元A获取网元B证书后,网元A向NRF发送网元B证书ID,用以向NRF请求验证网元B证书是否吊销和验证网元B证书的数字签名是否有效。
步骤29b:NRF根据网元B证书ID查找更新后的网元B的网元证书映射关系(如表17)获取证书状态信息。
具体的,如果网元证书映射关系不包括证书状态信息,则NRF根据网元B证书ID查找网元证书映射关系获取区块链标识和区块标识(分别为区块链B的标识和区块B3的标识),通过获取区块链B的标识和区块B3的标识从区块链B中获取区块B3,并在该区块B3内通过网元B证书ID查询网元B的证书的证书状态信息。由于在步骤23中CA-B已吊销网元B证书,NRF确定证书状态信息指示网元B证书已吊销和网元B证书的吊销原因值,例如网元B私钥已泄露,或网元B为恶意用户等,此处不做限定。
步骤30b:NRF根据网元B证书ID查找更新后的网元B的网元证书映射关系(如表17)获取区块链标识和区块标识(分别为区块链B的标识和区块B3的标识),通过获取区块链B的标识和区块B3的标识从区块链B中获取区块B3,并在该区块B3内通过网元B证书ID查询网元B的证书。NRF根据网元B证书中的CA证书ID,即CA-B证书ID,以此为索引查找CA证书映射关系(如表5)获取区块链标识和区块标识(分别为区块链A的标识和区块A2的标识),通过获取的区块链A的标识和区块A2的标识从区块链A中获取区块A2,并在区块A2内通过CA-B证书ID查询CA-B的证书,CA-B的证书包括CA-B的公钥。
步骤31至步骤33可以参考实施例1的相关内容,重复之处不再赘述。
采用上述实施例4,管理设备可以通过区块链方式维护CA证书映射关系和网元证书映射关系,基于维护的网元证书映射关系查询最新的证书状态信息。由于网元的证书新增签发证书的CA的证书的标识,管理设备通过网元的证书获取CA证书的标识,并基于维护的CA证书映射关系查询CA公钥。
上述主要从方法流程的角度对本申请实施例提供的方案进行了介绍。下面结合附图介绍本申请实施例中用来实现上述方法的装置。因此,上文中的内容均可以用于后续实施例中,重复的内容不再赘述。
为了实现上述本申请实施例提供的方法中的各功能,本申请实施例还提供一种装置用于实现上述方法。该装置可以包括硬件结构和/或软件模块,以硬件结构、软件模块、或硬件结构加软件模块的形式来实现上述各功能。上述各功能中的某个功能以硬件结构、软件模块、还是硬件结构加软件模块的方式来执行,取决于技术方案的特定应用和设计约束条件。
本申请实施例提供的装置可以是能够执行上述方法对应的功能的芯片或电路,该芯片或电路可以设置在处理器等设备中。进一步的,本申请实施例提供的装置,还能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行,取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能,但是这种实现不应认为超出本申请实施例的范围。
本申请实施例提供的装置可以进行功能模块的划分,例如,可对应各个功能划分各个功能模块,也可将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以 采用硬件的形式实现,也可以采用软件功能模块的形式实现。需要说明的是,本申请实施例中对模块的划分是示意性的,仅仅为一种逻辑功能划分,实际实现时可以有另外的划分方式。
一种可能的实现方式中,如图8所示,为本申请实施例提供一种证书查询装置的结构示意图。该装置可以是处理器,也可以是处理器中的装置。该装置800可以包括:处理模块81和通信模块82。当然,该装置800还可能包括其他模块,本申请实施例并不限定,仅示出主要的功能模块。通信模块82用于接收来自于第二设备的第一信息,所述第一信息包括第一设备的证书的标识,处理模块81用于根据所述第一设备的证书的标识和第一映射关系确定所述第一设备的证书的证书状态信息,通信模块82用于向所述第二设备发送所述证书状态信息。所述第一映射关系指示所述第一设备的证书的标识与所述证书状态信息的对应关系,所述证书状态信息用于指示所述第一设备的证书是否被吊销。
应理解,本申请实施例中的处理模块81可以由处理器或处理器相关电路组件实现,通信模块82可以由通信接口或通信接口相关电路组件或者通信接口实现。应理解,通信接口可以包括例如发射器和接收器,处理器、发射器和接收器相互耦合,其中,发射器和接收器例如通过天线、馈线和编解码器等实现,或者,如果所述装置为设置在设备中的芯片,那么发射器和接收器例如为芯片中的通信接口,该通信接口与设备中的射频收发组件连接,以通过射频收发组件实现信息的收发。
例如,如图9所示为本申请实施例提供的装置900,图9所示的装置可以为图8所示的装置的一种硬件电路的实现方式。该装置可用于执行图3所示出的流程图中的管理设备的功能。为了便于说明,图9仅示出了该装置的主要部件。
需要说明的是,图9所示的装置可以是能够执行上述方法对应的功能的芯片或电路,也可以是包括上述芯片或电路的设备,本申请实施例对此并不限定。
图9所示的装置900包括至少一个处理器920,用于实现本申请实施例提供的图3中管理设备的功能。
装置900还可以包括至少一个存储器930,用于存储程序指令和/或数据。存储器930和处理器920耦合。本申请实施例中的耦合是装置、单元或模块之间的间接耦合或通信连接,可以是电性,机械或其它的形式,用于装置、单元或模块之间的信息交互。处理器920可能和存储器930协同操作。处理器920可能执行存储器930中存储的程序指令。所述至少一个存储器中的至少一个可以包括于处理器中。
可选地,若该装置900为芯片或电路,该装置900也可以不包括存储器930,处理器920可以读取该芯片或电路外部的存储器中的指令(程序或代码)以实现图3所示的实施例所提供的管理设备的功能。
装置900还可以包括通信接口910,用于通过传输介质和其它设备进行通信,从而用于装置900中的装置可以和其它设备进行通信。在本申请实施例中,通信接口可以是收发器、电路、总线、模块或其它类型的通信接口。在本申请实施例中,收发器可以为独立的接收器、独立的发射器、集成收发功能的收发器、或者是接口电路。处理器920利用通信接口910收发数据,并用于实现图3所示实施例中处理器的功能,具体可以参考前面的描述,在此不再赘述。
装置900还可以包括通信总线940。其中,通信接口910、处理器920以及存储器930 可以通过通信总线940相互连接;通信总线940可以是外设部件互连标准(peripheral component interconnect,简称PCI)总线或扩展工业标准结构(extended industry standard architecture,简称EISA)总线等。所述通信总线940可以分为地址总线、数据总线、控制总线等。为便于表示,图9中仅用一条粗线表示,但并不表示仅有一根总线或一种类型的总线。
再一种可选的方式,本申请实施例提供的装置使用软件实现时,可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时,全部或部分地实现本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中,或者从一个计算机可读存储介质向另一个计算机可读存储介质传输,例如,所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line,DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质,(例如软盘、硬盘、磁带)、光介质(例如DVD)、或者半导体介质(例如固态硬盘(solid state disk,SSD))等。
需要说明的是,用于执行本申请实施例提供的方法的上述装置中所包含的处理器可以是中央处理器(central processing unit,CPU),通用处理器、数字信号处理器(digital signal processor,DSP)、专用集成电路(application-specific integrated circuit,ASIC),现场可编程门阵列(field programmable gate array,FPGA)或者其他可编程逻辑器件、晶体管逻辑器件,硬件部件或者其任意组合。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框,模块和电路。所述处理器也可以是实现计算功能的组合,例如包含一个或多个微处理器组合,DSP和微处理器的组合等等。
结合本申请实施例所描述的方法或者算法的步骤可以硬件的方式来实现,也可以是由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成,软件模块可以被存放于随机存取存储器(random access memory,RAM)、闪存、只读存储器(read-only memory,ROM)存储器、可擦除可编程只读存储器(erasable programmable read-only memory,EPROM)、电可擦除可编程只读存储器(electrically erasable programmable read-only memory,EEPROM)、寄存器、硬盘、移动硬盘、只读光盘(compact disc read-only memory,CD-ROM)或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器,从而使处理器能够从该存储介质读取信息,且可向该存储介质写入信息。当然,存储介质也可以是处理器的组成部分。处理器和存储介质可以位于ASIC中。另外,该ASIC可以位于雷达装置或者安装雷达装置的探测设备中。当然,处理器和存储介质也可以作为分立组件存在于雷达装置或者安装雷达装置的探测设备中。
可以理解的是,图8~图9仅仅示出了该装置的简化设计。在实际应用中,本申请实施例提供的装置可以包含任意数量的发射器,接收器,处理器,控制器,存储器以及其他可能存在的元件。
通过以上的实施方式的描述,所属领域的技术人员可以清楚地了解到,为描述的方便和简洁,仅以上述各功能模块的划分进行举例说明,实际应用中,可以根据需要而将上述 功能分配由不同的功能模块完成,即将装置的内部结构划分成不同的功能模块,以完成以上描述的全部或者部分功能。
本申请实施例还提供一种芯片,所述芯片与存储器相连,用于读取并执行所述存储器中存储的软件程序,当在所述芯片上运行所述软件程序时,使得所述芯片实现图3中处理器的功能。
本申请实施例还提供一种计算机可读存储介质,包括指令,当在计算机上运行所述指令时,使得计算机实现图3中管理设备的功能。
本领域内的技术人员应明白,本申请的实施例可提供为方法、系统、或计算机程序产品。因此,本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且,本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器,使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中,使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品,该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上,使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理,从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然,本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样,倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内,则本申请也意图包含这些改动和变型在内。
Claims (21)
- 一种证书查询方法,其特征在于,该方法包括:管理设备接收来自于第二设备的第一信息,所述第一信息包括第一设备的证书的标识;所述管理设备根据所述第一设备的证书的标识和第一映射关系确定所述第一设备的证书的证书状态信息;所述第一映射关系指示所述第一设备的证书的标识与所述证书状态信息的对应关系;所述证书状态信息用于指示所述第一设备的证书是否被吊销;所述管理设备向所述第二设备发送所述证书状态信息。
- 如权利要求1所述的方法,其特征在于,所述证书状态信息具体指示:所述第一设备的证书未被吊销,或者所述第一设备的证书的吊销原因值;或者所述证书状态信息具体指示:所述第一设备的证书未被吊销,或者所述第一设备的证书被吊销和所述第一设备的证书的吊销原因值。
- 如权利要求1或2所述的方法,其特征在于,所述第一映射关系具体指示所述第一设备的证书的标识、第一区块链的标识信息和第一区块的标识信息的对应关系,其中,所述第一区块在所述第一区块链上,所述第一区块存储所述证书状态信息;所述管理设备根据所述第一设备的证书的标识和第一映射关系确定所述证书状态信息,包括:所述管理设备根据所述第一设备的证书的标识和所述第一映射关系确定所述第一区块链的标识信息和所述第一区块的标识信息;所述管理设备根据所述第一区块链的标识信息和所述第一区块的标识信息从所述第一区块获取所述证书状态信息。
- 如权利要求1或2所述的方法,其特征在于,所述第一映射关系具体指示被吊销的证书的标识、存储所述被吊销的证书的吊销原因值的区块所在的区块链的标识信息和所述存储所述被吊销的证书的吊销原因值的区块的标识信息的对应关系;所述管理设备根据所述第一设备的证书的标识和第一映射关系确定所述证书状态信息,包括:在所述被吊销的证书的标识不包括所述第一设备的证书的标识时,所述管理设备确定所述证书状态信息,所述证书状态信息指示所述第一证书未被吊销;或者,在所述被吊销的证书的标识包括所述第一设备的证书的标识时,所述第一映射关系包括第四映射关系,所述第四映射关系指示所述第一设备的证书的标识、第二区块链的标识信息和第二区块的标识信息,其中,所述第二区块在所述第二区块链上,所述第二区块存储所述被吊销证书的标识和所述被吊销的证书对应的吊销原因值;所述管理设备根据所述第一设备的证书的标识和所述第四映射关系确定所述第二区块链的标识信息和所述第二区块的标识信息;所述管理设备根据所述第二区块链的标识信息和所述第二区块的标识信息从所述第二区块获取所述第一设备的证书的吊销原因值,所述管理设备确定所述证书状态信息,所述证书状态信息指示所述第一设备的证书的吊销原因值。
- 如权利要求1-4任一项所述的方法,其特征在于,还包括:所述管理设备获取第一数字证书颁发机构CA的公钥,所述第一CA是指为所述第一设备签发所述第一设备的证书的CA;所述管理设备向所述第二设备发送所述第一CA的公钥。
- 如权利要求1-4任一项所述的方法,其特征在于,在所述管理设备根据所述第一设备的证书的标识和第一映射关系确定所述证书状态信息之前,还包括:所述管理设备获取第一CA的公钥;所述第一CA是指为所述第一设备签发所述第一设备的证书的CA;所述管理设备根据所述第一CA的公钥确定所述第一设备的证书的数字签名有效。
- 如权利要求1-4任一项所述的方法,其特征在于,所述方法还包括:在所述管理设备确定所述证书状态信息指示所述第一设备的证书未被吊销时,所述管理设备获取第一CA的公钥;所述第一CA是指为所述第一设备签发所述第一设备的证书的CA;所述管理设备根据所述第一CA的公钥判断所述第一设备的证书的数字签名是否有效;所述管理设备向所述第一设备发送第二信息,所述第二信息指示所述第一设备的证书的数字签名是否有效。
- 如权利要求5-7任一项所述的方法,其特征在于,所述第一信息还包括所述第一CA的证书的标识;所述管理设备获取第一CA的公钥,包括:所述管理设备根据所述第一CA的证书的标识和第二映射关系确定第三区块链的标识信息和第三区块的标识信息,所述第二映射关系指示所述第一CA的证书的标识、所述第三区块链的标识信息和所述第三区块的标识信息的对应关系;所述第三区块在所述第三区块链上,所述第三区块存储所述第一CA的证书;所述第一CA的证书包括所述第一CA的公钥;所述管理设备根据所述第三区块链的标识信息和所述第三区块的标识信息从所述第三区块获取所述第一CA的公钥。
- 如权利要求5-7任一项所述的方法,其特征在于,在所述管理设备获取第一CA的公钥之前,还包括:所述管理设备根据所述第一设备的证书的标识和第三映射关系确定所述第一CA的证书的标识;所述第三映射关系指示所述第一设备的证书的标识和所述第一CA的证书的标识的对应关系;所述管理设备获取第一CA的公钥,包括:所述管理设备根据所述第一CA的证书的标识和第二映射关系确定第三区块链的标识信息和第三区块的标识信息,所述第二映射关系指示所述第一CA的证书的标识、所述第三区块链的标识信息和所述第三区块的标识信息的对应关系;所述第三区块在所述第三区块链上,所述第三区块存储所述第一CA的证书;所述第一CA的证书包括所述第一CA的公钥;所述管理设备根据所述第三区块链的标识信息和所述第三区块的标识信息从所述第三区块获取所述第一CA的公钥。
- 如权利要求8或9所述的方法,其特征在于,还包括:所述管理设备接收第一广播消息,所述第一广播消息指示所述第二映射关系。
- 如权利要求10所述的方法,其特征在于,在所述管理设备接收第一广播消息之前,还包括:所述管理设备接收来自于所述第一CA的第三信息,所述第三信息包括所述第一CA 的证书;所述管理设备确定所述第三区块链的标识信息;所述管理设备将所述第一CA的证书公布至所述第三区块链的标识信息对应的区块链网络;在所述管理设备接收第一广播消息之后,还包括:所述管理设备向所述第一CA发送第四信息,所述第四信息指示所述第一CA的证书已公布至所述第三区块链的标识信息对应的所述区块链网络。
- 如权利要求6-11任一项所述的方法,其特征在于,还包括:所述管理设备接收第二广播消息,所述第二广播消息指示所述第一映射关系。
- 如权利要求12所述的方法,其特征在于,在所述管理设备接收第二广播消息之前,还包括:所述管理设备接收来自于所述第一CA的第五信息,所述第五信息包括所述第一设备的证书和所述证书状态信息;所述证书状态信息指示所述第一设备的证书未被吊销;所述管理设备确定所述第一区块链的标识信息;所述管理设备将所述第一设备的证书、所述证书状态信息公布至所述第一区块链的标识信息对应的区块链网络;在所述管理设备接收第二广播消息之后,还包括:所述管理设备向所述第一CA发送第六信息,所述第六信息指示所述证书状态信息已公布至所述第一区块链的标识信息对应的区块链网络。
- 如权利要求13所述的方法,其特征在于,所述第五信息还包括所述第一CA的证书的标识;所述管理设备将所述第一设备的证书、所述证书状态信息公布至所述第一区块链的标识信息对应的区块链网络,包括:所述管理设备将所述第一CA的证书的标识、所述第一设备的证书、所述证书状态信息公布至所述第一区块链的标识信息对应的区块链网络;所述管理设备接收第二广播消息,包括:所述管理设备接收第二广播消息,所述第二广播消息还指示所述第一设备的证书的标识和所述第一CA的证书的标识的对应关系。
- 如权利要求12-14任一项所述的方法,其特征在于,还包括:所述管理设备接收第三广播消息,所述第三广播消息指示更新后的第一映射关系,所述更新后的第一映射关系指示所述第一设备的证书的标识、所述第一区块链的标识信息和所述第四区块的标识信息的对应关系,所述第四区块在所述第一区块链上,所述第四区块存储所述第一设备的证书的标识和更新后的证书状态信息,所述更新后的证书状态信息指示所述第一设备的证书的吊销原因值。
- 如权利要求15所述的方法,其特征在于,在所述管理设备接收第三广播消息之前,还包括:所述管理设备接收来自于所述第一CA的第七信息,所述第七信息包括所述第一设备的证书的标识和所述更新后的证书状态信息;所述管理设备根据所述第一设备的证书的标识和所述第一映射关系确定所述第一区块链的标识信息;所述管理设备将所述更新后的证书状态信息、所述第一设备的证书的标识公布至所述第一区块链的标识信息对应的所述区块链网络;在所述管理设备接收第三广播消息之后,还包括:所述管理设备向所述第一CA发送第八信息,所述第八信息指示所述更新后的证书状态信息已公布至所述第一区块链的标识信息对应的区块链网络。
- 如权利要求6-11任一项所述的方法,其特征在于,还包括:所述管理设备接收第四广播消息,所述第四广播消息指示第四映射关系,所述第一映射关系包括所述第四映射关系,所述第四映射关系指示所述第一设备的证书的标识、所述第二区块链的标识信息和所述第二区块的标识信息的对应关系。
- 如权利要求17所述的方法,其特征在于,在所述管理设备接收第四广播消息之前,还包括:所述管理设备接收来自于所述第一CA的第九信息,所述第九信息包括所述第一设备的证书的标识和所述证书状态信息;所述证书状态信息指示所述第一设备的证书的吊销原因值;所述管理设备确定所述第二区块链的标识信息;所述管理设备将所述第一设备的证书的标识、所述证书状态信息公布至所述第二区块链的标识信息对应的区块链网络;在所述管理设备接收第四广播消息之后,还包括:所述管理设备向所述第一CA发送第十信息,所述第十信息指示所述证书状态信息已公布至所述第二区块链的标识信息对应的区块链网络。
- 一种通信装置,其特征在于,包括用于执行如权利要求1至18中的任一项所述的方法的模块。
- 一种通信装置,其特征在于,包括处理器和接口电路,所述接口电路用于接收来自所述通信装置之外的其它通信装置的信号并传输至所述处理器或将来自所述处理器的信号发送给所述通信装置之外的其它通信装置,所述处理器通过逻辑电路或执行代码指令用于实现如权利要求1至18中任一项所述的方法。
- 一种计算机可读存储介质,其特征在于,所述存储介质中存储有计算机程序或指令,当所述计算机程序或指令被通信装置执行时,实现如权利要求1至18中任一项所述的方法。
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202110346361.1 | 2021-03-31 | ||
CN202110346361.1A CN115146320A (zh) | 2021-03-31 | 2021-03-31 | 一种证书查询方法及装置 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2022206247A1 true WO2022206247A1 (zh) | 2022-10-06 |
Family
ID=83403448
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2022/078223 WO2022206247A1 (zh) | 2021-03-31 | 2022-02-28 | 一种证书查询方法及装置 |
Country Status (2)
Country | Link |
---|---|
CN (1) | CN115146320A (zh) |
WO (1) | WO2022206247A1 (zh) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11943373B2 (en) * | 2019-03-07 | 2024-03-26 | Tencent Technology (Shenzhen) Company Limited | Method for issuing identity certificate to blockchain node and related apparatus |
Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN108537666A (zh) * | 2018-04-09 | 2018-09-14 | 深圳市云蚂蚁科技有限责任公司 | 一种区块链系统以及区块链网络交易方法 |
US20190260596A1 (en) * | 2018-01-19 | 2019-08-22 | Cable Television Laboratories, Inc | Systems and methods for enhanced online certificate status protocol |
US10547457B1 (en) * | 2016-10-21 | 2020-01-28 | Wells Fargo Bank N.A. | Systems and methods for notary agent for public key infrastructure names |
CN110855445A (zh) * | 2019-11-08 | 2020-02-28 | 腾讯科技(深圳)有限公司 | 一种基于区块链的证书管理方法、装置及存储设备 |
-
2021
- 2021-03-31 CN CN202110346361.1A patent/CN115146320A/zh active Pending
-
2022
- 2022-02-28 WO PCT/CN2022/078223 patent/WO2022206247A1/zh active Application Filing
Patent Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10547457B1 (en) * | 2016-10-21 | 2020-01-28 | Wells Fargo Bank N.A. | Systems and methods for notary agent for public key infrastructure names |
US20190260596A1 (en) * | 2018-01-19 | 2019-08-22 | Cable Television Laboratories, Inc | Systems and methods for enhanced online certificate status protocol |
CN108537666A (zh) * | 2018-04-09 | 2018-09-14 | 深圳市云蚂蚁科技有限责任公司 | 一种区块链系统以及区块链网络交易方法 |
CN110855445A (zh) * | 2019-11-08 | 2020-02-28 | 腾讯科技(深圳)有限公司 | 一种基于区块链的证书管理方法、装置及存储设备 |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11943373B2 (en) * | 2019-03-07 | 2024-03-26 | Tencent Technology (Shenzhen) Company Limited | Method for issuing identity certificate to blockchain node and related apparatus |
Also Published As
Publication number | Publication date |
---|---|
CN115146320A (zh) | 2022-10-04 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US20200396060A1 (en) | Identity Management Method, Device, Communications Network, And Storage Medium | |
US11601426B2 (en) | Device authentication method, service access control method, device, and non-transitory computer-readable recording medium | |
WO2020057163A1 (zh) | Mec平台部署方法及装置 | |
US10764040B2 (en) | Dynamic domain key exchange for authenticated device to device communications | |
WO2018177143A1 (zh) | 一种身份认证的方法、系统及服务器和终端 | |
WO2022121538A1 (zh) | 基于区块链的数据同步方法、系统及相关设备 | |
US10382213B1 (en) | Certificate registration | |
US20160373431A1 (en) | Method to enroll a certificate to a device using scep and respective management application | |
CN111226418B (zh) | 针对跨网络周边防火墙的设备使能零接触引导 | |
CN107908979B (zh) | 用于在区块链中进行配置和背书的方法和电子设备 | |
WO2019041809A1 (zh) | 基于服务化架构的注册方法及装置 | |
US11057368B2 (en) | Issuing a certificate based on an identification of an application | |
CN110247917B (zh) | 用于认证身份的方法和装置 | |
JP2022534023A (ja) | コンピュータで実施されるシステムおよび方法 | |
WO2023216532A1 (zh) | 一种数字资产的管理方法及相关装置 | |
WO2023000967A1 (zh) | 一种设备管理方法、系统以及装置 | |
WO2023221591A1 (zh) | 一种数据传输的方法、相关装置、设备以及存储介质 | |
WO2022206247A1 (zh) | 一种证书查询方法及装置 | |
WO2022170821A1 (zh) | 业务证书管理方法、装置、系统及电子设备 | |
CN108833334B (zh) | 一种数字家庭网络的设备安全接入系统及方法 | |
WO2023231558A1 (zh) | 区块链共识方法、装置、介质、电子设备和程序产品 | |
CN111787044A (zh) | 物联网终端平台 | |
CN110740039B (zh) | 一种数字证书管理系统、方法及服务终端 | |
CN115879080A (zh) | 证书认证方法及装置 | |
US20220377550A1 (en) | Secure and trusted peer-to-peer offline communication systems and methods |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 22778432 Country of ref document: EP Kind code of ref document: A1 |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 22778432 Country of ref document: EP Kind code of ref document: A1 |