PKI certificate cross-domain authentication method based on blockchain

Abstract

The invention discloses a PKI certificate cross-domain authentication method based on a blockchain. The method comprises the following steps: when a user initiates a cross-domain access request through a client end, a certificate is shown to an authentication server; the authentication server initiates a request to the blockchain for verifying whether each certificate in a certificate chain is revoked or not according to attribute fields of the shown certificate; a smart contract searches whether each certificate is valid in a BCRL (blockchain certificate revocation list), obtains a whole certificate chain, verifies whether the certificate chain is valid step by step from a root-of-trust certificate of a relying party, and signs and issues a user access token if each certificate is not revoked and the certificate chain verification is passed. Through the method provided by the invention, a complex topological structure in cross authentication is solved, a certificate chain trust path can be quickly constructed based on a multi-node tampering-free trust anchor of the blockchain, and the security of PKI certificate cross-domain authentication is improved.

Description

technical field [0001] The invention belongs to the technical field of communication security, and in particular relates to a blockchain-based PKI certificate cross-domain authentication method. Background technique [0002] At present, cross-domain authentication of PKI (Public Key Infrastructure) certificates mainly includes three methods: simple cross-certification, trust list, and bridge CA (certificate authority). [0003] Among them, the risk of simple cross-certification is small, the deployment is flexible but it is difficult to manage effectively, and it is easy to form a complex network structure when there are many participating members (trust systems), which is not suitable for large-scale PKI / CA cross-domain construction. [0004] The trust list needs to be maintained by a trusted third party. Some organizations use this method on a small scale in the construction of domestic government extranets. However, at the level of unified trust services, it is difficult ...

AI Technical Summary

Problems solved by technology

[0003] Among them, the risk of simple cross-certification is small, the deployment is flexible but difficult to manage effectively, and it is easy to form a complex network structure when there are many participating members (trust systems), which is not suitable for large-scale PKI / CA cross-domain construction

[0004] The trust list needs to be maintained by a trusted third party. Some organizations use this method on a small scale in the construction of domestic government affairs extranets. However, at the level of unified trust services, it is difficult for the selected third party to be recognized by all organizations, and it has not been popularized.

[0005] The bridge CA (BCA) is similar to the trust list in terms of trust relationship. It is difficult to select a third party (bridge) trusted by all parties. At present, the only successful bridge CA is the US Federal Bridge CA, which is difficult to apply in the separate government extranet and business fields.

Images