Digital certificate life cycle management method based on block chain

Abstract

The invention discloses a digital certificate life cycle management method based on a block chain, and relates to a block chain and digital identity authentication technology, and the method comprises the steps: receiving a certificate issuing application submitted by a certificate applicant, and writing the certificate issuing application into a certificate application node of a block chain network; obtaining a historical certificate revocation record of a certificate applicant through the verification node based on the certificate revocation state query interface, and performing security evaluation on the certificate issuing application to generate an evaluation result; when the evaluation result shows that the applicant has no historical certificate revocation record, a digital certificate is generated through the certificate issuing node, and the digital certificate and the identity identification information of the certificate applicant form a certificate block; and broadcasting the certificate block to all nodes of the block chain network through the certificate issuing node, and recording state change information to form a state tracing chain. According to the invention, the whole digital certificate management process and the block chain technology are deeply fused, a complete closed-loop management system is constructed, and revolutionary upgrading of a traditional certificate management system is realized.

Description

Technical Field

[0001] The present invention relates to the field of blockchain and digital identity authentication technology, and in particular to a blockchain-based digital certificate lifecycle management method. Background Art

[0002] Blockchain-based digital certificate management technology aims to provide a more trustworthy, transparent, and traceable solution for digital identity authentication and data security. As a core mechanism for ensuring network security, digital certificates are widely used in numerous scenarios, including government services, financial systems, and enterprise informatization. However, traditional digital certificate lifecycle management models generally rely on centralized certificate authorities (CAs). This leads to operational opacity, high risk of tampering, and delayed information synchronization during certificate issuance, revocation, renewal, and verification. This makes it easy for malicious users to exploit management vulnerabilities at any stage in the certificate lifecycle to launch attacks or forge identities, posing serious security risks. Especially given the current challenges of high-frequency dynamic authentication and cross-platform trusted interaction faced by digital identity management, building a distributed system capable of managing the digital certificate lifecycle from start to finish, ensuring data trustworthiness at every stage, and enabling operational traceability is a pressing technical challenge.

[0003] CN110598482B discloses a blockchain-based digital certificate management method, apparatus, device, and storage medium. This method generates a digital certificate after user authentication and constructs a first block containing the certificate information, which is then broadcast to multiple nodes in the blockchain system. This achieves distributed storage of issuance records, effectively preventing data tampering and ensuring the credibility and transparency of issuance records. However, this method primarily focuses on certificate generation and the preservation of issuance records, omitting key processes in the certificate lifecycle, such as status changes, revocation, and renewal. This makes it difficult to trace and dynamically monitor the entire certificate usage process, leading to information silos.

[0004] CN114157428A proposes a blockchain-based digital certificate management method and system. This system employs a collaborative processing architecture with multiple CA authentication terminals and stores certificate operation records on the blockchain through a consensus mechanism. This ensures that certificate processing operations are verifiable and tamper-proof, enhancing the transparency and credibility of certificate management. However, this solution still records individual certificate operations and lacks a continuous chain management mechanism throughout the entire certificate lifecycle. This system cannot effectively identify applicants for historical abnormal behavior or revocation records, and cannot conduct behavioral risk assessment and control on certificate subjects. Consequently, potential risks such as counterfeiting and malicious applications still exist. Summary of the Invention

[0005] In view of the problems existing in the existing digital certificate management, such as the lack of security review for certificate application behavior, the inability to fully utilize the revocation history information, and the lack of a complete chain record in the process of certificate status change, the present invention is proposed.

[0006] Therefore, the problem to be solved by the present invention is how to implement the whole-process management of digital certificates based on the blockchain, including the traceability and immutability of operations such as certificate application, issuance, verification, revocation, and status update, so as to improve the security, transparency, and automation level of certificate management.

[0007] To solve the above technical problems, the present invention provides the following technical solutions:

[0008] In a first aspect, an embodiment of the present invention provides a method for managing the life cycle of digital certificates based on the blockchain, which includes,

[0009] Receiving a certificate issuance application submitted by a certificate applicant and writing it into the certificate application node of the blockchain network;

[0010] Based on the certificate revocation status query interface, obtaining the historical certificate revocation record of the certificate applicant through the verification node in the blockchain network, and performing a security assessment on the certificate issuance application to generate an assessment result;

[0011] When the assessment result indicates that the applicant has no historical certificate revocation record, a digital certificate is generated through the certificate issuing node, and the digital certificate and the certificate applicant identity identification information are formed into a certificate block;

[0012] The certificate block is broadcast by the certificate issuing node to all nodes of the blockchain network, and the status change information of the digital certificate is recorded in the certificate information block to form a status traceability chain for the entire life cycle of the digital certificate.

[0013] As a preferred solution of the method for managing the life cycle of digital certificates based on the blockchain according to the present invention, wherein: the method for forming the status traceability chain is,

[0014] The certificate issuing node calculates the hash value of the certificate block and broadcasts the certificate block and the hash value of the certificate block to all nodes in the blockchain network;

[0015] Verifying the hash value of the certificate block and establishing a certificate status index table based on the certificate serial number;

[0016] Listening for certificate status change events and updating the certificate status index table according to the certificate status change request;

[0017] Packaging the certificate status change information into a status change block and adding it to the blockchain network through the consensus mechanism, establishing an association with the original certificate block, and forming a status traceability chain for the digital certificate.

[0018] As a preferred solution of the blockchain-based digital certificate lifecycle management method described in the present invention, wherein: verifying the hash value of the certificate block includes:

[0019] Extracting the certificate serial number, certificate expiration date, certificate status identifier, and identity identifier information from the certificate block, and forming the data to be verified in accordance with the preset field order;

[0020] Performing hash calculation on the data to be verified by using the SHA-256 hash algorithm to generate the current hash value;

[0021] Comparing the current hash value with the hash value carried in the certificate block. When the two hash values match exactly, the certificate block passes the hash verification;

[0022] Verifying whether the hash value of the previous block and the hash value of the corresponding block in the local blockchain are consistent, and at the same time verifying whether the timestamp is later than the timestamp of the previous block and earlier than the current system time;

[0023] When the certificate block passes the hash verification, block link verification, and time sequence verification, each node marks the certificate block as the verified state.

[0024] As a preferred solution of the blockchain-based digital certificate lifecycle management method described in the present invention, wherein: the method for obtaining the certificate block is as follows

[0025] The certificate issuing node receives the evaluation record block, parses the evaluation result of the evaluation record block. When the evaluation result is a passing evaluation result, it enters the certificate generation process;

[0026] Invoking the certificate serial number generation module to generate a certificate serial number based on the timestamp and random number seed, and setting the certificate expiration date according to the certificate usage information;

[0027] Based on the certificate status identifier that has been initialized to the valid state, packing the certificate serial number and the certificate expiration date to form a digital certificate;

[0028] Adding a digital signature to the digital certificate, wherein the digital signature encrypts the digital certificate content by using the private key of the certificate issuing authority;

[0029] Associating the digital certificate with the identity identifier information of the certificate applicant, and constructing a certificate block header, wherein the certificate block header includes a block version number, a timestamp, and a hash value of the previous block;

[0030] Forming a certificate block by combining the certificate block header, the digital certificate, and the associated identity identifier information.

[0031] As a preferred solution of the blockchain-based digital certificate lifecycle management method described in the present invention, wherein: the method for generating the evaluation result is as follows

[0032] The verification nodes in the blockchain network receive the certificate application block, extract the identity identification information of the certificate applicant, and construct a certificate revocation query request

[0033] Send the certificate revocation query request to the blockchain network through the certificate revocation status query interface to obtain the historical certificate revocation records

[0034] Analyze the historical certificate revocation records according to the preset security evaluation rules, and calculate the first security score, where the security evaluation rules include the certificate revocation times threshold and revocation reason classification

[0035] Generate an evaluation result based on the first security score, incorporate it into the evaluation record block, and broadcast it to other nodes in the blockchain network

[0036] As a preferred solution of the blockchain-based digital certificate lifecycle management method described in the present invention, wherein: analyzing the historical certificate revocation records according to the preset security evaluation rules and calculating the first security score includes

[0037] Extract the revocation time, revocation reason, and associated certificate information of the historical certificate revocation records, form a revocation time sequence with the revocation time in chronological order, and calculate the time decay coefficient

[0038] Count the number of certificate revocations in the revocation time sequence, compare the number of certificate revocations with the preset revocation times threshold, and generate a revocation times score

[0039] Classify the revocation reasons based on the preset revocation reason grading standard

[0040] Calculate the occurrence frequency of each level of revocation reasons, multiply the occurrence frequency by the corresponding level weight coefficient, and generate a revocation reason score

[0041] Multiply the revocation times score and the revocation reason score by the time decay coefficient respectively, and perform weighted summation according to the preset weights to obtain the initial security score

[0042] Extract the certificate usage classification according to the associated certificate information, and correct the initial security score according to the security level requirements of different certificate usages to generate the first security score

[0043] As a preferred solution of the blockchain-based digital certificate lifecycle management method described in the present invention, wherein: receiving the certificate issuance application submitted by the certificate applicant and writing it into the certificate application node of the blockchain network includes

[0044] The certificate application node of the blockchain network displays a certificate application interface, and the certificate applicant fills in the identity identification information and selects the certificate application scenario;

[0045] Perform format verification on the identity identification information, and form a certificate issuance application with the identity identification information after format verification and the certificate application scenario;

[0046] Calculate the hash value of the certificate issuance application, and add the certificate issuance application and the corresponding hash value to the certificate application queue;

[0047] Pack the certificate issuance applications in the certificate application queue into certificate application blocks in timestamp order and write them into the blockchain network.

[0048] As a preferred solution of the blockchain-based digital certificate life cycle management method described in the present invention, wherein: the format verification includes format verification scheme A and format verification scheme B; performing format verification on the identity identification information includes:

[0049] When performing format verification scheme A, if the identity identification information is of enterprise type, a multi-dimensional cross-verification mode is adopted, the unified social credit code is verified in real time through the enterprise credit information verification center, and triple verification functions are added to the organization code, enterprise registration number, and business license number; if an abnormal code appears, a downgraded verification mode is adopted, and the identity identification information is double-verified through a backup verification center, and the special character information is processed by a combination of manual review and system automatic filtering, and the effectiveness of the code is evaluated; if the identity identification information appears in an irregular format, the abnormal fields are automatically corrected to prevent the generation of invalid codes;

[0050] When performing format verification scheme B, if abnormal identity identification information is found, dynamic traceable verification is adopted, and the identity identification information is multi-level verified through an intelligent recognition engine, and quadruple verification functions are added to the organization code, enterprise registration number, and business license number, and the intelligent recognition engine locates the abnormality; if the abnormality is located, synchronous early warning feedback is performed to notify the administrator to manually review the abnormal information, add a backup verification node to the verification process, receive the verification status information fed back by the intelligent recognition engine, and classify the abnormal information; if the abnormality is eliminated, the corrected identity identification information is re-evaluated; if there is no format abnormality, the identity identification information and the certificate application scenario are formed into a certificate issuance application to complete the format verification process.

[0051] In a second aspect, an embodiment of the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program instructions are executed by the processor, the steps of the blockchain-based digital certificate lifecycle management method as described in the first aspect of the present invention are implemented.

[0052] In a third aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program instructions are executed by a processor, the steps of the blockchain-based digital certificate lifecycle management method as described in the first aspect of the present invention are implemented.

[0053] Compared with the existing technology, the present invention has the following beneficial effects: by deeply integrating the entire digital certificate management process with blockchain technology, a complete closed-loop management system from certificate application, risk assessment, certificate issuance to status tracing is constructed, achieving a revolutionary upgrade of the traditional certificate management system; by recording certificate application information in the blockchain network, the application data is ensured to be tamper-proof and traceable, eliminating the risk of malicious information modification at the source; based on the intelligent security assessment mechanism of historical certificate revocation records, through multi-dimensional quantitative analysis such as time decay coefficient and revocation reason classification, accurate prediction of the applicant's credit risk is achieved, effectively preventing the possibility of repeated violations by high-risk entities; through cryptographic-level digital signature and hash verification technology, a unique and anti-counterfeiting digital certificate is constructed, solving the problems of forgery and fraud in traditional certificate systems; through full network broadcast and the establishment of a status traceability chain, real-time synchronization of the certificate status throughout its life cycle and complete recording of its historical trajectory are achieved, making certificate status query and historical tracing possible at any point in time; this method not only significantly improves the security, credibility and management efficiency of digital certificates, but also establishes a decentralized certificate trust system, providing a solid technical foundation and institutional guarantee for trusted identity authentication and authority management in the digital society. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0055] Figure 1 Flowchart of a blockchain-based digital certificate lifecycle management method according to an embodiment.

[0056] Figure 2 This is a real-time status diagram of certificate processing in an embodiment of a blockchain-based digital certificate lifecycle management method. DETAILED DESCRIPTION

[0057] To make the above objects, features, and advantages of the present invention more apparent and understandable, the following provides a detailed description of the specific embodiments of the present invention in conjunction with the accompanying drawings of the specification.

[0058] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art may make similar extensions without departing from the connotation of the present invention. Therefore, the present invention is not limited by the specific embodiments disclosed below.

[0059] Secondly, the so-called "one embodiment" or "embodiment" herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation manner of the present invention. The appearances of "in one embodiment" in different places in this specification do not all refer to the same embodiment, nor are they separate or alternative embodiments that are mutually exclusive with other embodiments.

[0060] Embodiment 1

[0061] Referring to Figures 1 to 2 , this is the first embodiment of the present invention. This embodiment provides a method for managing the life cycle of digital certificates based on blockchain, including:

[0062] S1: Receive a certificate issuance application submitted by a certificate applicant and write it into the certificate application node of the blockchain network.

[0063] Specifically, it includes:

[0064] S1.1: The certificate application node of the blockchain network displays a certificate application interface, and the certificate applicant fills in the identity identification information and selects the certificate application scenario.

[0065] It should be noted that the certificate application interface includes an identity identification information input box and a certificate usage information selection box; the identity identification information includes the unified social credit code, the organization name, and the applicant's contact information; the certificate application scenarios include one or more of website SSL certificates, code signing certificates, and document signing certificates.

[0066] S1.2: Perform format verification on the identity identification information, and form a certificate issuance application with the format-verified identity identification information and the certificate application scenario.

[0067] It should be noted that the certificate issuance application includes the identity identification information and the certificate usage information of the certificate applicant; the format verification includes a primary format verification scheme A and a secondary format verification scheme B.

[0068] In an alternative embodiment, when the primary format verification scheme A is executed, if the identity identification information is of the enterprise type, a multi-dimensional cross-verification mode is adopted. The unified social credit code is verified in real time through the enterprise credit information verification center, and triple verification functions are added to the organization code, enterprise registration number, and business license number. If an abnormal code appears, a downgraded verification mode is adopted, and the identity identification information is double-verified through a backup verification center. The special character information is processed by combining manual review and automatic system filtering, and the validity of the code is evaluated. If the identity identification information has an irregular format, the abnormal fields are automatically corrected to prevent the generation of invalid codes.

[0069] Preferably, the triple verification functions include a digital verification function, a character verification function, and a rule verification function. The digital verification function verifies the compliance of the coding rules. The character verification function filters and converts special characters. The rule verification function determines the integrity and consistency of the identity identification information. The double verification function includes a digital verification function and a rule verification function.

[0070] In an alternative embodiment, when the secondary format verification scheme B is executed, if abnormal identity identification information is found, dynamic traceable verification is adopted. The identity identification information is multi-level verified through an intelligent recognition engine, and quadruple verification functions are added to the organization code, enterprise registration number, and business license number. The intelligent recognition engine locates the abnormality. If the abnormality is located, synchronous warning feedback is performed to notify the administrator to manually review the abnormal information, a backup verification node is added to the verification process, the verification status information fed back by the intelligent recognition engine is received, and the abnormal information is classified and processed. If the abnormality is eliminated, the corrected identity identification information is re-evaluated. If there is no format abnormality, the identity identification information and the certificate application scenario are combined into a certificate issuance application to complete the format verification process.

[0071] Preferably, the quadruple verification function adds a historical record verification function on the basis of the triple verification function. The historical record verification function is used to compare the consistency of the current identity identification information with the historical archive records.

[0072] S1.3: Calculate the hash value of the certificate issuance application, and add the certificate issuance application and the corresponding hash value to the certificate application queue.

[0073] S1.4: Package the certificate issuance applications in the certificate application queue into certificate application blocks in chronological order of timestamps and write them into the blockchain network.

[0074] S2: Based on the certificate revocation status query interface, obtain the historical certificate revocation records of the certificate applicant through the verification nodes in the blockchain network, and perform a security assessment on the certificate issuance application to generate an assessment result.

[0075] Specifically including

[0076] S2.1: Receive a certificate application block through the verification nodes of the blockchain network, extract the identity identification information of the certificate applicant, and construct a certificate revocation query request;

[0077] S2.2: Send the certificate revocation query request to the blockchain network through the certificate revocation status query interface to obtain historical certificate revocation records;

[0078] S2.3: Analyze the historical certificate revocation records according to the preset security assessment rules, and calculate the first security score, where the security assessment rules include the certificate revocation times threshold and revocation reason classification;

[0079] In an alternative implementation, for the judgment of the certificate revocation times threshold: when the number of certificate revocations N within the recent 5 years ≤ 2 times, the revocation times score is 100 points; when 2 times < the number of certificate revocations N ≤ 4 times, the revocation times score is 80 points; when 4 times < the number of certificate revocations N ≤ 6 times, the revocation times score is 60 points; when the number of certificate revocations N > 6 times, the revocation times score is 0 points, and the application is directly rejected.

[0080] Specifically including:

[0081] S2.3.1: Extract the revocation time, revocation reason and associated certificate information of the historical certificate revocation records, form a revocation time sequence for the revocation time in chronological order, and calculate the time decay coefficient;

[0082] S2.3.2: Count the number of certificate revocations in the revocation time sequence, compare the number of certificate revocations with the preset revocation times threshold, and generate a revocation times score;

[0083] S2.3.3: Classify the revocation reasons based on the preset revocation reason grading standard;

[0084] In an alternative implementation, the revocation reasons are divided into four levels:

[0085] Level A (certificate information change violation): Certificate update extension, information change not reported in time, basic score 85 points;

[0086] Level B (certificate use violation): Certificate use scope exceeds the application purpose, certificate not used according to regulations, basic score 70 points;

[0087] Level C (certificate security violation): Certificate private key leakage, illegal sharing of certificates, basic score 40 points;

[0088] Level D (certificate malicious violation): Certificate used for illegal activities, malicious tampering with certificate content, basic score 0 points.

[0089] S2.3.4: Calculate the occurrence frequency of revocation reasons at each level, multiply the occurrence frequency by the corresponding level weight coefficient to generate a revocation reason score.

[0090] S2.3.5: Multiply the revocation times score and the revocation reason score by the time decay coefficient respectively, and perform weighted summation according to the preset weight to obtain an initial security score.

[0091] S2.3.6: Extract the certificate usage classification according to the associated certificate information, and correct the initial security score through the security level requirements for different certificate usages to generate a first security score.

[0092] Preferably, the specific formula for the first security score is as follows:

[0093]

[0094] Among them, SafetyScore is the first security score, R n is the basic score based on the revocation times N, V i is the level score of the i-th violation, λ is the time decay factor, t i is the time interval (calculated in years) from the i-th violation to the current time, γ c is the certificate usage correction coefficient, and m is the total number of violation records.

[0095] It should be noted that the value range description: SafetyScore ∈ [0, 100]; [0, 60): High risk, it is recommended to reject the application; [60, 75): Medium risk, additional review is required; [75, 90): Low risk, normal processing.

[0096] S2.4: Generate an evaluation result based on the first security score, incorporate it into the evaluation record block, and broadcast it to other nodes in the blockchain network.

[0097] In an alternative implementation, extract the first security score and perform hierarchical evaluation based on a preset score threshold:

[0098] When the first security score is higher than the first threshold, generate a direct pass evaluation result, mark the fast approval channel identifier, and record the basic information and security score of the certificate applicant; when the first security score is between the second threshold and the first threshold, generate a conditional pass evaluation result, mark the supplementary review identifier, require the certificate applicant to provide credit guarantee materials, and record the basic information, security score and credit guarantee requirements of the certificate applicant; when the first security score is between the third threshold and the second threshold, generate a restricted pass evaluation result, mark the mandatory constraint identifier, restrict the scope of certificate use, shorten the certificate validity period, and record the basic information, security score, usage restriction conditions and validity period constraints of the certificate applicant; when the first security score is lower than the third threshold, generate a non-pass evaluation result, mark the rejection of issuance identifier, and record the reason for rejection and the basic information, security score and reason for rejection of the certificate applicant.

[0099] In an alternative embodiment, the evaluation record information packet is packaged to generate an evaluation record block: when packaging the fast approval channel record, add a priority processing identifier, and the node synchronously processes it with priority; when packaging the supplementary review record, add a material tracking identifier, and the node synchronously updates the material tracking status; when packaging the mandatory constraint record, add a supervision tracking identifier, and the node synchronously updates the supervision status; when packaging the rejection of issuance record, add a blacklist warning identifier, and the node synchronously updates the blacklist information.

[0100] S3: When the evaluation result indicates that the applicant has no historical certificate revocation record, a digital certificate is generated by the certificate issuing node, and the digital certificate and the certificate applicant's identity identification information are formed into a certificate block.

[0101] Specifically, it includes:

[0102] S3.1: The certificate issuing node receives the evaluation record block, parses the evaluation result of the evaluation record block, and when the evaluation result is a pass evaluation result, enters the certificate generation process;

[0103] It should be noted that entering the certificate generation process is as Figure 2 shown.

[0104] S3.2: Call the certificate serial number generation module to generate a certificate serial number based on the time stamp and the random number seed, and set the certificate validity period according to the certificate usage information;

[0105] It should be noted that the certificate serial number adopts a 36-bit string format; for website SSL certificates, it is set to 12 months, for code signing certificates, it is set to 24 months, and for document signing certificates, it is set to 36 months.

[0106] S3.3: Based on the certificate status identifier that has been initialized to the valid state, package the certificate serial number and the certificate expiration date to form a digital certificate;

[0107] S3.4: Add a digital signature to the digital certificate, where the digital signature encrypts the digital certificate content using the private key of the certificate authority;

[0108] S3.5: Associate the digital certificate with the identity identification information of the certificate applicant to construct a certificate block header, where the certificate block header includes a block version number, a timestamp, and a previous block hash value;

[0109] S3.6: Combine the certificate block header, the digital certificate, and the associated identity identification information to form a certificate block.

[0110] S4: Broadcast the certificate block to all nodes in the blockchain network through the certificate issuing node, and record the status change information of the digital certificate in the certificate information block to form a status traceability chain for the entire life cycle of the digital certificate.

[0111] Specifically, it includes:

[0112] S4.1: The certificate issuing node calculates the hash value of the certificate block and broadcasts the certificate block and the hash value of the certificate block to all nodes in the blockchain network;

[0113] Preferably, the specific formula for the hash value of the certificate block is as follows:

[0114] BlockHash = SHA256(H p |T s |CertInfo||Status)

[0115] CertInfo = SHA256(SN||V||E||I||U);

[0116] Where, BlockHash is the final certificate block hash value, H p is the hash value of the previous block, T s is the block timestamp, CertInfo is the certificate information hash value, Status is the certificate status identifier, SN is the certificate serial number, V is the certificate version number, E is the certificate expiration date, I is the identity identification of the certificate applicant, U is the certificate usage identifier, and || is the string concatenation operator.

[0117] S4.2: Verify the hash value of the certificate block. When the verification passes, add the certificate block to the local blockchain;

[0118] S4.3: Monitor certificate status change events and update the certificate status index table according to the certificate status change request;

[0119] It should be noted that the certificate status index table includes fields such as certificate serial number, certificate status identifier, and status update timestamp.

[0120] S4.4: Package the certificate status change information into a status change block and add it to the blockchain network through the consensus mechanism, establishing an association with the original certificate block to form a status traceability chain for digital certificates.

[0121] It should be noted that the certificate status change request includes change type, change reason, and change time; the status change block contains certificate serial number, original certificate status identifier, new certificate status identifier, change type, and change reason.

[0122] In summary, by deeply integrating the entire process of digital certificate management with blockchain technology, the present invention constructs a complete closed-loop management system from certificate application, risk assessment, certificate issuance to status traceability, realizing a revolutionary upgrade of the traditional certificate management system; by recording certificate application information in the blockchain network, it ensures the immutability and traceability of application data, eliminating the risk of malicious modification of information from the source; based on the intelligent security assessment mechanism of historical certificate revocation records, through multi-dimensional quantitative analysis such as time decay coefficient and revocation reason grading, it realizes the accurate prediction of the applicant's credit risk and effectively prevents the possibility of repeated violations by high-risk entities; by using cryptographic-level digital signature and hash verification technologies, it constructs a digital certificate with uniqueness and anti-counterfeiting properties, solving the problems of forgery and misappropriation in the traditional certificate system; by establishing a network-wide broadcast and status traceability chain, it realizes the real-time synchronization of the entire life cycle status of certificates and the complete record of historical trajectories, making it possible to query the certificate status and trace the history at any point in time; this method not only significantly improves the security, credibility, and management efficiency of digital certificates, but also establishes a decentralized certificate trust system, providing a solid technical foundation and institutional guarantee for trusted identity authentication and permission management in the digital society.

[0123] This embodiment also provides an electronic device, which includes a processor, a memory, a communication interface, a display screen, and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, a carrier network, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a multi-task edge computing resource scheduling method. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, a trackball, or a touchpad provided on the housing of the computer device, or an external keyboard, a touchpad, or a mouse, etc.

[0124] This embodiment also provides a computer-readable storage medium, on which a computer program is stored, and when the program is executed by the processor, it implements the method proposed in the above embodiment.

[0125] The storage medium proposed in this embodiment and the method proposed in the above embodiment belong to the same inventive concept. For technical details not described in detail in this embodiment, reference can be made to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0126] Through the above description of the implementation manners, those skilled in the art can clearly understand that the present invention can be implemented by means of software and necessary general hardware. Of course, it can also be implemented by hardware, but in many cases, the former is a better implementation manner. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a floppy disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (FLASH), a hard disk, or an optical disc of a computer, etc., and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the method of the embodiment of the present invention.

[0127] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them. Although the present invention has been described in detail with reference to the preferred embodiments, those of ordinary skill in the art should understand that the technical solutions of the present invention can be modified or equivalently replaced without departing from the spirit and scope of the technical solutions of the present invention, and they should all be covered within the scope of the claims of the present invention.

[0128] Those skilled in the art should understand that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk memory, CD-ROM, optical memory, etc.) containing computer-usable program code. The solutions in the embodiments of the present application can be implemented in various computer languages.

[0129] The present application is described with reference to the flowcharts and / or block diagrams of methods, apparatuses (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices generate a device for implementing the specified functions in Figure 1 one process or multiple processes and / or blocks Figure 1 one block or multiple blocks.

[0130] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory generate a manufactured article including an instruction device, and the instruction device implements the specified functions in Figure 1 one process or multiple processes and / or blocks Figure 1 one block or multiple blocks.

[0131] These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to generate a computer-implemented process, and thus the instructions executed on the computer or other programmable device provide steps for implementing the specified functions in Figure 1 one process or multiple processes and / or blocks Figure 1 one block or multiple blocks.

[0132] Although the preferred embodiments of the present application have been described, additional changes and modifications can be made to these embodiments by those skilled in the art once they learn the basic creative concept. Therefore, the appended claims are intended to be construed to include the preferred embodiments as well as all changes and modifications falling within the scope of the present application.

[0133] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application is also intended to include these modifications and variations.

Claims

1. A method for managing the life cycle of digital certificates based on blockchain, characterized in that: including Receiving a certificate issuance application submitted by a certificate applicant and writing it into a certificate application node of a blockchain network; Based on a certificate revocation status query interface, obtaining the historical certificate revocation record of the certificate applicant through a verification node in the blockchain network, and performing a security assessment on the certificate issuance application to generate an assessment result; When the assessment result indicates that the applicant has no historical certificate revocation record, generating a digital certificate through a certificate issuing node, and forming a certificate block by combining the digital certificate with the identity identification information of the certificate applicant; Broadcasting the certificate block to all nodes of the blockchain network through a certificate issuing node, and recording the status change information of the digital certificate in the certificate information block to form a status traceability chain for the entire life cycle of the digital certificate.

2. The blockchain-based digital certificate lifecycle management method according to claim 1, wherein: The method for forming the status traceability chain is as follows: The certificate issuing node calculates the hash value of the certificate block, and broadcasts the certificate block and the hash value of the certificate block to all nodes in the blockchain network; Verifying the hash value of the certificate block, and establishing a certificate status index table based on the certificate serial number; Listening for certificate status change events, and updating the certificate status index table according to the certificate status change request; Packing the certificate status change information into a status change block and adding it to the blockchain network through a consensus mechanism, establishing an association with the original certificate block, and forming a status traceability chain of the digital certificate.

3. The method for managing the life cycle of digital certificates based on blockchain according to claim 2, wherein: Verifying the hash value of the certificate block includes: Extracting the certificate serial number, certificate expiration date, certificate status identifier, and identity identification information from the certificate block, and forming the data to be verified in a preset field order; Performing hash calculation on the data to be verified using the SHA-256 hash algorithm to generate the current hash value; Comparing the current hash value with the hash value carried in the certificate block. When the two hash values match exactly, the certificate block passes the hash verification; Verifying whether the hash value of the previous block and the hash value of the corresponding block in the local blockchain are consistent, and at the same time verifying that the timestamp is later than the timestamp of the previous block and earlier than the current system time; When the certificate block passes the hash verification, block link verification, and time sequence verification, each node marks the certificate block as a verified state.

4. The blockchain-based digital certificate lifecycle management method according to claim 3, wherein: The method for obtaining the certificate block is as follows: The certificate issuing node receives an evaluation record block, parses the evaluation result of the evaluation record block. When the evaluation result is a passed evaluation result, it enters the certificate generation process; Invoking a certificate serial number generation module, generating a certificate serial number based on a timestamp and a random number seed, and setting the certificate expiration date according to the certificate usage information; Based on the certificate status identifier that has been initialized to the valid state, packing the certificate serial number and the certificate expiration date to form a digital certificate; Adding a digital signature to the digital certificate, where the digital signature encrypts the digital certificate content using the private key of the certificate issuing authority; Associating the digital certificate with the identity identification information of the certificate applicant, and constructing a certificate block header, where the certificate block header includes a block version number, a timestamp, and a previous block hash value; Forming a certificate block by combining the certificate block header, the digital certificate, and the associated identity identification information.

5. The blockchain-based digital certificate lifecycle management method according to claim 4, characterized in that: The method for generating the evaluation result is as follows: The verification node of the blockchain network receives the certificate application block, extracts the identity identification information of the certificate applicant, and constructs a certificate revocation query request; Send the certificate revocation query request to the blockchain network through the certificate revocation status query interface to obtain the historical certificate revocation records; Analyze the historical certificate revocation records according to the preset security evaluation rules, and calculate the first security score, where the security evaluation rules include the certificate revocation times threshold and the revocation reason classification; Generate an evaluation result based on the first security score, incorporate it into the evaluation record block, and broadcast it to other nodes in the blockchain network.

6. The blockchain-based digital certificate lifecycle management method according to claim 5, characterized in that: Analyze the historical certificate revocation records according to the preset security evaluation rules and calculate the first security score, including: Extract the revocation time, revocation reason, and associated certificate information of the historical certificate revocation record, form a revocation time sequence in chronological order of the revocation time, and calculate the time decay coefficient; Count the number of certificate revocations in the revocation time sequence, compare the number of certificate revocations with the preset revocation times threshold, and generate a revocation times score; Classify the revocation reasons based on the preset revocation reason grading standard; Calculate the occurrence frequency of each level of revocation reasons, multiply the occurrence frequency by the corresponding level weight coefficient, and generate a revocation reason score; Multiply the revocation times score and the revocation reason score by the time decay coefficient respectively, and perform weighted summation according to the preset weight to obtain the initial security score; Extract the certificate usage classification according to the associated certificate information, and correct the initial security score through the security level requirements for different certificate usages to generate the first security score.

7. The blockchain-based digital certificate lifecycle management method according to claim 6, characterized in that: Receive the certificate issuance application submitted by the certificate applicant and write it into the certificate application node of the blockchain network, including: The certificate application node of the blockchain network displays the certificate application interface, and the certificate applicant fills in the identity identification information and selects the certificate application scenario; Perform format verification on the identity identification information, and form a certificate issuance application by combining the identity identification information after format verification and the certificate application scenario; Calculate the hash value of the certificate issuance application, and add the certificate issuance application and the corresponding hash value to the certificate application queue; Package the certificate issuance applications in the certificate application queue into a certificate application block in timestamp order and write it into the blockchain network.

8. The method for managing the life cycle of digital certificates based on blockchain according to claim 7, characterized in that: The format verification includes format verification scheme A and format verification scheme B; Perform format verification on the identity identification information, including: When executing the format verification scheme A, if the identity identification information is of the enterprise type, a multi-dimensional cross-verification mode is adopted. The unified social credit code is verified in real time through the enterprise credit information verification center, and triple verification functions are added to the organization code, enterprise registration number, and business license number. If an abnormal code appears, a downgraded verification mode is adopted, and the identity identification information is double-verified through a backup verification center. The special character information is processed by a combination of manual review and automatic system filtering, and the effectiveness of the code is evaluated. If the identity identification information has an irregular format, the abnormal fields are automatically corrected to prevent the generation of invalid codes. When executing the format verification scheme B, if abnormal identity identification information is found, dynamic traceable verification is adopted. The identity identification information is verified at multiple levels through an intelligent recognition engine, and quadruple verification functions are added to the organization code, enterprise registration number, and business license number. The intelligent recognition engine locates the abnormality. If the abnormality is located, synchronous early warning feedback is carried out to notify the administrator to manually review the abnormal information. Backup verification nodes are added to the verification process to receive the verification status information fed back by the intelligent recognition engine, and the abnormal information is classified and processed. If the abnormality is eliminated, the corrected identity identification information is evaluated again. If there is no format abnormality, the identity identification information and the certificate application scenario are combined to form a certificate issuance application to complete the format verification process.

9. A computer device, comprising a memory and a processor, the memory storing a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the blockchain-based digital certificate life cycle management method according to any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the blockchain-based digital certificate life cycle management method according to any one of claims 1 to 8.

Images