Distributed CA certificate management system based on block chain

Abstract

The invention relates to the technical field of digital certificate management, in particular to a block chain-based distributed CA certificate management system, which comprises a certificate generation module, a block chain module, an authority control module, an intelligent contract module and an identity authentication module, according to the scheme, by constructing the public cross trust list and the cross-chain trust structure, a CA mutual recognition mechanism between different block chain systems is realized, so that the interoperability of cross-chain operation and the uniformity of identity authentication are effectively improved; a state transition system is introduced to dynamically manage a public cross trust list, flexible joining of new CA nodes and participants is supported, and the method can adapt to a complex multi-chain heterogeneous environment; a hierarchical CA structure design is adopted, a complete certificate chain is constructed, a traceable identity trust path is formed, and the security and reliability of an identity authentication process are ensured in combination with the non-tampering characteristic of a block chain technology and the automatic execution capability of an intelligent contract.

Description

Technical Field

[0001] The present invention relates to the technical field of digital certificate management, and in particular to a distributed CA certificate management system based on blockchain. Background Art

[0002] With the continuous expansion of the internet and the widespread adoption of distributed systems, the traditional CA (Certification Authority) system faces severe challenges in scalability, transparency, and security. This is particularly true in a multi-chain blockchain environment, where CAs across different systems do not recognize each other. This results in a user's identity on one chain being unrecognizable across other chains, and a lack of a unified identity authentication mechanism for cross-chain operations. Furthermore, the traditional PKI system features a complex multi-level CA structure, high trust chain verification costs, and a lack of a unified trust model and automated verification mechanism suitable for cross-chain scenarios. Furthermore, certificate issuance, renewal, revocation, and restoration operations still rely on centralized organizations, resulting in low management efficiency and delayed status synchronization, which can easily lead to certificate invalidation or abuse. This makes it difficult to meet the demand for efficient and trusted identity authentication in today's distributed environment. Summary of the Invention

[0003] In response to the above situation, and to overcome the shortcomings of the existing technology, the present invention provides a distributed CA certificate management system based on blockchain. To address the problem that CAs between different systems do not recognize each other, resulting in the user's identity on one chain being unable to be recognized by other chains and the lack of a unified identity authentication mechanism for cross-chain operations, this solution implements a CA mutual recognition mechanism between different blockchain systems by constructing a public cross-trust list and a cross-chain trust structure, so that the user's digital identity on one chain can be recognized and verified by other chains, thereby effectively improving the interoperability of cross-chain operations and the uniformity of identity authentication. At the same time, a state transition system is introduced to dynamically manage the public cross-trust list, supporting the flexible addition of new CA nodes and participants, with good scalability and compatibility, and can adapt to complex multi-chain heterogeneous environments. To address the problems of complex multi-level CA structure and high trust chain verification cost in traditional PKI, this solution adopts a hierarchical CA structure design. Through the hierarchical relationship between root CA, intermediate CA and terminal CA, a complete certificate chain is constructed to form a traceable identity trust path. Combining the tamper-proof characteristics of blockchain technology and the automated execution capabilities of smart contracts, it realizes the automated processing of certificate issuance, verification, renewal and revocation, ensuring the security and reliability of the identity authentication process.

[0004] The present invention provides a distributed CA certificate management system based on blockchain, which includes a certificate generation module, a blockchain module, a permission control module, a smart contract module and an identity authentication module;

[0005] The certificate generation module is responsible for generating CA certificates in the CA organization. It receives user registration requests and generates a global identifier and a CA certificate in a standard format. It also hashes the contents of the CA certificate and uploads it to the blockchain module.

[0006] The blockchain module uses each CA node and participant as a basis for building a blockchain network. The CA nodes include root CA, intermediate CA, and terminal CA. The participant's node registers its identity through the CA node.

[0007] The permission control module manages the operation permissions of different roles in the blockchain network, supports fine-grained access control, and uses the blockchain's signature mechanism to form a traceable operation log;

[0008] The smart contract module is an automated logic program deployed on the blockchain that builds a public cross-trust list and performs operations such as issuing, updating, revoking, and restoring user permissions;

[0009] The identity authentication module provides an external interface, allowing users to verify the user's CA certificate status across chains through the smart contract module.

[0010] Furthermore, the blockchain network includes blockchain nodes, an intra-chain trust model, and a cross-chain trust structure;

[0011] The construction of the blockchain node submits the identity information of the CA node and the participant to the certificate generation module. The certificate generation module automatically selects the appropriate root CA and intermediate CA to review and issue a CA certificate. The CA certificate is verified through the PKI system and stored on the blockchain, and the CA node and the participant are regarded as a node in the blockchain network;

[0012] The in-chain trust model is constructed using a hierarchical structure to build CA nodes, delegating trust authority step by step from the root CA to the intermediate CA and then to the terminal CA. Each level of CA node holds a CA certificate issued by the upper level, forming a complete certificate chain. The certificate chain is used to verify the legitimacy of the user's identity and build a traceable identity trust path.

[0013] The cross-chain trust structure is constructed by mutually authenticating the root CAs of the chains in the blockchain, generating a cross-trust list, writing it into the smart contract module in each chain, using the state transition system to establish a public cross-trust list, and dynamically storing the CA certificates of cross-chain authentication;

[0014] The public cross-trust list implements cross-chain and cross-node joint verification, temporarily stores verified cross-chain CA certificates, uses a least recently used strategy to manage a fixed-length cache, marks expired CA certificates and invalid CA certificates as pending deletion, and regularly cleans and updates the public cross-trust list.

[0015] Furthermore, the state transition system defines a five-tuple ,in, Indicates the cross-chain communication status, including unauthenticated, CA certificate verification, CA certificate has been added to the public cross-trust list, access authorization, and access successful. Indicates the initial unauthenticated state. Represents a set of executable actions, including sending requests, verifying CA certificates, adding CA certificates to the cross-trust list, checking access policies, authorizing access, denying access, and revoking access rights. Indicates the guard conditions that must be met before the action is executed, including that the CA certificate signature is valid, the root CA is in the cross-trust list, it is not expired, and it complies with the access policy. It is a state transition relationship, which indicates how each action changes the state of the system.

[0016] Furthermore, the smart contract module includes a cross-chain identity authentication contract, a signature verification contract, a cross-chain data transmission contract, an operation log recording contract, and a cross-chain contract list;

[0017] The certificate verification smart contract obtains the user's own CA certificate and user ID from the blockchain, verifies whether the root CA exists in the cross-trust list of the blockchain module, parses the user's CA certificate and verifies the validity of the signature, obtains the verification result, and stores the verification result in the public cross-trust list. If the verification is successful, it returns an authentication identifier, allowing the user to initiate a cross-chain request;

[0018] The signature verification contract, the user initiates a cross-chain verification request to the target chain and attaches the signature to be verified in the request. The signature verification contract extracts the user's CA certificate from the public cross-trust list and verifies the signature of the CA certificate using the elliptic curve digital signature algorithm. If the signature is invalid, the request is rejected. If successful, the request is allowed.

[0019] The cross-chain data transmission contract, during the data transmission process of the CA certificate, obtains the public key of the recipient user from the public cross-trust list, encrypts the CA certificate data using the ECC algorithm, adds a SHA-256 hash value to ensure integrity, and writes the encrypted CA certificate data into the target chain state database;

[0020] The operation log record contract records the identity of the requester who made the request, the request timestamp, the request content summary, the return result summary and the signature information, generates an operation log record, and sends it to the permission control module;

[0021] The cross-chain contract list performs inter-chain function calls and data interactions, obtains the target chain interface information, constructs call parameters and calls the business contract on the target chain, returns the result after execution is completed, and triggers the operation log to record the record operation of the smart contract.

[0022] The beneficial effects achieved by the present invention using the above scheme are as follows:

[0023] (1) In response to the problem that CAs between different systems do not recognize each other, resulting in the user's identity on one chain being unable to be recognized by other chains, and the lack of a unified identity authentication mechanism for cross-chain operations, this solution implements a CA mutual recognition mechanism between different blockchain systems by constructing a public cross-trust list and a cross-chain trust structure, so that the user's digital identity on one chain can be recognized and verified by other chains, thereby effectively improving the interoperability of cross-chain operations and the uniformity of identity authentication; at the same time, a state transition system is introduced to dynamically manage the public cross-trust list, supporting the flexible addition of new CA nodes and participants. The system has good scalability and compatibility and can adapt to complex multi-chain heterogeneous environments;

[0024] (2) In response to the problems of complex multi-level CA structure and high trust chain verification cost in traditional PKI, this solution adopts a hierarchical CA structure design, constructs a complete certificate chain through the hierarchical relationship of root CA, intermediate CA and terminal CA, and forms a traceable identity trust path. Combined with the tamper-proof characteristics of blockchain technology and the automated execution capabilities of smart contracts, it realizes the automation of operations such as certificate issuance, verification, renewal and revocation, significantly reducing the complexity and cost of trust chain verification; at the same time, the distributed ledger mechanism based on blockchain solves the key problems faced by traditional PKI in cross-chain scenarios, such as trust rupture, identity islands and extensive authority management, ensures the security and reliability of the identity authentication process, enhances the credibility and security of the entire system, and provides an efficient, secure and scalable technical solution for cross-chain identity authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 This is a schematic diagram of a distributed CA certificate management system based on blockchain proposed by the present invention;

[0026] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention. DETAILED DESCRIPTION

[0027] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments; based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0028] Example 1, see Figure 1The application provides a distributed CA certificate management system based on a block chain, which comprises a certificate generation module, a block chain module, an authority control module, an intelligent contract module and an identity authentication module.

[0029] The certificate generation module is a module responsible for the generation of CA certificates in a CA organization, receives a user registration request and generates a global identifier and a CA certificate in a standard format, and performs hash processing on the content of the CA certificate and uploads it to the block chain module.

[0030] The block chain module constructs a block chain network by taking each CA node and participant as a node, wherein the CA nodes include a root CA, an intermediate CA and a terminal CA, and the nodes of the participants are registered through the CA nodes.

[0031] The authority control module manages the operation authority of different roles in the block chain network, supports fine-grained access control, and forms a traceable operation log by using the signature mechanism of the block chain.

[0032] The intelligent contract module is an automatic logic program deployed on the block chain, constructs a public cross-trust list, and performs the operations of issuing, updating, revoking and restoring the authority of a user.

[0033] The identity authentication module provides an external interface, so that a user can verify the CA certificate status of the user through the intelligent contract module.

[0034] Embodiment two, based on the above-mentioned embodiment, the certificate generation module is responsible for the generation of CA certificates, and specifically comprises the following steps:

[0035] Step S1: initialize global parameters and master keys, call a key generation algorithm to generate a set of global public parameters and global master key pairs, including a public key and a private key; wherein the public parameters are used for subsequent CA certificate verification, and the master private key is securely stored by the CA node and used for CA certificate issuance;

[0036] Step S2: receive a user registration request, when a user initiates an application for a CA certificate, receive the user's registration request, which contains the user's identity information, including the user's name, organization, device ID, public key material and authentication credentials;

[0037] Step S3: generate a globally unique identifier, generate a globally unique identifier based on a timestamp, a random number and a uniqueness policy, and bind it with the user identity information, which is used for subsequent CA certificate management and query;

[0038] Step S4: constructing and signing the CA certificate in a standard format, constructing the fields of user identity information, globally unique identifier, public key, validity period, issuer information into a CA certificate template according to the X.509 standard, and signing the CA certificate using the global master private key to generate a CA certificate in PEM standard format;

[0039] Step S5: calculating the certificate hash value, performing SHA-256 hash operation on the complete CA certificate content generated to generate a unique digest value as the fingerprint information of the CA certificate;

[0040] Step S6: uploading to the blockchain module, obtaining the metadata of the CA certificate, and submitting the metadata of the CA certificate and the corresponding hash value to the blockchain module, and completing the on-chain operation by the smart contract module, wherein the metadata includes the issuer, the validity period, the GUID, and the subject information.

[0041] In the third embodiment, the blockchain network includes a blockchain node, an intra-chain trust model, and a cross-chain trust structure based on the above-mentioned embodiments.

[0042] The construction of the blockchain node submits the identity information of the CA node and the participants to the certificate generation module, and the certificate generation module automatically selects a suitable root CA and intermediate CA to audit and issue a CA certificate, which is verified by the PKI system and stored on the blockchain, and the CA node and the participants are regarded as a node in the blockchain network.

[0043] The intra-chain trust model is constructed by constructing the CA node in a hierarchical structure, and the trust authority is gradually delegated from the root CA to the intermediate CA and then to the terminal CA, each level of CA node holds a CA certificate issued by the upper level, forming a complete certificate chain, and the certificate chain is used to verify the legitimacy of the user identity, and a traceable identity trust path is constructed.

[0044] The cross-chain trust structure is constructed, the root CAs of each chain in the blockchain are mutually authenticated, a cross-trust list is generated, and the smart contract module in each chain is written, a public cross-trust list is established using a state transition system, and CA certificates authenticated across chains are dynamically stored.

[0045] The public cross-trust list realizes cross-chain and cross-node joint verification, temporarily stores the verified cross-chain CA certificates, uses the least recently used strategy to manage the fixed length cache, marks the expired CA certificates and invalid CA certificates as to be deleted, and periodically cleans up and updates the public cross-trust list.

[0046] By executing the above operations, the problem that CAs between different systems do not recognize each other, resulting in the user's identity on one chain cannot be recognized by other chains, and cross-chain operations lack a unified identity authentication mechanism, is solved. This solution realizes the CA mutual recognition mechanism between different blockchain systems by constructing a public cross-trust list and a cross-chain trust structure, so that the user's digital identity on one chain can be recognized and verified by other chains, thereby effectively improving the interoperability of cross-chain operations and the uniformity of identity authentication; at the same time, a state transition system is introduced to dynamically manage the public cross-trust list, supporting the flexible addition of new CA nodes and participants. The system has good scalability and compatibility and can adapt to complex multi-chain heterogeneous environments; it solves the key problems faced by traditional PKI in cross-chain scenarios, such as trust rupture, identity silos, and extensive authority management, and provides important support for building a trusted cross-chain identity authentication system.

[0047] Example 4: This example is based on the above example. The state transition system defines a five-tuple ,in, Indicates the cross-chain communication status, including unauthenticated, CA certificate verification, CA certificate has been added to the public cross-trust list, access authorization, and access successful. Indicates the initial unauthenticated state. Represents a set of executable actions, including sending requests, verifying CA certificates, adding CA certificates to the cross-trust list, checking access policies, authorizing access, denying access, and revoking access rights. Indicates the guard conditions that must be met before the action is executed, including that the CA certificate signature is valid, the root CA is in the cross-trust list, it is not expired, and it complies with the access policy. It is a state transition relationship, which indicates how each action changes the state of the system.

[0048] Example 5. This example is based on the above example. The permission control module manages the operation permissions of different roles in the blockchain network. According to the user's business needs and security management policies, the CA nodes and participants in the blockchain network are divided into N roles with clear responsibilities. The roles include root CA administrators, sub-CA nodes, ordinary users, and audit agencies. A role-based access control mechanism is adopted to assign different sets of operation permissions to each role. The smart contract module is combined to implement fine-grained permission management. Ordinary users only have certificate application and status query permissions. Sub-CA nodes can review and submit certificate revocation requests, but they must be confirmed by the upper-level root CA before they can take effect. The audit node can access the complete operation log but has no right to modify the data. The root CA has the highest authority and can configure system parameters, manage sub-CA node permissions and the issuance, update, and revocation of CA certificates of sub-CA nodes. Sub-CA nodes refer to intermediate CAs and terminal CAs other than the root CA node.

[0049] Example 6: This example is based on the above example. The smart contract module includes a cross-chain identity authentication contract, a signature verification contract, a cross-chain data transmission contract, an operation log recording contract, and a cross-chain contract list.

[0050] The certificate verification smart contract obtains the user's own CA certificate and user ID from the blockchain, verifies whether the root CA exists in the cross-trust list of the blockchain module, parses the user's CA certificate and verifies the validity of the signature, obtains the verification result, and stores the verification result in the public cross-trust list. If the verification is successful, it returns an authentication identifier, allowing the user to initiate a cross-chain request;

[0051] The signature verification contract, the user initiates a cross-chain verification request to the target chain and attaches the signature to be verified in the request. The signature verification contract extracts the user's CA certificate from the public cross-trust list and verifies the signature of the CA certificate using the elliptic curve digital signature algorithm. If the signature is invalid, the request is rejected. If successful, the request is allowed.

[0052] The cross-chain data transmission contract, during the data transmission process of the CA certificate, obtains the public key of the recipient user from the public cross-trust list, encrypts the CA certificate data using the ECC algorithm, adds a SHA-256 hash value to ensure integrity, and writes the encrypted CA certificate data into the target chain state database;

[0053] The operation log record contract records the identity of the requester who made the request, the request timestamp, the request content summary, the return result summary and the signature information, generates an operation log record, and sends it to the permission control module;

[0054] The cross-chain contract list performs inter-chain function calls and data interactions, obtains target chain interface information, constructs call parameters and calls the business contract on the target chain, returns the result after execution is completed, and triggers the operation log to record the record operation of the smart contract;

[0055] By performing the above operations, in order to solve the problems of complex multi-level CA structure and high trust chain verification cost in traditional PKI, this solution adopts a hierarchical CA structure design, builds a complete certificate chain through the hierarchical relationship of root CA, intermediate CA and terminal CA, and forms a traceable identity trust path. Combining the tamper-proof characteristics of blockchain technology and the automated execution capability of smart contracts, it realizes the automation of operations such as certificate issuance, verification, renewal and revocation, significantly reducing the complexity and cost of trust chain verification. At the same time, the distributed ledger mechanism based on blockchain solves the key problems faced by traditional PKI in cross-chain scenarios, such as trust rupture, identity islands and extensive authority management, ensures the security and reliability of the identity authentication process, enhances the credibility and security of the entire system, and provides an efficient, secure and scalable technical solution for cross-chain identity authentication.

[0056] It is to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting; it is not intended to exclude myriad other embodiments of the present application that other presenters can develop. That is, although the present application has been described in language specific to structural features, methodological acts, and computer code indicated in the figures and the specification, the present application is clearly not limited to the features, acts, and code illustrated or described. Rather, the scope of the present application is to be understood only as set forth in the accompanying claims. Moreover, the use of the terms first, second, etc. do not denote any order or importance, but rather the terms first, second, etc. are used to distinguish one element from another. Furthermore, the use of the terms a, an, etc. do not denote a limitation on the number of entities, but rather the terms a, an, etc. are used to refer to at least one.

[0057] While the embodiments of the application have been shown and described, it is to be understood that the application is not limited to the details of the embodiments described, since the scope of the expenditure is defined with respect to the appended claims.

[0058] The above description of the present application and its embodiments is not restrictive, and the embodiments shown in the drawings are only one of the embodiments of the present application, and the actual structure is not limited thereto. In general, if a person skilled in the art is inspired by it, without departing from the spirit and principles of the present application, similar structural modes and embodiments can be designed without creative design, which should belong to the protection scope of the present application.

Claims

1. A distributed CA certificate management system based on blockchain, characterized by: The system includes a certificate generation module, a blockchain module, a permission control module, a smart contract module, and an identity authentication module; The certificate generation module is responsible for generating CA certificates in the CA organization. It receives user registration requests and generates a global identifier and a CA certificate in a standard format. It also hashes the contents of the CA certificate and uploads it to the blockchain module. The blockchain module uses each CA node and participant as a basis for building a blockchain network. The CA nodes include root CA, intermediate CA, and terminal CA. The participant's node registers its identity through the CA node. The permission control module manages the operation permissions of different roles in the blockchain network, supports fine-grained access control, and uses the blockchain's signature mechanism to form a traceable operation log; The smart contract module is an automated logic program deployed on the blockchain that builds a public cross-trust list and performs operations such as issuing, updating, revoking, and restoring user permissions; The identity authentication module provides an external interface, allowing users to verify the user's CA certificate status across chains through the smart contract module.

2. A distributed CA certificate management system based on blockchain according to claim 1, characterized in that: The blockchain network includes blockchain nodes, an intra-chain trust model, and a cross-chain trust structure; The construction of the blockchain node submits the identity information of the CA node and the participant to the certificate generation module. The certificate generation module automatically selects the appropriate root CA and intermediate CA to review and issue a CA certificate. The CA certificate is verified through the PKI system and stored on the blockchain, and the CA node and the participant are regarded as a node in the blockchain network; The in-chain trust model is constructed using a hierarchical structure to build CA nodes, delegating trust authority step by step from the root CA to the intermediate CA and then to the terminal CA. Each level of CA node holds a CA certificate issued by the upper level, forming a complete certificate chain. The certificate chain is used to verify the legitimacy of the user's identity and build a traceable identity trust path. The cross-chain trust structure is constructed by mutually authenticating the root CAs of the chains in the blockchain, generating a cross-trust list, writing it into the smart contract module in each chain, using the state transition system to establish a public cross-trust list, and dynamically storing the CA certificates of cross-chain authentication; The public cross-trust list implements cross-chain and cross-node joint verification, temporarily stores verified cross-chain CA certificates, uses a least recently used strategy to manage a fixed-length cache, marks expired CA certificates and invalid CA certificates as pending deletion, and regularly cleans and updates the public cross-trust list.

3. A distributed CA certificate management system based on blockchain according to claim 1, characterized in that: The smart contract module includes a cross-chain identity authentication contract, a signature verification contract, a cross-chain data transmission contract, an operation log recording contract, and a cross-chain contract list; The certificate verification smart contract obtains the user's own CA certificate and user ID from the blockchain, verifies whether the root CA exists in the cross-trust list of the blockchain module, parses the user's CA certificate and verifies the validity of the signature, obtains the verification result, and stores the verification result in the public cross-trust list. If the verification is successful, it returns an authentication identifier, allowing the user to initiate a cross-chain request; The signature verification contract, the user initiates a cross-chain verification request to the target chain and attaches the signature to be verified in the request. The signature verification contract extracts the user's CA certificate from the public cross-trust list and verifies the signature of the CA certificate using the elliptic curve digital signature algorithm. If the signature is invalid, the request is rejected. If successful, the request is allowed. The cross-chain data transmission contract, during the data transmission process of the CA certificate, obtains the public key of the recipient user from the public cross-trust list, encrypts the CA certificate data using the ECC algorithm, adds a SHA-256 hash value to ensure integrity, and writes the encrypted CA certificate data into the target chain state database; The operation log record contract records the identity of the requester who made the request, the request timestamp, the request content summary, the return result summary and the signature information, generates an operation log record, and sends it to the permission control module; The cross-chain contract list performs inter-chain function calls and data interactions, obtains the target chain interface information, constructs call parameters and calls the business contract on the target chain, returns the result after execution is completed, and triggers the operation log to record the record operation of the smart contract.

Images