Multi-node mutual credit authentication method and system of public key infrastructure system

Abstract

The invention discloses a mutual credit granting authentication method and system among multiple nodes of a public key infrastructure system, and relates to the big data and data security technology, and the method comprises the steps: accessing a real name verification service provider and an identity credential service provider through a regional management node; the verification module is used for verifying the accessed enterprise identities and signing and issuing digital certificates to the enterprise identities passing the verification; a regional management node is used for registering service child nodes for qualified enterprise identities, registering connector root nodes for enterprise identities participating in services, generating node identity unique identifiers, and signing and issuing digital certificates; and the connector root nodes and the service child nodes access the area management node, the connector root nodes access the service child nodes, and the connector root nodes access each other to complete related services. According to the embodiment of the invention, an identity-authority-business three-in-one automatic trust system is constructed, the reliability of node identity authenticity verification in a distributed environment is improved, and the certificate and authority management cost of manual intervention is reduced.

Description

Technical Field

[0001] This application relates to the fields of big data and data security technology, and in particular to a method and system for mutual trust authentication between multiple nodes in a public key infrastructure system. Background Technology

[0002] In distributed business scenarios using big data components, frequent interactions are required across enterprise nodes (such as data transactions and service calls). Traditional operations and maintenance face three major security challenges: Identity forgery risk: Static API keys are easily leaked, making it impossible to verify the true identity of nodes. Transmission security flaws: Plaintext communication is easily eavesdropped on, and lacks integrity protection mechanisms. Weak access control: Decoupling of business operations from identity makes it difficult to prevent unauthorized access. Most existing technical solutions employ centralized CA certificate issuance and HTTPS for two-way authentication. This results in issues such as rigid architecture and coarse-grained permission settings. For example, in existing technologies, CN202410359056.X discloses an end-node authentication method, device, electronic device, and storage medium, while CN202310845101.8 discloses a distributed node authentication method, electronic device, and storage medium. Summary of the Invention

[0003] This application provides a method and system for mutual trust authentication between multiple nodes in a public key infrastructure system, which constructs an automated trust system integrating identity, permissions, and business, solves the reliability problem of node identity authenticity verification in a distributed environment, and reduces the cost of manual certificate and permission management.

[0004] This application provides a method for mutual trust authentication between multiple nodes in a public key infrastructure (PKI) system, applied to a three-tier node architecture. The three-tier node architecture includes a hierarchically configured regional management node, business sub-nodes, and a connector root node. The method for mutual trust authentication between multiple nodes includes: By utilizing regional management nodes to connect to real-name verification service providers and identity credential service providers, the identities of connected enterprises can be verified and digital certificates can be issued to verified enterprises. The regional management node is used to register business sub-nodes for qualified enterprise identities and to register connector root nodes for enterprise identities participating in the business, generating unique node identity identifiers and issuing digital certificates. Connector root nodes and business sub-nodes access the area management node. Connector root nodes access business sub-nodes. Connector root nodes access each other to complete related business. Requests between nodes require mutual trust authentication, encrypted data transmission, and data signature verification.

[0005] This application provides a multi-node mutual trust authentication system for a public key infrastructure, including a processor and a memory. The memory stores a computer program, which, when executed by the processor, implements the steps of the aforementioned method.

[0006] This application embodiment solves the reliability problem of node identity authenticity verification in a distributed environment by constructing an automated trust system that integrates identity, permissions, and business functions, thereby reducing the cost of manual certificate and permission management.

[0007] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0008] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 This is a basic flowchart illustrating the inter-node mutual trust authentication method of the public key infrastructure system in this application embodiment; Figure 2 This is a schematic diagram of the identity verification and certificate issuance process for a multi-node mutual trust authentication method in a public key infrastructure system according to an embodiment of this application. Figure 3 This is a schematic diagram of the two-way authentication establishment process of the multi-node mutual trust authentication method in the public key infrastructure system of this application embodiment. Detailed Implementation

[0009] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0010] The existing technology has the following drawbacks: 1. Identity-Business Disconnection: The OU / CN fields of the certificate only contain basic identity information and are not associated with business permission attributes; 2. Lack of Dynamic Authorization: The certificate validity period is long (1-2 years), which cannot respond to business changes in real time (such as node permission revocation); 3. Fragmented Operation and Maintenance: Certificate application, verification, and business registration are scattered in different systems, increasing management complexity; 4. Delayed Unauthorized Access Detection: Permission verification relies on application layer logic and does not achieve source blocking at the transport layer.

[0011] This application provides a method for mutual trust authentication among multiple nodes in a public key infrastructure (PKI) system, applied to a three-tier node architecture. The three-tier node architecture includes, at each level, a regional management node, business sub-nodes, and a connector root node. Wherein: Regional management node: Connects with real-name verification service providers and CAs, and is responsible for enterprise identity authentication, certificate issuance, and sub-node registration.

[0012] Business sub-nodes: handle business listing and transaction execution, and hold certificates with business permission tags.

[0013] Connector root node: Responsible for cross-node communication routing and has cross-domain trust transfer capabilities.

[0014] like Figure 1 As shown, the multi-node mutual trust authentication method in this application embodiment includes: In step S101, the regional management node connects to the real-name verification service provider and the identity credential service provider to verify the identity of the connected enterprise and issue digital certificates to the verified enterprise. In a specific example, the regional management node connects to the real-name verification service provider to verify the identity of the connected enterprise and generate a unique identifier for the enterprise. It also connects to the identity credential service provider to issue digital certificates to the verified enterprise. Here, OU is the unique identifier for the enterprise. The generated unique identifier for the node can include the enterprise ID + node type hash. The issuance of node certificates can be implemented using the method (OU=node_id, CN=node_address).

[0015] In step S102, the regional management node is used to register business sub-nodes for qualified enterprise identities and register connector root nodes for participating enterprise identities, generating unique node identity identifiers and issuing digital certificates. For example, in a specific example, the enterprise certificate OU = unique enterprise identity identifier, the node certificate OU = unique node identity identifier (associated enterprise ID + node type), and the node certificate CN = node IP / domain name. In some embodiments, after issuing digital certificates for verified enterprise identities, the process further includes: binding corresponding business permissions to verified enterprises, thereby directly mapping the access control model of business permissions through the certificate OU.

[0016] In step S103, the connector root node and business sub-nodes access the area management node, the connector root node accesses the business sub-nodes, and the connector root nodes access each other to complete related business. Furthermore, mutual requests between nodes require mutual trust authentication, encrypted data transmission, and data signature verification. The permission policy library in this application stores access control rules using the node OU as the primary key.

[0017] For example, the connector root node accesses the area management node to complete tasks such as registration. The business sub-node accesses the regional management node to complete the listing and sales process; The connector root node accesses business sub-nodes to complete business processes such as transaction delivery; Connector root nodes communicate with each other to complete business processes such as data transmission; In this specific example, nodes request each other's interfaces to complete business processes. This requires mutual trust authentication, encrypted data transmission, and data signature verification to prevent eavesdropping, tampering, repudiation, and unauthorized access. In this example, both requesting nodes use HTTPS+POST requests to achieve encrypted data transmission.

[0018] This application embodiment solves the reliability problem of node identity authenticity verification in a distributed environment by constructing an automated trust system that integrates identity, permissions, and business functions, thereby reducing the cost of manual certificate and permission management.

[0019] In some embodiments, such as Figure 2 As shown, the mutual request for mutual trust authentication between nodes includes: Both nodes add the intermediate certificate of the identity credential service provider to the trusted certificate store, realize two-way identity authentication through the certificate chain of digital certificates, and confirm that the domain name of the responding node matches the certificate.

[0020] In some embodiments, the process of nodes requesting interfaces to complete a business process includes: The requesting node uses its certificate private key to sign the request parameters and includes them in the request header. The requesting node also uses its private key to sign the (business parameters + timestamp) pair.

[0021] The responding node uses the web container to perform SSL offloading on the received request to obtain the public key of the requesting node's certificate, and sends the public key of the certificate in the request header to the application service. The application service uses the certificate public key to verify the request parameters and signature, and then performs a three-level verification of OU → permissions → parameters.

[0022] In some embodiments, the process of nodes requesting interfaces to complete business processes also includes: The responding node obtains the unique identifier of the requesting node based on the OU of the requesting node's certificate, and verifies the business parameters to prevent data unauthorization. The OU is a unique identifier generated after the regional management node verifies the identity.

[0023] In some embodiments, such as Figure 3 As shown, the process of nodes requesting each other's interfaces to complete the business process specifically includes the following two-way authentication establishment process: The requesting node sends an HTTPS request carrying the client's certificate to the target node; The web container (such as Nginx) of the responder node performs SSL decryption, extracts the requester's public key and certificate OU field, and sends them to the application service. The requester's public key is stored in the X-Public-Key request header, and the certificate OU field is stored in the X-Certificate-OU request header, thereby extracting the OU at the SSL offload layer and injecting it into the request context.

[0024] The application service retrieves the intermediate CA certificate from the certificate trust store, verifies whether the certificate was issued by a trusted CA, whether the certificate is valid, and whether the certificate has not been revoked. If the verification is successful, it enters the business processing flow; if the verification fails, it immediately terminates the connection (HTTP 401).

[0025] In some examples, this also includes: domain name matching verification, which additionally verifies the consistency between the requested domain name and the CN field of the certificate.

[0026] In some embodiments, this application also includes security enhancement mechanisms: The regional management node periodically synchronizes permission policies to the local policy library of each node to enable dynamic permission injection. When an enterprise's qualification expires, it automatically triggers the batch revocation of certificates on associated nodes, achieving coordinated certificate revocation.

[0027] All request logs record a triple (requester OU, business type, signature) to complete business operation auditing.

[0028] This application's method is deeply integrated with enterprise real-name authentication and the CA system to achieve "one certificate for all." At the communication layer, it automatically associates permission policies through the OU field, reducing the intrusion of business code. Regional management nodes uniformly control the certificate lifecycle and business permissions, reducing change effective time from hours to seconds. The certificate chain authentication prevents forgery, parameter signature prevents tampering, and OU permission verification provides a three-pronged protection system, achieving a strong association between certificates and real-time business permissions, reducing the cost of manual certificate and permission management. This application also proposes a multi-node mutual trust authentication system for a public key infrastructure, including a processor and a memory. The memory stores a computer program, which, when executed by the processor, implements the steps of the method described above.

[0029] It should be noted that, in the embodiments of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0030] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0031] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0032] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims. All of these forms are within the protection scope of this application.

Claims

1. A method for mutual trust authentication among multiple nodes in a public key infrastructure (PKI) system, applied to a three-tier node architecture, wherein the three-tier node architecture includes a region management node, business sub-nodes, and a connector root node arranged in a hierarchical manner, characterized in that, Multi-node mutual trust authentication methods include: By utilizing regional management nodes to connect to real-name verification service providers and identity credential service providers, the identities of connected enterprises can be verified and digital certificates can be issued to verified enterprises. The regional management node is used to register business sub-nodes for qualified enterprise identities and to register connector root nodes for enterprise identities participating in the business, generating unique node identity identifiers and issuing digital certificates. Connector root nodes and business sub-nodes access the area management node. Connector root nodes access business sub-nodes. Connector root nodes access each other to complete related business. Requests between nodes require mutual trust authentication, encrypted data transmission, and data signature verification.

2. The method for mutual trust authentication between multiple nodes in a public key infrastructure system as described in claim 1, characterized in that, The mutual trust authentication requests between nodes include: Both nodes add the intermediate certificate of the identity credential service provider to the trusted certificate store, realize two-way identity authentication through the certificate chain of digital certificates, and confirm that the domain name of the responding node matches the certificate.

3. The method for mutual trust authentication between multiple nodes in a public key infrastructure system as described in claim 1, characterized in that, The process of nodes requesting each other's interfaces to complete business operations includes: The requesting node uses its certificate private key to sign the request parameters and includes them in the request header; The responding node uses the web container to perform SSL offloading on the received request to obtain the public key of the requesting node's certificate, and sends the public key of the certificate in the request header to the application service. The application service uses the certificate public key to verify the request parameters and signature.

4. The method for mutual trust authentication between multiple nodes in a public key infrastructure system as described in claim 3, characterized in that, The process of completing business operations by requesting interfaces between nodes also includes: The responding node obtains the unique identifier of the requesting node based on the OU of the requesting node's certificate, and verifies the business parameters. The OU is the unique identifier generated after the regional management node verifies the identity.

5. The method for mutual trust authentication between multiple nodes in a public key infrastructure system as described in claim 3, characterized in that, The process of nodes requesting each other's interfaces to complete the business flow includes the following two-way authentication establishment process: The requesting node sends an HTTPS request carrying the client's certificate to the target node; The responder node performs SSL decryption in the web container, extracts the requester's public key and certificate OU field, and sends them to the application service. The requester's public key is stored in the X-Public-Key request header, and the certificate OU field is stored in the X-Certificate-OU request header. The application service retrieves the intermediate CA certificate from the certificate trust store, verifies whether the certificate was issued by a trusted CA, whether the certificate is valid, and whether the certificate has not been revoked. If the verification is successful, it enters the business processing flow; if the verification fails, the connection is terminated.

6. The method for mutual trust authentication between multiple nodes in a public key infrastructure system as described in claim 5, characterized in that, Also includes: Domain name matching verification additionally verifies the consistency between the requested domain name and the CN field of the certificate.

7. The method for mutual trust authentication between multiple nodes in a public key infrastructure system as described in claim 1, characterized in that, After issuing digital certificates to verified enterprise identities, the process also includes binding corresponding business permissions to verified enterprises.

8. The method for mutual trust authentication between multiple nodes in a public key infrastructure system as described in claim 1, characterized in that, The regional management node periodically synchronizes permission policies to the local policy library of each node for dynamic permission injection.

9. A multi-node mutual trust authentication system within a public key infrastructure, characterized in that, It includes a processor and a memory, wherein the memory stores a computer program that, when executed by the processor, implements the steps of the method as described in any one of claims 1 to 8.

Images