A mutual authentication method based on digital certificates under limited participants

Abstract

The present invention discloses a mutual authentication method based on digital certificates under the condition of limited participants. A digital certificate authentication agency performs a digital signature operation according to the information in a digital certificate issuance request. When issuing a digital certificate, the issuer's signature and the issuer's public key are embedded. The mutually authenticated digital certificates are issued by the same digital certificate authentication agency. During mutual authentication, a digital certificate obtains the issuer's public key embedded in itself, and uses the issuer's public key to verify whether the issuer's signature of other digital certificates is correct. If it is correct, the authentication is passed; if it is incorrect, the authentication fails. The use cost of the holders of certificates that need mutual authentication is greatly simplified, and the verification process of digital certificates is greatly simplified, with obvious advantages in space cost and performance cost.

Description

Technical Field

[0001] The present invention belongs to the technical field of digital certificates, and in particular relates to a mutual authentication method under the condition of limited participants. Background Art

[0002] Digital certificates are an important means of confirming user identity and preventing repudiation for various personalized high-value application services. They are widely used in applications such as online banking and electronic contracts.

[0003] Traditional digital certificates, whether they are X.509 digital certificates or V2X certificates based on IEEE1609.2, have similar authentication methods, namely the chain trust relationship of "entity certificate-CA certificate-root certificate", also known as "certificate chain". Figure 1 Shown is the format of a traditional digital certificate.

[0004] For example, Chinese patent 201210338461.0 discloses a method for associating and verifying multiple digital certificates, using one or more digital certificates as the primary certificate, and performing operations such as digital signature on specific information in the issuance request of the secondary certificate through the primary certificate to obtain the primary certificate's proprietary identifier, and the issuing authority (CA) of the secondary certificate includes the primary certificate's proprietary identifier as a component of the secondary certificate content in the secondary certificate after issuance. During verification, the primary certificate's proprietary identifier in the secondary certificate is extracted, and the validity of the proprietary identifier is verified through methods such as signature verification, thereby obtaining the validity of the association.

[0005] In the "certificate chain" system, if you want to authenticate entity certificate A, you need to first verify the CA signature on the A certificate, then verify the root CA signature on the issuer (CA) certificate of the A certificate, and finally verify the self-signature on the CA certificate issuer (root CA) certificate; therefore, during the authentication process, you need to access three certificates: the A certificate, the issuer (CA) certificate of the A certificate, and the CA certificate issuer (root CA) certificate. The latter two are called pre-set certificates, because without these two certificates, the A certificate cannot be verified. At the same time, in order to prevent these two certificates from being maliciously replaced (further destroying the trust chain and forging the A certificate), the verifier needs to obtain these two certificates through reliable channels in advance and keep them properly. Here, we found a problem, that is, the acquisition, storage, and update of CA certificates and root CA certificates need to be carried out in a highly secure environment, which also brings higher usage costs to users.

[0006] If the number of trusted parties is unlimited, the above usage costs are helpless, but still effective and necessary; but at the same time, the "certificate chain" puts forward requirements on the capacity of storage space and the security of the storage location. For IoT embedded modules, any additional space requirements and security requirements will bring additional costs, and this cost multiplied by the huge number of modules may eventually become a huge number. Summary of the invention

[0007] In view of the above technical problems, the technical problem to be solved by the present invention is: in the case of limited participants, without using a certificate chain, the same security as the certificate chain can be achieved, and it is more convenient and has a lower cost.

[0008] To achieve the above-mentioned purpose, the technical solution adopted by the present invention is: a mutual authentication method based on digital certificates under the condition of limited participants, 1. The entity certificate includes one or more issuer public keys; 2. When verifying another entity certificate, the issuer public key is obtained from its own or the other party's entity certificate, and then the public key is used to complete the certificate verification process.

[0009] The digital certificate certification authority performs a digital signature operation based on the information in the digital certificate issuance request, and embeds the issuer's signature and issuer's public key when issuing a digital certificate;

[0010] Mutually authenticated digital certificates are issued by the same digital certificate authority;

[0011] During mutual authentication: a digital certificate obtains the issuer's public key embedded in itself, and uses the issuer's public key to verify whether the issuer's signature of other digital certificates is correct; if correct, the verification succeeds; if incorrect, the verification fails.

[0012] Furthermore, a digital certificate includes the issuer's signature and issuer's public key of one or more digital certificate certification authorities; mutually authenticated digital certificates include one or more identical issuer public keys.

[0013] Furthermore, when issuing a digital certificate, the issuer's public key is attached to the subject item, issuer item, certificate extension item or other certificate content of the digital certificate. More preferably, in order to improve the independence of the issuer's public key and avoid the influence of the digital certificate issuance procedure, the issuer's public key is attached to the certificate extension item of the digital certificate.

[0014] The present invention has the following beneficial effects: In the above verification process, the participation of the certificate chain is not required, and only the certificates of the participants themselves are required. The use cost of the holders of certificates that need mutual authentication is greatly simplified, and the verification process of digital certificates is greatly simplified, with obvious advantages in space cost and performance cost. The present invention is an innovative invention that starts from practicality, breaks through traditional thinking, and creatively uses the principles of certificates and public key algorithms. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 It is a digital certificate format of the prior art.

[0016] Figure 2 This is the digital certificate format of the mutual authentication method under the limited participant condition of the embodiment of the present invention. DETAILED DESCRIPTION

[0017] To facilitate understanding by those skilled in the art, the present invention is further described below in conjunction with embodiments and drawings.

[0018] A digital certificate is an online identifier that proves the user's identity. It identifies the identities of all parties in the communication network and can ensure that the transactions you conduct on the network are safe and reliable. The main functions of a digital certificate are as follows:

[0019] 1. Identity authentication: The main contents of a digital certificate include: the identity information of the certificate owner, the public key of the certificate owner, the validity period of the public key, the name of the CA that issued the digital certificate, the digital signature of the CA, etc.

[0020] 2. Encrypted transmission of information: Data is transmitted online through digital certificates. These data must be encrypted and then transmitted on the network in the form of a password. The sender encrypts the file with the receiver's public key, and the receiver decrypts it with his or her own private key to obtain the plain text of the file.

[0021] 3. Non-repudiation of digital signatures: In real life, non-repudiation is achieved with official seals, signatures, etc., but on the Internet, it can be achieved with the help of digital signatures with digital certificates.

[0022] Digital Certificate Authority (CA): It is the issuing authority of certificates. CA is responsible for issuing certificates, authenticating certificates, and managing issued certificates. It must formulate policies and specific procedures to verify and identify user identities, and sign user certificates to ensure the identity of the certificate holder and the ownership of the public key.

[0023] Traditional digital certificates only contain the CA's signature. Figure 2In the new digital certificate shown, when issuing the certificate, the CA not only adds its own signature, but also embeds its own public key (PUBK-CA) as part of the certificate into the issued digital certificate.

[0024] Assume that in the above model, the CA issues two entity certificates A and B. In addition to the CA signature, A and B also contain the CA's public key (PUBK-CA).

[0025] When the holder of certificate A authenticates certificate B, he can verify it by following the steps below:

[0026] 1) Get the CA public key (PUBK-CA) from your own certificate;

[0027] 2) Use PUBK-CA to verify whether the CA signature of certificate B is correct. If correct, the verification passes; if incorrect, the verification fails;

[0028] In the above verification process, the participation of the certificate chain is not required, and only the participant's own certificate is required. This greatly simplifies the use cost of certificate A and certificate B holders, and also greatly simplifies the certificate verification process.

[0029] The above certificate verification process seems to have many limitations in use. Compared with the traditional certificate chain mode, it is not flexible enough and has poor scalability. However, in fact, this method is a creative way to improve convenience and maintain security by giving up some flexibility.

[0030] Imagine a scenario where a device has three independent components that need to authenticate each other before they can work. In traditional digital certificate scenarios, not only do you need to issue physical certificates to each of the three components, you also need to install a complete certificate chain on each of the three components, which places requirements on the capacity of the storage space and the security of the storage location. For IoT embedded modules, any additional space requirements and security requirements will bring additional costs, which, multiplied by the large number of modules, may eventually become a huge number.

[0031] The solution designed by the present invention only needs to store one certificate, and the verification process only needs one step, with obvious advantages in space cost and performance cost. The components on the same device use certificates from the same CA, which is not difficult in the application mode and does not increase any cost. The flexibility sacrificed by the present invention is not needed in the above scenario. It is an innovative invention that breaks through traditional thinking and creatively uses the principles of certificates and public key algorithms from a practical point of view.

[0032] The above embodiments are only for illustrating the technical idea of ​​the present invention, and cannot be used to limit the protection scope of the present invention. Any changes made on the basis of the technical solution in accordance with the technical idea proposed by the present invention shall fall within the protection scope of the present invention.

Claims

1. A mutual authentication method based on digital certificates under limited participant conditions, characterized in that: The digital certificate certification authority performs a digital signature operation based on the information in the digital certificate issuance request, and embeds the issuer's signature and issuer's public key when issuing a digital certificate; Mutually authenticated digital certificates are issued by the same digital certificate authority; During mutual authentication: a digital certificate obtains the issuer's public key embedded in itself, and uses the issuer's public key to verify whether the issuer's signature of other digital certificates is correct; if correct, the verification succeeds; if incorrect, the verification fails.

2. The mutual authentication method based on digital certificates under limited participant conditions according to claim 1, characterized in that: A digital certificate includes the issuer's signature and issuer's public key of one or more digital certificate certification authorities; mutually authenticated digital certificates include one or more identical issuer public keys.

3. The mutual authentication method based on digital certificates under limited participant conditions according to claim 1 or 2, characterized in that: When issuing a digital certificate, the issuer's public key is attached to the subject item, issuer item, and certificate extension item of the digital certificate.

Images