A PKI certificate system model and certificate management method based on blockchain
By introducing blockchain and RSA accumulator technology into the PKI system, the centralization problem in traditional PKI systems is solved, decentralized, transparent and efficient certificate management is achieved, and the reliability and efficiency of network security is enhanced.
Patent Information
- Application Number
- CN202111482274.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2021-12-07
- Publication Date
- 2024-12-13
- Estimated Expiration
- 2041-12-07
AI Technical Summary
Traditional PKI systems rely on centralized certificate authorities, which poses the risk of insufficient transparency and single point of failure, resulting in the loss or tampering of user identity information and the collapse of the trust system.
Combining blockchain technology and RSA accumulator, a blockchain-based PKI system model was designed, and transparent recording and verification of CA operations was achieved through alliance chains and smart contracts, and dual RSA accumulator was introduced for certificate management to ensure certificates. legality and validity.
It provides decentralized, transparent and traceable certificate management, avoids storage space pressure, and users can verify the legitimacy of digital certificates locally, enhancing the reliability and efficiency of network security.
Smart Images
Figure CN114186288B_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of blockchain technology application, and mainly relates to blockchain technology, cryptographic RSA accumulator, public key infrastructure (PKI) and digital certificate management method. Background Art
[0002] With the development and popularization of the Internet, network activities have occupied an increasingly large proportion in human daily activities. The development of mobile Internet enables people to communicate through terminals at any time, while the development of e-commerce and mobile payment technology has shifted the focus of economic activities to online. There is no doubt that strengthening network security construction is of vital importance to the actual economy.
[0003] The generation and distribution of security keys is the basis of secure Internet communications. The PKI system is the most popular solution for network communications. A PKI system includes a certificate authority (CA), a registration authority (RA), a certificate issuing system, and a PKI policy. It provides a secure method for verifying identity on the Internet by implementing the generation, management, distribution, and revocation of certificates based on public key encryption. With the continuous development of PKI technology, the PKI system has been widely used in various secure communication scenarios, such as e-commerce, e-government, online banking, and more and more e-health industries.
[0004] However, in recent years, many security incidents involving well-known CAs have exposed the fragility of the traditional PKI system structure. The reason is that the current PKI structure has two fatal flaws in the process of binding trusted entities to digital identities due to its over-reliance on centralized certificate authorities. First, the credibility of the third-party certification center cannot be guaranteed due to its lack of transparency. Second, if the certification center has a single point of failure or key leakage, it will lead to the loss or even tampering of user identity information, and even the collapse of the entire trust system.
[0005] Blockchain technology is a decentralized distributed ledger technology that can build a trusted distributed environment in an untrusted public environment through a consensus mechanism, implant trust directly into the system without relying on a trusted third party, and use encryption algorithms to transparently record and verify all transaction records.
[0006] Blockchain technology has the potential to solve the problems in the traditional PKI structure. In the blockchain system, participants can jointly manage and maintain the operation of the system with third-party organizations such as certification agencies and registration agencies, and all processes are transparent and traceable, effectively preventing the hidden dangers of third-party abuse of power. Taking this into account, this paper designs a blockchain-based PKI system model based on blockchain, RSA accumulator and other technologies, and proposes its digital certificate management method based on this system. Summary of the invention
[0007] The main purpose of this invention is to propose a PKI certificate system model and digital certificate management method based on blockchain and RSA accumulator, combining the traditional PKI digital certificate trust system with blockchain, aiming to solve the centralization problem in the traditional PKI system, and by introducing RSA accumulator technology, optimize the performance problems caused by introducing blockchain in the PKI system. The system structure diagram is shown in the figure below. Figure 1 shown.
[0008] In order to achieve the purpose of the present invention, the technical solution adopted by the present invention is: a PKI digital certificate system model and a digital certificate management method based on blockchain, wherein the model is as follows: Figure 2 As shown, it mainly includes the following roles:
[0009] 1CA Node
[0010] A CA node is an organization that manages and maintains digital certificates in a PKI system, and provides operations such as issuing, revoking, and updating digital certificates.
[0011] 2. Service Provider
[0012] The service provider is the provider of network services and the initiator of the certificate request. It obtains the certificate by initiating a certificate application to the CA node.
[0013] 3 users
[0014] Users are requesters of network services. They can verify the authenticity and legitimacy of digital certificates based on the digital certificates and certificates provided by the server and the data stored on the blockchain.
[0015] 4. Blockchain
[0016] The blockchain uses the consortium chain as the underlying chain and builds a blockchain network with Docker containers as the carrier. By deploying multiple smart contracts, it realizes the audit of CA's digital certificate operation records and provides users with RSA accumulator parameters for verifying the validity of digital certificates.
[0017] The digital certificate management method of this model mainly involves three aspects: certificate registration, certificate revocation, and certificate verification:
[0018] Certificate registration. The service provider sends a certificate registration request to the CA node and submits identity information. The CA node checks the physical identity of the service provider offline, generates and issues the corresponding digital certificate CertReg. After that, the CA node will retrieve the latest accumulator status A on the blockchain. pub , by adding the certificate CertReg to A pub Add the certificate to the certificate issuance set and return a registration proof. The certificate information will be formatted as the CertControl data type and uploaded to the blockchain through the transaction. When the transaction is verified, the proof will be returned to the service provider as evidence of successful certificate registration. The process is as follows: Figure 3 shown.
[0019] Certificate revocation. Due to changes in service provider information or private key leakage, the service provider can request the CA to revoke the digital certificate CertRev. The CA node will retrieve the latest accumulator state A in the blockchain. rev , by adding the revoked digital certificate CertRev to A rev Add the certificate to the certificate invalidation set. Then, through the transaction, the accumulator state A on the blockchain rev The corresponding CertControl is updated. When the transaction verification is passed, the certificate is revoked successfully. The process is as follows Figure 4 shown.
[0020] Certificate verification. Before establishing a secure connection with a service provider, the user needs to verify the legitimacy of the digital certificate provided by the service provider, which mainly includes the following steps. First, the user queries the corresponding CertControl on the blockchain based on the certificate serial code provided by the service provider; second, the user queries the latest accumulator status A on the blockchain. pub and A rev ; Third, based on the registrationproof provided by the service provider and the accumulator state A pub Verify whether the certificate is in the CA-issued certificate set; Fourth, based on the digital certificate provided by the service provider and the latest accumulator status A rev Verify whether the certificate is in the CA revoked certificate set; only after both verification stages are passed, the user can establish a secure connection with the service provider through the digital certificate. Figure 5 shown.
[0021] Compared with the existing PKI system model and certificate management method, the PKI system based on blockchain and RSA accumulator and the certificate management method thereof proposed in the present invention have the following benefits:
[0022] 1. Compared with the traditional PKI system, the blockchain-based PKI system model described in the present invention provides transparency and traceability in an unsafe Internet environment. CA operations on digital certificates are uploaded by coupled blockchain nodes to the blockchain maintained by multiple parties. It has the characteristics of decentralization and traceability of CA behavior.
[0023] 2. Based on the design of the PKI model based on blockchain, the present invention introduces RSA accumulator technology. Through the knowledge proof scheme, it avoids storing a large number of digital certificates on the blockchain and compresses the storage space.
[0024] 3. In the process of digital certificate management, the present invention proposes a digital certificate management method based on blockchain and dual RSA accumulators according to the characteristics of the entire life cycle of digital certificate management and RSA accumulators. All participants in the PKI system can verify the legitimacy of the digital certificate locally through the accumulator status disclosed by the blockchain, combined with the digital certificate and the corresponding proof. BRIEF DESCRIPTION OF THE DRAWINGS
[0025] Figure 1 This is the system architecture diagram.
[0026] Figure 2 This is the system model diagram.
[0027] Figure 3 Flowchart for issuing digital certificates.
[0028] Figure 4 This is a flowchart for digital certificate revocation.
[0029] Figure 5 Flowchart for digital certificate verification. DETAILED DESCRIPTION
[0030] In order to make the purpose, content and advantages of the present invention clearer and more specific, so as to facilitate those skilled in the art to understand the present invention, the present invention will be further described in detail below with reference to the accompanying drawings. The specific steps of the implementation case are as follows:
[0031] Step 001: Initialization phase. Generate a large number N with unknown factorization through RSA2048, and select a generator base g, which represents an empty accumulator. Initialize the accumulator A with this pub and A rev , and publish the initial state of the accumulator on the blockchain.
[0032] Step 002: Certificate issuance application. The service provider submits a certificate issuance application to the CA node. The CA node verifies the information provided by the service provider, generates a corresponding digital certificate, and calculates the latest accumulator state A representing the issuance set. pub .
[0033] Step 003: Certificate registration. The CA node submits the certificate issuance information and the latest accumulator status A to the blockchain through the submission node. pub .
[0034] Step 004: Update the existence proof. After the service provider detects the registration of a new digital certificate, it updates the registerproof it holds according to the newly issued digital certificate.
[0035] Step 005: Certificate revocation. When a digital certificate expires or a service provider submits a certificate revocation application to the CA node, the CA node checks whether the service provider identity matches the revoked certificate and calculates the latest accumulator state A representing the revocation set. rev The CA node publishes information and the latest accumulator state A to the blockchain by submitting the node pub .
[0036] Step 006: Certificate verification. The user obtains the digital certificate and the corresponding registerproof from the service provider, and queries the latest accumulator status A from the blockchain. pub and A rev , verify the validity of the digital certificate by calculation. If the certificate and register proof can be combined with the accumulator state A pub Agree, indicating that the digital certificate is issued by a legitimate CA. If the certificate is consistent with the accumulator status A rev Combined with the ability to generate proof of non-existence, this indicates that the digital certificate is still valid.
[0037] Step 007: Establishing a connection. After the validity of the digital certificate is verified, the user can establish secure communication with the service provider through the public key attached to the digital certificate.
[0038] The above is a specific implementation method of the present invention. Based on the transparent, unchangeable and traceable characteristics of blockchain technology, the present invention proposes a blockchain-based PKI system model and certificate management method without changing the traditional PKI system. The present invention recommends building on the alliance blockchain, which is only open to limited third parties (regulators) and specific groups. Through the organizational participation method of the alliance blockchain, CAs of different organizations can be integrated into the same trust system. Users can query the corresponding accumulator status directly on the blockchain, and combine the digital certificate and proof provided by the service provider to locally implement the security verification of the digital certificate. Especially in the presence of frequent cross-domain authentication, the present invention has great practical value.
Claims
1. A PKI digital certificate system model and digital certificate management method based on blockchain, characterized by: This method is implemented in a model structure, which includes the following roles: 1) CA node; The CA node is an organization that manages and maintains digital certificates in the PKI system, and provides digital certificate issuance, revocation, and renewal operations; 2) Service providers; The service provider is the provider of network services and the initiator of the certificate request. It obtains the certificate by initiating a certificate application to the CA node. 3) Users; The user is the requester of the network service. The user can verify the authenticity and legitimacy of the digital certificate based on the digital certificate and proof provided by the server and the data stored on the blockchain; 4) Blockchain; The blockchain uses the consortium chain as the underlying chain and builds a blockchain network with Docker containers as the carrier. By deploying multiple smart contracts, it realizes the audit of CA's digital certificate operation records and provides users with RSA accumulator parameters for verifying the validity of digital certificates. The digital certificate management method of this model structure involves three aspects: certificate registration, certificate revocation, and certificate verification: Certificate registration: The service provider sends a certificate registration request to the CA node and submits identity information. The CA node checks the physical identity of the service provider offline, generates and issues the corresponding digital certificate CertReg. After that, the CA node retrieves the latest accumulator status A on the blockchain. pub , add the certificate CertReg to A pub , add the certificate to the certificate issuance set and return a registration proof; the relevant information of the certificate will be formatted as the CertControl data type and uploaded to the blockchain through the transaction; when the transaction verification is successful, the registration proof will be returned to the service provider as evidence of successful certificate registration; Certificate revocation: Due to changes in service provider information or private key leakage, the service provider requests the CA node to revoke the digital certificate CertRev; the CA node will retrieve the latest accumulator status A in the blockchain rev , by adding the revoked digital certificate CertRev to A rev Add the certificate to the certificate revocation set; then, through the transaction, the accumulator state A on the blockchain rev Update the corresponding CertControl. When the transaction verification is passed, the certificate revocation is successful. Certificate verification; Before a user establishes a secure connection with a service provider, the user needs to verify the legitimacy of the digital certificate provided by the service provider, which includes the following steps: First, the user queries the corresponding CertControl on the blockchain based on the certificate serial code provided by the service provider; Second, query the latest accumulator state A on the blockchain pub and A rev ; Third, based on the registration proof provided by the service provider and the accumulator status A pub Verify whether the certificate is in the CA certificate issuance set; Fourth, based on the digital certificate provided by the service provider and the latest accumulator status A rev Verify whether the certificate is in the CA certificate invalidation set; only after both verification stages are passed, the user can establish a secure connection with the service provider through the digital certificate; Step 001: Initialization phase; Generate a large number N with unknown factorization through RSA2048, and select a generator base g, which represents an empty accumulator; initialize the accumulator A with this pub and A rev , and publish the initial state of the accumulator on the blockchain; Step 002: Certificate issuance application: The service provider submits a certificate issuance application to the CA node. The CA node verifies the information provided by the service provider, generates a corresponding digital certificate, and calculates the latest accumulator state A representing the issuance set. pub ; Step 003: Certificate registration; The CA node submits the certificate issuance information and the latest accumulator state A to the blockchain through the submission node pub ; Step 004: Update of existence proof: After the service provider detects the registration of a new digital certificate, it updates the registration proof it holds according to the newly issued digital certificate; Step 005: Certificate revocation; When a digital certificate expires or a service provider submits a certificate revocation application to the CA node, the CA node checks whether the service provider identity matches the revoked certificate and calculates the latest accumulator state A representing the certificate invalidation set. rev ; CA node publishes information and the latest accumulator state A to the blockchain through the submission node pub ; Step 006: Certificate verification; The user obtains the digital certificate and the corresponding registration proof from the service provider, and queries the latest accumulator status A from the blockchain. pub and A rev , verify the validity of the digital certificate by calculation. If the certificate and registration proof can be combined with the accumulator state A pub Agree, indicating that the digital certificate is issued by a legitimate CA. If the certificate is consistent with the accumulator status A rev Combined with the ability to generate proof of non-existence, this means that the digital certificate is still valid; Step 007: Establish a connection; after verifying the validity of the digital certificate, the user can establish secure communication with the service provider through the public key attached to the digital certificate.