Digital certificate processing method and device based on blockchain

Abstract

The present application provides a digital certificate processing method and processing device based on blockchain, the processing method includes: receiving a query request for a digital certificate from a user, the query request includes address information of the issuance operation of the digital certificate, the address information of the issuance operation is used to indicate the address of the data of the issuance operation stored in the blockchain; obtaining the data of the issuance operation of the digital certificate in the blockchain according to the address information of the issuance operation, the data of the issuance operation is stored in a target block in the blockchain, the target block includes first address information, the first address information is used to indicate the address of the data of the next operation processing of the issuance operation stored in the blockchain; obtaining the current state of the digital certificate according to the first address information; sending the current state of the digital certificate to the user. Based on the technical solution of the present application, by associating the blocks storing the data of the operation processing of the digital certificate with each other, the efficiency of the certificate status verification can be improved.

Description

Technical Field

[0001] The present application relates to the field of information technology, and more specifically, to a blockchain-based digital certificate processing method and device. Background Art

[0002] Public key infrastructure (PKI) is a set of infrastructure consisting of hardware, software, participants, management policies and processes, which aims to create, manage, distribute, use, store and revoke digital certificates. Its essence is to standardize asymmetric key management and the mapping relationship between identity and public key; the birth of public key cryptography marks the beginning of a new era in cryptography, and the application of cryptographic technology has developed from simple confidential communication to identity authentication.

[0003] PKI includes a certificate authority (CA), which issues certificates to certificate applicants through its own private key signature, providing a trusted digital identity, thereby ensuring the user's authenticated identity during the communication process and protecting the confidentiality and integrity of the transmitted information. Usually, the legitimacy of the user's identity can be determined by verifying whether the user's digital certificate is legitimate; currently, the certificate revocation list (CRL) or the online certificate status protocol (OCSP) is usually used to verify the status of the certificate; however, since the CRL mechanism is limited by the update cycle and the OCSP mechanism is limited by the increase in the number of certificates and query requests, there is a delay in the certificate status verification.

[0004] Therefore, how to improve the efficiency of digital certificate status verification has become an urgent problem to be solved. Summary of the invention

[0005] The present application provides a blockchain-based digital certificate processing method and device, which can improve the efficiency of digital certificate status verification by recording the operation log of the digital certificate in the blockchain.

[0006] In a first aspect, a blockchain-based digital certificate processing method is provided, comprising: receiving a query request for a digital certificate from a user, the query request comprising address information of an issuance operation of the digital certificate, the address information of the issuance operation being used to indicate an address of data of the issuance operation stored in the blockchain; obtaining data of the issuance operation of the digital certificate in the blockchain according to the address information of the issuance operation, the data of the issuance operation being stored in a target block in the blockchain, the target block comprising first address information, the first address information being used to indicate an address of data of a next operation processing of the issuance operation stored in the blockchain; obtaining a current status of the digital certificate according to the first address information; and sending the current status of the digital certificate to the user.

[0007] It should be understood that the blockchain is used to store data on at least one operation processing of the digital certificate by the digital certificate authority CA, which is mutually associated in the blockchain through the address information of the block, and the at least one operation processing includes the issuance operation.

[0008] The method of the present application can be executed by a computing device, or can be executed by a smart chip in one or more computing devices. The computing device can be any device that has the function of maintaining and managing blockchain. For example, it can include any device known in the current technology; or, the computing device can also refer to a chip that has the function of maintaining and managing blockchain.

[0009] It should be understood that blockchain can be used to store CA's operation log records of digital certificates, and the data of at least one operation process in the operation log records are mutually related; for example, the data of any operation process in at least one operation process can be used to query the data of the operation process related to the any operation process (for example, the previous operation process or the next operation process).

[0010] It should also be understood that the current status of a digital certificate refers to the status of the digital certificate after the last operation processed by the CA on the digital certificate.

[0011] In an embodiment of the present application, by storing data of at least one operation processed by the CA on the digital certificate in the blockchain, the data of at least one operation processed are mutually associated in the blockchain through the address information of the block; further, when the user queries the current status of the digital certificate, the address information of the issuance operation of the digital certificate can be sent to the blockchain; the blockchain can obtain the current status of the digital certificate according to the address information of the issuance operation of the digital certificate, that is, the subsequent life cycle of the digital certificate can be queried in the blockchain according to the address information of the issuance operation of the digital certificate, thereby realizing the query of the status of the digital certificate on the blockchain; thereby avoiding the delay problem caused by the user's need to centrally query the server for the current status of the digital certificate, and can improve the efficiency of digital certificate status verification.

[0012] In one possible implementation, the blockchain receives a query request for a digital certificate sent by a user, and the query request includes the address information of the issuance operation of the digital certificate. The blockchain can query one by one through the address information of the issuance operation, obtain the address information of the data processed by the latest operation in the blockchain, and return the data processed by the latest operation to the user.

[0013] In one possible implementation, the blockchain receives a query request for a digital certificate sent by a user, and the query request includes the address information of the issuance operation of the digital certificate. The blockchain can query one by one through the address information of the issuance operation. When the operation processing data stored in an address information is obtained, the blockchain can return it to the user one by one; until the latest operation processing data is returned to the user.

[0014] In one possible implementation, the user can directly interact with the blockchain, and the user can query the status of the digital certificate locally, or the user can directly send a query request for the digital certificate to the node that manages and maintains the blockchain.

[0015] In one possible implementation, the user cannot directly interact with the blockchain, so the user needs to forward the information through the bookkeeper in the blockchain; that is, the user can send a query request for a digital certificate to the blockchain through the bookkeeping node in the blockchain.

[0016] In combination with the first aspect, in certain implementations of the first aspect, the target block also includes second address information, and the second address information is used to represent the address of the data processed by the previous operation of the issuance operation stored in the blockchain.

[0017] In a possible implementation, the blockchain may include a first block, which may refer to any block in the blockchain; the first block may be used to store data processed by a first operation, and the first operation process may refer to any one of an issuance operation, a revocation operation, a freeze operation, a thawing operation, a rollback operation, or an update operation. The first block may include two address information; wherein one address information is used to indicate an address in the blockchain where data processed by the previous operation of the first operation is stored, and the other address information is used to indicate an address in the blockchain where data processed by the next operation of the first operation is stored.

[0018] In an embodiment of the present application, the data structure in any block in the blockchain may include the address of the previous operation (linked to the previous operation) and the address of the next operation (modifying the field to achieve backward linking), thereby enabling the data of the CA's operation processing of the digital certificate to be uploaded to the chain; the data processed by all operations can be associated through the address information of the block.

[0019] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes:

[0020] Receive a first transaction from the CA, the first transaction is used to store data processed by a first operation in the blockchain, the first transaction carries target address information, the target address information is used by the blockchain to determine an address for storing data processed by a previous operation of the first operation, the first operation processing includes any one of the issuance operation, revocation operation, freeze operation, thawing operation, rollback operation or update operation; send address information of a first block to the CA, the first block is used to store the data processed by the first operation.

[0021] In combination with the first aspect, in some implementations of the first aspect, when the first operation is processed as the issuance operation, the target address information refers to the second address information.

[0022] It should be understood that the issuance operation may refer to the operation used by the CA for issuing digital certificates. The revocation operation may refer to the operation of the CA for terminating the certificate life of a digital certificate. The freezing operation may include the CA's temporary freezing of a digital certificate, rather than permanent revocation. The thawing operation may refer to the CA's revocation of a freezing operation on a digital certificate. The rollback operation may include the CA's withdrawal of an erroneous revocation, erroneous freezing, or unmodified certificate operation on a digital certificate. The update operation refers to the CA's update of the certificate content of a digital certificate; for example, an update of a trial period extension, etc.

[0023] In combination with the first aspect, in some implementations of the first aspect, the second address information is a preconfigured initialization address.

[0024] In a possible implementation, the preconfigured initialization address may be “0x00”, or the preconfigured initialization address may be empty.

[0025] In combination with the first aspect, in certain implementations of the first aspect, when the first operation processing is not the issuance operation, the target address information refers to the address information of the data of the previous operation processing of the first operation processing stored in the blockchain, or the target address information refers to the address information of the issuance operation.

[0026] In combination with the first aspect, in some implementations of the first aspect, the blockchain further includes a second block, further including:

[0027] The address information of the next operation process included in the second block is modified according to the address information of the first block, and the second block refers to a block in the blockchain that stores data of the previous operation process of the first operation process.

[0028] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes:

[0029] Verify that the current status of the digital certificate is legal based on the address information of the issuing operation.

[0030] In an embodiment of the present application, when the first operation processing is not the issuance operation of the digital certificate by the CA, the current status of the digital certificate can also be obtained, and subsequent operations on the digital certificate can be continued when it is determined that the digital certificate is currently in a legal state.

[0031] In combination with the first aspect, in some implementations of the first aspect, acquiring the current state of the digital certificate according to the first address information includes:

[0032] Determine the target block in the blockchain according to the address information of the issuance operation, where the target block refers to the block in the blockchain that stores the data of the issuance operation;

[0033] When the first address information is empty or a preset field, data of the issuance operation of the digital certificate is obtained.

[0034] In an embodiment of the present application, when the first address information included in the target block is empty, or a preset field or other pre-configured field, it means that when the issuance operation is the last operation of the CA on the digital certificate, the data of the issuance operation of the digital certificate is obtained in the target block; that is, the issuance operation of the digital certificate is the current status of the digital certificate.

[0035] In combination with the first aspect, in some implementations of the first aspect, when the issuance operation is not the last operation processed by the CA on the digital certificate, the method further includes:

[0036] Querying the blockchain for address information of the last operation processed by the digital certificate according to the address information of the next operation included in the target block;

[0037] According to the address information of the last operation process, data of the last operation process of the digital certificate is obtained in the blockchain.

[0038] In an embodiment of the present application, if it is determined that the issuance operation is the last operation of the CA on the digital certificate, the current state of the digital certificate can be determined based on the data of the issuance operation. If it is determined that the issuance operation is not the last operation of the CA on the digital certificate, the address information of the last operation processing of the digital certificate can be queried in the blockchain based on the address information of the next operation included in the target block, and then the data of the last operation processing of the digital certificate is obtained, that is, the current state of the digital certificate is obtained.

[0039] In combination with the first aspect, in some implementations of the first aspect, the query request also includes an identifier of the digital certificate.

[0040] In an embodiment of the present application, the target digital certificate corresponding to the query request can be determined from multiple digital certificates included in the target block through the identification of the digital certificate.

[0041] In combination with the first aspect, in some implementations of the first aspect, the first address information and target address information included in the first block are not used for hash calculation of the first block.

[0042] In an embodiment of the present application, the address of the previous operation and the address of the next operation included in any block in the blockchain are not used for the hash calculation of the block.

[0043] In a second aspect, a digital certificate processing method based on blockchain is provided, comprising:

[0044] Sending a query request for a digital certificate to a blockchain, the query request including address information of an issuance operation of the digital certificate, the address information of the issuance operation being used to indicate an address at which data of the issuance operation is stored in the blockchain;

[0045] Receive the current state of the digital certificate from the blockchain, the current state of the digital certificate is obtained in the blockchain according to the first address information, the data of the issuance operation is stored in the target block in the blockchain, the target block includes the first address information, and the first address information is used to represent the address of the data processed by the next operation of the issuance operation stored in the blockchain.

[0046] The method of the present application can be executed by a terminal device, or can be executed by a smart chip in one or more terminal devices. The terminal device can be any terminal device that interacts with a computing device that has the function of maintaining and managing a blockchain.

[0047] In combination with the second aspect, in certain implementations of the second aspect, the target block also includes second address information, and the second address information is used to represent the address of the data processed by the previous operation of the issuance operation stored in the blockchain.

[0048] In a possible implementation, the blockchain may include a first block, which may refer to any block in the blockchain; the first block may be used to store data processed by a first operation, and the first operation process may refer to any one of an issuance operation, a revocation operation, a freeze operation, a thawing operation, a rollback operation, or an update operation. The first block may include two address information; wherein one address information is used to indicate an address in the blockchain where data processed by the previous operation of the first operation is stored, and the other address information is used to indicate an address in the blockchain where data processed by the next operation of the first operation is stored.

[0049] In conjunction with the second aspect, in some implementations of the second aspect, when the first operation process is the issuance operation, the method further includes:

[0050] An application request for the digital certificate is sent to the CA, wherein the application request includes the identity information of the user.

[0051] In combination with the second aspect, in some implementations of the second aspect, the first address information and the second address information are preconfigured initialization addresses.

[0052] In combination with the second aspect, in certain implementations of the second aspect, when the first operation processing is not the issuance operation, the second address information is obtained based on the address information of the previous operation processing of the first operation processing, and the first address information is a preconfigured initialization address.

[0053] In conjunction with the second aspect, in some implementations of the second aspect, it is characterized in that the first operation processing refers to any one of the following operations performed by the CA on the digital certificate:

[0054] Issue operation, revoke operation, freeze operation, unfreeze operation, rollback operation or update operation.

[0055] In combination with the second aspect, in some implementations of the second aspect, the first address information and target address information included in the first block are not used for hash calculation of the first block.

[0056] In an embodiment of the present application, the address of the previous operation and the address of the next operation included in any block in the blockchain are not used for the hash calculation of the block.

[0057] In a third aspect, a digital certificate processing method based on blockchain is provided, comprising:

[0058] Sending a first transaction to a blockchain, the first transaction being used to store data of a first operation processed by a digital certificate authority CA on the blockchain, the first transaction carrying target address information, the target address information being used by the blockchain to determine an address for storing data of a previous operation processed by the first operation;

[0059] Receive address information of a first block from the blockchain, where the first block refers to a block in the blockchain that stores data processed by the first operation.

[0060] The method of the present application can be executed by a server, or can be executed by a smart chip in one or more servers. The server can be any device that has the function of maintaining and managing digital certificates. For example, it can include any device known in the current technology; or, the computing device can also refer to a chip that has the function of maintaining and managing blockchain. For example, the server can refer to a server of a certificate authority.

[0061] It should be understood that in the embodiments of the present application, the CA can upload the data of the operation and processing of the digital certificate to the blockchain, that is, store it in the blockchain.

[0062] In combination with the third aspect, in certain implementations of the third aspect, when the first operation processing is the digital certificate issuance operation, the target address information refers to the address of the data of the previous operation processing of the issuance operation stored in the blockchain.

[0063] In combination with the third aspect, in certain implementations of the third aspect, the target address information is a preconfigured initialization address.

[0064] In conjunction with the third aspect, in some implementations of the third aspect, the following further includes:

[0065] An application request for the digital certificate is received from a user, wherein the application request includes the identity information of the user.

[0066] In combination with the third aspect, in certain implementations of the third aspect, when the first operation processing is not the digital certificate issuance operation, the target address information refers to the address of the data of the previous operation processing of the first operation processing stored in the blockchain, or, the target address information refers to the address of the data of the digital certificate issuance operation stored in the blockchain.

[0067] In combination with the third aspect, in certain implementations of the third aspect, the first block includes third address information and fourth address information, the third address information is used to indicate the address of data of the previous operation processed by the first operation processing stored in the blockchain, and the fourth address information is used to indicate the address of data of the next operation processed by the first operation processing stored in the blockchain.

[0068] In combination with the third aspect, in certain implementations of the third aspect, the fourth address information is obtained by the blockchain based on address information of a third block, and the third block refers to a block in the blockchain that stores data for the next operation process of the first operation process.

[0069] In conjunction with the third aspect, in some implementations of the third aspect, the first operation processing refers to any one of the following operations performed by the CA on the digital certificate:

[0070] Issue operation, revoke operation, freeze operation, unfreeze operation, rollback operation or update operation.

[0071] In a fourth aspect, a blockchain-based digital certificate processing method is provided, comprising:

[0072] Receive a first transaction from a digital certificate authority CA, where the first transaction is used to store data of a first operation processed by the digital certificate authority CA on the blockchain, where the first transaction carries target address information, and the target address information is used by the blockchain to determine an address for storing data of a previous operation processed by the first operation;

[0073] Sending address information of a first block to the CA, where the first block refers to a block in the blockchain that stores data processed by the first operation.

[0074] The method of the present application can be executed by a computing device, or can be executed by a smart chip in one or more computing devices. The computing device can be any device that has the function of maintaining and managing blockchain. For example, it can include any device known in the current technology; or, the computing device can also refer to a chip that has the function of maintaining and managing blockchain.

[0075] In combination with the fourth aspect, in certain implementations of the fourth aspect, when the first operation processing is the digital certificate issuance operation, the target address information refers to the address of the data of the previous operation processing of the issuance operation stored in the blockchain.

[0076] In combination with the fourth aspect, in certain implementations of the fourth aspect, the target address information is a preconfigured initialization address.

[0077] In combination with the fourth aspect, in certain implementations of the fourth aspect, when the first operation processing is not the digital certificate issuance operation, the target address information refers to the address of the data of the previous operation processing of the first operation processing stored in the blockchain, or, the target address information refers to the address of the data of the digital certificate issuance operation stored in the blockchain.

[0078] In combination with the fourth aspect, in certain implementations of the fourth aspect, the first block includes third address information and fourth address information, the third address information is used to indicate the address of data of the previous operation processed by the first operation processing stored in the blockchain, and the fourth address information is used to indicate the address of data of the next operation processed by the first operation processing stored in the blockchain.

[0079] In combination with the fourth aspect, in certain implementations of the fourth aspect, the fourth address information is obtained by the blockchain based on address information of a third block, and the third block refers to a block in the blockchain that stores data for the next operation process of the first operation process.

[0080] In conjunction with the fourth aspect, in some implementations of the fourth aspect, the first operation processing refers to any one of the following operations performed by the CA on the digital certificate:

[0081] Issue operation, revoke operation, freeze operation, unfreeze operation, rollback operation or update operation.

[0082] In a fifth aspect, a blockchain-based digital certificate processing device is provided, comprising: a transceiver unit, configured to receive a query request for a digital certificate from a user, the query request comprising address information of an issuance operation of the digital certificate, the address information of the issuance operation being used to indicate an address of data of the issuance operation stored in the blockchain; a processing unit, configured to obtain data of the issuance operation of the digital certificate in the blockchain according to the address information of the issuance operation, the data of the issuance operation being stored in a target block in the blockchain, the target block comprising first address information, the first address information being used to indicate an address of data of the next operation processing of the issuance operation stored in the blockchain; obtaining a current status of the digital certificate according to the first address information; the transceiver unit is also configured to send the current status of the digital certificate to the user.

[0083] In a possible implementation manner, the digital certificate processing apparatus includes a functional unit / module further configured to execute the digital certificate processing method in the first aspect and any one of the implementation manners of the first aspect.

[0084] It should be understood that the expansion, limitation, explanation and description of the relevant contents in the above-mentioned first aspect also apply to the same contents in the fifth aspect.

[0085] In a sixth aspect, a blockchain-based digital certificate processing device is provided, comprising: a sending unit, configured to send a query request for a digital certificate to a blockchain, the query request comprising address information of an issuance operation of the digital certificate, the address information of the issuance operation being used to indicate an address of data of the issuance operation stored in the blockchain; a receiving unit, configured to receive a current state of the digital certificate from the blockchain, the current state of the digital certificate being obtained in the blockchain based on first address information, the data of the issuance operation being stored in a target block in the blockchain, the target block comprising the first address information, the first address information being used to indicate an address of data of the next operation processing of the issuance operation being stored in the blockchain.

[0086] In a possible implementation manner, the digital certificate processing apparatus includes a functional unit / module further configured to execute the digital certificate processing method in the second aspect and any one of the implementation manners of the second aspect.

[0087] It should be understood that the expansion, limitation, explanation and description of the relevant contents in the above-mentioned second aspect also apply to the same contents in the sixth aspect.

[0088] In the seventh aspect, a digital certificate processing device based on blockchain is provided, including: a sending unit, used to send a first transaction to the blockchain, the first transaction is used to store data of a first operation processed by a digital certificate authority CA on the blockchain, the first transaction carries target address information, and the target address information is used by the blockchain to determine the address of the data processed by the previous operation processed by the first operation; a receiving unit, used to receive address information of a first block from the blockchain, the first block refers to a block in the blockchain that stores the data processed by the first operation.

[0089] In a possible implementation manner, the digital certificate processing device includes a functional unit / module that is also used to execute the digital certificate processing method in the third aspect and any one of the implementation manners of the third aspect.

[0090] It should be understood that the expansion, limitation, explanation and description of the relevant contents in the above-mentioned third aspect also apply to the same contents in the seventh aspect.

[0091] In an eighth aspect, a blockchain-based digital certificate processing device is provided, including: a receiving unit, used to receive a first transaction from a digital certificate authority CA, the first transaction is used to store data of a first operation processed by the digital certificate authority CA on a digital certificate in the blockchain, the first transaction carries target address information, and the target address information is used by the blockchain to determine an address for storing data processed by the previous operation of the first operation; a sending unit, used to send address information of a first block to the CA, the first block refers to a block in the blockchain that stores the data processed by the first operation.

[0092] In a possible implementation manner, the digital certificate processing device includes a functional unit / module that is also used to execute the digital certificate processing method in the fourth aspect and any one of the implementation manners of the fourth aspect.

[0093] It should be understood that the expansion, limitation, explanation and description of the relevant contents in the fourth aspect mentioned above are also applicable to the same contents in the seventh aspect.

[0094] In a ninth aspect, a digital certificate processing device based on blockchain is provided, comprising: an input / output interface, a processor, and a memory. The processor is used to control the input / output interface to send and receive information, the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that the training device executes the digital certificate processing method in the first aspect and any one of the implementations of the first aspect.

[0095] In a tenth aspect, a digital certificate processing device based on blockchain is provided, comprising: an input / output interface, a processor, and a memory. The processor is used to control the input / output interface to send and receive information, the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that the training device executes the digital certificate processing method in the second aspect and any one of the implementations of the second aspect.

[0096] In the eleventh aspect, a digital certificate processing device based on blockchain is provided, comprising: an input / output interface, a processor, and a memory. The processor is used to control the input / output interface to send and receive information, the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that the training device executes the digital certificate processing method in the third aspect and any one of the implementations of the third aspect.

[0097] In a twelfth aspect, a digital certificate processing device based on blockchain is provided, comprising: an input / output interface, a processor, and a memory. The processor is used to control the input / output interface to send and receive information, the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that the training device executes the digital certificate processing method in the fourth aspect and any one of the implementations of the fourth aspect.

[0098] In the thirteenth aspect, a computer-readable medium is provided, which stores a program code for execution by a device, and the program code includes a method for processing a digital certificate in any one of the implementations of the first to fourth aspects and the first to fourth aspects.

[0099] In a fourteenth aspect, a computer program product comprising instructions is provided. When the computer program product is run on a computer, the computer is caused to execute the digital certificate processing method in any one of the implementations of the first to fourth aspects and the first to fourth aspects.

[0100] In the fifteenth aspect, a chip is provided, comprising a processor and a data interface, wherein the processor reads instructions stored in a memory through the data interface to execute the digital certificate processing method in the above-mentioned first to fourth aspects and any one of the implementation methods of the first to fourth aspects.

[0101] Optionally, as an implementation method, the chip may also include a memory, in which instructions are stored, and the processor is used to execute the instructions stored in the memory. When the instructions are executed, the processor is used to execute the digital certificate processing method in the above-mentioned first to fourth aspects and any one of the implementation methods of the first to fourth aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0102] Figure 1 It is a schematic diagram of the architecture of the PKI system provided in the embodiment of the present application;

[0103] Figure 2 is a schematic flow chart of a digital certificate processing method provided in an embodiment of the present application;

[0104] Figure 3 It is a schematic diagram of a blockchain-based digital certificate processing method provided in an embodiment of the present application;

[0105] Figure 4 It is a schematic diagram of the data structure of a transaction in a blockchain provided by an embodiment of the present application;

[0106] Figure 5 is a schematic flow chart of a digital certificate processing method provided in an embodiment of the present application;

[0107] Figure 6 It is a schematic flow chart of the certificate issuance transaction chain provided in the embodiment of the present application;

[0108] Figure 7 It is a schematic flow chart of the certificate revocation transaction chain provided by the embodiment of the present application;

[0109] Figure 8 It is a schematic flow chart of the certificate modification transaction chain provided by the embodiment of the present application;

[0110] Fig. 9 is a schematic flow chart of a certificate status verification method provided in an embodiment of the present application;

[0111] Fig.10 is a schematic flow chart of a certificate status verification method provided in an embodiment of the present application;

[0112] Fig.11 is a schematic block diagram of a digital certificate processing device provided by the present application;

[0113] Fig.12 is a schematic block diagram of a digital certificate processing device provided by the present application;

[0114] Fig.13 is a schematic block diagram of a digital certificate processing device provided by the present application;

[0115] Fig.14 is a schematic block diagram of a digital certificate processing device provided by the present application;

[0116] Fig.15 It is a hardware structure diagram of the digital certificate processing device provided in this application. DETAILED DESCRIPTION

[0117] The following will describe the technical solutions in the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0118] First, the concepts involved in the embodiments of the present application are briefly described.

[0119] 1. Public key infrastructure (PKI)

[0120] Public key infrastructure is a set of hardware, software, participants, management policies and processes that are used to create, manage, distribute, use, store and revoke digital certificates. In cryptography, public key infrastructure links the user's personal identity with the public key through a digital certificate authority.

[0121] Figure 1 The PKI system architecture diagram is shown in FIG. 100 , in which the PKI 100 may include a user 110 , a security server 120 , a registration authority (RA) server 130 , a lightweight directory access protocol (LDAP) server 140 , a certificate authority (CA) 150 , and a data server 160 .

[0122] Exemplarily, the security server 120 is oriented to ordinary users and is used to provide security services such as certificate application, browsing, certificate revocation list, certificate download, etc.; the user needs to first obtain the certificate of the security server (the certificate is issued by the CA).

[0123] RA server 130 plays a connecting role in the CA architecture; on the one hand, it can forward the certificate application request transmitted by the security server to CA, and on the other hand, it can forward the digital certificate and certificate revocation list (CRL) issued by CA to LDAP server 140 and security server 120.

[0124] The LDAP server 140 is used to provide directory browsing services and is responsible for adding user information and digital certificates transmitted from the RA server 130 to the server; users can obtain digital certificates of other users by accessing the LDAP server 140 .

[0125] CA150 is the core of the entire certificate authority and is responsible for issuing certificates. CA first generates its own private key and public key, then generates a digital certificate and transmits the digital certificate to the security server. CA is also responsible for generating digital certificates for the security server and RA server.

[0126] The database server 160 is the core part of the CA and is used for storing and managing data (such as keys and user information, etc.), logs, and statistical information in the CA.

[0127] 2. Blockchain technology

[0128] In a narrow sense, blockchain is a distributed ledger that combines data blocks in a sequentially connected manner in chronological order and is cryptographically guaranteed to be unforgeable. In a broad sense, blockchain technology is a new distributed infrastructure and computing paradigm that uses block chain data structures to verify and store data, distributed node consensus algorithms to generate and update data, cryptography to ensure the security of data transmission and access, and smart contracts composed of automated script code to program and manipulate data.

[0129] Blockchain technology implements a chain data structure that connects data and information blocks in a sequential manner in chronological order, and uses cryptography to ensure that they cannot be tampered with or forged. In general, the data and information in the blockchain are called "transactions".

[0130] CA issues certificates to certificate applicants through its own private key signature, providing a trusted digital identity, thereby ensuring the user's authentication identity during the communication process and protecting the confidentiality and integrity of the transmitted information. The legitimacy of the user's identity can be effectively determined by verifying the user's certificate status; currently, the status verification of the certificate (for example, whether the certificate has been revoked or updated) requires additional means to solve; for example: using CRL technology or OCSP technology, where CRL technology refers to judging the current status of the certificate through the certificate revocation list regularly updated and published by the CA, and the CRL includes the serial number, revocation time and other information of the revoked certificate; OCSP technology refers to the user sending a query request to the OCSP server, the server encrypts the query result and returns it to the user, and the user uses the server public key to decrypt the information to obtain the result of the certificate status verification. For CRL technology, since the query certificate status is limited by the CRL issuance period, there is a delay in certificate status verification; for OCSP technology, since OCSP is a real-time query and the client can only query the OCSP server corresponding to the certificate, as the number of certificates and the number of query requests increase, the server's response speed will slow down, resulting in a delay in certificate status verification.

[0131] In view of this, an embodiment of the present application provides a digital certificate processing method based on blockchain, in which the data processed by the CA on each operation of the digital certificate is deployed in the blockchain, and the various operations are associated through the address information of the data processed by each operation deployed in the blockchain, so that the current status of the digital certificate can be queried in the blockchain when the address information of the issuance operation of the digital certificate and the identifier of the digital certificate are obtained; through the digital certificate processing method in the embodiment of the present application, the operation processing data of the CA on the digital certificate can be queried in the corresponding block in the blockchain through the address information of the operation processing, thereby improving the efficiency of certificate status verification.

[0132] Combine the following Figures 2 to 10 The digital certificate processing method provided in the embodiment of the present application is described in detail.

[0133] Figure 2 It is a schematic flow chart of the digital certificate processing method provided in the embodiment of the present application. Figure 2 The method 200 shown includes steps S210 to S240, and steps S210 to S240 are described in detail below.

[0134] It should be understood that Figure 2 The digital certificate processing method shown may refer to a method for a user to verify the status of a digital certificate; before the user verifies the status of the digital certificate, the CA may deploy the operation processing data of the digital certificate in the blockchain, that is, when executing Figure 2 The method shown may also include Figures 4 to 10 The digital certificate processing method shown.

[0135] S210. The blockchain receives a query request for a digital certificate from a user.

[0136] The query request includes the address information of the issuance operation of the digital certificate, and the address information of the issuance operation is used to indicate the address of the data storing the issuance operation in the blockchain.

[0137] In other words, in an embodiment of the present application, a user can send a query request for a digital certificate to the blockchain, and the query request may include address information of the issuance operation of the digital certificate.

[0138] Optionally, in one example, the query request may also include an identifier of a digital certificate.

[0139] Exemplarily, the data of the issuance operation of the digital certificate can be obtained in the target block in the blockchain through the address information of the issuance operation of the digital certificate.

[0140] Exemplarily, the target digital certificate corresponding to the query request can be determined from multiple digital certificates included in the target block through the identification of the digital certificate.

[0141] Exemplarily, the user may include a Web server manufacturer, or a digital certificate application user, etc.

[0142] In one example, if the user can directly interact with the blockchain, the user can locally verify the status of the digital certificate, or the user can directly send a query request for the digital certificate to the blockchain; that is, the node can receive the query request for the digital certificate sent by the user, and the node can be used to maintain and manage the blockchain.

[0143] In another example, if the user cannot directly interact with the blockchain, the user can forward the information through the accountant in the blockchain; for example, the user can send a query request for a digital certificate to the blockchain through the accounting node in the blockchain.

[0144] It should be understood that the bookkeepers of the blockchain can also be called miners. Each miner has his or her own copy of the blockchain information stored on their local computer. The blockchain is generated by each miner running the blockchain program, reaching consensus, and generating blocks.

[0145] S220. Obtain data of the issuance operation of the digital certificate in the blockchain according to the address information of the issuance operation.

[0146] The data of the issuance operation is stored in a target block in the blockchain, and the target block includes first address information, and the first address information is used to indicate the address of the data for the next operation processing of the issuance operation stored in the blockchain.

[0147] It should be understood that the blockchain is used to store data on at least one operation processing of the digital certificate by the digital certificate authority CA, which is mutually associated in the blockchain through the address information of the block, and the at least one operation processing includes the issuance operation.

[0148] In an embodiment of the present application, the data of multiple operations processed by the CA on the digital certificate can be uploaded to the blockchain; that is, the data of each operation processed by the CA on the digital certificate can be stored in a block of the blockchain.

[0149] S230. Obtain the current status of the digital certificate according to the first address information.

[0150] In one example, obtaining the current state of the digital certificate according to the first address information includes:

[0151] Determine the target block in the blockchain according to the address information of the issuance operation, where the target block refers to the block in the blockchain that stores the data of the issuance operation;

[0152] When the first address information is empty or a preset field, data of the issuance operation of the digital certificate is obtained.

[0153] In an embodiment of the present application, when the first address information included in the target block is empty, or a preset field or other pre-configured field, it means that when the issuance operation is the last operation of the CA on the digital certificate, the data of the issuance operation of the digital certificate is obtained in the target block; that is, the issuance operation of the digital certificate is the current status of the digital certificate.

[0154] In another example, obtaining the current state of the digital certificate according to the first address information includes:

[0155] Determine the target block in the blockchain according to the address information of the issuance operation, where the target block refers to the block in the blockchain that stores the data of the issuance operation;

[0156] Acquire address information of data processed by the next operation of the issuance operation according to the first address information, and determine a block in the blockchain storing the data processed by the next operation of the issuance operation according to the address information;

[0157] When the next operation processing of the issuance operation is the last operation processing of the CA on the digital certificate, the data of the next operation processing of the issuance operation obtained is the current state of the digital certificate.

[0158] It should be noted that when the next operation processing of the issuance operation is not the last operation processing of the digital certificate by the CA, the address information of the operation processing can be obtained hop by hop based on the relevant associated address information in the block; and then the data of the last operation processing of the digital certificate by the CA, that is, the current status of the digital certificate, can be obtained.

[0159] S240: Send the current status of the digital certificate to the user.

[0160] In other words, in an embodiment of the present application, a user can receive the current status of a digital certificate from the blockchain.

[0161] Exemplarily, through the current status of the digital certificate, the user can determine the legitimacy of the digital certificate; and then effectively determine the legitimacy of the user identity corresponding to the digital certificate. In one example, the blockchain can store data of an operation process of the digital certificate; for example, the blockchain stores data of the issuance operation of the digital certificate; the block storing the data of the issuance operation may include the address information of the previous operation process and the address information of the next operation, wherein the address information of the previous operation process and the first information of the next operation may be a pre-configured initialization address; then the user can determine that the digital certificate is currently in the issuance state by querying the status of the digital certificate in the blockchain.

[0162] In another example, the blockchain can store data of multiple operation processes of a digital certificate; if the address information of the multiple operation processes in the blockchain is related, the data of the last operation process of the current digital certificate can be queried based on the address information of the issuance operation of the digital certificate; and then, the current status of the digital certificate can be determined.

[0163] It should be understood that the data of multiple operation processes are mutually associated, which means that the data corresponding to the operation processes related to any one of the multiple operation processes can be queried through the data of the operation process; for example, the CA's multiple operation processes for digital certificates are issuance operation-update operation-revoke operation, then in the blockchain, the address information of the data of the update operation stored in the blockchain can be queried based on the address information of the CA's issuance operation on the digital certificate; the address information of the data of the revocation operation stored in the blockchain can be queried based on the address information of the update operation.

[0164] Optionally, the target block also includes second address information, and the second address information is used to indicate the address of data processed by the previous operation of the issuance operation stored in the blockchain.

[0165] In one possible implementation, the blockchain may include a first block, which may refer to any block in the blockchain; the first block may be used to store data processed by a first operation, which may refer to any one of an issuance operation, a revocation operation, a freeze operation, a thawing operation, a rollback operation, or an update operation, and the first block may include two address information; wherein one address information is used to indicate the address of the data processed by the previous operation of the first operation in the blockchain, and the other address information is used to indicate the address of the data processed by the next operation of the first operation in the blockchain. In an embodiment of the present application, the data structure in any block in the blockchain may include the address of the previous operation (linked to the previous operation) and the address of the next operation (modifying the field to achieve backward linking), thereby realizing the chaining of the data processed by the CA for the digital certificate; the data processed by all operations can be linked through the address information of the block. Specifically, the data structure included in the first block can be found in the subsequent Figure 4 Schematic diagram of the data structure shown.

[0166] For example, the first operation processing may refer to the issuance of a digital certificate by a CA. The CA may publish information such as the hash of the digital certificate, the serial number of the digital certificate, and the CA signature to the blockchain, while carrying the address information of the previous operation and the next operation of the issuance operation. For the specific process, please refer to the subsequent Figure 6 shown.

[0167] For example, the first operation may refer to the revocation of a digital certificate by the CA. The CA may publish the hash of the digital certificate, the serial number of the digital certificate, the reason for revocation, the CA signature and other information to the blockchain, and carry the address information of the previous operation and the next operation of the revocation operation. For the specific process, please refer to the subsequent Figure 7 shown.

[0168] Optionally, in a possible implementation manner, the first operation process is any one of the following operation processes:

[0169] The issuing operation, revoking operation, freezing operation, unfreezing operation, rolling back operation or updating operation.

[0170] It should be noted that the issuance operation may refer to the operation used by the CA to issue digital certificates; the revocation operation may refer to the operation by the CA to terminate the certificate life of a digital certificate; the freezing operation may include the temporary freezing of a digital certificate by the CA, rather than the permanent revocation; the thawing operation may refer to the revocation of a freezing operation on a digital certificate by the CA; the rollback operation may include the withdrawal of a digital certificate by the CA due to an accidental revocation, accidental freezing, or unmodified certificate operation; the update operation refers to the update of the certificate content of a digital certificate by the CA; for example, updates such as extension of the trial period.

[0171] Optionally, in a possible implementation, it also includes: receiving a first transaction from the CA, the first transaction is used to store the data processed by the first operation in the blockchain, the first transaction carries target address information, and the target address information is used by the blockchain to determine an address for storing data processed by the previous operation of the first operation; sending the address information of the first block to the CA.

[0172] For example, in an embodiment of the present application, the CA can upload the data of the operation and processing of the digital certificate to the blockchain by issuing a transaction to the blockchain. For the specific process, please refer to the subsequent Figures 6 to 10 .

[0173] In one example, when the first operation is processed as the issuing operation, the target address information refers to the second address information.

[0174] In an embodiment of the present application, when the first operation process is an issuance operation of a digital certificate, the target address information carried in the first transaction is used to indicate the address information of the previous operation process of the issuance operation.

[0175] Optionally, in a possible implementation manner, the second address information is a preconfigured initialization address.

[0176] For example, the preconfigured initialization address may be "0x00", or the preconfigured initialization address may be empty.

[0177] In one example, when the first operation processing is not the issuance operation, when the first operation processing is not the issuance operation, the target address information refers to the address information of the data of the previous operation processing of the first operation processing stored in the blockchain, or, the target address information refers to the address information of the issuance operation.

[0178] In an embodiment of the present application, when the first operation processing is not an issuance operation of a digital certificate, the target address information carried in the first transaction can be used to indicate the address information of the previous operation processing of the first operation processing; alternatively, the target address information may also refer to the address information of the issuance operation of a digital certificate.

[0179] Furthermore, the blockchain can also modify the address information of the next operation processing included in the block.

[0180] Optionally, in a possible implementation, the blockchain also includes a second block, further including:

[0181] The address information of the next operation process included in the second block is modified according to the address information of the first block, and the second block refers to a block in the blockchain that stores data of the previous operation process of the first operation process.

[0182] In an embodiment of the present application, the CA may also carry the address information of the next operation when uploading the operation processing data of the digital certificate to the chain, and the address information of the next operation may be pre-configured address information; subsequently, according to the address information of the block storing the next operation processing data in the blockchain returned by the blockchain, the blockchain may modify the pre-configured address information.

[0183] Optionally, in a possible implementation manner, the method further includes: verifying that the current state of the digital certificate is legal according to the address information of the issuance operation.

[0184] In an embodiment of the present application, when the first operation processing is not the issuance operation of the digital certificate by the CA, the current status of the digital certificate can also be obtained, and subsequent operations on the digital certificate can be continued when it is determined that the digital certificate is currently in a legal state.

[0185] In one example, the current status of the digital certificate may be obtained in the blockchain according to the address information of the issuance operation, including:

[0186] Determine a target block in the blockchain according to the address information of the issuance operation, wherein the target block refers to a block in the blockchain storing data of the issuance operation;

[0187] In a case where the issuance operation is the last operation of the CA on the digital certificate, data of the issuance operation is obtained in the target block.

[0188] Optionally, in a possible implementation manner, when the issuing operation is not the last operation processing of the CA on the digital certificate, the method further includes:

[0189] Querying the blockchain for address information of the last operation processed by the digital certificate according to the address information of the next operation included in the target block;

[0190] According to the address information of the last operation process, data of the last operation process of the digital certificate is obtained in the blockchain.

[0191] It should be noted that the above process of obtaining the current status of the digital certificate can be repeated once or multiple times until the data corresponding to the last operation of the CA on the digital certificate is queried; the current status of the digital certificate is obtained according to the data corresponding to the last operation of the CA on the digital certificate. Fig. 9 or Fig.10 shown.

[0192] In one example, a blockchain receives a query request for a digital certificate sent by a user, and the query request includes the address information of the issuance operation of the digital certificate. The blockchain can query one by one through the address information of the issuance operation, obtain the address information of the data processed by the latest operation in the blockchain, and return the data processed by the latest operation to the user.

[0193] In one example, a blockchain receives a query request for a digital certificate sent by a user, and the query request includes the address information of the issuance operation of the digital certificate. The blockchain can query one by one through the address information of the issuance operation. When the operation processing data stored in an address information is obtained, the blockchain can return it to the user one by one; until the latest operation processing data is returned to the user.

[0194] In an embodiment of the present application, by storing data of at least one operation processed by the CA on the digital certificate in the blockchain, the data of at least one operation processed are mutually associated in the blockchain through the address information of the block; further, when the user queries the current status of the digital certificate, the address information of the issuance operation of the digital certificate can be sent to the blockchain; the blockchain can obtain the current status of the digital certificate according to the address information of the issuance operation of the digital certificate, that is, the subsequent life cycle of the digital certificate can be queried in the blockchain according to the address information of the issuance operation of the digital certificate, thereby realizing the query of the status of the digital certificate on the blockchain; thereby avoiding the delay problem caused by the user's need to centrally query the server for the current status of the digital certificate, and can improve the efficiency of digital certificate status verification.

[0195] For example, Figure 3 Schematic diagram of a blockchain-based digital certificate processing method provided in an embodiment of the present application. Figure 3 As shown, the certificate authority CA can publish operations on the certificate status to the blockchain; among them, operations on the certificate status can be divided into three types, namely issuance transactions, revocation transactions, and modification transactions.

[0196] Exemplarily, the issuance transaction is used to deploy data of the CA's issuance operation of the digital certificate in the blockchain.

[0197] For example, after CA issues a certificate for user A, it publishes the certificate hash, serial number, CA signature and other information to the blockchain; at the same time, it carries the previous operation address / next operation address of the issuance transaction; for example, the previous operation address / next operation address can be initialized to 0x00; the blockchain address obtained after the issuance transaction is uploaded to the chain can be 0x12345678.

[0198] Exemplarily, the revocation transaction is used to deploy data of the CA's revocation or freezing operation on the digital certificate in the blockchain.

[0199] For example, when CA revokes (including freezing) the certificate of user A, CA publishes the certificate hash, serial number, revocation reason, CA signature, previous operation address (for example, 0x12345678) and other information to the blockchain; after obtaining the blockchain address corresponding to the current revocation operation (for example, 0x23456789), after K blockchains (to avoid forks), the "next operation address" field in the block corresponding to the corresponding issuance operation can be modified according to the previous operation address (for example, 0x12345678) to 0x23456789.

[0200] Exemplarily, the modification transaction is used to deploy data of CA's revocation, thawing or update operations on digital certificates in the blockchain.

[0201] Similar to certificate revocation transactions, CA can publish unfrozen certificate transactions to the blockchain; at the same time, modify the "next operation address" of the previous transaction. Certificate update is a modification of the certificate content (subject, validity period, etc.). Although the hash value of the certificate has changed, the organization's certificate life cycle can also be connected by modifying the transaction.

[0202] It should be understood that through the above-mentioned certificate status management and verification based on the editable blockchain, the certificate operations can be linked through the operation address information in the blockchain corresponding to different operations. User B can request the blockchain node to track and verify the latest status of user A's certificate through the certificate hash and the address of the blockchain corresponding to the issuance operation.

[0203] In an embodiment of the present application, a certificate status and verification method based on an editable blockchain is proposed. The operation of the certificate is published to the blockchain through the CA. The various operations of the certificate are associated through the address of the blockchain corresponding to the operation and the previous operation address or the next operation address. The current status of the certificate can be queried through the address in the blockchain.

[0204] Figure 4 It is a schematic diagram of the data structure of transactions in the blockchain provided in an embodiment of the present application.

[0205] In the embodiment of the present application, the life cycle of the certificate is connected through transactions on the blockchain. The main data structures are as follows: Figure 4 As shown; Figure 4 Taking Ethereum data as an example, there are three types of transactions: issuing transactions, revoking transactions, and modifying transactions. The additional data of the transaction includes the hash of the certificate, the certificate serial number (issuing transactions) or the reason for the operation, such as the reason for revoking or modifying a transaction; the data basis (CA signature, there may be a phenomenon of multiple CAs jointly issuing certificates), the address of the previous operation (link to the previous operation) and the address of the next operation (modify this field to achieve backward link). The data structure of the transaction can record the necessary information for certificate verification, which is convenient for managing the certificate status and for use when verifying the certificate status.

[0206] It should be noted that the blockchain itself has the characteristic of being tamper-proof, because the next block contains the hash value of the previous block; in the embodiment of the present application, by modifying the address of the next operation in the additional data of the transaction, different operations on the certificate can be linked to each other in the blockchain. For example, the initial value of the next operation address is 0x00, and after modification, it is linked to the subsequent transaction; since the editable blockchain modifies part of the information in the transaction, it may affect the integrity of the block and the blockchain. Therefore, when verifying the block, if the data segment is modified, it can be restored to 0x00 to verify the integrity of the block, and then the security of the modified value can be verified through the transaction linked to the address.

[0207] Figure 5 It is a schematic flow chart of the digital certificate processing method provided in the embodiment of the present application. Figure 5 The method 300 shown includes step S310 to step S320, and steps S310 to S320 are described in detail below.

[0208] It should be understood that Figure 2 The digital certificate processing method shown may refer to a method for a user to verify the status of a digital certificate; before the user verifies the status of a digital certificate, the CA may Figure 5 The method shown deploys the data processed by digital certificate operations in the blockchain.

[0209] S310: Send a first transaction to the blockchain.

[0210] In other words, in an embodiment of the present application, the blockchain may receive a first transaction from the CA.

[0211] Among them, the first transaction is used to store the data of the first operation processing of the digital certificate by the digital certificate authority CA in the blockchain, and the first transaction carries target address information, and the target address information is used by the blockchain to determine the address of storing the data of the previous operation processing of the first operation processing.

[0212] Exemplarily, in an embodiment of the present application, the CA may upload data on the operation and processing of the digital certificate to the blockchain by issuing a transaction to the blockchain.

[0213] S320. Receive address information of a first block from the blockchain.

[0214] The first block refers to a block in the blockchain that stores data processed by the first operation.

[0215] In other words, in an embodiment of the present application, the blockchain can send the address information of the first block to the CA.

[0216] In an embodiment of the present application, after the blockchain uploads the first operation to the chain, the blockchain can send address information to the CA to facilitate the CA's subsequent information management of the digital certificate.

[0217] Exemplarily, in an embodiment of the present application, the CA may upload data on the operation and processing of the digital certificate to the blockchain by issuing a transaction to the blockchain.

[0218] Optionally, in a possible implementation, when the first operation process is an issuance operation of the digital certificate, the target address information refers to an address of data of a previous operation process of the issuance operation stored in the blockchain.

[0219] In an embodiment of the present application, when the first operation process is an issuance operation of a digital certificate, the target address information carried in the first transaction may refer to the address information of the previous operation process of the issuance operation.

[0220] Optionally, in a possible implementation manner, the first address information is a preconfigured initialization address.

[0221] For example, the preconfigured initialization address may be "0x00", or the preconfigured initialization address may be empty.

[0222] Optionally, in a possible implementation, when the first operation processing is not an issuance operation of a digital certificate by a digital authorization center CA, the first address information may be obtained from the address information of a previous operation processing of the first operation processing, and the target address information may be an initialization address that can be preconfigured.

[0223] For example, when the first operation process is not an issuance operation of a digital certificate by the CA, the CA may obtain the address information of the previous operation process of the first operation process sent by the blockchain, thereby obtaining the first address information.

[0224] Optionally, in a possible implementation, the method further includes:

[0225] An application request for the digital certificate is received from a user, wherein the application request includes the identity information of the user.

[0226] Exemplarily, after receiving an application request for a digital certificate sent by a user, the CA may review the identity of the digital certificate application object; the application request includes the identity information of the digital certificate application object, for example, the identity information of the digital certificate application object may refer to the domain name of the digital certificate application object, the public key of the digital certificate application object, and the validity period and other information.

[0227] Optionally, in a possible implementation, when the first operation processing is not the digital certificate issuance operation, the target address information refers to the address of the data of the previous operation processing of the first operation processing stored in the blockchain, or, the target address information refers to the address of the data of the digital certificate issuance operation stored in the blockchain.

[0228] In an embodiment of the present application, when the first operation processing is not an issuance operation of a digital certificate, the target address information carried in the first transaction can be used to indicate the address information of the previous operation processing of the first operation processing; alternatively, the target address information may also refer to the address information of the issuance operation of a digital certificate.

[0229] Optionally, in a possible implementation, the first block includes third address information and fourth address information, the third address information is used to indicate an address of data of a previous operation processed by the first operation processed in the blockchain, and the fourth address information is used to indicate an address of data of a next operation processed by the first operation processed in the blockchain.

[0230] In an embodiment of the present application, the data structure in any block in the blockchain may include the address of the previous operation (linked to the previous operation) and the address of the next operation (modifying the field to achieve backward linking), thereby enabling the data of the CA's operation processing of the digital certificate to be uploaded to the chain; the data processed by all operations can be associated through the address information of the block.

[0231] Optionally, in a possible implementation, the fourth address information is obtained by the blockchain based on address information of a third block, and the third block refers to a block in the blockchain that stores data for the next operation process of the first operation process.

[0232] Optionally, in a possible implementation manner, the first operation process is any one of the following operation processes:

[0233] The issuing operation, revoking operation, freezing operation, unfreezing operation, rolling back operation or updating operation.

[0234] It should be noted that the issuance operation may refer to the operation used by the CA to issue digital certificates; the revocation operation may refer to the operation by the CA to terminate the certificate life of a digital certificate; the freezing operation may include the temporary freezing of a digital certificate by the CA, rather than the permanent revocation; the thawing operation may refer to the revocation of a freezing operation on a digital certificate by the CA; the rollback operation may include the withdrawal of a digital certificate by the CA due to an accidental revocation, accidental freezing, or unmodified certificate operation; the update operation refers to the update of the certificate content of a digital certificate by the CA; for example, updates such as extension of the trial period.

[0235] In an embodiment of the present application, the CA may also carry the address information of the next operation when uploading the operation processing data of the digital certificate to the chain, and the address information of the next operation may be pre-configured address information; subsequently, according to the address information of the block storing the next operation processing data in the blockchain returned by the blockchain, the blockchain may modify the pre-configured address information.

[0236] In an embodiment of the present application, by storing the data corresponding to the CA's operation processing on the digital certificate in the blockchain, the data corresponding to multiple operation processing are mutually associated in the blockchain through address information; and then according to the address information of the issuance operation of the digital certificate, the subsequent life cycle of the digital certificate can be queried in the blockchain, thereby realizing the query of the status of the digital certificate on the blockchain; thereby avoiding the delay problem caused by the concentrated demand to query the server for the current status of the digital certificate, and can improve the efficiency of digital certificate status verification.

[0237] Combine the following Figures 6 to 10 The processes of certificate issuance transaction, revocation transaction, modification transaction and certificate verification are described in detail respectively.

[0238] Figure 6 It is a schematic flow chart of the certificate issuance transaction chain provided in the embodiment of the present application. Figure 6 The method 400 shown includes steps S410 to S460, and steps S410 to S460 are described in detail below.

[0239] S410. CA receives a certificate application request from a user.

[0240] The users may include Web server manufacturers or digital certificate application users.

[0241] S420: CA reviews the request information and confirms whether to issue the certificate.

[0242] S430. When the CA determines to issue the certificate, the CA sends a certificate issuance transaction to the blockchain.

[0243] It should be understood that the issuance transaction may mean that the CA can deploy the data of the issuance operation of the digital certificate in the blockchain in the form of a transaction.

[0244] For example, the CA can package one or more issuance operations into a transaction and then put the issuance transaction on the chain.

[0245] Exemplarily, when the issuance transaction is uploaded to the blockchain, the data sent to the blockchain may also include, but is not limited to: certificate hash value, certificate serial number, CA signature, address information of the previous operation, and address information of the next operation.

[0246] S440. CA obtains blockchain address information of the certificate issuance transaction.

[0247] For example, after the issuance transaction is uploaded to the chain, a corresponding blockchain address can be obtained, and the corresponding issuance transaction can be quickly located through the blockchain address.

[0248] S450. The CA verifies whether there is a certificate issuance transaction in the obtained blockchain address.

[0249] S460: Send a digital certificate to the user.

[0250] Furthermore, the CA can also send the address information of the digital certificate issuance operation data in the blockchain to the user.

[0251] For example, after the CA verifies the blockchain address information of the received issuance transaction, it can send a certificate and the blockchain address information corresponding to the issuance transaction to the user.

[0252] During the process of issuing the certificate on the blockchain, the status of the certificate in the blockchain can be queried through the blockchain address information. The operation after issuing the certificate also needs to be modified through this operation to update the certificate status. Storing the audit information of the certificate on the blockchain realizes the transparency of the certificate operation; the blockchain address of the issuance transaction can effectively prevent users from maliciously modifying the certificate, which is conducive to the subsequent certificate status verification; and users can verify the status of the certificate through any blockchain node without the need for a specific CA server.

[0253] Figure 7 It is a schematic flowchart of the certificate revocation transaction chain provided in an embodiment of the present application. Figure 7 The method 500 shown includes steps S510 to S550, and steps S510 to S550 are described in detail below.

[0254] S510. CA queries the blockchain address information of the certificate issuance transaction.

[0255] Exemplarily, the block address information corresponding to the issuance transaction can be searched in the blockchain according to the certificate identification (for example, the certificate ID).

[0256] S520: Verify the certificate status according to the address information of the issuance operation.

[0257] Exemplarily, the CA can perform a second verification of the certificate status through the address information of the issuing operation. If the digital certificate is currently in a legal state, subsequent operations can be performed; if the digital certificate is currently in an illegal state (for example, the certificate has been revoked, or the certificate is unknown), the revocation operation may not be performed.

[0258] It should be understood that the above S520 is an optional step, and S530 may be directly executed after executing S510.

[0259] S530. CA sends a certificate revocation transaction to the blockchain.

[0260] It should be understood that the revocation transaction may mean that the CA can deploy the revocation operation data of the digital certificate in the blockchain in the form of a transaction.

[0261] For example, the CA can package one or more revocation operations into a revocation transaction and then put the revocation transaction on the chain.

[0262] Exemplarily, the revocation operation may include, but is not limited to, the following data: certificate hash value, certificate serial number, revocation or modification reason, CA signature, address information of the previous operation, and address information of the next operation.

[0263] S540, the block verification in the blockchain cancels the transaction and modifies the transaction address.

[0264] For example, when a revocation transaction is included in a block, each node verifies the certificate hash value and operator information in the transaction to confirm whether to modify the corresponding issuance transaction. The issuance transaction can be located through the "previous operation address" and certificate hash in the revocation transaction.

[0265] Optionally, it can be set that the issuance transaction is modified after K blocks of the block corresponding to the issuance transaction.

[0266] S550. The CA receives blockchain address information of the certificate revocation transaction.

[0267] Exemplarily, the blockchain returns the address of the revoked transaction to the CA, facilitating the CA to perform local identity information management.

[0268] It should be understood that the above-mentioned revocation transaction is mainly to revoke or freeze the certificate. The difference between revocation and freezing operations is that the freezing operation is short-term and may be unfrozen. Taking into account the possible erroneous revocation operation, the revocation operation and the freezing operation are uniformly attributed to the revocation transaction, and the reason for the revocation (or freezing) is recorded in the revocation transaction.

[0269] Figure 8 It is a schematic flowchart of the certificate modification transaction chain provided in the embodiment of the present application. Figure 8 The method 600 shown includes steps S610 to S650, and steps S610 to S650 are described in detail below.

[0270] S610. CA queries the blockchain address information corresponding to the certificate issuance transaction or revocation transaction.

[0271] Exemplarily, the block address information corresponding to the issuance transaction can be found in the blockchain according to the hash value of the certificate.

[0272] S620: Verify the certificate status according to the address information of the issuance operation.

[0273] It should be understood that the above S620 is an optional step, and S630 may be directly executed after S610 is executed.

[0274] Exemplarily, the CA can perform a second verification of the certificate status through the address information of the issuing operation. If the digital certificate is currently in a legal state, subsequent operations can be performed; if the digital certificate is currently in an illegal state (for example, the certificate has been revoked, or the certificate is unknown), the revocation operation may not be performed.

[0275] S630. CA sends a certificate modification transaction to the blockchain.

[0276] It should be understood that a modification transaction may mean that the CA may deploy the modification operation data of the digital certificate in the blockchain in the form of a transaction.

[0277] S640, the block verification in the blockchain modifies the transaction and modifies the transaction address.

[0278] S650. The CA receives blockchain address information of the certificate modification transaction.

[0279] In a possible implementation, in a certificate modification transaction, in addition to unfreezing and modifying logs, the operation of updating the certificate can also be implemented; for example, modifying the validity period of the certificate, the domain name scope of the certificate, etc., and recording the changes in the certificate hash value caused by the certificate modification.

[0280] Furthermore, when verifying a certificate, the next operation can be directly located through the operation of updating the certificate. The update operation can record the information changes of the organization or user, thereby realizing the status update of the entire life cycle of the certificate.

[0281] It should be noted that the CA has verified the correspondence between the certificate and the blockchain address when issuing the certificate, so the issuance operation generally does not need to be modified; when verifying the revocation operation, its audit information must be consistent with the previously issued information, otherwise it cannot be uploaded to the chain.

[0282] In the embodiments of the present application, the main purpose of the certificate modification transaction is to roll back the status of the certificate, that is, to handle the erroneous revocation and unfreezing of certificates; for example, if the CA revokes the certificate by mistake, the revocation operation can be deleted by modifying the transaction.

[0283] Combine the following Fig. 9 and Fig.10 A schematic flowchart of a certificate status verification method provided in an embodiment of the present application.

[0284] Fig. 9 It is a schematic flowchart of the certificate status verification method provided in an embodiment of the present application. Fig. 9 The method 700 shown includes steps S710 to S750, and steps S710 to S730 are described in detail below.

[0285] It should be understood that Fig. 9 In the certificate status verification method shown, the operation log of the certificate is recorded in the blockchain, and the user can verify the certificate status locally by querying the transaction, or directly request the certificate status from the node.

[0286] S710. The user sends a verification request for a digital certificate to the blockchain.

[0287] The verification request may include address information of the issuance operation of the digital certificate.

[0288] Optionally, in the embodiment of the present application, the verification request may further include an identifier of a digital certificate; for example, the identifier of a digital certificate may refer to a hash value of the digital certificate.

[0289] Exemplarily, the user may refer to a digital certificate application object; for example, the digital certificate application object may include a Web server manufacturer, or a digital certificate application user.

[0290] In one example, the verification request in step S710 may refer to Figure 2 A query request for the digital certificate shown.

[0291] S720. The blockchain sends the CA's operation data on the digital certificate to the user.

[0292] Exemplarily, the blockchain can query the data of the issuance operation of the digital certificate in the blockchain based on the address information of the issuance operation of the digital certificate; because the data of at least one operation of the CA on the digital certificate are interconnected through the address information in the blockchain, the block storing the data of the issuance operation also includes the address information of the next operation of the issuance operation; further, the blockchain can further query the status of the digital certificate.

[0293] It should be understood that the above S720 and S730 can be executed multiple times; the user can query in the blockchain according to the blockchain address information corresponding to different transactions; until the last operation of the certificate is queried, that is, the current status of the certificate.

[0294] S730: The user determines the current status of the digital certificate based on the operation information in the blockchain.

[0295] Exemplarily, the user may determine the current status of the digital certificate based on the CA's operation data on the digital certificate obtained in the previous step.

[0296] Fig.10 It is a schematic flowchart of the certificate status verification method provided in an embodiment of the present application. Fig.10 The method 800 shown includes steps S810 to S850, and steps S810 to S850 are described in detail below.

[0297] It should be understood that Fig.10 In the certificate status verification method shown, the client needs to send the blockchain address information corresponding to the operation to the bookkeeper in the blockchain. The bookkeeper obtains a series of transactions corresponding to the certificate by operating the corresponding blockchain address information. The final status of the certificate can be confirmed through these transactions. The blockchain node completes the query of the certificate status and returns the query result to the client.

[0298] It should be understood that the bookkeepers of the blockchain can also be called miners; each miner has his or her own copy of the blockchain information stored on their local computer, and the blockchain is generated by each miner running the blockchain program, reaching consensus, and generating blocks.

[0299] S810. The user sends a digital certificate verification request to the bookkeeper.

[0300] The verification request may include the address information of the issuance operation of the digital certificate. Optionally, in the embodiment of the present application, the verification request may also include the identifier of the digital certificate; for example, the identifier of the digital certificate may refer to the hash value of the digital certificate.

[0301] Exemplarily, the user may refer to a digital certificate application object; for example, the digital certificate application object may include a Web server manufacturer, or a digital certificate application user.

[0302] In one example, the verification request in step S710 may refer to Figure 2 A query request for the digital certificate shown.

[0303] S820. The bookkeeper may send the address information of the issuance operation of the digital certificate to the blockchain.

[0304] Optionally, the bookkeeper may also send an identifier of the digital certificate to the blockchain; for example, a hash value of the digital certificate.

[0305] S830. The blockchain sends the CA's operation data on the digital certificate to the bookkeeper.

[0306] Exemplarily, the blockchain can query the data of the issuance operation of the digital certificate in the blockchain based on the address information of the issuance operation of the digital certificate; because the data of at least one operation of the CA on the digital certificate are interconnected through the address information in the blockchain, the block storing the data of the issuance operation also includes the address information of the next operation of the issuance operation; further, the blockchain can further query the status of the digital certificate.

[0307] It should be understood that the above S820 and S830 can be executed multiple times; the blockchain can be queried according to the blockchain address information corresponding to different transactions; until the last operation of the certificate is queried, that is, the current status of the certificate.

[0308] S840: The account keeper determines the current status of the digital certificate based on the operation data in the blockchain. For example, the account keeper can verify the status of the certificate based on the certificate operation obtained in the previous step.

[0309] S850 The account keeper sends the current status of the digital certificate to the user.

[0310] In an embodiment of the present application, a blockchain is used to store data of at least one operation processed by a digital certificate authority CA on a digital certificate. By associating the data of at least one operation processed with address information deployed in the blockchain, the current status of the digital certificate can be queried in the blockchain when the address information of the issuance operation of the digital certificate is obtained. Through the digital certificate processing method in an embodiment of the present application, the current status of the digital certificate can be queried in the blockchain through the address information of the operation processing, thereby improving the efficiency of certificate status verification.

[0311] It should be understood that the above examples are intended to help those skilled in the art understand the embodiments of the present application, rather than to limit the embodiments of the present application to the specific numerical values ​​or specific scenarios illustrated. Those skilled in the art can obviously make various equivalent modifications or changes based on the above examples, and such modifications or changes also fall within the scope of the embodiments of the present application.

[0312] Combination of the above Figures 1 to 10 , describes in detail the blockchain-based digital certificate processing method provided by the embodiment of the present application; the following will be combined with Figures 11 to 15 , describes the device embodiment of the present application in detail. It should be understood that the blockchain-based digital certificate processing device in the embodiment of the present application can execute the various methods of the aforementioned embodiments of the present application, that is, the specific working process of the following various products can refer to the corresponding process in the aforementioned method embodiment.

[0313] Fig.11 It is a schematic block diagram of a blockchain-based digital certificate processing device provided in an embodiment of the present application.

[0314] It should be understood that Fig.11 The digital certificate processing device shown can execute Figure 2 , Fig. 9 as well as Fig.10 All or part of the operations in any one of the digital certificate processing methods shown; the digital certificate processing device 900 includes: a transceiver unit 910 and a processing unit 920.

[0315] It should be noted that the digital certificate processing device 900 may refer to a computing device or a chip configured in a computing device.

[0316] The computing device may be a device that has the function of maintaining and managing blockchain, for example, any device known in the current technology; or, the computing device may also refer to a chip that has the function of maintaining and managing blockchain. The computing device may include a memory and a processor; the memory may be used to store program code, and the processor may be used to call the program code stored in the memory to implement the corresponding functions of the computing device. The processor and memory included in the computing device may be implemented by a chip, and no specific limitation is made here.

[0317] Among them, the transceiver unit 910 is used to receive a query request for a digital certificate from a user, the query request includes address information of the issuance operation of the digital certificate, and the address information of the issuance operation is used to indicate the address of the data of the issuance operation stored in the blockchain; the processing unit 920 is used to obtain the data of the issuance operation of the digital certificate in the blockchain according to the address information of the issuance operation, the data of the issuance operation is stored in a target block in the blockchain, and the target block includes first address information, and the first address information is used to indicate the address of the data of the next operation processing of the issuance operation stored in the blockchain; the current status of the digital certificate is obtained according to the first address information; the transceiver unit 910 is also used to send the current status of the digital certificate to the user.

[0318] Optionally, as an embodiment, the target block also includes second address information, and the second address information is used to represent the address of the data processed by the previous operation of the issuance operation stored in the blockchain.

[0319] Optionally, as an embodiment, the transceiver unit 910 is used to:

[0320] Receive a first transaction from the CA, the first transaction is used to store the data processed by the first operation in the blockchain, the first transaction carries target address information, the target address information is used by the blockchain to determine the address for storing the data of the previous operation processed by the first operation, the first operation processing includes any one of the issuance operation, revocation operation, freeze operation, thawing operation, rollback operation or update operation; send the address information of a first block to the CA, the first block is used to store the data processed by the first operation.

[0321] Optionally, as an embodiment, when the first operation is processed as the issuance operation, the target address information refers to the second address information.

[0322] Optionally, as an embodiment, the second address information is a preconfigured initialization address.

[0323] Optionally, as an embodiment, when the first operation processing is not the issuance operation, the target address information refers to the address information of the data of the previous operation processing of the first operation processing stored in the blockchain, or, the target address information refers to the address information of the issuance operation.

[0324] Optionally, as an embodiment, the blockchain further includes a second block, and the processing unit 920 is further configured to:

[0325] The address information of the next operation process included in the second block is modified according to the address information of the first block, and the second block refers to a block in the blockchain that stores data of the previous operation process of the first operation process.

[0326] Optionally, as an embodiment, the processing unit 920 is further configured to:

[0327] Verify that the current status of the digital certificate is legal based on the address information of the issuing operation.

[0328] Optionally, as an embodiment, the query request also includes an identifier of the digital certificate.

[0329] In one example, the digital certificate processing apparatus 900 may be used to perform Figure 2 , Fig. 9 as well as Fig.10 All or part of the operations in any one of the digital certificate processing methods shown. For example, the transceiver unit 910 can be used to perform all or part of the operations in S210, S240, S630, S650, S710, and S720; the processing unit 920 can be used to perform all or part of the operations in S220 and S230.

[0330] Fig.12 It is a schematic block diagram of a blockchain-based digital certificate processing device provided in an embodiment of the present application.

[0331] It should be understood that Fig.12 The digital certificate processing device shown can execute Figure 2 , Fig. 9 as well as Fig.10 The digital certificate processing method shown; the digital certificate processing device 1000 includes: a sending unit 1010 and a receiving unit 1020.

[0332] It should be noted that the digital certificate processing device 1000 may refer to a terminal device, or a chip configured in the terminal device, and the user can interact with the blockchain through the terminal device.

[0333] Among them, the sending unit 1010 is used to send a query request for a digital certificate to the blockchain, the query request includes address information of the issuance operation of the digital certificate, and the address information of the issuance operation is used to indicate the address of the data of the issuance operation stored in the blockchain; the receiving unit 1020 is used to receive the current state of the digital certificate from the blockchain, the current state of the digital certificate is obtained in the blockchain according to the first address information, the data of the issuance operation is stored in the target block in the blockchain, the target block includes the first address information, and the first address information is used to indicate the address of the data of the next operation processing of the issuance operation stored in the blockchain.

[0334] Optionally, as an embodiment, the target block also includes second address information, and the second address information is used to represent the address of the data processed by the previous operation of the issuance operation stored in the blockchain.

[0335] Optionally, as an embodiment, when the first operation process is the issuance operation, the sending unit 1010 is further configured to:

[0336] An application request for the digital certificate is sent to the CA, wherein the application request includes the identity information of the user.

[0337] Optionally, as an embodiment, the second address information and the target address information are preconfigured initialization addresses.

[0338] Optionally, as an embodiment, when the first operation processing is not the issuance operation, the target address information refers to the address information of the data of the previous operation processing of the first operation processing stored in the blockchain, or, the target address information refers to the address information of the issuance operation.

[0339] In one example, the digital certificate processing apparatus 1000 can be used to perform Figure 2 , Fig. 9 as well as Fig.10 For example, the receiving unit 1010 may be used to perform all or part of the operations in S240, S720, S830, and S850; the sending unit 1020 may be used to perform all or part of the operations in S210, S710, and S810.

[0340] It should be understood that the digital certificate processing device 1000 may include other units in addition to the above-mentioned receiving unit 1010 and sending unit 1020; for example, a processing unit, which can control the receiving unit and the sending unit to perform the above-mentioned operations.

[0341] Fig.13It is a schematic block diagram of a blockchain-based digital certificate processing device provided in an embodiment of the present application.

[0342] It should be understood that Fig.13 The digital certificate processing device shown can execute Figures 5 to 8 All or part of the operations in any one of the digital certificate processing methods shown; the digital certificate processing device 1100 includes: a sending unit 1110 and a receiving unit 1120.

[0343] It should be noted that the digital certificate processing device 1100 may be a server or a chip configured in a server; the server may refer to a server of a certificate authority.

[0344] Among them, the sending unit 1110 is used to send a first transaction to the blockchain, and the first transaction is used to store the data of the first operation processed by the digital certificate authority CA on the digital certificate in the blockchain. The first transaction carries target address information, and the target address information is used by the blockchain to determine the address of the data of the previous operation processed by the first operation; the receiving unit 1120 is used to receive the address information of the first block from the blockchain, and the first block refers to the block in the blockchain that stores the data processed by the first operation.

[0345] Optionally, as an embodiment, when the first operation processing is the issuance operation of the digital certificate, the target address information refers to the address of the data of the previous operation processing of the issuance operation stored in the blockchain.

[0346] Optionally, as an embodiment, the target address information is a preconfigured initialization address.

[0347] Optionally, as an embodiment, the receiving unit 1120 is further configured to:

[0348] An application request for the digital certificate is received from a user, wherein the application request includes the identity information of the user.

[0349] Optionally, as an embodiment, when the first operation processing is not the digital certificate issuance operation, the target address information refers to the address of the data of the previous operation processing of the first operation processing stored in the blockchain, or, the target address information refers to the address of the data of the digital certificate issuance operation stored in the blockchain.

[0350] Optionally, as an embodiment, the first block includes third address information and fourth address information, the third address information is used to indicate the address of data of the previous operation process of the first operation process stored in the blockchain, and the fourth address information is used to indicate the address of data of the next operation process of the first operation process stored in the blockchain.

[0351] Optionally, as an embodiment, the fourth address information is obtained by the blockchain based on address information of a third block, and the third block refers to a block in the blockchain that stores data for the next operation process of the first operation process.

[0352] Optionally, as an embodiment, the first operation processing refers to any one of the following operations performed by the CA on the digital certificate:

[0353] The issuing operation, revoking operation, freezing operation, unfreezing operation, rolling back operation or updating operation.

[0354] In one example, the digital certificate processing apparatus 1100 may be used to perform Figures 5 to 8 All or part of the operations in any one of the digital certificate processing methods shown. For example, the sending unit 1110 can be used to perform all or part of the operations in S310, S430, S460, S530, and S630; the receiving unit 1120 can be used to perform all or part of the operations in S320, S440, S550, and S650.

[0355] It should be understood that the digital certificate processing device 1100 may include other units in addition to the above-mentioned receiving unit 1110 and sending unit 1120; for example, a processing unit, which can control the receiving unit and the sending unit to perform the above-mentioned operations.

[0356] Fig.14 It is a schematic block diagram of a blockchain-based digital certificate processing device provided in an embodiment of the present application.

[0357] It should be understood that Fig.13 The digital certificate processing device shown can execute Figures 5 to 8 All or part of the operations in any one of the digital certificate processing methods shown; the digital certificate processing device 1200 includes: a receiving unit 1210 and a sending unit 1220.

[0358] It should be noted that the digital certificate processing device 1200 may refer to a computing device or a chip configured in a computing device.

[0359] The computing device may be a device that has the function of maintaining and managing blockchain, for example, any device known in the current technology; or, the computing device may also refer to a chip that has the function of maintaining and managing blockchain. The computing device may include a memory and a processor; the memory may be used to store program code, and the processor may be used to call the program code stored in the memory to implement the corresponding functions of the computing device. The processor and memory included in the computing device may be implemented by a chip, and no specific limitation is made here.

[0360] Among them, the receiving unit 1210 is used to receive a first transaction from a digital certificate authority CA, and the first transaction is used to store the data of a first operation processed by the digital certificate authority CA on the digital certificate in the blockchain. The first transaction carries target address information, and the target address information is used by the blockchain to determine the address of the data of the previous operation processed by the first operation; the sending unit 1220 is used to send the address information of the first block to the CA, and the first block refers to the block in the blockchain that stores the data processed by the first operation.

[0361] Optionally, as an embodiment, when the first operation processing is the issuance operation of the digital certificate, the target address information refers to the address of the data of the previous operation processing of the issuance operation stored in the blockchain.

[0362] Optionally, as an embodiment, the target address information is a preconfigured initialization address.

[0363] Optionally, as an embodiment, when the first operation processing is not the digital certificate issuance operation, the target address information refers to the address of the data of the previous operation processing of the first operation processing stored in the blockchain, or, the target address information refers to the address of the data of the digital certificate issuance operation stored in the blockchain.

[0364] Optionally, as an embodiment, the first block includes third address information and fourth address information, the third address information is used to indicate the address of data of the previous operation process of the first operation process stored in the blockchain, and the fourth address information is used to indicate the address of data of the next operation process of the first operation process stored in the blockchain.

[0365] Optionally, as an embodiment, the fourth address information is obtained by the blockchain based on address information of a third block, and the third block refers to a block in the blockchain that stores data for the next operation process of the first operation process.

[0366] Optionally, as an embodiment, the first operation processing refers to any one of the following operations performed by the CA on the digital certificate:

[0367] The issuing operation, revoking operation, freezing operation, unfreezing operation, rolling back operation or updating operation.

[0368] In one example, the digital certificate processing apparatus 1200 may be used to perform Figures 5 to 8 All or part of the operations in any one of the digital certificate processing methods shown. For example, the receiving unit 1210 can be used to perform all or part of the operations in S310, S430, S530, and S630; the sending unit 1220 can be used to perform all or part of the operations in S320, S440, S550, and S650.

[0369] It should be understood that the digital certificate processing device 1200 may include other units in addition to the above-mentioned receiving unit 1210 and sending unit 1220; for example, a processing unit, which can control the receiving unit and the sending unit to perform the above-mentioned operations.

[0370] It should be noted that the digital certificate processing apparatus 900, digital certificate processing apparatus 1000, digital certificate processing apparatus 1100 and digital certificate processing apparatus 1200 are implemented in the form of functional units. The term "unit" here can be implemented in the form of software and / or hardware, and is not specifically limited to this.

[0371] For example, a "unit" may be a software program, a hardware circuit, or a combination of the two that implements the above functions. The hardware circuit may include an application specific integrated circuit (ASIC), an electronic circuit, a processor (e.g., a shared processor, a dedicated processor, or a group processor, etc.) and a memory for executing one or more software or firmware programs, a combined logic circuit, and / or other suitable components that support the described functions.

[0372] Therefore, the units of each example described in the embodiments of the present application can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present application.

[0373] Fig.15 It is a schematic diagram of the hardware structure of the digital certificate processing device provided in an embodiment of the present application.

[0374] Fig.15The digital certificate processing device 1300 shown includes a memory 1310, a processor 1320, a communication interface 1330 and a bus 1340. The memory 1310, the processor 1320 and the communication interface 1330 are connected to each other through the bus 1340.

[0375] The memory 1310 may be a read only memory (ROM), a static storage device, a dynamic storage device or a random access memory (RAM). The memory 1310 may store a program. When the program stored in the memory 1310 is executed by the processor 1320, the processor 1320 is used to execute each step of the digital certificate processing method of the embodiment of the present application.

[0376] In one example, the digital certificate processing device 1300 may refer to a terminal device, or a chip configured in the terminal device, through which a user may interact with the blockchain; the following may be performed: Figure 2 , Fig. 9 as well as Fig.10 Any of the digital certificate processing methods shown.

[0377] In another example, the digital certificate processing device 1300 may be a server or a chip configured in a server; the server may be a server of a certificate authority; Figures 2 to 7 All or part of the operations in any one of the digital certificate processing methods shown.

[0378] In another example, the digital certificate processing device 1300 may refer to a computing device or a chip configured in a computing device; Figures 2 to 9 All or part of the operations in any one of the digital certificate processing methods shown.

[0379] The computing device may be a device that has the function of maintaining and managing blockchain, for example, any device known in the current technology; or, the computing device may also refer to a chip that has the function of maintaining and managing blockchain. The computing device may include a memory and a processor; the memory may be used to store program code, and the processor may be used to call the program code stored in the memory to implement the corresponding functions of the computing device. The processor and memory included in the computing device may be implemented by a chip, and no specific limitation is made here.

[0380] For example, the memory may be used to store relevant program instructions of the digital certificate processing method provided in the embodiments of the present application, and the processor may be used to call relevant program instructions of the digital certificate processing method stored in the memory.

[0381] The processor 1320 can adopt a general-purpose central processing unit (CPU), a microprocessor, an application specific integrated circuit (ASIC), or one or more integrated circuits to execute relevant programs to implement the digital certificate processing method of the method embodiment of the present application.

[0382] The processor 1320 may also be an integrated circuit chip with signal processing capability. In the implementation process, each step of the hyperparameter search method of the present application may be completed by an integrated logic circuit of hardware in the processor 1320 or by instructions in the form of software.

[0383] The processor 1320 may also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, or discrete hardware components. The methods, steps, and logic block diagrams disclosed in the embodiments of the present application may be implemented or executed. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application may be directly embodied as being executed by a hardware decoding processor, or may be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a mature storage medium in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, or the like. The storage medium is located in the memory 1310, and the processor 1320 reads the information in the memory 1310, and completes the implementation of the present application in combination with its hardware. Figures 11 to 14 The functions required to be performed by the units included in the digital certificate processing device shown, or the execution of the method embodiment of the present application Figures 2 to 10 The digital certificate processing method shown.

[0384] The communication interface 1330 uses a transceiver device such as but not limited to a transceiver to implement communication between the digital certificate processing device 1300 and other devices or communication networks.

[0385] The bus 1340 may include a path for transmitting information between various components of the digital certificate processing device 1300 (eg, the memory 1310 , the processor 1320 , and the communication interface 1330 ).

[0386] It should be noted that although the above-mentioned digital certificate processing device 1300 only shows a memory, a processor, and a communication interface, in the specific implementation process, those skilled in the art should understand that the digital certificate processing device 1300 may also include other devices necessary for normal operation. At the same time, according to specific needs, those skilled in the art should understand that the above-mentioned digital certificate processing device 1300 may also include hardware devices for implementing other additional functions. In addition, those skilled in the art should understand that the above-mentioned digital certificate processing device 1300 may also only include the devices necessary to implement the embodiments of the present application, and does not necessarily include Fig.15 All devices shown in .

[0387] For example, the embodiment of the present application further provides a chip, which includes a transceiver unit and a processing unit. The transceiver unit may be an input / output circuit or a communication interface; the processing unit may be a processor or a microprocessor or an integrated circuit integrated on the chip; and the chip may execute the digital certificate processing method in the above method embodiment.

[0388] Exemplarily, an embodiment of the present application further provides a computer-readable storage medium having instructions stored thereon, which, when executed, execute the digital certificate processing method in the above method embodiment.

[0389] Exemplarily, an embodiment of the present application further provides a computer program product comprising instructions, which, when executed, execute the digital certificate processing method in the above method embodiment.

[0390] It should be understood that the processor in the embodiment of the present application may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0391] It should also be understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0392] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0393] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0394] In this application, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can be represented by: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0395] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0396] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0397] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0398] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0399] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0400] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0401] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks.

[0402] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A digital certificate processing method based on blockchain, characterized in that: include: Receiving a query request for a digital certificate from a user, the query request including address information of an issuance operation of the digital certificate, the address information of the issuance operation being used to indicate an address storing data of the issuance operation in the blockchain; Acquire data of the issuance operation of the digital certificate in the blockchain according to the address information of the issuance operation, wherein the data of the issuance operation is stored in a target block in the blockchain, wherein the target block includes first address information, and the first address information is used to indicate an address in the blockchain where data for the next operation processing of the issuance operation is stored; Acquire the current status of the digital certificate according to the first address information; The current status of the digital certificate is sent to the user.

2. The method according to claim 1, characterized in that The target block also includes second address information, and the second address information is used to indicate the address of data processed by the previous operation of the issuance operation stored in the blockchain.

3. The method according to claim 1, characterized in that Also includes: receiving a first transaction from a CA, the first transaction being used to store data processed by a first operation in the blockchain, the first transaction carrying target address information, the target address information being used by the blockchain to determine an address for storing data processed by a previous operation of the first operation, the first operation processing including any one of the issuance operation, the revocation operation, the freezing operation, the thawing operation, the rollback operation, or the update operation; Address information of a first block is sent to the CA, where the first block is used to store data processed by the first operation.

4. The method according to claim 3, characterized in that When the first operation is processed as the issuance operation, the target address information refers to second address information, and the second address information is used to represent the address of the data processed by the previous operation of the issuance operation stored in the blockchain.

5. The method according to claim 4, characterized in that The second address information is a preconfigured initialization address.

6. The method as claimed in claim 3, characterized in that When the first operation process is not the issuance operation, the target address information refers to the address information of the data of the previous operation process of the first operation process stored in the blockchain, or the target address information refers to the address information of the issuance operation.

7. The method according to claim 3, characterized in that The blockchain also includes a second block, and further includes: The address information of the next operation process included in the second block is modified according to the address information of the first block, and the second block refers to a block in the blockchain that stores data of the previous operation process of the first operation process.

8. The method according to claim 6, characterized in that Also includes: Verify that the current state of the digital certificate is legal based on the address information of the issuance operation.

9. The method according to any one of claims 1 to 8, characterized in that The query request also includes the identifier of the digital certificate.

10. A digital certificate processing method based on blockchain, characterized in that: include: Sending a query request for a digital certificate to a blockchain, the query request including address information of an issuance operation of the digital certificate, the address information of the issuance operation being used to indicate an address at which data of the issuance operation is stored in the blockchain; Receive the current state of the digital certificate from the blockchain, the current state of the digital certificate is obtained in the blockchain according to the first address information, the data of the issuance operation is stored in the target block in the blockchain, the target block includes the first address information, and the first address information is used to represent the address of the data processed by the next operation of the issuance operation stored in the blockchain.

11. The method according to claim 10, characterized in that The target block also includes second address information, and the second address information is used to indicate the address of data processed by the previous operation of the issuance operation stored in the blockchain.

12. The method according to claim 10, characterized in that Also includes: An application request for the digital certificate sent to the CA, wherein the application request includes the user's identity information.

13. The method according to any one of claims 10 to 12, characterized in that The first address information and the second address information are preconfigured initialization addresses, and the second address information is used to represent the address of the data processed by the previous operation of the issuance operation stored in the blockchain.

14. A digital certificate processing device based on blockchain, characterized in that: The invention comprises a module for executing the digital certificate processing method as claimed in any one of claims 1 to 9 or claims 10 to 13.

15. A digital certificate processing device based on blockchain, characterized in that: include: Memory, used to store programs; A processor is used to execute the program stored in the memory. When the program stored in the memory is executed, the processor is used to execute the digital certificate processing method as described in any one of claims 1 to 9 or claims 10 to 13.

16. A computer storage medium, characterized in that: The computer storage medium stores program codes, and the program codes include codes for executing the digital certificate processing method according to any one of claims 1 to 9 or claims 10 to 13.

17. A computer program product, characterized in that The computer program product comprises instructions, and when the computer program product is run on a computer, the computer is caused to execute the digital certificate processing method according to any one of claims 1 to 9 or claims 10 to 13.

Images