Digital certificate processing method, device, electronic device and readable storage medium

Abstract

The embodiment of the present invention provides a digital certificate processing method, device, electronic device and readable storage medium. In the method, any candidate node in the digital certificate management system will respond to the issuance request sent by the requesting end, and generate a digital certificate according to the private key of the candidate node and the relevant information carried in the issuance request. A block including at least a digital certificate is created based on the digital certificate as a candidate block. When the candidate block meets the preset requirements, the candidate block is determined as a target block, and the digital certificate in the target block is returned to the requesting end. In the embodiment of the present invention, multiple candidate nodes generate digital certificates, and finally return the digital certificate in the target block that meets the preset requirements to the requesting end. Even if a single candidate node fails, the issuance of digital certificates can be achieved to a certain extent, thereby improving the stability of the issuance operation.

Description

Technical Field

[0001] The present invention belongs to the field of network technology, and in particular relates to a digital certificate processing method, device, electronic equipment and readable storage medium. Background Art

[0002] Currently, in order to ensure the security of communication between ends, one end needs to request a digital certificate from a Certificate Authority (CA), so that when communicating with the other end, the digital certificate can be used to perform identity authentication, data encryption, and other operations.

[0003] In the prior art, when issuing a digital certificate, a single CA center often generates a digital signature, and based on the digital signature and the public key of the requesting end, generates a digital certificate and issues it to the end. In this way, if the CA center fails, the digital certificate cannot be issued normally, and the stability of the issuance operation is poor. Summary of the invention

[0004] The present invention provides a digital certificate processing method, device, electronic device and readable storage medium to solve the technical problem of poor stability.

[0005] In a first aspect, the present invention provides a digital certificate processing method, the method being applied to any candidate node in a digital certificate management system including at least two candidate nodes, the method comprising:

[0006] In response to the issuance request sent by the requesting end, generate a digital certificate according to the private key of the candidate node and the relevant information carried in the issuance request;

[0007] Creating a block including at least the digital certificate based on the digital certificate as a candidate block;

[0008] In the case that the candidate block meets the preset requirements, the candidate block is determined as the target block, and the digital certificate in the target block is returned to the requesting end.

[0009] Optionally, when the candidate block meets a preset requirement, determining the candidate block as a target block includes:

[0010] If the candidate block meets the preset block chain requirements, determine the candidate block as the target block;

[0011] Before returning the digital certificate in the target block to the requesting end, the method further includes: performing a block chain operation on the target block to add the target block to the blockchain corresponding to the digital certificate management system; after successful addition, performing the operation of returning the digital certificate in the target block to the requesting end.

[0012] Optionally, performing a block chaining operation on the target block to add the target block to a blockchain corresponding to the digital certificate management system includes:

[0013] The target block is added to the local blockchain of the candidate node, and the target block is broadcast to other nodes in the digital certificate management system. The other nodes are used to perform validity verification operations on the target block, and if the verification passes, synchronize the target block to the local blockchain.

[0014] Optionally, the validity verification operation includes: verifying whether the public key of the requesting end belongs to the public key of the trusted end stored in the specified block of the blockchain; and / or verifying whether the data format of the content in the target block conforms to the specified format; and / or verifying whether the target block meets the block chain requirements.

[0015] Optionally, before generating a digital certificate according to the private key of the candidate node and the relevant information carried in the issuance request, the method further includes:

[0016] Obtaining a public key of a trusted end stored in a specified block of the blockchain;

[0017] In the case where the public key of the requesting end belongs to the public key of the trusted end, the operation of generating a digital certificate according to the private key of the candidate node and the relevant information carried in the issuance request is performed.

[0018] Optionally, the designated block is a genesis block in the blockchain, and the genesis block is created during the initialization phase of the blockchain based on the public keys of each trusted end.

[0019] Optionally, when the candidate node receives a certificate verification request sent by the query end, the method further includes:

[0020] In response to the certificate verification request, determining a block to be queried in the blockchain according to the issuance time of the certificate to be verified indicated by the certificate verification request;

[0021] Detecting whether the digital certificate in the block to be queried matches the certificate to be verified indicated by the certificate verification request;

[0022] In case of a match, returning valid indication information to the query end;

[0023] In case of mismatch, invalid indication information is returned to the query end.

[0024] Optionally, the creating a block including at least the digital certificate based on the digital certificate includes: packaging the digital certificate and the public key of the candidate node into a block;

[0025] The detecting whether the digital certificate in the block to be queried matches the certificate to be verified indicated by the certificate verification request includes:

[0026] Based on the public key of the candidate node in the block to be queried, verify whether the digital certificate in the block to be queried matches the certificate to be verified.

[0027] In a second aspect, the present invention provides a digital certificate processing device, the device is applied to any candidate node in a digital certificate management system including at least two candidate nodes, the device comprising:

[0028] A generating module, configured to generate a digital certificate in response to the issuance request sent by the requesting end according to the private key of the candidate node and the relevant information carried in the issuance request;

[0029] A creation module, configured to create a block including at least the digital certificate based on the digital certificate as a candidate block;

[0030] The first returning module is used to determine the candidate block as the target block if the candidate block meets the preset requirements, and return the digital certificate in the target block to the requesting end.

[0031] Optionally, the first returning module is specifically used to:

[0032] If the candidate block meets the preset block chain requirements, determine the candidate block as the target block;

[0033] The device also includes: an adding module, used to perform a block chain operation on the target block to add the target block to the blockchain corresponding to the digital certificate management system; a first execution module, used to execute the operation of returning the digital certificate in the target block to the requesting end after successful addition.

[0034] Optionally, the adding module is specifically used for:

[0035] The target block is added to the local blockchain of the candidate node, and the target block is broadcast to other nodes in the digital certificate management system. The other nodes are used to perform validity verification operations on the target block, and if the verification passes, synchronize the target block to the local blockchain.

[0036] Optionally, the validity verification operation includes: verifying whether the public key of the requesting end belongs to the public key of the trusted end stored in the specified block of the blockchain; and / or verifying whether the data format of the content in the target block conforms to the specified format; and / or verifying whether the target block meets the block chain requirements.

[0037] Optionally, the device further comprises:

[0038] An acquisition module, used to acquire the public key of the trusted end stored in a specified block of the blockchain;

[0039] The second execution module is used to execute the operation of generating a digital certificate according to the private key of the candidate node and the relevant information carried in the issuance request when the public key of the requesting end belongs to the public key of the trusted end.

[0040] Optionally, the designated block is a genesis block in the blockchain, and the genesis block is created during the initialization phase of the blockchain based on the public keys of each trusted end.

[0041] Optionally, the device further comprises:

[0042] A determination module, configured to determine, in response to the certificate verification request, a block to be queried in the blockchain according to the issuance time of the certificate to be verified indicated by the certificate verification request;

[0043] A detection module, used to detect whether the digital certificate in the block to be queried matches the certificate to be verified indicated by the certificate verification request;

[0044] A second returning module, used for returning valid indication information to the query end in case of a match;

[0045] The third returning module is used to return invalid indication information to the query end in case of mismatch.

[0046] Optionally, the creation module is specifically used to: package the digital certificate and the public key of the candidate node into a block;

[0047] The detection module is specifically used for:

[0048] Based on the public key of the candidate node in the block to be queried, verify whether the digital certificate in the block to be queried matches the certificate to be verified.

[0049] In a third aspect, the present invention provides a digital certificate management system, the system comprising at least two candidate nodes, each of the candidate nodes being used to execute the above-mentioned digital certificate processing method.

[0050] In a fourth aspect, the present invention provides an electronic device comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned digital certificate processing method when executing the program.

[0051] In a fifth aspect, the present invention provides a readable storage medium, which, when instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to execute the above-mentioned digital certificate processing method.

[0052] In an embodiment of the present invention, a digital certificate processing method provided in an embodiment of the present invention, any candidate node in a digital certificate management system will respond to the issuance request sent by the requesting end, and generate a digital certificate according to the private key of the candidate node and the relevant information carried in the issuance request. A block including at least a digital certificate is created based on the digital certificate as a candidate block. When the candidate block meets the preset requirements, the candidate block is determined as a target block, and the digital certificate in the target block is returned to the requesting end. In an embodiment of the present invention, multiple candidate nodes generate digital certificates, and eventually return the digital certificate in the target block that meets the preset requirements to the requesting end. Even if a single candidate node fails, the issuance of digital certificates can be achieved to a certain extent, thereby improving the stability of the issuance operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0054] Figure 1 is a flowchart of a digital certificate processing method provided by an embodiment of the present invention;

[0055] Figure 2 It is a schematic diagram of a processing flow provided by an embodiment of the present invention;

[0056] Figure 3 It is a schematic diagram of an application scenario provided by an embodiment of the present invention;

[0057] Figure 4 is a structural diagram of a digital certificate processing device provided by an embodiment of the present invention;

[0058] Figure 5 It is a structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0059] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0060] Figure 1 is a flowchart of a digital certificate processing method provided by an embodiment of the present invention, wherein the method is applied to any candidate node in a digital certificate management system including at least two candidate nodes, such as Figure 1 As shown, the method may include:

[0061] Step 101: In response to a signing request sent by a requesting end, a digital certificate is generated according to the private key of the candidate node and the relevant information carried in the signing request.

[0062] In an embodiment of the present invention, the digital certificate management system can be regarded as a blockchain network, and the two candidate nodes can be all nodes in the digital certificate management system, or they can be some nodes, and each candidate node in the digital certificate management system has the qualification to issue digital certificates. The requesting end can be a server, and the server can be a physical server. The issuance request can be sent by the requesting end in the initialization phase, or it can be sent when the digital certificate requested previously expires. The issuance request received by the candidate node can be sent directly to the candidate node by the requesting end, or it can be sent indirectly. For example, the issuance request of the requesting end can be sent to the candidate node closest to the requesting end in the blockchain network according to the principle of proximity, and then the candidate node synchronizes the issuance request to other candidate nodes, thereby realizing indirect transmission, so as to save the processing resources consumed by the requesting end to perform the sending operation. Alternatively, the requesting end can also directly send the issuance request to each candidate node in the blockchain network, and the embodiment of the present invention does not limit this.

[0063] The issuance request can also be called a digital certificate issuance request, a digital certificate issuance authentication request, and the issuance request can carry the relevant information required for the digital certificate issuance. The specific content of the relevant information can be set according to actual needs, and the relevant information at least includes the public key of the requesting end. Further, the relevant information can also include the name, identification, address, sending time and other information of the requesting end. For example, for any candidate node, the certificate summary can be encrypted based on the private key of the candidate node to generate a digital signature, and further a digital certificate including at least the digital signature and the public key of the requesting end can be generated. Among them, the certificate summary can be a hash value of the relevant information, and the operation of encrypting the certificate summary based on the private key of the candidate node can be regarded as the process of the candidate node using the private key to sign the public key of the requesting end. It should be noted that the public key of the requesting end can be the public key in the private key-public key pair generated by the requesting end, and the private key of each candidate node can be the private key in the private key-public key pair generated in the initialization phase of the candidate node, and the private key-public key pairs generated by different candidate nodes can be different.

[0064] Step 102: Create a block including at least the digital certificate based on the digital certificate as a candidate block.

[0065] In the embodiment of the present invention, after each candidate node generates a digital certificate, each candidate node can create a new block based on the digital certificate generated by each candidate node, thereby obtaining a candidate block. Since there are at least two candidate nodes, there can be at least two candidate blocks generated in the end.

[0066] Step 103: If the candidate block meets the preset requirements, the candidate block is determined as the target block, and the digital certificate in the target block is returned to the requesting end.

[0067] In an embodiment of the present invention, the preset requirements can be set according to actual needs. For example, the preset requirements can be preset block chain requirements. The candidate block is successfully chained to the blockchain, and the target block can be the chained block among at least two candidate blocks. Alternatively, the preset requirement can also be that the content complexity of the candidate block is the highest. If the content complexity of the candidate block created by the candidate node is the highest, then the candidate block created by the candidate node can be used as the target block. Among them, the blockchain can be a blockchain for digital certificate management. If the candidate block created by the candidate node meets the preset requirements, then the candidate node can perform the operation of determining the candidate block created by the candidate node as the target block and returning the digital certificate in the target block to the requesting end, otherwise, it will not be executed.

[0068] Furthermore, for any candidate node, when it is determined that the candidate block created this time is the target block, the digital certificate in the target block, that is, the digital certificate generated by the candidate node, is sent to the requesting end, so that the digital certificate issuance authentication can be realized. The requesting end can perform encrypted communication based on the received digital certificate.

[0069] In summary, the digital certificate processing method provided by the embodiment of the present invention, any candidate node in the digital certificate management system, will respond to the issuance request sent by the requesting end, and generate a digital certificate according to the private key of the candidate node and the relevant information carried in the issuance request. Create a block that at least includes a digital certificate based on the digital certificate as a candidate block. When the candidate block meets the preset requirements, the candidate block is determined as the target block, and the digital certificate in the target block is returned to the requesting end. In the embodiment of the present invention, multiple candidate nodes generate digital certificates, and eventually return the digital certificate in the target block that meets the preset requirements to the requesting end. Even if a single candidate node fails, the issuance of digital certificates can be achieved to a certain extent, thereby improving the stability of the issuance operation.

[0070] Optionally, in an embodiment of the present invention, before generating a digital certificate according to the private key of the candidate node and the relevant information carried in the issuance request, the public key of the trusted end stored in the designated block of the blockchain can be obtained. In the case where the public key of the requesting end belongs to the public key of the trusted end, the operation of generating a digital certificate according to the private key of the candidate node and the relevant information carried in the issuance request is performed. Specifically, the designated block can be specified in the block that has been chained in the blockchain according to actual needs, and the candidate node can access the designated block to read the public key of the trusted end from it, extract the public key contained in the issuance request, and use it as the public key of the requesting end. Then, the public key of the requesting end is compared with the public keys of each trusted end to determine whether there is a public key of the trusted end that is consistent with the public key of the requesting end. If it exists, it can be determined that the public key of the requesting end belongs to the public key of the trusted end. Otherwise, it can be determined that it does not belong. In an embodiment of the present invention, a digital certificate is issued only to a trusted end corresponding to a public key stored in a designated block. When a signing request is received, the identity of the requesting end is first verified, that is, whether the public key of the requesting end belongs to the public key of the trusted end is detected. If so, subsequent certificate signing operations are performed for the requesting end. In this way, the problem of issuing a digital certificate to an untrusted requesting end can be avoided to a certain extent.

[0071] In the embodiment of the present invention, the trusted end acts as a trusted node, and the public key of the trusted end is saved in the genesis block. The issuance requests from these trusted ends can be responded to quickly without cumbersome manual review processes. The identity subject verification can be automatically realized based on the public key of the trusted end stored in the specified block, which can improve processing efficiency.

[0072] It should be noted that compared to the method in which each issuance request needs to be submitted to the manual review process, in an embodiment of the present invention, when the public key of the requesting end does not belong to the public key of the trusted end, the issuance request sent by the requesting end can be submitted to the manual review process, thereby reducing the manual review process to a certain extent. The embodiment of the present invention does not impose any restrictions on this.

[0073] Optionally, when the candidate block meets the preset requirements, the step of determining the candidate block as the target block may specifically include:

[0074] Step S21: If the candidate block meets the preset block chain requirement, determine the candidate block as the target block.

[0075] Specifically, each candidate node can calculate the hash value of the created candidate block. For example, the content in the block header of the candidate block can be hashed to obtain the hash value of the candidate block. Further, it can be detected whether the hash value of the candidate block meets the preset numerical requirements. If it meets and there is only one candidate block whose hash value meets the preset numerical requirements, then it can be determined that the candidate block meets the preset block chain requirements. If it meets but there are currently multiple candidate blocks whose hash values ​​meet the preset numerical requirements, then if the candidate block meets the preset fork selection condition, it is determined that the candidate block meets the preset block chain requirements. Among them, the fork selection condition can be the first to reach a specified number of new blocks after being chained, or the fork selection condition can also be other conditions, for example, the hash value that meets the preset numerical requirements is calculated first, etc., and the embodiment of the present invention does not limit this. For example, each candidate node can synchronously calculate a hash value that meets the preset numerical requirements or the time required to first reach a specified number of new blocks, so that each candidate node can determine whether it is the first to calculate a hash value that meets the preset numerical requirements, or whether it can reach the specified number of new blocks first.

[0076] Accordingly, before the above step of returning the digital certificate in the target block to the requesting end, the following operations may also be performed:

[0077] Step S31: perform a block chain operation on the target block to add the target block to the blockchain corresponding to the digital certificate management system.

[0078] Among them, the blockchain corresponding to the digital certificate management system can be used for digital certificate management, and the blockchain corresponding to the digital certificate management system can store the blocks corresponding to the issued digital certificates, that is, the digital certificates issued by the digital certificate management system in the embodiment of the present invention are stored in the form of blockchain. It should be noted that in the embodiment of the present invention, after returning the digital certificate in the target block to the requesting end, the block chain operation can be performed, and the embodiment of the present invention does not limit this. Accordingly, in this implementation method, after performing the block chain operation, it can be detected whether the digital certificate in the target block that is successfully chained is consistent with the digital certificate returned to the requesting end. In the case of inconsistency, the digital certificate in the target block that is successfully chained is resent to the requesting end to ensure that the digital certificate held by the requesting end is accurately recorded in the blockchain.

[0079] Step S32: After successful addition, the operation of returning the digital certificate in the target block to the requesting end is performed.

[0080] That is to say, the operation of returning the digital certificate in the target block to the requesting end may specifically be to send the digital certificate in the target block to the requesting end when the target block is successfully added to the blockchain corresponding to the digital certificate management system. It should be noted that the requesting end may subsequently send a new digital certificate issuance modification request to re-acquire the digital certificate when the digital certificate cannot be used. Accordingly, the candidate node in the digital certificate management system may re-perform the next hash calculation to re-issue the digital certificate.

[0081] In the embodiment of the present invention, when the candidate block meets the preset block chain requirements, the candidate block is determined as the target block. The block chain operation is performed on the target block to add the target block to the blockchain corresponding to the digital certificate management system. After the target block is successfully added, the digital certificate in the target block is returned to the requesting end. In this way, it can be ensured that the digital certificate issued to the requesting end is successfully recorded in the blockchain, thereby facilitating the subsequent management of the digital certificate based on the blockchain.

[0082] Optionally, the above-mentioned operation of performing a block chain operation on the target block to add the target block to the blockchain corresponding to the digital certificate management system may specifically include:

[0083] Step S41: Add the target block to the local blockchain of the candidate node, and broadcast the target block to other nodes in the digital certificate management system, where the other nodes are used to perform validity verification operations on the target block, and if the verification passes, synchronize the target block to the local blockchain.

[0084] In an embodiment of the present invention, the blockchain corresponding to the digital certificate management system may include a blockchain deployed locally on each node. Accordingly, in order to realize the addition of the target block to the blockchain corresponding to the digital certificate management system, each node in the digital certificate management system may perform an on-chain operation to ensure the content consistency of the blockchain local to each node, thereby ensuring that subsequent operations can proceed normally. Specifically, the candidate node may directly perform an on-chain operation to add the target block to the blockchain local to the candidate node. Further, the target block may be broadcast to any other node in the digital certificate management system to implement the digital certificate issuance business processing link. For any other node, the other node may verify the validity of the target block, and if the verification is passed, synchronize the target block to the blockchain local to other nodes. When the target block is added to the blockchain local to the candidate node and synchronized by each other node, it may be regarded as the target block being added to the blockchain corresponding to the digital certificate management system. It should be noted that the candidate node may further detect whether the target block is successfully added to the blockchain corresponding to the digital certificate management system after synchronization.

[0085] In the embodiment of the present invention, the target block is added to the local blockchain of the candidate node, and the target block is broadcast to other nodes in the digital certificate management system. The other nodes are used to perform validity verification operations on the target block, and synchronize the target block to the local blockchain only when the verification is passed. In this way, it can be ensured that only the target block that passes the validity verification can be successfully added to the blockchain corresponding to the digital certificate management system, and invalid target blocks are prevented from being synchronized to the local blockchains of other nodes, thereby preventing invalid target blocks from being added to the blockchain corresponding to the digital certificate management system.

[0086] Optionally, the validity verification operation may specifically include: verifying whether the public key of the requesting end belongs to the public key of the trusted end stored in the designated block of the blockchain; and / or, verifying whether the data format of the content in the target block conforms to the designated format; and / or, verifying whether the target block conforms to the requirements for block on-chain.

[0087] In an embodiment of the present invention, the public key of the requesting end may be included in the digital certificate of the target block, and the public key of the trusted end stored in the designated block may be pre-stored. The other node may search the designated block for the public key of the trusted end stored in the designated block, and reconfirm the identity of the requesting subject. If the public key of the requesting end belongs to the public key of the trusted end stored in the designated block, it can be determined that the requesting end meets the identity of the requesting subject and is qualified to be issued a digital certificate. The implementation method for verifying whether the target block meets the requirements for block chaining can refer to the relevant description in the embodiment of the present invention, which will not be repeated here. Furthermore, the specified format may be the data format of the content in the block pre-agreed between the nodes. If the public key of the requesting end belongs to the public key of the trusted end and / or the data format of the content in the target block meets the specified format and / or the target block meets the requirements for block chaining, it can be explained to a certain extent that the digital certificate in the target block is not maliciously issued by an illegal node for an illegal requesting end. Accordingly, in this case, it can be determined that the target block has passed the validity verification. For example, Figure 2 is a schematic diagram of a processing flow provided by an embodiment of the present invention, such as Figure 2 As shown, a digital certificate issuance request can be received first, and then blocks can be packaged to create candidate blocks. When the target block is determined, the block can be broadcast to synchronize other nodes. Accordingly, other nodes can verify the block and complete the synchronization if the verification is successful.

[0088] In the embodiment of the present invention, by verifying whether the public key of the requesting end belongs to the public key of the trusted end stored in the specified block of the blockchain; and / or verifying whether the data format of the content in the target block conforms to the specified format; and / or verifying whether the target block conforms to the block chain requirements, the validity confirmation of the certificate issuance is achieved, which can avoid the problem of malicious issuance of digital certificates to a certain extent, thereby ensuring the security of digital certificate issuance.

[0089] Optionally, in one implementation, the designated block may be a genesis block in the blockchain, and the genesis block may be created in the initialization phase of the blockchain according to the public keys of each trusted terminal. Specifically, the designated node in the digital management system may send a public key reporting instruction to each trusted terminal, so that each trusted terminal reports its own public key to the designated node. Alternatively, the public key of the trusted terminal may be directly preset in the designated node. The designated node may be any node in the digital certificate management system, and the designated node may determine the correspondence between the identifier of the trusted terminal and the public key according to the public keys of each trusted terminal, and create the first block including the correspondence in the initialization phase as the designated block. Accordingly, the step of comparing the public key of the requesting end with the public keys of each trusted end to determine whether there is a public key of the trusted end that is consistent with the public key of the requesting end may specifically include: comparing each public key in the corresponding relationship with the public key of the requesting end, if the public key is consistent with the public key of the requesting end, and the identifier of the trusted end corresponding to the public key is consistent with the identifier of the requesting end, it can be determined that the public key of the requesting end belongs to the public key of the trusted end. Otherwise, it can be determined that the public key of the requesting end does not belong to the public key of the trusted end.

[0090] In an embodiment of the present invention, a genesis block is created according to the public key of each trusted end during the initialization phase of the blockchain. The genesis block is used as the first block in the blockchain. The genesis block in the blockchain is used as the designated block, which can ensure that the public key of the trusted end can be found in each subsequent process of issuing digital certificates based on the blockchain network, thereby ensuring that the issuance operation can proceed normally.

[0091] It should be noted that in the embodiment of the present invention, when a new trusted end appears, a new blockchain can be created for the digital certificate management system based on the public key of the new trusted end to issue digital certificates for these new trusted ends. Compared with adding the public key of the new trusted end to the genesis block, which requires updating the entire blockchain, in the embodiment of the present invention, only a new blockchain needs to be created, which can ensure the added efficiency to a certain extent and reduce the added cost.

[0092] Optionally, upon receiving the certificate verification request sent by the query end, the candidate node may also perform the following operations:

[0093] Step S51: In response to the certificate verification request, determine the block to be queried in the blockchain according to the issuance time of the certificate to be verified indicated by the certificate verification request.

[0094] The certificate verification request can also be called a digital certificate query request. Any candidate node in the digital certificate management system may receive the certificate verification request. Specifically, in one implementation, the certificate verification request sent by the query end can be specifically sent to the candidate node closest to the query end. The query end can be a client, or it can also be a server.

[0095] For example, Figure 3 is a schematic diagram of an application scenario provided by an embodiment of the present invention, such as Figure 3 As shown in Figure 1, the server can request the CA blockchain network to issue a digital certificate, that is, the server can send an issuance request to the CA blockchain network. The client can request the CA blockchain network to authenticate a digital certificate, that is, the client can send a certificate verification request to the CA blockchain network. The CA blockchain network can be regarded as a digital certificate management system, where CA1, CA2, ..., CA k It can be regarded as a node in the digital certificate management system. The CA blockchain network provided by the embodiment of the present invention can quickly verify the issued digital certificates, thereby ensuring the query efficiency of digital certificates.

[0096] The certificate to be verified indicated by the certificate verification request may be the certificate carried in the certificate verification request. The issuance time of the certificate to be verified may be carried in the certificate verification request, or, when issuing a digital certificate, the generation time of the digital certificate may be written into the digital certificate as the issuance time, and accordingly, the candidate node may also obtain the issuance time from the certificate to be verified.

[0097] Furthermore, in the case of creating a block, each block can be timestamped, and accordingly, the timestamp representation time of each block in the blockchain can be used as the creation time. Specifically, the block whose creation time is consistent with the issuance time and the m blocks before and / or after the block can be determined as the block to be queried. The specific value of m can be set according to actual needs, for example, m can be 1. Alternatively, the block whose creation time and the issuance time of the certificate to be verified have a time difference less than a preset threshold and is determined as the block to be queried. The preset threshold can be determined according to actual conditions. For example, the preset threshold can be 0, or 10 minutes, and so on.

[0098] Step S52: Detect whether the digital certificate in the block to be queried matches the certificate to be verified indicated by the certificate verification request.

[0099] There may be one or more blocks to be queried. Accordingly, the digital certificates in each block to be queried may be compared with the certificate to be verified. If the two are consistent, it is determined that the two match.

[0100] Optionally, in one implementation, the operation of creating a block based on the digital certificate generated by the candidate node may specifically include: packaging the digital certificate and the public key of the candidate node into a block. For example, each candidate node may directly perform CA business processing, that is, packaging the digital certificate issuance record into the block. Accordingly, the validity of the block may be determined by a consensus algorithm later. Among them, the issuance record includes at least a digital certificate and the public key of the candidate node, and the block validity may be determined by a consensus algorithm by performing a hash calculation to determine the candidate block that meets the requirements for block on-chain. That is, the block to be queried will also include the public key of the candidate node that generates the digital certificate in the block to be queried. Accordingly, based on the public key of the candidate node in the block to be queried, it can be verified whether the digital certificate in the block to be queried matches the certificate to be verified. Specifically, the public key of the candidate node contained in the block to be queried may be first obtained from the block to be queried. Then the encrypted certificate summary in the certificate to be verified is decrypted using the obtained public key, and the certificate summary is obtained based on the certificate content. If the obtained certificate digest is consistent with the certificate digest obtained after decryption, it can be ensured that the certificate to be verified matches the digital certificate in the block to be queried. Otherwise, it can be determined that they do not match. In the embodiment of the present invention, by further packaging the public key of the candidate node when creating the block, the subsequent certificate validity verification based on the public key of the candidate node in the block can be more convenient, thereby improving the efficiency of certificate query to a certain extent.

[0101] It should be noted that in the embodiment of the present invention, based on the identification information of the certificate to be verified, the Merkle tree structure can be used to quickly locate whether there is a certificate to be verified in the block to be queried. If it exists, verification is performed based on the public key of the candidate node in the block to be queried. And it is possible to verify whether the digital certificate in the block to be queried matches the certificate to be verified only based on the public key of the candidate node in the block to be queried where the certificate to be verified exists. In this way, it is possible to avoid performing unnecessary verification operations, resulting in a waste of resources.

[0102] Step S53: If there is a match, return valid indication information to the query end.

[0103] Step S54: In case of mismatch, return invalid indication information to the query end.

[0104] In the embodiment of the present invention, the valid indication information may be used to indicate that the certificate to be verified is valid, and the invalid indication information may be used to indicate that the certificate to be verified is invalid.

[0105] In an existing process, when the server requests the CA center to authenticate the server's digital certificate, a single CA center issues a digital certificate to the server. However, due to the problem of centralization, a single CA center is easily attacked and then has a single node failure problem, resulting in the inability to issue digital certificates normally. Accordingly, in this existing process, the client needs to download and install the CA root certificate first. When the client and the server communicate, it needs to request a digital certificate from the server first. The server returns the server's digital certificate to the client, and the client verifies the validity of the digital certificate based on the local CA root certificate (i.e., CA public key). Accordingly, when it is verified that the digital certificate is valid, it can be determined that the server public key provided in the digital certificate is indeed provided by a legitimate server, and can be used to verify the identity of the server in the future. However, the CA public key stored locally on the client is easy to be tampered with. This method cannot ensure communication security when the CA public key is easy to be tampered with.

[0106] In an embodiment of the present invention, the digital certificate is stored in the blockchain corresponding to the digital certificate management system, and the digital certificate is managed based on the blockchain, which can prevent tampering to a certain extent. When the candidate node receives the certificate verification request sent by the query end, it will respond to the certificate verification request and determine the block to be queried in the blockchain according to the issuance time of the certificate to be verified indicated by the certificate verification request. Detect whether the digital certificate in the block to be queried matches the certificate to be verified indicated by the certificate verification request. In the case of a match, return valid indication information to the query end. In the case of a mismatch, return invalid indication information to the query end. Query directly from the blockchain corresponding to the digital management system. Since the candidate node that receives the certificate verification request performs certificate verification based on the blockchain, since there is no need to use the local CA root certificate of the client, it can avoid the problem of communication security that cannot be ensured when the CA public key is easily tampered with to a certain extent.

[0107] At the same time, the blockchain network itself issues digital certificates, that is, the blockchain network itself serves as the CA center, and the digital certificate issuance, authentication, and storage modules are integrated from the architecture, and the single CA center function is deconstructed into the entire blockchain network to achieve decentralization. Each blockchain node performs the packaging processing of the issuance request, saves the CA authentication record in the block (that is, creates a candidate area), and the blockchain network will eventually chain the target block that meets the requirements. In other words, in the embodiment of the present invention, each blockchain node performs the CA function, there is no specific CA center, there is no confirmation step of the CA center, and the business processing is directly performed. With this process structure, the attacker has no specific CA center to attack, and the attacker can only attack the blockchain network itself. However, in the case of an attack on a multi-node blockchain network, there are still nodes whose functions are not affected that can issue digital certificates. In this way, based on a decentralized digital certificate management system, it can better resist attacks, and to a certain extent, it can ensure that the issuance process can proceed normally and ensure that the system can run stably. The blockchain network provided by the embodiment of the present invention can be regarded as an effective CA center. The system can run stably after initialization, and there will be no problem that the issuance process cannot proceed normally due to a single point failure, thereby ensuring the stability of the system.

[0108] And because each blockchain node in the embodiment of the present invention can provide complete issuance, storage, and query functions, it is only necessary to add nodes with the same functions to achieve capacity expansion, so that the blockchain network can be easily expanded to a certain extent, reducing the difficulty of expansion. Further, the digital certificate can only be generated by the joint signature of multiple nodes. The method of verifying and returning the certificate by a single management node still has the problem of centralization and the system coupling is high. The impact of a single node failure on the entire processing flow is large. In the embodiment of the present invention, each candidate node has the ability to generate a digital certificate, and there is no need to communicate in the link of generating a digital certificate, so that the communication time consumption can be reduced to a certain extent. The embodiment of the present invention can effectively avoid the centralization problem and facilitate the management of nodes. Even if a single node fails, it will not affect the entire processing flow. In the way that nodes take turns as CA centers, there is still a centralization problem and it is difficult to confirm the current CA center. In the embodiment of the present invention, each candidate node simultaneously acts as a CA center to issue digital certificates, and there is no need to confirm the current CA center, so that the centralization problem and the problem of difficulty in confirmation can be avoided.

[0109] Figure 4 20 is a structural diagram of a digital certificate processing device provided by an embodiment of the present invention. The device can be applied to any candidate node in a digital certificate management system including at least two candidate nodes. The device 20 may include:

[0110] The generating module 201 is used to generate a digital certificate in response to the issuance request sent by the requesting end according to the private key of the candidate node and the relevant information carried in the issuance request;

[0111] A creation module 202, configured to create a block including at least the digital certificate based on the digital certificate as a candidate block;

[0112] The first returning module 203 is used to determine the candidate block as the target block if the candidate block meets the preset requirements, and return the digital certificate in the target block to the requesting end.

[0113] Optionally, the first returning module 203 is specifically configured to:

[0114] If the candidate block meets the preset block chain requirements, determine the candidate block as the target block;

[0115] The device 20 also includes: an adding module, used to perform a block chaining operation on the target block to add the target block to the blockchain corresponding to the digital certificate management system; a first execution module, used to execute the operation of returning the digital certificate in the target block to the requesting end after successful addition.

[0116] Optionally, the adding module is specifically used for:

[0117] The target block is added to the local blockchain of the candidate node, and the target block is broadcast to other nodes in the digital certificate management system. The other nodes are used to perform validity verification operations on the target block, and if the verification passes, synchronize the target block to the local blockchain.

[0118] Optionally, the validity verification operation includes: verifying whether the public key of the requesting end belongs to the public key of the trusted end stored in the specified block of the blockchain; and / or verifying whether the data format of the content in the target block conforms to the specified format; and / or verifying whether the target block meets the block chain requirements.

[0119] Optionally, the device 20 further includes:

[0120] An acquisition module, used to acquire the public key of the trusted end stored in a specified block of the blockchain;

[0121] The second execution module is used to execute the operation of generating a digital certificate according to the private key of the candidate node and the relevant information carried in the issuance request when the public key of the requesting end belongs to the public key of the trusted end.

[0122] Optionally, the designated block is a genesis block in the blockchain, and the genesis block is created during the initialization phase of the blockchain based on the public keys of each trusted end.

[0123] Optionally, the device 20 further includes:

[0124] A determination module, configured to determine, in response to the certificate verification request, a block to be queried in the blockchain according to the issuance time of the certificate to be verified indicated by the certificate verification request;

[0125] A detection module, used to detect whether the digital certificate in the block to be queried matches the certificate to be verified indicated by the certificate verification request;

[0126] A second returning module, used for returning valid indication information to the query end in case of a match;

[0127] The third returning module is used to return invalid indication information to the query end in case of mismatch.

[0128] Optionally, the creation module 202 is specifically configured to: package the digital certificate and the public key of the candidate node into a block;

[0129] The detection module is specifically used for:

[0130] Based on the public key of the candidate node in the block to be queried, verify whether the digital certificate in the block to be queried matches the certificate to be verified.

[0131] In summary, the digital certificate processing device provided in the embodiment of the present invention, any candidate node in the digital certificate management system, will respond to the issuance request sent by the requesting end, and generate a digital certificate according to the private key of the candidate node and the relevant information carried in the issuance request. Create a block that at least includes a digital certificate based on the digital certificate as a candidate block. When the candidate block meets the preset requirements, the candidate block is determined as the target block, and the digital certificate in the target block is returned to the requesting end. In the embodiment of the present invention, multiple candidate nodes generate digital certificates, and eventually return the digital certificate in the target block that meets the preset requirements to the requesting end. Even if a single candidate node fails, the issuance of digital certificates can be achieved to a certain extent, thereby improving the stability of the issuance operation.

[0132] The present invention also provides a digital certificate management system, the system comprising at least two candidate nodes, each of the candidate nodes being used to execute the digital certificate processing method of the aforementioned embodiment.

[0133] The present invention also provides an electronic device, see Figure 5, including: a processor 901, a memory 902, and a computer program 9021 stored in the memory and executable on the processor, wherein when the processor executes the program, the digital certificate processing method of the aforementioned embodiment is implemented.

[0134] The present invention also provides a readable storage medium. When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute the digital certificate processing method of the aforementioned embodiment.

[0135] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0136] It should be noted that the various information and data obtained in the embodiments of the present invention are all obtained with the authorization of the information / data holder.

[0137] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the present invention is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the description of the above specific languages ​​is for disclosing the best mode of the present invention.

[0138] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0139] Similarly, it should be understood that in order to streamline the present invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, the various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the following intention: that the claimed invention requires more features than the features explicitly recited in each claim. More specifically, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present invention.

[0140] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0141] The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functions of some or all of the components in the sorting device according to the present invention. The present invention may also be implemented as a device or apparatus program for executing part or all of the methods described herein. Such a program for implementing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0142] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc., does not indicate any order. These words may be interpreted as names.

[0143] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0144] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

[0145] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A digital certificate processing method, characterized in that: The method is applied to any candidate node in a digital certificate management system including at least two candidate nodes, and the method includes: In response to the issuance request sent by the requesting end, encrypt the certificate digest according to the private key of the candidate node and the relevant information carried in the issuance request to generate a digital signature, and generate a digital certificate containing at least the digital signature and the public key of the requesting end; Based on the digital certificate, create a block including at least the digital certificate as a candidate block, where the number of the candidate blocks is greater than or equal to 2; If the candidate block meets the preset requirements, determine the candidate block as the target block, and return the digital certificate in the target block to the requesting end; Wherein, when the candidate block meets the preset requirements, determining the candidate block as the target block includes: Performing hash calculation on the block header of the candidate block to obtain a hash value of the candidate block; Detecting whether the hash value of the candidate block meets a preset numerical requirement, and determining the candidate block as a target block when the hash value of the candidate block meets the preset numerical requirement.

2. The method according to claim 1, characterized in that When the candidate block meets the preset requirements, determining the candidate block as the target block includes: If the candidate block meets the preset block chain requirements, determine the candidate block as the target block; Before returning the digital certificate in the target block to the requesting end, the method further includes: performing a block chain operation on the target block to add the target block to the blockchain corresponding to the digital certificate management system; after successful addition, performing the operation of returning the digital certificate in the target block to the requesting end.

3. The method according to claim 2, characterized in that The performing a block chaining operation on the target block to add the target block to the blockchain corresponding to the digital certificate management system includes: The target block is added to the local blockchain of the candidate node, and the target block is broadcast to other nodes in the digital certificate management system. The other nodes are used to perform validity verification operations on the target block, and if the verification passes, synchronize the target block to the local blockchain.

4. The method according to claim 3, characterized in that The validity verification operation includes: verifying whether the public key of the requesting end belongs to the public key of the trusted end stored in the specified block of the blockchain; and / or verifying whether the data format of the content in the target block conforms to the specified format; and / or verifying whether the target block meets the block chain requirements.

5. The method according to claim 2, characterized in that: Before generating a digital certificate according to the private key of the candidate node and the relevant information carried in the issuance request, the method further includes: Obtaining a public key of a trusted end stored in a specified block of the blockchain; In the case where the public key of the requesting end belongs to the public key of the trusted end, the operation of generating a digital certificate according to the private key of the candidate node and the relevant information carried in the issuance request is performed.

6. The method according to claim 4 or 5, characterized in that: The designated block is a genesis block in the blockchain, and the genesis block is created according to the public keys of each trusted end during the initialization phase of the blockchain.

7. The method according to claim 2, characterized in that In the case where the candidate node receives a certificate verification request sent by the query end, the method further includes: In response to the certificate verification request, determining a block to be queried in the blockchain according to the issuance time of the certificate to be verified indicated by the certificate verification request; Detecting whether the digital certificate in the block to be queried matches the certificate to be verified indicated by the certificate verification request; In case of a match, returning valid indication information to the query end; In case of mismatch, invalid indication information is returned to the query end.

8. The method according to claim 7, characterized in that The creating a block including at least the digital certificate based on the digital certificate comprises: packaging the digital certificate and the public key of the candidate node into a block; The detecting whether the digital certificate in the block to be queried matches the certificate to be verified indicated by the certificate verification request includes: Based on the public key of the candidate node in the block to be queried, verify whether the digital certificate in the block to be queried matches the certificate to be verified.

9. A digital certificate processing device, characterized in that: The device is applied to any candidate node in a digital certificate management system including at least two candidate nodes, and the device includes: A generating module, configured to, in response to the issuance request sent by the requesting end, encrypt the certificate digest according to the private key of the candidate node and the relevant information carried in the issuance request to generate a digital signature, and generate a digital certificate containing at least the digital signature and the public key of the requesting end; A creation module, configured to create a block including at least the digital certificate based on the digital certificate as a candidate block, wherein the number of the candidate blocks is greater than or equal to 2; A first returning module, configured to determine the candidate block as a target block if the candidate block meets a preset requirement, and return the digital certificate in the target block to the requesting end; The first returning module is specifically used to perform hash calculation on the block header of the candidate block to obtain the hash value of the candidate block; detect whether the hash value of the candidate block meets the preset numerical requirement, and if the hash value of the candidate block meets the preset numerical requirement, determine the candidate block as the target block.

10. A digital certificate management system, characterized in that: The system comprises at least two candidate nodes, each of which is configured to execute the method according to one or more of claims 1-8.

11. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method according to one or more of claims 1 to 8 is implemented.

12. A readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute one or more of the methods described in claims 1-8.

Images