A digital certificate issuance method, device and system based on blockchain

Abstract

The present specification provides a blockchain-based digital certificate issuance method, device and system, the method is applied to blockchain nodes in a blockchain network, including: in response to a certificate issuance transaction that calls a certificate issuance contract, transparently transmitting the certificate provision task to the issuer node device where the issuer node corresponding to the issuer is located, for instructing the issuer off-chain computing engine deployed by the issuer node device to feedback the issuer task execution result; based on the description information of the to-be-issued certificate held by the issuer carried in the issuer task execution result, maintaining the digital certificate corresponding to the to-be-issued certificate in the certificate issuance contract, transparently transmitting the certificate audit task to the auditor nodes corresponding to the auditors, for instructing the auditor off-chain computing engine corresponding to the auditor node to feedback the auditor task execution result; based on the audit result generated by the corresponding auditor carried in the auditor task execution result, updating the audit status of the digital certificate.

Description

Technical Field

[0001] The embodiments of this specification belong to the field of blockchain technology, and in particular, relate to a method, device and system for issuing digital certificates based on blockchain. Background Art

[0002] Blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. In the blockchain system, data blocks are combined into a chain data structure in a sequential manner according to chronological order, and a distributed ledger that cannot be tampered with or forged is guaranteed by cryptography.

[0003] Each blockchain node in the blockchain network is deployed with the same blockchain copy and smart contract, which makes the on-chain data maintained by the blockchain or the on-chain behavior executed by the blockchain shared by all blockchain nodes. When all participants jointly implement collaborative tasks through the blockchain, on the one hand, they need to ensure the openness and transparency of the task execution process, and on the other hand, they do not want to expose sensitive data in their own business systems that must be involved in performing collaborative tasks. Especially in the scenario of credential issuance and review, on the one hand, it is necessary to ensure that the credential issuance process is credible, and on the other hand, the issuer does not want to expose other information except the credential to be issued, and the auditor does not want to expose internal data used to review the credential. Summary of the invention

[0004] The purpose of the present invention is to provide a method, device and system for issuing digital certificates based on blockchain.

[0005] According to a first aspect of one or more embodiments of this specification, a blockchain-based digital certificate issuance method is proposed, which is applied to a blockchain node in a blockchain network, wherein the blockchain network includes blockchain nodes corresponding to an issuer and at least one auditor, and the node devices where the blockchain nodes corresponding to each party are located are also deployed with corresponding off-chain computing engines; the method includes:

[0006] In response to the credential issuance transaction that calls the credential issuance contract, the credential provision task is transparently transmitted to the issuer node device where the issuer node corresponding to the issuer is located, and the credential provision task is used to instruct the issuer off-chain computing engine deployed by the issuer node device to feedback the issuer task execution result to the credential issuance contract;

[0007] Based on the description information of the to-be-issued voucher held by the issuer carried in the execution result of the issuer task, the digital voucher corresponding to the to-be-issued voucher is maintained in the voucher issuance contract, and the voucher audit task is transparently transmitted to the audit party node device where the audit party node corresponding to the audit party is located, and the voucher audit task is used to instruct the audit party off-chain computing engine deployed by the audit party node device to feedback the audit party task execution result to the voucher issuance contract;

[0008] Based on the audit result generated by the corresponding auditor carried in the auditor task execution result, the audit status of the digital certificate is updated; wherein, when the audit status is updated to have passed the audit of all auditors, the audit status is used to indicate that the digital certificate is successfully issued.

[0009] According to a second aspect of one or more embodiments of this specification, a digital certificate issuance device based on blockchain is proposed, which is applied to a blockchain node in a blockchain network, wherein the blockchain network includes blockchain nodes corresponding to an issuer and at least one reviewer, and the node devices where the blockchain nodes corresponding to each party are located are also deployed with corresponding off-chain computing engines; the device includes:

[0010] A credential issuance transaction response unit, configured to respond to a credential issuance transaction that calls a credential issuance contract, transparently transmit a credential provision task to an issuer node device where an issuer node corresponding to the issuer is located, wherein the credential provision task is used to instruct an issuer off-chain computing engine deployed by the issuer node device to feed back an issuer task execution result to the credential issuance contract;

[0011] A digital certificate maintenance unit, for maintaining the digital certificate corresponding to the certificate to be issued in the certificate issuance contract based on the description information of the certificate to be issued held by the issuer carried in the result of the issuer task execution, and transparently transmitting the certificate audit task to the audit party node device where the audit party node corresponding to the audit party is located, and the certificate audit task is used to instruct the audit party off-chain computing engine deployed by the audit party node device to feedback the audit party task execution result to the certificate issuance contract;

[0012] An audit status updating unit is used to update the audit status of the digital certificate based on the audit result generated by the corresponding auditor carried by the auditor's task execution result; wherein, when the audit status is updated to have passed the audit of all auditors, the audit status is used to indicate that the digital certificate is successfully issued.

[0013] According to a third aspect of one or more embodiments of this specification, a blockchain-based digital certificate issuance system is proposed, including: an issuer node device, a platform reviewer node device, a payment collection supplier reviewer node device, and a bank reviewer node device, each node device is respectively deployed with a blockchain node belonging to the same blockchain network and a corresponding off-chain computing engine, and the blockchain network is deployed with a certificate issuance contract;

[0014] The issuer node device is used to, upon obtaining the credential provision task transparently transmitted by the credential issuance contract in response to the credential issuance transaction, call the locally deployed issuer off-chain computing engine to return the description information of the accounts payable held by the issuer to the credential issuance contract based on the credential provision task, wherein the description information is used to instruct the credential issuance contract to maintain the digital credential corresponding to the accounts payable and update the review status of the digital credential to submitted;

[0015] The platform auditor node device is used to, when obtaining the platform credential audit task transparently transmitted by the credential issuance contract when the audit status is submitted, call the locally deployed platform off-chain computing engine to return the platform audit result to the credential issuance contract based on the platform credential audit task, and the platform audit result is used to instruct the credential issuance contract to update the audit status;

[0016] The node device of the payment receiving supplier reviewer is used to call the locally deployed payment receiving supplier chain computing engine to return the payment receiving supplier review result to the voucher issuing contract based on the payment receiving supplier voucher review task when the voucher issuing contract obtains the payment receiving supplier voucher review task transmitted by the voucher issuing contract when the review status indicates that the platform has passed the review, and the payment receiving supplier review result is used to instruct the voucher issuing contract to update the review status;

[0017] The bank reviewer node device is used to call the locally deployed bank chain computing engine to return the bank review result to the certificate issuance contract based on the bank certificate review task when the bank certificate issuance contract obtains the bank certificate review task transmitted when the review status indicates that it has passed the review of the payment supplier. The bank review result is used to instruct the certificate issuance contract to update the review status; wherein, when the review status is updated to have passed the bank review, the review status is used to indicate that the digital certificate has been successfully issued.

[0018] According to a fourth aspect of one or more embodiments of this specification, an electronic device is provided, including:

[0019] processor;

[0020] a memory for storing processor-executable instructions;

[0021] The processor implements the method as described in the first aspect by running the executable instructions.

[0022] According to a fifth aspect of one or more embodiments of the present specification, a computer-readable storage medium is provided, on which computer instructions are stored, and when the instructions are executed by a processor, the steps of the method described in the first aspect are implemented.

[0023] In the embodiments of this specification, on the one hand, the certificate issuance contract deployed through the blockchain network maintains the digital certificate corresponding to the certificate to be issued held by the issuer, and updates the audit status of the digital certificate according to the audit result provided by the auditor, so that the entire process of the digital certificate from creation, audit to successful issuance is open and transparent, that is, the issuance process of the digital certificate is ensured to be credible; on the other hand, since the certificate issuance contract only serves as a task dispatching function, and the certificate provision task and certificate audit task, which involve the internal data of the issuer or auditor, are actually handed over to the off-chain computing engine for execution, the data used in the execution process will not be shared on the blockchain, thereby ensuring the privacy security of the issuer and the auditor. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0025] Figure 1 It is a flowchart of a blockchain-based digital certificate issuance method provided by an exemplary embodiment.

[0026] Figure 2 This is an architectural diagram of a blockchain-based digital certificate issuance system provided by an exemplary embodiment.

[0027] Figure 3 This is an application scenario diagram of a blockchain-based digital certificate issuance system provided by an exemplary embodiment.

[0028] Figure 4 It is an interactive flow chart of a blockchain-based digital certificate issuance scheme provided by an exemplary embodiment.

[0029] Figure 5 It is a structural schematic diagram of a device provided by an exemplary embodiment.

[0030] Figure 6 It is a block diagram of a digital certificate issuing device based on blockchain provided by an exemplary embodiment. DETAILED DESCRIPTION

[0031] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0032] Figure 1 This is a flowchart of a blockchain-based digital certificate issuance method provided by an exemplary embodiment. The method is applied to a blockchain node in a blockchain network, wherein the blockchain network includes blockchain nodes corresponding to the issuer and at least one auditor, and the node devices where the blockchain nodes corresponding to each party are located are also deployed with corresponding off-chain computing engines; the method includes:

[0033] S102: In response to the credential issuance transaction that calls the credential issuance contract, the credential provision task is transparently transmitted to the issuer node device where the issuer node corresponding to the issuer is located, and the credential provision task is used to instruct the issuer off-chain computing engine deployed by the issuer node device to feedback the issuer task execution result to the credential issuance contract.

[0034] In the embodiments of this specification, the issuer and the auditor of the digital certificate will hold corresponding blockchain nodes in the blockchain network in advance, wherein the blockchain node held by the issuer of the digital certificate in the blockchain network is called the issuer node, and the blockchain node held by the auditor of the digital certificate is called the auditor node. Node equipment refers to a hardware device with the blockchain node software deployed, and the resources deployed related to the blockchain node are considered as on-chain resources, while the rest are considered as off-chain resources. For example, the issuer node equipment with the issuer node also has the issuer off-chain computing engine held by the issuer as an off-chain resource, and the auditor node equipment with the auditor node also has the auditor off-chain computing engine held by the corresponding auditor as an off-chain resource.

[0035] The off-chain computing engine involved in the embodiments of this specification refers to a service or subsystem that provides off-chain computing capabilities for node devices. An off-chain computing engine can often undertake one or more types of computing tasks to provide support for the computing requirements corresponding to the relevant tasks. For example, in the embodiments of this specification, the off-chain computing engine of the issuer can support the execution of the credential provision task, and the off-chain computing engine of the auditor can support the execution of the credential audit task.

[0036] In the embodiments of this specification, the blockchain network may be a blockchain subnet managed by the blockchain main network, and the node device where the subnet node in the blockchain subnet is located is deployed with the main network node in the blockchain main network. In some blockchain systems, in order to save physical device resources and meet the needs of data isolation in a small range, a new blockchain network is usually created again on the node device where the blockchain network has been deployed. The pre-existing blockchain network is called the blockchain main network, and the blockchain network created subsequently is called the blockchain subnet. The blockchain main network manages the blockchain subnet through the main network contract. Since the blockchain subnet and the blockchain main network are essentially different blockchain networks, the data they maintain are not shared, which is reflected in the isolation of the databases of the subnet nodes in the blockchain subnets deployed on the same node device and the main network nodes in the blockchain main network, and they cannot access each other. It should be noted that the scope of the blockchain subnet cannot exceed the scope of the blockchain main network, which means that the node device where the subnet node is deployed must have the main network node deployed.

[0037] The blockchain network involved in the embodiments of this specification is deployed with a credential issuance contract, which is specifically used to provide trusted services for the creation, review and issuance of digital credentials, and is deployed as a smart contract by each blockchain node in the blockchain network. In the embodiments of this specification, the initiator of the credential issuance transaction is arbitrary, for example, it can be initiated by the issuer or any reviewer, or by other third parties. After the credential issuance transaction is initiated to the blockchain network, it is executed by each blockchain node in the blockchain network through the consensus of the blockchain network. Since the credential issuance transaction is used to call the credential issuance contract, each blockchain node will respond to the credential issuance transaction and call the credential issuance contract deployed by its own node, thereby triggering the start of a credential issuance service.

[0038] In the embodiments of this specification, the credential provision task specifically refers to the credential provision event generated by the credential issuance contract in response to the credential issuance exchange. The credential provision event as a contract event can be monitored and obtained by the node device where each blockchain node in the blockchain network is located, thereby realizing the transparent transmission of information from the chain to the chain of each node device. In order to make it clear that the executor of the credential provision task is the issuer node device where the corresponding issuer node is located, rather than all other node devices that can obtain the credential provision task, the credential provision task usually carries the identification information of the issuer node, so that each node device checks whether the issuer node with the corresponding identification information is deployed locally after obtaining the credential provision task. If the issuer node is found to be deployed locally after the check, it can be determined that the credential provision task should be executed by itself, thereby triggering the next process of calling the locally deployed issuer off-chain computing engine. Specifically, the execution subject of monitoring the credential provision event and calling the issuer off-chain computing engine is the issuer scheduling engine deployed by the issuer node device.

[0039] In the embodiment of this specification, when the issuer's off-chain computing engine is called by the issuer's node device, it will trigger the execution of the credential provision task, obtain the description information corresponding to the credential to be issued held by the issuer selected by the issuer or specified by the credential provision task, carry the description information in the issuer task execution result and feedback to the credential issuance contract. Specifically, the issuer's off-chain computing engine will first return the description information of the credential to be issued to the local issuer scheduling engine, and the issuer scheduling engine will initiate a credential provision transaction (i.e., the issuer task execution result) carrying the description information of the credential to be issued to the credential issuance contract, thereby realizing information feedback from off-chain to on-chain.

[0040] In one embodiment, the blockchain network only includes one issuer node held by one issuer and the issuer is specified by the certificate issuance contract. In this case, the certificate issuance transaction may not carry the relevant identification information of the issuer or the issuer node. The certificate issuance contract can directly read the pre-defined issuer information from the certificate issuance contract under the call trigger of the certificate issuance transaction, and further determine the identification information of the issuer node held by the issuer to carry the identification information of the issuer node in the generated certificate provision task. In another embodiment, the blockchain network includes multiple issuer nodes held by multiple issuers. In this case, it is necessary to ensure that the certificate provision task is ultimately executed by only the issuer node device where one issuer node is located. At this time, the identification information of the target issuer or the target issuer node involved in the execution of the certificate provision task can be carried in the certificate issuance transaction, so that the certificate issuance contract will only carry the identification information of the target issuer node in the certificate provision task generated in response to the certificate issuance transaction, so as to realize the unique participation in the execution of the certificate provision task by specifying the target issuer from multiple issuers through the certificate issuance transaction.

[0041] Similarly, the voucher issuance transaction may also carry the identification information of the target voucher to be issued held by the issuer, so as to specify the description information of the voucher to be issued fed back by the issuer as the description information of the target voucher to be issued. Specifically, the voucher issuance contract carries the identification information of the target voucher to be issued in the voucher provision task generated in response to the voucher issuance transaction. After the issuer node device obtains the voucher provision task, it will instruct the issuer's off-chain computing engine to feed back the description information of the target voucher to be issued corresponding to the identification information held by the issuer in the process of calling the issuer's off-chain computing engine to execute the voucher task.

[0042] S104: Based on the description information of the to-be-issued certificate held by the issuer carried in the execution result of the issuer task, the digital certificate corresponding to the to-be-issued certificate is maintained in the certificate issuance contract, and the certificate audit task is transparently transmitted to the auditor node device where the auditor node corresponding to the auditor is located. The certificate audit task is used to instruct the auditor off-chain computing engine deployed by the auditor node device to feedback the auditor task execution result to the certificate issuance contract.

[0043] The description information of the voucher to be issued involved in this specification may specifically include: the identity information of the issuer, the identity information of other participants (including the reviewer) involved in the voucher to be issued, and the content information of the voucher to be issued (such as the contract transaction information anchored by the voucher to be issued, the issuance amount, etc.). In short, the description information of the voucher to be issued is the necessary information that can be organized and restored into a digital voucher with the same content, validity and function as the original voucher to be issued. After the voucher provision task is fed back to the voucher issuance contract, since the voucher provision task designed in the embodiment of this specification is specifically a voucher provision transaction, that is, the voucher provision task is initiated to the voucher issuance contract in the form of a voucher provision transaction, after the voucher provision transaction completes the consensus, each blockchain node in the blockchain network will obtain the voucher provision transaction and call the local corresponding voucher issuance contract to execute the voucher provision transaction. In response to the call of the voucher provision transaction, the voucher issuance contract extracts the description information of the voucher to be issued carried by it and converts it into a digital voucher to be issued and maintains it in the voucher issuance contract. It should be noted that the digital certificate is stored in the certificate issuance contract in the form of contract status. As a structure containing multiple fields, although some necessary information is filled in through the description information of the certificate to be issued at the beginning of creation, it still has some vacant values ​​or values ​​to be changed, which need to be gradually supplemented and improved in subsequent steps. For example, the digital certificate contains an audit status field, which is used to indicate which auditors have currently audited the digital certificate and the audit results of the auditors who have completed the audit.

[0044] After the credential issuance contract completes the creation of the digital credential, it will enter the audit phase for the digital credential. Specifically, the credential audit task involved in the embodiments of this specification is specifically a credential audit event generated by the credential issuance contract, which is transmitted to each node device by being monitored by each node device. In order to clarify that the executor of the credential audit task is the auditor node device where the corresponding auditor node is located, rather than all other node devices that can obtain the credential audit task, the credential audit task usually carries the identification information of the auditor node, so that after each node device obtains the credential audit task, it checks whether the auditor node with the corresponding identification information is deployed locally. If it is found that the auditor node is deployed locally after the check, it can be determined that the credential audit task should be executed by itself, thereby triggering the next process of calling the locally deployed auditor chain computing engine. Specifically, the executor of monitoring the credential audit event and calling the auditor chain computing engine is the auditor scheduling engine deployed by the auditor node device.

[0045] In the embodiment of this specification, when the audit party off-chain computing engine is called by the audit party node device, it will trigger the execution of the credential audit task, obtain the information of at least part of the digital credential carried by the credential audit task, and audit the information of at least part of the digital credential obtained to obtain the corresponding audit result. The audit result is the audit result generated by the auditor holding the audit party off-chain computing engine (that is, the auditor holding the corresponding audit party node), and the audit result is carried in the audit party task execution result and fed back to the credential issuance contract. Specifically, the audit party off-chain computing engine will first return the audit result generated by the corresponding auditor to the local auditor scheduling engine, and the auditor scheduling engine will initiate a credential provision transaction carrying the audit result generated by the corresponding auditor to the credential issuance contract, thereby realizing information feedback from off-chain to on-chain.

[0046] Optionally, the at least one auditor is statically specified by the certificate issuance contract; and / or, the at least one auditor is dynamically specified by the description information of the certificate to be issued. In one embodiment, the at least one auditor involved in the embodiment of this specification is specifically an auditor participating in the audit of the newly created digital certificate. These auditors can be statically specified by the certificate issuance contract. In this case, the certificate issuance contract predefines the auditor information of the digital certificate, and further determines the identification information of the auditor node held by the auditor to carry the identification information of the auditor node in the generated certificate audit task. In another embodiment, the at least one auditor is dynamically specified by the description information of the certificate to be issued. Since the auditor information is actually carried in the description information of the certificate to be issued provided by the issuer, the auditor of the digital certificate changes dynamically with the different certificates to be issued. In response to the execution result of the issuer's task, the certificate issuance contract will not only create a digital certificate corresponding to the certificate to be issued, but will also carry the identification information of the target auditor node held by the target auditor specified by the issuer in the generated certificate audit contract, so that the issuer dynamically specifies the auditor to participate in the execution of the certificate audit task. In another embodiment, the at least one auditor is jointly specified by the certificate issuance contract and the description information of the certificate to be issued. In this case, at least a part of the auditors of the digital certificate is statically defined in the certificate issuance contract, while the other part is dynamically determined by the description information of the certificate to be issued provided by the issuer.

[0047] S106: Based on the audit result generated by the corresponding auditor carried by the auditor task execution result, the audit status of the digital certificate is updated; wherein, when the audit status is updated to have passed the audit of all auditors, the audit status is used to indicate that the digital certificate is successfully issued.

[0048] In the embodiments of this specification, after each auditor generates the corresponding audit result, it will independently feedback the corresponding auditor task execution result to the credential issuance contract. This corresponds to the fact that the credential issuance contract may receive multiple credential audit transactions initiated by multiple auditor node devices. Each time in response to a credential audit transaction, the credential issuance contract will update the audit status of the digital credential. For example, after receiving the first credential audit transaction initiated by the first auditor node device held by the first auditor (i.e., the first auditor task execution result), the audit status of the digital credential is updated to the first auditor has completed the audit and the corresponding audit result is the first audit result generated by the first auditor carried in the first credential audit transaction.

[0049] In the embodiment of the present specification, when the audit status is updated to have passed the audit of all auditors corresponding to the digital certificate, the audit status is used to indicate that the digital certificate is successfully issued; when the audit status indicates that it has not passed the audit of at least one auditor, the audit status is used to indicate that the digital certificate has failed to be issued. Since the audit status is used to indicate which auditors have currently audited the digital certificate and the audit results of the auditors that have completed the audit, when the audit status indicates that the current digital certificate has completed the audit of all auditors and the audit results generated by all auditors are all audited, it can be determined that the digital certificate has been successfully issued. At this time, the digital certificate maintained in the contract will have the same legal effect as the corresponding certificate to be issued. When the certificate issuance contract determines that the digital certificate is successfully issued, a successful issuance event can also be generated to inform the issuer and the auditor.

[0050] When the audit status indicates that the current digital certificate has been audited by all auditors and not all audit results generated by all auditors are passed, or when the audit status indicates that the current digital certificate has not been audited by all auditors but there are audit results that have failed, it can be determined that the issuance of the digital certificate has failed. At this time, the digital certificate maintained in the contract will have no legal effect. When the certificate issuance contract determines that the issuance of the digital certificate has failed, an issuance failure event can also be generated to inform the issuer and the auditor. The issuer can negotiate with the auditor whose audit result is failed based on the failure reason carried in the issuance failure event to repeat the issuance after resolving the differences and improving the materials.

[0051] Optionally, the transparent transmission of the credential audit task to the auditing party node devices where the auditing party nodes corresponding to the auditing parties are located includes:

[0052] The credential audit task is synchronously and transparently transmitted to the audit party node device where the audit party node corresponding to the at least one audit party is located; or, according to the audit order of the at least one audit party, the credential audit task is asynchronously and transparently transmitted to the audit party node device where the audit party node corresponding to the at least one audit party is located; wherein, the credential audit task is transparently transmitted to the audit party node device where the audit party node corresponding to the audit party with a later audit order is located, which requires that: the credential issuance contract has obtained the audit result generated by the audit party with an earlier audit order.

[0053] In one embodiment, assuming that there are multiple auditors of a digital certificate, the certificate audit task can be synchronously transmitted to the auditor node devices where the auditor nodes corresponding to all auditors are located. This means that the certificate issuance contract will only generate one certificate audit task (i.e., a certificate audit event), and the certificate audit task will also include the identification information of the auditor nodes held by all auditors, so that each auditor node device deployed with an auditor node can execute the certificate audit task simultaneously under the triggering of the same certificate audit task. Of course, although each auditor formally executes the same certificate audit task, different information to be audited will be assigned to different auditors in the certificate audit task. Therefore, at least part of the information about the digital certificate actually audited by different auditors may not be exactly the same.

[0054] In another embodiment, assuming that there are multiple auditors for the digital certificate, the certificate audit task can be asynchronously transparently transmitted to the auditor node device where the auditor node corresponding to each auditor is located according to the audit order of all auditors. The audit order of all auditors is determined by the nature of the digital certificate. In the process of asynchronous transparent transmission, the following rules need to be met: the execution condition for transparently transmitting the certificate audit task to the auditor node device where the auditor node corresponding to the auditor with the later audit order is located is that the certificate issuance contract has obtained the audit result generated by the auditor with the earlier audit order. Assuming that all auditors include the first auditor and the second auditor, a total of two auditors, and the audit order is the first auditor and the second auditor respectively, then when the audit phase of the digital certificate begins, the certificate issuance contract will first generate a first certificate audit task. The first certificate audit task carries the identification information of the first auditor node held by the first auditor, so as to indicate the first auditor node device where the first auditor node is located to trigger the execution of the first certificate audit task, and after the execution is completed, the first auditor task execution result of the first certificate execution task is fed back to the certificate issuance contract. The certificate issuance contract thereby obtains the first audit result generated by the first auditor carried in the first auditor task execution result, and updates the audit status based on the first audit result. After that, according to the aforementioned audit rules, a second credential audit task carrying the identification information of the second audit party node held by the second audit party will be further generated to instruct the second audit party node device where the second audit party node is located to trigger the execution of the second credential audit task, and after the execution is completed, the second audit party task execution result of the second credential execution task will be fed back to the credential issuance contract. The credential issuance contract thereby obtains the second audit result generated by the second audit party carried in the second audit party task execution result, and updates the audit status based on the second audit result. Since this embodiment stipulates the audit order and divides the audit process into multiple stages, each stage is only used to enable the certificate issuance contract to obtain the audit result generated by one auditor, so that the audit process of the digital certificate is more in line with practical specifications, and because the auditor at the front of the audit order cannot provide the audit task execution result, the audit process cannot continue and may trigger a timeout failure judgment (if the certificate issuance contract transmits the certificate audit task and reaches the preset time without feedback on the corresponding audit party task execution result, the audit result of the auditor will be directly defaulted to audit failure), thereby minimizing the consumption of audit resources for each certificate issuance service. At the same time, segmenting the audit process also helps to provide trusted endorsement and process monitoring of the digital certificate audit process through multiple certificate audit transactions and segmented updates of the audit status.

[0055] Optionally, the transparent transmission of the credential audit task to the audit node device where the audit node corresponding to the audit party with a later audit order is located also needs to satisfy that: the audit results generated by the audit party with an earlier audit order are all audit-passed.

[0056] In the asynchronous transparent transmission process involved in the embodiments of this specification, the execution condition for transparently transmitting the credential audit task to the audit node device corresponding to the audit party node of the audit party with a later audit order is that the credential issuance contract has obtained the audit results generated by the audit party with a previous audit order and the audit results generated by the audit party with a previous audit order are all audited. This means that the audit link will continue to execute only when the audit results fed back by the previous audit party are all audited. Otherwise, once a credential discovery contract obtains an approval result generated by a certain approval party that fails the audit, not only will the approval status be updated to not pass the audit of a certain approval party, but the audit link will also be terminated, and the digital credential will be directly determined as a failed issuance. Through the early termination mechanism of the audit link in the embodiments of this specification, the consumption of audit resources for each credential issuance service can be effectively reduced.

[0057] Optionally, the voucher to be issued is an account payable, and the at least one reviewing party includes a platform, a payment supplier and a bank; the review order is, from earliest to latest, the platform review result generated by the platform is generated by the platform reviewing the issuer information and the issuance amount of the digital voucher, the payment supplier review result generated by the payment supplier is generated by the payment supplier reviewing the issuer information, payment supplier information, issuance amount and transaction contract information of the digital voucher (usually referring to the transaction information of the goods or services purchased by the issuer corresponding to the accounts payable from the payment supplier), and the bank review result generated by the bank is generated by the bank reviewing the issuer information of the digital voucher. The embodiments of this specification combine a specific application scenario, namely, the issuance scenario of accounts payable of an enterprise, wherein the platform and the bank are specified by the certificate issuance contract, the payment collection supplier is specified by the description information of the certificate to be issued, the platform holds a platform auditor node in the blockchain network, and the platform auditor node is located on the platform auditor node device deployed on the platform chain computing engine held by the platform, and the platform chain computing engine is used to audit the issuer information and issuance amount of the digital certificate to generate a platform audit result; the payment collection supplier is the equity beneficiary of the accounts payable (accounts payable is the promise of the issuer to the payment collection supplier to deliver the accounts payable specified on the specified date). The bank holds a bank audit node in the blockchain network, and the bank audit node device where the bank audit node is located is equipped with a bank off-chain computing engine held by the payee audit party. The off-chain computing engine of the payee audit party is used to audit the issuer information, payee information, issuance amount and transaction contract information of the digital certificate to generate the payee audit result; the bank holds a bank audit node in the blockchain network, and the bank audit node device where the bank audit node is located is equipped with a bank off-chain computing engine held by the bank. The bank off-chain computing engine is used to audit the issuer information and generate the bank audit result. These auditors audit the information of various aspects of the digital certificate corresponding to the accounts payable from different angles and return the audit results, thereby supporting the effective issuance of digital certificates for accounts payable based on blockchain.

[0058] In the embodiments of this specification, on the one hand, the certificate issuance contract deployed through the blockchain network maintains the digital certificate corresponding to the certificate to be issued held by the issuer, and updates the audit status of the digital certificate according to the audit result provided by the auditor, so that the entire process of the digital certificate from creation, audit to successful issuance is open and transparent, that is, the issuance process of the digital certificate is ensured to be credible; on the other hand, since the certificate issuance contract only serves as a task dispatching function, and the certificate provision task and certificate audit task, which involve the internal data of the issuer or auditor, are actually handed over to the off-chain computing engine for execution, the data used in the execution process will not be shared on the blockchain, thereby ensuring the privacy security of the issuer and the auditor.

[0059] Optionally, the issuer's off-chain computing engine is used to interact with the issuer system and / or other external systems corresponding to the issuer when called; the auditor's off-chain computing engine deployed on the auditor's node device where the auditor's node corresponding to any auditor is located is used to interact with the first auditor's system and / or the other external systems corresponding to any auditor when called. In the embodiments of this specification, each off-chain computing engine can interact with the corresponding holder system or other external system when executing a task, so that the logic and functions involving privacy data can be further migrated to the corresponding holder system, and the off-chain computing engine only assumes the function of sending task requests to the holder system and receiving task results returned by the holder system, so that the issuer and the auditor do not need to migrate any business logic but only need to provide description information of the certificate to be issued or the corresponding audit results, thereby further avoiding the leakage of privacy data.

[0060] Optionally, the issuer task execution result also carries the issuer digital signature corresponding to the description information of the to-be-issued credential, and the audit task execution result fed back by the audit off-chain computing engine deployed on the audit node device where the audit node corresponding to any audit party is located carries the audit digital signature corresponding to the audit result generated by any audit party; the method further includes: determining that the description information to be issued is valid when the issuer digital signature is successfully verified by the issuer public key corresponding to the issuer; and determining that the audit result generated by any audit party is valid when the audit digital signature corresponding to the audit result generated by any audit party is successfully verified by the audit public key corresponding to any audit party. In the embodiment of this specification, the description information of the to-be-issued credential fed back by the issuer to the credential issuance contract and the audit result fed back by the audit direction to the issuance contract both need to be signed and bound, so that the credential issuance contract can confirm the legitimacy (indeed from the legitimate issuer or audit party) and integrity (the feedback information has not been tampered with) of various feedback information by means of signature verification, thereby ensuring the security and reliability of the issuance process of digital credential.

[0061] Furthermore, it also includes: recording the digital signature of the issuer and / or the digital signature of the auditor corresponding to the audit result generated by any auditor in the digital certificate. In the embodiments of this specification, the digital signature of the issuer provided by the issuer and / or the digital signature of the auditor provided by the auditor will also be maintained in the digital certificate, so that after the digital certificate is successfully issued, other third parties can use these digital signatures to conduct a secondary audit of the legality of the digital certificate issuance process. In addition, the digital certificate will also maintain the time information corresponding to the description information of the certificate to be issued fed back by the issuer and the time information corresponding to the audit result fed back by the auditor. These time information will also help each auditor or other third party to conduct a compliance audit on the digital certificate.

[0062] Figure 2 This is an architecture diagram of a blockchain-based digital certificate issuance system provided by an exemplary embodiment, the digital certificate issuance system includes: an issuer node device, a platform reviewer node device, a payment supplier reviewer node device and a bank reviewer node device, each node device is respectively deployed with a blockchain node belonging to the same blockchain network and a corresponding off-chain computing engine, and the blockchain network is deployed with a certificate issuance contract 201;

[0063] The issuer node device 202 is deployed with an issuer node, an issuer scheduling engine and an issuer off-chain computing engine, and is used to call the locally deployed issuer off-chain computing engine to return the description information of the accounts payable held by the issuer to the credential issuance contract based on the credential provision task when obtaining the credential provision task transmitted by the credential issuance contract in response to the credential issuance transaction. The description information is used to instruct the credential issuance contract to maintain the digital credential corresponding to the accounts payable and update the review status of the digital credential to submitted;

[0064] The platform auditor node device 203 is deployed with a platform auditor node, a platform scheduling engine and a platform off-chain computing engine, and is used to call the locally deployed platform off-chain computing engine to return a platform audit result to the credential issuance contract based on the platform credential audit task when the platform credential issuance contract transmits the platform credential audit task when the audit status is submitted. The platform audit result is used to instruct the credential issuance contract to update the audit status;

[0065] The payment collection supplier reviewer node device 204 is deployed with a payment collection supplier reviewer node, a payment collection supplier scheduling engine and a payment collection supplier off-chain computing engine, and is used to call the locally deployed payment collection supplier off-chain computing engine to return the payment collection supplier review result to the voucher issuance contract based on the payment collection supplier voucher review task when the voucher issuance contract obtains the payment collection supplier voucher review task transmitted when the review status indicates that the platform review has been passed. The payment collection supplier review result is used to instruct the voucher issuance contract to update the review status;

[0066] The bank auditor node device 205 is deployed with a bank auditor node, a bank scheduling engine and a bank off-chain computing engine, and is used to call the locally deployed bank off-chain computing engine to return the bank audit result to the voucher issuance contract based on the bank voucher audit task when the bank voucher issuance contract obtains the bank voucher audit task transmitted when the audit status indicates that it has passed the review of the payment supplier. The bank audit result is used to instruct the voucher issuance contract to update the audit status; wherein, when the audit status is updated to have passed the bank audit, the audit status is used to indicate that the digital voucher is successfully issued.

[0067] Figure 3 This is an application scenario diagram of a blockchain-based digital certificate issuance system provided by an exemplary embodiment. Figure 3 is Figure 2 Based on the digital certificate issuance system shown in the figure, the architecture of the blockchain main network and the blockchain subnet, as well as the application scenarios of the communication connection architecture between the off-chain computing engine and each external engine are added. Figure 3As shown, nodeA, nodeB, nodeC, nodeD and nodeE together constitute the blockchain main network, and the blockchain subnet formed by the blockchain main network includes nodeA1 (issuer node), nodeB1 (platform auditor node), nodeCl (payee supplier auditor node) and nodeD1 (bank auditor node). The blockchain subnet is deployed with a certificate issuance contract, among which nodeA, nodeA1 and the issuer's off-chain computing engine are deployed in the same issuer node device, nodeB, nodeB1 and the platform's off-chain computing engine are deployed in the same platform's auditor node device, nodeC, nodeC1 and the payment supplier's off-chain computing engine are deployed in the same payment supplier auditor node device, and nodeD, nodeD1 and the bank's off-chain computing engine are deployed in the same bank auditor node device. At the same time, a network connection is established between the issuer's off-chain computing engine and the issuer's system, such as an HTTP (Hyper Text Transfer Protocol) connection, a network connection is established between the platform's off-chain computing engine and the platform system, a network connection is established between the payment supplier's off-chain computing engine and the payment supplier's system, and a network connection is established between the bank's off-chain computing engine and the bank system.

[0068] Figure 4 This is an interactive flow chart of a blockchain-based digital certificate issuance solution provided by an exemplary embodiment. Figure 3 Taking the issuer's issuance of accounts payable as an example, this specification describes in detail the scheme for issuing digital certificates based on blockchain. Figure 4 The blockchain-based digital certificate issuance scheme involved in this specification can be implemented based on the cooperation between the certificate issuance contract, the issuer node device, the platform reviewer node device, the payment supplier reviewer node device and the bank reviewer node device. The method may include the following steps:

[0069] S401: The issuer system calls the issuer's off-chain computing engine deployed by the issuer's node device to instruct the issuer's off-chain computing engine to initiate a certificate issuance transaction through the issuer's node to the certificate issuance contract deployed in the blockchain subnet.

[0070] S402: The credential issuance contract generates a credential provision event carrying identification information of the issuer node in response to the credential issuance transaction.

[0071] S403: The issuer's node device monitors the credential provision event, and when it determines that it has deployed a blockchain node corresponding to the identification information of the issuer's node, it calls the issuer's off-chain computing engine to execute the credential provision task corresponding to the credential provision event. The issuer's off-chain computing engine requests the issuer system to obtain the description information of the target accounts payable indicated by the credential provision task.

[0072] S404: After obtaining the description information of the target accounts payable, the issuer node device initiates a voucher provision transaction carrying the description information of the target accounts payable to the voucher issuance contract.

[0073] S405: The voucher issuance contract responds to the voucher provision transaction, maintains the digital voucher corresponding to the target accounts payable in the voucher issuance contract according to the description information of the target accounts payable, and updates the review status of the digital voucher to submitted, and at the same time generates a platform voucher review event carrying the identification information of the platform reviewer node and the issuer information of the digital voucher and the issued amount.

[0074] S406: The platform auditor node device monitors the platform credential audit event, and when it determines that it has deployed a blockchain node corresponding to the identification information of the platform auditor node, it calls the platform chain computing engine to execute the platform credential audit task corresponding to the platform credential audit event. The platform chain computing engine transfers the platform credential audit task to the platform system and requests the platform system to obtain the platform audit result corresponding to the platform credential audit task. The platform audit result is generated by the platform system through the audit of the issuer information and issuance amount of the digital credential.

[0075] S407: After the platform auditor node device obtains the platform audit result, it initiates a platform credential audit transaction carrying the platform audit result to the credential issuance contract.

[0076] S408: The voucher issuance contract responds to the platform voucher review transaction. When the current review status is submitted and the platform review result is passed, the review status of the digital voucher is updated to passed the platform review. At the same time, a payment supplier voucher review event is generated, which carries the identification information of the payment supplier reviewer node and the issuer information of the digital voucher, the payment supplier information, the issuance amount and the transaction contract information.

[0077] S409: The node device of the payee supplier auditor monitors the payee supplier credential audit event, and when it determines that it has deployed a blockchain node corresponding to the identification information of the payee supplier auditor node, calls the payee supplier chain computing engine to execute the payee supplier credential audit task corresponding to the payee supplier credential audit event. The payee supplier chain computing engine transfers the payee supplier audit task to the payee supplier system and requests the payee supplier system to obtain the payee supplier audit result corresponding to the payee supplier credential audit task. The payee supplier audit result is generated by the payee supplier system through the audit of the issuer information, payee supplier information, issuance amount and transaction contract information of the digital credential.

[0078] S410: After obtaining the payment receiving supplier's review result, the node device of the payment receiving supplier review party initiates a payment receiving supplier voucher review transaction carrying the payment receiving supplier's review result to the voucher issuing contract.

[0079] S411: The voucher issuance contract responds to the voucher review transaction of the payment supplier. When the current review status is passed by the platform review and the payment supplier review result is passed, the review status of the digital voucher is updated to passed by the payment supplier review, and a bank voucher review event is generated that carries the identification information of the bank reviewer node and the issuer information of the digital voucher.

[0080] S412: The bank auditor node device monitors the bank credential audit event, and when it determines that it has deployed a blockchain node corresponding to the identification information of the bank auditor node, it calls the bank chain computing engine to execute the bank credential audit task corresponding to the bank credential audit event. The bank chain computing engine transfers the bank audit task to the bank system and requests the bank system to obtain the bank audit result corresponding to the bank credential audit task. The bank audit result is generated by the bank system for the issuer information of the digital credential.

[0081] S413: After the bank reviewer node device obtains the bank review result, it initiates a bank voucher review transaction carrying the bank review result to the voucher issuance contract.

[0082] S414: The voucher issuance contract responds to the bank voucher review transaction. When the current review status is that the payment supplier has passed the review and the bank's review result is that the review has passed, the review status of the digital voucher is updated to have passed the bank's review. Since the digital voucher has passed the review of all review parties including the platform, the payment supplier and the bank, the voucher issuance contract can determine that the digital voucher has been issued successfully and generate a successful issuance event.

[0083] Figure 5 is a schematic structural diagram of a device provided by an exemplary embodiment. Figure 5 At the hardware level, the device includes a processor 502, an internal bus 505, a network interface 506, a memory 508, and a non-volatile memory 510, and may also include hardware required for other functions. One or more embodiments of this specification may be implemented based on software, such as the processor 502 reading the corresponding computer program from the non-volatile memory 510 into the memory 508 and then running it. Of course, in addition to the software implementation, one or more embodiments of this specification do not exclude other implementations, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0084] like Figure 6 As shown, Figure 6 This is a block diagram of a digital certificate issuing device based on blockchain provided in accordance with an exemplary embodiment of the present specification. The device can be applied to Figure 5 In the device shown in the figure, the technical solution of this specification is implemented; the device is applied to a blockchain node in a blockchain network, the blockchain network includes blockchain nodes corresponding to the issuer and at least one auditor, and the node devices where the blockchain nodes corresponding to each party are located are also deployed with corresponding off-chain computing engines; the device includes:

[0085] The credential issuance transaction response unit 601 is used to respond to the credential issuance transaction that calls the credential issuance contract, and transparently transmit the credential provision task to the issuer node device where the issuer node corresponding to the issuer is located, and the credential provision task is used to instruct the issuer off-chain computing engine deployed by the issuer node device to feedback the issuer task execution result to the credential issuance contract;

[0086] The digital certificate maintenance unit 602 is used to maintain the digital certificate corresponding to the to-be-issued certificate in the certificate issuance contract based on the description information of the to-be-issued certificate held by the issuer carried in the execution result of the issuer task, and transparently transmit the certificate audit task to the audit party node device where the audit party node corresponding to the audit party is located, and the certificate audit task is used to instruct the audit party off-chain computing engine deployed by the audit party node device to feedback the audit party task execution result to the certificate issuance contract;

[0087] The audit status updating unit 603 is used to update the audit status of the digital certificate based on the audit result generated by the corresponding auditor carried by the auditor's task execution result; wherein, when the audit status is updated to have passed the audit of all auditors, the audit status is used to indicate that the digital certificate is successfully issued.

[0088] Optionally, the digital certificate maintenance unit 602 is specifically used for:

[0089] Synchronously and transparently transmitting the credential audit task to the audit node device where the audit node corresponding to the at least one audit party is located; or,

[0090] According to the audit order of the at least one auditor, the credential audit task is asynchronously transmitted to the auditor node device where the auditor node corresponding to the at least one auditor is located; wherein, the transparent transmission of the credential audit task to the auditor node device where the auditor node corresponding to the auditor with a later audit order is located needs to meet the following requirements: the credential issuance contract has obtained the audit result generated by the auditor with an earlier audit order.

[0091] Optionally, the voucher to be issued is an account payable, and the at least one reviewing party includes a platform, a payment supplier and a bank; the review order is, from earliest to latest, the platform review result generated by the platform is generated by the platform reviewing the issuer information and the issuance amount of the digital voucher, the payment supplier review result generated by the payment supplier is generated by the payment supplier reviewing the issuer information, payment supplier information, issuance amount and transaction contract information of the digital voucher, and the bank review result generated by the bank is generated by the bank reviewing the issuer information of the digital voucher.

[0092] Optionally, the transparent transmission of the credential audit task to the audit node device where the audit node corresponding to the audit party with a later audit order is located also needs to meet the following requirements:

[0093] The audit results generated by the auditors who come first in the audit order are all passed.

[0094] Optionally, the at least one auditor is statically specified by the certificate issuance contract; and / or,

[0095] The at least one auditor is dynamically specified by the description information of the credential to be issued.

[0096] Optionally, the issuer off-chain computing engine is used to interact with the issuer system and / or other external systems corresponding to the issuer when called;

[0097] The auditor's off-chain computing engine deployed on the auditor's node device where the auditor's node corresponding to any auditor is located is used to interact with the first auditor's system corresponding to any auditor and / or the other external systems when called.

[0098] Optionally, also include:

[0099] The issuance failure determination unit 604 is configured to, when the audit status indicates that the digital certificate has not been audited by at least one auditing party, use the audit status to indicate that the issuance of the digital certificate has failed.

[0100] Optionally, the issuer task execution result also carries the issuer digital signature corresponding to the description information of the to-be-issued credential, and the auditor task execution result fed back by the auditor off-chain computing engine deployed on the auditor node device where the auditor node corresponding to any auditor is located carries the auditor digital signature corresponding to the audit result generated by any auditor; the method further comprises:

[0101] The first signature verification unit 605 is used to determine that the description information to be issued is valid when the digital signature of the issuer is successfully verified by the issuer public key corresponding to the issuer;

[0102] The second signature verification unit 606 is used to determine that the audit result generated by any audit party is valid when the audit party digital signature corresponding to the audit result generated by any audit party is successfully verified through the audit party public key corresponding to any audit party.

[0103] Optionally, also include:

[0104] The signature recording unit 607 is used to record the digital signature of the issuer and / or the digital signature of the auditor corresponding to the audit result generated by any auditor in the digital certificate.

[0105] Optionally, the blockchain network is a blockchain subnet managed by a blockchain main network, and the main network nodes in the blockchain main network are deployed on the node devices where the subnet nodes in the blockchain subnet are located.

[0106] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0107] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0108] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, the present invention does not exclude that with the development of computer technology in the future, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, a vehicle-mounted human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0109] Although one or more embodiments of the present specification provide method operation steps as described in the embodiments or flow charts, more or less operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps, and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such a process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any specific order.

[0110] For the convenience of description, the above devices are described in various modules according to their functions. Of course, when implementing one or more of the present specification, the functions of each module can be implemented in the same or more software and / or hardware, or the module implementing the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0111] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0112] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0113] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0114] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0115] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0116] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0117] It should be understood by those skilled in the art that one or more embodiments of the present specification may be provided as a method, system or computer program product. Therefore, one or more embodiments of the present specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, one or more embodiments of the present specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0118] One or more embodiments of this specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of this specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0119] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. In the description of this specification, the description of the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples without contradiction.

[0120] The above description is only an example of one or more embodiments of this specification and is not intended to limit one or more embodiments of this specification. For those skilled in the art, one or more embodiments of this specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this specification shall be included in the scope of the claims.

Claims

1. A digital certificate issuance system based on blockchain, comprising: The node device of the issuer, the node device of the platform auditor, the node device of the payment collection supplier auditor and the node device of the bank auditor are respectively deployed with a blockchain node belonging to the same blockchain network and a corresponding off-chain computing engine, and the blockchain network is deployed with a voucher issuance contract; The issuer node device is used to, upon obtaining the credential provision task transparently transmitted by the credential issuance contract in response to the credential issuance transaction, call the locally deployed issuer off-chain computing engine to return the description information of the accounts payable held by the issuer to the credential issuance contract based on the credential provision task, wherein the description information is used to instruct the credential issuance contract to maintain the digital credential corresponding to the accounts payable and update the review status of the digital credential to submitted; The platform auditor node device is used to, when obtaining the platform credential audit task transparently transmitted by the credential issuance contract when the audit status is submitted, call the locally deployed platform off-chain computing engine to return the platform audit result to the credential issuance contract based on the platform credential audit task, and the platform audit result is used to instruct the credential issuance contract to update the audit status; The node device of the payment receiving supplier reviewer is used to call the locally deployed payment receiving supplier chain computing engine to return the payment receiving supplier review result to the voucher issuing contract based on the payment receiving supplier voucher review task when the voucher issuing contract obtains the payment receiving supplier voucher review task transmitted by the voucher issuing contract when the review status indicates that the platform has passed the review, and the payment receiving supplier review result is used to instruct the voucher issuing contract to update the review status; The bank reviewer node device is used to call the locally deployed bank chain computing engine to return the bank review result to the certificate issuance contract based on the bank certificate review task when the bank certificate issuance contract obtains the bank certificate review task transmitted when the review status indicates that it has passed the review of the payment supplier. The bank review result is used to instruct the certificate issuance contract to update the review status; wherein, when the review status is updated to have passed the bank review, the review status is used to indicate that the digital certificate has been successfully issued.

2. A method for issuing digital certificates based on blockchain, applied to blockchain nodes in a blockchain network, wherein the blockchain network includes blockchain nodes corresponding to the issuer and at least one auditor, and the node devices where the blockchain nodes corresponding to each party are located are also deployed with corresponding off-chain computing engines; the method comprises: In response to the credential issuance transaction that calls the credential issuance contract, the credential provision task is transparently transmitted to the issuer node device where the issuer node corresponding to the issuer is located, and the credential provision task is used to instruct the issuer off-chain computing engine deployed by the issuer node device to feedback the issuer task execution result to the credential issuance contract; Based on the description information of the to-be-issued voucher held by the issuer carried in the execution result of the issuer task, the digital voucher corresponding to the to-be-issued voucher is maintained in the voucher issuance contract, and the voucher audit task is transparently transmitted to the audit party node device where the audit party node corresponding to the audit party is located, and the voucher audit task is used to instruct the audit party off-chain computing engine deployed by the audit party node device to feedback the audit party task execution result to the voucher issuance contract; Based on the audit result generated by the corresponding auditor carried in the auditing party task execution result, updating the audit status of the digital certificate; wherein, when the audit status is updated to have passed the audit of all auditors, the audit status is used to indicate that the digital certificate is successfully issued; The transparent transmission of the credential audit task to the audit node device where the audit node corresponding to the audit party is located includes: according to the audit order of the at least one audit party, the credential audit task is asynchronously transparently transmitted to the audit node device where the audit node corresponding to the at least one audit party is located; wherein, the transparent transmission of the credential audit task to the audit node device where the audit node corresponding to the audit party with a later audit order is located needs to meet the following conditions: the credential issuance contract has obtained the audit result generated by the audit party with a previous audit order; Among them, the voucher to be issued is an account payable, and the at least one reviewing party includes a platform, a payment supplier and a bank; the review order is, from first to last, the platform, the payment supplier and the bank respectively; the platform review result generated by the platform is generated by the platform reviewing the issuer information and the issuance amount of the digital voucher, the payment supplier review result generated by the payment supplier is generated by the payment supplier reviewing the issuer information, payment supplier information, issuance amount and transaction contract information of the digital voucher, and the bank review result generated by the bank is generated by the bank reviewing the issuer information of the digital voucher.

3. According to the method of claim 2, the transparent transmission of the credential audit task to the audit node device where the audit node corresponding to the audit party with a later audit order is located also needs to meet the following requirements: The audit results generated by the auditors who come first in the audit order are all passed.

4. The method according to claim 2, wherein the at least one auditor is statically specified by the credential issuance contract; and / or, The at least one auditor is dynamically specified by the description information of the credential to be issued.

5. According to the method of claim 2, the issuer off-chain computing engine is used to interact with the issuer system and / or other external systems corresponding to the issuer when called; The auditor's off-chain computing engine deployed on the auditor's node device where the auditor's node corresponding to any auditor is located is used to interact with the first auditor's system corresponding to any auditor and / or the other external systems when called.

6. The method according to claim 2, further comprising: In the case where the audit status indicates that the digital certificate has not passed the audit by at least one auditor, the audit status is used to indicate that the issuance of the digital certificate has failed.

7. According to the method of claim 2, the issuer task execution result also carries the issuer digital signature corresponding to the description information of the to-be-issued credential, and the auditor task execution result fed back by the auditor off-chain computing engine deployed on the auditor node device where the auditor node corresponding to any auditor is located carries the auditor digital signature corresponding to the audit result generated by any auditor; the method further comprises: In the case where the digital signature of the issuer is successfully verified by the issuer public key corresponding to the issuer, determining that the description information to be issued is valid; In the event that the auditor's digital signature corresponding to the audit result generated by any auditor is successfully verified through the auditor's public key corresponding to any auditor, it is determined that the audit result generated by any auditor is valid.

8. The method according to claim 7, further comprising: The digital signature of the issuer and / or the digital signature of the auditor corresponding to the audit result generated by any auditor is recorded in the digital certificate.

9. According to the method described in claim 2, the blockchain network is a blockchain subnet managed by a blockchain main network, and the main network node in the blockchain main network is deployed on the node device where the subnet node in the blockchain subnet is located.

10. A digital certificate issuance device based on blockchain, applied to a blockchain node in a blockchain network, wherein the blockchain network includes blockchain nodes corresponding to an issuer and at least one reviewer, and the node devices where the blockchain nodes corresponding to each party are located are also deployed with corresponding off-chain computing engines; the device comprises: A credential issuance transaction response unit, configured to respond to a credential issuance transaction that calls a credential issuance contract, transparently transmit a credential provision task to an issuer node device where an issuer node corresponding to the issuer is located, wherein the credential provision task is used to instruct an issuer off-chain computing engine deployed by the issuer node device to feed back an issuer task execution result to the credential issuance contract; A digital certificate maintenance unit, for maintaining the digital certificate corresponding to the certificate to be issued in the certificate issuance contract based on the description information of the certificate to be issued held by the issuer carried in the result of the issuer task execution, and transparently transmitting the certificate audit task to the audit party node device where the audit party node corresponding to the audit party is located, and the certificate audit task is used to instruct the audit party off-chain computing engine deployed by the audit party node device to feedback the audit party task execution result to the certificate issuance contract; The transparent transmission of the voucher audit task to the audit node device where the audit node corresponding to the audit party is located includes: according to the audit order of the at least one audit party, asynchronously transparently transmitting the voucher audit task to the audit node device where the audit node corresponding to the at least one audit party is located; wherein, the transparent transmission of the voucher audit task to the audit node device where the audit node corresponding to the audit party with a later audit order is located needs to meet the following conditions: the voucher issuance contract has obtained the audit result generated by the audit party with a previous audit order; wherein, the voucher to be issued is an account payable, and the at least one audit party includes a platform, a payment collection supplier and a bank; the audit order from earliest to latest is the platform, the payment collection supplier and the bank; the platform audit result generated by the platform is generated by the platform auditing the issuer information and the issuance amount of the digital voucher, the payment collection supplier audit result generated by the payment collection supplier is generated by the payment collection supplier auditing the issuer information, payment collection supplier information, the issuance amount and the transaction contract information of the digital voucher, and the bank audit result generated by the bank is generated by the bank auditing the issuer information of the digital voucher; An audit status updating unit is used to update the audit status of the digital certificate based on the audit result generated by the corresponding auditor carried by the auditor's task execution result; wherein, when the audit status is updated to have passed the audit of all auditors, the audit status is used to indicate that the digital certificate is successfully issued.

11. An electronic device, comprising: processor; a memory for storing processor-executable instructions; The processor implements the method according to any one of claims 2 to 9 by running the executable instructions.

12. A computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the steps of the method according to any one of claims 2 to 9.

Images