A digital certificate system based on blockchain and its processing method

Abstract

The present invention discloses a digital certificate system based on blockchain and a processing method thereof. The method comprises the following steps: a user collects front-end data and sends the front-end data; processes the sent front-end data and feeds back the processed data; manages and controls the processed data and stores the data; queries the data under management and deletes duplicate data; the present invention puts a certificate member set into a dynamic accumulator to prove whether the certificate exists on the blockchain, and the query time does not increase linearly with the increase of the blockchain length, thereby improving the execution efficiency of the system; regards the node as a blockchain node, reduces the risk of distributed denial of service attacks, and improves the overall security of the system.

Description

Technical Field

[0001] The present invention relates to the field of digital certificates, and in particular to a blockchain-based digital certificate system and a processing method thereof. Background Art

[0002] Blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, and encryption algorithm. Blockchain is essentially a decentralized database, a string of data blocks generated using cryptography. Each data block is linked through random hashing, and the latter block contains the hash value of the previous block.

[0003] However, the traditional digital certificate system has a single point of failure, is vulnerable to distributed denial of service attacks, has a long certificate trust path, has difficulty in mutual trust between different certificate issuing agencies, and has problems such as data abuse and data leakage. Summary of the invention

[0004] Based on this, it is necessary to provide a blockchain-based digital certificate system and its processing method to address the above technical problems.

[0005] The technical solution of the present invention is as follows:

[0006] A method for processing digital certificates based on blockchain, comprising:

[0007] Step 1: The user collects the front-end data and sends it;

[0008] Step 2: Process the sent front-end data and provide data feedback for the processed data;

[0009] Step 3: Manage and control the processed data and store the data;

[0010] Step 4: Query the data under control and delete duplicate data.

[0011] In a further embodiment, the step 1 is further performed by the user sending data to the digital certificate subsystem and the privacy protection subsystem through the front end; the digital certificate subsystem associates and binds the user's identity data and public key to form a user identity credential;

[0012] The user includes registration, identity verification, login and digital certificate management. The user queries the digital certificate through the specified name, obtains the encrypted identity authentication information of the user through the node, decrypts and checks the user's private key, verifies the user's identity, and issues the user's digital certificate to the blockchain;

[0013] The registration is performed by entering a username and password to register an account. First, the user fills in the registration form and sends the username and password to the background. The background calls the username on the blockchain and judges the registered username. If the user account exists, it prompts that the username has been registered. If the user account does not exist, the username and password are encrypted, shared and stored; and the user account is registered according to the contract layer, and the user's successfully registered account name and password interface is returned to prompt the user that the registration is successful.

[0014] In a further embodiment, the step 2 further processes the request initiated in the digital certificate subsystem and feeds it back to the privacy protection subsystem, while storing and querying the certificate;

[0015] The digital certificate management system enables users to view issued certificates and download certificates after logging in. The certificate information includes certificate version, certificate validity period, certificate signature value, cumulative value and signature algorithm.

[0016] The digital certificate subsystem can view the certificates on the blockchain and revoke the certificates issued to the users.

[0017] In a further embodiment, step three further implements a smart contract for the user's digital certificate lifecycle management, and performs data storage and certificate query and verification in real time.

[0018] In a further embodiment, the step 4 further includes storing the identity information submitted by the user and the digital certificate file.

[0019] In a further embodiment, after the registration is successful, the user logs in with the username and password. The user fills in the corresponding username and password information on the login interface. After the background obtains the user's login request, it queries the user's corresponding encryption key through the contract layer to see if it is consistent, and then compares the password and encryption value entered by the user with the data in the blockchain. If they are consistent, the login is successful. If they are inconsistent, the user login fails. After successful login, different function interfaces are displayed according to different account types. For example, ordinary users only have the authority to apply for and view certificates.

[0020] In a further embodiment, the privacy protection subsystem first allows the user to obtain the public key certificate of the information node to be reviewed, and then encrypts the user's identity information using the user's public key, and then generates a re-encryption key by combining the private key and the public key of the recipient's review node, and stores the encrypted key. The storage address is then filled in the identity review table, and the form information is transmitted to the node for review. The node review judges the form information. If it is rejected, an error message is prompted and the identity information is uploaded again. If it passes, the identity information is prompted to be compliant, and then it is tested through the review operation. If it is rejected, the reason for the failure of the review is returned, and the identity information is uploaded again. If it passes, a blockchain certificate is issued, and the certificate acquisition information is packaged and saved.

[0021] In a further embodiment, the registration of the certificate is performed by submitting identity information, the node reviews and approves it, issues the certificate to the user, uploads and saves it, writes the address of the certificate to the blockchain, and finally returns the address of the user to which the certificate is issued;

[0022] The revocation of the certificate, when it is detected that the certificate has expired or has been abused, the certificate is removed. By passing in the user name and the certificate number of the certificate to be revoked, the remove digital certificate function is called to revoke the certificate. At the same time, the member set of the current certificate is removed from the dynamic accumulator and rewritten to the blockchain through the consensus algorithm;

[0023] The verification of the certificate, when the user needs to verify the validity of the certificate, the certificate number and certificate file are used to query the certificate through the certificate query interface, and the queried certificate data is compared with the certificate file provided by the user. If the comparison is the same, the verification is successful, if the comparison is different, the verification fails.

[0024] A digital certificate system based on blockchain, comprising:

[0025] The application layer collects front-end data through users and sends the front-end data to the interface layer;

[0026] Interface layer, which transmits data in the interface layer through request initiation and request response interfaces;

[0027] The business layer processes the data of the request initiation interface and provides data feedback through the request response interface;

[0028] The contract layer controls the data in the business layer and stores the data in transit;

[0029] The data layer queries the data under management and deletes duplicate data.

[0030] In a further embodiment, the application layer includes a digital certificate subsystem and a privacy protection subsystem, wherein the digital certificate subsystem is responsible for the user's certificate application and certificate management; the privacy protection subsystem is responsible for the protection of the user's application; the user sends data to the digital certificate subsystem through the front end, and interacts with the back end through the hypertext transfer protocol;

[0031] The business layer includes user certificate application, certificate storage, log management, blockchain data browsing, user data management, and certificate lifecycle management;

[0032] The contract layer includes registering contracts, querying contracts, modifying contracts and revoking contracts;

[0033] The data layer includes a user identity information storage unit and a digital certificate file storage unit;

[0034] The certificate management includes an audit registration center, a certificate authority center, a timestamp service center and cryptographic middleware; the audit registration center enters and audits information of users applying for certificates; the certificate authority center issues and manages certificates; and the timestamp service center records the time point of certificate issuance.

[0035] Beneficial effects: The present invention designs a digital certificate system based on blockchain and a processing method thereof. By applying blockchain technology to a public key infrastructure and utilizing distributed storage and user data encryption methods, a decentralized, distributed trust digital certificate system with privacy protection is implemented based on blockchain and using smart contracts; the security of the system is improved, and the user's information data and certificate data are protected; when a user applies for a blockchain certificate, it is necessary to provide valid identity information to the corresponding certificate issuing agency service provider for review, and the storage pressure of the blockchain is reduced by storing the user's proxy re-encrypted data in the interplanetary file system, thereby reducing the storage pressure of the blockchain, and users can share identity information, avoiding the need to provide identity information every time a certificate is applied for. In addition, through proxy re-encryption, users can also ensure the reliability of the recipient of the data to be transmitted, avoiding security issues caused by leakage of transmitted data;

[0036] By putting the certificate member set into a dynamic accumulator to prove whether the certificate exists on the blockchain, the query time will not increase linearly with the increase of the blockchain length, which improves the execution efficiency of the system; treating the node as a blockchain node reduces the risk of distributed denial of service attacks and improves the overall security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 It is a schematic diagram of the process structure of the present invention.

[0038] Figure 2It is a schematic diagram of the system structure of the present invention.

[0039] Figure 3 This is a schematic diagram of digital certificate management of the present invention.

[0040] Figure 4 A user registration flow chart for the invention. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0042] like Figure 1-Figure 4 As shown, a method for processing a digital certificate based on blockchain includes:

[0043] The user collects the front-end data and sends the front-end data;

[0044] The user sends data to the digital certificate subsystem and the privacy protection subsystem through the front end; the digital certificate subsystem associates and binds the user's identity data and public key to form the user's identity credential;

[0045] Users include registration, identity verification, login and digital certificate management. Users query digital certificates by specified names, obtain encrypted identity authentication information through nodes, decrypt and view it through the user's private key, verify the user's identity, and issue the user's digital certificate to the blockchain;

[0046] Registration is performed by entering a username and password. First, the user fills out the registration form and sends the username and password to the background. The background calls the username on the blockchain and judges the registered username. If the user account exists, it will prompt that the username has been registered. If the user account does not exist, the username and password will be encrypted, shared and stored. The user account is registered according to the contract layer, and the user's successfully registered account name and password interface is returned to prompt the user that the registration is successful.

[0047] Process the sent front-end data and provide data feedback for the processed data;

[0048] Process the requests initiated in the digital certificate subsystem and feed them back to the privacy protection subsystem, while storing and querying the certificates;

[0049] Digital certificate management allows users to view issued certificates and download certificates after logging in. Certificate information includes certificate version, certificate validity period, certificate signature value, cumulative value and signature algorithm.

[0050] The digital certificate subsystem can view certificates on the blockchain and revoke certificates issued to users.

[0051] In the privacy protection subsystem, the user first obtains the public key certificate of the information node to be reviewed, and then encrypts the user's identity information with the user's public key, and then generates a re-encryption key by combining the private key and the public key of the receiving party's review node, and stores the encrypted key. The storage address is then filled in the identity review table, and the form information is transmitted to the node for review. The node review judges the form information. If it is rejected, an error message is prompted and the identity information is uploaded again. If it passes, the identity information is prompted to be compliant, and then it is tested through the review operation. If it is rejected, the reason for the failure of the review is returned, and the identity information is uploaded again. If it passes, a blockchain certificate is issued, and the information obtained by the certificate is packaged and saved.

[0052] Manage and control the processed data and store the data;

[0053] Implement smart contracts to manage the user's digital certificate lifecycle, store data and query and verify certificates in real time.

[0054] Query the data under control and delete duplicate data.

[0055] Store the identity information submitted by the user and the digital certificate files.

[0056] After successful registration, the user logs in with the username and password. The user fills in the corresponding username and password information on the login interface. After the background obtains the user's login request, it queries the user's corresponding encryption key through the contract layer to see if it is consistent, and then compares the password and encrypted value entered by the user with the data in the blockchain. If they are consistent, the login is successful. If not, the user's login fails.

[0057] The registration of the certificate is done by submitting identity information, and the node will review and issue the certificate to the user, upload and save it, and then write the address of the certificate to the blockchain, and finally return the address of the user to which the certificate was issued;

[0058] Certificate revocation: When a certificate is detected to be expired or abused, the certificate is removed. By passing in the user name and the certificate number of the certificate to be revoked, the remove digital certificate function is called to revoke the certificate. At the same time, the member set of the current certificate is removed from the dynamic accumulator and rewritten to the blockchain through the consensus algorithm.

[0059] Certificate verification: When the user needs to verify the validity of a certificate, the certificate number and certificate file are used to query the certificate through the certificate query interface, and the queried certificate data is compared with the certificate file provided by the user. If they are the same, the verification is successful. If they are different, the verification fails.

[0060] A digital certificate system based on blockchain, comprising:

[0061] The application layer collects front-end data through users and sends the front-end data to the interface layer; the application layer includes a digital certificate subsystem and a privacy protection subsystem. The digital certificate subsystem is responsible for user certificate application and certificate management; the privacy protection subsystem is responsible for the protection of user applications; users send data to the digital certificate subsystem through the front end and interact with the background through the hypertext transfer protocol.

[0062] Certificate management includes the audit registration center, certificate authority center, timestamp service center and cryptographic middleware; the audit registration center enters and audits the information of users applying for certificates; the certificate authority center issues and manages certificates; the timestamp service center records the time of certificate issuance.

[0063] Interface layer, which transmits data in the interface layer through request initiation and request response interfaces;

[0064] The business layer processes the data of the request initiation interface and provides data feedback through the request response interface; the business layer includes user certificate application, certificate storage, log management, blockchain data browsing, user data management and certificate life cycle management.

[0065] The contract layer manages and controls the data in the business layer and stores the data in transmission; the contract layer includes registering contracts, querying contracts, changing contracts, and revoking contracts.

[0066] The data layer queries the data under control and deletes duplicate data; the data layer includes a user identity information storage unit and a digital certificate file storage unit.

[0067] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0068] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A method for processing digital certificates based on blockchain, characterized in that: The method comprises: Step 1: The user collects the front-end data and sends it; In step 1, the user sends data to the digital certificate subsystem and the privacy protection subsystem through the front end; the digital certificate subsystem associates and binds the user's identity data and public key to form a user identity certificate; The user includes registration, identity verification, login and digital certificate management. The user queries the digital certificate through the specified name, obtains the encrypted identity authentication information of the user through the node, decrypts and checks the user's private key, verifies the user's identity, and issues the user's digital certificate to the blockchain; The registration is performed by inputting a user name and password to register an account. First, the user fills in the registration form and sends the user name and password to the backend. The backend calls the user name on the blockchain and judges the registered user name. If the user account exists, it prompts that the user name has been registered. If the user account does not exist, the user name and password are encrypted, shared and stored. The user account is registered according to the contract layer, and the user's successfully registered account name and password interface is returned to prompt the user that the registration is successful. After the registration is successful, the user logs in with the username and password. The user fills in the corresponding username and password information on the login interface. After the background obtains the user's login request, it queries the user's corresponding encryption key through the contract layer to see if it is consistent, and then compares the password and encrypted value entered by the user with the data in the blockchain. If they are consistent, the login is successful, otherwise, the user's login fails; The registration of the certificate is done by submitting identity information, the node reviews and issues the certificate to the user, uploads and saves it, writes the address of the certificate to the blockchain, and finally returns the address of the user's certificate; The revocation of the certificate, when it is detected that the certificate has expired or has been abused, the certificate is removed. By passing in the user name and the certificate number of the certificate to be revoked, the remove digital certificate function is called to revoke the certificate. At the same time, the member set of the current certificate is removed from the dynamic accumulator and rewritten to the blockchain through the consensus algorithm; The verification of the certificate, when the user needs to verify the validity of the certificate, the certificate number and certificate file are used to query the certificate through the certificate query interface, and the queried certificate data is compared with the certificate file provided by the user. If the comparison is the same, the verification is successful, and if the comparison is different, the verification fails; Step 2: Process the sent front-end data and provide data feedback for the processed data; The step 2 further processes the request initiated in the digital certificate subsystem and feeds it back to the privacy protection subsystem, while storing and querying the certificate; The digital certificate management system enables users to view issued certificates and download certificates after logging in. The certificate information includes certificate version, certificate validity period, certificate signature value, cumulative value and signature algorithm. The digital certificate subsystem can view the certificates on the blockchain and revoke the certificates issued to the users; Step 3: Manage and control the processed data and store the data; Step 3: Further, a smart contract is implemented for the life cycle management of the user's digital certificate, and data is stored and certificate query and verification is performed in real time; Step 4: Query the data under control and delete duplicate data; The step 4 further includes storing the identity information submitted by the user and the digital certificate file.

2. A digital certificate system based on blockchain, characterized in that: The system comprises: The application layer collects front-end data through users and sends the front-end data to the interface layer; The application layer includes a digital certificate subsystem and a privacy protection subsystem. The digital certificate subsystem is responsible for the user's certificate application and certificate management; the privacy protection subsystem is responsible for the protection of the user's application; the user sends data to the digital certificate subsystem through the front end and interacts with the back end through the hypertext transfer protocol; In the privacy protection subsystem, the user first obtains the public key certificate of the information node to be reviewed, and then encrypts the user's identity information with the user's public key, and then generates a re-encryption key by combining the private key and the public key of the receiving party's review node, and stores the encrypted key, and then fills the storage address into the identity review table, and transmits the form information to the node for review. The node review judges the form information, and if it is rejected, an error message is prompted, and the identity information is uploaded again. If it passes, it is prompted that the identity information is compliant, and then it is tested through the review operation. If it is rejected, the reason for the failure of the review is returned, and the identity information is uploaded again. If it passes, a blockchain certificate is issued, and the certificate acquisition information is packaged and saved; Interface layer, which transmits data in the interface layer through request initiation and request response interfaces; The business layer processes the data of the request initiation interface and provides data feedback through the request response interface; The business layer includes user certificate application, certificate storage, log management, blockchain data browsing, user data management, and certificate lifecycle management; The contract layer controls the data in the business layer and stores the data in transit; The contract layer includes registering contracts, querying contracts, modifying contracts and revoking contracts; The data layer queries the data under control and deletes duplicate data; The data layer includes a user identity information storage unit and a digital certificate file storage unit; The certificate management includes an audit registration center, a certificate authority center, a timestamp service center and cryptographic middleware; the audit registration center enters and audits information of users applying for certificates; the certificate authority center issues and manages certificates; and the timestamp service center records the time point of certificate issuance.

Images