A decentralized digital certificate management method and system

Abstract

The application discloses a kind of decentralized digital certificate management method and system, transaction request is sent to service node, then service node generates first transaction according to transaction request, and first transaction is broadcast to all accounting nodes in blockchain, and the verification result of first transaction is obtained by accounting node, and according to the verification result, the consensus result corresponding to first transaction is sent to all accounting nodes.The first operation instruction of digital certificate is executed according to the consensus result by accounting node.The scheme of the application broadcasts the transaction request issued by the client through the service node in the blockchain to all accounting nodes in the blockchain, which also reduces the security risks and complexity of using third-party authorities.And according to the verification result of the first transaction corresponding to the transaction request by each accounting node, the first operation instruction of the digital certificate at the accounting node by the client is executed through the verification result, which realizes decentralized management and improves operational efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of blockchains, and in particular to a decentralized digital certificate management method and system. BACKGROUND

[0002] A blockchain is composed of multiple nodes. The identity authentication of the client and the nodes in the blockchain, and the information interaction between the nodes in the blockchain, all need to be confirmed by digital certificates. When the client and the nodes in the blockchain, and the information interaction between the nodes in the blockchain, are carried out, the respective identity certificates need to be checked, and the information interaction can be carried out only after the check is passed.

[0003] In the prior art, the current digital certificate is generally generated by a third-party authority and manually bound to the program of the client or the program of the blockchain node, and the management of the digital certificate is also completed by the third-party authority. In the existing blockchain scheme, the digital certificate initiated by the client to call the node is generally signed by a third-party authority, and the main content of the digital certificate includes a certificate serial number, a signature algorithm used by the certificate, a version number of the certificate, a name of an issuing authority of the certificate, a name of a certificate owner, a validity period of the certificate, and a public key of the certificate owner.

[0004] However, this method is equivalent to a centralized server deployment and operation management method. The security of the digital certificate depends on the security of the third-party authority, and once the authority is maliciously attacked or the authority itself subjectively wants to impersonate the user, information leakage or identity impersonation may easily occur, and the information security is not high; in addition, the issued certificate generally has a time limit, and a new certificate needs to be issued after expiration, and when the blockchain freezes, revokes, or performs other operations on the digital certificate, the certificate also needs to be reissued, which greatly increases the operation difficulty and operation cost. SUMMARY

[0005] The present application provides a decentralized digital certificate management method and system to solve the problems of low centralized trust, poor security, and complex operation in the prior art of managing digital certificates and digital certificates in each node of the blockchain.

[0006] In a first aspect, the present application provides a decentralized digital certificate management method, which comprises:

[0007] The client sends a transaction request to the service node; the transaction request includes a digital certificate and a first operation instruction executed on the digital certificate; the digital certificate is generated by the client through an asymmetric encryption algorithm of the node program;

[0008] The service node generates a first transaction according to the transaction request and broadcasts the first transaction to all the accounting nodes in the blockchain;

[0009] The accounting nodes verify the first transaction and feed back a verification result corresponding to the first transaction to the service node; the verification result includes an agreement to execute the transaction or a disagreement to execute the transaction;

[0010] If the number of the accounting nodes that agree to execute the transaction obtained by the service node is greater than a preset threshold, the service node sends a consensus result corresponding to the first transaction to all the accounting nodes in the blockchain;

[0011] The accounting nodes execute a first operation instruction on the digital certificate according to the consensus result.

[0012] In some embodiments, before the client sends the transaction request to the service node, the method further includes:

[0013] The client encrypts the digital certificate and the first operation instruction executed on the digital certificate using the public key of the digital certificate to obtain an encrypted transaction request;

[0014] Before the step of generating a first transaction by the service node according to the transaction request, the method further includes:

[0015] The service node decrypts the encrypted transaction request using a private key corresponding to the public key to obtain the digital certificate and the first operation instruction executed on the digital certificate.

[0016] In some embodiments, before the step of generating a first transaction by the service node according to the transaction request, the method further includes:

[0017] The service node checks the working state of the digital certificate;

[0018] When the working state of the digital certificate is any one of expiration, revocation or freezing, the service node returns the transaction request to the client.

[0019] In some embodiments, the first operation instruction executed on the digital certificate includes one of a certificate installation instruction, a certificate freezing instruction, a certificate unfreezing instruction, a certificate revocation instruction and a certificate replacement instruction.

[0020] In some embodiments, when the first operation instruction executed on the digital certificate is a certificate installation instruction, before the step of generating a first transaction by the service node according to the transaction request, the method further includes:

[0021] The service node checks the timeliness of the digital certificate at the accounting node;

[0022] If the digital certificate is in an active state within a corresponding time limit, the first operation instruction performed on the digital certificate is changed to a certificate replacement, and a first transaction is generated according to the modified first operation instruction.

[0023] In some embodiments, when the first operation instruction performed on the digital certificate is a certificate installation instruction, before the step of generating the first transaction according to the transaction request by the service node, the method further comprises:

[0024] The service node checks the state of the digital certificate at the accounting node;

[0025] If the state of the digital certificate is a certificate freeze, the first operation instruction performed on the digital certificate is changed to a certificate unfreezing instruction, and a first transaction is generated according to the modified first operation instruction.

[0026] In a second aspect, the application further provides a decentralized digital certificate management system, comprising a client and a blockchain composed of a service node and a plurality of accounting nodes, wherein:

[0027] The client is configured to send a transaction request to the service node; the transaction request includes a digital certificate and a first operation instruction performed on the digital certificate; the digital certificate is generated by the client through an asymmetric encryption algorithm of a node program;

[0028] The service node is configured to generate a first transaction according to the transaction request and broadcast the first transaction to all accounting nodes in the blockchain; if the service node obtains a number of accounting nodes agreeing to execute the transaction greater than a preset threshold, the service node is further configured to send a consensus result corresponding to the first transaction to all accounting nodes in the blockchain;

[0029] The accounting node is configured to verify the first transaction and feed back a verification result corresponding to the first transaction to the service node; the verification result includes agreeing to execute the transaction or disagreeing to execute the transaction; the accounting node is further configured to execute the first operation instruction on the digital certificate according to the consensus result.

[0030] In some embodiments, before the client sends a transaction request to the service node, the client is further configured to encrypt the digital certificate and the first operation instruction performed on the digital certificate using a public key of the digital certificate to obtain an encrypted transaction request;

[0031] Before the step of generating the first transaction according to the transaction request by the service node, the service node is further configured to decrypt the encrypted transaction request using a private key corresponding to the public key to obtain the digital certificate and the first operation instruction performed on the digital certificate.

[0032] In some embodiments, before the service node generates the first transaction based on the transaction request, the service node is also configured to verify the working status of the digital certificate.

[0033] When the digital certificate is in any of the following states: expired, revoked, or frozen, the service node is also configured to return the transaction request to the client.

[0034] In some embodiments, when the first operation instruction is a certificate installation instruction, before the ledger node executes the first operation instruction on the digital certificate according to the consensus result, the service node is further configured to verify the status of the digital certificate at the ledger node.

[0035] If the digital certificate is valid within the corresponding time period, the first operation instruction on the digital certificate will be changed to a certificate replacement instruction.

[0036] If the digital certificate is in a frozen state, then the first operation instruction on the digital certificate is changed to a certificate unfreezing instruction.

[0037] As can be seen from the above scheme, this application provides a decentralized digital certificate management method and system. First, the client sends a transaction request to the service node. Then, the service node generates a first transaction based on the transaction request and broadcasts the first transaction to all ledger nodes in the blockchain. It then obtains the verification results of the first transaction from the ledger nodes and sends the consensus result corresponding to the first transaction to all ledger nodes based on the verification results. The ledger nodes execute the first operation instruction on the digital certificate based on the consensus result. This application's scheme, by having the service node in the blockchain broadcast the client's transaction request to all ledger nodes in the blockchain, also reduces the security risks and complexity of using third-party authoritative institutions. By executing the client's first operation instruction on the digital certificate at the ledger node through the verification result, decentralized management is achieved, improving operational efficiency. Attached Figure Description

[0038] To more clearly illustrate the technical solution of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0039] Figure 1 A flowchart illustrating a decentralized digital certificate management method provided in this application;

[0040] Figure 2 for Figure 1 The flowchart of S500 of the method shown is a breakdown diagram.

[0041] Figure 3 For Figure 1 The flowchart of the method in an embodiment is shown in the figure.

[0042] Figure 4 The structural diagram of a decentralized digital certificate management system provided in the present application is shown in the figure.

[0043] Figure 5 The flowchart of the process in which the client directly interacts with the nodes in the consortium chain is shown in the figure.

[0044] Figure 6 The flowchart of the process in which the client interacts with other nodes in the consortium through a certain node is shown in the figure. DETAILED DESCRIPTION

[0045] The blockchain technology can solve the digital certificate management of the trust mechanism. Through the blockchain smart contract transaction, the consensus among the blockchain nodes is formed and recorded on the block to complete the management of the client digital certificate, realize decentralization, improve the operation efficiency, and also reduce the security and complexity of using the third-party system.

[0046] It should be noted that in the present application, the meaning of the digital certificate is the client digital certificate. In the field of blockchain technology, the meaning of the digital certificate usually includes the client digital certificate and the node digital certificate. Since the generation process, purpose, and control method of the client certificate and the node certificate are different, the differences between the client digital certificate and the node digital certificate are explained as follows:

[0047] The client digital certificate is used to indicate the permission of the client. When a certain node A in the blockchain is installed with the client digital certificate, it indicates that the client corresponding to the client digital certificate can send transactions, execute transactions, or other operations through the node A. Referring to Figure 5 The flowchart of the process in which the client directly interacts with the nodes in the consortium chain / blockchain is shown in the figure. In Figure 5In the prior art, if a client wants to use a node in the consortium chain to perform a transaction, the node used needs to be installed with a client digital certificate. When a node installed with a client digital certificate receives a transaction request from a client, the node can use the installed client digital certificate to verify the request from the client, and after verification, the node can perform the transaction. If a node is not installed with a client digital certificate, the node will not process the request sent by the client, that is, the client digital certificate installed on the node is equivalent to the “valid identity proof” when the client logs in to the node. However, in order to ensure that this “valid identity proof” is authentic and reliable, a trusted third-party agency (for example, a CA agency) usually needs to issue a client digital certificate for the client in advance. Only the client digital certificate generated and issued by the CA agency and the like can be installed in each node in the consortium chain. Therefore, in the prior art, if a client digital certificate needs to be managed, the client needs to send a certificate application to the third-party certificate agency before sending a transaction request, and the third-party certificate agency issues a client digital certificate for the client after the certificate application.

[0048] However, a node digital certificate is different from a client digital certificate. Referring to Figure 6 , a flowchart of a process in which a client interacts with other nodes in a consortium through a certain node. As Figure 6 indicated, in the prior art consortium / blockchain, each node also has a node digital certificate. The role of the node digital certificate is to verify the node digital certificate contained in the transaction request when a node A in the blockchain needs to perform a transaction, so as to verify whether the node sending the transaction request has the qualification to send the transaction request or is legal. Obviously, the node digital certificate is used to identify whether a node is legal, and has no direct relationship with the client logging in to the node. As Figure 6 indicated, if a node has a node certificate, as long as the node is installed with client digital certificates of multiple clients, the clients can send transactions through the node. Then, when the node broadcasts the transaction request to other nodes in the consortium chain, the other nodes only need to verify the node certificate at the node to further perform the transaction, and do not need to verify the client digital certificate. That is, the node digital certificate is equivalent to the “valid identity proof” of the node when sending a transaction to other nodes.

[0049] Unlike the node digital certificate, the client digital certificate has to rely on the CA organization in the regular management, and in the case that the security of the three-party certificate structure cannot be guaranteed, if the three-party certificate organization is attacked, the information of the issued digital certificate is leaked, which reduces the security of the digital certificate management. Therefore, the present application is aimed at the problems existing in the management process of the client digital certificate, and the following technical scheme is proposed. The present application aims to provide a management method of digital certificate in a block chain, improve the security and flexibility of the client certificate management, and the method of the present application is described in detail as follows:

[0050] Figure 1 A flowchart of a decentralized digital certificate management method provided by the present application.

[0051] By Figure 1 It can be seen that the decentralized digital certificate management method provided by the present application comprises:

[0052] S100: The client sends a transaction request to the service node; the transaction request includes a digital certificate and a first operation instruction executed on the digital certificate.

[0053] The digital certificate is a digital identity certificate generated by the client outside the block chain through the asymmetric encryption algorithm of the node program. The digital certificate is initially generated at the client. At the same time, when the digital certificate is generated, the public key and the private key corresponding to the digital certificate are also generated, and the public key and the private key are kept at the client. The unique hash value of the entire certificate generation is recorded on the block chain, and the entire life cycle of the digital certificate can be traced through the hash value. If the digital certificate is used for signature when initiating a transaction on the block chain, etc., it will be recorded on the block chain, and the entire transaction process can be traced, which ensures the legality and non-tamperability of the transaction.

[0054] The block chain includes public chain, private chain and alliance chain. The core difference between the three types of block chains is the degree of openness of access permission, or the degree of decentralization.

[0055] In the present embodiment, any node located in the block chain can be used as a service node, and the service node is used to generate a corresponding first transaction according to the transaction request sent by the client. When the client sends a transaction request to a certain block chain, the service node will receive the transaction request in the first time and generate a first transaction. When a node in the block chain is identified as a service node, the node does not participate in subsequent transaction verification and cannot be used as an accounting node again.

[0056] The digital certificate initiated by the traditional client to call the node is generally signed by a third-party institution, and the security of the digital certificate depends on the security of the third-party institution. Once the institution is maliciously attacked or the institution itself subjectively wants to impersonate the user, information leakage and identity impersonation are easily caused. In order to prevent the information leakage of the digital certificate of the client when the client sends a transaction request to the blockchain, in some embodiments, before step S100, the method further comprises:

[0057] The client encrypts the digital certificate and the first operation instruction executed on the digital certificate using the public key of the digital certificate, and obtains an encrypted transaction request. The encrypted transaction request needs to be decrypted by the private key corresponding to the public key. Therefore, before obtaining the encrypted transaction request, the client needs to send the private key corresponding to the public key to the service node, so that the service node can decrypt the encrypted transaction request in time after obtaining the transaction request.

[0058] In this embodiment, the client can be replaced by a business application subsystem, and the service node is associated. Each time a digital certificate is generated through the node, it is installed on the blockchain and saved in the application subsystem at the same time, and the certificate private key is encrypted and stored, thereby solving the problem of secure storage of the private key. And the application subsystem initiates related other command control digital certificate life cycle management.

[0059] S200: The service node generates a first transaction according to the transaction request, and broadcasts the first transaction to all accounting nodes in the blockchain.

[0060] The accounting node is a node responsible for verifying transactions and submitting ledgers in the blockchain. In the blockchain, all nodes except the service node can be defined as accounting nodes. Because the transaction request issued by the client is to operate all nodes in the blockchain, when the service node obtains the transaction request, the first transaction generated by the transaction request is broadcast to all accounting nodes in the blockchain.

[0061] It should be noted that the embodiments of the present application are through the client to initiate a transaction request to the blockchain. The purpose is to realize the various operations of the client on the digital certificate at the accounting node through the transaction request, such as certificate installation, certificate freezing, and certificate revocation. The service node only receives the transaction request issued by the client in the blockchain and broadcasts it to the accounting nodes in the blockchain. The service node does not serve as the object of actively sending transactions.

[0062] In this embodiment, corresponding to the encryption of the transaction request issued by the client in the embodiment of step S100, before step S200, the method further comprises:

[0063] The service node decrypts the encrypted transaction request using a private key corresponding to the public key to obtain the digital certificate and the first operation instruction performed on the digital certificate.

[0064] Before decryption, the service node needs to obtain the private key sent by the client. In this way, only the service node can decrypt the encrypted transaction request. Even if the information of the transaction request is leaked when the client sends the transaction request to the blockchain, the transaction request cannot be decrypted because the client private key is not available, thereby improving the security of the client sending the transaction request to the blockchain.

[0065] In some embodiments, the service node can also encrypt the first transaction before broadcasting it to all the accounting nodes in the blockchain, and then broadcast the encrypted first transaction to the accounting nodes. The accounting nodes will use the decryption algorithm or the corresponding public key of the service node to decrypt the encrypted first transaction, preventing malicious nodes in the blockchain from stealing the digital certificate in the first transaction and causing information leakage of the digital certificate.

[0066] Further, in order to prevent the digital certificate from being in an invalid state when the client sends a transaction request, and then the accounting node executes the first operation instruction on the digital certificate in an invalid state after reaching a consensus, resulting in a decrease in the processing of other transactions by the blockchain. In some embodiments, before S200 is performed, the service node also needs to verify whether the working state of the digital certificate is valid. If the state of the digital certificate is any of expired, revoked, or frozen, it means that the digital certificate at this moment is in an invalid state. Therefore, the transaction request initiated by the client at this time does not have validity, and the service node needs to return the transaction request sent by the client to the client.

[0067] S300: The accounting node verifies the first transaction.

[0068] The verification process is to verify the identity of the service node and the identity of the client. After receiving the transaction request, the accounting node extracts the information in the request for verification. If the verification is successful, a verification result agreeing to execute the transaction is generated, and a certificate signature of the accounting node is added to the verification result, indicating that the transaction has been verified. If the verification fails, a verification result disagreeing to execute the transaction is generated.

[0069] Further, if an accounting node generates a verification result disagreeing to execute the transaction. The verification result can also include the reason why the accounting node does not accept the transaction. The identity information of the node sending the information should also be included in the verification result, which is used to provide the authenticity verification basis of the corresponding feedback information and the data record of the verification process. So that the client can judge the authenticity of the verification result.

[0070] S400: feedback the verification result corresponding to the first transaction to the service node; after all the accounting nodes verify the first transaction, feedback all the verification results to the service node. After receiving all the verification results, the service node performs step S500.

[0071] S500: if the number of accounting nodes that agree to execute the transaction obtained by the service node is greater than a preset threshold, the service node sends the consensus result corresponding to the first transaction to all the accounting nodes in the blockchain. When the number of accounting nodes that agree to execute the transaction is greater than the threshold, that is, the blockchain reaches a consensus on the first transaction sent by the service node, the service node sends the consensus result corresponding to the first transaction to the accounting nodes in the blockchain.

[0072] It should be noted that the digital certificate at the accounting node is equivalent to the authentication of the client by the accounting node. If the digital certificate at the accounting node is in the effective state, the client can directly complete the transaction through the accounting node and publicize it to all the accounting nodes participating in the transaction verification in the blockchain, including the accounting nodes that agree to execute the transaction and the accounting nodes that disagree to execute the transaction.

[0073] In this embodiment, the consensus result obtained in step S500 includes two kinds, namely, consensus success and consensus failure. When the number of nodes in the blockchain that meet the consensus rule requirement selects to agree to execute the first transaction, it means that the transaction is successfully consensus, otherwise it means that there is no successful consensus.

[0074] In this embodiment, the threshold of the number of nodes can also be set to further determine whether the first transaction is consensus. For example, when there are 50 accounting nodes in the blockchain except the service node, the threshold for consensus success can be set to 30 nodes. When the accounting nodes in the blockchain verify a certain transaction, when there are 30 and more accounting nodes that agree to execute the transaction, then a consensus on the transaction is reached, and the feedback is consensus success. The threshold ratio can also be set to determine whether the transaction is consensus success, for example, the threshold ratio is set to 50%, that is, in the blockchain, there are 50% and more accounting nodes that agree to the transaction, that is, a consensus on the transaction is reached, and the feedback is consensus success.

[0075] In some embodiments, the consensus process can select configuration mechanisms, such as election strategy of leader node (selecting a certain node as leader node, rotating to select a certain node as leader node, randomly selecting a certain node as leader node), voting mechanism (administrator voting, majority voting, all voting), etc., and flexible mechanisms to ensure consensus safety and flexibility.

[0076] Corresponding to the above embodiment, referring to Figure 2 , step S500 can also be decomposed into:

[0077] S501: According to all the verification results, the number of the ledger nodes that agree to execute the transaction in the blockchain is counted. And the number of the ledger nodes that agree to execute the transaction is compared with the threshold value.

[0078] S502: If the number of the ledger nodes that agree to execute the transaction is greater than or equal to the preset threshold value, a consensus result of success is obtained, and step S600 is executed.

[0079] S503: If the number of the ledger nodes that agree to execute the transaction is less than the preset threshold value, a consensus result of failure is obtained. At this time, the service node needs to feed back the consensus result of failure to the client. Before feeding back to the client, the service node also needs to count the information of the ledger nodes that disagree to execute the transaction, and the reasons for disagreeing to execute the transaction, and feed back to the client together with the consensus result, so that the client analyzes the reasons for the consensus failure.

[0080] S600: The ledger node executes the first operation instruction on the digital certificate according to the consensus result. Wherein, the first operation instruction includes one of the certificate installation instruction, the certificate freezing instruction, the certificate unfreezing instruction, the certificate revocation instruction, and the certificate replacement instruction. This embodiment is described by taking the certificate freezing instruction as an example. When the first operation instruction is the certificate freezing instruction, after obtaining the result of success, the ledger node immediately responds to the certificate freezing instruction and executes the freezing operation on the digital certificate at the ledger node.

[0081] When the client initiates a transaction request to the blockchain for the first time, at this time, each ledger node in the blockchain has not installed the digital certificate, therefore, in the first transaction request initiated by the client to the blockchain, the first operation instruction must be the certificate installation instruction. After reaching a consensus on the transaction, the ledger node installs the digital certificate according to the consensus result, so as to facilitate the subsequent client to perform other instruction operations on the digital certificate at the ledger node.

[0082] In some embodiments, when the first operation instruction executed on the digital certificate is the certificate installation instruction, before the step of generating the first transaction by the service node according to the transaction request, the service node also needs to verify the timeliness of the digital certificate at the ledger node. Referring to Figure 3 At this time, steps S610-S620 will be executed.

[0083] S610: The service node sends a timeliness verification request to the ledger node;

[0084] S620: The ledger node feeds back the timeliness state of the digital certificate at the ledger node to the service node.

[0085] There are two cases for the time limit of the digital certificate. The first case is that the digital certificate is expired, and the certificate installation instruction is executed normally.

[0086] The second case is that the digital certificate is in a valid state within the corresponding time limit. When the digital certificate is in a valid state within the corresponding time limit, steps S630-S640 are executed.

[0087] S630: The first operation instruction executed on the digital certificate is changed to a certificate replacement instruction, and a first transaction is generated according to the modified first operation instruction. The certificate replacement is replaced by a newly registered digital certificate to replace the expired digital certificate at the accounting node.

[0088] S640: The first transaction is broadcast to the accounting node. The accounting node executes the modified first operation instruction on the digital certificate at the accounting node according to the first transaction.

[0089] The validity period of the digital certificate is generally one year or about 398 days. If the validity period of the digital certificate is one year, and the time to the expiration date of the digital certificate is only one month or one week, the digital certificate is in a state of expiration. The user can select the first operation instruction executed on the digital certificate as the certificate installation instruction or the certificate replacement instruction according to the actual situation.

[0090] In some embodiments, the time limit of the digital certificate, the life cycle management adds new business logic processing to find the expired digital certificate, and executes the certificate revocation operation logic through the smart contract to ensure the real-time validity of the certificate.

[0091] Further, the service node of the present embodiment also checks the state of the digital certificate at the accounting node when verifying the time limit. If the state of the digital certificate at the accounting node is certificate freezing, the installation operation on the digital certificate at the accounting node cannot be executed at this time. At this time, the digital certificate needs to be unfrozen first, and then other related operations of the first operation instruction are executed. At this time, the service node changes the first operation instruction executed on the digital certificate to a certificate unfreezing instruction, and generates a first transaction according to the modified first operation instruction, and then broadcasts it to the accounting node. After the accounting node obtains the certificate unfreezing instruction, the digital certificate is unfreezed first, so that the digital certificate is in an operable state.

[0092] According to the technical solution, the application provides a decentralized digital certificate management method. First, the client sends a transaction request to the service node. Then, the service node generates a first transaction according to the transaction request and broadcasts the first transaction to all the accounting nodes in the blockchain. The service node obtains the verification result of the first transaction by the accounting nodes and sends the consensus result corresponding to the first transaction to all the accounting nodes according to the verification result. The accounting nodes execute the first operation instruction on the digital certificate according to the consensus result. The application broadcasts the transaction request of the client to all the accounting nodes in the blockchain through the service node in the blockchain, which reduces the security risks and complexity of using a third-party authority. According to the verification result of the first transaction corresponding to the transaction request by the accounting nodes, the first operation instruction of the client on the digital certificate in the accounting node is executed through the verification result, which realizes decentralized management and improves operational efficiency.

[0093] Correspondingly, Figure 4 A decentralized digital certificate management system is shown, which includes a client and a blockchain composed of a service node and a plurality of accounting nodes.

[0094] The client is configured to send a transaction request to the service node. The transaction request includes a digital certificate and a first operation instruction executed on the digital certificate.

[0095] The service node is configured to generate a first transaction according to the transaction request and broadcast the first transaction to all the accounting nodes in the blockchain. If the number of accounting nodes that agree to execute the transaction obtained by the service node is greater than a preset threshold, the service node is further configured to send the consensus result corresponding to the first transaction to all the accounting nodes in the blockchain.

[0096] The accounting node is configured to verify the first transaction and feed back the verification result corresponding to the first transaction to the service node. The verification result includes agreeing to execute the transaction or disagreeing to execute the transaction. The accounting node is further configured to execute the first operation instruction on the digital certificate according to the consensus result.

[0097] In some embodiments, in order to prevent the information of the digital certificate from being leaked when the client sends a transaction request to the blockchain, before the client sends a transaction request to the service node, the client is further configured to encrypt the digital certificate and the first operation instruction executed on the digital certificate using the public key of the digital certificate to obtain an encrypted transaction request.

[0098] In this embodiment, the service node is further configured to decrypt the encrypted transaction request using the private key corresponding to the public key to obtain the digital certificate and the first operation instruction executed on the digital certificate.

[0099] In some embodiments, before sending the transaction request to all the accounting nodes in the blockchain, the service node is further configured to check the working status of the digital certificate.

[0100] When the working status of the digital certificate is any one of expired, revoked or frozen, it means that the digital certificate is in an invalid state at this time, and the service node is further configured to return the transaction request to the client at this time.

[0101] In some embodiments, when the digital certificate operation is a certificate installation instruction, before executing the transaction request of the digital certificate operation according to the consensus result, the service node is further configured to check the status of the digital certificate at the accounting node.

[0102] If the digital certificate is in an effective state within the corresponding validity period, the digital certificate at the accounting node does not need to be installed with a new certificate at this time, so the first operation instruction executed on the digital certificate needs to be changed from a certificate installation instruction to a certificate replacement instruction.

[0103] If the status of the digital certificate is certificate frozen, the operation on the digital certificate is changed to a certificate unfreezing instruction. If the status of the digital certificate at the accounting node is certificate frozen, the installation operation cannot be performed on the digital certificate at the accounting node at this time. At this time, the digital certificate needs to be unfrozen first, and then other related operations of the first operation instruction are performed.

[0104] Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the specification and examples be considered as exemplary only, with the true scope and spirit of the application being indicated by the following claims.

Claims

1. A decentralized digital certificate management method, characterized in that, The method includes: The client sends a transaction request to a service node in the blockchain; the transaction request includes a digital certificate and a first operation instruction to be executed on the digital certificate; the digital certificate is generated by the client using an asymmetric encryption algorithm of the node program; the digital certificate is installed on the ledger node in the blockchain so that the ledger node can verify the client's request using the installed digital certificate; the first operation instruction includes one of a certificate installation instruction, a certificate freeze instruction, a certificate unfreeze instruction, a certificate revocation instruction, and a certificate replacement instruction; wherein, in the first transaction request initiated by the client to the blockchain, the first operation instruction is a certificate installation instruction; The service node generates a first transaction based on the transaction request and broadcasts the first transaction to all accounting nodes in the blockchain. The accounting node verifies the first transaction and sends the verification result corresponding to the first transaction back to the service node; the verification result includes whether to agree to execute the transaction or disagree to execute the transaction. If the number of accounting nodes that the service node obtains to agree to execute the transaction is greater than a preset threshold, the service node sends the consensus result corresponding to the first transaction to all accounting nodes in the blockchain. The ledger node executes a first operation instruction on the digital certificate based on the consensus result, including: performing one of the following operations on the digital certificate at the ledger node: installing, freezing, unfreezing, revoking, or replacing.

2. The decentralized digital certificate management method according to claim 1, characterized in that, Before the client sends a transaction request to the service node, the method further includes: The client uses the public key of the digital certificate to encrypt the digital certificate and the first operation instruction executed on the digital certificate to obtain the encrypted transaction request; Before the step of the service node generating the first transaction based on the transaction request, the method further includes: The service node uses the private key corresponding to the public key to decrypt the encrypted transaction request, thereby obtaining the digital certificate and the first operation instruction to be executed on the digital certificate.

3. The decentralized digital certificate management method according to claim 1, characterized in that, Before the step of the service node generating the first transaction based on the transaction request, the method further includes: The service node verifies the working status of the digital certificate; When the digital certificate is in any of the following states: expired, revoked, or frozen, the service node will return the transaction request to the client.

4. The decentralized digital certificate management method according to claim 1, characterized in that, When the first operation instruction executed on the digital certificate is a certificate installation instruction, before the step of the service node generating the first transaction according to the transaction request, the method further includes: The service node verifies the validity of the digital certificate at the accounting node; If the digital certificate is valid within the corresponding time period, the first operation instruction executed on the digital certificate is changed to a certificate replacement instruction, and a first transaction is generated according to the modified first operation instruction.

5. The decentralized digital certificate management method according to claim 1, characterized in that, When the first operation instruction executed on the digital certificate is a certificate installation instruction, before the step of the service node generating the first transaction according to the transaction request, the method further includes: The service node verifies the status of the digital certificate at the accounting node; If the digital certificate is in a frozen state, the first operation instruction executed on the digital certificate is changed to a certificate unfreezing instruction, and a first transaction is generated according to the modified first operation instruction.

6. A decentralized digital certificate management system, characterized in that, The system includes a client and a blockchain consisting of service nodes and multiple ledger nodes, wherein: The client is configured to send a transaction request to a service node in the blockchain; the transaction request includes a digital certificate and a first operation instruction to be executed on the digital certificate; the digital certificate is generated by the client using an asymmetric encryption algorithm of the node program; the digital certificate is installed on the ledger node in the blockchain so that the ledger node can verify the client's request using the installed digital certificate; the first operation instruction includes one of a certificate installation instruction, a certificate freeze instruction, a certificate unfreeze instruction, a certificate revocation instruction, and a certificate replacement instruction; wherein, in the first transaction request initiated by the client to the blockchain, the first operation instruction is a certificate installation instruction; The service node is configured to generate a first transaction based on the transaction request and broadcast the first transaction to all ledger nodes in the blockchain; if the number of ledger nodes that agree to execute the transaction is greater than a preset threshold, the service node is further configured to send the consensus result corresponding to the first transaction to all ledger nodes in the blockchain. The ledger node is configured to verify the first transaction and report the verification result corresponding to the first transaction to the service node; the verification result includes agreeing to execute the transaction or disagreeing to execute the transaction; the ledger node is also configured to execute a first operation instruction on the digital certificate according to the consensus result, including: performing one of the following on the digital certificate at the ledger node: installing, freezing, unfreezing, revoking or replacing.

7. The decentralized digital certificate management system according to claim 6, characterized in that, Before the client sends a transaction request to the service node, the client is also configured to encrypt the digital certificate and the first operation instruction executed on the digital certificate using the public key of the digital certificate, so as to obtain the encrypted transaction request. Before the step of generating the first transaction based on the transaction request, the service node is further configured to use the private key corresponding to the public key to decrypt the encrypted transaction request to obtain a digital certificate and a first operation instruction to be executed on the digital certificate.

8. The decentralized digital certificate management system according to claim 6, characterized in that, Before generating the first transaction based on the transaction request, the service node is also configured to verify the working status of the digital certificate. When the digital certificate is in any of the following states: expired, revoked, or frozen, the service node is also configured to return the transaction request to the client.

9. The decentralized digital certificate management system according to claim 6, characterized in that, When the first operation instruction is a certificate installation instruction, before the ledger node executes the first operation instruction on the digital certificate according to the consensus result, the service node is also configured to verify the status of the digital certificate at the ledger node. If the digital certificate is valid within the corresponding time period, the first operation instruction on the digital certificate will be changed to a certificate replacement instruction. If the digital certificate is in a frozen state, then the first operation instruction on the digital certificate is changed to a certificate unfreezing instruction.

Images