Trusted time network calibration system and trusted time digital service

Abstract

A trusted time network calibration system and a method for providing a trusted time service based on the system, the system comprising: a time source traceable to the time coordination time UTC; an NTP synchronization server connected to the time source, providing NTP synchronization service, and recording the server-side NTP synchronization log; a time calibration server that generates and issues digital calibration certificates and provides valid status query of digital calibration certificates; a trusted time device that provides a trusted time service with a digital calibration certificate to an external program by synchronizing and calibrating the system time with the NTP synchronization server and obtaining a digital calibration certificate from the time calibration server. And a method for providing the trusted time digital service. By using the system and method of the present invention, the accuracy of the time calibration of the trusted time device, the machine readability of the DCC certificate, and the security and reliability of the trusted time service provided can be guaranteed.

Description

Technical Field

[0001] The invention relates to a trusted time network calibration system and a trusted time digital service. Technical Background

[0002] Trusted time services are widely used in the current Internet and production and life fields, such as timestamp services for e-commerce, measurement, electronic contracts, electronic documents, etc. The equipment that provides timestamps needs to be calibrated on a trusted time network. At the same time, the accuracy of the time and the integrity of the electronic data content of the timestamp must be ensured in the above process. At present, the trusted time service has the following problems: 1. The digital calibration certificate (DCC) provided in the relevant technology is generally a paper or PDF electronic version. This is because the paper and PDF versions are not easy to be tampered with and have high security. However, this version is not conducive to the computer system to accurately obtain various data in the DCC certificate. It can only be processed manually and the efficiency is low. 2. The digital trust problem of providing a trusted time device, that is, how to ensure that a device with a legal time calibration certificate has not been tampered with between the time period when it is calibrated to provide time services, and how to ensure that the digital identity of the device is consistent with the object of the time calibration certificate. 3. The traceability and verification problem of the application of trusted time by products or services. When a product or service applies for time from a time device, how to be closely bound to the object associated with the time, so that it can be verified and traced. Otherwise, the applied time may have technical loopholes that may lead to tampering.

[0003] Patent document CN104506268A discloses a method for implementing time calibration, which is characterized by comprising:

[0004] Step S1: the calibrated device generates a calibration time request message according to the sending time of the request message and sends it to the standard time device, and records the sending time of the request message; Step S2: the calibrated device receives the response message returned by the standard time device and records the receiving time of the response message, parses the response message to obtain the receiving time of the request message and the sending time of the response message, and obtains the time difference and message transmission delay between the calibrated device and the standard time device according to the sending time of the request message, the receiving time of the response message, the receiving time of the request message and the sending time of the response message; Step S3: the calibrated device calibrates the internally set clock according to the time difference and the message transmission delay between the calibrated device and the standard time device.

[0005] The above-mentioned related technologies only solve the problem of time synchronization. However, the related technologies do not solve the problem that the current digital calibration certificate data is not conducive to computer reading and the device providing time services cannot ensure that its time has not been tampered with during the period from calibration to the time when the time service is provided, and the time applied for by the device applying for time services and its corresponding digital calibration certificate cannot be easily verified and traced.

[0006] Glossary:

[0007] DCC: Digital Calibration Certificate.

[0008] NTP: Network Time Protocol.

[0009] NTS: NTP security authentication mechanism.

[0010] UTC: Coordinated Time.

[0011] UDP (User Datagram Protocol) is a datagram-oriented transport layer protocol. The standard document describing UDP is RFC768.

[0012] SHA256: Secure Hash Algorithm, secure hash algorithm, length is 256 bits

[0013] SM3: The SM3 cryptographic hash algorithm is a Chinese commercial cryptographic hash algorithm standard announced by the China National Cryptography Administration in 2010. Its standard document is the National Cryptographic Hash Algorithm Standard (GB / T 32905-2016).

[0014] DOI: digital object identifier, digital object unique identifier. Summary of the invention

[0015] The problem to be solved by the present invention is that in the above-mentioned related technologies, the time digital calibration certificate data is not conducive to computer reading, and the device providing time services cannot ensure that its time has not been tampered with during the period from calibration to the time when the time service is provided, and the external program applying for trusted time service cannot conveniently verify and trace the time applied for and its corresponding digital calibration certificate. A trusted time network calibration system and a method for providing trusted time services are provided, which can provide a secure and tamper-proof, computer-readable time digital calibration certificate, and ensure the accuracy and reliability of the trusted time provided, while making the provided trusted time and its calibration certificate traceable and verifiable.

[0016] In view of the above limitations, the present invention proposes a trusted time network calibration system, including:

[0017] A time source 101 traceable to Coordinated Time UTC;

[0018] NTP synchronization server 102: connects to the time source 101 via the network, provides NTP synchronization service, and records the server-side NTP synchronization log;

[0019] Time calibration server 103: provides the following services:

[0020] Use the pre-saved device certificate 206 to verify the download request of the digital calibration certificate 205, and after the verification is passed, generate and issue the digital calibration certificate 205;

[0021] Returning the validity status of the corresponding digital calibration certificate 205 according to the received DOI of the verified digital calibration certificate 205;

[0022] Trusted time device 501:

[0023] The network connects the NTP synchronization server (102) and the time calibration server (103);

[0024] Calibrate the system time (203) of the trusted time device (501) by synchronizing with the NTP synchronization server (102); obtain the digital calibration certificate (205) generated by the time calibration server (103) by interacting with the time calibration server data (103);

[0025] Provides trusted time services with digital calibration certificates 205 to external programs 301.

[0026] Further: the trusted time device 501 includes:

[0027] NTP synchronization client 201: sends a time synchronization request to the NTP synchronization server 102, calibrates the system time according to the data returned by the NTP synchronization server 102 (203, and records the device-side NTP synchronization log;

[0028] The time calibration client 202: sends a download request for the digital calibration certificate 205 and the device-side NTP synchronization log to the time calibration server 103, and receives the digital calibration certificate 205 returned by the time calibration server; the device-side NTP synchronization log is encrypted using the device certificate 206; the download request is signed using the private key of the device certificate 206 for the time calibration server 103 to verify the download request.

[0029] Further:

[0030] The NTP synchronization server (102): performs NTS verification on the NTP synchronization request;

[0031] The method of generating and issuing the digital calibration certificate 205 of the time calibration server (103) is:

[0032] In response to the download request of the digital calibration certificate 205 from the time calibration client 202, by analyzing the corresponding server-side NTP synchronization log and the device-side NTP synchronization log, the average time offset and uncertainty of NTP time synchronization are calculated, and the encrypted digital calibration certificate 205 in XML format is generated and returned to the trusted time device 501;

[0033] The trusted time service 204 provided by the trusted time device 501 includes:

[0034] Trusted time: system BIOS time of the trusted time device 501;

[0035] The DOI of the digital calibration certificate 205;

[0036] The ID of the device certificate 206 of the trusted time device 501 ; the DOI of the digital calibration certificate 205 and the ID of the device certificate 206 are used by the external program 301 to verify the validity of the digital calibration certificate 205 .

[0037] Further:

[0038] The calculation method of the average time offset is: within the selected period, remove the extreme value from all the time offset values, calculate the average value to obtain the average time offset; the calculation formula of the time offset value △t is:

[0039] △t=((T2-T1)+(T3-T4)) / 2

[0040] Wherein, T1 is the time when the NTP synchronization client (201) sends the first data packet to the NTP synchronization server (102), T2 is the time when the NTP synchronization server (102) receives the first data packet, T3 is the time when the NTP synchronization server (102) sends the second data packet, and T4 is the time when the NTP synchronization client (201) receives the second data packet;

[0041] The uncertainty is the standard deviation of the time offset after de-extinction.

[0042] A method for providing a trusted time service, based on the above system, comprises:

[0043] Step S101: the NTP synchronization server 102 receives a request from a trusted time device 501, provides a trusted time service 204 for the trusted time device 501, and saves a server-side NTP log record corresponding to the device ID of the requested trusted time device 501;

[0044] Step S103: the trusted time device 501 adjusts the system time to keep time synchronization with the NTP synchronization server 102, and saves the device-side NTP log record;

[0045] Step S105: the trusted time device 501 uploads the encrypted device-side NTP synchronization log to the time calibration server 103, and the time calibration server 103 generates and issues a digital calibration certificate 205 based on the server-side NTP log record, the device-side NTP synchronization log, and the digital identity of the trusted time device 501;

[0046] Step S107 : the trusted time device 501 obtains the digital calibration certificate 205 from the time calibration server 103 , responds to the request of the external program 301 , and provides the trusted time service 204 ; the trusted time service 204 includes: the system time 203 of the trusted time device 501 , the digital calibration certificate 205 , and the ID of the device certificate 206 .

[0047] Further:

[0048] The time source 101 of the NTP synchronization server 102 is traced back to the time coordinated time UTC;

[0049] The digital identity of the trusted time device 501 includes the device certificate 206 of the time device issued by the certificate authority and the device ID of the trusted time device. The device ID of the trusted time device is used by the NTP synchronization server 102 to search for the server-side NTP log record corresponding to the trusted time device 501.

[0050] Further: the step of generating the digital calibration certificate 205 includes:

[0051] Step S201: On the NTP synchronization server 102, a standard NTP synchronization protocol is used to provide time synchronization services on the Internet, while NTS verification is enabled and a server-side NTP synchronization log is recorded;

[0052] Step S203: On the trusted time device 501, time synchronization is performed with the NTP synchronization server 102, and the device-side NTP synchronization log is recorded;

[0053] Step S205: On the trusted time device 501, the NTP synchronization log of the client of the trusted time device 501 is analyzed to obtain log information, the log content is encrypted using the device certificate 206, and uploaded to the time calibration server 103;

[0054] Step S207: On the time calibration server 103, the received NTP client log information is stored in a database according to the digital identity of the trusted time device;

[0055] Step S209: The time calibration server 103 calculates the average offset value and uncertainty of NTP time synchronization based on the device-side NTP synchronization log and the server-side NTP synchronization log of the trusted time device 501; generates an encrypted time digital calibration certificate 205, and transmits it to the trusted time device 501.

[0056] Further: the request data of the external program 301 includes:

[0057] Time request identifier: The data to be timestamped is obtained by calculating the hash value using the SM3 or SHA256 method;

[0058] External program identification: used by the trusted time device 501 to search in a preset external program identification library to see whether it is a legitimate external program after receiving a request.

[0059] Further:

[0060] The trusted time device 501 verifies whether the time request identifier of the request data of the external program 301 is standardized; whether the external program identifier is an authorized external program; and verifies whether there is a valid digital calibration certificate 205; after the verification, the data returned to the external program 301 is digitally signed, and the data returned to the external program 301 includes:

[0061] The time request identifier;

[0062] The external request identifier;

[0063] Time data: time described by a string, and the current time status;

[0064] The ID of the device certificate (206) of the trusted time device (501) is used by the external program (301) to query the device certificate (206) from the time calibration server (103), and to verify the signature with the public key of the device certificate (206) when necessary;

[0065] The DOI of the digital calibration certificate 205 is used by an external program to query the time calibration server 103 for the validity status of the digital calibration certificate 205 .

[0066] Compared with the related art, the present invention has the following advantages:

[0067] Improved time accuracy by connecting to a traceable time source;

[0068] The digital calibration certificate uses XML as the content container, and the time offset, time uncertainty and calibration raw data are placed in the XML container according to certain specifications to complete the generation of the digital calibration certificate. At the same time, the digital certificate can be read by a machine, so that the digital calibration certificate has machine processability and improves the processing efficiency of the digital calibration certificate. At the same time, the digital calibration certificate in XML format is encrypted to ensure the security of the certificate.

[0069] By analyzing the NTP synchronization logs of the NTP server and the trusted time device, calculating the average time offset and uncertainty, and generating a DCC certificate, it is ensured that the time data between obtaining the calibration and providing the service is not tampered with, and that the trusted time provided has higher accuracy and reliability during the validity period of the DCC certificate.

[0070] The accuracy and reliability of trusted time calibration are improved by pre-applying for device certificates for trusted time devices and time calibration server devices, and asymmetric encryption of the interactive data between trusted time devices and time calibration servers. The reliability and data quality of trusted time services are further improved by providing external programs to check and trace the DCC certificates of trusted time service devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 A structural diagram of a trusted time network calibration system and a trusted time service method according to an embodiment of the present invention

[0072] Figure 2 The present invention is a flowchart of generating a digital calibration certificate in a trusted time network calibration system according to an embodiment of the present invention.

[0073] Figure 3 A trusted time acquisition process in a trusted time service method according to an embodiment of the present invention

[0074] Figure 4 This is a schematic diagram of an application of a trusted time network calibration system and a trusted time service method according to an embodiment of the present invention.

[0075] Figure 5 is a flow chart of a trusted time service method according to an embodiment of the present invention

[0076] Figure 6 is a flowchart of generating a digital calibration certificate according to an embodiment of the present invention DETAILED DESCRIPTION

[0077] In order to make the purpose, technical solution and advantages of the present invention more clear, the present invention is further described in detail below. However, it should be understood that the description herein is only used to explain the present invention and is not intended to limit the scope of the present invention.

[0078] Unless otherwise defined, all technical terms and scientific terms used herein have the same meanings as those generally understood by those skilled in the art of the present invention. The terms used in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The characterization means involved in this article can refer to the relevant descriptions in the prior art and will not be repeated herein.

[0079] In order to further understand the present invention, the present invention is further described in detail below in conjunction with the best embodiment.

[0080] Example 1

[0081] A trusted time network calibration system, comprising:

[0082] A time source 101 traceable to the time coordinated time UTC; the UTC (time coordinated time) is such as a cesium atomic clock or a hydrogen atomic clock, and the UTC is based on the network time protocol NTP to grant time to the NTP synchronization server. The time source can also be GPS, etc., but is not limited to the above form. The following traceable time sources are the same.

[0083] NTP synchronization server 102: connects to the time source 101 through the network, provides NTP synchronization service, and records the server-side NTP synchronization log; the network connection is a variety of ways such as wired Ethernet, WIFI, 4G, 5G, etc. and is not limited to the above methods, as long as the data is transmitted through the network. The following network connections are the same as this and will not be repeated. The NTP synchronization server adopts the NTP protocol.

[0084] Time calibration server 103: provides the following services:

[0085] Use the pre-saved device certificate 206 to verify the download request of the digital calibration certificate 205, and after the verification is passed, generate and issue the digital calibration certificate 205;

[0086] Returning the validity status of the corresponding digital calibration certificate 205 according to the received DOI of the verified digital calibration certificate 205;

[0087] Trusted time device 501:

[0088] The network connects the NTP synchronization server (102) and the time calibration server (103);

[0089] Calibrate the system time (203) of the trusted time device (501) by synchronizing with the NTP synchronization server (102); obtain the digital calibration certificate (205) generated by the time calibration server (103) by interacting with the time calibration server data (103);

[0090] Provides trusted time services with digital calibration certificates 205 to external programs 301.

[0091] Further: the trusted time device 501 includes:

[0092] NTP synchronization client 201: sends a time synchronization request to the NTP synchronization server 102, calibrates the system time 203 according to the data returned by the NTP synchronization server 102, and records the device-side NTP synchronization log;

[0093] The time calibration client 202: sends a download request for the digital calibration certificate 205 and the device-side NTP synchronization log to the time calibration server 103, and receives the digital calibration certificate 205 returned by the time calibration server; the device-side NTP synchronization log is encrypted using the device certificate 206; the download request is signed using the private key of the device certificate 206 for the time calibration server 103 to verify the download request.

[0094] The digital calibration certificate applied for by the time calibration client 202 can be applied for at a frequency of 1 hour, 1 day, etc. as required, and the corresponding validity period of the digital calibration certificate is set according to the required frequency of application.

[0095] Further:

[0096] The NTP synchronization server 102: performs NTS verification on the NTP synchronization request;

[0097] The method of generating and issuing the digital calibration certificate 205 of the time calibration server 103 is:

[0098] In response to the download request of the digital calibration certificate 205 from the time calibration client 202, by analyzing the corresponding server-side NTP synchronization log and the device-side NTP synchronization log, the average time offset and uncertainty of NTP time synchronization are calculated, and the encrypted digital calibration certificate 205 in XML format is generated and returned to the trusted time device 501;

[0099] The trusted time service 204 provided by the trusted time device 501 includes:

[0100] Trusted time: system BIOS time of the trusted time device 501;

[0101] The DOI of the digital calibration certificate 205;

[0102] The ID of the device certificate 206 of the trusted time device 501 ; the DOI of the digital calibration certificate 205 and the ID of the device certificate 206 are used by the external program 301 to verify the validity of the digital calibration certificate 205 .

[0103] Further:

[0104] The method for calculating the average time offset is as follows: within a selected period, all time offset values ​​are removed from the extreme values, and the average value is calculated to obtain the average time offset; the time offset value calculation formula is:

[0105] △t=((T2-T1)+(T3-T4)) / 2

[0106] Wherein, T1 is the time when the NTP synchronization client (201) sends the first data packet to the NTP synchronization server (102), T2 is the time when the NTP synchronization server (102) receives the first data packet, T3 is the time when the NTP synchronization server (102) sends the second data packet, and T4 is the time when the NTP synchronization client (201) receives the second data packet;

[0107] The deextreme value method may be a 3σ deextreme value method, but is not limited to this method.

[0108] The uncertainty is the standard deviation of the time offset after de-extinction.

[0109] Furthermore, by obtaining the average value of Δt through multiple measurements, the system time of the trusted service device can be accurately calibrated according to the time between the NTP synchronization servers 102. Usually, at the beginning of the setting, there are 6 exchanges within 5 to 10 minutes. Once synchronized, the server time is synchronized once every 10 minutes.

[0110] Furthermore, the trusted service device 501 can be installed on a server, a small computer, a mobile terminal, a mobile phone, a tablet, etc., and connected to the external program 301 that needs to provide the trusted time service 204 through a network, or installed on the same device as the external program 301. Preferably, the external program 301 is connected to the trusted service device 501 via Ethernet.

[0111] The above method of the present invention has the following advantages:

[0112] Improved time accuracy by connecting to a traceable time source;

[0113] By making the DCC certificate in XML format, the machine readability of the digital calibration certificate is guaranteed, thereby improving the efficiency of certificate processing and reducing processing costs.

[0114] By analyzing the NTP synchronization logs of the NTP server and the trusted time device, calculating the average time offset and uncertainty, and generating a DCC certificate, it is ensured that the time data between obtaining the calibration and providing the service is not tampered with, and that the trusted time provided has higher accuracy and reliability during the validity period of the DCC certificate.

[0115] The accuracy and reliability of trusted time calibration are improved by pre-applying for CA certificates for trusted time devices and time calibration server devices, and asymmetric encryption of the interactive data between trusted time devices and time calibration servers. The reliability and data quality of trusted time services are further improved by providing external programs to verify and trace the DCC certificates of trusted time service devices.

[0116] Example 2

[0117] A method for providing a trusted time service, based on the above system, comprises:

[0118] Step S101: the NTP synchronization server 102 receives a request from a trusted time device 501, provides a trusted time service 204 for the trusted time device 501, and saves a server-side NTP log record corresponding to the device ID of the requested trusted time device 501;

[0119] Step S103: the trusted time device 501 adjusts the system time to keep time synchronization with the NTP synchronization server 102, and saves the device-side NTP log record;

[0120] Step S105: the trusted time device 501 uploads the encrypted device-side NTP synchronization log to the time calibration server 103, and the time calibration server 103 generates and issues a digital calibration certificate 205 based on the server-side NTP log record, the device-side NTP synchronization log, and the digital identity of the trusted time device 501;

[0121] Step S107 : the trusted time device 501 obtains the digital calibration certificate 205 from the time calibration server 103 , responds to the request of the external program 301 , and provides the trusted time service 204 ; the trusted time service 204 includes: the system time 203 of the trusted time device 501 , the digital calibration certificate 205 , and the ID of the device certificate 206 .

[0122] Further:

[0123] The time source 101 of the NTP synchronization server 102 is traced back to the time coordinated time UTC;

[0124] The digital identity of the trusted time device 501 includes the device certificate 206 of the time device issued by the certificate authority and the device ID of the trusted time device. The device ID of the trusted time device is used by the NTP synchronization server 102 to search for the server-side NTP log record corresponding to the trusted time device 501.

[0125] Further: the step of generating the digital calibration certificate 205 includes:

[0126] Step S201: On the NTP synchronization server 102, a standard NTP synchronization protocol is used to provide time synchronization services on the Internet, while NTS verification is enabled and a server-side NTP synchronization log is recorded;

[0127] Step S203: On the trusted time device 501, time synchronization is performed with the NTP synchronization server 102, and the device-side NTP synchronization log is recorded;

[0128] Step S205: On the trusted time device 501, the NTP synchronization log of the client of the trusted time device 501 is analyzed to obtain log information, the log content is encrypted using the device certificate 206, and uploaded to the time calibration server 103;

[0129] Step S207: On the time calibration server 103, the received NTP client log information is stored in a database according to the digital identity of the trusted time device;

[0130] Step S209: The time calibration server 103 calculates the average offset value and uncertainty of NTP time synchronization based on the device-side NTP synchronization log and the server-side NTP synchronization log of the trusted time device 501; generates an encrypted time digital calibration certificate 205, and transmits it to the trusted time device 501.

[0131] Further: the request data of the external program 301 includes:

[0132] Time request identifier: The data to be timestamped is obtained by calculating the hash value using the SM3 or SHA256 method;

[0133] External program identification: used by the trusted time device 501 to search in a preset external program identification library to see whether it is a legitimate external program after receiving a request.

[0134] Further:

[0135] The trusted time device 501 verifies whether the time request identifier of the request data of the external program 301 is standardized; whether the external program identifier is an authorized external program; and verifies whether there is a valid digital calibration certificate 205; after the verification, the data returned to the external program 301 is digitally signed, and the data returned to the external program 301 includes:

[0136] The time request identifier;

[0137] The external request identifier;

[0138] Time data: time described by a string, and the current time status;

[0139] The ID of the device certificate (206) of the trusted time device (501) is used by the external program (301) to query the device certificate (206) from the time calibration server (103), and to verify the signature with the public key of the device certificate (206) when necessary;

[0140] The DOI of the digital calibration certificate 205 is used by an external program to query the time calibration server 103 for the validity status of the digital calibration certificate 205 .

[0141] Example 3

[0142] To achieve the above object, a trusted time network calibration system and a trusted time service method according to an embodiment of the present invention include the following steps in sequence:

[0143] 1. Provide a time source (101) that can be traced back to the original source of measurement as the time source for the entire system;

[0144] 2. Apply for device certificates for the time calibration server 103 and the trusted time device 501 from the certificate authority (CA); including:

[0145] A) Generate a public key and private key pair on the trusted time device 501, and generate a CSR (certificate request file);

[0146] B) Send the CSR file and current organization certification document to the certificate authority (CA);

[0147] C) The CA organization returns the device certificate and saves it in the trusted time device 501.

[0148] 3. Start the NTP synchronization server 102 to provide NTP time synchronization service for the system and save the log;

[0149] 4. Start the time synchronization service in the trusted time device 501, keep time synchronization with the NTP synchronization server 102, and save log records;

[0150] 5. The trusted time device 501 uploads the NTP synchronization log to the time calibration server 103, and the time calibration server 103 generates a time digital calibration certificate (DCC) 205 based on the log information and the digital identity of the trusted time device 501;

[0151] 6. The trusted time device 501 provides a trusted time service 204 to the outside based on the device certificate of the trusted time device 501 , the system time 203 , and the DCC certificate 205 .

[0152] The advantages of using the system and digital services of the present invention are analyzed as follows:

[0153] Use a time source that can be traced back to the national time and frequency standard and has a time calibration certificate issued by a legitimate metrology agency to ensure the accuracy, reliability and traceability of the time source.

[0154] Compared with the current situation in which the calibration certificate used in network time calibration in the related art is paper or PDF electronic version, which is not conducive to the computer system to accurately obtain the time uncertainty value, the present invention adopts the internationally recognized and approved exchange format XML (Extensible Markup Language) as the container for the digitalization of the calibration certificate, ensuring that the calibration certificate is machine-readable. At the same time, asymmetric encryption is also used to ensure that the DCC certificate is not tampered with and reliable.

[0155] The trusted time device that provides the trusted time service can ensure that its time is not tampered with during the period from when it is calibrated to when it provides the time service, and ensure that the digital identity of the device is consistent with the object of the time calibration certificate. By using the digital certificate and PKI system issued by the authoritative CA organization for the trusted time device, it is ensured that the DCC certificate is not tampered with, the original data that needs a timestamp, the request information and the return information are not tampered with, thus ensuring the security and reliability of the data.

[0156] It can ensure that electronic data is not tampered with and can be traced back afterwards. The present invention calculates the SM3 hash value of the time-related object, and then combines it with relevant information such as time, time device ID, DCC certificate ID, etc., and uses the device certificate of the time DCC for digital signature to complete the close binding of the time-related object, time, time device, and time measurement traceability information, identify the time identity, and prevent the tampering of the time data; the time digital calibration certificate and device ID certificate are based on the PKI system and can be verified and traced on the Internet.

[0157] Example 4

[0158] like Figure 1 As shown, a schematic diagram of a trusted time network calibration system and a trusted time service of an embodiment of the present invention includes a time source 101, an NTP synchronization server 102, a time calibration server 103, an NTP synchronization client 201, a time calibration client 202, a system time 203, a trusted time service 204, a DCC certificate 205, a device certificate 206, an external program 301, the Internet 401, and a time service interface 402.

[0159] Time Source 101: Metrologically traceable time source, providing a highly accurate, reliable, metrologically traceable time source for the entire system.

[0160] NTP synchronization server 102: a service system deployed on the Internet, a server that provides NTP synchronization services to the outside world, has an independent IP address, provides NTS to protect NTP, and ensures the basic security of NTP services.

[0161] Time calibration server 103: A service system deployed on the Internet, providing REST interface services to the outside world through HTTPS, using certificates issued by CA institutions for authentication, and storing device certificates 206 of all legally accessible devices on the server. The device requesting the service holds the corresponding private key, and uses an asymmetric encryption mechanism (RSA, ECC) to verify the request. Only requests with legal certificates can use the interface; the interface mainly provides functions such as DCC certificate 205 generation, DCC certificate 205 download, and DCC certificate 205 verification; the generation of DCC certificate 205, based on the certificate of the logged-in user, searches for the corresponding NTP synchronization log on the NTP synchronization server 102, generates DCC certificate 205 based on the synchronization log (log data of at least 24 hours), and saves it in the database. The verification of DCC certificate 205, based on the requested DCC certificate DOI, queries and returns whether the DCC certificate is valid.

[0162] NTP synchronization client 201: runs on the trusted time device 501, and synchronizes time with the NTP synchronization server 102 through Ethernet. The NTP synchronization client 201 sends a time request and exchanges time with the NTP synchronization server 102. As a result of this exchange, the time offset can be calculated and adjusted to synchronize with the server time. The time offset calculation formula is: time offset = ((T2-T1) + (T3-T4)) / 2, where T1 is the client's data packet sending time, T2 is the server-side data packet receiving time, T3 is the server-side data packet sending time, and T4 is the client-side data packet receiving time. Normally, at the initial setting, there are 6 exchanges within 5 to 10 minutes. Once synchronized, it is synchronized with the server time every 10 minutes. The frequency of the exchange can be set according to actual needs, not limited to the above examples. The time can be adjusted by directly modifying the time or modifying the frequency calibration value.

[0163] Time calibration client 202: The program runs on the trusted time device 501, and generates the device's time DCC certificate 205 through Ethernet using the REST interface based on HTTPS. First, use the pre-saved device certificate 206 of the trusted time device 501 to log in to the time calibration server 103 system and obtain a session token; then send the device identifier to the time calibration server 103 to generate the corresponding DCC certificate 205; finally download the DCC certificate 205 and save it in the system directory.

[0164] System time 203: The system time 203 of the trusted time device 501 is provided by the system BIOS of the trusted time device 501. Even if the system is restarted or shut down for a short time, the time will not be affected. The time can be modified by directly modifying the time or modifying the frequency calibration value.

[0165] Trusted time service 204: is a program for the trusted time device 501 to provide external services, and provides REST interface services based on Ethernet.

[0166] Digital Calibration Certificate (DCC) 205: The Digital Calibration Certificate 205 plays a decisive role in every metrological quality management system. The Digital Calibration Certificate 205 can do more than just prove metrological traceability. The Digital Calibration Certificate 205 is based on the internationally recognized and approved exchange format XML (Extensible Markup Language), and it is machine-readable. All displays, including numerical calibration curves, can be directly or automatically converted to digital support processes. At the same time, a cryptographic signature is used as a security procedure to ensure the integrity and authenticity of the calibration certificate.

[0167] Device certificate 206: The device certificate 206 issued by the authoritative CA organization to the trusted time device 501, and the device certificate 206 identifies the device in the digital world.

[0168] External program 301: a third-party program that needs to use trusted time. The third-party independent program can be installed on an independent hardware device, or it can be an application program running in the trusted time device 501.

[0169] Internet 401: Communicate with the NTP synchronization server 102 and the time calibration server 103 through the Internet 401, including multiple access methods: wired Ethernet, WIFI, 4G, 5G and other methods.

[0170] Time service interface 402: mainly provides services to the outside in the form of Ethernet, but is not limited to the above forms.

[0171] Figure 2 The present invention is a flowchart of generating a digital calibration certificate in a trusted time network calibration system according to an embodiment of the present invention.

[0172] like Figure 2 As shown, based on the synchronization log of the NTP synchronization client 201 and the synchronization log of the server, the average time offset and uncertainty of the trusted time device 501 are calculated through the digital identity authentication of the CA certificate, and the time DCC certificate 205 is generated: the specific steps included are as follows:

[0173] Step S301: On the NTP synchronization server 102, the NTPD service program is used to adopt the standard NTP synchronization protocol (RFC 5905) to provide time synchronization services on the Internet, while enabling NTS authentication and recording all time synchronization logs.

[0174] Step S302: On the trusted time device 501, use the NTPD service program and adopt the standard NTP protocol (RFC5905) to synchronize time with the NTP synchronization server 102, and record the synchronization log in a file.

[0175] Step S303: On the trusted time device 501, the NTP synchronization log of the client is analyzed to obtain log information, including: date, hour (UTC), IP address from which measurement is made, leap year status, maximum delay, score, estimated local clock error, peer delay, etc. The log content is encrypted using the device ID certificate 206 and uploaded to the time calibration server 103, wherein the interface uploaded to the server complies with the RESTful specification.

[0176] Step S304: On the time calibration server 103, the received NTP client log information is analyzed and organized, and stored in the database according to the digital identity of the trusted time device 501; for the same trusted time device 501, the offset and uncertainty of the NTP time synchronization are calculated by combining the NTP client log and the NTP server log; a time DCC certificate 205 is generated, and an encrypted signature is used as a security procedure to ensure the integrity and authenticity of the calibration certificate, and the certificate is transmitted to the trusted time device 501.

[0177] The average time offset calculation is as follows: within the calculation period, after removing the extreme value (3σ extremum) from all time offset values, the average value of the remaining time offset values ​​is calculated as the average time offset; the uncertainty is the standard deviation of the time offset after extremum removal.

[0178] Example 5

[0179] like Figure 3 As shown, it is a trusted time acquisition process in a trusted time service method of an embodiment of the present invention. The time device provides services that comply with the RESTful specification to the outside world through a communication interface (network, pipeline, etc.). The data content is in JSON format. The external program actively obtains trusted time information, and one request corresponds to one response.

[0180] The specific process is as follows:

[0181] Step S401: The external program 301 obtains the authorized external program identifier by applying in advance, calculates the hash value for the data to be timestamped, obtains the time request identifier, and then combines the external program identifier group and the time request identifier into a JSON data packet and sends it to the trusted time device 501. The data members of the time request packet are as follows:

[0182]

[0183] Step S402: The trusted time device 501 adopts the following processing rules for the received time request packet: 1) Verify whether the time request identifier complies with the specifications. If not, directly return an error message; 2) Verify whether the external program identifier is in the authorized external program identifier library. If not, directly return an error message; 3) Check the device certificate 206 of the trusted time device 501, mainly to check whether it exists, whether it is within the valid time range, and whether it has been revoked, and obtain the device certificate 206 ID identifier; 4) Check the latest DCC certificate 205, mainly to check whether the DCC certificate 205 exists, whether the DCC certificate 205 is valid, and whether the time offset and uncertainty of the DCC certificate 205 are within a reasonable range, and obtain the DCC certificate ID.

[0184] Step S403: Get the system time 203, convert it into a string that complies with the ISO 8601 specification as the current time; connect the string contents of the time request identifier, external program identifier, time status, current time, device certificate 206 ID identifier, and digital calibration certificate 205 ID in sequence, convert them into UTF-8 encoded data blocks, use the device certificate 206 of the trusted time device 501, digitally sign the connected data blocks, and finally convert them into BASE64 encoding.

[0185] Step S404: The information to be returned to the external program 301 is formed into a JSON data packet, and is returned to the external program 301 through an interface that complies with the RESTful specification. The data member format of the time response packet is as follows:

[0186]

[0187]

[0188] Example 6

[0189] like Figure 4As shown, a schematic diagram of the application of a trusted time network calibration system and a digital service method in one embodiment of the present invention shows an example of a VOCs online monitoring system using a trusted time service 204. Adding trusted time to the data collected by VOCs provides guarantees for the integrity, time accuracy, and time measurement traceability of the VOCs data, and provides traceability and verifiability for the data. The specific process is as follows:

[0190] Step A01: The VOCs online monitoring system collects data to obtain result data;

[0191] Step A02: The VOCs online monitoring system is connected to the trusted time device 501 via Ethernet. The hash value of the data (using the SM3 hash algorithm) is calculated for the VOCs result data and the instrument status parameters in the agreed order. The hash value is used as the associated object of time, and the trusted time information is obtained from the trusted time device 501 through the RESTful programming interface.

[0192] Step A03: combine the trusted time information, the time-related object, and the original data into a time-trusted VOCs data A03 data object, and save it in a file / database;

[0193] Step A04: The public / regulatory agency C1 views and downloads the VOCs data with reliable time, and uploads the data to the trusted time device 501 via the Internet, and can verify the integrity of the VOCs data, the accuracy of the VOCs data associated time, and the measurement traceability record (digital calibration certificate 205) of the VOCs data associated time. The public / regulatory agency obtains the ID of the digital calibration certificate 205 through the trusted time device 501, and can query the content of the digital calibration certificate 205 on the Internet.

[0194] In the embodiments of the present invention, the trusted time calibration system and trusted time service of the present invention can be applied to the above-mentioned application scenarios. It can be understood that the present invention is not limited to the above-mentioned application scenarios, but can also be widely used in all equipment and services that have requirements for time accuracy, consistency, and metrological traceability.

[0195] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modification, equivalent substitution or improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A trusted time network calibration system, characterized in that: include: A time source (101) traceable to Coordinated Universal Time (UTC); NTP synchronization server (102): connects to the time source (101) via the network, provides NTP synchronization service, and records the server-side NTP synchronization log; Time calibration server (103): provides the following services: Using a pre-stored device certificate (206) to verify the download request of the digital calibration certificate (205), after the verification is passed, generating and issuing the digital calibration certificate (205); returning the validity status of the corresponding digital calibration certificate (205) according to the received DOI of the verified digital calibration certificate (205); Trusted Time Device (501): The network connects the NTP synchronization server (102) and the time calibration server (103); the system time (203) of the trusted time device (501) is synchronized and calibrated with the NTP synchronization server (102), the system time (203) is calibrated according to the data returned by the NTP synchronization server (102), and the device-side NTP synchronization log is recorded; the digital calibration certificate (205) generated by the time calibration server (103) is obtained by data interaction with the time calibration server (103); specifically, the time calibration server (103) generates and issues the digital calibration certificate (205) based on the server-side NTP log record, the device-side NTP synchronization log, and the digital identity of the trusted time device (501); the digital calibration certificate uses XML as a content container, puts the time offset, time uncertainty and calibration raw data specifications into the XML container, completes the generation of the digital calibration certificate, and provides a trusted time service with the digital calibration certificate (205) for the external program (301); Wherein, the trusted time device (501) comprises: NTP synchronization client (201): sends a time synchronization request to the NTP synchronization server (102), calibrates the system time (203) according to the data returned by the NTP synchronization server (102), and records the device-side NTP synchronization log; The time calibration client (202) sends a download request for a digital calibration certificate (205) and a device-side NTP synchronization log to the time calibration server (103), and receives the digital calibration certificate (205) returned by the time calibration server; the device-side NTP synchronization log is encrypted using a device certificate (206); the download request is signed using a private key of the device certificate (206) for the time calibration server (103) to verify the download request; The NTP synchronization server (102): performs NTS verification on the NTP synchronization request; The method of generating and issuing a digital calibration certificate (205) by the time calibration server (103) is: In response to a download request for a digital calibration certificate (205) from a time calibration client (202), by analyzing a corresponding server-side NTP synchronization log and a device-side NTP synchronization log, calculating an average time offset and uncertainty of NTP time synchronization, generating an encrypted digital calibration certificate (205) in XML format and returning the encrypted digital calibration certificate (205) to the trusted time device (501); The trusted time service (204) provided by the trusted time device (501) includes: Trusted time: system BIOS time of the trusted time device (501); the digital calibration certificate (205) DOI; The device certificate (206) ID of the trusted time device (501); the digital calibration certificate (205) DOI and the device certificate (206) ID are used by an external program (301) to verify the validity of the digital calibration certificate (205); The method for calculating the average time offset is as follows: within a selected period, after removing the extreme value from all time offset values ​​Δt, the average value of the time offset values ​​Δt is calculated to obtain the average time offset; the calculation formula for the time offset value Δt is: Δt =((T2-T1)+(T3-T4)) / 2 Wherein, T1 is the time when the NTP synchronization client (201) sends the first data packet to the NTP synchronization server (102), T2 is the time when the NTP synchronization server (102) receives the first data packet, T3 is the time when the NTP synchronization server (102) sends the second data packet, and T4 is the time when the NTP synchronization client (201) receives the second data packet; The uncertainty is the standard deviation of the time offset after de-extinction.

2. A method for providing a trusted time service, based on the system according to claim 1, characterized in that: include: Step S101: the NTP synchronization server (102) receives a request from a trusted time device (501), provides a trusted time service (204) for the trusted time device (501), and saves a server-side NTP log record corresponding to the device ID of the requesting trusted time device (501); Step S103: the trusted time device (501) adjusts the system time to keep time synchronization with the NTP synchronization server (102), and saves the NTP log record on the device side; Step S105: The trusted time device (501) uploads the encrypted device-side NTP synchronization log to the time calibration server (103), and the time calibration server (103) generates and issues a digital calibration certificate (205) based on the server-side NTP log record, the device-side NTP synchronization log, and the digital identity of the trusted time device (501). The digital calibration certificate uses XML as a content container, and puts the time offset, time uncertainty, and calibration raw data specifications into the XML container to complete the generation of the digital calibration certificate; Step S107: The trusted time device (501) obtains the digital calibration certificate (205) from the time calibration server (103), responds to the request of the external program (301), and provides a trusted time service (204); the trusted time service (204) includes: the system time (203) of the trusted time device (501), the digital calibration certificate (205), and the device certificate (206) ID.

3. The method according to claim 2, characterized in that: The time source (101) of the NTP synchronization server (102) is traced back to the Universal Time Coordinated (UTC); The digital identity of the trusted time device (501) includes a device certificate (206) of the time device issued by a certificate authority and a device ID of the trusted time device, wherein the device ID of the trusted time device is used by the NTP synchronization server (102) to search for a server-side NTP log record corresponding to the trusted time device (501).

4. The method according to claim 2 or 3, characterized in that: The steps of generating a digital calibration certificate (205) include: Step S201: On the NTP synchronization server (102), a standard NTP synchronization protocol is used to provide time synchronization services on the Internet, while NTS verification is enabled and a server-side NTP synchronization log is recorded; Step S203: On the trusted time device (501), time synchronization is performed with the NTP synchronization server (102), and a device-side NTP synchronization log is recorded; Step S205: On the trusted time device (501), analyze the NTP synchronization log of the client of the trusted time device (501), obtain log information, encrypt the log content using the device certificate (206), and upload it to the time calibration server (103); Step S207: On the time calibration server (103), the received NTP client log information is stored in a database according to the digital identity of the trusted time device; Step S209: The time calibration server (103) calculates the average offset value and uncertainty of NTP time synchronization based on the device-side NTP synchronization log and the server-side NTP synchronization log of the trusted time device (501); generates an encrypted time digital calibration certificate (205), and transmits it to the trusted time device (501).

5. The method according to claim 4, characterized in that: The request data of the external program (301) includes: Time request identification: The data to be timestamped is obtained by calculating the hash value using the SM3 or SHA256 method; External program identification: used by the trusted time device (501) to search in a preset external program identification library to see whether it is a legitimate external program after receiving a request.

6. The method according to claim 5, characterized in that: The trusted time device (501) verifies whether the time request identifier of the request data of the external program (301) is standardized; whether the external program identifier is an authorized external program; and verifies whether there is a valid digital calibration certificate (205); after the verification is passed, the data returned to the external program (301) is digitally signed, and the data returned to the external program (301) includes: The time request identifier; the external program identifier; Time data: time described by a string, and the current time status; The ID of the device certificate (206) of the trusted time device (501) is used by the external program (301) to query the device certificate (206) from the time calibration server (103), and to verify the signature with the public key of the device certificate (206) when necessary; The digital calibration certificate (205) DOI is used by an external program to query the time calibration server (103) about the validity status of the digital calibration certificate (205).

Images