A blockchain-based school certificate issuance and verification method, system and device

Abstract

The present invention discloses a school certificate issuance and verification method, verification system and device based on blockchain, including certificate generation and issuance, certificate revocation and certificate verification. The control module of the device is used to encrypt the Bitcoin wallet key information required for certificate issuance and verification and save it to the storage module of the device; and the information required for certificate issuance and verification is read from the storage module of the device and decrypted and output; the verification and revocation information of the certificate is stored on the blockchain, and the original certificate is stored in the IPFS; the certificate is revoked by re-issuing it to the blockchain; the DNS authentication method is used to realize the identity authentication of the institution; the present invention realizes the safe storage of verification information, original certificate and wallet information, supports the operation of revoking certificates, ensures the authenticity, validity and security of the issued certificates, and solves the technical problems such as non-verification by the certificate issuing authority, unsafe certificate revocation, incompatibility of certificates in previous years, easy loss of wallet information, etc.

Description

Technical Field

[0001] The present invention belongs to the field of information technology and relates to the storage, issuance and verification technology of school certificates, and in particular to a school certificate issuance and verification method, verification system and device based on blockchain. It provides the storage of information on blockchain and the application of distributed file system, and is a method for storage, issuance and verification of school certificates and related devices. Background Art

[0002] In the field of school certificate storage, issuance and verification technology, there are many blockchain certificate systems represented by Blockcerts, a blockchain certificate project based on the Bitcoin blockchain and an open standard for digital academic certificates. Blockcerts implements the generation, issuance, viewing and verification of blockchain certificates. However, the Blockcerts blockchain certificate system has the following technical problems:

[0003] 1. In the verification process of this system, there is no step to authenticate the issuing agency. It can only verify that the certificate is indeed recorded on the blockchain. Therefore, it is impossible to guarantee that the issuing agency is official, which provides the possibility for other institutions to forge certificates.

[0004] 2. The revocation of certificates is a common problem with current electronic certificates. When revoking a certificate, Blockcert only stores the certificates that need to be revoked in a centralized manner on the server and compares them when inquiring. This list is more vulnerable to attacks and tampering than the information stored on the blockchain;

[0005] 3. Paper certificates or electronic certificates in PDF format issued in previous years are not compatible and can only be regenerated electronically;

[0006] 4. The digital currency wallet key information used to issue the certificate is stored by the user himself, which is at risk of loss or theft. Summary of the invention

[0007] In order to overcome the deficiencies of the above-mentioned prior art, the present invention provides a blockchain-based school certificate issuance and verification method, verification system and device. The storage, issuance and verification method, system and device of the school certificate provided by the present invention are used to solve the technical problems existing in the existing blockchain certificate platform, such as the issuing authority does not verify, the withdrawal of certificates is unsafe, the certificates of previous years are incompatible, and the wallet information is easy to lose.

[0008] The present invention stores the relevant information of the verification and revocation of the school certificate on the blockchain, stores the original school certificate in the distributed file system, and provides a safe and easy-to-use device for storing wallet information, thereby realizing the safe storage of verification information, original certificate, and wallet information, and also supporting the operation of withdrawing certificates, thereby ensuring the authenticity, validity and security of the issued school certificates.

[0009] The present invention provides a device for school certificate issuance and verification based on blockchain, including a storage module and a control module, which is a device for storing and reading key information. The control module only interacts with the school certificate issuance and verification system of the present invention, and mainly realizes two functions, one is to encrypt the wallet key information required by the school certificate issuance and verification system and save it to the storage module, and the other is to read the information required by the school certificate issuance and verification system from the storage module and output it after decryption. In specific implementation, the encryption and decryption algorithm of the present invention uses the RSA (Rivest-Shamir-Adleman) algorithm.

[0010] The blockchain-based school certificate issuance and verification method provided by the present invention stores the relevant information of the verification and revocation of the school certificate on the blockchain, and stores the original school certificate in the distributed file system; the certificate is revoked by "re-issuing to the blockchain"; for the institutional identity authentication, a DNS (Domain Name Service) authentication method is designed to realize automatic and unforgeable identity authentication. The method includes: certificate generation and issuance process, certificate revocation process, certificate acquisition process and certificate verification process; including the following steps:

[0011] A. The implementation method of certificate generation and issuance is:

[0012] A1. The school registers a Bitcoin wallet, obtains a Bitcoin wallet key (hereinafter referred to as the wallet key) and a Bitcoin wallet address, stores the wallet key in the device provided by the present invention, and places the Bitcoin wallet address and the file key public key in the domain name resolution record to implement certificate verification. Specifically, the Bitcoin wallet address is copied to the Domain Name System (Domain Name Service, DNS) resolution record of a domain name controlled by the school. This Bitcoin wallet address will be used for certificate verification. The DNS resolution record of a domain name is unique in the world and can be publicly accessed by everyone, but only the school that owns the domain name can modify the domain name resolution information. Afterwards, generate another pair of keys (including a public key and a private key) for encrypting the certificate file (hereinafter referred to as the file key), write the public key in the file key into the domain name, generate another DNS message, and store the private key in the file key in the device;

[0013] A2. Use existing technology to fill student information into the pdf certificate template;

[0014] When the school wants to issue a certificate, it will input the student information that needs to generate the certificate into this system. The system will use the existing java library itextpdf to fill the student information into the pdf certificate template generated by the Adobe tool, and generate certificate (pdf) files in batches;

[0015] A3. Read the school's Bitcoin wallet key from the device provided by the present invention, initiate a transaction, obtain the hash values ​​of all certificate files generated this time, and store the hash values ​​on the blockchain; use the existing Bitcoin blockchain technology to generate Chainpoint proofs for blocks; in specific implementation, use the python library chainpoint to generate Chainpoint proofs for blocks in the blockchain and add them to the metadata field of the certificate file. The Chainpoint proof is a Bitcoin blockchain proof that contains the root hash value of the merkle tree generated by all certificate hash values. It links the hash value of the data to the blockchain and returns a timestamp proof;

[0016] A4. Read the school's file key private key from the device, use this private key to encrypt each certificate file (using ECIES (elliptic curve integrate encrypt scheme) encryption algorithm in the specific implementation), then upload the encrypted certificate file to IPFS, and send the IPFS hash value to each certificate holder; specifically: upload it to the distributed file system IPFS, and obtain a file hash value returned by the IPFS system (hereinafter referred to as "IPFS hash value", which is the hash value corresponding to the file calculated by the IPFS network after the file is uploaded. The user can subsequently obtain this file directly from the IPFS network through this hash value, which is different from the certificate hash uploaded in Bitcoin transactions);

[0017] A5. The system sends an email containing the certificate file and the certificate IPFS hash value to each certificate holder.

[0018] B. The implementation method of certificate revocation is:

[0019] B1. Upload the certificate revocation record to the blockchain, and search for the certificate revocation record on the blockchain during verification to implement certificate revocation;

[0020] In order to solve the contradiction between the permanent storage of blockchain evidence and the need for certificate revocation, the present invention innovatively proposes a method of uploading the record of certificate revocation to the blockchain again, and searching for the record of certificate revocation from the blockchain during verification, thereby ensuring the safe withdrawal of certificates. The present invention provides three different ways of certificate revocation: withdrawing a single certificate, withdrawing all certificates issued in a transaction, and withdrawing all certificates ever issued by a Bitcoin wallet address. When a school needs to revoke a student's certificate, it first obtains the necessary information of the certificate. Depending on the certificate revocation method, the information is: the hash value of the certificate (revoke a single certificate), the transaction ID when the certificate was issued (revoke all certificates issued in a transaction), and the Bitcoin wallet address when the certificate was issued (revoke all certificates ever issued by a Bitcoin wallet address).

[0021] B2. After the school determines the withdrawal method and necessary information, it obtains the school's Bitcoin wallet address from the device, initiates a transaction containing relevant information of the certificate to be withdrawn, and stores the withdrawal information on the blockchain, thus achieving secure withdrawal of the certificate.

[0022] C. The method to obtain the certificate is:

[0023] C1. Students enter the IPFS hash value received in the email in step A5 into the system

[0024] C2. The system first downloads the encrypted certificate file from IPFS according to the IPFS hash value, then reads the DNS information of the school domain name to obtain the public key of the file key, and uses this public key to decrypt the file and download it to the user.

[0025] D. The implementation method of certificate verification is:

[0026] D1. When students need to present their certificates, they should send the certificates to a third party (such as a company or other recruiting organization);

[0027] D2. When the third-party company needs to verify the certificate, it uploads the certificate file to the system;

[0028] D3. Based on the certificate file, the system traverses the entire blockchain to query whether there is a record of issuance and revocation of the certificate. If there is no record of issuance of the certificate, it means that the certificate is forged; if there is a record of issuance of the certificate, but there is also a record of revocation of the certificate, it means that the certificate has been revoked and is currently invalid.

[0029] D4. If the certificate file has an issuance record on the blockchain and no withdrawal record, the system will further query the school's DNS information to verify whether the Bitcoin address provided in the issuer's DNS information is consistent with the actual transaction address, and determine whether the certificate is officially issued by the school;

[0030] D5. The system returns the verification result of the certificate and its issuer to the third party.

[0031] The present invention also provides a certificate issuance and verification system for implementing the above-mentioned blockchain-based school certificate issuance and verification method, including: a certificate issuance and verification device, a certificate generation and issuance module, a certificate revocation module and a certificate verification module; wherein:

[0032] The certificate issuance and verification device has been described in the previous text, and includes a storage module and a control module; the control module is used to interact with the outside world, encrypt the wallet and key information that the system needs to store and save them in the storage module, and read the information required by the outside world from the storage module and decrypt it before outputting it;

[0033] The certificate generation and issuance module is used to: read the Bitcoin wallet address and file key information from the device according to the student's information and certificate template, and generate a certificate file

[0034] The certificate revocation module is used to: read the Bitcoin wallet address and file key information, and initiate a transaction to revoke the certificate.

[0035] The certificate verification module is used to: read the uploaded certificate file and the information in the domain name DNS to verify whether the certificate uploaded by the user is authentic and valid.

[0036] Compared with the prior art, the present invention has the following beneficial effects:

[0037] The present invention implements a blockchain-based school certificate issuance and verification method, verification system and device, including the following improvements, innovations and technical effects:

[0038] (i) The system certificate format in the present invention uses the PDF file format, which is different from the original json file format certificate, that is, the system certificate is transformed from a text document format to a visual certificate, which expands the application scope of the system certificate;

[0039] (ii) The present invention stores the certificate file in the distributed file system IPFS, which can be read at any time and stored permanently, thereby improving the security and access efficiency of the certificate file;

[0040] (III) The present invention also adds an important function of authenticating the issuing authority, and designs a DNS verification method to verify the identity of the issuer, which can effectively prevent certificate forgery;

[0041] (iv) The present invention designs a new certificate revocation method, which changes the storage of revocation information from centralized storage to storage on the blockchain, ensuring the security of the revocation information and preventing it from being tampered with;

[0042] (V) The present invention also designs a device for storing school Bitcoin wallet keys and file key private key information to help publishers save important wallet and key information. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 It is a flowchart of the operation of the school certificate issuance and verification system based on blockchain provided by the present invention.

[0044] Figure 2 It is a flowchart of the certificate generation and issuance in the method of the present invention.

[0045] Figure 3 It is a flowchart of certificate revocation in the method of the present invention.

[0046] Figure 4 It is a flowchart of the certificate verification in the method of the present invention.

[0047] Figure 5 It is a schematic diagram of the process of certificate encryption and decryption in the method of the present invention;

[0048] That is, during the certificate issuance stage, the school encrypts the certificate when uploading it to the ipfs platform (step A4), and the student decrypts it when downloading the certificate (step A5).

[0049] Figure 6 It is a structural block diagram of the software and hardware modules of the blockchain-based school certificate issuance and verification system provided by the present invention.

[0050] Figure 7 It is a software system architecture block diagram of the present invention. DETAILED DESCRIPTION

[0051] The present invention will be further described below by way of embodiments in conjunction with the accompanying drawings, but the scope of the present invention is not limited in any way.

[0052] The present invention provides a blockchain-based school certificate issuance verification method, verification system and device, and the system use method includes: certificate generation and issuance process, certificate revocation process and certificate verification process; Figure 1 The figure shows the operation process of the school certificate issuance and verification system based on blockchain provided by the present invention. Figures 2 to 5 The following is a detailed flow chart of each of the above processes. Figure 6 The structure of the software and hardware modules of the blockchain-based school certificate issuance and verification system is shown. Figure 7 It is the software system architecture of the present invention.

[0053] The following is a description of the specific implementation of the present invention to provide a blockchain-based school certificate issuance verification method, verification system and device. In the blockchain-based school certificate issuance verification method:

[0054] During the certificate generation and issuance phase, the main process is as follows (such as Figure 2 ):

[0055] (1) The issuer prepares a PDF certificate template with form fields and a csv file that collects all student information, and generates certificate files in batches. csv stands for comma-separated values ​​(CSV, sometimes also called character-separated values, where the separator character may not be a comma). The specific student information contained in the csv file is shown in Table 1:

[0056] Table 1 csv file information

[0057]

[0058] (2) Generate a certificate. The system reads the content in the csv file, fills in the certificate file template, generates a certificate file in PDF format and stores it in the certificate storage path. At the same time, the Chainpoint python interface is used to generate a Chainpoint certificate for the block in the blockchain and add it to the metadata field of the certificate file. The Chainpoint here is the Bitcoin blockchain certificate, which contains the root hash value of the merkle tree generated by all certificate hash values. It links the hash of the data to the blockchain and returns a timestamp certificate.

[0059] (3) Issue the certificate. After the system runs the Bitcoin client locally and ensures that it can maintain communication with the nodes in the Bitcoin distributed network, it reads the school's Bitcoin wallet key from the device, accesses the Bitcoin wallet through JSON-RPC calls, records the certificate information in the transaction (Bitcoin transactions include transaction ID, input, output, and lock time. If you want to write additional data in the transaction, you need to add an OP_RETURN output to the output to record the relevant content), generates a transaction and broadcasts it to the blockchain network, so that it is permanently stored on the blockchain. After completion, the transaction ID of this transaction is returned, and the authentication information is written into the metadata field of the certificate file.

[0060] (4) Encrypted storage. The system reads the school’s file key private key from the device, uses this private key to encrypt the current certificate, uploads the encrypted certificate file to the IPFS file system, returns the certificate hash value, and sends the file and the file’s hash value to the student via email.

[0061] Figure 3 The figure shows the process of certificate revocation in the method of the present invention. In the certificate revocation stage, the system provides three modes of certificate revocation, namely, revoking a single certificate, revoking all certificates in a transaction, and revoking all certificates issued by a certain address. The main process is as follows:

[0062] (1) The issuer prepares the certificate information to be revoked in three different modes: the original certificate, the certificate transaction ID, and the certificate issuing address.

[0063] (2) The issuer fills in a configuration file, which is similar to the configuration file for issuing the certificate. The same Bitcoin address as when issuing the certificate needs to be used.

[0064] (3) The system reads the school's Bitcoin key from the device, uses the hash value, transaction ID or Bitcoin address of the certificate as the OP_Return value of the Bitcoin transaction, and publishes the revocation information to the blockchain network. This method ensures the security of revoking the certificate. Flexible selection of different revocation methods can improve the efficiency of the system and reduce the Bitcoin transaction cost of revoking the certificate.

[0065] The existing certificate revocation scheme (such as BlockCerts) adopts a method of centrally storing a list of revoked certificates in the server and performing comparison during verification. In the process of revoking such centralized storage certificates, information is easily tampered with and attacked. In order to solve this problem, the present invention also uploads the certificate revocation information to the blockchain. The uploaded content is the version number + operator indicating revocation + hash value of the revoked certificate / revoked transaction address / revoked Bitcoin address, which is the same as issuing the certificate. The transaction is recorded on the blockchain using the information note function of Bitcoin. The certificate verification process of the certificate revocation method of the present invention is also different from the prior art. The existing certificate verification technology can stop when finding the transaction of issuing the certificate while traversing the blockchain, while the certificate verification in the present invention needs to traverse to the latest generated block to prevent the occurrence of revoked transactions later. Such a processing method makes it possible to effectively improve security performance.

[0066] Figure 4 The figure shows the process of certificate verification in the method of the present invention. In the certificate authentication stage, there are the following processes:

[0067] (1) The system reads and removes the Chainpoint proof in the PDF metadata field and calculates the hash value of the original PDF.

[0068] (2) Perform certificate verification. After reading the transaction ID, hash value, and merkle root contained in the Chainpoint proof information, the system queries all OP_Return transaction outputs of the certificate issuance address in the blockchain network, which are divided into transactions before issuance and transactions after issuance. The following situations may cause a certificate to be false: finding a transaction indicating the withdrawal of this certificate, the hash value of the current PDF file is different from the hash value recorded at the time of issuance, the merkle root is different, the certificate is expired, and other different types. If the certificate is false, the certificate is returned to be false and the reason. If the transaction has not been withdrawn, the hash value and other information are consistent with those on the blockchain, and before the expiration date, the certificate is true.

[0069] (3) If the certificate verification is successful, the issuer identity verification will proceed. The system obtains the domain name of the issuer from the metadata field of the certificate file, queries the DNS resolution record (you can directly run the command 'dig+domain name+any@8.8.8.8' in the command line to access the DNS resolution information), queries the resolution record of this domain name in the DNS, obtains the resolution record result, and compares the transaction address recorded in the current file metadata field with the resolution record. If the two addresses match, the issuer identity authentication is successful.

[0070] (4) If the identity of the issuer is also verified successfully, the returned certificate is true, otherwise it is false.

[0071] It should be noted that the purpose of publishing the embodiments is to help further understand the present invention, but those skilled in the art can understand that various substitutions and modifications are possible without departing from the scope of the present invention and the appended claims, including the use of different blockchains, programming languages ​​and library functions, encryption algorithms, PDF tools, etc. Therefore, the present invention should not be limited to the contents disclosed in the embodiments, and the scope of protection claimed by the present invention shall be subject to the scope defined in the claims.

Claims

1. A blockchain-based school certificate issuance and verification method, which stores the verification and revocation related information of the school certificate on the blockchain, and stores the original school certificate in a distributed file system; the certificate is withdrawn by "re-issuing to the blockchain"; for institutional identity authentication, the DNS domain name system authentication method is designed to achieve automated and unforgeable identity authentication; the blockchain-based school certificate issuance and verification method includes: The certificate generation and issuance process, certificate revocation process and certificate verification process include the following specific steps: A. The implementation of certificate generation and issuance includes: A1. The school registers a Bitcoin wallet and obtains the Bitcoin wallet key and Bitcoin wallet address; The device is designed to include a storage module and a control module; the control module is used to encrypt the bitcoin wallet key information required for the school certificate issuance verification and save it to the storage module; and read the information required for the school certificate issuance verification from the storage module and output it after decryption; The Bitcoin wallet key is stored in the device, and the Bitcoin wallet address is stored in a domain name system DNS controlled by the school; the resolution information of the domain name system DNS is used for certificate verification; the DNS resolution information is publicly accessible to all, but only the school that owns the domain name can modify the domain name resolution information; Then generate another pair of file keys for encrypting the certificate file. This pair of file keys includes a public key and a private key. Write the public key in the file key into the domain name to generate another DNS information; store the private key in the file key in the device; A2. When the school wants to issue certificates, it uses the itextpdf of the java library to fill the student information that needs to generate certificates into the pdf certificate template and generate certificate files in batches; A3. Read the school's Bitcoin wallet key from the device, initiate a transaction, obtain the hash value of all certificate files generated this time, and store the hash value on the blockchain; Generate a Chainpoint certificate for a block in the blockchain using chainpoint and add it to the metadata field of the certificate file; the Chainpoint certificate is a Bitcoin blockchain certificate that contains the root hash value of the merkle tree generated by all certificate hash values, which is used to link the hash value of the data to the blockchain and return a timestamp certificate; A4. Read the school's file key private key from the device, use the private key to encrypt each certificate file using the integrated encryption scheme ECIES, upload it to the distributed file system IPFS, obtain a file hash value returned by the IPFS system, i.e., the IPFS hash value; and send the IPFS hash value to each certificate holder; A5. Send an email containing the certificate file and the certificate IPFS hash value to each certificate holder; the certificate IPFS hash value can be used to download the certificate file; during the download process, first download the encrypted certificate file from IPFS according to the certificate IPFS hash value, then read the DNS information of the school domain name to obtain the public key of the file key, and use this public key to decrypt the file and download it to the user; B. The implementation of certificate revocation includes: B1. When it is necessary to revoke a student's certificate, first obtain the necessary information of the certificate to be revoked; depending on the withdrawal method, the information is the hash value of the certificate, the transaction ID when the certificate was issued, or the Bitcoin wallet address when the certificate was issued; B2. Obtain the school's Bitcoin wallet address from the device, initiate a transaction containing relevant information of the certificate to be withdrawn, and store the withdrawal information on the blockchain; when verifying the certificate, find out whether there is withdrawal information corresponding to the certificate on the blockchain, solve the contradiction between the permanent storage of blockchain certificates and the certificate withdrawal requirements, and ensure the safe withdrawal of certificates; C. Implementation of certificate verification includes: C1. Students send the certificate documents to a third party when they need to produce the certificate; C2. When a third party needs to verify the certificate, it obtains the certificate PDF; C3. Traverse the blockchain based on the certificate pdf to check whether there is a record of issuance and withdrawal of the certificate; C4. Query the school’s DNS information and verify whether the Bitcoin address provided in the DNS information is consistent with the actual transaction address, thereby determining whether the certificate is officially issued by the school; C5. Return the verification result of the certificate and its issuer; Through the above process, blockchain-based school certificate issuance verification is achieved.

2. The blockchain-based school certificate issuance and verification method as claimed in claim 1, characterized in that: Put the Bitcoin wallet address and file key public key in the domain name resolution record to realize certificate verification; specifically, put the Bitcoin wallet address and file key public key in the text domain of DNS, save the DNS information in the certificate, read the DNS information from the certificate during verification, and use the dig command to query and compare whether the file sending address is consistent with the actual institution address, so as to realize certificate verification.

3. The blockchain-based school certificate issuance and verification method as claimed in claim 1 is characterized in that the certificate The withdrawal methods include: withdrawing a single certificate, withdrawing all certificates issued in a transaction, and withdrawing all certificates ever issued by a Bitcoin wallet address. When the school needs to withdraw a student's certificate, it first obtains the necessary information of the certificate. When revoking a single certificate, the necessary information to obtain the certificate is: the hash value of the certificate; When revoking all certificates issued by a transaction, the necessary information to obtain the certificate is: the transaction ID when the certificate was issued; When revoking all certificates that have ever been issued by a Bitcoin wallet address, the necessary information to obtain the certificate is: the Bitcoin wallet address when the certificate was issued.

4. The blockchain-based school certificate issuance and verification method as claimed in claim 1, characterized in that: In A1, the encryption and decryption algorithm adopted by the device is specifically the RSA algorithm.

5. The blockchain-based school certificate issuance and verification method as described in claim 1 is characterized in that, in A4, the IPFS hash value is the hash value corresponding to the file calculated by the IPFS network after the file is uploaded, which can be used for subsequent file acquisition.

6. A school certificate issuance and verification system based on blockchain, used to implement the school certificate issuance and verification method based on blockchain as claimed in claim 1, characterized in that: The certificate issuance and verification system comprises: a certificate issuance and verification device, a certificate generation and issuance module, a certificate revocation module and a certificate verification module; wherein: The certificate issuance and verification device includes a storage module and a control module; the control module is used to interact with the outside world, encrypt the wallet and key information that the system needs to store and save them in the storage module, and read the information required by the outside world from the storage module and output it after decryption; The certificate generation and issuance module is used to: read the Bitcoin wallet address and file key information from the device according to the student's information and certificate template, and generate a certificate file; The certificate revocation module is used to: read the Bitcoin wallet address and file key information, and initiate a transaction to revoke the certificate; The certificate verification module is used to: read the uploaded certificate file and the information in the domain name DNS to verify whether the certificate uploaded by the user is authentic and valid.

7. A school certificate issuance and verification device based on blockchain, used to implement the school certificate issuance and verification method based on blockchain as claimed in claim 1, characterized in that: The device is used to store and read key information, and includes a storage module and a control module; The control module is used to encrypt the wallet key information needed to be stored by the school certificate issuance and verification system and save it to the storage module, and to read the information needed by the school certificate issuance and verification system from the storage module and output it after decryption.

8. The blockchain-based school certificate issuance and verification device as claimed in claim 7, characterized in that: The encryption and decryption algorithm of the device uses the RSA algorithm.

Images