A multi-tenant intensive trusted timestamp service system and implementation method

Abstract

The application relates to the field of information technology, and particularly discloses a multi-tenant intensive trusted timestamp service system and an implementation method, which comprises a service resource module, a service agent module and a service supervision module; the service resource module is used for fully utilizing the computing resources and computing capacity of a certain number of different timestamp server devices to provide trusted timestamp services for tenants; the service agent module is used for forwarding a tenant timestamp request to a designated timestamp server device and then returning generated timestamp data to the tenant; and the service supervision module is used for registering and monitoring device resources and configuring a timestamp key and a digital certificate for each tenant. The application manages the computing resources and computing capacity of multiple timestamp server devices in an intensive manner, which not only provides tenants on the service demand side with high-availability trusted timestamp services with performance capable of elastic expansion, but also improves the overall resource utilization efficiency of devices on the service supply side, effectively reduces hardware investment cost and operation and maintenance cost.

Description

Technical Field

[0001] This invention relates to the field of information technology, specifically to a multi-tenant centralized and trusted timestamp service system and its implementation method. Background Technology

[0002] An electronic signature refers to data contained or attached in electronic form within any data message to identify the signatory and indicate their approval of the content. A digital signature, a form of electronic signature, is the result of signing an electronic document with a digital certificate and retaining the signature on the document. It proves the signatory's intent and ensures the authenticity, integrity, and non-repudiation of the electronic information. However, this only addresses the content (What) and the signatory's identity (Who). As long as the user possesses the private key, they can issue a signature at any time. The aforementioned technology cannot objectively and effectively prove the time when the electronic data was signed. Current trusted timestamp services bind the hash value of the user's electronic data to an authoritative time source and, based on this, generate an unforgeable timestamp file using the cryptographic devices of a timestamp server. This effectively, objectively, and reliably solves the problems of when the electronic data was signed (When) and the integrity of the content.

[0003] In various fields such as e-government, finance and insurance, and healthcare, in order to address the problems of easily tampered content and time of electronic data, low evidentiary value, and difficulty in providing evidence for parties involved in various electronic data voucher applications, each unit / institution usually deploys timestamp server equipment locally according to actual needs. Then, by exclusively using the trusted timestamp service resources provided by the equipment, they issue non-repudiable and tamper-proof electronic certificates, which can effectively prove the integrity of the time and content of electronic data.

[0004] However, the traditional application model of having exclusive access to timestamp server equipment resources for an organization / unit has the following problems:

[0005] 1) When the demand for trusted timestamp services exceeds the maximum service capacity that the timestamp server equipment can provide, it is often necessary to increase the equipment hardware resources, which inevitably increases the hardware investment cost and operation and maintenance management cost.

[0006] 2) When the demand for trusted timestamp services is low, resources are wasted because the computing resources and computing power of server equipment cannot be fully utilized.

[0007] 3) Different organizations obtain timestamp data by directly connecting to their locally deployed timestamp server devices. Malicious attackers can listen to or tamper with timestamp data through man-in-the-middle attacks.

[0008] To address the aforementioned issues, this invention provides a multi-tenant centralized trusted timestamp service system and its implementation method. Summary of the Invention

[0009] This invention proposes a multi-tenant centralized trusted timestamp service system and its implementation method to solve the problems raised in the background art.

[0010] To achieve the above objectives, the present invention provides the following technical solution: a multi-tenant centralized and trusted timestamp service system, the system comprising a system service resource module, a service proxy module, and a service supervision module;

[0011] 1) The service resource module is used to fully share and utilize the computing resources and computing power of a certain number of different timestamp server devices to provide trusted timestamp services for each tenant;

[0012] The service resource module includes several timestamp server devices. In order to better manage, fully share and utilize the computing resources and computing power of each device, and maximize the signing and stamping service capabilities, all timestamp server devices in the service resource module must support the configuration of multiple timestamp signing and stamping keys and corresponding digital certificates.

[0013] 2) The service proxy module includes an identity authentication unit, a key storage configuration retrieval unit, and a proxy forwarding unit, wherein:

[0014] The identity authentication unit is used to authenticate the timestamp signature requests sent by each tenant application.

[0015] The key storage configuration retrieval unit is used to retrieve the corresponding key storage information from the key storage configuration table based on the timestamp signature key identifier number bound to the tenant.

[0016] The proxy forwarding unit is used to forward the timestamp signing request to a timestamp server device in the service resource module to generate a trusted timestamp according to the load balancing algorithm; the timestamp signing request includes the electronic data to be signed and the storage location of the tenant signing key.

[0017] 3) The service supervision module includes a tenant registration unit, a key configuration unit, a device registration unit, and a resource monitoring unit, wherein:

[0018] The tenant registration unit is used to register tenant identities and generate identity (AppID+AppSecret) information for each tenant's application. This information is used for the identity authentication unit in the aforementioned service proxy module.

[0019] The key configuration unit is used to import the signature key and digital certificate into several timestamp server devices according to the key multi-copy storage mechanism, and bind the timestamp signature key to multiple tenants.

[0020] The device registration unit is used to register timestamp server devices and configure device certificates for them;

[0021] The resource monitoring unit is used to monitor the operating status of each timestamp server device in the above-mentioned service resource module.

[0022] As a preferred embodiment of the present invention, the key storage configuration table is used to store the timestamp signature key storage information bound to each tenant, specifically including the tenant number TID, the signature key identifier KeyID, and the actual storage information of the tenant's signature key in several timestamp server devices.

[0023] A method for implementing a multi-tenant, centralized, and trusted timestamp service, the method comprising:

[0024] Step S310: Register the timestamp server device and incorporate it into the service resource module for centralized management;

[0025] Step S320: Create a tenant for the organization / unit based on its information, and generate an identity for the tenant's application.

[0026] Step S330: Configure the tenant's timestamp signing key and digital certificate, and then import the signing key and digital certificate into the key storage medium of several timestamp server devices based on the key multi-copy storage mechanism;

[0027] Step S340: Authenticate the timestamp signature request sent by the tenant application, and then retrieve the key storage information bound to the tenant from the key storage configuration table;

[0028] Step S350: Obtain the resource load status of several target timestamp server devices based on the key storage information, select one of the devices through a load balancing algorithm, and then forward the timestamp signing request to the device to generate trusted timestamp data;

[0029] Step S360: The timestamp server device returns the generated timestamp data to the service proxy module, and the service proxy module returns it to the tenant application.

[0030] In a preferred embodiment of the present invention, the method involves a service proxy module and a service monitoring module interacting with a registered timestamp server device based on a secure communication mechanism. The specific implementation of the secure communication mechanism includes:

[0031] 1) Ensure the confidentiality and integrity of communication data through the TLS (Transport Layer Security) protocol;

[0032] 2) Generate a message authentication code for communication data through the MAC algorithm. The two communication entities can verify the correctness of the message authentication code, thereby ensuring the authenticity, integrity, and non-repudiation of communication data.

[0033] As a preferred implementation scheme of the present invention, in the method, the process of configuring the timestamp signing key and digital certificate of the tenant and then importing the signing key and digital certificate into the key storage media of several timestamp server devices based on the key multi-copy storage mechanism includes:

[0034] 1) The key configuration unit randomly requests a certain timestamp server device incorporated into the service resource module to generate an SM2 key pair;

[0035] 2) The key configuration unit obtains the SM2 key pair and key storage information generated by the device, and requests the CA institution to issue a digital certificate;

[0036] 3) The key configuration unit obtains the digital certificate from the CA institution and imports it into the original device;

[0037] 4) The key configuration unit selects n devices through the key multi-copy storage mechanism according to the key storage capacity of the current m - 1 timestamp server devices, and then imports the SM2 private key and digital certificate into the key storage media of the n devices, where n < m - 1, n represents the number of key copies, and m is the number of timestamp server devices running in the current service resource module;

[0038] 5) The key configuration unit obtains the key storage information returned by the n devices and stores it in the key storage configuration table.

[0039] As a preferred implementation scheme of the present invention, the process of retrieving the key storage information bound to the tenant from the key storage configuration table in the method includes:

[0040] 1) The key storage configuration retrieval unit queries the signing key number KeyID bound to the tenant according to the tenant identification number TID to which the tenant application belongs;

[0041] 2) The key storage configuration retrieval unit queries the key storage information from the key storage configuration table according to the signing key number KeyID and sends the key storage information to the proxy forwarding unit.

[0042] As a preferred embodiment of the present invention, the method includes obtaining the resource load status of several target timestamp server devices based on the key storage information, selecting one of the devices through a load balancing algorithm, and then forwarding the timestamp signing request to the device to generate trusted timestamp data, comprising:

[0043] 1) The proxy forwarding unit obtains the resource load status of the target n timestamp server devices based on the key storage information, and selects the timestamp server device D with the best current resources through a load balancing algorithm. j ;

[0044] 2) The service proxy module stores the key in the KeyIndex location. Dj The electronic data to be signed is packaged into a timestamp signing request in HTTP protocol format and sent to the device D. j .

[0045] 3) The device D j Obtain the timestamp signature request and determine the key storage location (KeyIndex) from it. Dj Retrieve the locally stored timestamp signature key, and then use the key in conjunction with a trusted time source to generate timestamp data.

[0046] As a preferred embodiment of the present invention, the process in which the timestamp server device returns the generated timestamp data to the service proxy module, and the service proxy module returns it to the tenant application, specifically involves protocol conversion technology, that is, returning the generated timestamp data to the tenant application in the original standard protocol format.

[0047] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention transforms the traditional application model of a single unit / organization having exclusive access to timestamp server equipment resources into a multi-tenant application model where multiple organizations share a set of timestamp server equipment resources. This model adopts an intensive approach to manage the computing resources and computing power of multiple timestamp server devices. This not only provides highly available and elastically scalable trusted timestamp services for the service demand side, but also improves the overall resource utilization efficiency of the service supply side equipment, effectively reducing hardware investment costs and operation and maintenance costs. At the same time, the system also adopts a data isolation mechanism to configure different timestamp signing keys and digital certificates for each tenant (organization), meeting the personalized trusted timestamp needs of tenants (organizations). Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention.

[0049] Figure 1 This is an architecture diagram of a multi-tenant centralized trusted timestamp service system proposed in this invention;

[0050] Figure 2 This is a schematic flowchart illustrating a method for implementing a multi-tenant centralized trusted timestamp service according to an embodiment of the present invention.

[0051] Figure 3 This is a schematic diagram of a model for configuring tenant timestamp signature keys;

[0052] Figure 4 This is a timing diagram illustrating the configuration of the tenant timestamp signature key;

[0053] Figure 5 This is a schematic diagram of the trusted timestamp signature service provided by the present invention;

[0054] Figure 6 This is a timing diagram of the trusted timestamp signing service provided by the present invention. Detailed Implementation

[0055] To make the technical problems to be solved, the technical solutions, and the beneficial effects of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present invention and are not intended to limit the present invention.

[0056] Please see Figures 1-6 This invention provides a multi-tenant centralized trusted timestamp service system and its implementation method.

[0057] To make the above-mentioned features and advantages of the present invention more apparent and understandable, specific examples are given below, and detailed descriptions are provided in conjunction with the accompanying drawings:

[0058] Reference Figure 1 , Figure 1 This is a reference to an embodiment of the present invention. Figure 1 The multi-tenant centralized trusted timestamp service system proposed in this invention includes: a service resource module, a service proxy module, and a service supervision module, wherein:

[0059] 1) The service resource module is used to fully share and utilize the computing resources and computing power of a certain number of different timestamp server devices to provide trusted timestamp services to each tenant;

[0060] The service resource module includes several timestamp server devices. In order to better manage, fully share and utilize the computing resources and computing power of each device, and maximize the signing and stamping service capabilities, all timestamp server devices in the service resource module must support the configuration of multiple timestamp signing and stamping keys and corresponding digital certificates.

[0061] 2) The service proxy module includes an identity authentication unit, a key storage configuration retrieval unit, and a proxy forwarding unit, wherein:

[0062] The identity authentication unit is used to authenticate the timestamp signature requests sent by each tenant application.

[0063] The key storage configuration retrieval unit is used to retrieve the corresponding key storage information from the key storage configuration table based on the timestamp signature key identifier number bound to the tenant.

[0064] Furthermore, the key storage configuration table is used to store the timestamp signature key storage information bound to each tenant, specifically including the tenant number TID, signature key identifier KeyID, and the actual storage information of the tenant's signature key in several timestamp server devices;

[0065] The proxy forwarding unit is used to forward the timestamp signing request to a timestamp server device in the service resource module to generate a trusted timestamp according to the load balancing algorithm; the timestamp signing request includes the electronic data to be signed and the storage location of the tenant's signing key.

[0066] 3) The service supervision module includes a tenant registration unit, a key configuration unit, a device registration unit, and a resource monitoring unit, wherein:

[0067] The tenant registration unit is used to register tenant identities and generate identity (AppID+AppSecret) information for each tenant's application. This information is used for the identity authentication unit in the aforementioned service proxy module.

[0068] The key configuration unit is used to import the signature key and digital certificate into several timestamp server devices according to the key multi-copy storage mechanism, and bind the timestamp signature key to multiple tenants.

[0069] The device registration unit is used to register timestamp server devices and configure device certificates for them;

[0070] The resource monitoring unit is used to monitor the operating status of each timestamp server device in the above-mentioned service resource module.

[0071] Reference Figure 2This embodiment also provides a method for implementing a multi-tenant centralized trusted timestamp service, which includes the following steps:

[0072] Step S310: Register the timestamp server device and incorporate it into the service resource module for centralized management;

[0073] Step S320: Create a tenant for the organization / unit based on its information, and generate an identity for the tenant's application.

[0074] Step S330: Configure the tenant's timestamp signing key and digital certificate, and then import the signing key and digital certificate into the key storage medium of several timestamp server devices based on the key multi-copy storage mechanism;

[0075] Step S340: Authenticate the timestamp signature request sent by the tenant application, and then retrieve the key storage information bound to the tenant from the key storage configuration table;

[0076] Step S350: Obtain the resource load status of several target timestamp server devices based on the key storage information, select one of the devices through a load balancing algorithm, and then forward the timestamp signing request to the device to generate trusted timestamp data;

[0077] Step S360: The timestamp server device returns the generated timestamp data to the service proxy module, and the service proxy module returns it to the tenant application.

[0078] Figure 3 and Figure 4 These are schematic model diagrams and timing diagrams of step S330 in a multi-tenant centralized trusted timestamp service implementation method according to an embodiment of the present invention, wherein the key multi-copy storage mechanism is preset to a three-copy storage technology, and the specific process is as follows:

[0079] 1) The operation and maintenance administrator sends a tenant signature key configuration request to the key configuration unit. The key configuration unit randomly selects a timestamp server device D1 running in the current service resource module and sends a request to it to obtain a timestamp key pair.

[0080] 2) The device D1 randomly generates an SM2 key pair and returns it to the key configuration unit;

[0081] 3) The key configuration unit requests a digital certificate from a CA authority based on the obtained SM2 public key and imports the certificate into the original device D1;

[0082] 4) Device D1 returns the key storage information corresponding to the SM2 key to the key configuration unit;

[0083] 5) The key configuration unit selects two timestamp server devices D2 and D3 according to the key storage capacity of the M-1 timestamp server devices currently in operation, through the key multi-copy storage mechanism, and imports the SM2 private key and digital certificate into devices D2 and D3, where M is the total number of timestamp server devices currently in operation in the service resource module;

[0084] 6) Devices D2 and D3 respectively return the corresponding key storage information to the key configuration unit;

[0085] 7) The key configuration unit stores the tenant number, the key storage information of the devices D2 and D3, and the signature key identifier KeyID in the key storage configuration table, and then returns a message that the tenant signature key has been successfully configured.

[0086] The process of importing the aforementioned digital certificate includes two scenarios:

[0087] 1) After the CA successfully issues the digital certificate, the key configuration unit imports the digital certificate and the signature key (SM2 private key) into the key storage medium of each server device through the key multi-copy storage mechanism.

[0088] 2) When the CA has not yet completed the issuance of the digital certificate, the signing key (SM2 private key) is first imported into the key storage medium of each server device through the key multi-copy storage mechanism. Then, after the CA successfully issues the digital certificate, the certificate is imported into each server device.

[0089] Figure 5 and Figure 6 These are schematic model diagrams and timing diagrams of steps S340-360 in a multi-tenant centralized trusted timestamp service implementation method according to an embodiment of the present invention. The specific process is as follows:

[0090] 1) The tenant application sends an identity authentication request to the service proxy module, and the identity authentication unit performs the identity authentication operation. When the identity authentication operation is successful, the identity authentication unit returns a valid token to the tenant application.

[0091] 2) The tenant application packages the token and timestamp signature request and sends it to the service broker module. The key storage configuration retrieval unit then queries the corresponding key storage information from the key storage configuration table based on the tenant number T2 to which the tenant application belongs. This information specifically includes D. i &KeyIndex Di ,i∈[1,3], where D i KeyIndex is the device number of several timestamp server devices that actually store the tenant's signature key. Di This refers to the actual location where the key is stored.

[0092] 3) The key storage information described by the key storage configuration retrieval unit is sent to the proxy forwarding unit;

[0093] 4) The proxy forwarding unit, based on the received device number D i ,i∈[1,3] to obtain the corresponding device resource load, and select the timestamp server device D2 with the best current resources through the load balancing algorithm;

[0094] 5) The proxy forwarding unit stores the electronic data to be signed and the key location KeyIndex. D2 The request is packaged into a timestamp signature request using the HTTP protocol format and sent to the device D2.

[0095] 6) The device D2 stores the obtained key in the KeyIndex location. D2 Retrieve the locally stored SM2 private key, use the SM2 private key to generate trusted timestamp data, and finally return the generated timestamp data to the proxy forwarding unit;

[0096] 7) The proxy forwarding unit returns the timestamp data to the tenant application in the original standard protocol format.

[0097] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0098] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A multi-tenant, centralized, and trusted timestamp service system, characterized in that, The system includes a system service resource module, a service proxy module, and a service supervision module. 1) The service resource module is used to fully share and utilize the computing resources and computing power of a certain number of different timestamp server devices to provide trusted timestamp services to each tenant; The service resource module includes several timestamp server devices, and all timestamp server devices in the service resource module must support the configuration of multiple timestamp signature keys and corresponding digital certificates. 2) The service proxy module includes an identity authentication unit, a key storage configuration retrieval unit, and a proxy forwarding unit, wherein: The identity authentication unit is used to authenticate the timestamp signature requests sent by each tenant application. The key storage configuration retrieval unit is used to retrieve the corresponding key storage information from the key storage configuration table based on the timestamp signature key identifier number bound to the tenant. The proxy forwarding unit is used to forward the timestamp signing request to a timestamp server device in the service resource module to generate a trusted timestamp according to the load balancing algorithm; the timestamp signing request includes the electronic data to be signed and the storage location of the tenant signing key. 3) The service supervision module includes a tenant registration unit, a key configuration unit, a device registration unit, and a resource monitoring unit, wherein: The tenant registration unit is used to register tenant identities and generate identity (AppID+AppSecret) information for each tenant's application. This information is used for the identity authentication unit in the aforementioned service proxy module. The key configuration unit is used to import the signature key and digital certificate into several timestamp server devices according to the key multi-copy storage mechanism, and bind the timestamp signature key to multiple tenants. The device registration unit is used to register timestamp server devices and configure device certificates for them; The resource monitoring unit is used to monitor the operating status of each timestamp server device in the above-mentioned service resource module.

2. The multi-tenant centralized trusted timestamp service system according to claim 1, characterized in that, The key storage configuration table is used to store the timestamp signature key storage information bound to each tenant, specifically including the tenant number TID, signature key identifier KeyID, and the actual storage information of the tenant's signature key in several timestamp server devices.

3. A method for implementing a multi-tenant, centralized, and trusted timestamp service based on any one of claims 1-2, characterized in that, The method includes: Step S310: Register the timestamp server device and incorporate it into the service resource module for centralized management; Step S320: Create a tenant for the organization / unit based on its information, and generate an identity for the tenant's application. Step S330: Configure the tenant's timestamp signing key and digital certificate, and then import the signing key and digital certificate into the key storage medium of several timestamp server devices based on the key multi-copy storage mechanism; Step S340: Authenticate the timestamp signature request sent by the tenant application, and then retrieve the key storage information bound to the tenant from the key storage configuration table; Step S350: Obtain the resource load status of several target timestamp server devices based on the key storage information, select one of the devices through a load balancing algorithm, and then forward the timestamp signing request to the device to generate trusted timestamp data; Step S360: The timestamp server device returns the generated timestamp data to the service proxy module, and the service proxy module returns it to the tenant application end.

4. The method for implementing a multi-tenant centralized and trusted timestamp service according to claim 3, characterized in that, In the method, the service proxy module and the service supervision module perform data interaction with the registered timestamp server device based on a secure communication mechanism. The specific implementation of the secure communication mechanism includes: 1) Ensure the confidentiality and integrity of communication data through the TLS (Transport Layer Security) protocol. 2) Generate a message authentication code for the communication data through the MAC algorithm, and both communication entities verify the correctness of the message authentication code.

5. The method for implementing a multi-tenant centralized trusted timestamp service according to claim 4, characterized in that, In the method, the process of configuring the timestamp signing key and digital certificate of the tenant and then importing the signing key and digital certificate into the key storage media of several timestamp server devices based on the key multi-copy storage mechanism includes: 1) The key configuration unit randomly requests a certain timestamp server device included in the service resource module to generate an SM2 key pair. 2) The key configuration unit obtains the generated SM2 key pair and key storage information of the device, and requests the CA institution to issue a digital certificate. 3) The key configuration unit obtains the digital certificate from the CA institution and imports it into the original device. 4) The key configuration unit selects n devices through the key multi-copy storage mechanism according to the key storage capacity of the current m - 1 timestamp server devices, and then imports the SM2 key pair and digital certificate into the key storage media of the n devices, where n < m - 1, n represents the number of key copies, and m is the number of timestamp server devices running in the current service resource module. 5) The key configuration unit obtains the key storage information returned by the n devices and stores it in the key storage configuration table.

6. The method for implementing a multi-tenant centralized trusted timestamp service according to claim 5, characterized in that, In the method, the process of retrieving the key storage information bound to the tenant from the key storage configuration table includes: 1) The key storage configuration retrieval unit queries the signing key number KeyID bound to the tenant according to the tenant identification number TID to which the tenant application belongs. 2) The key storage configuration retrieval unit queries the key storage information from the key storage configuration table according to the signing key number KeyID and sends the key storage information to the proxy forwarding unit.

7. The method for implementing a multi-tenant centralized trusted timestamp service according to claim 6, characterized in that, In the method, the process of obtaining the resource load conditions of the target several timestamp server devices according to the key storage information, selecting one of the devices through the load balancing algorithm, and then forwarding the timestamp signing request to the device to generate trusted timestamp data includes: 1) The proxy forwarding unit obtains the resource load status of the target n timestamp server devices based on the key storage information, and selects the timestamp server device with the best current resources through a load balancing algorithm. ; 2) The service proxy module stores the key location. The electronic data to be signed is packaged into a timestamp signing request in HTTP protocol format and sent to the device. ; 3) The device Obtain the timestamp signature request and determine the key storage location within it. Retrieve the locally stored timestamp signature key, and then use the key in conjunction with a trusted time source to generate timestamp data.

8. The method for implementing a multi-tenant centralized trusted timestamp service according to claim 7, characterized in that, In the method, the process that the timestamp server device returns the generated timestamp data to the service proxy module and the service proxy module returns it to the tenant application end specifically involves protocol conversion technology, that is, returning the generated timestamp data to the tenant application end in the original standard protocol format.

Images