Blockchain-based certificate generation management method, device, equipment and storage medium

Abstract

The application provides a blockchain-based certificate generation management method, device, equipment and storage medium. The method comprises the following steps: in response to a certificate generation instruction, generating at least one certificate information block; in response to a certificate chaining instruction, performing hash calculation on valid certificate information blocks, and putting the valid certificate information blocks and corresponding first hash values into a first block to perform a first chaining operation; in response to a certificate management instruction, generating an initial operation information block; in response to a management chaining instruction, performing hash calculation on valid initial operation information blocks, and putting the valid initial operation information blocks and corresponding second hash values into a second block to perform a second chaining operation; the related data information of an electronic certificate can be stored in a blockchain, and the issuance and management of the electronic certificate for an enterprise or an individual can be performed, so that the electronic certificate in the blockchain is ensured to be unchangeable, unforgeable, long-term stored and improved in issuance efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of blockchains, and in particular to a certificate generation management method and device based on a blockchain, a certificate generation management equipment and a storage medium. BACKGROUND

[0002] Blockchain technology is a distributed ledger technology that connects data blocks in order and uses cryptography to ensure that the data blocks are not tampered with and cannot be forged. The technical solution based on a blockchain can be used to solve the problem of trust, realize the free transfer of information and value, and has been applied in the fields of digital currency, asset transaction, digital government affairs, evidence storage and anti-counterfeiting. With the development of science and technology, electronic certificates are beneficial to simplifying the process of certificate handling and issuance, improving the efficiency of various work related to certificates, and realizing long-term storage, preventing fake certificates, and facilitating the query and verification of certificates. These features that electronic certificates need to achieve are consistent with the technical characteristics of a blockchain. Therefore, electronic certificates can be written into a blockchain to achieve the purpose of being unchangeable, unforgeable and long-term storage in the blockchain.

[0003] Based on the above background, how to store the relevant data information of electronic certificates in a blockchain, and how to improve the efficiency of the issuance of electronic certificates by the issuing authority on enterprises or individuals on the blockchain are problems that need to be solved. SUMMARY

[0004] The present application provides a certificate generation management method and device based on a blockchain, which can store the relevant data information of electronic certificates in a blockchain, manage the issuance of electronic certificates to enterprises or individuals, ensure that electronic certificates are unchangeable, unforgeable and long-term storage in the blockchain, and improve the efficiency of the issuance of electronic certificates.

[0005] In a first aspect, the present application provides a certificate generation management method based on a blockchain, comprising: in response to a certificate generation instruction, generating at least one certificate information block, each certificate information block comprising certificate information in the certificate generation instruction, an issuing authority public key obtained by querying, and a first signature obtained by encrypting the certificate information and the issuing authority public key using an issuing authority private key in the certificate generation instruction;

[0006] In response to a certificate chaining instruction, verifying that the issuing authority public key in each certificate information block is legal, and determining whether the certificate information block is valid using the issuing authority public key and the first signature;

[0007] Hash calculating the valid certificate information block, and putting the valid certificate information block and the corresponding first hash value into a first block for a first chaining operation;

[0008] In response to the certificate management instruction, a target certificate information block meeting a management condition is queried and read, and a certificate authority public key and a corresponding first hash value in the target certificate information block are encrypted by using a certificate authority private key in the certificate management instruction to obtain a second signature;

[0009] An initial operation information block is generated according to the first hash value corresponding to the target certificate information block, the second signature, an operation category of the certificate management instruction, and a certificate management object number in the certificate management instruction;

[0010] In response to the management chaining instruction, each initial operation information block to be chained is determined, and a corresponding signature in each initial operation information block to be chained is decrypted by using a certificate authority public key in the corresponding target certificate information block to determine whether each initial operation information block to be chained is valid;

[0011] The valid initial operation information block is subjected to hash calculation, and the valid initial operation information block and a corresponding second hash value are put into a second block for a second chaining operation.

[0012] Optionally, the certificate management instruction includes a certificate issuance instruction and a certificate revocation instruction, and the management condition is that a certificate information block is generated and has not been issued.

[0013] When the certificate management instruction is the certificate issuance instruction, the operation category is issuance, and the certificate management object number in the operation information block is a certificate issuance object number.

[0014] When the certificate management instruction is the certificate revocation instruction, the operation category is deletion, and the certificate management object number in the operation information block is empty.

[0015] Optionally, the method further includes:

[0016] In response to a state change instruction, a latest target operation information block corresponding to a certificate information to be changed in state is determined.

[0017] A certificate authority public key corresponding to the target operation information block and a second hash value in the target operation information block are encrypted by using a certificate authority private key in the state change instruction to obtain a third signature.

[0018] A change operation information block is generated according to the second hash value corresponding to the target operation information block, the third signature, an operation category, and a changed certificate management object number indicated by the state change instruction.

[0019] In response to a state change chaining instruction, a change operation information block to be chained is determined, and a third signature in the change operation information block to be chained is decrypted by using a certificate authority public key corresponding to the target operation information block to determine whether the change operation information block to be chained is valid.

[0020] Hashing the valid change operation information block, and performing a third chaining operation on the second block by putting the valid change operation information block and the corresponding third hash value into the second block.

[0021] Optionally, after determining that the chaining operation occurs, the chaining operation includes a first chaining operation / second chaining operation / third chaining operation, and further includes at least one of the following steps:

[0022] According to the chaining operation, reading all the certificate information blocks in the first block, generating a certificate table item corresponding to each certificate and writing into a certificate information table; the certificate table item corresponding to each certificate includes certificate information corresponding to each certificate, certificate generation time, and certificate authority public key;

[0023] According to the chaining operation, reading all the initial operation information blocks in the second block, and updating the corresponding certificate information table;

[0024] According to the chaining operation, reading all the change operation information blocks in the second block, and updating the corresponding certificate information table;

[0025] The updated corresponding certificate information table includes certificate information corresponding to each certificate, certificate generation time, certificate authority public key, current issuance state, certificate management object number, and issuance state update time.

[0026] Optionally, determining whether the certificate information blocks are valid includes:

[0027] Decrypting the first signature by using the certificate authority public key in the certificate information block to obtain a first plaintext;

[0028] Determining whether the certificate authority public key and the certificate information in the first plaintext are the same as those in the certificate information block, and if so, the certificate information block is valid, otherwise, it is invalid;

[0029] Determining whether the initial operation information blocks are valid includes:

[0030] Decrypting the second signature by using the certificate authority public key in the target certificate information block to obtain a second plaintext;

[0031] Determining whether the certificate authority public key and the hash value in the second plaintext are the same as the first hash value in the initial operation information block and the certificate authority public key in the target certificate information block, and if so, the initial operation information block is valid, otherwise, it is invalid;

[0032] Determining whether the change operation information blocks are valid includes:

[0033] Decrypting the third signature by using the certificate authority public key corresponding to the target operation information block to obtain a third plaintext;

[0034] determining whether the CA public key and the hash value in the third plaintext are same as the CA public key corresponding to the latest target operation information block and the second hash value corresponding to the CA public key, and if yes, the operation information block is valid, otherwise, the operation information block is invalid.

[0035] Optionally, the method further comprises:

[0036] in response to a certificate query instruction, querying the certificate information table;

[0037] determining whether a certificate table entry is queried from the certificate information table, and sending the certificate table entry and the certificate information to the client; or

[0038] determining that no certificate table entry is queried from the certificate information table, and sending no query related result to the client.

[0039] Optionally, before generating the at least one certificate information block in response to the certificate generation instruction, the method further comprises:

[0040] determining whether the name of the CA, the CA code and the CA public key corresponding to the CA exist in the CA information table according to the name of the CA and the CA code in the certificate generation instruction;

[0041] if not, notifying the CA to register, receiving a registration instruction sent by the CA, and generating a table entry corresponding to the CA and writing the table entry into the CA information table according to the name of the CA, the CA code and the CA public key in the registration instruction.

[0042] In a second aspect, the application provides a certificate generation management device based on a block chain, comprising:

[0043] a certificate generation module, configured to generate at least one certificate information block, each of the certificate information blocks comprising certificate information in a certificate generation instruction, a CA public key obtained by querying, and a first signature obtained by encrypting the certificate information and the CA public key by using a CA private key in the certificate generation instruction;

[0044] a certificate chaining module, configured to, after verifying that the CA public key in each of the certificate information blocks is legal, determine whether the certificate information block is valid by using the CA public key and the first signature;

[0045] and further configured to perform hash calculation on the valid certificate information block, and put the valid certificate information block and a corresponding first hash value into a first block for first chaining operation;

[0046] The certificate management module is configured to query and read the target certificate information block meeting the management condition, and encrypt the certificate authority public key and the corresponding first hash value in the target certificate information block by using the certificate authority private key in the certificate management instruction to obtain a second signature;

[0047] The certificate management module is further configured to generate an initial operation information block according to the first hash value corresponding to the target certificate information block, the second signature, the operation category of the certificate management instruction, and the certificate management object number in the certificate management instruction.

[0048] The management chaining module is configured to determine each initial operation information block to be chained, and decrypt the corresponding signature in each initial operation information block to be chained by using the certificate authority public key in the corresponding target certificate information block to determine whether the initial operation information block to be chained is valid.

[0049] The management chaining module is further configured to perform hash calculation on the valid initial operation information block, and put the valid initial operation information block and the corresponding second hash value into a second block for a second chaining operation.

[0050] In a third aspect, the present application provides a certificate generation management device based on a block chain, comprising: at least one processor; and a memory in communication connection with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the certificate generation management method based on the block chain as described in any one of the first aspect.

[0051] In a fourth aspect, the present application provides a computer storage medium storing a computer program, and the computer program is used to enable a computer to execute the certificate generation management method based on the block chain as described in any one of the first aspect.

[0052] The certificate generation management method, device, equipment and storage medium based on the block chain provided by the present application can store the related data information of the electronic certificate into the block chain, and manage the issuance of the electronic certificate for enterprises or individuals, so as to ensure that the electronic certificate cannot be changed, forged and stored for a long time in the block chain, and improve the issuance efficiency of the electronic certificate. BRIEF DESCRIPTION OF DRAWINGS

[0053] The accompanying drawings incorporated in the specification and forming a part thereof illustrate embodiments consistent with the present application and together with the description, serve to explain the principles of the present application, and do not constitute an improper limitation on the present application.

[0054] Figure 1 A flowchart is provided according to the embodiments of the present application;

[0055] Figure 2A flow chart provided according to an embodiment of the application;

[0056] Figure 3 A flow chart provided according to an embodiment of the application;

[0057] Figure 4 A module schematic diagram provided according to an embodiment of the application;

[0058] Figure 5 A flow chart provided according to an embodiment of the application;

[0059] Figure 6 A flow chart provided according to an embodiment of the application;

[0060] Figure 7 A module schematic diagram provided according to an embodiment of the application;

[0061] Figure 8 A module schematic diagram provided according to an embodiment of the application;

[0062] Figure 9 A module schematic diagram provided according to an embodiment of the application;

[0063] Figure 10 A flow chart provided according to an embodiment of the application;

[0064] Figure 11 A flow chart provided according to an embodiment of the application;

[0065] Figure 12 A module schematic diagram provided according to an embodiment of the application;

[0066] Figure 13 A flow chart provided according to an embodiment of the application;

[0067] Figure 14 A flow chart provided according to an embodiment of the application;

[0068] Figure 15 A flow chart provided according to an embodiment of the application;

[0069] Figure 16 A flow chart provided according to an embodiment of the application;

[0070] Figure 17 A flow chart provided according to an embodiment of the application;

[0071] Figure 18 A flow chart provided according to an embodiment of the application;

[0072] Figure 19 A device schematic diagram provided according to an embodiment of the application;

[0073] Figure 20 A schematic diagram of a device according to an embodiment of the application;

[0074] Figure 21 A schematic diagram of a storage medium according to an embodiment. DETAILED DESCRIPTION

[0075] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments. Based on the embodiments of the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of the present application.

[0076] In the prior art, the blockchain technology is a distributed ledger technology that connects data blocks in order and uses cryptography to ensure that the data blocks are not tampered with and not forged. The technical solution based on the blockchain can be used to solve the trust problem, realize the free transfer of information and value, and has been widely used in the fields of digital currency, asset transaction, digital government, evidence storage and anti-forgery. With the development of science and technology, the electronicization of certificates is beneficial to simplify the process of certificate handling and issuance. Therefore, writing electronic certificates into the blockchain can improve the efficiency of various work related to certificates, realize long-term evidence storage, prevent fake certificates, and realize convenient query and verification of certificates. Therefore, the present application provides a certificate generation management method, device and equipment based on the blockchain and a storage medium, which can store the related data information of the electronic certificate into the blockchain, manage the issuance of the electronic certificate for enterprises or individuals, ensure that the electronic certificate cannot be changed, forged and stored for a long time in the blockchain, and improve the efficiency of the issuance of the electronic certificate.

[0077] In a first aspect, the present application provides a certificate generation management method based on the blockchain, as shown in Figure 1 The method comprises the following steps:

[0078] In step 101, at least one certificate information block is generated in response to a certificate generation instruction. Each certificate information block includes certificate information in the certificate generation instruction, a queried certificate authority public key, and a first signature obtained by encrypting the certificate information and the certificate authority public key using a certificate authority private key in the certificate generation instruction.

[0079] Optionally, the certificate generation instruction includes certificate information, a CA private key and a CA code, and the certificate information includes a CA-set certificate template and a number of certificates and a certificate number corresponding to each certificate; wherein the CA-set certificate template can be a previously set certificate template or a newly set certificate template; setting a new certificate template includes setting the layout of the certificate, the position, size and margin of the background picture in the certificate, the text, seal and logo style in the certificate, and the position in the page; at the same time, the CA public key of the CA can be queried in the CA information table according to the CA name and CA code in the certificate generation instruction;

[0080] Optionally, the certificate information and the CA public key are encrypted by the CA private key in the certificate generation instruction to obtain a first signature, and as shown in Figure 2

[0081] Step 201: According to the CA public key queried in the CA information table, the first signature is decrypted to obtain a first signature plaintext;

[0082] Step 202: Determine whether the CA public key and the certificate information in the first signature plaintext are the same as the CA public key and the certificate information in the certificate generation instruction queried in the CA information table; if yes, execute step 203; if no, execute step 204;

[0083] Step 203: Determine that the first signature is a valid signature;

[0084] Step 204: Determine that the first signature is an invalid signature;

[0085] Optionally, according to the certificate information, the queried CA public key and the first signature, a certificate information block can be generated; and a timestamp of generating the certificate information block is written into the certificate information block; according to the number of certificates set in the certificate generation instruction, a corresponding number of certificate information blocks are generated, that is, one certificate corresponds to one certificate information block.

[0086] Step 102: In response to the certificate chaining instruction, after verifying that the CA public key in each certificate information block is legal, the CA public key and the first signature are used to determine whether the certificate information block is valid;

[0087] Hash calculation is performed on the valid certificate information block, and the valid certificate information block and the corresponding first hash value are put into the first block for first chaining operation;

[0088] ​Optionally, verifying whether the certificate authority public key in each certificate information block is legal, it is needed to verify whether the certificate authority public key in each certificate information block exists in the certificate authority information table, if exists, it is determined that the certificate authority public key is legal, if not exists, the certificate authority public key is not legal; at the same time, the valid certificate information block is calculated by hash, and the valid certificate information block and the corresponding first hash value are put into the first block to perform the first chain operation, which can be set according to the number or time, for example, when the certificate information block to be packaged into the above-mentioned first block reaches 128 or the time from the first certificate information block to be packaged into the above-mentioned first block reaches 24 hours, the above-mentioned first chain operation is performed.

[0089] Optionally, the valid certificate information block is calculated by hash, and the valid certificate information block and the corresponding first hash value are put into the first block to perform the first chain operation, as shown in Figure 3 , specifically comprising:

[0090] Step 301, the valid certificate information block is calculated by hash to obtain the corresponding first hash value;

[0091] Step 302, the first hash value corresponding to each valid certificate information block is taken as a bottom leaf node, and the hash value of each two bottom leaf nodes is taken as a parent node, if there is one bottom leaf node left, the bottom leaf node is directly copied as a parent node, until the parent node is only one as a root node to generate a Merkle tree, and write into a block body;

[0092] Step 303, the hash value of the root node in the block body is written into the block header, and the hash value of the root node in the previous block header, the timestamp of the block header and the block type marked as 0 are written; the above-mentioned block body and block header are taken as a whole, that is, the first block is performed the first chain operation;

[0093] Among them, the block type of the first block is marked as 0, that is, only the basic information of the certificate is recorded in the first block; the first block can be multiple; as shown in Figure 4 , it is the intention of each item of information included in the certificate information block and the corresponding first hash value; as shown in Figure 8 , it is the overall schematic diagram of the first block, including each valid certificate information block 801 and the corresponding first hash value 802 in the block body, the generated Merkle tree and the root node hash value 803 in the block header, the root node hash value 804 in the previous block header, the timestamp 805, and the block type 806.

[0094] Step 103, in response to the certificate management instruction, the target certificate information block meeting the management condition is queried and read, and the certificate authority public key and the corresponding first hash value in the target certificate information block are encrypted by using the certificate authority private key in the certificate management instruction to obtain a second signature;

[0095] According to the first hash value corresponding to the target certificate information block, the second signature, the operation category of the certificate management instruction, and the certificate management object number in the certificate management instruction, an initial operation information block is generated;

[0096] Optionally, the certificate number in the certificate information is included in the certificate management instruction, and the target certificate information block meeting the management condition can be queried and read according to the certificate number; the CA public key and the corresponding first hash value in the target certificate information block are encrypted by using the CA private key in the certificate management instruction, and then a second signature is obtained, and the same as Figure 5 As shown, it includes:

[0097] Step 501, the second signature is decrypted according to the target certificate information block to obtain the second signature plaintext;

[0098] Step 502, it is judged whether the CA public key and the hash value in the second signature plaintext are the same as the first hash value corresponding to the target certificate information block and the CA public key in the target certificate information block; if yes, step 503 is executed, if not, step 504 is executed;

[0099] Step 503, it is determined that the second signature is a valid signature;

[0100] Step 504, it is determined that the second signature is an invalid signature.

[0101] Optionally, according to the first hash value corresponding to the target certificate information block, the second signature, the operation category of the certificate management instruction, and the certificate management object number in the certificate management instruction, an initial operation information block is generated; and the time stamp of generating the initial operation information block is written into the initial operation information block.

[0102] Step 104, in response to the management on-chain instruction, each initial operation information block to be chained is determined, and the corresponding signature in the initial operation information block to be chained is decrypted by using the CA public key in the corresponding target certificate information block to determine whether the initial operation information block to be chained is valid;

[0103] The valid initial operation information block is subjected to hash calculation, and the valid initial operation information block and the corresponding second hash value are put into the second block for second on-chain operation.

[0104] Optionally, the same as the hash operation of the certificate information block, the valid initial operation information block is subjected to hash calculation, and the valid initial operation information block and the corresponding second hash value are put into the second block for second on-chain operation, as shown in Figure 6 As shown, it specifically includes:

[0105] Step 601, hash operation is performed on the valid initial operation information block to obtain the corresponding second hash value;

[0106] Step 602, the second hash value corresponding to each valid initial operation information block is taken as the bottom leaf node, and the hash value of each two bottom leaf nodes is taken as the parent node, if there is one bottom leaf node left, the bottom leaf node is directly copied as the parent node, until the parent node is only one as the root node to generate the Merkle tree, and write into the block body;

[0107] Step 603, the hash value of the root node in the block body is written into the block header, and the hash value of the root node, the timestamp of the block header and the block type marked as 1 in the previous block header are written; the above block body and block header are taken as a whole, that is, the second block is subjected to the second chain operation;

[0108] Among them, the block type of the second block is marked as 1, that is, the operation information of the certificate is recorded in the second block; the second block can be multiple; as Figure 7 As shown in the figure, it is a schematic diagram of each item of information included in the initial operation information block and the corresponding second hash value.

[0109] According to the certificate generation management method based on the block chain provided by the application, a plurality of certificate information blocks are generated, and the valid certificate information blocks are calculated to generate a first block with a block type of 0; based on the generated first block, the initial operation information block according to the number specified in the certificate management instruction is generated, and the valid initial operation information block is calculated to generate a second block with a block type of 1; as Figure 9 As shown in the figure, it is a schematic diagram of the whole block chain, including a plurality of first blocks and a plurality of second blocks, a total of N blocks, wherein the first block and the second block are composed of a block body and a block header; according to the certificate generation management method based on the block chain provided by the application, the related data information of the electronic certificate can be stored in the block chain, and the electronic certificate of the enterprise or the individual can be issued and managed, so that the electronic certificate in the block chain cannot be changed, cannot be forged, long-term storage, and the efficiency of the electronic certificate issuing is improved.

[0110] Optionally, the certificate management instruction includes a certificate issuing instruction and a certificate invalidation instruction, the management condition is that the certificate information block is generated and not issued; when the certificate management instruction is the certificate issuing instruction, the operation category is issuing, and the certificate management object number in the operation information block is a certificate issuing object number; when the certificate management instruction is the certificate invalidation instruction, the operation category is deleting, and the certificate management object number in the operation information block is empty; the certificate issuing instruction includes an enterprise name, an organization name, a personal name, a corresponding enterprise, an organization social unified information code, a personal identity code of the certificate issuing object, and optionally includes an enterprise registration address, a personal title, a personal address, and a professional title; the certificate issuing object number is the enterprise, organization social unified information code, and personal identity code; information in the certificate issuing instruction except the certificate issuing object number is filled into a certificate template to generate a complete electronic certificate.

[0111] Optionally, as shown in Figure 10 , the method further includes:

[0112] Step 1001, in response to the state change instruction, determining the latest target operation information block corresponding to the certificate information to be changed;

[0113] Encrypting the second hash value in the target operation information block and the certificate issuing authority public key corresponding to the target operation information block by using the certificate issuing authority private key in the state change instruction to obtain a third signature;

[0114] Generating a change operation information block according to the second hash value corresponding to the target operation information block, the third signature, the operation category, and the changed certificate management object number indicated by the state change instruction;

[0115] Optionally, the state change instruction includes any one or more of a certificate number, a certificate issuing authority, a certificate issuing object, and a certificate issuing object number in the certificate information, which are used to query and select the certificate information to be changed, and determine the latest target operation information block corresponding to the certificate information to be changed; similarly, after the second hash value in the target operation information block and the certificate issuing authority public key corresponding to the target operation information block are encrypted by using the certificate issuing authority private key in the state change instruction to obtain a third signature, as shown in Figure 11 , the method further includes:

[0116] Step 1101, decrypting the third signature by using the certificate issuing authority public key corresponding to the target operation information block to obtain a third signature plaintext;

[0117] Step 1102, judging whether the CA public key and the hash value in the first signed plaintext are same as the second hash value corresponding to the target operation information block and the CA public key corresponding to the target information block; if yes, executing step 1103, if no, executing step 1104;

[0118] Step 1103, determining that the third signature is a valid signature;

[0119] Step 1104, determining that the third signature is an invalid signature;

[0120] Optionally, the state change instruction includes a state change mode of the certificate, that is, a specific operation category, and the state change mode includes revocation, revocation, loss, loss, certificate transfer, and the like, which will not be listed one by one here; it is worth noting that when it is determined that the state change mode of the certificate is certificate transfer, the certificate transfer object number of the certificate transfer object to which the certificate is transferred is also included in the above-mentioned state change instruction; the changed certificate management object number indicated by the state change instruction can come from the state change instruction or the latest target operation information block; a change operation information block is generated according to the second hash value corresponding to the target operation information block, the third signature, the operation category and the changed certificate management object number indicated by the state change instruction; and the timestamp of generating the change operation information block is written into the above-mentioned change operation information block.

[0121] Step 1002, in response to the state change on-chain instruction, determining a change operation information block to be chained, and using the CA public key corresponding to the target operation information block to decrypt the third signature in the change operation information block to be chained, to determine whether the change operation information block to be chained is valid.

[0122] The valid change operation information block is subjected to hash calculation, and the valid change operation information block and the corresponding third hash value are put into the second block for third on-chain operation.

[0123] Optionally, the same as the above-mentioned valid initial operation information block, the third on-chain operation is performed, and the detailed content is referred to Figure 6 , which will not be repeated here; as Figure 12 shown, it is a schematic diagram of each item of information included in the change operation information block and the corresponding third hash value.

[0124] Optionally, after determining that the on-chain operation is performed, the on-chain operation includes first on-chain operation / second on-chain operation / third on-chain operation, as Figure 13 shown, further includes at least one of the following steps:

[0125] Step 1301, according to the upper chain operation, reading all certificate information blocks in the first block, generating the certificate table item corresponding to each certificate and writing into the certificate information table;

[0126] The certificate table item corresponding to each certificate includes the certificate information corresponding to each certificate, the certificate generation time, and the certificate authority public key.

[0127] Step 1302, according to the upper chain operation, reading all initial operation information blocks in the second block, updating the corresponding certificate information table;

[0128] Step 1303, according to the upper chain operation, reading all change operation information blocks in the second block, updating the corresponding certificate information table;

[0129] The updated corresponding certificate information table includes the certificate information corresponding to each certificate, the certificate generation time, the certificate authority public key, the current issuance state, the certificate management object number, and the issuance state update time.

[0130] Optionally, it is determined whether the certificate information blocks are valid, as shown in the following table: Figure 14 The table includes:

[0131] Step 1401, decrypting the first signature by using the certificate authority public key in the certificate information block to obtain the first plaintext;

[0132] Step 1402, judging whether the certificate authority public key and the certificate information in the first plaintext are the same as those in the certificate information block, if yes, the certificate information block is valid, otherwise, it is invalid;

[0133] It is determined whether the initial operation information blocks are valid, as shown in the following table: Figure 15 The table includes:

[0134] Step 1501, decrypting the second signature by using the certificate authority public key in the target certificate information block to obtain the second plaintext;

[0135] Step 1502, judging whether the certificate authority public key and the hash value in the second plaintext are the same as the first hash value in the initial operation information block and the certificate authority public key in the target certificate information block, if yes, the initial operation information block is valid, otherwise, it is invalid;

[0136] It is determined whether the change operation information blocks are valid, as shown in the following table: Figure 16 The table includes:

[0137] Step 1601, decrypting the third signature by using the certificate authority public key corresponding to the target operation information block to obtain the third plaintext;

[0138] Step 1602, judging whether the CA public key and the hash value in the third plaintext are same as the CA public key corresponding to the latest target operation information block and the corresponding second hash value, if same, the operation information block is valid, otherwise, invalid.

[0139] Optionally, as shown in Figure 17 , further comprising:

[0140] Step 1701, in response to the certificate query instruction, querying the certificate information table;

[0141] Step 1702, determining that the certificate table item in the certificate information table is queried, and sending the certificate related information in the certificate table item to the client; or,

[0142] Step 1703, determining that the certificate table item in the certificate information table is not queried, and sending the no query related result to the client.

[0143] Optionally, the certificate query instruction includes any one or more of the certificate name, the certificate generation time, the CA public key, the current issuing state, the certificate management object number, the issuing state update time, and the certificate number in the certificate information, which are used to find the certificate table item in the certificate information table; after the above determining that the certificate table item in the certificate information table is queried, and sending the certificate related information in the certificate table item to the client, the displayed certificate related information can be further verified; for example, verifying whether the certificate is a valid certificate, finding the corresponding certificate information block according to the certificate query instruction, if not found, it means that the certificate is an invalid certificate, if found, reading the CA public key, the certificate information and the first signature in the certificate information block, judging whether the corresponding CA public key in the CA information table is consistent with the CA public key in the certificate information block, using the CA public key to decrypt the first signature to obtain the first plaintext, judging whether the CA public key and the certificate information in the first plaintext are consistent with the CA public key and the certificate information in the certificate information block, if all consistent, determining that the certificate information block is a valid certificate information block, and the certificate is a valid certificate.

[0144] Optionally, in response to the certificate generation instruction, before generating at least one certificate information block, as shown in Figure 18 , further comprising:

[0145] Step 1801, according to the CA name and the CA code in the certificate generation instruction, determining whether the name, the CA code and the CA public key corresponding to the CA of the CA exist in the CA information table;

[0146] If not, the step 1802 notifies the certificate authority to register, receives the registration instruction sent by the certificate authority, and generates the table item corresponding to the certificate authority according to the name of the certificate authority, the certificate authority code and the certificate authority public key in the registration instruction, and writes the table item into the certificate authority information table.

[0147] Based on the same inventive concept, in a second aspect, the present application also provides a certificate generation management device based on a block chain, as shown in the accompanying drawings, comprising: Figure 19

[0148] The certificate generation module 1901 is configured to generate at least one certificate information block, each of the certificate information blocks comprising certificate information in a certificate generation instruction, a queried certificate authority public key, and a first signature obtained by encrypting the certificate information and the certificate authority public key by using a certificate authority private key in the certificate generation instruction.

[0149] The certificate on-chain module 1902 is configured to, after verifying that the certificate authority public key in each certificate information block is legal, determine whether the certificate information block is valid by using the certificate authority public key and the first signature.

[0150] The certificate on-chain module 1902 is further configured to perform a first hash calculation on the valid certificate information block, and put the valid certificate information block and the corresponding first hash value into a first block to perform a first on-chain operation.

[0151] The certificate management module 1903 is configured to query and read a target certificate information block meeting a management condition, and encrypt the certificate authority public key and the corresponding first hash value in the target certificate information block by using a certificate authority private key in a certificate management instruction to obtain a second signature.

[0152] The certificate management module 1903 is further configured to generate an initial operation information block according to the first hash value corresponding to the target certificate information block, the second signature, the operation category of the certificate management instruction and the certificate management object number in the certificate management instruction.

[0153] The management on-chain module 1904 is configured to determine each initial operation information block to be chained, and decrypt the corresponding signature in each initial operation information block to be chained by using the certificate authority public key in the corresponding target certificate information block to determine whether each initial operation information block to be chained is valid.

[0154] The management on-chain module 1904 is further configured to perform a second hash calculation on the valid initial operation information block, and put the valid initial operation information block and the corresponding second hash value into a second block to perform a second on-chain operation.

[0155] ​Based on the same inventive concept, in a third aspect, the present application also provides a blockchain-based certificate generation management device, comprising: at least one processor; and a memory connected in communication with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform any one of the blockchain-based certificate generation management methods provided in the above embodiments.

[0156] As shown in Figure 20 The device includes a processor 2001, a memory 2002, a communication interface 2003 and a bus 2004. Among them, the processor 2001, the memory 2002 and the communication interface 2003 are connected with each other through the bus 2004.

[0157] The processor 2001 is configured to read instructions in the memory 2002 and execute the instructions to enable the at least one processor to perform any one of the blockchain-based certificate generation management methods provided in the above embodiments.

[0158] The memory 2002 is configured to store various instructions and programs of the blockchain-based certificate generation management methods provided in the above embodiments.

[0159] The bus 2004 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, Figure 20 Only one thick line is used in the figure, but it does not mean that there is only one bus or only one type of bus.

[0160] Processor 2001 may be a central processing unit (CPU), a network processor (NP), a graphics processing unit (GPU), or any combination of a CPU, NP, and GPU. It may also be a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0161] Based on the same inventive concept, in a fourth aspect, the present application also provides a storage medium, such as Figure 21 As shown, the storage medium stores a computer program, which is used to enable a computer to execute the blockchain-based certificate generation and management method described in any one of the above embodiments.

[0162] The memory may include readable media in the form of volatile memory, such as random access memory (RAM) 2121 and / or cache memory 2122 , and may further include read-only memory (ROM) 2123 .

[0163] The memory may also include a program / utility 2125 having a set (at least one) of program modules 2124, such program modules 2124 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0164] The present application provides a blockchain-based certificate generation management method, device, equipment and storage medium, which can store the relevant data information of electronic certificates in the blockchain and manage the issuance of electronic certificates for enterprises or individuals, ensuring that electronic certificates cannot be changed, forged, and stored for a long time in the blockchain, and improving the efficiency of electronic certificate issuance.

[0165] Those skilled in the art will appreciate that embodiments of the present application can be devised for a variety of other systems which are currently developed or later developed. Therefore, the present application is intended to cover all such modifications and variations of this application that are within the scope of the appended claims and their equivalents. It is intended that each element of claim 1 and 2 is independent of one another. No element of claim 1 and 2, or any other claim, is implied to depend on any other element or limitation of claim 1 and 2 or any other claim except where expressly recited in that claim.

[0166] The present application is described in reference to the flowchart and / or block diagrams of the method, apparatus (system) and computer program product according to this application. It will be understood that each block of the flowchart and / or block diagrams, and combinations of blocks in the flowchart and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks.

[0167] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks.

[0168] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks.

[0169] Obviously, numerous modifications and variations of the present application are possible in light of the above teachings. It is therefore to be understood that within the scope of the appended claims and their equivalents, the application can be practiced otherwise than as specifically described.

Claims

1. A certificate generation and management method based on blockchain, characterized in that: include: In response to the certificate generation instruction, generate at least one certificate information block, each of the certificate information blocks including the certificate information in the certificate generation instruction, the public key of the issuing authority obtained by querying, and a first signature obtained by encrypting the certificate information and the public key of the issuing authority using the private key of the issuing authority in the certificate generation instruction; In response to the certificate chain instruction, after verifying the legitimacy of the issuing authority public key in each certificate information block, determine whether the certificate information block is valid using the issuing authority public key and the first signature; Performing a hash calculation on a valid certificate information block, and placing the valid certificate information block and the corresponding first hash value into a first block for a first on-chain operation; In response to the certificate management instruction, query and read the target certificate information block that meets the management conditions, and use the issuing authority private key in the certificate management instruction to encrypt the issuing authority public key and the corresponding first hash value in the target certificate information block to obtain a second signature; Generate an initial operation information block according to the first hash value corresponding to the target certificate information block, the second signature, the operation category of the certificate management instruction, and the certificate management object number in the certificate management instruction; In response to the management chaining instruction, determine each initial operation information block to be chained, and use the issuing authority public key in the corresponding target certificate information block to decrypt the corresponding signature in each initial operation information block to determine whether each initial operation information block to be chained is valid; A hash calculation is performed on the valid initial operation information block, and the valid initial operation information block and the corresponding second hash value are placed in the second block for a second on-chain operation.

2. The method according to claim 1, characterized in that The certificate management instructions include certificate issuance instructions and certificate revocation instructions, and the management condition is that the certificate information block is generated but not issued; When the certificate management instruction is a certificate issuance instruction, the operation category is issuance, and the certificate management object number in the operation information block is the certificate issuance object number; When the certificate management instruction is a certificate revocation instruction, the operation category is deletion, and the certificate management object number in the operation information block is empty.

3. The method according to claim 1, characterized in that Also includes: In response to the state change instruction, determining the latest target operation information block corresponding to the certificate information of the to-be-changed state; Encrypting the public key of the issuing authority corresponding to the target operation information block and the second hash value in the target operation information block using the issuing authority private key in the state change instruction to obtain a third signature; Generate a change operation information block according to the second hash value corresponding to the target operation information block, the third signature, the operation type, and the changed certificate management object number indicated by the status change instruction; In response to the status change on-chain instruction, determine the change operation information block to be on-chain, decrypt the third signature in the change operation information block to be on-chain using the public key of the issuing authority corresponding to the corresponding target operation information block, and determine whether the change operation information block to be on-chain is valid; A hash calculation is performed on the valid change operation information block, and the valid change operation information block and the corresponding third hash value are placed in the second block for a third on-chain operation.

4. The method according to any one of claims 1 to 3, characterized in that: After determining that an on-chain operation occurs, the on-chain operation includes a first on-chain operation / a second on-chain operation / a third on-chain operation, and further includes at least one of the following steps: According to the chain operation, all certificate information blocks in the first block are read, and certificate entries corresponding to each certificate are generated and written into the certificate information table; the certificate entries corresponding to each certificate include the certificate information corresponding to each certificate, the certificate generation time, and the public key of the issuing authority; According to the chain operation, read all initial operation information blocks in the second block and update the corresponding certificate information table; According to the on-chain operation, read all the change operation information blocks in the second block and update the corresponding certificate information table; The updated corresponding certificate information table includes the certificate information corresponding to each certificate, certificate generation time, issuing authority public key, current issuance status, certificate management object number, and issuance status update time.

5. The method according to any one of claims 1 to 3, characterized in that: Determining whether each certificate information block is valid includes: Decrypting the first signature using the public key of the issuing authority corresponding to the certificate information block to obtain a first plaintext; Determine whether the issuing authority public key and certificate information in the first plaintext are the same as those in the certificate information block; if they are the same, the certificate information block is valid; otherwise, it is invalid; Determining whether each of the initial operation information blocks is valid includes: Decrypting the second signature using the issuing authority public key in the target certificate information block to obtain a second plaintext; Determine whether the issuing authority public key and hash value in the second plaintext are the same as the first hash value in the initial operation information block and the issuing authority public key in the target certificate information block; if they are the same, the initial operation information block is valid; otherwise, it is invalid; Determining whether each of the change operation information blocks is valid includes: Decrypting the third signature using the issuing authority's public key corresponding to the target operation information block to obtain a third plaintext; Determine whether the issuing agency public key and hash value in the third plaintext are the same as the issuing agency public key and the corresponding second hash value corresponding to the latest target operation information block. If they are the same, the changed operation information block is valid, otherwise it is invalid.

6. The method according to claim 4, characterized in that Also includes: In response to a certificate query instruction, query the certificate information table; Determine the certificate entry found in the certificate information table, and send the certificate information in the certificate entry to the client; or, It is determined that no certificate entry in the certificate information table is found, and a no-query related result is sent to the client.

7. The method according to claim 1, characterized in that Before generating at least one certificate information block in response to the certificate generation instruction, the method further includes: Determining, based on the issuing authority name and issuing authority code in the certificate generation instruction, whether the issuing authority name, issuing authority code, and the issuing authority public key corresponding to the issuing authority exist in the issuing authority information table; If it does not exist, notify the issuing agency to register, receive the registration instruction sent by the issuing agency, generate the corresponding table entry of the issuing agency according to the name, code and public key of the issuing agency in the registration instruction and write it into the issuing agency information table.

8. A certificate generation and management device based on blockchain, characterized in that: include: a certificate generation module configured to generate at least one certificate information block, each of the certificate information blocks comprising the certificate information in the certificate generation instruction, the public key of the issuing authority obtained by querying, and a first signature obtained by encrypting the certificate information and the public key of the issuing authority using the private key of the issuing authority in the certificate generation instruction; a certificate chain module, configured to verify the legitimacy of the issuing authority's public key in each certificate information block, and then determine whether the certificate information block is valid using the issuing authority's public key and the first signature; Also used to perform hash calculation on a valid certificate information block, and put the valid certificate information block and the corresponding first hash value into the first block for a first on-chain operation; a certificate management module, configured to query and read a target certificate information block that meets the management conditions, and encrypt the issuing authority public key and the corresponding first hash value in the target certificate information block using the issuing authority private key in the certificate management instruction to obtain a second signature; further configured to generate an initial operation information block according to the first hash value corresponding to the target certificate information block, the second signature, the operation category of the certificate management instruction, and the certificate management object number in the certificate management instruction; The on-chain management module is used to determine each initial operation information block to be on-chained, and use the issuing authority's public key in the corresponding target certificate information block to decrypt the corresponding signature in each initial operation information block to determine whether each initial operation information block to be on-chained is valid; It is also used to perform hash calculation on a valid initial operation information block, and put the valid initial operation information block and the corresponding second hash value into the second block for a second on-chain operation.

9. A blockchain-based certificate generation and management device, characterized in that: include: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the blockchain-based certificate generation management method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores a computer program, which is used to enable a computer to execute the blockchain-based certificate generation and management method as described in any one of claims 1 to 7.

Images