A secure access control method based on CA authentication system

Abstract

This invention provides a secure access control method based on a CA (Certificate Authority) authentication system, relating to the field of blockchain security technology. This method adds a CA node to the existing verification nodes in a blockchain network. It eliminates the need for a third party to generate node certificates. During initialization, the verification node requests a certificate from the CA node. When establishing a communication connection, the verification node verifies the validity of the certificate to confirm the connection. The verification node periodically maintains its address book to ensure the legitimacy of certificates for nodes with established connections. A new node addition mechanism is also implemented, with the CA node broadcasting new node information to existing nodes. The CA node can also revoke certificates of malicious nodes and broadcast notifications to other verification nodes. This method directly eliminates third-party intervention during certificate operations, with the CA node generating certificates and performing subsequent certificate-related operations, and enabling the addition of new ordinary nodes within the blockchain network.

Description

Technical Field

[0001] This invention relates to the field of blockchain security technology, and in particular to a secure access control method based on a CA authentication system. Background Technology

[0002] In recent years, due to the explosive growth in public interest in cryptocurrencies, blockchain technology has received increasing attention, and discussions about it have intensified. It is gradually changing people's lifestyles and continues to have an impact in certain areas. Accompanying this is also skepticism and reflection on blockchain security issues. Current blockchain network frameworks lack advanced access control methods. Specifically, blockchain networks primarily focus on the consensus layer and network communication. In existing blockchain networks, nodes are anonymous, allowing unauthorized nodes to participate in the consensus process or submit malicious transactions, compromising network security. Furthermore, there is no mechanism for new ordinary nodes to join, failing to meet the needs of real-world applications. Adding a secure access control method based on a CA (Certificate Authority) authentication system to the blockchain network can achieve identity authentication and authorization when nodes access the network. Simultaneously, nodes can authenticate each other, facilitating secure inter-node communication and possessing significant security implications for real-world applications in fields such as healthcare, public security, transportation, and education. Therefore, it is necessary to design a secure access control method based on a CA authentication system to address the aforementioned problem of the lack of access control technology in blockchain.

[0003] Patent CN201710265307 provides a consortium blockchain access control method based on digital certificates and a CA authentication system. However, operations such as certificate generation require the involvement of a trusted third party, and third-party-generated certificates may not be trusted by everyone. If the third party has a poor reputation or is not widely accepted, the certificate may be doubted or rejected; dishonest third parties may generate forged certificates that appear legitimate but do not actually reflect reality. This could lead to deception and security risks. If the third party needs to obtain sensitive user information, such as personal identification or financial information, user privacy may be threatened. Using third-party-generated certificates may make organizations overly dependent on that third party, and if the third party stops providing services or encounters problems, it may lead to difficulties in certificate management. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a secure access control method based on the CA authentication system to address the shortcomings of the prior art and realize secure access control of blockchain.

[0005] To address the aforementioned technical problems, the technical solution adopted by this invention is: a secure access control method based on a CA authentication system. This method adds CA nodes to the existing verification nodes in a blockchain network. No third-party node certificate generation is required; during initialization, the verification node sends a request to the CA node to obtain the node certificate. When establishing a communication connection, the verification node verifies the validity of the certificate to confirm the connection. The verification node periodically maintains its address book to ensure the legitimacy of the certificates of nodes with established connections. A new node addition mechanism is also set up, whereby the CA node broadcasts new node information to existing nodes. The CA node can also revoke the certificates of malicious nodes and broadcast notifications to other verification nodes, thereby maintaining the integrity of the address book and the trustworthiness of the verifier set. Specifically, it includes the following steps:

[0006] 1) Create and initialize the verification node and CA node;

[0007] CA nodes are added to the existing verification nodes in the blockchain network. The verification nodes are divided into genesis nodes and ordinary nodes.

[0008] When a CA node is created and initialized, a CA node configuration file, a root certificate, and the CA node's own certificate, i.e., a CA certificate, are generated. The root certificate is generated by self-signing, the CA certificate is issued by the root certificate, and the CA certificate issues other ordinary certificates.

[0009] The initialization of a verification node falls into two categories: if it is a genesis node, a genesis file needs to be generated and saved in the database for ordinary nodes to access; if it is an ordinary node, its genesis file is retrieved from the database and saved locally.

[0010] 2) Start the verification node and CA node;

[0011] When a CA node starts, the CA Reactor is launched. Within the CA Reactor, various CA services are initiated, including certificate revocation for malicious nodes, certificate issuance for new ordinary nodes, and node certificate maintenance. Two coroutines are also started. The certificate revocation service for malicious nodes means that if an ordinary node performs malicious operations, the CA node will revoke its certificate and broadcast the revocation. The certificate issuance service for new ordinary nodes means that when a new ordinary node starts, the CA node issues a certificate based on the new ordinary node's ID and broadcasts the new ordinary node's information to facilitate communication between old and new nodes. Node certificate maintenance means that the CA node periodically broadcasts node information so that validating nodes can maintain their address books and validator sets, ensuring the legitimacy of certificates for nodes with established connections.

[0012] When a verification node starts, it will start all Reactors except CA Reactor and dial the verification nodes in the address book to establish secure communication.

[0013] 3) Inter-node communication verification:

[0014] When a validator node needs to connect and communicate with other validator nodes, it sends its own certificate and signature to the other validator node so that the other validator node can verify the validity of the certificate. Specifically, this includes checking whether the certificate has been revoked or expired, whether the issuer is a CA node, and the validity of the signature. Only if the verification is successful can the connection and communication be established. If the certificate validity verification fails, the connection and communication will fail.

[0015] 4) Node certificate maintenance:

[0016] CA nodes are not responsible for maintaining other nodes' certificates; they are only responsible for issuing, renewing, and revoking node certificates. Verification nodes are only responsible for maintaining their own certificates.

[0017] Certificate extension: When a validator's certificate is about to expire or has already expired, the validator will proactively apply to the CA node for certificate extension. After the extension, the certificate content will change, and the validator with the extended certificate needs to re-establish connections with other nodes and update the certificate information in its address book.

[0018] 5) New regular nodes added:

[0019] The CA node will broadcast the information of the new ordinary node to other validator nodes so that existing validator nodes in the network can establish communication with the new validator node; after the new ordinary node joins, it will also send a request to the CA node to obtain information of other validator nodes and actively dial to other validator nodes to establish a connection.

[0020] 6) Malicious node removal:

[0021] When a validator node becomes a malicious node or engages in illegal activities, the CA node will revoke the validator node's certificate and broadcast the revocation, causing all nodes to proactively update their address books and validator sets to remove malicious nodes.

[0022] Furthermore, the CA node initialization involves initializing a Certificate Authority (CA) node to manage the issuance and management of digital certificates. This includes setting the root directory and loading configurations, creating relevant directories, configuring P2P network parameters, creating the CA node's key, executing initialization tasks, and configuring private validators, including key files and state files. If the key file exists, the existing private validator is loaded; otherwise, a new private validator is generated. The private validator is used for verification during block signing and consensus processes. Afterward, the genesis file is configured to initialize the blockchain. If the genesis file exists, it is recorded; otherwise, a new genesis file is generated. Further, the CA Reactor starts the CA service and CA listener, and initiates two coroutines responsible for broadcasting validator information and validator information, respectively. The former synchronizes validator information in the Tendermint blockchain network to ensure all validator nodes have the latest information, while the latter synchronizes validator information in the Tendermint blockchain network.

[0023] Furthermore, when starting and running a CA node, the following steps are performed first: configuration initialization to ensure the CA node has the correct settings; initialization of logs and databases to effectively record CA node operation information and management data; checking the CA genesis block hash to verify the initial state of the CA node; then starting the CA node, configuring network connections, and loading certificates and keys for collaborative operation; recording the CA node's startup information for monitoring and troubleshooting; the CA node enters a running loop to perform consensus and certificate management tasks, maintaining normal network operation; simultaneously, the CA node listens for operation or termination signals and performs corresponding operations based on the received signals.

[0024] The CA node calls methods in the X.509 digital certificate module to manage and verify the certificates of the verification node.

[0025] Furthermore, the CA node can also be used to implement functions such as issuing certificates, querying certificates, renewing certificates, revoking certificates, determining whether a certificate has been revoked or expired, verifying certificates, and verifying digital signatures.

[0026] Furthermore, the certificate issuance function is as follows: the verification node interacts with the CA node and obtains the certificate. The acquisition request contains user information parameters. Then, a POST request is sent to the HTTP server, the response is processed, and the certificate generation logic is executed by the CA node.

[0027] Furthermore, the certificate query function is as follows: the verification node communicates with the CA node, the certificate query logic is handled by the CA node, and the CA node will return the corresponding certificate or query result based on the information in the query request.

[0028] The extended certificate function is as follows: after the verification node communicates with the CA node, it sends a POST request to request an extended certificate, and then processes the response from the CA node. The logic for extending the certificate is handled by the CA node, which updates the certificate's validity period based on the information in the renewal request and returns the extended certificate or result.

[0029] The certificate revocation function is as follows: after the verification node communicates with the CA node, it sends a POST request to request the revocation of the certificate. Then, it processes the response from the CA node. The logic for revoking the certificate is handled by the CA node. The CA node will perform the revocation operation based on the information in the revocation request and return the revocation result.

[0030] Furthermore, the function to determine whether a certificate has been revoked or expired is as follows: First, the certificate query method is called to query the certificate information. If the certificate is not found, an error is returned. If the certificate is found, the next step is to check whether the certificate has been revoked. If it has been revoked, an error message indicating certificate revocation is returned. If it has not been revoked, the certificate expiration time is obtained, the current time is obtained, and the two times are compared. If the certificate expiration time is before the current time, an error message indicating expired certificate is returned. If the certificate has neither been revoked nor expired, a certificate validity is returned.

[0031] Furthermore, the certificate verification function is as follows: First, the certificate query method is called to query certificate information. If the certificate is not found, an error is returned. If the certificate is found, the next step is to check whether the certificate has been revoked. If it has been revoked, the certificate will be delayed and the delayed certificate content will be used for subsequent verification. Then, the incoming certificate content is decoded and converted into an X.509 certificate object. A certificate pool is created, and certificates are added to the certificate pool. The certificate pool is the core component for establishing digital certificate verification and trust. It stores trusted certificates and is used to verify the validity of other certificates and the trust of the issuing certificate authority. Then, the function in the X.509 standard library is used to verify whether the incoming certificate is valid. If the verification fails, an error is returned.

[0032] The digital signature verification function works as follows: First, it ensures that the decoded X.509 digital certificate is valid. Then, it decodes the certificate data into the required structure and uses the public key in the certificate for verification. Next, it calculates the SHA-256 hash value of the input data for comparison with the signature. Finally, it uses the RSA PKCS#1v1.5 signature verification algorithm to verify the data hash and signature. If the verification is successful, the function returns that the signature is valid; otherwise, it returns an error message.

[0033] The beneficial effects of adopting the above technical solution are as follows: The secure access control method based on the CA authentication system provided by this invention directly removes the intervention of third parties when performing certificate operations. The CA node generates the certificate and performs the subsequent certificate-related operations. The CA node starts the CA service through the CA Reactor. Taking Tendermint as an example, blockchain networks generally do not have access control methods, but the method of this invention enables the addition of new ordinary nodes in the blockchain network. After the new node joins, it will also send a request to the CA node to obtain information about other ordinary nodes and actively dial to establish connections with other ordinary nodes. If it is an illegal or malicious node, the connection will fail. This improves the security of the blockchain network and enables the legitimate addition of new nodes.

[0034] This invention establishes a CA node and a CA Reactor. The CA Reactor is used to start the CA service, and the CA node is used for certificate issuance and other operations. The root certificate is self-signed, the CA certificate is issued by the root certificate, and other ordinary certificates are issued by the CA certificate. The CA certificate is maintained by the verification node itself. Legitimate new ordinary nodes can be added to the blockchain network, actively requesting information about other ordinary nodes from the CA node and proactively making connections. This largely addresses the issue of preventing the addition of new ordinary nodes to the blockchain network, adds access control methods to the blockchain network, and improves the security of the blockchain network. Attached Figure Description

[0035] Figure 1 This is a schematic diagram illustrating a secure access control method based on a CA authentication system provided in an embodiment of the present invention.

[0036] Figure 2 A flowchart for CA node initialization provided in an embodiment of the present invention;

[0037] Figure 3 A flowchart for starting a CA node provided in an embodiment of the present invention;

[0038] Figure 4 A flowchart for initializing a verification node provided in an embodiment of the present invention;

[0039] Figure 5 A flowchart for establishing connections between nodes provided in an embodiment of the present invention;

[0040] Figure 6 A flowchart for starting and maintaining a new ordinary node provided in an embodiment of the present invention. Detailed Implementation

[0041] The specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples. The following examples are for illustrative purposes only and are not intended to limit the scope of the invention.

[0042] This embodiment takes the Tendermint network as an example and uses the security access control method based on the CA authentication system of the present invention to achieve secure access control to the blockchain network.

[0043] In this example, a secure access control method based on a CA authentication system is described, such as... Figure 1 As shown, adding a CA node to the existing blockchain network's validator nodes eliminates the need for third-party node certificate generation. During initialization, each validator node requests a certificate from the CA node, facilitating identity authentication and authorization. When establishing a communication connection, the validator node verifies the certificate's validity to confirm the connection, contributing to secure inter-node communication. Validator nodes periodically maintain their address books to ensure the legitimacy of certificates for connected nodes. A new node addition mechanism is also implemented, with the CA node broadcasting new node information to existing nodes. The CA node can also revoke malicious node certificates and broadcast notifications to other validator nodes, thus maintaining the integrity of the address book and the trustworthiness of the validator set. The specific steps include:

[0044] 1) Create and initialize the verification node and CA node;

[0045] Adding CA nodes to the existing verification nodes in the blockchain network, such as... Figure 2 as well as Figure 4 As shown, nodes in the Tendermint network are divided into validator nodes and CA nodes, where validator nodes are further divided into genesis nodes and ordinary nodes.

[0046] When a CA node is created and initialized, a CA node configuration file, a root certificate, and the CA node's own certificate, i.e., a CA certificate, are generated. The root certificate is self-signed, the CA certificate is issued by the root certificate, and the CA certificate issues other ordinary certificates. The root certificate is the starting point of the trust chain and is the highest-level digital certificate. The correctness of the root certificate must be ensured to guarantee the trustworthiness of all certificates on the certificate chain.

[0047] The initialization of a verification node falls into two categories: if it is a genesis node, a genesis file needs to be generated and saved in the database for ordinary nodes to access; if it is an ordinary node, its genesis file is retrieved from the database and saved locally.

[0048] The so-called CA node initialization, such as Figure 2As shown, the process involves initializing a Certificate Authority (CA) node to manage the issuance and management of digital certificates. This includes setting the root directory and loading configurations, creating relevant directories, configuring P2P network parameters, creating the CA node's key, performing initialization tasks such as checking basic configurations and creating root certificates, configuring private validators (including key files and state files), loading existing private validators if the key file exists, and generating new private validators otherwise. Private validators are used for verification during block signing and consensus processes. Afterwards, the genesis file is configured to initialize the blockchain. If the genesis file exists, it is recorded; otherwise, a new genesis file is generated. The main purpose of CA node initialization is to prepare the initial configuration and data for the CA node to function properly and manage the issuance and management of digital certificates.

[0049] 2) Start the verification node and CA node;

[0050] When the CA node starts, the CA Reactor will be started, such as... Figure 3 As shown, various CA services are started in the CA Reactor, including certificate revocation service for malicious nodes, certificate issuance service for new ordinary nodes, and node certificate maintenance, and two coroutines are started. The certificate revocation service for malicious nodes means that if an ordinary node performs malicious operations, the CA node will revoke its certificate and broadcast it. The certificate issuance service for new ordinary nodes means that when a new ordinary node starts, the CA node will issue a certificate based on the ID of the new ordinary node and broadcast the new ordinary node information when the new ordinary node starts so that old nodes can establish communication with the new node. The node certificate maintenance means that the CA node will broadcast node information periodically so that the validator node can maintain its own address book and validator set to ensure the legitimacy of the certificates of nodes with established connections. For CA nodes, this invention adds CA Reactor. The CA Reactor starts the CA service and CA listener, and starts two coroutines to be responsible for broadcasting validator information and validator information, respectively. The former is used to synchronize validator information in the Tendermint blockchain network to ensure that all validator nodes in the network have the latest information, and the latter is used to synchronize validator information in the Tendermint blockchain network, which is crucial for maintaining consensus and network integrity.

[0051] When a CA node is started and running, configuration initialization is performed first to ensure the CA node has the correct settings. Next, logs and the database are initialized to effectively record CA node operation information and manage data. A check of the CA genesis block hash is performed to verify the CA node's initial state. Then, the CA node is started, network connectivity is configured, and certificates and keys are loaded for collaborative operation; startup information is recorded for monitoring and troubleshooting; the CA node enters a running loop, performing consensus and certificate management tasks to maintain normal network operation; simultaneously, the CA node listens for operation or termination signals and performs corresponding actions based on the received signals, such as upgrading or stopping operation. This ensures the stable operation and management of the CA node.

[0052] The CA node calls various methods in the X.509 digital certificate module to manage and verify the certificates of the verification node.

[0053] When a verification node starts, it will start all Reactors except CA Reactor and dial the verification nodes in the address book to establish secure communication.

[0054] In this embodiment, the initialization process of the verification node is as follows: Figure 4 As shown.

[0055] 3) Inter-node communication verification:

[0056] When a verification node needs to connect and communicate with other verification nodes, it sends its own certificate and signature to the other verification node for verification of the certificate's validity. This verification includes checking if the certificate has been revoked or expired, whether the issuer is a CA node, and the validity of the signature. Only if the verification passes can a connection be established; if the certificate validity verification fails, the connection will fail. In this embodiment, the connection communication process between nodes is as follows: Figure 5 As shown.

[0057] 4) Node certificate maintenance:

[0058] CA nodes are not responsible for maintaining other nodes' certificates; they are only responsible for issuing, renewing, and revoking node certificates. Verification nodes are only responsible for maintaining their own certificates.

[0059] Certificate extension: When a validator's certificate is about to expire or has already expired, the validator will proactively apply to the CA node for certificate extension. After the extension, the certificate content will change, and the validator with the extended certificate needs to re-establish connections with other nodes and update the certificate information in its address book.

[0060] 5) New regular nodes added:

[0061] The CA node broadcasts the information of the new ordinary node to other authentication nodes so that existing authentication nodes in the network can establish communication with the new authentication node; after joining, the new ordinary node will also send a request to the CA node to obtain information about other authentication nodes and actively dial to establish connections with other authentication nodes; in this embodiment, the startup and maintenance process of the new ordinary node is as follows: Figure 6 As shown.

[0062] 6) Malicious node removal:

[0063] When a validator node becomes a malicious node or engages in other illegal activities, the CA node revokes the validator node's certificate and broadcasts the revocation, causing all nodes to proactively update their address books and validator sets to remove malicious nodes.

[0064] Based on the above steps, access control policies for new node additions and inter-node communication in the Tendermint network can be implemented using the CA authentication system, thereby improving the security of the blockchain network.

[0065] In addition, CA nodes can also be used to implement certificate issuance, certificate query, certificate renewal, certificate revocation, certificate determination (whether a certificate has been revoked or expired), certificate verification, and digital signature verification. Among these:

[0066] (1) The certificate issuance function is as follows: the verification node interacts with the CA node and obtains the certificate. The request contains some parameters, such as user ID, user type, certificate purpose, node IP and port information. Then, a POST request is sent to the HTTP server, the response is processed, and the certificate generation logic is executed by the CA node.

[0067] (2) The certificate query function is as follows: the verification node communicates with the CA node, the certificate query logic is handled by the CA node, and the CA node will return the corresponding certificate or query result according to the information in the query request. The basic request sending logic is similar to that of issuing certificates.

[0068] (3) The certificate extension function is as follows: After the verification node communicates with the CA node, it sends a POST request to request the certificate extension. Then it processes the response of the CA node. The logic of the certificate extension is handled by the CA node. The CA node will update the validity period of the certificate according to the information in the renewal request and return the extended certificate or result.

[0069] (4) The certificate revocation function is as follows: After the verification node communicates with the CA node, it sends a POST request to request the revocation of the certificate. Then it processes the response of the CA node. The logic of revoking the certificate is handled by the CA node. The CA node will perform the revocation operation according to the information in the revocation request and return the revocation result.

[0070] (5) The function to determine whether a certificate has been revoked or expired is as follows: The CA node first calls the method to query the certificate to query the certificate information. If the certificate is not found, an error is returned. If the certificate is found, the next step is to check whether the certificate has been revoked. If it has been revoked, an error message is returned. If it has not been revoked, the certificate expiration time (Unix timestamp format) is obtained. The current time is obtained and the two times are compared. If the certificate expiration time is before the current time, an error message is returned indicating that the certificate has expired. If the certificate has neither been revoked nor expired, a valid certificate message is returned.

[0071] (6) The certificate verification function is as follows: The CA node first calls the certificate query method to query the certificate information. If the certificate is not found, an error is returned. If the certificate is found, the next step is to check whether the certificate has been revoked. If it has been revoked, the CA node will try to delay the certificate and use the delayed certificate content for subsequent verification. Then, the incoming certificate content is decoded and converted into an X.509 certificate object. A certificate pool is created and the certificate is added to the certificate pool. The certificate pool is the core component for establishing digital certificate verification and trust. It stores trusted certificates and is used to verify the validity of other certificates and the trust of the issuing certificate authority. Then, the function in the X.509 standard library is used to verify whether the incoming certificate is valid. If the verification fails, an error is returned.

[0072] (7) The digital signature verification function is as follows: The CA node first ensures that the decoded X.509 digital certificate is valid, then decodes the certificate data into the required structure, and then uses the public key in the certificate for verification. Next, the SHA-256 hash value of the incoming data is calculated for comparison with the signature. Finally, the RSA PKCS#1v1.5 signature verification algorithm is used to verify the data hash and signature. If the verification is successful, the function returns that the signature is valid; otherwise, it returns an error message.

[0073] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope defined by the claims of the present invention.

Claims

1. A secure access control method based on a CA authentication system, characterized in that: Adding a CA node to the existing verification nodes in the blockchain network does not require a third party to generate the node certificate. The verification node will send a request to the CA node to obtain the node certificate during initialization. When a verification node establishes a communication connection, it verifies the validity of the certificate to confirm whether the connection should be established. The verification node will periodically maintain its address book to ensure the validity of the certificates of nodes that have established connections. At the same time, a new node joining mechanism is set up, and the CA node will broadcast the new node information to existing nodes. CA nodes can also revoke the certificates of malicious nodes and broadcast notifications to other validator nodes, thereby maintaining the integrity of the address book and the trustworthiness of the validator set; The method includes the following steps: 1) Create and initialize the verification node and CA node; CA nodes are added to the existing verification nodes in the blockchain network. The verification nodes are divided into genesis nodes and ordinary nodes. When a CA node is created and initialized, a CA node configuration file, a root certificate, and the CA node's own certificate, i.e., a CA certificate, are generated. The root certificate is generated by self-signing, the CA certificate is issued by the root certificate, and the CA certificate issues other ordinary certificates. The initialization of a verification node falls into two categories: if it is a genesis node, a genesis file needs to be generated and saved in the database for ordinary nodes to access; if it is an ordinary node, its genesis file is retrieved from the database and saved locally. 2) Start the verification node and CA node; When a CA node starts, the CA Reactor is launched. Within the CA Reactor, various CA services are initiated, including certificate revocation for malicious nodes, certificate issuance for new ordinary nodes, and node certificate maintenance. Two coroutines are also started. The certificate revocation service for malicious nodes means that if an ordinary node performs malicious operations, the CA node will revoke its certificate and broadcast the revocation. The certificate issuance service for new ordinary nodes means that when a new ordinary node starts, the CA node issues a certificate based on the new ordinary node's ID and broadcasts the new ordinary node's information to facilitate communication between old and new nodes. Node certificate maintenance means that the CA node periodically broadcasts node information so that validating nodes can maintain their address books and validator sets, ensuring the legitimacy of certificates for nodes with established connections. When a verification node starts, it will start all Reactors except CA Reactor and dial the verification nodes in the address book to establish secure communication. 3) Inter-node communication verification: When a validator node needs to connect and communicate with other validator nodes, it sends its own certificate and signature to the other validator node so that the other validator node can verify the validity of the certificate. Specifically, this includes checking whether the certificate has been revoked or expired, whether the issuer is a CA node, and the validity of the signature. Only if the verification is successful can the connection and communication be established. If the certificate validity verification fails, the connection and communication will fail. 4) Node certificate maintenance: CA nodes are not responsible for maintaining other nodes' certificates; they are only responsible for issuing, renewing, and revoking node certificates. Verification nodes are only responsible for maintaining their own certificates. Certificate extension: When a validator's certificate is about to expire or has already expired, the validator will proactively apply to the CA node for certificate extension. After the extension, the certificate content will change, and the validator with the extended certificate needs to re-establish connections with other nodes and update the certificate information in its address book. 5) Addition of new regular nodes: The CA node will broadcast the information of the new ordinary node to other validator nodes so that existing validator nodes in the network can establish communication with the new validator node; after the new ordinary node joins, it will also send a request to the CA node to obtain information of other validator nodes and actively dial to other validator nodes to establish a connection. 6) Malicious node removal: When a validator node becomes a malicious node or engages in illegal activities, the CA node revokes the validator node's certificate and broadcasts the revocation, causing all nodes to proactively update their address books and validator sets to remove malicious nodes.

2. The secure access control method based on a CA authentication system according to claim 1, characterized in that: The CA node initialization involves initializing a Certificate Authority node to manage the issuance and management of digital certificates. This includes setting the root directory and loading configurations, creating relevant directories, configuring P2P network parameters, creating the CA node's key, executing initialization tasks, configuring private validators (including key files and state files), loading existing private validators if the key file exists, and generating new private validators if not. Private validators are used for verification during block signing and consensus processes. Afterward, the genesis file is configured to initialize the blockchain. If the genesis file exists, it is recorded; otherwise, a new genesis file is generated.

3. The secure access control method based on a CA authentication system according to claim 2, characterized in that: The CA Reactor starts the CA service and CA listener, and initiates two coroutines, one for broadcasting validator information and the other for broadcasting validator information. The former is used to synchronize validator information in the Tendermint blockchain network to ensure that all validator nodes in the network have the latest information, while the latter is used to synchronize validator information in the Tendermint blockchain network.

4. The secure access control method based on a CA authentication system according to claim 3, characterized in that: When starting and running a CA node, the first step is to initialize the configuration to ensure that the CA node has the correct settings; then, the logs and database are initialized to effectively record CA node operation information and management data. Perform a check on the CA genesis block hash to verify the initial state of the CA nodes; Then start the CA node, configure network connectivity, and load certificates and keys to work together; Record the startup information of the CA node for monitoring and troubleshooting; the CA node enters the running loop to perform consensus and certificate management tasks to maintain the normal operation of the network; at the same time, the CA node listens for operation or termination signals and performs corresponding operations based on the received signals. The CA node calls methods in the X.509 digital certificate module to manage and verify the certificates of the verification node.

5. A secure access control method based on a CA authentication system according to claim 4, characterized in that: The CA node can also be used to implement functions such as issuing certificates, querying certificates, renewing certificates, revoking certificates, determining whether a certificate has been revoked or expired, verifying certificates, and verifying digital signatures.

6. The secure access control method based on a CA authentication system according to claim 5, characterized in that: The certificate issuance function is as follows: the verification node interacts with the CA node and obtains the certificate. The request for obtaining the certificate contains user information parameters. Then, a POST request is sent to the HTTP server, the response is processed, and the certificate generation logic is executed by the CA node.

7. A secure access control method based on a CA authentication system according to claim 6, characterized in that: The certificate query function is as follows: the verification node communicates with the CA node, the certificate query logic is handled by the CA node, and the CA node will return the corresponding certificate or query result based on the information in the query request; The extended certificate function is as follows: after the verification node communicates with the CA node, it sends a POST request to request an extended certificate, and then processes the response of the CA node. The logic of the extended certificate is handled by the CA node. The CA node will update the validity period of the certificate according to the information in the renewal request and return the extended certificate or result. The certificate revocation function is as follows: after the verification node communicates with the CA node, it sends a POST request to request the revocation of the certificate. Then, it processes the response from the CA node. The logic for revoking the certificate is handled by the CA node. The CA node will perform the revocation operation based on the information in the revocation request and return the revocation result.

8. A secure access control method based on a CA authentication system according to claim 7, characterized in that: The function to determine whether a certificate has been revoked or expired is as follows: First, the certificate query method is called to query the certificate information. If the certificate is not found, an error is returned. If the certificate is found, the next step is to check whether the certificate has been revoked. If it has been revoked, an error message indicating certificate revocation is returned. If it has not been revoked, the certificate expiration time is obtained, the current time is obtained, and the two times are compared. If the certificate expiration time is before the current time, an error message indicating expired certificate is returned. If the certificate has neither been revoked nor expired, a valid certificate message is returned.

9. A secure access control method based on a CA authentication system according to claim 8, characterized in that: The certificate verification function works as follows: First, the certificate query method is called to query certificate information. If the certificate is not found, an error is returned. If the certificate is found, the next step is to check if the certificate has been revoked. If it has been revoked, the certificate will be delayed and the delayed certificate content will be used for subsequent verification. Then, the incoming certificate content is decoded and converted into an X.509 certificate object. A certificate pool is created, and certificates are added to the certificate pool. The certificate pool is the core component for establishing digital certificate verification and trust. It stores trusted certificates and is used to verify the validity of other certificates and the trust of the issuing certificate authority. Then, functions in the X.509 standard library are used to verify whether the incoming certificate is valid. If the verification fails, an error is returned.

Images