Blockchain-based digital certificate verification method, blockchain node, and storage medium

Abstract

The embodiment of the application provides a kind of based on the digital certificate verification method of blockchain, blockchain node and storage medium, the method comprises: the digital certificate verification request that first equipment sends is received by blockchain node;Wherein, verification request includes identity information, certificate information corresponding to digital certificate;Corresponding target verification strategy is determined based on identity information, certificate information;Further, the verification result corresponding to digital certificate can be obtained based on target verification strategy and carry out verification processing to digital certificate;The method simplifies the certificate dependent party to digital certificate verification strategy management at the same time, reduces the computing environment requirement and implementation difficulty of dependent party using digital certificate, improves the reliability of verification.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a blockchain-based digital certificate verification method, blockchain node, and storage medium. Background Technology

[0002] Public Key Infrastructure (PKI) is a crucial supporting technology in the field of information security, widely used in scenarios such as digital signatures, identity authentication, secure communication, data encryption / decryption, and integrity protection. Digital certificates, as the carriers of PKI technology, are issued by trusted Certificate Authorities (CAs) after verifying user application information, serving as trusted identity credentials for users. CAs, as managers of the digital certificate lifecycle, periodically publish Certificate Revocation Lists (CRLs) for users to check the status of digital certificates. In practical applications, users often select certain information from these CRLs as verification targets based on their own security needs, i.e., they formulate certificate verification strategies.

[0003] However, for a party to verify digital certificates, it needs the resources, environment, and functionality to execute verification policies, creating a certain barrier to entry. Secondly, when a party trusts multiple CAs, it not only needs to maintain multiple sets of verification policies but also support different policy execution environments. This is particularly unfriendly to parties with limited storage capacity or those unable to directly interact with the external network, and places high demands on their operational and maintenance work. Furthermore, since the party maintains its own verification policies, the policy configuration lacks corresponding security protection, making it difficult to guarantee their trustworthiness and integrity. In summary, currently, parties face problems with complex verification processes and low reliability when verifying digital certificates. Summary of the Invention

[0004] This application implements legislation to provide a blockchain-based digital certificate verification method, blockchain node, and storage medium, which can simplify the digital certificate verification process while improving verification reliability.

[0005] The technical solution of this application embodiment is implemented as follows:

[0006] In a first aspect, embodiments of this application provide a blockchain-based digital certificate verification method, the method comprising:

[0007] Receive a verification request sent by a first device; wherein the verification request includes identity information and certificate information corresponding to the digital certificate;

[0008] The corresponding target verification strategy is determined based on the identity information and the certificate information;

[0009] The digital certificate is verified based on the target verification strategy to obtain the verification result corresponding to the digital certificate.

[0010] Secondly, embodiments of this application provide a blockchain node, which includes: a receiving unit, a determining unit, and a verifying unit;

[0011] The receiving unit is configured to receive a verification request sent by the first device; wherein the verification request includes identity information and certificate information corresponding to the digital certificate;

[0012] The determining unit is used to determine the corresponding target verification strategy based on the identity information and the certificate information;

[0013] The verification unit is used to perform verification processing on the digital certificate based on the target verification strategy to obtain the verification result corresponding to the digital certificate.

[0014] Thirdly, embodiments of this application provide a blockchain node, which includes: a processor and a memory; wherein,

[0015] The memory is used to store computer programs that can run on the processor;

[0016] The processor is configured to execute the blockchain-based digital certificate verification method as described above when running the computer program.

[0017] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer program code, which, when executed by a computer, implements the blockchain-based digital certificate verification method as described above.

[0018] This application provides a blockchain-based digital certificate verification method, a blockchain node, and a storage medium. The blockchain node receives a verification request sent by a first device. The verification request includes identity information and certificate information corresponding to the digital certificate. A corresponding target verification strategy is determined based on the identity information and certificate information. The digital certificate is then verified based on the target verification strategy to obtain a verification result. Therefore, the blockchain node can determine the corresponding target verification strategy based on the received identity information and certificate information. Furthermore, it can verify the digital certificate based on the target verification strategy. This application utilizes the immutability and trusted execution characteristics of blockchain to verify the digital certificate, thereby quickly obtaining the verification result. This method simplifies the management of digital certificate verification strategies by the certificate-dependent party, reduces the computational environment requirements and implementation difficulty for the party using the digital certificate, and improves verification reliability. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the blockchain-based digital certificate verification method proposed in this application. Figure 1 ;

[0020] Figure 2 This is a schematic diagram of the blockchain-based digital certificate verification method proposed in this application. Figure 2 ;

[0021] Figure 3 This is a schematic diagram of the blockchain-based digital certificate verification method proposed in this application. Figure 3 ;

[0022] Figure 4 This is a schematic diagram of the blockchain-based digital certificate verification method proposed in this application. Figure 4 ;

[0023] Figure 5 This is a schematic diagram of the blockchain-based digital certificate verification method proposed in this application. Figure 5 ;

[0024] Figure 6 This is a schematic diagram of the blockchain-based digital certificate verification method proposed in this application. Figure 6 ;

[0025] Figure 7 This is a schematic diagram of the composition structure of a blockchain node proposed in an embodiment of this application. Figure 1 ;

[0026] Figure 8 This is a schematic diagram of the composition structure of a blockchain node proposed in an embodiment of this application. Figure 2 . Detailed Implementation

[0027] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for explaining the relevant application and not for limiting the application. Furthermore, it should be noted that, for ease of description, only the parts related to the relevant application are shown in the accompanying drawings.

[0028] Public Key Infrastructure (PKI) is a crucial supporting technology in the field of information security, widely used in scenarios such as digital signatures, identity authentication, secure communication, data encryption / decryption, and integrity protection. Digital certificates, as the carrier of PKI technology, are issued by trusted Certificate Authorities (CAs) after verifying user application information, serving as trusted identity credentials for users. When interacting with users, dependent parties obtain the user's digital certificate and, with the support of the CA, verify its validity, responding to user requests based on the verification results.

[0029] Digital certificates contain not only user information, but also information such as the certificate issuer (i.e., the Certificate Authority), root certificate signature, validity period, certificate usage, and signature algorithm. This information is fixed after the digital certificate is issued and can all be used as objects for verification by the dependent party. In addition, as the manager of the digital certificate lifecycle, the Certificate Authority will periodically publish a Certificate Revocation List (CRL) for the dependent party to check the status of the digital certificate. In practical applications, the dependent party often selects certain information as verification objects according to its own security needs, that is, formulates a certificate verification strategy.

[0030] Currently, in order to support certificate verification, there are some requirements for the dependent party, including: (1) having the hardware and software resources and network environment to perform certificate verification, formulating and maintaining a series of verification strategies, implementing the corresponding software functions of the verification strategies in its own business, and ensuring correct execution; (2) installing the root certificates and certificate chains of all trusted CA authorities to verify the trustworthiness of the certificate issuer; (3) downloading and updating the CRL lists published by all CA authorities in a timely manner through the Internet, or being able to access the Online Certificate Status Protocol (OCSP) of CA authorities in real time to verify whether the certificate has been revoked; In addition, in practice, due to resource limitations, development difficulties or other objective reasons, the dependent party often relaxes the verification strategy to a certain extent, such as: due to network limitations or limited storage resources, it is not possible to download / store the CRL list, so it chooses not to query the CRL list, etc. Such processing will bring significant security risks to the dependent party's business.

[0031] In summary, the current certificate verification methods have the following problems: (1) To verify digital certificates, the dependent party needs to have the resources, environment, and functions to execute the verification policy, such as access to the Internet and signature verification, which creates a certain threshold for using digital certificates; (2) When the dependent party trusts multiple CA institutions, it not only needs to maintain multiple sets of verification policies, but also needs to support different policy execution environments, such as installing multiple CA root certificates and certificate chains, downloading multiple sets of CRL lists, and updating them in a timely manner. This is very unfriendly to dependent parties with limited storage capacity or unable to directly interact with the external network, and also places high demands on the operation and maintenance work of dependent parties; (3) The dependent party maintains the verification policy independently, and the policy configuration lacks corresponding security protection, making it difficult to ensure its trustworthiness and integrity; (4) Due to resource or environmental limitations, the verification policy is reduced, which can easily introduce security risks to the dependent party. For example, if the dependent party chooses not to query the CRL list because it cannot access the Internet, it can easily allow revoked certificates to still be used normally, which can easily lead to security risks such as certificate misuse.

[0032] To address the issues of complex verification processes and low reliability currently encountered by parties relying on digital certificates, this application provides a blockchain-based digital certificate verification method, a blockchain node, and a storage medium. The blockchain node receives a verification request from a first device; the verification request includes identity information and certificate information corresponding to the digital certificate. A corresponding target verification strategy is determined based on the identity information and certificate information; the digital certificate is then verified using the target verification strategy to obtain a verification result. Therefore, the blockchain node can determine the corresponding target verification strategy based on the received identity information and certificate information; and then verify the digital certificate based on the target verification strategy. This application utilizes the immutability and trusted execution characteristics of blockchain to verify digital certificates, thereby quickly obtaining the verification result. This simplifies the management of digital certificate verification strategies for certificate-reliant parties, reduces the computational environment requirements and implementation difficulty for using digital certificates, and improves verification reliability.

[0033] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0034] Example 1

[0035] This application provides a blockchain-based digital certificate verification method. Figure 1 This is a schematic diagram of the blockchain-based digital certificate verification method proposed in this application. Figure 1 ,like Figure 1 As shown, a blockchain-based digital certificate verification method may include the following steps:

[0036] Step 101: Receive the verification request sent by the first device; wherein, the verification request includes identity information and certificate information corresponding to the digital certificate.

[0037] In the embodiments of this application, the blockchain node can receive a verification request sent by the first device; wherein, the verification request includes identity information and certificate information corresponding to the digital certificate.

[0038] It should be noted that, in the embodiments of this application, the first device may be an organization, a website, or a hardware or software device; this application does not specifically limit the type of the first device.

[0039] It should be noted that, in the embodiments of this application, the certificate information corresponding to the digital certificate may include the digital certificate or the certificate identifier information corresponding to the digital certificate.

[0040] It should be noted that, in the embodiments of this application, before receiving the verification request sent by the first device, the blockchain node may receive the first verification strategy set sent by the first device; and then the first verification strategy set may be processed on the blockchain.

[0041] It should be noted that, in the embodiments of this application, the first verification strategy set may include N verification strategies, where N is an integer greater than 0. This application does not specifically limit the number of verification strategies included in the first verification strategy set.

[0042] It should be noted that, in the embodiments of this application, the first verification strategy set may include N verification strategies, where N is an integer greater than 0. This application does not specifically limit the number of verification strategies included in the first verification strategy set.

[0043] Step 102: Determine the corresponding target verification strategy based on identity information and certificate information.

[0044] In the embodiments of this application, after receiving the verification request sent by the first device, the blockchain node can determine the corresponding target verification strategy based on the identity information and certificate information.

[0045] It should be noted that, in the embodiments of this application, when a blockchain node determines the corresponding target verification strategy based on identity information and certificate information, it can determine the corresponding target digital certificate user set based on identity information and certificate information; then it can determine the target verification strategy number set corresponding to the target digital certificate user set, and determine the target verification strategy corresponding to the target verification strategy number set in the first verification strategy set.

[0046] It should be noted that, in the embodiments of this application, the digital certificate user is the ultimate holder of the certificate, which can be a person, organization, website, or hardware and software device; this application does not specifically limit the type of digital certificate user.

[0047] It should be noted that, in the embodiments of this application, when a blockchain node determines the corresponding target digital certificate user set based on identity information and certificate information, it can call a smart contract to determine the status of the digital certificate based on the identity information and the certificate information corresponding to the digital certificate; when the status of the digital certificate is normal, the corresponding target digital certificate user set can be determined based on the identity information and the certificate information corresponding to the digital certificate.

[0048] It should be noted that, in the embodiments of this application, when a blockchain node determines the target verification policy number set corresponding to the target digital certificate user set, it can determine the target verification policy number set corresponding to the target digital certificate user set based on the first correspondence relationship; wherein, the first digital certificate user set includes the target digital certificate user set.

[0049] It should be noted that, in the embodiments of this application, the first digital certificate user set may include at least one digital certificate user set, and this application does not specifically limit the number of digital certificate user sets included in the first digital certificate user set.

[0050] It should be noted that, in the embodiments of this application, the target digital certificate user set can be a part or all of the first digital certificate user set. Assuming that the first digital certificate user set is digital certificate user set 1, digital certificate user set 2, ..., digital certificate user set N, and the target digital certificate user set is digital certificate user set 2, the target verification policy number set corresponding to digital certificate user set 2 can be determined as {11, 12, 13, 14} based on the first correspondence.

[0051] Step 103: Verify the digital certificate based on the target verification strategy to obtain the verification result corresponding to the digital certificate.

[0052] In the embodiments of this application, after determining the corresponding target verification strategy based on identity information and certificate information, the blockchain node can perform verification processing on the digital certificate based on the target verification strategy to obtain the verification result corresponding to the digital certificate.

[0053] It should be noted that, in the embodiments of this application, Figure 2 This is a schematic diagram of the blockchain-based digital certificate verification method proposed in this application. Figure 2 ,like Figure 2As shown, before the blockchain node verifies the digital certificate based on the target verification strategy, i.e., before step 103, the following steps may also be included:

[0054] Step 104: Receive the first correspondence between the first policy number corresponding to the first verification policy set and the first digital certificate user set sent by the first device.

[0055] It should be noted that, in the embodiments of this application, the first device may be an organization, a website, or a hardware or software device; this application does not specifically limit the type of the first device.

[0056] Step 105: Add the first correspondence to the blockchain.

[0057] It should be noted that, in the embodiments of this application, after receiving the first policy number corresponding to the first verification policy set sent by the first device, the first correspondence between the first policy number and the first digital certificate user set, the blockchain node can process the first correspondence on the blockchain.

[0058] It should be noted that, in the embodiments of this application, the first set of digital certificate users is assumed to be digital certificate user set 1, digital certificate user set 2, ..., digital certificate user set N, where N is an integer greater than 0. The set of verification policies corresponding to digital certificate user set 1 can be {P1, P2, P3, P4}, and the policy number can be {11, 12, 13, 14}. Then, the policy number corresponding to verification policy P1 is 11, the policy number corresponding to verification policy P2 is 12, the policy number corresponding to verification policy P3 is 13, and the policy number corresponding to verification policy P4 is 14.

[0059] For example, in the embodiments of this application, verification strategy P1 can be used to verify the signature of the digital certificate issuer; verification strategy P2 can be used to verify the validity period of the digital certificate; verification strategy P3 can be used to verify whether the digital certificate is in the latest CRL list; verification strategy P4 can be used to verify whether the digital certificate subject information is consistent with the device identity information. This application does not specifically limit the function of the verification strategy.

[0060] It should be noted that, in the embodiments of this application, the blockchain node can receive a smart contract published by the first device, wherein the smart contract is used to determine the certificate status and perform certificate verification.

[0061] It should be noted that, in the embodiments of this application, the smart contract function may include querying the certificate status based on the identity information and the certificate information corresponding to the digital certificate, such as "normal" or "revoked"; querying the set of verification strategies to be followed, and completing the verification work according to the strategies in the set to obtain the result of the digital certificate being valid or invalid. This application does not specifically limit the content included in the smart contract function.

[0062] It should be noted that, in the embodiments of this application, the blockchain node can also receive sub-smart contracts published by the first device to the blockchain. The sub-smart contracts can be called during the execution of the smart contract. For example, they can be used to query whether the digital certificate is in the CRL list published by the CA authority and return the query results.

[0063] It should be noted that, in the embodiments of this application, after receiving an update instruction or a revocation instruction sent by the first device, the blockchain node can update or revoke the first verification policy set and the first correspondence; and / or, after receiving a new instruction sent by the first device, it can add a second digital certificate user set, a second verification policy set, and a second correspondence between the second policy number corresponding to the second verification policy set and the second digital certificate user set.

[0064] Furthermore, in the embodiments of this application, when a blockchain node verifies a digital certificate based on the target verification strategy corresponding to the target verification strategy number set and obtains the verification result corresponding to the digital certificate, it can call a smart contract, and then verify the digital certificate based on the target verification strategy corresponding to the target verification strategy number set and obtain the verification result corresponding to the digital certificate.

[0065] For example, in an embodiment of this application, it is assumed that the target verification strategy number set is {11, 12} and the target verification strategy is {P5, P6}. Verification strategy P5 can be used to verify the signature of the digital certificate issuer; verification strategy P6 can be used to verify the validity period of the digital certificate; the blockchain node can call the smart contract and perform the verification process of the digital certificate based on the target verification strategy {P5, P6} to obtain the verification result corresponding to the digital certificate.

[0066] It should be noted that, in the embodiments of this application, when only the third verification strategy set is uploaded to the chain, the blockchain node can receive the verification strategy number set sent by the first device; call the smart contract and determine the status of the digital certificate based on the identity information and the certificate information corresponding to the digital certificate; if the status of the digital certificate is normal, filter out the verification strategy corresponding to the verification strategy number set from the third verification strategy set; and perform verification processing on the digital certificate based on the verification strategy.

[0067] It should be noted that, in the embodiments of this application, after receiving the set of verification policy numbers sent by the first device, the blockchain node can match the verification policy corresponding to the set of verification policy numbers in the third set of verification policies, and then perform verification processing on the digital certificate based on the verification policy.

[0068] It should be noted that, in the embodiments of this application, the third verification strategy set includes at least the first verification strategy set and the second verification strategy set, that is, the third verification strategy set may include all verification strategies in the first verification strategy set and the second verification strategy set. This application does not make a specific limitation on the number of verification strategies included in the third verification strategy set.

[0069] It should be noted that, in the embodiments of this application, when a blockchain node calls a smart contract to perform verification processing, if it finds that a digital certificate that was originally in a normal state already exists in the CRL list issued by a CA authority, it can modify the certificate status of the digital certificate to revoked.

[0070] It should be noted that, in the embodiments of this application, when the first device only publishes a smart contract to the blockchain, it can receive the fourth verification strategy set sent by the first device; call the smart contract, and determine the status of the digital certificate based on the identity information and the certificate information corresponding to the digital certificate; if the status of the digital certificate is normal, it can perform verification processing on the digital certificate based on the verification strategy in the fourth verification strategy set.

[0071] It should be noted that, in the embodiments of this application, when multiple first devices share a set of verification strategies, the blockchain node can receive identity identification information and certificate information corresponding to digital certificates sent by multiple first devices. The certificate information includes digital certificates or certificate identification information corresponding to digital certificates. Then, the blockchain node can query the status of digital certificates based on the identity identification information and the certificate information corresponding to digital certificates. If the status of digital certificates is normal, the corresponding set of verification strategies is queried, and the set of verification strategies can be returned to the first devices. The dependent party performs certificate verification. In this scenario, the blockchain is only used to record and share verification strategies and does not perform certificate verification processing. Therefore, there is no need for the first devices to issue smart contracts.

[0072] In summary, blockchain nodes can process the first set of verification strategies on the chain and determine the corresponding set of target digital certificate users. Then, based on the first correspondence, they can determine the set of target verification strategy numbers corresponding to the set of target digital certificate users. Subsequently, they can verify the digital certificate based on the target verification strategy corresponding to the set of target verification strategy numbers to obtain the verification result of the digital certificate. By leveraging the immutability and trusted execution characteristics of blockchain, the verification of digital certificates can be achieved, which can improve the reliability and efficiency of verification.

[0073] This application provides a blockchain-based digital certificate verification method. A blockchain node receives a verification request from a first device. The verification request includes identity information and certificate information corresponding to the digital certificate. A target verification strategy is determined based on the identity information and certificate information. The digital certificate is then verified using the target verification strategy to obtain a verification result. Therefore, the blockchain node can determine the target verification strategy based on the received identity information and certificate information. Furthermore, it can verify the digital certificate based on the target verification strategy. This application utilizes the immutability and trusted execution characteristics of blockchain to verify the digital certificate, thereby quickly obtaining the verification result. This simplifies the management of digital certificate verification strategies by the certificate-dependent party, reduces the computational environment requirements and implementation difficulty for the party using the digital certificate, and improves verification reliability.

[0074] Example 2

[0075] Based on the above embodiments, another embodiment of this application provides a blockchain-based digital certificate verification method. This method records the user digital certificate issued by the CA authority and the certificate verification strategy required by the dependent party in the blockchain ledger. The dependent party (first device) can conveniently complete the certificate verification through the blockchain. The blockchain-based digital certificate verification method is described below.

[0076] It should be noted that, in the embodiments of this application, the digital certificate user is the ultimate holder of the certificate, which can be a person, organization, website, hardware or software device, etc.; the dependent party is a person, organization, website, hardware or software device, etc., that needs to conduct activities by verifying the digital certificate or its signature or encryption, and is an entity that trusts and uses the digital certificate, trusting the digital certificate issued by one or more designated CA authorities.

[0077] It should be noted that, in the embodiments of this application, when a digital certificate user obtains a digital certificate, the digital certificate or its key information (such as certificate serial number, hash value, issuer, etc.) is submitted to the blockchain system in the form of a transaction through a blockchain node / blockchain client. The blockchain node verifies the validity of the digital certificate and / or the completeness of the submitted key information before uploading it to the chain, including: (1) formulating verification rules for uploading digital certificates to the chain, such as: formulating a list of trusted CA institutions, and only digital certificates issued by CA institutions in the list can be uploaded to the chain. This rule is embodied in a smart contract, and the smart contract carries the root certificate of the trusted CA institution; (2) verifying that the identity of the digital certificate user is consistent with the subject of the digital certificate, such as: verifying the password method; (3) verifying that the digital certificate issuing institution belongs to a trusted CA institution and whether the certificate is in a revoked state, such as: querying the CRL list of CA institutions; After the above verification, the blockchain node can record the digital certificate / agreed key certificate information to the blockchain ledger and mark the certificate status as normal.

[0078] It should be noted that, in the embodiments of this application, when a digital certificate is found in the CRL list, the certificate status can be marked as revoked, and subsequent verification requests for the certificate will not require further verification.

[0079] Furthermore, in the embodiments of this application, the dependent party (first device) can generate multiple verification strategies according to its own security needs. After the blockchain node verifies the integrity of the strategy, it records it to the blockchain ledger. This may include: the dependent party (first device) formulating verification strategies (first verification strategy set) for the agreed certificate user group (first digital certificate user set), such as: which fields need to be strictly verified, which fields can be ignored, what algorithms need to be supported, etc.

[0080] (2) The blockchain system can record the verification strategy (first set of verification strategies) in the ledger, denoted as P1, P2, P3..., and can also record the correspondence between certificate users (first set of digital certificate users) (e.g., users who issue certificates for a certain CA, or users within a certain domain range) and the set of verification strategy numbers (first strategy numbers) to be followed {P1.no, P2.no, ...}.

[0081] For example, in an embodiment of this application, a network element device providing a service needs to establish a secure channel with another network element device calling the service after authentication with a digital certificate. Since the callers of the service include local devices and devices from other domains with different levels of trust, the administrator believes that simple verification is sufficient for local devices, while strict verification is required for access requests from other domains. Therefore, different sets of verification strategies are formulated according to whether the request is from the local network segment, and the correspondence between the device network segment and the set of verification strategy numbers to be followed is recorded on the blockchain; for example, the administrator formulates verification strategies P1, P2, P3, and P4 with verification strategy numbers 13, 15, 20, and 25 respectively; where P1(13): verifies the signature of the digital certificate issuer; P2(15): verifies the validity period of the digital certificate; P3(20): verifies whether the digital certificate is in the latest CRL list; P4(25) To verify whether the digital certificate subject information is consistent with the device identity information, the corresponding relationship on the blockchain can be configured as follows: local network segment 192.168.132.1~192.168.132.254—>{(13), (15)}, other network segments—>{(13), (15), (20), (25)}. When the network element device receives an access request, the blockchain can determine the verification strategy to be followed based on the accessor's network segment information and execute the corresponding smart contract for verification.

[0082] Furthermore, in the embodiments of this application, the dependent party (first device) can publish a smart contract for digital certificate verification on the blockchain. The contract functions at least include: querying the certificate status based on the user identity ID (identity information) and the digital certificate / digital certificate identifier (certificate information corresponding to the digital certificate), such as "normal" or "revoked"; querying the set of verification strategies to be followed; completing the verification work according to the strategies in the set; and returning the result of the digital certificate being valid or invalid.

[0083] It should be noted that, in the embodiments of this application, the classification of certificate user groups agreed upon by the dependent party should be determined by the user's identity ID; for example, the organization or equipment manufacturer to which they belong; the dependent party may also publish a series of sub-smart contracts that execute specific verification strategies, which are called during the execution of the digital certificate verification contract; for example, to query whether a digital certificate is in the CRL list published by the CA authority, the CRL list can be queried through a specific smart contract and the query result can be returned.

[0084] It should be noted that, in the embodiments of this application, the dependent party (first device) can add new verification policies (second verification policy set), certificate user groups (second digital certificate user set), and policy number sets (second policy numbers) as needed by submitting transactions; the dependent party can update the certificate verification policies (first verification policy set) or corresponding relationships (first corresponding relationships) already on the chain by submitting transactions, for example, by controlling it through time / policy version. During the certificate verification process, the latest verification policy shall prevail. The dependent party can revoke the published verification policies or corresponding relationships by submitting transactions, such as by publishing a new policy record in the ledger and marking it as invalid. During the certificate verification process, policies and corresponding relationships marked as invalid are ignored.

[0085] Furthermore, in the embodiments of this application, when executing the verification strategy, if it is found that a digital certificate that was originally in a normal state already exists in the CRL list issued by the CA authority, the certificate status of the digital certificate is modified to revoked.

[0086] It should be noted that, in the embodiments of this application, Figure 3 This is a schematic diagram of the blockchain-based digital certificate verification method proposed in this application. Figure 3 ,like Figure 3 As shown, when the dependent party interacts with the user, it obtains the user's identity ID (identity identification information) and digital certificate, and initiates a verification request to the blockchain. The steps are as follows: 1. The user sends the identity ID (identity identification information) and digital certificate Cert in a pre-defined format to the dependent party; 2. The dependent party sends the user's identity ID (identity identification information) and digital certificate / digital certificate identifier (certificate information corresponding to the digital certificate) to the blockchain node in the form of a transaction, and calls the certificate verification smart contract; 3. If the certificate verification smart contract finds that the digital certificate status is normal, it can then query the set of verification strategy numbers to be followed, P = {P1.no, P2.no, ...} (target verification strategy number), based on the (certificate information corresponding to the digital certificate). The method parses and matches the verification strategies (target verification strategies) contained in the set, and executes the verification. When executing the verification strategy, the corresponding sub-smart contract is called to complete the verification. 4. After verification, the verification result is fed back to the dependent party. 5. The dependent party responds to the user's business request based on the verification result. This verification method is suitable for situations where the dependent party puts the verification strategy (first verification strategy set), the correspondence between the certificate user group and the verification strategy set (first correspondence) on the chain in advance. During the digital certificate verification process, the strategy set and the corresponding strategy can be directly queried and the contract can be called to execute. If the blockchain serves multiple dependent parties, the relationship between the certificate user group and the verification strategy set, the verification smart contract, etc., need to be distinguished by the dependent party, such as by the dependent party's identity ID.

[0087] Furthermore, in the embodiments of this application, depending on the on-chain granularity of the verification strategy of the dependent party (first device), this application can also adjust the verification method accordingly. Figure 4 This is a schematic diagram of the blockchain-based digital certificate verification method proposed in this application. Figure 4 ,like Figure 4 As shown, this applies to scenarios where the dependent party only records the verification strategies used (the third set of verification strategies) on the blockchain, without recording the correspondence between the certificate user group and the set of verification strategies (the first correspondence) in the blockchain ledger. The steps are as follows: 1. The user sends their identity ID (identity information) and digital certificate Cert in a pre-defined format to the dependent party; 2. The dependent party sends the user's identity ID (identity information), digital certificate / digital certificate identifier (certificate information corresponding to the digital certificate), and the set of verification strategy numbers to be followed (ID, Cert / CertID, {P1.no, P2.no, ...}) to the blockchain node in the form of a transaction, invoking the certificate verification smart contract; 3. If the certificate verification smart contract finds that the digital certificate status is "normal", it parses the set of verification strategy numbers in the transaction content, queries and matches all verification strategies corresponding to the request in the ledger, and executes the verification; 4. Upon completion of the verification, the verification result is fed back to the dependent party; 5. The dependent party responds to the user's business request based on the verification result.

[0088] For example, in the embodiments of this application, when only the third set of verification strategies is uploaded to the chain, the blockchain node can receive the set of verification strategy numbers sent by the first device; call the smart contract and determine the status of the digital certificate based on the identity information and the certificate information corresponding to the digital certificate; if the status of the digital certificate is normal, filter out the verification strategy corresponding to the set of verification strategy numbers from the third set of verification strategies; and perform verification processing on the digital certificate based on the verification strategy.

[0089] It should be noted that, in the embodiments of this application, after receiving the set of verification policy numbers sent by the first device, the blockchain node can match the verification policy corresponding to the set of verification policy numbers in the third set of verification policies, and then perform verification processing on the digital certificate based on the verification policy.

[0090] It should be noted that, in the embodiments of this application, the third verification strategy set includes at least the first verification strategy set and the second verification strategy set, that is, the third verification strategy set may include all verification strategies in the first verification strategy set and the second verification strategy set. This application does not make a specific limitation on the number of verification strategies included in the third verification strategy set.

[0091] Furthermore, in the embodiments of this application, Figure 5 This is a schematic diagram of the blockchain-based digital certificate verification method proposed in this application. Figure 5 ,like Figure 5 As shown, this method is applicable to scenarios where the dependent party only publishes a digital certificate verification smart contract, and the verification strategies (first set of verification strategies) and the correspondence between certificate user groups and the set of verification strategies (first correspondence) are not recorded in the blockchain ledger. The steps are as follows: 1. The user sends their identity ID and digital certificate Cert in a pre-defined format to the dependent party; 2. The dependent party sends the user's identity ID, digital certificate / digital certificate identifier, and the set of verification strategies to be followed (ID, Cert / CertID, {P1, P2, ...}) to the blockchain node in the form of a transaction, invoking the certificate verification smart contract; 3. If the certificate verification smart contract finds that the digital certificate status is normal, it parses the verification strategies {P1, P2, ...} in the transaction content and executes the verification; 4. Upon completion of the verification, the verification result is fed back to the dependent party; 5. The dependent party responds to the user's business request based on the verification result. This method is also applicable to scenarios where only the blockchain is used to complete part of the certificate verification work. For example, when the dependent party cannot directly query the CRL list published by the CA, it can use the blockchain to execute the CRL list query strategy to assist in verification, while other verification strategies are completed by the dependent party itself.

[0092] Furthermore, in the embodiments of this application, Figure 6 This is a schematic diagram of the blockchain-based digital certificate verification method proposed in this application. Figure 6 ,like Figure 6 As shown, this method is suitable for scenarios where multiple dependent parties share a single verification strategy, which may be maintained by a CA (Certificate Authority) or other entities trusted by the dependent parties. The steps are as follows: 1. The user sends their identity ID (identity information) and digital certificate Cert in a pre-defined format to the dependent party; 2. The dependent party sends the user's identity ID and digital certificate / digital certificate identifier (ID, Cert / CertID) to a non-blockchain node in the form of a transaction; 3. If the blockchain queries the digital certificate status and finds it to be normal, it queries the set of verification strategies to be followed, P = {P1, P2, ...}; 4. The blockchain returns the results to the dependent party; 5. The dependent party performs certificate verification; 6. Verification is complete, and the blockchain responds to the user's business request based on the verification result. In this method, the blockchain is only used to record and share the verification strategy and does not perform certificate verification. Therefore, there is no need for the dependent party to publish a certificate verification smart contract.

[0093] In summary, blockchain nodes can process the first set of verification strategies on the chain and determine the corresponding set of target digital certificate users. Then, based on the first correspondence, they can determine the target verification strategy number corresponding to the target set of digital certificate users. Subsequently, they can verify the digital certificate based on the target verification strategy corresponding to the target verification strategy number to obtain the verification result of the digital certificate. By leveraging the immutability and trusted execution characteristics of blockchain, the verification of digital certificates can be achieved, which can improve the reliability and efficiency of verification.

[0094] This application provides a blockchain-based digital certificate verification method. A blockchain node receives a verification request from a first device. The verification request includes identity information and certificate information corresponding to the digital certificate. A target verification strategy is determined based on the identity information and certificate information. The digital certificate is then verified using the target verification strategy to obtain a verification result. Therefore, the blockchain node can determine the target verification strategy based on the received identity information and certificate information. Furthermore, it can verify the digital certificate based on the target verification strategy. This application utilizes the immutability and trusted execution characteristics of blockchain to verify the digital certificate, thereby quickly obtaining the verification result. This simplifies the management of digital certificate verification strategies by the certificate-dependent party, reduces the computational environment requirements and implementation difficulty for the party using the digital certificate, and improves verification reliability.

[0095] Example 3

[0096] Based on the above embodiments, this application provides a blockchain node. Figure 7 Diagram of the composition structure of a blockchain node Figure 1 ,like Figure 7 As shown, the blockchain node 10 includes: a receiving unit 11, a determining unit 12, and a verifying unit 13;

[0097] The receiving unit 11 is used to receive a verification request sent by the first device; wherein the verification request includes identity information and certificate information corresponding to the digital certificate;

[0098] The determining unit 12 is used to determine the corresponding target verification strategy based on the identity information and the certificate information;

[0099] The verification unit 13 is used to perform verification processing on the digital certificate based on the target verification strategy to obtain the verification result corresponding to the digital certificate.

[0100] In the embodiments of this application, further, Figure 8 Diagram of the composition structure of a blockchain node Figure 2 ,like Figure 8 As shown, the blockchain node 10 proposed in this application embodiment may further include a processor 14, a memory 15 storing executable instructions of the processor 14, and further, the blockchain node 10 may also include a communication interface 16 and a bus 17 for connecting the processor 14, the memory 15 and the communication interface 16.

[0101] In the embodiments of this application, the processor 14 can be at least one of the following: Application-Specific Integrated Circuit (ASIC), Digital Signal Processor (DSP), Digital Signal Processing Device (DSPD), Programmable Logic Device (PLD), Field-Programmable Gate Array (FPGA), Central Processing Unit (CPU), controller, microcontroller, and microprocessor. It is understood that for different devices, the electronic device used to implement the above-mentioned processor function can also be other types, and this application embodiment does not specifically limit this. The blockchain node 10 may also include a memory 15, which can be connected to the processor 14. The memory 15 is used to store executable program code, which includes computer operation instructions. The memory 15 may include high-speed RAM memory and may also include non-volatile memory, such as at least two disk drives.

[0102] In embodiments of this application, bus 17 is used to connect communication interface 16, processor 14, and memory 15, as well as the mutual communication between these devices.

[0103] In embodiments of this application, memory 15 is used to store instructions and data.

[0104] Furthermore, in an embodiment of this application, the processor 14 is configured to receive a verification request sent by a first device; wherein the verification request includes identity information and certificate information corresponding to the digital certificate; determine a corresponding target verification strategy based on the identity information and the certificate information; perform verification processing on the digital certificate based on the target verification strategy to obtain a verification result corresponding to the digital certificate.

[0105] In practical applications, the aforementioned memory 15 can be volatile memory, such as random-access memory (RAM); or non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid-state drive (SSD); or a combination of the above types of memory, and provide instructions and data to the processor 14.

[0106] This application provides a blockchain node that can receive verification requests sent by a first device. The verification request includes identity information and certificate information corresponding to the digital certificate. A corresponding target verification strategy is determined based on the identity information and certificate information. The digital certificate is then verified using the target verification strategy to obtain a verification result. Therefore, the blockchain node can determine the corresponding target verification strategy based on the received identity information and certificate information. Furthermore, it can verify the digital certificate based on the target verification strategy. This application utilizes the immutability and trusted execution characteristics of blockchain to verify the digital certificate, thereby quickly obtaining the verification result. This simplifies the management of digital certificate verification strategies by the certificate-dependent party, reduces the computational environment requirements and implementation difficulty for the party using the digital certificate, and improves verification reliability.

[0107] This application provides a computer-readable storage medium storing a program thereon, which, when executed by a processor, implements the blockchain-based digital certificate verification method described above.

[0108] Specifically, the program instructions corresponding to a blockchain-based digital certificate verification method in this embodiment can be stored on storage media such as optical discs, hard disks, and USB flash drives. When the program instructions corresponding to the blockchain-based digital certificate verification method in the storage media are read or executed by an electronic device, the following steps are included:

[0109] Receive a verification request sent by a first device; wherein the verification request includes identity information and certificate information corresponding to the digital certificate;

[0110] The corresponding target verification strategy is determined based on the identity information and the certificate information;

[0111] The digital certificate is verified based on the target verification strategy to obtain the verification result corresponding to the digital certificate.

[0112] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0113] This application is described with reference to schematic and / or block diagrams of implementations of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block of the schematic and / or block diagrams can be implemented by computer program instructions, and combinations of blocks in the schematic and / or block diagrams can be implemented. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the schematic and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0114] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in the implementation flow diagram. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0115] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0116] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application.

Claims

1. A blockchain-based digital certificate verification method, characterized in that, The method comprises: receiving a verification request sent by a first device; wherein the verification request comprises identity information and certificate information corresponding to a digital certificate; determining a target verification policy corresponding to the identity information and the certificate information; verifying the digital certificate based on the target verification policy to obtain a verification result corresponding to the digital certificate.

2. The method of claim 1, wherein, The certificate information comprises the digital certificate or certificate identification information corresponding to the digital certificate, and before receiving the verification request sent by the first device, the method further comprises: receiving a first verification policy set sent by the first device; performing chain processing on the first verification policy set.

3. The method of claim 2, wherein, The determination of the target verification policy corresponding to the identity information and the certificate information comprises: determining a target digital certificate user set corresponding to the identity information and the certificate information; determining a target verification policy number set corresponding to the target digital certificate user set, and determining a target verification policy corresponding to the target verification policy number set in the first verification policy set.

4. The method of claim 1, wherein, Before the verification processing of the digital certificate based on the target verification policy, the method further comprises: receiving a first correspondence relationship between a first policy number set corresponding to the first verification policy set and a first digital certificate user set sent by the first device; performing chain processing on the first correspondence relationship.

5. The method of claim 3, wherein, The determination of the target verification policy number set corresponding to the target digital certificate user set comprises: determining the target verification policy number set corresponding to the target digital certificate user set based on the first correspondence relationship; wherein the first digital certificate user set comprises the target digital certificate user set.

6. The method of claim 5, wherein, The method further comprises: updating or revoking the first verification policy set and the first correspondence relationship; and / or, adding a second digital certificate user set, a second verification policy set, a second correspondence relationship between a second policy number corresponding to the second verification policy set and the second digital certificate user set.

7. The method of claim 3, wherein, The determination of the target digital certificate user set corresponding to the identity information and the certificate information comprises: calling a smart contract to determine the state of the digital certificate based on the identity information and the certificate information corresponding to the digital certificate; when the state of the digital certificate is normal, determining a target digital certificate user set corresponding to the identity information and the certificate information corresponding to the digital certificate.

8. The method of claim 7, wherein, The verification processing of the digital certificate based on the target verification policy to obtain a verification result corresponding to the digital certificate comprises: calling the smart contract to verify the digital certificate based on the target verification policy corresponding to the target verification policy number set to obtain a verification result corresponding to the digital certificate.

9. The method of claim 8, wherein, The third verification policy at least comprises the first verification policy and the second verification policy, and when only the third verification policy set is chained, the method further comprises: receiving a verification policy number set sent by the first device; The smart contract is invoked to determine the state of the digital certificate based on the identity information and the certificate information corresponding to the digital certificate; In the case where the state of the digital certificate is normal, a verification policy corresponding to the verification policy number set is screened out from the third verification policy set; The digital certificate is verified based on the verification policy.

10. The method of claim 8, wherein, When the first device only publishes a smart contract to the blockchain, the method further comprises: receiving a fourth verification policy set sent by the first device; The smart contract is invoked to determine the state of the digital certificate based on the identity information and the certificate information corresponding to the digital certificate; In the case where the state of the digital certificate is normal, the digital certificate is verified based on the verification policy in the fourth verification policy set. 11.A blockchain node, characterized in that, The blockchain node comprises a receiving unit, a determining unit and a verification unit. The receiving unit is configured to receive a verification request sent by a first device, wherein the verification request comprises identity information and certificate information corresponding to a digital certificate. The determining unit is configured to determine a target verification policy based on the identity information and the certificate information. The verification unit is configured to verify the digital certificate based on the target verification policy and obtain a verification result corresponding to the digital certificate. 12.A blockchain node, characterized in that, The blockchain node comprises a processor and a memory. The memory is configured to store a computer program capable of running on the processor. The processor is configured to execute the method according to any one of claims 1-10 when running the computer program.

13. A computer-readable storage medium, characterized in that, The storage medium stores computer program code, which, when executed by a computer, executes the method according to any one of claims 1-10.

Images