Certificate management method and device, electronic equipment and medium

Abstract

The invention provides a certificate management method and device, electronic equipment and a medium, and relates to the field of digital identity management. The method is applied to each holder and comprises the steps that a first knowledge graph is created with a certificate of each dependency statement as a first vertex and dependency relationships among different certificates as edges, and the certificates comprise verifiable certificates and / or traditional digital certificates; and creating a second knowledge graph by taking the subject and the value in each declaration as a second vertex pair and taking the subject pointing to the value as an edge, associating each edge in the second knowledge graph with an array and a label, recording a first vertex corresponding to the certificate to which the declaration belongs in the array, and enabling the label to be equal to the profile in the declaration. According to the scheme provided by the invention, the certificate information is managed by adopting two different granularities, so that not only can the certificate and declarated information be completely and comprehensively recorded, but also the management efficiency of the certificate can be remarkably improved.

Description

Technical Field

[0001] The present invention relates to the field of digital identity management, and in particular to a certificate management method, device, electronic equipment and medium. Background Art

[0002] With the emergence and popularization of the Internet, identity has another form of expression, namely digital identity. The core of digital identity is to prove the information of the holder based on various digital certificates. The digital certificates currently in use in the industry include traditional digital certificates based on centralized management and Verifiable Credentials (VC) based on decentralization.

[0003] At present, most of the ways to manage certificates in the industry ignore the characteristics of certificate structured data, making the management of digital certificates complicated. Especially after a single verifiable credential or traditional digital certificate expires, finding all affected credentials or traditional certificates not only requires a lot of computing power, but also has poor search efficiency and accuracy. In addition, as an important part of the certificate, the claim has a complex dependency relationship with different certificates. As the number of digital certificates increases, the management of the certificate itself and the claims it relies on will become more complicated, and the cost of management and maintenance is high, so it is in urgent need of improvement. Summary of the invention

[0004] The present invention provides a certificate management method, device, electronic device and medium to solve the defects of high cost and low efficiency of certificate management in the prior art, and proposes to use a knowledge graph to effectively manage all certificates and declarations held by the holder.

[0005] According to a first aspect of the present invention, the present invention provides a certificate management method, which is applied to each holder, and the method comprises: Creating a first knowledge graph with each certificate of the dependency declaration as a first vertex and dependency relationships between different certificates as edges, wherein the certificates include verifiable credentials and / or traditional digital certificates; A second knowledge graph is created with the subject and value in each statement as the second vertex pair and the subject pointing to the value as the edge, wherein each edge in the second knowledge graph is associated with an array and a label, the array records the first vertex corresponding to the certificate to which the statement belongs, and the label is equal to the property in the statement.

[0006] According to the certificate management method of the present invention, a first knowledge graph is created with each certificate of dependency declaration as a first vertex and dependency relationships between different certificates as edges, including: Creating a first mapping table for recording the correspondence between the first vertex and each verifiable credential and / or traditional digital certificate; Get the certificate to be created from the certificate creation request; Determine whether there is a first vertex corresponding to the certificate to be created in the first mapping table; If there is a first vertex corresponding to the certificate to be created, returning that the certificate to be created has been created; If there is no first vertex corresponding to the certificate to be created, creating a new first vertex and updating the first mapping table; When creating a new first vertex, the certificate relied upon when applying for the certificate to be created is obtained to obtain the dependent certificate, the first vertex corresponding to each dependent certificate is searched through the first mapping table, and an edge is created from each found first vertex to the new first vertex.

[0007] According to the certificate management method of the present invention, the method further includes: Obtaining the certificate to be deleted from the certificate deletion request, and searching the first target vertex corresponding to the certificate to be deleted through the first mapping table; Searching for a subgraph from the first knowledge graph based on the target first vertex, and determining a topological sequence list of the subgraph by a topological sorting algorithm, wherein the subgraph includes the target first vertex, other first vertices that can be directly and indirectly reached by the target first vertex, and edges connecting the vertices; The subgraph is deleted from the first knowledge graph and the first mapping table is updated synchronously, and the first knowledge graph and the topological sequence table after the subgraph is deleted are returned.

[0008] According to the certificate management method of the present invention, a second knowledge graph is created with subject and value in each statement as second vertex pairs and subject pointing to value as edges, including: Creating a second mapping table for recording the correspondence between each second vertex and each declaration, and an edge list of the second vertices connected by each edge; Get the statement to be created from the statement creation request; Determine whether two vertices in the statement to be created both belong to the second mapping table; If both vertices do not belong to the second mapping table, create a new second vertex pair, create an edge connecting the two new second vertices, and update the second mapping table and the edge list; In the case of creating a new second vertex pair, obtaining the first vertex corresponding to the certificate to which the statement to be created belongs and the subject, value and property in the statement to be created, setting the two vertices of the new second vertex pair to correspond to the subject and value respectively, creating an edge from the vertex corresponding to the subject to the vertex corresponding to the value, adding an associated array and label to the created edge, putting the first vertex corresponding to the certificate to which the statement to be created belongs into the array, and setting the label value equal to the property of the statement to be created; If any one of the two vertices does not belong to the second mapping table, create a new second vertex, create an edge connecting the new second vertex and the existing vertex, and update the second mapping table and the edge list; In the case of creating a new second vertex, obtain the first vertex corresponding to the certificate to which the statement to be created belongs, as well as the subject, value and property in the statement to be created, set the new second vertex and the existing second vertex to correspond to the subject and value respectively, set the newly created edge to point from the vertex corresponding to the subject to the value, add an associated array and label to the newly created edge, put the first vertex corresponding to the certificate to which the statement to be created belongs into the array, and set the label value to be equal to the property of the statement to be created; If both vertices belong to the second mapping table, determining whether there is an edge connecting the two vertices in the edge list; If there is no edge connecting the two vertices, create a new edge, set the new edge according to the first vertex corresponding to the certificate to which the statement to be created belongs and the subject, value and property in the statement to be created, and update the edge list; If there is an edge connecting the two vertices, determine whether there is an edge among the edges connecting the two vertices whose property is the same as the property of the statement to be created, and the direction of the edge satisfies the value pointed to by the subject of the statement to be created; If it exists, put the first vertex corresponding to the certificate to which the statement to be created belongs into the array; If it does not exist, create a new edge with the direction from the subject of the statement to be created to the value and the label value equal to the property of the statement to be created, and update the edge list.

[0009] According to the certificate management method of the present invention, the method further includes: In the case of a deleted certificate, all statements included in the deleted certificate are obtained; Using the second mapping table, searching for all second vertices corresponding to all statements included in the deleted certificate; Using the edge list, searching for all edges connected to all the found second vertices; Traverse the array associated with each edge among all the edges found, and determine whether the first vertex corresponding to the deleted certificate exists in the array; If a first vertex corresponding to a deleted certificate exists in a certain array, the first vertex corresponding to the deleted certificate in the certain array is deleted; When any first vertex in an array is deleted, it is determined whether the array is an empty array after deletion; If the array after deletion is an empty array, the edge to which the empty array belongs is deleted from the second knowledge graph and the edge list is updated synchronously, and it is determined whether the vertices connected to the deleted edge are still connected to other edges; If the vertices connected by the deleted edge are connected to other edges, the second knowledge graph after deleting the edge is returned; If the vertex connected to the deleted edge is not connected to other edges, the corresponding vertex will be deleted and the second mapping table will be updated synchronously, and the second knowledge graph after deleting the edge and vertex will be returned.

[0010] According to the certificate management method of the present invention, the method further includes: When a query request for an association relationship of a certain first vertex is received, all first vertices in the first knowledge graph that are connected to the certain first vertex through edges are traversed; Taking certificates corresponding to other first vertices that can reach the first vertex as a first certificate set; Taking certificates corresponding to other first vertices reachable by the first vertex as a second certificate set; The first certificate set and the second certificate set are returned.

[0011] According to the certificate management method of the present invention, the method further includes: Upon receiving a query for a statement included in a first vertex, traverse the array associated with each edge in the second knowledge graph; Return the subject, value, and property corresponding to each second vertex in the array including the first vertex.

[0012] According to a second aspect of the present invention, the present invention provides a certificate management device, which is applied to each holder, and the device includes: A first creation module, configured to create a first knowledge graph with each certificate of dependency declaration as a first vertex and dependency relationships between different certificates as edges, wherein the certificates include verifiable credentials and / or traditional digital certificates; The second creation module is used to create a second knowledge graph with the subject and value in each statement as the second vertex pair and the subject pointing to the value as the edge, wherein each edge in the second knowledge graph is associated with an array and a label, the array records the first vertex corresponding to the certificate to which the statement belongs, and the label is equal to the property in the statement.

[0013] According to a third aspect of the present invention, the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the certificate management method described above is implemented.

[0014] According to a fourth aspect of the present invention, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the certificate management method as described in any one of the above is implemented.

[0015] The present invention provides a certificate management method, which first establishes a first knowledge graph based on the certificate as the granularity, then establishes a second knowledge graph based on the declaration content as the granularity, and uses the edges in the second knowledge graph to maintain the relationship between each declaration and certificate, thereby realizing the management of certificate information at two different granularities. It can not only completely and comprehensively record the information of certificates and declarations, but also accurately and clearly record the relationship between certificates, and the relationship between certificates and declarations, thereby significantly improving the management efficiency of certificates.

[0016] In addition, a certificate management device, an electronic device and a non-transitory computer-readable storage medium provided by the present invention can also achieve the above-mentioned technical effects, which will not be described in detail here. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 It is a flow chart of the certificate management method provided by the present invention.

[0019] Figure 2 It is a schematic diagram of the first knowledge graph construction process provided by the present invention.

[0020] Figure 3 This is a schematic diagram of updating the first knowledge graph when deleting a certificate provided by the present invention.

[0021] Figure 4 It is a schematic diagram of the second knowledge graph construction process provided by the present invention.

[0022] Figure 5 This is a schematic diagram of updating the second knowledge graph when deleting a certificate provided by the present invention.

[0023] Figure 6 It is a structural schematic diagram of the certificate management device provided by the present invention.

[0024] Figure 7 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0026] Combine the following Figures 1 to 7 A certificate management method, a certificate management device, an electronic device and a non-transitory computer-readable storage medium of the present invention are described.

[0027] Figure 1 This is a flow chart of the certificate management method provided by the present invention. Please refer to Figure 1 As shown, this embodiment provides a certificate management method, which is applied to each holder. The method can be implemented through steps S101 to S102. Each step will be described in detail below: Step S101, creating a first knowledge graph with each certificate of dependency declaration as the first vertex and dependency relationships between different certificates as edges, wherein the certificates include verifiable credentials and / or traditional digital certificates.

[0028] Verifiable Credentials (VC): A descriptive statement issued by a distributed identity identifier (DID) to endorse certain attributes of another DID, and attach its own digital signature to prove the authenticity of these attributes. It can be considered a digital certificate. Verifiable credentials consist of three parts: VC metadata (Credential Metadata), claims (Claims) and proofs (Proofs).

[0029] Traditional digital certificates are usually issued by an authoritative certificate authority (CA). Digital certificates contain the user's identity information, such as name, organization, public key, etc., and use digital signatures to ensure their authenticity and integrity. Similar to verifiable credentials, traditional digital certificates also include statements.

[0030] In the specific implementation process, the certificate used to construct the first knowledge graph can be a certificate set consisting of all verifiable credentials, or a traditional digital certificate, or a certificate set consisting of a mixture of verifiable credentials and traditional digital certificates.

[0031] In this embodiment, the holder can have multiple certificates, each certificate corresponds to a first vertex. For example, if a holder has five verifiable credentials, then there are five first vertices in the first knowledge graph. Different verifiable credentials may or may not have dependencies. If there are dependencies, two first vertices with dependencies need to be connected by edges. For example, the five first vertices are denoted as VC1 to VC5. VC1 has dependencies with VC2 and VC3. Then VC1 needs to be connected with VC2 and VC3 by two edges respectively, while V1 does not need to be connected with VC4 and VC5. The first knowledge graph is constructed with certificates as the object. When the certificates used to construct the knowledge graph are all verifiable credentials, the first knowledge graph can also be called the VC knowledge graph.

[0032] It should be noted that the number of certificates included in the first knowledge graph in this embodiment and the specific dependencies between different verifiable credentials are only used for illustration and should not be construed as limitations on the scheme of the present invention.

[0033] Step S102, creating a second knowledge graph with the subject and value in each declaration as the second vertex pair and the subject pointing to the value as the edge, wherein each edge in the second knowledge graph is associated with an array and a label, the array records the first vertex corresponding to the certificate to which the declaration belongs, and the label is equal to the property in the declaration.

[0034] In this embodiment, when constructing the second knowledge graph, each claim is composed of two vertices, a label and an array, one vertex represents the subject and the other vertex represents the value, the label is used to record the property of the claim, and the array is used to record the certificate to which the claim belongs; vertex pairs corresponding to different claims may have some vertices in common, such as two claims sharing a subject or value, and vertex pairs corresponding to different claims may also have all vertices in common, such as two claims sharing the same subject and value. At this time, the difference between the two claims is that they are connected by different edges. The format of the declaration is "Subject-Property-Value". The exemplary part assumes that the three declarations include: Claim1: Pat graduated from a certain university, Claim2: Pat knows Sam, and Claim3: Sam is a university professor. Then the second knowledge graph includes three second vertex pairs. Pat is the subject of Claim1 and Claim2, and Sam is the subject of Claim3. The properties of Claim1, Claim2 and Claim3 are graduated from, known, and work labels respectively. The values ​​of Claim1, Claim2 and Claim3 are a certain university, Sam, and university professor respectively. Continuing with the example, assuming that Claim1 is associated with VC1 and VC2, then the array associated with the edge of the second vertex pair corresponding to Claim1 will record [VC1, VC2], and the properties of the three declarations are recorded in the labels associated with the corresponding edges. The second knowledge graph is constructed with declarations as objects. The second knowledge graph can also be called the Claims knowledge graph.

[0035] It should be noted that the number of statements included in the second knowledge graph in this embodiment and the specific dependencies between different verifiable credentials are only used for illustration and should not be construed as limitations on the scheme of the present invention.

[0036] The certificate management method of this embodiment first establishes a first knowledge graph based on the certificate as the granularity, and then establishes a second knowledge graph based on the declaration content as the granularity, and uses the edges in the second knowledge graph to maintain the relationship between each declaration and certificate, thereby realizing the use of two different granularities to manage certificate information. It can not only fully and comprehensively record the information of certificates and declarations, but also clearly and accurately record the relationship between certificates, and the relationship between certificates and declarations, thereby significantly improving the management efficiency of certificates.

[0037] In some possible implementations, Figure 2 This is a schematic diagram of the first knowledge graph construction process provided by the present invention. Please refer to Figure 2As shown, the aforementioned step S101 creates a first knowledge graph with each certificate of dependency declaration as the first vertex and dependency relationships between different certificates as edges, specifically including: Step S201, creating a first mapping table for recording the correspondence between the first vertex and each certificate; Step S202, obtaining the certificate to be created from the certificate creation request; Step S203, determining whether there is a first vertex corresponding to the certificate to be created in the first mapping table; Step S204: if there is a first vertex corresponding to the certificate to be created, returning that the certificate to be created has been created; Step S205: if there is no first vertex corresponding to the certificate to be created, create a new first vertex and update the first mapping table; Step S206, when creating a new first vertex, obtain the certificate that is relied upon when applying for the certificate to be created to obtain a dependent certificate, search the first vertex corresponding to each dependent certificate through the first mapping table, and create an edge from each found first vertex to the new first vertex.

[0038] For ease of understanding, let’s take the management of a verifiable credential set as an example. Alice is the holder of a verifiable credential (VC). use express The set of all declarations contained in . use Statement The subject, use Statement property, use Statement The value of corresponds to the declaration format definition of Subject-Property-Value. First, the relevant algorithm of VC knowledge graph is given. It should be pointed out that before adding the first verifiable credential, the vertex set and edge set of VC knowledge graph are empty. In the specific implementation process, the construction reference of the first knowledge graph is as follows: Algorithm input: VC knowledge graph ; a newly obtained verifiable credential ; Algorithm output: join in The knowledge graph obtained later; (1) Create a The corresponding vertex is added to In ; (2) For each verifiable credential ,satisfy Yes Application Verifiable credentials that you rely on when you create a Corresponding vertex points to The directed edge corresponding to the vertex, and add the newly created directed edge to middle; (3) Return to the knowledge graph .

[0039] It should be noted that although this embodiment takes a verifiable credential set as an example, this management method is also applicable to a traditional digital certificate set or a mixed set of verifiable credentials and traditional digital certificates.

[0040] In some possible implementations, the method further includes: Obtaining the certificate to be deleted from the certificate deletion request, and searching the first target vertex corresponding to the certificate to be deleted through the first mapping table; Searching for a subgraph from the first knowledge graph based on the target first vertex, and determining a topological sequence list of the subgraph by a topological sorting algorithm, wherein the subgraph includes the target first vertex, other first vertices that can be directly and indirectly reached by the target first vertex, and edges connecting the vertices; The subgraph is deleted from the first knowledge graph and the first mapping table is updated synchronously, and the first knowledge graph and the topological sequence table after the subgraph is deleted are returned.

[0041] Specifically, Figure 3 This is a schematic diagram of updating the first knowledge graph when the verifiable credential is deleted provided by the present invention. Please refer to Figure 3 As shown, the implementation of deleting verifiable credentials is as follows: Algorithm input: VC knowledge graph ; A verifiable credential that has expired or been revoked ; Algorithm output: VC knowledge graph based on all valid verifiable credentials; a topologically sorted list of verifiable credentials that need to be re-applied; (1) Find Zhongyu The corresponding vertex ;make express A subgraph of All accessible The middle vertices and all directed edges between them; (2) Use the topological sorting algorithm to determine The topological sequence of ; (3) From Delete all , and delete all directed edges associated with these vertices; let the newly obtained knowledge graph be represented as ; (4) Return to the knowledge graph and topological sequence .

[0042] It should be noted that although this embodiment takes a verifiable credential set as an example, this management method is also applicable to a traditional digital certificate set or a mixed set of verifiable credentials and traditional digital certificates.

[0043] Let's assume that the structure of a first knowledge graph is as follows Figure 3 As shown in the figure, when VC5 is deleted during the management process, the vertices that VC5 can directly reach in the first knowledge graph are VC6 and VC7, and the vertex that VC5 can indirectly reach is VC8. At this time, the vertices of VC5, VC6, VC7 and VC8 and the edges connecting these vertices are the subgraph part. Then, the topological sorting algorithm is applied to the subgraph to obtain the topological sequence. Figure 3 The number of vertices and connection relationships shown in the figure are for illustration only and should not be construed as limiting the present invention.

[0044] The certificate management method of this embodiment allows the certificate holder to complete the construction of the VC knowledge graph based on the set of certificates already held, and when the held certificate is invalid or revoked, the VC knowledge graph can be updated according to the deleted vertices. At the same time, a list of affected and invalid certificates is returned. The invalid certificates are consulted based on the list and the affected services are further analyzed. The certificates in the list are generated according to the topological sorting algorithm, that is, the certificate at any position in the list will only depend on the previous certificates at that position in the list. When the holder needs to reapply for the expired certificate, he only needs to apply one by one in the order given in the list, without worrying about the problem of unsatisfactory dependencies between certificates.

[0045] In some possible implementations, Figure 4 This is a schematic diagram of the second knowledge graph construction process provided by the present invention. Please refer to Figure 4 As shown, the aforementioned step S102 creates a second knowledge graph with subject and value in each statement as second vertex pairs and with subject pointing to value as edges, specifically including: Step S401, creating a second mapping table for recording the corresponding relationship between each second vertex and each declaration, and an edge list of the second vertices connected by each edge; It should be noted that the second mapping table is a table used to represent the relationship between each vertex and the statement. Through the second mapping table, it is possible to quickly find which statement each second vertex belongs to. Since the subject or value vertex belongs to one or more statements, the mapping relationship between the second vertex and the statement is not necessarily unique. Figure 5 Taking the second knowledge graph before updating as an example, the second mapping table should include the following content: u1 can be mapped to claim1, v1 can be mapped to claim1, u2 can be mapped to claim2 and claim3, v3 can be mapped to claim3... and so on; Step S402, obtaining the statement to be created from the statement creation request; Step S403, determining whether the two vertices in the statement to be created both belong to the second mapping table; Step S404: if both vertices do not belong to the second mapping table, create a new second vertex pair, create an edge connecting the two new second vertices, and update the second mapping table and the edge list; Step S405, in the case of creating a new second vertex pair, obtain the first vertex corresponding to the certificate to which the statement to be created belongs, and the subject, value, and property in the statement to be created, set the two vertices of the new second vertex pair to correspond to the subject and value respectively, create an edge from the vertex corresponding to the subject to the vertex corresponding to the value, add an associated array and label to the created edge, put the first vertex corresponding to the certificate to which the statement to be created belongs into the array, and set the label value to be equal to the property of the statement to be created; Step S406, if any one of the two vertices does not belong to the second mapping table, create a new second vertex, create an edge connecting the new second vertex and the existing vertex, and update the second mapping table and the edge list; Step S407, in the case of creating a new second vertex, obtain the first vertex corresponding to the certificate to which the statement to be created belongs, and the subject, value, and property in the statement to be created, set the new second vertex and the existing second vertex to correspond to the subject and value respectively, set the newly created edge to point from the vertex corresponding to the subject to the value, add an associated array and label to the newly created edge, put the first vertex corresponding to the certificate to which the statement to be created belongs into the array, and set the label value to be equal to the property of the statement to be created; Step S408, if both vertices belong to the second mapping table, determining whether there is an edge connecting the two vertices in the edge list; Step S409: if there is no edge connecting the two vertices, a new edge is created, the new edge is set according to the first vertex corresponding to the certificate to which the statement to be created belongs and the subject, value and property in the statement to be created, and the edge list is updated; Step S410, if there is an edge connecting the two vertices, determine whether there is an edge among the edges connecting the two vertices whose property is the same as the property of the statement to be created, and the direction of the edge satisfies the value pointed to by the subject of the statement to be created; Step S411, if it exists, put the first vertex corresponding to the certificate to which the statement to be created belongs into the array; Step S412: if it does not exist, create a new edge with the direction from the subject of the statement to be created to the value and the label value equal to the property of the statement to be created, and update the edge list.

[0046] In the specific implementation process, the construction of the Claims knowledge graph is as follows: Algorithm input: Claims knowledge graph ; a newly obtained verifiable credential ; and the set of claims contained in the verifiable credential ; Algorithm output: join in The knowledge graph obtained later; (1) Create a graph node set ,satisfy , and the claims collection The subject and value of each statement in A vertex in All vertices in are added to In ; (2) Next, we describe the directed edge set. The update process, A directed edge can be represented by two vertices. For example, a directed edge (u2, v2) represents an edge from u2 to v2, a directed edge (v2, u2) represents an edge from v2 to u2, and a directed edge (u2, v3) represents an edge from u2 to v3. It should be noted that each directed edge is associated with a label and an array, and the elements in the array represent the VC subscripts associated with the directed edge. Each statement in , perform the following steps in sequence: Step 1: correspond The vertices in ,make correspond The vertices in ; Step 2: If there is a point to Directed edge ,and The label of is equal to pro(c), then Add to Otherwise, create an associative array consisting of point to Directed edge ,Will The label is set to , create a The associated empty array will Add to the associative array and Join middle; (3) Return the updated knowledge graph ; In some possible implementations, the method further includes: In the case of deleting a certificate, all statements included in the deleted certificate are obtained, wherein the deleted certificate may be an invalid or revoked certificate; Using the second mapping table, searching for all second vertices corresponding to all statements included in the deleted certificate; Using the edge list, searching for all edges connected to all the found second vertices; Traverse the array associated with each edge among all the edges found, and determine whether the first vertex corresponding to the deleted certificate exists in the array; If a first vertex corresponding to a deleted certificate exists in a certain array, the first vertex corresponding to the deleted certificate in the certain array is deleted; When any first vertex in an array is deleted, it is determined whether the array is an empty array after deletion; If the array after deletion is an empty array, the edge to which the empty array belongs is deleted from the second knowledge graph and the edge list is updated synchronously, and it is determined whether the vertices connected to the deleted edge are still connected to other edges; If the vertices connected by the deleted edge are connected to other edges, the second knowledge graph after deleting the edge is returned; If the vertex connected to the deleted edge is not connected to other edges, the corresponding vertex will be deleted and the second mapping table will be updated synchronously, and the second knowledge graph after deleting the edge and vertex will be returned.

[0047] Specifically, Figure 5This is a schematic diagram of updating the second knowledge graph when deleting the verifiable credential provided by the present invention. Please refer to Figure 5 As shown, delete the verifiable credentials Claims knowledge graph The update process is as follows: Algorithm input: Claims knowledge graph ; An expired or revoked verifiable credential ; and the set of claims contained in the verifiable credential ; Algorithm output: A knowledge graph built based on the claims contained in all valid verifiable credentials; (1) For Each statement in , perform the following steps: make correspond The vertices in ;make correspond The vertices in ;make Indicates a point to , and satisfies The label is equal to ; Will from Delete from the associative array; if If the associative array of is empty, from Delete it, that is ; (2) Return the updated knowledge graph .

[0048] Let's assume that the structure of a second knowledge graph is as follows Figure 5 As shown, assuming that the verifiable credential VC5 is deleted in the first knowledge graph, since VC5 is recorded in the array associated with the edge connecting u2 and v2 in the second knowledge graph, it is necessary to update the array associated with the edge connecting u2 and v2. Specifically, VC5 recorded in the array is deleted. If there is still data in the array after deleting the edge, there is no need to delete the vertex. If there is still other data in the array after deleting VC5, there is no need to delete the vertex. If there is no other data in the array after deleting VC5, it is necessary to determine whether to delete the u2 and v2 vertices. The logic for whether to delete the vertex is as follows: determine whether u2 and v2 are still connected by other edges. If they are still connected by other edges, they should not be deleted. If there are no other edges, the vertex should be deleted together. Similarly Figure 5 The number of vertices and connection relationships shown in the figure are for illustration only and should not be construed as limiting the present invention.

[0049] The certificate management method of this embodiment allows certificate holders to complete the construction of the Claims knowledge graph based on the set of certificates they already hold. When the certificates they hold are invalid or revoked, they can update the Claims knowledge graph based on the deleted vertices. When updating the declaration information, only the numbers associated with the edges need to be modified, which greatly reduces the complexity of declaration management and has extremely high maintenance efficiency.

[0050] In some possible implementations, the method further includes: When a query request for an association relationship of a certain first vertex is received, all first vertices in the first knowledge graph that are connected to the certain first vertex through edges are traversed; Taking certificates corresponding to other first vertices that can reach the first vertex as a first certificate set; Taking certificates corresponding to other first vertices reachable by the first vertex as a second certificate set; The first certificate set and the second certificate set are returned.

[0051] Exemplary continues with Figure 3 Taking the first knowledge graph shown as an example, assuming that the query request is to query the association between VC3 and other credentials, the vertices that can reach VC3 are VC1 and VC2, and the vertices that VC3 can reach are VC4, VC5, VC6, VC7, and VC8. At this time, the first certificate set is the set composed of VC1 and VC2, and the second set is the set composed of VC4, VC5, VC6, VC7, and VC8.

[0052] In some possible implementations, the method further includes: Upon receiving a query for a statement included in a first vertex, traverse the array associated with each edge in the second knowledge graph; Return the subject, value, and property corresponding to each second vertex in the array including the first vertex.

[0053] Exemplary continues with Figure 5 Taking the second knowledge graph shown as an example, assuming that the query request is a statement to query VC3, since VC3 is recorded in the array associated with the edge connecting u1 and v1, the subject, value, and property corresponding to the vertex pair should be returned as the query result.

[0054] The certificate management method of this embodiment provides the holder with two types of editable query services, which can not only query the relationship between any certificate and other certificates, but also accurately search for the statements included in any certificate, providing great convenience for the holder to manage certificates and statements.

[0055] The certificate management device provided by the present invention is described below. The certificate management device described below and the certificate management method described above can be referenced to each other.

[0056] Please refer to Figure 6 As shown, this embodiment provides a certificate management device, which is applied to each holder. Specifically, the device includes: a first creation module 610, a second creation module 620, a module 530 and a module 540. The above modules are described in detail below: A first creation module 610, configured to create a first knowledge graph with each certificate of dependency declaration as a first vertex and dependency relationships between different certificates as edges, wherein the certificates include verifiable credentials and / or traditional digital certificates; The second creation module 620 is used to create a second knowledge graph with the subject and value in each declaration as the second vertex pair and the subject pointing to the value as the edge, wherein each edge in the second knowledge graph is associated with an array and a label, the array records the first vertex corresponding to the certificate to which the declaration belongs, and the label is equal to the property in the declaration.

[0057] The certificate management device of this embodiment first establishes a first knowledge graph based on the certificate as the granularity, and then establishes a second knowledge graph based on the declaration content as the granularity, and uses the edges in the second knowledge graph to maintain the relationship between each declaration and certificate, thereby realizing the use of two different granularities to manage certificate information. It can not only fully and comprehensively record the information of certificates and declarations, but also clearly and accurately record the relationship between certificates, and the relationship between certificates and declarations, thereby significantly improving the management efficiency of certificates.

[0058] The first creation module 610 is further used for: Creating a first mapping table for recording the correspondence between the first vertex and each verifiable credential and / or traditional digital certificate; Get the certificate to be created from the certificate creation request; Determine whether there is a first vertex corresponding to the certificate to be created in the first mapping table; If there is a first vertex corresponding to the certificate to be created, returning that the certificate to be created has been created; If there is no first vertex corresponding to the certificate to be created, creating a new first vertex and updating the first mapping table; When creating a new first vertex, the certificate relied upon when applying for the certificate to be created is obtained to obtain the dependent certificate, the first vertex corresponding to each dependent certificate is searched through the first mapping table, and an edge is created from each found first vertex to the new first vertex.

[0059] The device further includes a first deletion module, wherein the first deletion module is configured to: Obtaining the certificate to be deleted from the certificate deletion request, and searching the first target vertex corresponding to the certificate to be deleted through the first mapping table; Searching for a subgraph from the first knowledge graph based on the target first vertex, and determining a topological sequence list of the subgraph by a topological sorting algorithm, wherein the subgraph includes the target first vertex, other first vertices that can be directly and indirectly reached by the target first vertex, and edges connecting the vertices; The subgraph is deleted from the first knowledge graph and the first mapping table is updated synchronously, and the first knowledge graph and the topological sequence table after the subgraph is deleted are returned.

[0060] The second creation module 620 is further used for: Creating a second mapping table for recording the correspondence between each second vertex and each declaration, and an edge list of the second vertices connected by each edge; Get the statement to be created from the statement creation request; Determine whether two vertices in the statement to be created both belong to the second mapping table; If both vertices do not belong to the second mapping table, create a new second vertex pair, create an edge connecting the two new second vertices, and update the second mapping table and the edge list; In the case of creating a new second vertex pair, obtaining the first vertex corresponding to the certificate to which the statement to be created belongs and the subject, value and property in the statement to be created, setting the two vertices of the new second vertex pair to correspond to the subject and value respectively, creating an edge from the vertex corresponding to the subject to the vertex corresponding to the value, adding an associated array and label to the created edge, putting the first vertex corresponding to the certificate to which the statement to be created belongs into the array, and setting the label value equal to the property of the statement to be created; If any one of the two vertices does not belong to the second mapping table, create a new second vertex, create an edge connecting the new second vertex and the existing vertex, and update the second mapping table and the edge list; In the case of creating a new second vertex, obtain the first vertex corresponding to the certificate to which the statement to be created belongs, as well as the subject, value and property in the statement to be created, set the new second vertex and the existing second vertex to correspond to the subject and value respectively, set the newly created edge to point from the vertex corresponding to the subject to the value, add an associated array and label to the newly created edge, put the first vertex corresponding to the certificate to which the statement to be created belongs into the array, and set the label value to be equal to the property of the statement to be created; If both vertices belong to the second mapping table, determining whether there is an edge connecting the two vertices in the edge list; If there is no edge connecting the two vertices, create a new edge, set the new edge according to the first vertex corresponding to the certificate to which the statement to be created belongs and the subject, value and property in the statement to be created, and update the edge list; If there is an edge connecting the two vertices, determine whether there is an edge among the edges connecting the two vertices whose property is the same as the property of the statement to be created, and the direction of the edge satisfies the value pointed to by the subject of the statement to be created; If it exists, put the first vertex corresponding to the certificate to which the statement to be created belongs into the array; If it does not exist, create a new edge with the direction from the subject of the statement to be created to the value and the label value equal to the property of the statement to be created, and update the edge list.

[0061] The device further includes a second creation module, wherein the second creation module is further configured to: In the case of a deleted certificate, all statements included in the deleted certificate are obtained; Using the second mapping table, searching for all second vertices corresponding to all statements included in the deleted certificate; Using the edge list, searching for all edges connected to all the found second vertices; Traverse the array associated with each edge among all the edges found, and determine whether the first vertex corresponding to the deleted certificate exists in the array; If a first vertex corresponding to a deleted certificate exists in a certain array, the first vertex corresponding to the deleted certificate in the certain array is deleted; When any first vertex in an array is deleted, it is determined whether the array is an empty array after deletion; If the array after deletion is an empty array, the edge to which the empty array belongs is deleted from the second knowledge graph and the edge list is updated synchronously, and it is determined whether the vertices connected to the deleted edge are still connected to other edges; If the vertices connected by the deleted edge are connected to other edges, the second knowledge graph after deleting the edge is returned; If the vertex connected to the deleted edge is not connected to other edges, the corresponding vertex will be deleted and the second mapping table will be updated synchronously, and the second knowledge graph after deleting the edge and vertex will be returned.

[0062] The device further includes a first query module, wherein the first query module is configured to: When a query request for an association relationship of a certain first vertex is received, all first vertices in the first knowledge graph that are connected to the certain first vertex through edges are traversed; Taking certificates corresponding to other first vertices that can reach the first vertex as a first certificate set; Taking certificates corresponding to other first vertices reachable by the first vertex as a second certificate set; The first certificate set and the second certificate set are returned.

[0063] The device further includes a second query module, wherein the second query module is configured to: Upon receiving a query for a statement included in a first vertex, traverse the array associated with each edge in the second knowledge graph; Return the subject, value, and property corresponding to each second vertex in the array including the first vertex.

[0064] It should be noted that each module in the above-mentioned certificate management device can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in an electronic device in the form of hardware, or can be stored in a memory in an electronic device in the form of software, so that the processor can call and execute operations corresponding to each of the above modules.

[0065] Figure 7 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 7As shown, the electronic device may include: a processor 710, a communication interface 720, a memory 730 and a communication bus 740, wherein the processor 710, the communication interface 720 and the memory 730 communicate with each other through the communication bus 740. The processor 710 may call the logic instructions in the memory 730 to execute the certificate management method, which is applied to each holder. The method includes: creating a first knowledge graph with each certificate that depends on the declaration as the first vertex and the dependency relationship between different certificates as the edge, wherein the certificate includes a verifiable credential and / or a traditional digital certificate; creating a second knowledge graph with the subject and value in each declaration as the second vertex pair and the subject pointing to the value as the edge, wherein each edge in the second knowledge graph is associated with an array and a label, wherein the array records the first vertex corresponding to the certificate to which the declaration belongs, and the label is equal to the property in the declaration.

[0066] In addition, the logic instructions in the above-mentioned memory 730 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0067] On the other hand, the present invention also provides a computer program product, which includes a computer program, and the computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the certificate management method provided by the above methods, and apply it to each holder. The method includes: creating a first knowledge graph with each certificate that depends on the declaration as the first vertex and the dependency relationship between different certificates as the edge, wherein the certificate includes a verifiable credential and / or a traditional digital certificate; creating a second knowledge graph with the subject and value in each declaration as the second vertex pair and the subject pointing to the value as the edge, wherein each edge in the second knowledge graph is associated with an array and a label, and the array records the first vertex corresponding to the certificate to which the declaration belongs, and the label is equal to the property in the declaration.

[0068] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the certificate management method provided by the above-mentioned methods, and is applied to each holder, the method comprising: creating a first knowledge graph with each certificate that depends on the declaration as the first vertex and the dependency relationship between different certificates as the edge, wherein the certificate includes a verifiable credential and / or a traditional digital certificate; creating a second knowledge graph with the subject and value in each declaration as the second vertex pair and the subject pointing to the value as the edge, wherein each edge in the second knowledge graph is associated with an array and a label, the array records the first vertex corresponding to the certificate to which the declaration belongs, and the label is equal to the property in the declaration.

[0069] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0070] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0071] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A certificate management method, characterized in that: Applied to each holder, the method comprises: Creating a first knowledge graph with each certificate of the dependency declaration as a first vertex and dependency relationships between different certificates as edges, wherein the certificates include verifiable credentials and / or traditional digital certificates; A second knowledge graph is created with the subject and value in each statement as the second vertex pair and the subject pointing to the value as the edge, wherein each edge in the second knowledge graph is associated with an array and a label, the array records the first vertex corresponding to the certificate to which the statement belongs, and the label is equal to the property in the statement.

2. The certificate management method according to claim 1, characterized in that: A first knowledge graph is created with each certificate of dependency declaration as the first vertex and dependency relationships between different certificates as edges, including: Creating a first mapping table for recording the correspondence between the first vertex and each verifiable credential and / or traditional digital certificate; Get the certificate to be created from the certificate creation request; Determine whether there is a first vertex corresponding to the certificate to be created in the first mapping table; If there is a first vertex corresponding to the certificate to be created, returning that the certificate to be created has been created; If there is no first vertex corresponding to the certificate to be created, creating a new first vertex and updating the first mapping table; When creating a new first vertex, the certificate relied upon when applying for the certificate to be created is obtained to obtain the dependent certificate, the first vertex corresponding to each dependent certificate is searched through the first mapping table, and an edge is created from each found first vertex to the new first vertex.

3. The certificate management method according to claim 2, characterized in that: The method further comprises: Obtaining the certificate to be deleted from the certificate deletion request, and searching the first target vertex corresponding to the certificate to be deleted through the first mapping table; Searching for a subgraph from the first knowledge graph based on the target first vertex, and determining a topological sequence list of the subgraph by a topological sorting algorithm, wherein the subgraph includes the target first vertex, other first vertices that can be directly and indirectly reached by the target first vertex, and edges connecting the vertices; The subgraph is deleted from the first knowledge graph and the first mapping table is updated synchronously, and the first knowledge graph and the topological sequence table after the subgraph is deleted are returned.

4. The certificate management method according to claim 1, characterized in that: The second knowledge graph is created with the subject and value in each statement as the second vertex pair and the edge from subject to value, including: Creating a second mapping table for recording the correspondence between each second vertex and each declaration, and an edge list of the second vertices connected by each edge; Get the statement to be created from the statement creation request; Determine whether two vertices in the statement to be created both belong to the second mapping table; If both vertices do not belong to the second mapping table, create a new second vertex pair, create an edge connecting the two new second vertices, and update the second mapping table and the edge list; In the case of creating a new second vertex pair, obtaining the first vertex corresponding to the certificate to which the statement to be created belongs and the subject, value and property in the statement to be created, setting the two vertices of the new second vertex pair to correspond to the subject and value respectively, creating an edge from the vertex corresponding to the subject to the vertex corresponding to the value, adding an associated array and label to the created edge, putting the first vertex corresponding to the certificate to which the statement to be created belongs into the array, and setting the label value equal to the property of the statement to be created; If any one of the two vertices does not belong to the second mapping table, create a new second vertex, create an edge connecting the new second vertex and the existing vertex, and update the second mapping table and the edge list; In the case of creating a new second vertex, obtain the first vertex corresponding to the certificate to which the statement to be created belongs, as well as the subject, value and property in the statement to be created, set the new second vertex and the existing second vertex to correspond to the subject and value respectively, set the newly created edge to point from the vertex corresponding to the subject to the value, add an associated array and label to the newly created edge, put the first vertex corresponding to the certificate to which the statement to be created belongs into the array, and set the label value to be equal to the property of the statement to be created; If both vertices belong to the second mapping table, determining whether there is an edge connecting the two vertices in the edge list; If there is no edge connecting the two vertices, create a new edge, set the new edge according to the first vertex corresponding to the certificate to which the statement to be created belongs and the subject, value and property in the statement to be created, and update the edge list; If there is an edge connecting the two vertices, determine whether there is an edge among the edges connecting the two vertices whose property is the same as the property of the statement to be created, and the direction of the edge satisfies the value pointed to by the subject of the statement to be created; If it exists, put the first vertex corresponding to the certificate to which the statement to be created belongs into the array; If it does not exist, create a new edge with the direction from the subject of the statement to be created to the value and the label value equal to the property of the statement to be created, and update the edge list.

5. The certificate management method according to claim 4, characterized in that: The method further comprises: In the case of a deleted certificate, all statements included in the deleted certificate are obtained; Using the second mapping table, searching for all second vertices corresponding to all statements included in the deleted certificate; Using the edge list, searching for all edges connected to all the found second vertices; Traverse the array associated with each edge among all the edges found, and determine whether the first vertex corresponding to the deleted certificate exists in the array; If a first vertex corresponding to a deleted certificate exists in a certain array, the first vertex corresponding to the deleted certificate in the certain array is deleted; When any first vertex in an array is deleted, it is determined whether the array is an empty array after deletion; If the array after deletion is an empty array, the edge to which the empty array belongs is deleted from the second knowledge graph and the edge list is updated synchronously, and it is determined whether the vertices connected to the deleted edge are still connected to other edges; If the vertices connected by the deleted edge are connected to other edges, the second knowledge graph after deleting the edge is returned; If the vertex connected to the deleted edge is not connected to other edges, the corresponding vertex will be deleted and the second mapping table will be updated synchronously, and the second knowledge graph after deleting the edge and vertex will be returned.

6. The certificate management method according to claim 1, characterized in that: The method further comprises: When a query request for an association relationship of a certain first vertex is received, all first vertices in the first knowledge graph that are connected to the certain first vertex through edges are traversed; Taking certificates corresponding to other first vertices that can reach the first vertex as a first certificate set; Taking certificates corresponding to other first vertices reachable by the first vertex as a second certificate set; The first certificate set and the second certificate set are returned.

7. The certificate management method according to claim 1, characterized in that: The method further comprises: Upon receiving a query for a statement included in a first vertex, traverse the array associated with each edge in the second knowledge graph; Return the subject, value, and property corresponding to each second vertex in the array including the first vertex.

8. A certificate management device, characterized in that: Applied to each holder, the device comprises: A first creation module, configured to create a first knowledge graph with each certificate of dependency declaration as a first vertex and dependency relationships between different certificates as edges, wherein the certificates include verifiable credentials and / or traditional digital certificates; The second creation module is used to create a second knowledge graph with the subject and value in each statement as the second vertex pair and the subject pointing to the value as the edge, wherein each edge in the second knowledge graph is associated with an array and a label, the array records the first vertex corresponding to the certificate to which the statement belongs, and the label is equal to the property in the statement.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the certificate management method according to any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the certificate management method according to any one of claims 1 to 7 is implemented.

Images