Decentralized public key infrastructure constructed based on block chain and trusted network

Abstract

The invention discloses a decentralized public key infrastructure constructed based on a block chain and a trusted network, and belongs to the field of information security PKI public key infrastructure, and the method comprises the following steps: 1, building a decentralized CA mechanism; 2, a user submits a certificate application / update / abolish request; the user certificate request is submitted to a decentralized CA mechanism, and the decentralized CA mechanism service calls the block chain to generate / update / abolish the digital certificate; and 3, verifying the user certificate request by using a block chain technology. The certificate request is validated using a smart contract technique. The decentralized public key infrastructure constructed based on the block chain and the trusted network aims to solve the problems of single-point failure, non-transparent certificate, time-consuming certificate revocation and the like existing in a CA mechanism in a traditional PKI system, and emphatically realizes that the problem that the PKI trusted system collapses due to the failure of the CA mechanism in a certificate life cycle management process of the CA mechanism is solved; and meanwhile, certificate transparency is realized, and certificate revocation efficiency is improved.

Description

Technical Field

[0001] The present invention belongs to the field of information security PKI public key infrastructure, and in particular to a decentralized public key infrastructure built based on blockchain and trust network. Background Art

[0002] In 1976, computer scientists Whitfield Diffie and Martin Hellman introduced the concept of asymmetric encryption (i.e., public key encryption) in their paper "New Directions in Cryptography", laying the theoretical foundation for the later public key infrastructure (PKI). Although their paper did not directly mention "certificate authority", the public key encryption ideas they introduced inspired people to establish a trust system to verify the identity of public key holders. In the 1980s, with the further development of public key encryption technology, especially the introduction and commercialization of the RSA algorithm, there was a need for a trusted institution to manage public keys. This stage formed a further clarification of the concept of certificate authority (CA). In the early 1990s, the concept of public key infrastructure (PKI) began to be formally proposed. As a system for managing and distributing public keys, CA was established as a core component.

[0003] Existing digital certificate issuance process: 1. The user submits a certificate request to the CA, including his public key and identity information; 2. CA verifies the user's identity and the validity of the certificate request. If the verification is successful, it proceeds to the next step; 3. CA uses the private key corresponding to its certificate to combine and sign the user's public key and identity information to generate a digital certificate; 4. CA returns the issued digital certificate to the user.

[0004] The centralized design of traditional CAs brings about multiple problems. First, the single point failure problem is the most important and urgent problem, because CA is the core of the entire public key infrastructure (PKI). If a security vulnerability or attack occurs, whether it is caused by hackers, extremist organizations or governments, it may lead to the collapse of trust in the entire system. In addition, the certificate issuance process lacks transparency, and the certificate authority may abuse its power and issue certificates without review, resulting in the risk that users may be attacked by man-in-the-middle attacks. Summary of the invention

[0005] The purpose of the present invention is to provide a decentralized public key infrastructure based on blockchain and trust network to solve the problems raised in the background technology.

[0006] To achieve the above object, the present invention provides the following technical solution: a decentralized public key infrastructure based on blockchain and trust network, comprising the following steps: Step 1: Build a decentralized CA organization; Step 2: The user submits a certificate application / renewal / revocation request and submits the user certificate request to the decentralized CA agency. The decentralized CA agency service will call the blockchain to generate / renew / revoke the digital certificate; Step 3: Use blockchain technology to verify the user's certificate request, and use smart contract technology to verify the certificate request. If the verification is successful, proceed to the next step; Step 4: Use smart contract technology to construct a digital certificate, mainly involving the IntroducerIdentifier extension; Step 5: Send the constructed digital certificate or certificate revocation request to the key ring network; Step 6: Use smart contract technology to verify certificate information; Step 7. Set the blockchain transaction ID and certificate trust level. Use the certificate to construct a smart contract to place the blockchain transaction ID and certificate trust level generated in the previous step into the TranscationID and Certificatetrustlevel extensions respectively. Step 8: Send the certificate to the key ring network, and the introducer in the key ring network will make a final signature on the certificate; Step 9: Complete the issuance / renewal / revocation of digital certificates; Step 10: Send the digital certificate / revocation result to the applicant user.

[0007] As a preferred embodiment, the step 1 comprises the following steps: Step 1. Build a key ring network; Step 1 and 2: Based on blockchain technology, including but not limited to Ethereum and Hyperledger Fabric blockchain; Step 13: Based on the blockchain type, write smart contract technology to solve problems related to certificate issuance.

[0008] As a preferred embodiment, the sub-steps one and three include the following steps: Step 131. Construct smart contract technology to verify the integrity of the certificate request, including but not limited to verifying the signature value, domain name or IP address information of the certificate request; Step 132: Build smart contract technology to issue digital certificates, including but not limited to certificate serial number, certificate issuing authority, certificate subject, and certificate extension content; Step 133: Build smart contract technology to verify the authenticity of ring members in the certificate extension, the validity of ring member signatures, and calculate the certificate trust level.

[0009] As a preferred implementation scheme, the steps 1, 3 and 2 are based on the standard certificate extension content and are specifically designed with the following extensions: TranscationID: Blockchain transaction ID, used to obtain certificate-related information from the blockchain network, to solve the problem of opacity in traditional CA certificate issuance; multi-signature: a ring member signature list, which is a set of multiple signature values ​​obtained after multiple ring members sign the certificate. It is used to solve the single point failure problem of traditional CA. Certificatetrustlevel: Certificate trust level, used to tell the other end how much trust it should give to the certificate during communication; IntroducerIdentifier: The introducer's unique identifier, used to identify the introducer in the key ring network.

[0010] As a preferred embodiment, the step 132 further includes: (1) Ring member authenticity verification. Validity verification mainly verifies the signature value of the ring member's public key certificate. If the verification passes, the ring member is considered authentic. (2) Ring member signature verification: first parse the multi-signature extension field of the certificate to extract the signature values ​​of all ring members, then traverse and verify the signature values ​​of all ring members. If any signature fails to pass the verification process, the process terminates, otherwise the process continues; (3) Calculate the certificate trust level. The certificate trust level is calculated according to the following formula: ; L represents the certificate trust level. If L is greater than or equal to 1, the certificate is considered fully trusted. If L is greater than 0 and less than 1, the certificate is considered marginally trusted. If L is equal to 0, the certificate is considered untrusted. c and m represent the number of signatures from fully trusted and marginally trusted ring members, respectively; C and M represent the number of signatures of fully trusted and marginally trusted ring members required to verify the certificate, respectively. These values ​​are determined by the system authority, where C is greater than or equal to 1 and M is greater than or equal to 1; d represents the depth from the ring owner to the current ring member.

[0011] As a preferred embodiment, the step five comprises the following steps: (1) Verify user identity; (2) If the user identity verification is successful, the certificate content will be used as the original text for signing; (3) The ring members verify the reason for the cancellation. The introducer has the right to be verified first. If the reason for the cancellation is reasonable, proceed to the next step; (4) Update the certificate status in OCSP / CRL / world status (in the blockchain) to revoked by verifying the smart contract, completing the certificate revocation. After this step is completed, jump directly to step 6 to end the process; (5) Multiple ring members sign the certificate, and the number of ring members that complete trust and edge trust must at least reach C and M in the formula; (6) Combine the signature values ​​of multiple ring members into a ring member signature list, and then place the ring member signature list into the certificate extension item; (7) Return certificate.

[0012] As a preferred embodiment, the step six comprises the following steps: Verify the multi-signature extension of the certificate, mainly to verify the authenticity of all ring members in the list and the validity of the signature value; The certificate trust level is calculated according to the formula.

[0013] Compared with the prior art, the technical effects and advantages of the present invention are as follows: This decentralized public key infrastructure built on blockchain and trust network aims to solve the problems of single point failure, opaque certificates, time-consuming certificate revocation, etc. in the traditional PKI system. It focuses on ensuring that the PKI trust system will not collapse due to CA failures during the certificate lifecycle management process, while achieving certificate transparency and improving the efficiency of certificate revocation. This decentralized public key infrastructure built on blockchain and trust network uses a key ring network to implement the identity authentication process, reducing the single point failure problem of traditional CA; This decentralized public key infrastructure built on blockchain and trust network uses blockchain to record certificate issuance operations, making certificate issuance operations transparent, reducing the risk of man-in-the-middle attacks, and solving the opaque problem of traditional CA certificate issuance. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is a framework diagram of the present invention; Figure 2 This is a framework diagram of the traditional centralized CA of the present invention. DETAILED DESCRIPTION

[0015] In the following description, a large number of specific details are provided to provide a more thorough understanding of the present invention. However, it is apparent to those skilled in the art that the present invention can be implemented without one or more of these details. In other examples, in order to avoid confusion with the present invention, some technical features well known in the art are not described.

[0016] See also Figure 1 to Figure 2 , a decentralized public key infrastructure based on blockchain and trust network, this embodiment includes the following steps: Step 1: Build a decentralized CA organization; Step 2: The user submits a certificate application / update / revocation request. Submit the user certificate request to the decentralized CA agency, and the decentralized CA agency service will call the blockchain to generate / update / revoke the digital certificate; Step 3: Use blockchain technology to verify the user's certificate request. Use smart contract technology to verify the certificate request. If the verification is successful, proceed to the next step; Step 4: Use smart contract technology to construct a digital certificate, which mainly involves the IntroducerIdentifier extension (this step is omitted when revoking a certificate); Step 5: Send the constructed digital certificate or certificate revocation request to the key ring network; Step 6: Use smart contract technology to verify certificate information; Step 7: Set the blockchain transaction ID and certificate trust level. Use the certificate to construct a smart contract and place the blockchain transaction ID and certificate trust level generated in the previous step into the TranscationID and Certificatetrustlevel extensions respectively; Step 8: Send the certificate to the key ring network, and the introducer in the key ring network will make a final signature on the certificate; Step 9: Complete the issuance / renewal / revocation of digital certificates; Step 10: Send the digital certificate / revocation result to the applicant user.

[0017] Step one includes the following steps: Step 1. Build a key ring network; Step 1 and 2: Based on blockchain technology, including but not limited to Ethereum and Hyperledger Fabric blockchain; Step 13: Based on the blockchain type, write smart contract technology to solve problems related to certificate issuance.

[0018] As a preferred embodiment, step one and step three include the following steps: Step 131. Construct smart contract technology to verify the integrity of the certificate request, including but not limited to verifying the signature value, domain name or IP address information of the certificate request; Step 132: Build smart contract technology to issue digital certificates, including but not limited to certificate serial number, certificate issuing authority, certificate subject, and certificate extension content; Step 133: Build smart contract technology to verify the authenticity of ring members in the certificate extension, the validity of ring member signatures, and calculate the certificate trust level.

[0019] Steps 1, 3 and 2 are based on the standard certificate extensions and have been specially designed with the following extensions: TranscationID: Blockchain transaction ID, used to obtain certificate-related information from the blockchain network, to solve the problem of opacity in traditional CA certificate issuance; multi-signature: a ring member signature list, which is a set of multiple signature values ​​obtained after multiple ring members sign the certificate. It is used to solve the single point failure problem of traditional CA. Certificatetrustlevel: Certificate trust level, used to tell the other end how much trust it should give to the certificate during communication; IntroducerIdentifier: The introducer's unique identifier, used to identify the introducer in the key ring network.

[0020] Step 132 also includes: (1) Ring member authenticity verification. Validity verification mainly verifies the signature value of the ring member's public key certificate. If the verification passes, the ring member is considered authentic; (2) Ring member signature verification. First, parse the multi-signature extension field of the certificate to extract the signature values ​​of all ring members. Then, traverse and verify the signature values ​​of all ring members. If any signature fails to pass the verification process, the process terminates. Otherwise, the process continues. (3) Calculate the certificate trust level. The certificate trust level is calculated according to the following formula: ; L represents the certificate trust level. If L is greater than or equal to 1, the certificate is considered fully trusted; if L is greater than 0 and less than 1, the certificate is considered marginally trusted; if L is equal to 0, the certificate is considered untrusted; c and m represent the number of signatures from fully trusted and marginally trusted ring members, respectively; C and M represent the number of signatures from fully trusted and marginally trusted ring members required to verify the certificate, respectively. These values ​​are determined by the system authority, where C is greater than or equal to 1 and M is greater than or equal to 1; d represents the depth from the ring owner to the current ring member.

[0021] Step five includes the following steps: (1) Verify user identity; (2) If the user identity verification is successful, the certificate content will be used as the original text for signing; (3) The ring member verifies the reason for the revocation. The introducer has the right to verify first. If the reason for the revocation is reasonable, proceed to the next step (this step is omitted for certificate issuance and renewal operations); (4) Update the certificate status in OCSP / CRL / world status (in the blockchain) to revoked by verifying the smart contract, completing the certificate revocation. After this step is completed, jump directly to step 9 to end the process. (This step is omitted for certificate issuance and renewal operations); (5) Multiple ring members sign the certificate, and the number of ring members that complete trust and edge trust must at least reach C and M in the formula; (6) Combine the signature values ​​of multiple ring members into a ring member signature list, and then place the ring member signature list into the certificate extension item; (7) Return certificate.

[0022] Step six includes the following steps: Verify the multi-signature extension of the certificate, mainly to verify the authenticity of all ring members in the list and the validity of the signature value; The certificate trust level is calculated according to the formula.

[0023] It should be noted that, in this document, relational terms such as one and two are merely used to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any actual relationship or order between these entities or operations.

[0024] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A decentralized public key infrastructure based on blockchain and trust network, characterized by: The following steps are involved: Step 1: Build a decentralized CA organization; Step 2: The user submits a certificate application / renewal / revocation request and submits the user certificate request to the decentralized CA agency. The decentralized CA agency service will call the blockchain to generate / renew / revoke the digital certificate; Step 3: Use blockchain technology to verify the user's certificate request, and use smart contract technology to verify the certificate request. If the verification is successful, proceed to the next step; Step 4: Use smart contract technology to construct a digital certificate, mainly involving the IntroducerIdentifier extension; Step 5: Send the constructed digital certificate or certificate revocation request to the key ring network; Step 6: Use smart contract technology to verify certificate information; Step 7. Set the blockchain transaction ID and certificate trust level. Use the certificate to construct a smart contract to place the blockchain transaction ID and certificate trust level generated in the previous step into the TranscationID and Certificatetrustlevel extensions respectively. Step 8: Send the certificate to the key ring network, and the introducer in the key ring network will make a final signature on the certificate; Step 9: Complete the issuance / renewal / revocation of digital certificates; Step 10: Send the digital certificate / revocation result to the applicant user.

2. The decentralized public key infrastructure based on blockchain and trust network according to claim 1, characterized in that: The step 1 comprises the following steps: Step 1. Build a key ring network; Step 1 and 2: Based on blockchain technology, including but not limited to Ethereum and Hyperledger Fabric blockchain; Step 13: Based on the blockchain type, write smart contract technology to solve problems related to certificate issuance.

3. The decentralized public key infrastructure based on blockchain and trust network according to claim 2, characterized in that: The sub-step one and three include the following steps: Step 131. Construct smart contract technology to verify the integrity of the certificate request, including but not limited to verifying the signature value, domain name or IP address information of the certificate request; Step 132: Build smart contract technology to issue digital certificates, including but not limited to certificate serial number, certificate issuing authority, certificate subject, and certificate extension content; Step 133: Build smart contract technology to verify the authenticity of ring members in the certificate extension, the validity of ring member signatures, and calculate the certificate trust level.

4. The decentralized public key infrastructure based on blockchain and trust network according to claim 3, characterized in that: Steps 1, 3 and 2 are based on the standard certificate extensions and specifically designed with the following extensions: TranscationID: Blockchain transaction ID, used to obtain certificate-related information from the blockchain network, to solve the problem of opacity in traditional CA certificate issuance; multi-signature: a ring member signature list, which is a set of multiple signature values ​​obtained after multiple ring members sign the certificate. It is used to solve the single point failure problem of traditional CA. Certificatetrustlevel: Certificate trust level, used to tell the other end how much trust it should give to the certificate during the communication process; IntroducerIdentifier: The introducer's unique identifier, used to identify the introducer in the key ring network.

5. The decentralized public key infrastructure based on blockchain and trust network according to claim 3, characterized in that: The step 132 also includes: (1) Ring member authenticity verification. Validity verification mainly verifies the signature value of the ring member's public key certificate. If the verification passes, the ring member is considered authentic. (2) Ring member signature verification: first parse the multi-signature extension field of the certificate to extract the signature values ​​of all ring members, then traverse and verify the signature values ​​of all ring members. If any signature fails to pass the verification process, the process terminates, otherwise the process continues; (3) Calculate the certificate trust level. The certificate trust level is calculated according to the following formula: ； L represents the certificate trust level. If L is greater than or equal to 1, the certificate is considered fully trusted. If L is greater than 0 and less than 1, the certificate is considered marginally trusted. If L is equal to 0, the certificate is considered untrusted. c and m represent the number of signatures from fully trusted and marginally trusted ring members, respectively; C and M represent the number of signatures of fully trusted and marginally trusted ring members required to verify the certificate, respectively. These values ​​are determined by the system authority, where C is greater than or equal to 1 and M is greater than or equal to 1; d represents the depth from the ring owner to the current ring member.

6. The decentralized public key infrastructure based on blockchain and trust network according to claim 1, characterized in that: The step five comprises the following steps: (1) Verify user identity; (2) If the user identity verification is successful, the certificate content will be used as the original text for signing; (3) The ring members verify the reason for the cancellation. The introducer has the right to be verified first. If the reason for the cancellation is reasonable, proceed to the next step; (4) Update the certificate status in OCSP / CRL / world status to revoked by verifying the smart contract, and complete the certificate revocation. After this step is completed, jump directly to step 6 to end the process; (5) Multiple ring members sign the certificate, and the number of ring members that complete trust and edge trust must at least reach C and M in the formula; (6) Combine the signature values ​​of multiple ring members into a ring member signature list, and then place the ring member signature list into the certificate extension item; (7) Return certificate.

7. The decentralized public key infrastructure based on blockchain and trust network according to claim 1, characterized in that: The step six comprises the following steps: Verify the multi-signature extension of the certificate, mainly to verify the authenticity of all ring members in the list and the validity of the signature value; The certificate trust level is calculated according to the formula.

Images