A method for constructing a decentralized public key infrastructure based on a blockchain and a trust network

Abstract

The application discloses a kind of decentralized public key infrastructure based on blockchain and trust network construction method, belong to information security PKI public key infrastructure field, including the following steps: step one, build decentralized CA agency;Step two, user submits certificate application / update / revocation request.Certificate request of user is submitted to decentralized CA agency, and the service of decentralized CA agency will call blockchain to generate / update / revocation digital certificate;Step three, certificate request of user is verified using blockchain technology.Certificate request is verified using smart contract technology.The decentralized public key infrastructure based on blockchain and trust network construction method aims to solve the single point of failure, certificate opacity, certificate revocation time-consuming and other problems existing in traditional PKI system, focuses on realizing that CA agency will not cause PKI trust system to collapse due to CA agency failure in the process of certificate life cycle management, while realizing certificate transparency and improving certificate revocation efficiency.

Description

Technical Field

[0001] This invention belongs to the field of information security PKI public key infrastructure, and in particular, it is a method for building a decentralized public key infrastructure based on blockchain and trust network. Background Technology

[0002] In 1976, computer scientists Whitfield Diffie and Martin Hellman introduced the concept of asymmetric encryption (i.e., public-key encryption) in their paper "New Directions in Cryptography," laying the theoretical foundation for later Public Key Infrastructure (PKI). Although their paper did not directly mention "Certificate Authorities," their introduction of public-key encryption inspired the establishment of a trust system to verify the identity of public key holders. In the 1980s, with the further development of public-key encryption technology, especially the proposal and commercialization of the RSA algorithm, the need arose for a trusted institution to manage public keys. This stage led to a further clarification of the concept of Certificate Authorities (CAs). In the early 1990s, the concept of Public Key Infrastructure (PKI) was formally proposed, and CAs were established as a core component of a system for managing and distributing public keys.

[0003] Existing digital certificate issuance process:

[0004] 1. Users submit certificate requests to the CA authority, including their public key and identity information;

[0005] 2. The CA verifies the user's identity and the validity of the certificate request. If the verification is successful, proceed to the next step.

[0006] 3. The CA uses the private key corresponding to its certificate to combine and sign the user's public key and identity information to generate a digital certificate;

[0007] 4. The CA will return the issued digital certificate to the user.

[0008] The centralized design of traditional Certificate Authorities (CAs) presents several problems. First, the single point of failure is the most significant and pressing issue. As the core of the Public Key Infrastructure (PKI), a security vulnerability or attack on the CA—whether by hackers, extremist groups, or governments—could lead to a collapse of trust throughout the system. Furthermore, the lack of transparency in the certificate issuance process allows Certificate Authorities to abuse their power, issuing certificates without proper verification, potentially exposing users to man-in-the-middle attacks. Summary of the Invention

[0009] The purpose of this invention is to provide a method for building a decentralized public key infrastructure based on blockchain and trust networks to solve the problems mentioned in the background art.

[0010] To achieve the above objectives, the present invention provides the following technical solution: a method for building a decentralized public key infrastructure based on blockchain and trust networks, comprising the following steps:

[0011] Step 1: Establish a decentralized CA (Certificate Authority) organization;

[0012] Step 2: The user submits a certificate application / update / revocation request. The user's certificate request is submitted to the decentralized CA authority, and the decentralized CA authority service will call the blockchain to generate / update / revoke the digital certificate.

[0013] Step 3: Verify the user certificate request using blockchain technology and the certificate request using smart contract technology. If the verification is successful, proceed to the next step.

[0014] Step 4: Construct a digital certificate using smart contract technology, mainly involving the IntroducerIdentifier extension item;

[0015] Step 5: Send the constructed digital certificate or certificate revocation request to the key ring network;

[0016] Step Six: Verify certificate information using smart contract technology;

[0017] Step 7: Set the blockchain transaction ID and certificate trust level. Use the certificate to construct a smart contract and place the blockchain transaction ID and certificate trust level generated in the previous step into the TransactionID and Certificatetrustlevel extension items, respectively.

[0018] Step 8: Send the certificate to the key ring network, where the introducer in the key ring network performs the final signing of the certificate;

[0019] Step 9: Complete the issuance / renewal / revocation of digital certificates;

[0020] Step 10: Send the digital certificate / revocation result to the applicant user.

[0021] As a preferred embodiment, step one includes the following steps:

[0022] Step 11: Construct a key ring network;

[0023] Steps 1 and 2: Build blockchain technology infrastructure, including the Hyperledger Fabric blockchain;

[0024] Step 13: Based on the blockchain type, write smart contract technology to solve certificate issuance-related issues.

[0025] As a preferred implementation, step one and three include the following steps:

[0026] Step 131: Construct smart contract technology to verify the integrity of the certificate request, including verifying the certificate request signature value, domain name or IP address information;

[0027] Step 132: Construct a smart contract technology to issue digital certificates, including certificate serial number, certificate authority, certificate subject, and certificate extension information;

[0028] Step 133: Construct a smart contract to verify the authenticity of ring members in the certificate extension, the validity of ring member signatures, and calculate the certificate trust level.

[0029] As a preferred implementation, steps one, three, and two are based on the standard certificate extension content and specifically designed with the following extension items:

[0030] TransactionID: Blockchain Transaction ID, used to retrieve certificate-related information from the blockchain network, and to solve the problem of opacity in traditional CA certificate issuance;

[0031] multi-signature: Ring member signature list, a set of multiple signature values ​​obtained by multiple ring members signing the certificate, used to solve the single point of failure problem of traditional CA;

[0032] Certificatetrustlevel: The certificate trust level is used to tell the other party the degree of trust that the certificate should be given during communication.

[0033] IntroducerIdentifier: A unique identifier for the introducer, used to identify the introducer in a key ring network.

[0034] As a preferred embodiment, steps one, three, and two further include:

[0035] (1) Authenticity verification of ring members. The validity verification mainly verifies the signature value of the ring member's public key certificate. If the verification is successful, the ring member is considered authentic.

[0036] (2) Ring member signature verification: First, parse the multi-signature extension field of the certificate and extract the signature values ​​of all ring members. Then, iterate through and verify the signature values ​​of all ring members. If any signature verification fails during the verification process, the process terminates; otherwise, the process continues.

[0037] (3) Calculate the certificate trust level. The certificate trust level is calculated according to the following formula:

[0038] ;

[0039] L represents the certificate trust level. If L is greater than or equal to 1, the certificate is considered fully trusted. If L is greater than 0 and less than 1, the certificate is considered marginally trusted. If L is equal to 0, the certificate is considered untrusted.

[0040] c and m represent the number of signatures from ring members from full trust and edge trust, respectively;

[0041] C and M represent the number of signatures from ring members of full trust and edge trust required to verify the certificate, respectively. These values ​​are determined by the system authority, where C is greater than or equal to 1 and M is greater than or equal to 1.

[0042] d represents the depth from the ring owner to the current ring member.

[0043] As a preferred embodiment, step five includes the following steps:

[0044] (1) Verify user identity;

[0045] (2) If the user's identity verification is successful, the certificate content will be used as the original text for signing;

[0046] (3) Members of the ring verify the reason for the abolition. The introducer has the right to verify first. If the reason for the abolition is reasonable, proceed to the next step.

[0047] (4) Verify that the certificate status in OCSP / CRL / world state (in the blockchain) is revoked by updating the smart contract, and complete the certificate revocation. After this step is completed, directly jump to step six to end the process;

[0048] (5) Multiple ring members sign the certificate, and the number of ring members that complete trust and edge trust must reach at least C and M in the formula;

[0049] (6) Merge the signature values ​​of multiple ring members into a ring member signature list, and then place the ring member signature list into the certificate extension;

[0050] (7) Return the certificate.

[0051] As a preferred embodiment, step six includes the following steps:

[0052] Verify the certificate's multi-signature extension, which primarily verifies the authenticity of all ring members in the list and the validity of the signature value.

[0053] Calculate the certificate trust level according to the formula.

[0054] Compared with the prior art, the technical effects and advantages of the present invention are as follows:

[0055] This decentralized public key infrastructure method, built on blockchain and trust networks, aims to solve the problems of single point of failure, certificate opacity, and time-consuming certificate revocation in the traditional PKI system. It focuses on ensuring that the PKI trust system will not collapse due to the failure of the CA during the certificate lifecycle management process, while realizing certificate transparency and improving the efficiency of certificate revocation.

[0056] This decentralized public key infrastructure method, built on blockchain and trust networks, utilizes a key ring network to implement the authentication process, reducing the problem of single points of failure in traditional CAs.

[0057] This decentralized public key infrastructure method, built on blockchain and trust networks, utilizes blockchain to record certificate issuance operations, making the certificate issuance process transparent, reducing the risk of man-in-the-middle attacks, and solving the problem of opacity in traditional CA certificate issuance. Attached Figure Description

[0058] Figure 1 This is a framework diagram of the present invention;

[0059] Figure 2 This is a framework diagram of the traditional centralized CA of the present invention. Detailed Implementation

[0060] In the following description, numerous specific details are set forth in order to provide a more thorough understanding of the invention. However, it will be apparent to those skilled in the art that the invention can be practiced without one or more of these details. In other instances, certain technical features well-known in the art have not been described in order to avoid obscuring the invention.

[0061] Please see Figures 1 to 2 A method for building a decentralized public key infrastructure based on blockchain and trust networks, in this embodiment, includes the following steps:

[0062] Step 1: Establish a decentralized CA (Certificate Authority) organization;

[0063] Step 2: The user submits a certificate application / renewal / revocation request. The user submits the certificate request to the decentralized CA (Certificate Authority), which will then use the blockchain to generate / renew / revoke the digital certificate.

[0064] Step 3: Verify the user certificate request using blockchain technology. Use smart contract technology to verify the certificate request. If verification is successful, proceed to the next step.

[0065] Step 4: Construct a digital certificate using smart contract technology, mainly involving the IntroducerIdentifier extension (this step is omitted when revoking a certificate).

[0066] Step 5: Send the constructed digital certificate or certificate revocation request to the key ring network;

[0067] Step Six: Verify certificate information using smart contract technology;

[0068] Step 7: Set the blockchain transaction ID and certificate trust level. Construct a smart contract using the certificate and place the blockchain transaction ID and certificate trust level generated in the previous step into the TransactionID and Certificatetrustlevel extension fields, respectively.

[0069] Step 8: Send the certificate to the key ring network, where the introducer in the key ring network performs the final signing of the certificate;

[0070] Step 9: Complete the issuance / renewal / revocation of digital certificates;

[0071] Step 10: Send the digital certificate / revocation result to the applicant user.

[0072] Step one includes the following steps:

[0073] Step 11: Construct a key ring network;

[0074] Steps 1 and 2: Build blockchain technology infrastructure, including the Hyperledger Fabric blockchain;

[0075] Step 13: Based on the blockchain type, write smart contract technology to solve certificate issuance-related issues.

[0076] As a preferred implementation scheme, step one and three include the following steps:

[0077] Step 131: Construct smart contract technology to verify the integrity of the certificate request, including verifying the certificate request signature value, domain name or IP address information;

[0078] Step 132: Construct a smart contract technology to issue digital certificates, including certificate serial number, certificate authority, certificate subject, and certificate extension information;

[0079] Step 133: Construct a smart contract to verify the authenticity of ring members in the certificate extension, the validity of ring member signatures, and calculate the certificate trust level.

[0080] Steps 1, 3, and 2, based on the standard certificate extension content, have specifically designed the following extensions:

[0081] TransactionID: Blockchain Transaction ID, used to retrieve certificate-related information from the blockchain network, and to solve the problem of opacity in traditional CA certificate issuance;

[0082] multi-signature: Ring member signature list, a set of multiple signature values ​​obtained by multiple ring members signing the certificate, used to solve the single point of failure problem of traditional CA;

[0083] Certificatetrustlevel: The certificate trust level is used to tell the other party the degree of trust that the certificate should be given during communication.

[0084] IntroducerIdentifier: A unique identifier for the introducer, used to identify the introducer in a key ring network.

[0085] Steps one, three, and two also include:

[0086] (1) Authenticity verification of ring members. Validity verification mainly involves verifying the signature value of the ring member's public key certificate. If the verification passes, the ring member is considered authentic.

[0087] (2) Ring member signature verification. First, parse the multi-signature extension field of the certificate to extract the signature values ​​of all ring members. Then, iterate through and verify the signature values ​​of all ring members. If any signature verification fails during the process, the process terminates; otherwise, the process continues.

[0088] (3) Calculate the certificate trust level. The certificate trust level is calculated using the following formula:

[0089] ;

[0090] L represents the certificate trust level. If L is greater than or equal to 1, the certificate is considered fully trusted; if L is greater than 0 and less than 1, the certificate is considered marginally trusted; if L equals 0, the certificate is considered untrusted.

[0091] c and m represent the number of signatures from ring members from full trust and edge trust, respectively;

[0092] C and M represent the number of signatures from ring members of full trust and edge trust required to verify the certificate, respectively. These values ​​are determined by the system authority, where C is greater than or equal to 1 and M is greater than or equal to 1.

[0093] d represents the depth from the ring owner to the current ring member.

[0094] Step five includes the following steps:

[0095] (1) Verify user identity;

[0096] (2) If the user's identity verification is successful, the certificate content will be used as the original text for signing;

[0097] (3) Members of the ring verify the reason for the cancellation. The introducer has the right to verify first. If the reason for cancellation is reasonable, proceed to the next step (this step is omitted in certificate issuance and renewal operations).

[0098] (4) Verify that the certificate status in OCSP / CRL / world state (in the blockchain) is revoked by updating the smart contract, and complete the certificate revocation. After this step is completed, proceed directly to step 9 to end the process. (This step is omitted for certificate issuance and renewal operations);

[0099] (5) Multiple ring members sign the certificate, and the number of ring members that complete trust and edge trust must reach at least C and M in the formula;

[0100] (6) Merge the signature values ​​of multiple ring members into a ring member signature list, and then place the ring member signature list into the certificate extension;

[0101] (7) Return the certificate.

[0102] Step six includes the following steps:

[0103] Verify the certificate's multi-signature extension, which primarily verifies the authenticity of all ring members in the list and the validity of the signature value.

[0104] Calculate the certificate trust level according to the formula.

[0105] It should be noted that in this article, relational terms such as one and two are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0106] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for building a decentralized public key infrastructure based on blockchain and trust networks, characterized in that: Includes the following steps: Step 1: Establish a decentralized CA (Certificate Authority) organization; Step 2: The user submits a certificate application / update / revocation request. The user's certificate request is submitted to the decentralized CA authority, and the decentralized CA authority service will call the blockchain to generate / update / revoke the digital certificate. Step 3: Verify the user certificate request using blockchain technology and the certificate request using smart contract technology. If the verification is successful, proceed to the next step. Step 4: Construct a digital certificate using smart contract technology, mainly involving the IntroducerIdentifier extension item; Step 5: Send the constructed digital certificate or certificate revocation request to the key ring network; Step Six: Verify certificate information using smart contract technology; Step 7: Set the blockchain transaction ID and certificate trust level. Use the certificate to construct a smart contract and place the blockchain transaction ID and certificate trust level generated in the previous step into the TransactionID and Certificatetrustlevel extension items, respectively. Step 8: Send the certificate to the key ring network, where the introducer in the key ring network performs the final signing of the certificate; Step 9: Complete the issuance / renewal / revocation of digital certificates; Step 10: Send the digital certificate / revocation result to the applicant user.

2. The method for constructing a decentralized public key infrastructure based on blockchain and trust networks according to claim 1, characterized in that: Step one includes the following steps: Step 11: Construct a key ring network; Steps 1 and 2: Build blockchain technology infrastructure, including the Hyperledger Fabric blockchain; Step 13: Based on the blockchain type, write smart contract technology to solve certificate issuance-related issues.

3. The method for constructing a decentralized public key infrastructure based on blockchain and trust networks according to claim 2, characterized in that: The first and third steps include the following steps: Step 131: Construct smart contract technology to verify the integrity of the certificate request, including verifying the certificate request signature value, domain name or IP address information; Step 132: Construct a smart contract technology to issue digital certificates, including certificate serial number, certificate authority, certificate subject, and certificate extension information; Step 133: Construct a smart contract to verify the authenticity of ring members in the certificate extension, the validity of ring member signatures, and calculate the certificate trust level.

4. The method for constructing a decentralized public key infrastructure based on blockchain and trust networks according to claim 3, characterized in that: Steps one, three, and two, based on the standard certificate extension content, have been specially designed with the following extensions: TransactionID: Blockchain Transaction ID, used to retrieve certificate-related information from the blockchain network, and to solve the problem of opacity in traditional CA certificate issuance; multi-signature: Ring member signature list, a set of multiple signature values ​​obtained by multiple ring members signing the certificate, used to solve the single point of failure problem of traditional CA; Certificatetrustlevel: The certificate trust level is used to tell the other party the degree of trust that the certificate should be given during communication. IntroducerIdentifier: A unique identifier for the introducer, used to identify the introducer in a key ring network.

5. The method for constructing a decentralized public key infrastructure based on blockchain and trust networks according to claim 3, characterized in that: Steps one through three also include: (1) Authenticity verification of ring members. The validity verification mainly verifies the signature value of the ring member's public key certificate. If the verification is successful, the ring member is considered authentic. (2) Ring member signature verification: First, parse the multi-signature extension field of the certificate and extract the signature values ​​of all ring members. Then, iterate through and verify the signature values ​​of all ring members. If any signature verification fails during the verification process, the process terminates; otherwise, the process continues. (3) Calculate the certificate trust level. The certificate trust level is calculated according to the following formula: ； L represents the certificate trust level. If L is greater than or equal to 1, the certificate is considered fully trusted. If L is greater than 0 and less than 1, the certificate is considered marginally trusted. If L is equal to 0, the certificate is considered untrusted. c and m represent the number of signatures from ring members from full trust and edge trust, respectively; C and M represent the number of signatures from ring members of full trust and edge trust required to verify the certificate, respectively. These values ​​are determined by the system authority, where C is greater than or equal to 1 and M is greater than or equal to 1. d represents the depth from the ring owner to the current ring member.

6. The method for constructing a decentralized public key infrastructure based on blockchain and trust networks according to claim 5, characterized in that: Step five includes the following steps: (1) Verify user identity; (2) If the user's identity verification is successful, the certificate content will be used as the original text for signing; (3) Members of the ring verify the reason for the abolition. The introducer has the right to verify first. If the reason for the abolition is reasonable, proceed to the next step. (4) Verify that the certificate status in OCSP / CRL / world state is revoked by updating the smart contract, and complete the certificate revocation. After this step is completed, directly jump to step six to end the process. (5) Multiple ring members sign the certificate, and the number of ring members that complete trust and edge trust must reach at least C and M in the formula; (6) Merge the signature values ​​of multiple ring members into a ring member signature list, and then place the ring member signature list into the certificate extension; (7) Return the certificate.

7. The method for constructing a decentralized public key infrastructure based on blockchain and trust networks according to claim 1, characterized in that: Step six includes the following steps: Verify the certificate's multi-signature extension, which primarily verifies the authenticity of all ring members in the list and the validity of the signature value. Calculate the certificate trust level according to the formula.

Images