Limited participant authentication method based on digital certificate

Abstract

The invention discloses a digital certificate-based authentication method for limited participants. The method at least comprises a first digital certificate and a second digital certificate; when the first digital certificate is signed and issued by the first CA, a signature of the first CA to the first digital certificate and at least signer public keys of the first CA and the second CA are embedded; when the second digital certificate is signed and issued by the second CA, at least embedding a signature of the second CA to the second digital certificate; the first digital certificate authenticates the second digital certificate; and the first digital certificate authenticates the signature of the second CA to the second digital certificate in the second digital certificate by using an embedded issuer public key of the second CA. According to the authentication method, a certificate chain is not used, but the same security can be realized, and the authentication method is suitable for mutual authentication of digital certificates among different digital certificate authentication mechanisms.

Description

Technical Field

[0001] The present invention belongs to the technical field of digital certificates, and in particular relates to an authentication method based on digital certificates for limited participants. Background Art

[0002] Digital certificates are an important means of confirming user identity and preventing repudiation for various personalized high-value application services. They are widely used in applications such as online banking and electronic contracts.

[0003] Traditional digital certificates, whether they are digital certificates in X.509 format or V2X certificates based on IEEE1609.2, have similar authentication methods, namely the chain trust relationship of "entity certificate-CA certificate-root certificate", also known as "certificate chain".

[0004] like Figure 1 The following is a schematic diagram of the structure of a traditional digital certificate. In this case, when certificate A wants to authenticate certificate B, certificate A needs to: 1. Obtain CA Certificate A; 2. Verify the validity of CA certificate A itself. If the verification fails, the entire verification fails; 3. Use A's public key to verify "A's signature to B" in B. If the verification fails, the entire verification fails.

[0005] In the "certificate chain" system, if you want to authenticate entity certificate A, you need to first verify the CA signature on the A certificate, then verify the root CA signature on the issuer (CA) certificate of the A certificate, and finally verify the self-signature on the CA certificate issuer (root CA) certificate; therefore, during the authentication process, you need to access three certificates: the A certificate, the issuer (CA) certificate of the A certificate, and the CA certificate issuer (root CA) certificate. The latter two are called pre-set certificates, because without these two certificates, the A certificate cannot be verified. At the same time, in order to prevent these two certificates from being maliciously replaced (further destroying the trust chain and forging the A certificate), the verifier needs to obtain these two certificates through reliable channels in advance and keep them properly. Here, we found a problem, that is, the acquisition, storage, and update of CA certificates and root CA certificates need to be carried out in a highly secure environment, which also brings higher usage costs to users.

[0006] If the number of trusted parties is unlimited, the above usage costs are helpless, but still effective and necessary; but at the same time, the "certificate chain" puts forward requirements on the capacity of storage space and the security of the storage location. For IoT embedded modules, any additional space requirements and security requirements will bring additional costs, and this cost multiplied by the huge number of modules may eventually become a huge number.

[0007] Chinese patent application CN113343202A discloses a mutual authentication method based on digital certificates under limited participant conditions. The digital certificate authentication agency performs digital signature operations based on specific information in the digital certificate issuance request. When issuing a digital certificate, the issuer's signature and issuer's public key are embedded. The mutually authenticated digital certificates are issued by the same digital certificate authentication agency. During mutual authentication: a digital certificate obtains the issuer's public key embedded in itself, and uses the issuer's public key to verify whether the issuer's signature of other digital certificates is correct; if correct, the authentication is successful; if incorrect, the authentication fails. This greatly simplifies the use cost of the holders of certificates that need mutual authentication, and also greatly simplifies the verification process of digital certificates, with obvious advantages in space cost and performance cost. However, this solution has the limitation of poor compatibility, and certificates between different digital certificate authentication agencies cannot be applied. Summary of the invention

[0008] In view of the above technical problems, the technical problem to be solved by the present invention is: in the case of limited participants, the same security can be achieved without using a certificate chain, and it is suitable for mutual authentication of digital certificates between different digital certificate certification authorities.

[0009] To achieve the above object, the technical solution adopted by the present invention is: a digital certificate-based authentication method for a limited party, comprising at least a first digital certificate and a second digital certificate; When the first digital certificate is issued by the first CA, the first CA's signature on the first digital certificate and at least the issuer public keys of the first CA and the second CA are embedded; When the second digital certificate is issued by the second CA, at least the signature of the second CA on the second digital certificate is embedded; The first digital certificate authenticates the second digital certificate: The first digital certificate authenticates the signature of the second CA on the second digital certificate in the second digital certificate with the embedded second CA's issuer public key. Authentication is to use the issuer public key to verify whether the issuer signature of other digital certificates is correct; if correct, the verification is passed; if incorrect, the verification fails.

[0010] This authentication method can adapt to the scenario of authentication between digital certificates issued by different CAs, greatly expanding the applicability of digital certificate authentication methods for limited participants.

[0011] In order to further expand the usage scenarios and realize mutual authentication between the first digital certificate and the second digital certificate, when the second digital certificate is issued by the second CA, the issuer public key of the first CA is also embedded; When the second digital certificate authenticates the first digital certificate: the second digital certificate uses the embedded first CA's issuer public key to authenticate the first CA's signature on the first digital certificate in the first digital certificate.

[0012] To further expand the usage scenarios, it also includes a third digital certificate issued by the first CA; When the first digital certificate authenticates the third digital certificate: the first digital certificate uses the embedded first CA's issuer public key to authenticate the first CA's signature on the third digital certificate in the third digital certificate. This authentication method can achieve the first digital certificate using its own issuer public key to authenticate the legitimacy of the third digital certificate, but the third digital certificate cannot authenticate the first digital certificate conversely.

[0013] When the second digital certificate authenticates the third digital certificate: the second digital certificate uses the embedded first CA's issuer public key to authenticate the first CA's signature on the third digital certificate in the third digital certificate.

[0014] Although the above authentication can only achieve one-way authentication, it is very important for the expansion of authentication scenarios.

[0015] To further expand the usage scenarios, when the second digital certificate is issued by the second CA, the issuer public key of the second CA is also embedded.

[0016] Preferably, in order to improve the independence of the issuer's public key and avoid the influence of the digital certificate issuance procedure, when issuing a digital certificate, the issuer's public key is attached to the certificate extension item of the digital certificate.

[0017] The present invention has the following beneficial effects: in the above verification process, the participation of the certificate chain is not required, and only the certificates of the participants themselves are required. This greatly simplifies the use cost of the holders of certificates that require mutual authentication, and also greatly simplifies the verification process of digital certificates, with obvious advantages in space cost and performance cost.

[0018] The present invention is applicable to mutual authentication of digital certificates between different digital certificate authentication agencies, and greatly expands the use scenarios of authentication between certificates. The present invention is an innovative invention that breaks through traditional thinking and creatively uses the principles of certificates and public key algorithms from a practical point of view. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 Schematic diagram of the digital certificate structure in the prior art.

[0020] Figure 2 This is a structural diagram of a digital certificate authentication method under limited participant conditions according to the first embodiment of the present invention.

[0021] Figure 3 This is a structural diagram of a digital certificate authentication method under limited participant conditions according to the second embodiment of the present invention.

[0022] Figure 4 This is a structural diagram of a digital certificate authentication method under limited participant conditions according to Embodiment 4 of the present invention.

[0023] Figure 5 This is the digital certificate format of the digital certificate authentication method under the limited participant condition of an embodiment of the present invention. DETAILED DESCRIPTION

[0024] To facilitate understanding by those skilled in the art, the present invention is further described below in conjunction with embodiments and drawings.

[0025] A digital certificate is an online identifier that proves the identity of a user. It identifies the identities of all parties in the communication network and can ensure that the transactions you conduct on the network are safe and reliable. A digital certificate authority (CA): is the issuing authority of certificates. CA is responsible for issuing certificates, certifying certificates, and managing issued certificates. It must formulate policies and specific steps to verify and identify user identities, and sign user certificates to ensure the identity of the certificate holder and the ownership of the public key.

[0026] Embodiment 1: A digital certificate-based authentication method for limited parties, such as Figure 2 As shown, it includes a first digital certificate (A) and a second digital certificate (B); when the first digital certificate is issued by a first CA (A), the signature of the first CA on the first digital certificate and the issuer public keys of the first CA and the second CA (B) are embedded; when the second digital certificate is issued by a second CA, the signature of the second CA on the second digital certificate is embedded.

[0027] The first digital certificate authenticates the second digital certificate: The first digital certificate authenticates the signature of the second CA on the second digital certificate in the second digital certificate with the embedded second CA's issuer public key. Authentication is to use the issuer public key to verify whether the issuer signature of other digital certificates is correct; if correct, the verification is passed; if incorrect, the verification fails.

[0028] This authentication method can adapt to the scenario of authentication between digital certificates issued by different CAs, greatly expanding the applicability of digital certificate authentication methods for limited participants. For example, if a company's equipment uses parts from another company, and the two companies use different CAs to issue digital certificates for the parts, it may involve mutual recognition between digital certificates issued by different CAs.

[0029] Embodiment 2: Figure 3 As shown, in order to further expand the usage scenarios, it also includes a third digital certificate (C) issued by the first CA; when the first digital certificate authenticates the third digital certificate: the first digital certificate uses the embedded first CA's issuer public key to authenticate the first CA's signature on the third digital certificate in the third digital certificate. This authentication method can realize that the first digital certificate uses its own issuer public key to authenticate the legitimacy of the third digital certificate, but conversely, it cannot realize the third digital certificate authenticating the first digital certificate.

[0030] Embodiment 3: Based on the above embodiment, in order to realize mutual authentication between the first digital certificate and the second digital certificate, when the second digital certificate is issued by the second CA, the issuer public key of the first CA is also embedded.

[0031] When the second digital certificate authenticates the first digital certificate: the second digital certificate uses the embedded first CA's issuer public key to authenticate the first CA's signature on the first digital certificate in the first digital certificate.

[0032] When the second digital certificate authenticates the third digital certificate: the second digital certificate uses the embedded first CA's issuer public key to authenticate the first CA's signature on the third digital certificate in the third digital certificate.

[0033] Although the above authentication can only be done in one direction, it is very important for the expansion of authentication scenarios. One-way authentication is widely used in fields such as identity authentication. For example, when a resident needs to submit personal information to an insurance company, the resident needs to confirm that the recipient of the submission is indeed the insurance company. However, in turn, the insurance company does not need to verify the identity of the resident after the resident submits the information, but can verify it through other means after the resident submits the information. This process is a one-way authentication process.

[0034] Embodiment 4, as Figure 4 As shown, on the basis of the above embodiments, in order to further expand the usage scenarios, when the second digital certificate is issued by the second CA, the issuer public key of the second CA is also embedded. The mutual recognition of the second CA's own internal certificates is realized. Based on the solutions of the various embodiments of the present invention, the extension of authentication and the simplification of procedures are realized in the case of limited participants in time and space. The more issuer public keys are included in the digital certificate, the simpler the authentication process is.

[0035] Imagine such a scenario: if there is only one CA, and all digital certificates are issued by this CA, then there is no need for a certificate chain. The reason why a certificate chain is needed is because there is a second CA (in space), and as time goes on, there may be a third CA. When the third CA comes out, how can the digital certificate of the first one authenticate the new digital certificate issued by the third one? It can only be authenticated through the certificate chain of the third party, which leads to an increase in cost. The technology of the embodiment of the present invention is to achieve mutual recognition or self-recognition through limited participants in space and time.

[0036] like Figure 5 As shown, in order to improve the independence of the issuer's public key and avoid the influence of the digital certificate issuance procedure, when issuing a digital certificate, the issuer's public key is attached to the certificate extension item of the digital certificate.

[0037] Imagine such a scenario: there are three independent components on a certain device, and these three components need to authenticate each other before they can work. Component A and component B are from supplier A, and component C is from supplier B. Supplier A and supplier B have established a digital certificate issuance and supervision system for parts. Within their own system, supplier A and supplier B use embodiment three to complete mutual authentication of the parts they produce, that is, component A can authenticate component B. When the issuer public key of the first CA A is embedded in the third digital certificate C, component B can also authenticate component A; however, how component A authenticates component C requires further work. In the case of the embodiment of the present invention, components A and B can authenticate component C through the embedded public key of supplier B, and component C can also authenticate components A and B through the embedded public key of supplier A.

[0038] The above embodiments are only for illustrating the technical idea of ​​the present invention, and cannot be used to limit the protection scope of the present invention. Any changes made on the basis of the technical solution in accordance with the technical idea proposed by the present invention shall fall within the protection scope of the present invention.

Claims

1. A digital certificate-based authentication method for limited parties, characterized in that: At least includes a first digital certificate and a second digital certificate; When the first digital certificate is issued by the first CA, the first CA's signature on the first digital certificate and at least the issuer public keys of the first CA and the second CA are embedded; When the second digital certificate is issued by the second CA, at least the signature of the second CA on the second digital certificate is embedded; The first digital certificate authenticates the second digital certificate: the first digital certificate authenticates the signature of the second CA on the second digital certificate in the second digital certificate with the embedded issuer public key of the second CA.

2. The digital certificate-based authentication method for limited parties according to claim 1, characterized in that: Also includes a third digital certificate issued by the first CA; When the first digital certificate authenticates the third digital certificate: the first digital certificate uses the embedded first CA's issuer public key to authenticate the first CA's signature on the third digital certificate in the third digital certificate.

3. The digital certificate-based authentication method for limited parties according to claim 1, characterized in that: When the second digital certificate is issued by the second CA, the issuer public key of the first CA is also embedded; When the second digital certificate authenticates the first digital certificate: the second digital certificate uses the embedded first CA's issuer public key to authenticate the first CA's signature on the first digital certificate in the first digital certificate.

4. The digital certificate-based authentication method for limited parties according to claim 3, characterized in that: Also includes a third digital certificate issued by the first CA; When the second digital certificate authenticates the third digital certificate: the second digital certificate uses the embedded first CA's issuer public key to authenticate the first CA's signature on the third digital certificate in the third digital certificate.

5. The digital certificate-based authentication method for a limited party according to any one of claims 1 to 4, characterized in that: When the second digital certificate is issued by the second CA, the issuer public key of the second CA is also embedded in the second digital certificate.

6. The digital certificate-based authentication method for a limited party according to any one of claims 1 to 4, characterized in that: The issuer's public key is attached to the certificate extension of the digital certificate.

Images