A blockchain-based digital certificate life cycle management method

Abstract

The application discloses a kind of digital certificate life cycle management methods based on block chain, it is related to block chain and digital identity authentication technology, including receiving the certificate application party submitted certificate issuing application, and write in the certificate application node of block chain network;Based on certificate revocation state inquiry interface, the historical certificate revocation record of certificate application party is obtained by verification node, and the security evaluation of certificate issuing application is carried out, and evaluation result is generated;When evaluation result indicates that the applicant has no historical certificate revocation record, digital certificate is generated through certificate issuing node, and certificate block is formed with certificate application party identity information;Certificate block is broadcasted to all nodes of block chain network through certificate issuing node, and state change information is recorded, and state trace chain is formed.The application is integrated with block chain technology by whole process of digital certificate management, constructs complete closed-loop management system, realizes revolutionary upgrade of traditional certificate management system.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of blockchain and digital identity authentication technology, and in particular to a digital certificate life cycle management method based on blockchain. BACKGROUND

[0002] The digital certificate management technology based on blockchain aims to provide a more credible, transparent and traceable solution for digital identity authentication and data security. As a core mechanism to protect network security, digital certificates are widely used in government services, financial systems, enterprise informatization and many other scenarios. However, the traditional digital certificate life cycle management mode generally relies on centralized certificate authorities (CAs), and there are problems such as operation opacity, high tampering risk, information synchronization lag, etc. in the process of certificate issuance, revocation, update and verification, which can be easily exploited by malicious users to implement attacks or fake identities at a certain stage of the certificate life cycle, causing serious security risks. Especially in the current context of high-frequency dynamic authentication requirements and cross-platform trusted interaction challenges in digital identity management, how to build a distributed system that can manage the entire life cycle of digital certificates, ensure data credibility at each link and realize operation traceability is a technical problem that needs to be solved urgently.

[0003] CN110598482B discloses a digital certificate management method, device and equipment based on blockchain and storage medium, which generates a digital certificate after user verification and constructs a first block containing certificate information, which is broadcast to multiple nodes of the blockchain system, realizing distributed storage of issuance records, effectively preventing data tampering and ensuring the credibility and transparency of the issuance records. However, this method mainly focuses on certificate generation and issuance record preservation, and does not cover key processes such as state change, revocation and update in the certificate life cycle, making it difficult to realize the entire process of certificate use and traceability, and there is an information island problem.

[0004] CN114157428A proposes a digital certificate management method and system based on blockchain, which adopts a multi-CA authentication end collaborative processing architecture, stores certificate operation records in the blockchain through a consensus mechanism, realizes verifiable and tamper-proof certificate processing operations, and improves the transparency and credibility of certificate management. However, this scheme still records single certificate operations, lacks a continuous chain management mechanism throughout the entire certificate life cycle, cannot effectively identify whether the applicant has a history of abnormal behavior or revocation records, and cannot perform behavior risk assessment and control on the certificate subject, so there are still potential risks such as forgery and malicious application. SUMMARY

[0005] In view of the problems of lack of security review of certificate application behavior, inability to fully utilize the revocation history information, and lack of complete chain record in the certificate status change process in the existing digital certificate management, the application is proposed.

[0006] Therefore, the problem to be solved by the application is how to realize the whole-process management of digital certificates based on a blockchain, including the traceability and non-tamperability of operations such as certificate application, issuance, verification, revocation, and status update, so as to improve the security, transparency, and automation level of certificate management.

[0007] To solve the above technical problems, the application provides the following technical solutions.

[0008] In a first aspect, the application embodiment provides a digital certificate life cycle management method based on a blockchain, which comprises,

[0009] receiving a certificate issuance application submitted by a certificate applicant and writing the certificate issuance application into a certificate application node of a blockchain network;

[0010] based on a certificate revocation status query interface, obtaining historical certificate revocation records of the certificate applicant through a verification node in the blockchain network, and performing a security evaluation on the certificate issuance application to generate an evaluation result;

[0011] when the evaluation result indicates that the applicant has no historical certificate revocation records, generating a digital certificate through a certificate issuing node, and grouping the digital certificate and certificate applicant identity information into a certificate block;

[0012] broadcasting the certificate block to all nodes of the blockchain network through the certificate issuing node, recording state change information of the digital certificate in a certificate information block, and forming a state trace chain of the whole life cycle of the digital certificate.

[0013] As a preferred scheme of the digital certificate life cycle management method based on a blockchain, the forming method of the state trace chain is,

[0014] the certificate issuing node calculates a hash value of the certificate block, and broadcasts the certificate block and the hash value of the certificate block to all nodes in the blockchain network;

[0015] verifying the hash value of the certificate block, and establishing a certificate state index table based on a certificate serial number;

[0016] listening to a certificate state change event, and updating the certificate state index table according to a certificate state change request;

[0017] packing the certificate state change information into a state change block and adding the state change block to the blockchain network through a consensus mechanism, associating the state change block with the original certificate block, and forming a state trace chain of the digital certificate.

[0018] As a preferred scheme of the blockchain-based digital certificate lifecycle management method, wherein: the hash value of the certificate block is verified, including:

[0019] The certificate serial number, certificate validity period, certificate status identifier and identity information are extracted from the certificate block, and the to-be-verified data is composed in a preset field order;

[0020] The SHA-256 hash algorithm is used to calculate the hash value of the to-be-verified data;

[0021] The current hash value is compared with the hash value carried in the certificate block, and when the two hash values are completely matched, the certificate block passes the hash verification;

[0022] Verify whether the hash value of the previous block and the hash value of the corresponding block in the local blockchain are consistent, and whether the timestamp is later than the timestamp of the previous block and earlier than the current system time;

[0023] When the certificate block passes the hash verification, the block link verification and the timing verification, each node marks the certificate block as a verified state.

[0024] As a preferred scheme of the blockchain-based digital certificate lifecycle management method, wherein: the certificate block is obtained by,

[0025] The certificate issuing node receives the evaluation record block, parses the evaluation result of the evaluation record block, and when the evaluation result is a passed evaluation result, enters the certificate generation process;

[0026] The certificate serial number generation module is called, the certificate serial number is generated based on the timestamp and the random number seed, and the certificate validity period is set according to the certificate use information;

[0027] Based on the certificate status identifier initialized to be valid, the certificate serial number and the certificate validity period are packaged to form a digital certificate;

[0028] The digital certificate is added with a digital signature, wherein the digital signature uses the private key of the certificate issuing authority to encrypt the content of the digital certificate;

[0029] The digital certificate is associated with the identity information of the certificate applicant to construct a certificate block header, wherein the certificate block header includes a block version number, a timestamp and a previous block hash value;

[0030] The certificate block header, the digital certificate and the associated identity information constitute a certificate block.

[0031] As a preferred scheme of the blockchain-based digital certificate life cycle management method, wherein the generation method of the evaluation result is,

[0032] The verification node in the blockchain network receives the certificate application block, extracts the identity information of the certificate applicant, and constructs a certificate revocation query request;

[0033] The certificate revocation query request is sent to the blockchain network through a certificate revocation state query interface, and historical certificate revocation records are obtained;

[0034] According to the preset security evaluation rule, the historical certificate revocation records are analyzed, and a first security score is calculated, wherein the security evaluation rule includes a certificate revocation frequency threshold and a revocation reason classification;

[0035] The evaluation result is generated based on the first security score, and an evaluation record block is incorporated and broadcast to other nodes in the blockchain network.

[0036] As a preferred scheme of the blockchain-based digital certificate life cycle management method, wherein the historical certificate revocation records are analyzed according to the preset security evaluation rule, and a first security score is calculated, including:

[0037] The revocation time, revocation reason and associated certificate information of the historical certificate revocation record are extracted, the revocation time is formed into a revocation time sequence in chronological order, and a time decay coefficient is calculated;

[0038] The number of certificate revocations in the revocation time sequence is counted, and the number of certificate revocations is compared with the preset revocation frequency threshold to generate a revocation frequency score;

[0039] Based on the preset revocation reason grading standard, the revocation reason is graded;

[0040] The occurrence frequency of each level of revocation reason is calculated, the occurrence frequency is multiplied by the corresponding level weight coefficient to generate a revocation reason score;

[0041] The revocation frequency score and the revocation reason score are multiplied by the time decay coefficient respectively, and weighted summation is performed according to the preset weight to obtain an initial security score;

[0042] According to the associated certificate information, the certificate purpose classification is extracted, the initial security score is modified through the security level requirements of different certificate purposes, and a first security score is generated.

[0043] As a preferred scheme of the blockchain-based digital certificate life cycle management method, wherein the certificate application submitted by the certificate applicant is received, and the certificate application node of the blockchain network is written, including:

[0044] The certificate application node of the blockchain network displays a certificate application interface, and a certificate applicant fills in identity information and selects a certificate application scenario;

[0045] The identity information is format-verified, and the format-verified identity information and the certificate application scenario are combined to form a certificate issuance application;

[0046] A hash value of the certificate issuance application is calculated, and the certificate issuance application and the corresponding hash value are added to a certificate application queue;

[0047] The certificate issuance applications in the certificate application queue are packaged into certificate application blocks in chronological order and written into the blockchain network.

[0048] As a preferred scheme of the blockchain-based digital certificate life cycle management method, wherein: the format verification includes format verification scheme A and format verification scheme B; the format verification of the identity information includes:

[0049] When the format verification scheme A is executed, if the identity information is of an enterprise type, a multi-dimensional cross-verification mode is adopted, the unified social credit code is verified in real time by an enterprise credit information verification center, and three verification functions are added to the organization code, the enterprise registration number and the business license number; if an abnormal code appears, a degraded verification mode is adopted, the identity information is verified twice by a backup verification center, special character information is processed by combining manual review and system automatic filtering, and the code is evaluated for effectiveness; if the identity information is in an unstandardized format, the abnormal field is automatically corrected to prevent invalid code generation;

[0050] When the format verification scheme B is executed, if the identity information is found to be abnormal, a dynamic tracing verification is adopted, multi-level verification of the identity information is performed by an intelligent recognition engine, four verification functions are added to the organization code, the enterprise registration number and the business license number, and the intelligent recognition engine locates the abnormality; if the abnormality is located, a synchronous early warning feedback is performed, an administrator is notified to manually review the abnormal information, a verification node is added to the verification process, verification state information fed back by the intelligent recognition engine is received, the abnormal information is classified and processed; if the abnormality is excluded, the corrected identity information is re-evaluated; if there is no format abnormality, the identity information and the certificate application scenario are combined to form a certificate issuance application, and the format verification process is completed.

[0051] In a second aspect, an embodiment of the present application provides a computer device, comprising a memory and a processor, and the memory stores a computer program, wherein: the computer program instructions are executed by the processor to implement the steps of the method for managing the life cycle of a digital certificate based on a blockchain as described in the first aspect of the present application.

[0052] In a third aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, wherein: the computer program instructions are executed by the processor to implement the steps of the method for managing the life cycle of a digital certificate based on a blockchain as described in the first aspect of the present application.

[0053] Compared with the prior art, the present application has the following beneficial effects: by deeply integrating the whole process of digital certificate management with blockchain technology, a complete closed-loop management system from certificate application, risk assessment, certificate issuance to state tracing is constructed, and a revolutionary upgrade of the traditional certificate management system is realized; by recording the certificate application information in the blockchain network, the tamper resistance and traceability of the application data are ensured, and the risk of malicious modification of information is eliminated from the source; based on the intelligent safety evaluation mechanism of the historical certificate revocation record, through multi-dimensional quantitative analysis such as time decay coefficient and revocation reason grading, the precise prediction of the credit risk of the applicant is realized, and the possibility of repeated violation of high-risk subjects is effectively prevented; by using the digital signature and hash verification technology of the cryptography level, a digital certificate with uniqueness and anti-fake property is constructed, and the problems of forgery and misuse in the traditional certificate system are solved; through the establishment of the network-wide broadcast and the state tracing chain, the real-time synchronization of the certificate life cycle state and the complete record of the historical track are realized, making it possible to query the certificate state at any time point and trace the history; this method not only significantly improves the security, credibility and management efficiency of the digital certificate, but also establishes a decentralized certificate trust system, providing a solid technical foundation and institutional guarantee for the trusted identity authentication and permission management of the digital society. BRIEF DESCRIPTION OF DRAWINGS

[0054] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor. Among them:

[0055] Figure 1 The flowchart of the method for managing the life cycle of a digital certificate based on a blockchain of the embodiment.

[0056] Figure 2 The real-time state diagram of the method for managing the life cycle of a digital certificate based on a blockchain of the embodiment. DETAILED DESCRIPTION

[0057] In order to make the above objectives, features and advantages of the present application more obvious and easy to understand, the specific embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0058] In the following description, a lot of specific details are set forth in order to facilitate a thorough understanding of the present application, but the present application can also be implemented in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the concept of the present application, therefore the present application is not limited to the specific embodiments disclosed below.

[0059] Secondly, the "one embodiment" or "embodiment" referred to herein means that the specific features, structures or characteristics can be included in at least one implementation of the present application. "In one embodiment" appearing in different places in the specification does not mean the same embodiment, nor is it an embodiment that is independent of or selected from other embodiments.

[0060] Embodiment 1

[0061] Reference Figures 1-2 For the first embodiment of the present application, the embodiment provides a blockchain-based digital certificate life cycle management method, comprising,

[0062] S1: receiving the certificate application submitted by the certificate applicant, and writing into the certificate application node of the blockchain network.

[0063] Specifically, it includes:

[0064] S1.1: the certificate application node of the blockchain network displays a certificate application interface, and the certificate applicant fills in the identity information and selects the certificate application scenario;

[0065] It should be noted that the certificate application interface includes an identity information input box and a certificate purpose information selection box; the identity information includes a unified social credit code, an organization name, and an applicant contact; the certificate application scenario includes one or more of website SSL certificate, code signing certificate, and document signing certificate.

[0066] S1.2: format checking is performed on the identity information, and the identity information after format checking and the certificate application scenario are combined to form a certificate issuance application;

[0067] It should be noted that the certificate issuance application includes the identity information of the certificate applicant and the certificate purpose information; the format checking includes a first format checking scheme A and a second format checking scheme B.

[0068] In an optional embodiment, when the primary format verification scheme A is executed, if the identity information is of an enterprise type, a multi-dimensional cross verification mode is adopted, the unified social credit code is verified in real time by an enterprise credit information verification center, three verification functions are added for the organization code, the enterprise registration number and the business license number, if abnormal codes appear, a degraded verification mode is adopted, the identity information is verified twice by a backup verification center, the special character information is processed by a combination of manual review and automatic filtering of the system, the codes are evaluated for effectiveness, if the identity information appears in a non-standard format, the abnormal fields are automatically corrected to prevent invalid codes from being generated.

[0069] Preferably, the three verification functions include a number verification function, a character verification function and a rule verification function, the number verification function checks the compliance of the coding rules, the character verification function filters and converts special characters, and the rule verification function determines the integrity and consistency of the identity information.

[0070] In an optional embodiment, when the secondary format verification scheme B is executed, if the identity information is found to be abnormal, a dynamic tracing verification is adopted, the identity information is verified by a multi-level intelligent identification engine, four verification functions are added for the organization code, the enterprise registration number and the business license number, and the intelligent identification engine locates the abnormality, if the abnormality is located, a synchronous early warning feedback is performed to notify an administrator to manually review the abnormal information, additional verification nodes are added to the verification process to receive the verification state information fed back by the intelligent identification engine, the abnormal information is classified and processed, if the abnormality is eliminated, the corrected identity information is re-evaluated, and if there is no format abnormality, the identity information and the certificate application scenarios are combined to form a certificate issuance application, and the format verification process is completed.

[0071] Preferably, the four verification functions add a historical record verification function to the three verification functions, and the historical record verification function is used to compare the consistency of the current identity information and the historical archive records.

[0072] S1.3: Calculate the hash value of the certificate issuance application, add the certificate issuance application and the corresponding hash value to the certificate application queue;

[0073] S1.4: Pack the certificate issuance applications in the certificate application queue into certificate application blocks in chronological order, and write them into the blockchain network.

[0074] S2: Based on the certificate revocation status query interface, obtain the historical certificate revocation records of the certificate applicant through the verification nodes in the blockchain network, and perform a security evaluation on the certificate issuance application to generate an evaluation result.

[0075] Specifically comprising

[0076] S2.1: receiving a certificate application block by a verification node of a blockchain network, extracting identity information of a certificate applicant, and constructing a certificate revocation query request;

[0077] S2.2: sending the certificate revocation query request to the blockchain network through a certificate revocation status query interface, and obtaining historical certificate revocation records;

[0078] S2.3: analyzing the historical certificate revocation records according to a preset security evaluation rule, and calculating a first security score, wherein the security evaluation rule includes a certificate revocation frequency threshold and a revocation reason classification;

[0079] In an optional implementation, the certificate revocation frequency threshold determines that when the number of certificate revocations N in the past 5 years is less than or equal to 2, the revocation frequency score is 100; when 2 < certificate revocation frequency N ≤ 4, the revocation frequency score is 80; when 4 < certificate revocation frequency N ≤ 6, the revocation frequency score is 60; and when the number of certificate revocations N > 6, the revocation frequency score is 0, and the application is directly rejected.

[0080] Specifically comprising:

[0081] S2.3.1: extracting the revocation time, revocation reason and associated certificate information of the historical certificate revocation records, forming a revocation time sequence according to the time sequence of the revocation time, and calculating a time decay coefficient;

[0082] S2.3.2: counting the number of certificate revocations in the revocation time sequence, comparing the number of certificate revocations with a preset revocation frequency threshold, and generating a revocation frequency score;

[0083] S2.3.3: classifying the revocation reason based on a preset revocation reason classification standard;

[0084] In an optional implementation, the revocation reason is divided into four levels:

[0085] A level (certificate information change violation): certificate update delay, information change not timely, basic score 85;

[0086] B level (certificate use violation): certificate use range exceeds application purpose, certificate is not used as required, basic score 70;

[0087] C level (certificate security violation): certificate private key leakage, illegal sharing of certificate, basic score 40;

[0088] D level (certificate malicious violation): certificate used for illegal activities, malicious tampering of certificate content, basic score 0.

[0089] S2.3.4: Calculate the occurrence frequency of each level revocation reason, multiply the occurrence frequency by the corresponding level weight coefficient, and generate a revocation reason score;

[0090] S2.3.5: Multiply the revocation frequency score and the revocation reason score by the time decay coefficient respectively, and perform weighted summation according to the preset weight to obtain an initial security score;

[0091] S2.3.6: Extract the certificate purpose classification according to the associated certificate information, modify the initial security score by the security level requirement of different certificate purposes, and generate a first security score.

[0092] Preferably, the specific formula of the first security score is as follows:

[0093]

[0094] wherein SafetyScore is the first security score, R n is the basic score based on the number of revocations N, V i is the level score of the i-th violation, λ is the time decay factor, t i is the time interval from the i-th violation to the present (calculated in years), γ c is the certificate purpose correction coefficient, and m is the total number of violation records.

[0095] It should be noted that the value range is SafetyScore∈[0, 100]; [0, 60): high risk, recommended to reject the application; [60, 75): medium risk, need additional review; [75, 90): low risk, normal processing.

[0096] S2.4: Generate an evaluation result based on the first security score, and enter the evaluation record block, and broadcast to other nodes in the blockchain network.

[0097] In an optional embodiment, the first security score is extracted, and a hierarchical evaluation is performed based on a preset score threshold:

[0098] When the first security score is higher than a first threshold value, a direct pass assessment result is generated, a fast approval channel identifier is marked, and the basic information of the certificate applicant and the security score are recorded; when the first security score is between the second threshold value and the first threshold value, a conditional pass assessment result is generated, a supplementary audit identifier is marked, credit guarantee materials are required to be provided by the certificate applicant, and the basic information of the certificate applicant, the security score and the credit guarantee requirement are recorded; when the first security score is between the third threshold value and the second threshold value, a restricted pass assessment result is generated, a mandatory constraint identifier is marked, the use range of the certificate is limited, the validity period of the certificate is shortened, and the basic information of the certificate applicant, the security score, the use restriction condition and the validity period constraint are recorded; when the first security score is lower than the third threshold value, a fail assessment result is generated, a refusal to issue identifier is marked, and the basic information of the certificate applicant, the security score and the refusal reason are recorded.

[0099] In an optional implementation, the evaluation record information package is packaged to generate an evaluation record block: when the fast approval channel record is packaged, a priority processing identifier is added, and the node is processed in priority; when the supplementary audit record is packaged, a material tracking identifier is added, and the node is synchronized to update the material tracking state; when the mandatory constraint record is packaged, a supervision tracking identifier is added, and the node is synchronized to update the supervision state; when the refusal to issue record is packaged, a blacklist warning identifier is added, and the node is synchronized to update the blacklist information.

[0100] S3: When the evaluation result indicates that the applicant has no historical certificate revocation record, a digital certificate is generated by a certificate issuing node, and the digital certificate and the certificate applicant identity information are combined to form a certificate block.

[0101] Specifically includes:

[0102] S3.1: The certificate issuing node receives the evaluation record block, parses the evaluation result of the evaluation record block, and when the evaluation result is a pass evaluation result, enters a certificate generation process;

[0103] It should be noted that the entering of the certificate generation process is as shown in Figure 2 .

[0104] S3.2: A certificate serial number generation module is called, a certificate serial number is generated based on a timestamp and a random number seed, and a certificate validity period is set according to certificate use information;

[0105] It should be noted that the certificate serial number adopts a 36-bit string format; for a website SSL certificate, 12 months are set, for a code signing certificate, 24 months are set, and for a document signing certificate, 36 months are set.

[0106] S3.3: Based on the certificate status identifier initialized to the valid state, the certificate serial number and the certificate validity period are packaged to form a digital certificate;

[0107] S3.4: A digital signature is added to the digital certificate, wherein the digital signature encrypts the content of the digital certificate by using the private key of the certificate authority;

[0108] S3.5: The digital certificate is associated with the identity information of the certificate applicant to construct a certificate block header, wherein the certificate block header comprises a block version number, a timestamp, and a previous block hash value;

[0109] S3.6: The certificate block header, the digital certificate, and the associated identity information are combined to form a certificate block.

[0110] S4: The certificate block is broadcast to all nodes of the blockchain network by the certificate issuing node, and the state change information of the digital certificate is recorded in the certificate information block to form a state trace chain of the whole life cycle of the digital certificate.

[0111] Specifically, it comprises:

[0112] S4.1: The certificate issuing node calculates the hash value of the certificate block, and broadcasts the certificate block and the hash value of the certificate block to all nodes in the blockchain network;

[0113] Preferably, the specific formula of the hash value of the certificate block is as follows:

[0114] BlockHash=SHA256(H p |T s |CertInfo||Status)

[0115] CertInfo=SHA256(SN||V||E||I||U);

[0116] Wherein, BlockHash is the final certificate block hash value, H p is the hash value of the previous block, T s is the block timestamp, CertInfo is the certificate information hash value, Status is the certificate status identifier, SN is the certificate serial number, V is the certificate version number, E is the certificate validity period, I is the certificate applicant identity, U is the certificate purpose identifier, and || is the string concatenation operator.

[0117] S4.2: Verify the hash value of the certificate block, and when the verification is passed, add the certificate block to the local blockchain;

[0118] S4.3: Listen to the certificate state change event, update the certificate state index table according to the certificate state change request;

[0119] It should be noted that the certificate state index table includes a certificate serial number, a certificate state identifier and a state update timestamp field.

[0120] S4.4: Pack the certificate state change information into a state change block and add it to the blockchain network through a consensus mechanism, associate it with the original certificate block, and form a state trace chain of the digital certificate.

[0121] It should be noted that the certificate state change request includes a change type, a change reason and a change time; the state change block contains a certificate serial number, an original certificate state identifier, a new certificate state identifier, a change type and a change reason.

[0122] In summary, the present application deeply integrates the whole process of digital certificate management with blockchain technology, and builds a complete closed-loop management system from certificate application, risk assessment, certificate issuance to state traceability, realizing the revolutionary upgrade of the traditional certificate management system; by recording the certificate application information in the blockchain network, the non-tamperability and traceability of the application data are ensured, and the risk of malicious modification of information is eliminated from the source; based on the intelligent security evaluation mechanism of historical certificate revocation records, through multi-dimensional quantitative analysis such as time decay coefficient and revocation reason classification, the precise prediction of the credit risk of the applicant is realized, and the possibility of repeated violation of high-risk subjects is effectively prevented; through the cryptography level digital signature and hash verification technology, a unique and anti-fake digital certificate is built, solving the problem of forgery and misuse in the traditional certificate system; through the establishment of network-wide broadcast and state traceability chain, the real-time synchronization of the certificate life cycle state and the complete record of the historical track are realized, making it possible to query the certificate state at any time point and trace the history; this method not only significantly improves the security, credibility and management efficiency of digital certificates, but also establishes a decentralized certificate trust system, providing a solid technical foundation and institutional guarantee for the trusted identity authentication and permission management of the digital society.

[0123] The embodiment also provides an electronic device, which comprises a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is configured to perform wired or wireless communication with an external terminal. The wireless communication can be achieved through WIFI, an operator network, NFC (Near Field Communication) or other technologies. The computer program is executed by the processor to implement a multi-task edge computing resource scheduling method. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer overlaid on the display screen, or a key, trackball or touchpad arranged on the shell of the computer device, or an external keyboard, touchpad or mouse, etc.

[0124] The embodiment also provides a computer readable storage medium, which stores a computer program. The program is executed by a processor to implement the method proposed in the above embodiment.

[0125] The storage medium proposed in the embodiment belongs to the same inventive concept as the method proposed in the above embodiment. The technical details not described in the embodiment can be referred to the above embodiment, and the embodiment has the same beneficial effects as the above embodiment.

[0126] From the above description about the embodiments, those skilled in the art can clearly understand that the present application can be realized by means of software and necessary universal hardware, and of course can also be realized by hardware, but in many cases the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a floppy disk, a ROM, a RAM, a FLASH, a hard disk or an optical disc, and includes a number of instructions to make a computer device (which can be a personal computer, a server or a network device, etc.) execute the methods of the embodiments of the present application.

[0127] It should be noted that the above examples are only used to illustrate the technical solutions of the present application but not limit the present application. Although the present application is described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or equivalently replaced without departing from the spirit and scope of the present application, and all these modifications and equivalents should be included in the scope of the claims of the present application.

[0128] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can adopt a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can adopt a computer program product in the form of being implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program codes. The solutions in the embodiments of the present application can be implemented in various computer languages.

[0129] The present application is described with reference to flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices generate a means for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus that carries out the functions specified in one or more blocks.

[0130] These computer program instructions can also be stored in a computer readable storage medium that can direct the computer or other programmable data processing devices to work in a specific manner, so that the instructions stored in the computer readable storage medium produce a product including an instruction apparatus that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus that carries out the functions specified in one or more blocks.

[0131] These computer program instructions can also be loaded into a computer or other programmable data processing device to cause a series of operation steps to be performed on the computer or other programmable data processing device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable data processing device provide a process for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus that carries out the functions specified in one or more blocks.

[0132] While the preferred embodiments of the application have been described, additional variations and modifications can be made to these embodiments by those skilled in the art once they have the benefit of the present disclosure without departing from the spirit and scope of the application. Accordingly, it is intended that the appended claims include all such modifications and variations as fall within the scope of the present application.

[0133] It is apparent that many modifications and variations of this application can be effected although only a few have been chosen for purposes of disclosure. Thus, it is intended that this application include all such modifications and variations as fall within the scope of the claims and their equivalents.

Claims

1. A blockchain-based digital certificate lifecycle management method, characterized in that: The application comprises the following steps: a certificate application node of a blockchain network receives a certificate application submitted by a certificate applicant and writes the certificate application into the blockchain network; based on a certificate revocation status query interface, a verification node in the blockchain network obtains historical certificate revocation records of the certificate applicant and performs a security evaluation on the certificate application to generate an evaluation result; when the evaluation result shows that the applicant has no historical certificate revocation records, a digital certificate is generated by a certificate issuing node, and the digital certificate and the identity information of the certificate applicant are combined to form a certificate block; the certificate block is broadcast to all nodes of the blockchain network by the certificate issuing node, and the state change information of the digital certificate is recorded in the certificate information block to form a state tracing chain of the whole life cycle of the digital certificate; the generation method of the evaluation result comprises the following steps: a verification node of the blockchain network receives a certificate application block, extracts the identity information of the certificate applicant, and constructs a certificate revocation query request; the certificate revocation query request is sent to the blockchain network through a certificate revocation status query interface to obtain historical certificate revocation records; the historical certificate revocation records are analyzed according to a preset security evaluation rule to calculate a first security score, wherein the security evaluation rule comprises a certificate revocation frequency threshold and a revocation reason classification; an evaluation result is generated based on the first security score and is incorporated into an evaluation record block and broadcast to other nodes in the blockchain network; the revocation time, revocation reason and associated certificate information of the historical certificate revocation records are extracted, the revocation time is arranged in chronological order to form a revocation time sequence, and a time decay coefficient is calculated; the number of certificate revocations in the revocation time sequence is counted, the number of certificate revocations is compared with a preset revocation frequency threshold, and a revocation frequency score is generated; the revocation reason is classified based on a preset revocation reason grading standard; the frequency of occurrence of each level of revocation reason is calculated, the frequency of occurrence is multiplied by the corresponding level weight coefficient to generate a revocation reason score; the revocation frequency score and the revocation reason score are multiplied by the time decay coefficient respectively, and a weighted sum is obtained according to a preset weight to obtain an initial security score; the purpose classification of the certificate is extracted according to the associated certificate information, the initial security score is modified according to the security level requirements of different certificate purposes, and a first security score is generated.

2. The blockchain-based digital certificate lifecycle management method of claim 1, wherein: The formation method of the state tracing chain comprises the following steps: a certificate issuing node calculates the hash value of a certificate block and broadcasts the certificate block and the hash value of the certificate block to all nodes in the blockchain network; the hash value of the certificate block is verified, and a certificate state index table is established based on a certificate serial number; certificate state change events are listened to, and the certificate state index table is updated according to a certificate state change request; certificate state change information is packaged into a state change block and added to the blockchain network through a consensus mechanism, and the state change block is associated with the original certificate block to form a state tracing chain of the digital certificate. 3.The blockchain-based digital certificate lifecycle management method of claim 2, wherein: the verification of the hash value of the certificate block comprises the following steps: the certificate serial number, certificate validity period, certificate state identifier and identity information are extracted from the certificate block, and the extracted information is arranged in a preset field order to form verification data; The SHA-256 hash algorithm is used to hash the to-be-verified data to generate a current hash value; The current hash value is compared with the hash value carried in the certificate block, and when the two hash values completely match, the certificate block passes the hash verification; The hash value of the previous block and the hash value of the corresponding block in the local block chain are verified to be consistent, and the timestamp is verified to be later than the timestamp of the previous block and earlier than the current system time; When the certificate block passes the hash verification, the block link verification and the timing verification, each node marks the certificate block as a verified state.

4. The blockchain-based digital certificate lifecycle management method of claim 3, wherein: The method for obtaining the certificate block is, The certificate issuing node receives the evaluation record block, parses the evaluation result of the evaluation record block, and when the evaluation result is a passed evaluation result, enters the certificate generation process; A certificate serial number generation module is called to generate a certificate serial number based on a timestamp and a random number seed, and to set a certificate validity period according to certificate use information; Based on the certificate status identifier that has been initialized to be in a valid state, the certificate serial number and the certificate validity period are packaged to form a digital certificate; A digital signature is added to the digital certificate, wherein the digital signature uses a private key of a certificate issuing authority to encrypt the content of the digital certificate; The digital certificate is associated with identity information of the certificate applicant to construct a certificate block header, wherein the certificate block header includes a block version number, a timestamp and a hash value of a previous block; The certificate block header, the digital certificate and the associated identity information form a certificate block.

5. The blockchain-based digital certificate lifecycle management method of claim 4, wherein: A certificate issuing application submitted by a certificate applicant is received, and written into a certificate application node of a block chain network, including: The certificate application node of the block chain network displays a certificate application interface, and the certificate applicant fills in identity information and selects a certificate application scenario; The identity information is format-verified, and the format-verified identity information and the certificate application scenario form a certificate issuing application; A hash value of the certificate issuing application is calculated, and the certificate issuing application and the corresponding hash value are added to a certificate application queue; The certificate issuing applications in the certificate application queue are packaged into a certificate application block in a timestamp order, and written into the block chain network.

6. The blockchain-based digital certificate lifecycle management method of claim 5, wherein: The format verification includes a format verification scheme A and a format verification scheme B; The format verification of the identity information includes: When the format verification scheme A is executed, if the identity information is of an enterprise type, a multi-dimensional cross verification mode is used, the unified social credit code is verified in real time by an enterprise credit information verification center, and three verification functions are added to the organization code, the enterprise registration number and the business license number; if an abnormal code appears, a degraded verification mode is used to perform two verification on the identity information by a backup verification center, and special character information is processed by combining manual review and system automatic filtering, and the code is evaluated for effectiveness; if the identity information is in an unstandardized format, the abnormal field is automatically corrected to prevent invalid code generation; When the format verification scheme B is executed, if the identity information is found to be abnormal, dynamic backtracking verification is adopted, multi-level verification of the identity information is performed by the intelligent identification engine, four verification functions are added for the organization code, enterprise registration number and business license number, and the intelligent identification engine positions the abnormality; if the abnormality is positioned, synchronous early warning feedback is performed, the administrator is notified to manually review the abnormal information, the verification process is increased with a verification node, the verification state information fed back by the intelligent identification engine is received, the abnormal information is classified and processed; if the abnormality is excluded, the corrected identity information is re-evaluated; if there is no format abnormality, the identity information and the certificate application scenario are combined to form a certificate issuance application, and the format verification process is completed. 7.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is characterized in that: The computer program is executed by the processor to implement the steps of the blockchain-based digital certificate life cycle management method of any one of claims 1-6.

8. A computer readable storage medium having stored thereon a computer program, characterized in that: The computer program is executed by the processor to implement the steps of the blockchain-based digital certificate life cycle management method of any one of claims 1-6.

Images