A blockchain-based distributed CA certificate management system

Abstract

The application relates to the technical field of digital certificate management, in particular to a distributed CA certificate management system based on a block chain, which comprises a certificate generation module, a block chain module, an authority control module, an intelligent contract module and an identity authentication module; the scheme realizes a CA mutual recognition mechanism between different block chain systems by constructing a public cross-trust list and a cross-chain trust structure, thereby effectively improving the interoperability of cross-chain operations and the uniformity of identity authentication; a state conversion system is introduced to dynamically manage the public cross-trust list, supports the flexible addition of new CA nodes and participants, and can adapt to a complex multi-chain heterogeneous environment; a hierarchical CA structure design is adopted to construct a complete certificate chain and form a traceable identity trust path, and in combination with the non-tamperable characteristics of the block chain technology and the automatic execution capability of the intelligent contract, the safety and reliability of the identity authentication process are ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of digital certificate management, and particularly relates to a distributed CA certificate management system based on a block chain. BACKGROUND

[0002] With the continuous expansion of the Internet and the wide application of distributed systems, the traditional CA (Certification Authority) system faces severe challenges in scalability, transparency and security. Especially in the multi-chain coexistence of block chains, the CA of different systems does not recognize each other, resulting in that the identity of a user on one chain cannot be identified by other chains, and the cross-chain operation lacks a unified identity authentication mechanism. In addition, the multi-level CA structure in the traditional PKI is complex, the trust chain verification cost is high, there is a lack of a unified trust model and an automatic verification mechanism suitable for cross-chain scenarios, at the same time, the operations such as issuance, update, revocation and recovery of certificates still rely on centralized institutions, the management efficiency is low, the state synchronization is lagging, and it is easy to cause certificate invalidation or misuse, which is difficult to meet the demand for efficient and reliable identity authentication in the current distributed environment. SUMMARY

[0003] In view of the above problems, in order to overcome the defects of the prior art, the present application provides a distributed CA certificate management system based on a block chain, which is used to solve the problem that the CA of different systems does not recognize each other, resulting in that the identity of a user on one chain cannot be identified by other chains, and the cross-chain operation lacks a unified identity authentication mechanism. The present application realizes the mutual recognition mechanism of CA between different block chain systems by constructing a public cross-trust list and a cross-chain trust structure, so that the digital identity of a user on one chain can be identified and verified by other chains, thereby effectively improving the interoperability of cross-chain operation and the uniformity of identity authentication. At the same time, the state conversion system is introduced to dynamically manage the public cross-trust list, support the flexible joining of new CA nodes and participants, have good expansibility and compatibility, and can adapt to complex multi-chain heterogeneous environment. In view of the problem that the multi-level CA structure in the traditional PKI is complex and the trust chain verification cost is high, the present application adopts a hierarchical CA structure design, constructs a complete certificate chain through the hierarchical relationship of root CA, intermediate CA and terminal CA, forms a traceable identity trust path, and realizes the automatic processing of certificate issuance, verification, update and revocation by combining the tamper-proof feature of block chain technology and the automatic execution ability of smart contract, thereby ensuring the security and reliability of the identity authentication process.

[0004] The present application provides a distributed CA certificate management system based on a block chain, which comprises a certificate generation module, a block chain module, an authority control module, a smart contract module and an identity authentication module.

[0005] The certificate generation module is a module responsible for the generation of CA certificates in the CA organization, receives user registration requests and generates global identifiers and CA certificates in standard format, and performs hash processing on the contents of the CA certificates and uploads them to the blockchain module;

[0006] The blockchain module constructs a blockchain network with each CA node and participant, the CA nodes including root CA, intermediate CA and terminal CA, and the nodes of the participants register for identity through the CA nodes;

[0007] The permission control module manages the operation permissions of different roles in the blockchain network, supports fine-grained access control, and forms a traceable operation log using the signature mechanism of the blockchain;

[0008] The smart contract module is an automatic logic program deployed on the blockchain, which constructs a public cross-trust list and performs operations such as issuing, updating, revoking and restoring user permissions;

[0009] The identity authentication module provides an external interface, allowing users to verify the status of their CA certificates through the smart contract module across chains.

[0010] Further, the blockchain network includes blockchain nodes, an intra-chain trust model and a cross-chain trust structure;

[0011] The construction of the blockchain node submits the identity information of the CA node and the participant to the certificate generation module, which automatically selects appropriate root CA and intermediate CA for auditing and issuing CA certificates, the CA certificates are verified through the PKI system and stored on the blockchain, and the CA node and the participant are taken as a node in the blockchain network;

[0012] The intra-chain trust model is constructed by constructing CA nodes in a hierarchical structure, with trust permissions being delegated from root CA to intermediate CA and then to terminal CA, each level of CA node holding a CA certificate issued by the upper level, forming a complete certificate chain, verifying the legitimacy of user identity using the certificate chain, and constructing a traceable identity trust path;

[0013] The cross-chain trust structure is constructed, the root CAs of each chain in the blockchain mutually authenticate each other, generate a cross-trust list, write it into the smart contract module in each chain, use a state transition system to establish a public cross-trust list, and dynamically store cross-chain authenticated CA certificates;

[0014] The public cross-trust list realizes cross-chain and cross-node joint verification, temporarily stores the verified cross-chain CA certificates, uses the least recently used strategy to manage the fixed length cache, marks the expired CA certificates and invalid CA certificates as to be deleted, and periodically cleans up and updates the public cross-trust list.

[0015] Further, the state transition system defines a five-tuple wherein, represents a cross-chain communication state, including unauthenticated, CA certificate verification in progress, CA certificate added to the public cross-trust list, access authorization in progress, access success, represents an initial unauthenticated state, represents a set of executable actions, including sending a request, verifying a CA certificate, adding a CA certificate to a cross-trust list, checking an access policy, authorizing access, denying access, revoking access, represents a guard condition that must be met before an action is executed, including a valid CA certificate signature, a root CA in the cross-trust list, not expired, and consistent with the access policy, is a state transition relationship, indicating how each action changes the state of the system.

[0016] Further, the smart contract module includes a cross-chain identity authentication contract, a signature verification contract, a cross-chain data transmission contract, an operation log recording contract, and a cross-chain contract list.

[0017] The certificate verification smart contract obtains the user's own CA certificate and user ID from the blockchain, verifies whether the root CA exists in the cross-trust list of the blockchain module, parses the user CA certificate and verifies the signature validity, obtains the verification result, stores the verification result in the public cross-trust list, and returns an authentication identifier if the verification is successful, allowing the user to initiate a cross-chain request.

[0018] The signature verification contract, the user initiates a cross-chain verification request to the target chain and attaches the signature to be verified in the request, the signature verification contract extracts the user CA certificate from the public cross-trust list, and uses the elliptic curve digital signature algorithm to verify the signature of the CA certificate, if the signature is invalid, the request is rejected, and if the signature is valid, the request is allowed.

[0019] The cross-chain data transmission contract obtains the public key of the receiving user from the public cross-trust list during the data transmission process of the CA certificate, encrypts the CA certificate data using the ECC algorithm, adds a SHA-256 hash value to ensure integrity, and writes the encrypted CA certificate data to the state database on the target chain.

[0020] The operation log recording contract records the requester's identity, request timestamp, request content summary, return result summary, and signature information, generates an operation log record, and sends it to the permission control module.

[0021] The cross-chain contract list performs inter-chain function calls and data interactions, obtains target chain interface information, constructs call parameters and calls the business contract on the target chain, returns the result after execution, and triggers the recording operation of the operation log recording smart contract.

[0022] The beneficial effects achieved by the application using the above scheme are as follows:

[0023] (1) In view of the problem that the CAs of different systems do not recognize each other, resulting in the identity of a user on one chain being unable to be identified by other chains, and the lack of a unified identity authentication mechanism for cross-chain operations, the scheme realizes the CA mutual recognition mechanism between different blockchain systems by constructing a public cross-trust list and a cross-chain trust structure, so that the digital identity of a user on one chain can be identified and verified by other chains, thereby effectively improving the interoperability of cross-chain operations and the uniformity of identity authentication; at the same time, the state conversion system is introduced to dynamically manage the public cross-trust list, supporting the flexible addition of new CA nodes and participants, and the system has good scalability and compatibility, and can adapt to complex multi-chain heterogeneous environments.

[0024] (2) In view of the problem of complex multi-level CA structure and high cost of trust chain verification in traditional PKI, the scheme adopts a hierarchical CA structure design, builds a complete certificate chain through the hierarchical relationship of root CA, intermediate CA and terminal CA, forms a traceable identity trust path, and combines the tamper-proof feature of blockchain technology and the automatic execution capability of smart contract, realizes the automatic processing of certificate issuance, verification, update and revocation, and significantly reduces the complexity and cost of trust chain verification; at the same time, based on the distributed ledger mechanism of blockchain, the key problems of trust rupture, identity island and extensive authority management faced by traditional PKI in cross-chain scenarios are solved, ensuring the security and reliability of the identity authentication process, enhancing the credibility and security of the entire system, and providing an efficient, secure and scalable technical solution for cross-chain identity authentication. BRIEF DESCRIPTION OF DRAWINGS

[0025] Figure 1 A schematic diagram of a distributed CA certificate management system based on blockchain is proposed for the application.

[0026] The accompanying drawings are used to provide a further understanding of the application, and constitute a part of the specification, together with the embodiments of the application, to explain the application, and do not constitute a limitation on the application. DETAILED DESCRIPTION

[0027] The technical solutions in the embodiments of the application will be described clearly and completely below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only a part of the embodiments of the application, rather than all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of the application.

[0028] Embodiment one, refer to Figure 1The application provides a distributed CA certificate management system based on a block chain, which comprises a certificate generation module, a block chain module, an authority control module, an intelligent contract module and an identity authentication module.

[0029] The certificate generation module is a module responsible for the generation of CA certificates in a CA institution, receives a user registration request and generates a global identifier and a CA certificate in a standard format, and performs hash processing on the content of the CA certificate and uploads it to the block chain module.

[0030] The block chain module constructs a block chain network by taking each CA node and participant as a node, wherein the CA nodes comprise a root CA, an intermediate CA and a terminal CA, and the nodes of the participants are registered through the CA nodes.

[0031] The authority control module manages the operation authority of different roles in the block chain network, supports fine-grained access control, and forms a traceable operation log by using the signature mechanism of the block chain.

[0032] The intelligent contract module is an automatic logic program deployed on the block chain, constructs a public cross-trust list, and performs the operations of issuing, updating, revoking and restoring the authority of a user.

[0033] The identity authentication module provides an external interface, so that a user can verify the CA certificate status of the user through the intelligent contract module.

[0034] In the embodiment, the certificate generation module is responsible for the generation of CA certificates, and specifically comprises the following steps:

[0035] Step S1: initializing global parameters and master keys, calling a key generation algorithm to generate a set of global public parameters and global master key pairs, including a public key and a private key; wherein the public parameters are used for subsequent CA certificate verification, and the master private key is securely stored by the CA node and used for CA certificate issuance;

[0036] Step S2: receiving a user registration request, when a user initiates an application for a CA certificate, receiving the user's registration request, wherein the request contains the user's identity information, and the identity information includes a username, an organization, a device ID, public key materials and authentication credentials;

[0037] Step S3: generating a globally unique identifier, generating a globally unique identifier based on a timestamp, a random number and a uniqueness policy, and binding it with the user identity information, which is used for subsequent CA certificate management and query;

[0038] Step S4: constructing and signing the CA certificate in a standard format, constructing the fields of user identity information, globally unique identifier, public key, validity period, issuer information into a CA certificate template according to the X.509 standard, and signing the CA certificate using the global master private key to generate a CA certificate in PEM standard format;

[0039] Step S5: calculating the certificate hash value, performing SHA-256 hash operation on the complete CA certificate content generated to generate a unique digest value as the fingerprint information of the CA certificate;

[0040] Step S6: uploading to the blockchain module, obtaining the metadata of the CA certificate, and submitting the metadata of the CA certificate and the corresponding hash value to the blockchain module, and completing the on-chain operation by the smart contract module, wherein the metadata includes the issuer, the validity period, the GUID, and the subject information.

[0041] In the third embodiment, the blockchain network includes a blockchain node, an intra-chain trust model, and a cross-chain trust structure based on the above-mentioned embodiments.

[0042] The construction of the blockchain node submits the identity information of the CA node and the participants to the certificate generation module, and the certificate generation module automatically selects a suitable root CA and intermediate CA to audit and issue a CA certificate, which is verified by the PKI system and stored on the blockchain, and the CA node and the participants are taken as a node in the blockchain network.

[0043] The intra-chain trust model is constructed by constructing the CA node in a hierarchical structure, and the trust authority is gradually delegated from the root CA to the intermediate CA and then to the terminal CA, each level of CA node holds a CA certificate issued by the upper level, forming a complete certificate chain, and the certificate chain is used to verify the legitimacy of the user identity, and a traceable identity trust path is constructed.

[0044] The cross-chain trust structure is constructed, the root CAs of each chain in the blockchain are mutually authenticated, a cross-trust list is generated, and the smart contract module in each chain is written, a public cross-trust list is established using a state transition system, and CA certificates authenticated across chains are dynamically stored.

[0045] The public cross-trust list realizes cross-chain and cross-node joint verification, temporarily stores the verified cross-chain CA certificates, uses the least recently used strategy to manage the fixed length cache, marks the expired CA certificates and invalid CA certificates as to be deleted, and periodically cleans up and updates the public cross-trust list.

[0046] By performing the operation, the CA mutual recognition between different systems is caused, the identity of the user on one chain cannot be recognized by other chains, and the cross-chain operation lacks a unified identity authentication mechanism. The scheme realizes the CA mutual recognition mechanism between different blockchain systems by constructing a public cross-trust list and a cross-chain trust structure, so that the digital identity of the user on one chain can be recognized and verified by other chains, thereby effectively improving the interoperability of cross-chain operation and the uniformity of identity authentication. At the same time, the state transition system is introduced to dynamically manage the public cross-trust list, support the flexible joining of new CA nodes and participants, and the system has good scalability and compatibility, which can adapt to complex multi-chain heterogeneous environment. The key problems of trust rupture, identity island and extensive permission management faced by traditional PKI in cross-chain scenarios are solved, which provides important support for building a trusted cross-chain identity authentication system.

[0047] Embodiment four, based on the above embodiment, the state transition system defines a five tuple , wherein represents the cross-chain communication state, including unauthenticated, CA certificate verification, CA certificate added to the public cross-trust list, access authorization, and access success represents the initial unauthenticated state, represents a set of executable actions, including sending a request, verifying a CA certificate, adding a CA certificate to a public cross-trust list, checking an access policy, authorizing access, rejecting access, and revoking access, represents the guard condition that needs to be met before the action is executed, including CA certificate signature valid, root CA in cross-trust list, not expired, and access policy, is a state transition relationship, indicating how each action changes the state of the system.

[0048] Embodiment five, based on the above embodiment, the permission control module manages the operation permissions of different roles in the blockchain network, according to the business needs and security management strategies of the user, divides the CA nodes and participants in the blockchain network into N roles with clear responsibilities, the roles include root CA administrator, sub-CA node, ordinary user, and audit agency, adopts a role-based access control mechanism, assigns different operation permission sets to each role, and realizes fine-grained permission management in combination with the smart contract module. The ordinary user only has certificate application and state query permissions, the sub-CA node can audit and submit certificate revocation requests, but needs to be confirmed by the superior root CA before taking effect, the audit node can access the complete operation log, but has no right to modify the data, the root CA has the highest permission, can configure system parameters, manage sub-CA node permissions and CA certificate issuance, update and revocation operations of sub-CA nodes, and the sub-CA node refers to the intermediate CA and terminal CA except the root CA node.

[0049] Embodiment six, which is based on the above-mentioned embodiments, the smart contract module includes a cross-chain identity authentication contract, a signature verification contract, a cross-chain data transmission contract, an operation log recording contract, and a cross-chain contract list;

[0050] The certificate verification smart contract obtains the user's own CA certificate and user ID from the blockchain, verifies whether the root CA exists in the cross-trust list of the blockchain module, parses the user CA certificate and verifies the signature validity, obtains the verification result, stores the verification result in the public cross-trust list, and returns the authentication identifier if the verification is successful, allowing the user to initiate a cross-chain request;

[0051] The signature verification contract, the user initiates a cross-chain verification request to the target chain and attaches the signature to be verified in the request, the signature verification contract extracts the user CA certificate from the public cross-trust list, and verifies the signature of the CA certificate using the elliptic curve digital signature algorithm, if the signature is invalid, the request is rejected, and if it is successful, the request is allowed;

[0052] The cross-chain data transmission contract obtains the public key of the receiving user from the public cross-trust list during the data transmission process of the CA certificate, encrypts the data of the CA certificate using the ECC algorithm, adds a SHA-256 hash value to ensure integrity, and writes the encrypted data of the CA certificate into the state database on the target chain;

[0053] The operation log recording contract records the requester's identity, request timestamp, request content summary, return result summary, and signature information, generates an operation log record, and sends it to the permission control module;

[0054] The cross-chain contract list performs inter-chain function calls and data interactions, obtains target chain interface information, constructs call parameters and calls business contracts on the target chain, returns the result after execution, and triggers the recording operation of the operation log recording smart contract;

[0055] By performing the operation, in view of the problems of complex multi-level CA structure and high trust chain verification cost in traditional PKI, the present scheme adopts a hierarchical CA structure design, constructs a complete certificate chain through the hierarchical relationship of root CA, intermediate CA and terminal CA, forms a traceable identity trust path, combines the tamper-proof characteristics of blockchain technology and the automatic execution capability of smart contract, realizes the automatic processing of certificate issuance, verification, update and revocation, and significantly reduces the complexity and cost of trust chain verification; At the same time, based on the distributed ledger mechanism of the blockchain, the key problems of trust rupture, identity island and extensive permission management faced by traditional PKI in cross-chain scenarios are solved, the security and reliability of the identity authentication process are ensured, the credibility and security of the entire system are enhanced, and an efficient, safe and scalable technical solution for cross-chain identity authentication is provided.

[0056] It is to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting; it is not intended to exclude myriad other embodiments of the present application that other presenters can develop. That is, although the present application has been described in language specific to structural features, methodological acts, and computer code indicated in the figures and the specification, the present application is clearly not limited to the features, acts, and code illustrated or described. Rather, the scope of the present application is to be understood only as set forth in the accompanying claims. Moreover, the use of the terms first, second, etc. do not denote any order or importance, but rather the terms first, second, etc. are used to distinguish one element from another. Furthermore, the use of the terms a, an, etc. do not denote a limitation on the number of entities, but rather the terms a, an, etc. are used to refer to at least one.

[0057] While the embodiments of the application have been shown and described, it is to be understood that the application is not limited to the details of the embodiments described, since the scope of the expenditure is defined with respect to the appended claims.

[0058] The above description of the present application and its embodiments is not restrictive, and the embodiments shown in the drawings are only one of the embodiments of the present application, and the actual structure is not limited thereto. In general, if a person skilled in the art is inspired by it, without departing from the spirit and principles of the present application, similar structural modes and embodiments can be designed without creative design, which should belong to the protection scope of the present application.

Claims

1. A blockchain-based distributed CA certificate management system, characterized in that: The system comprises a certificate generation module, a blockchain module, an authority control module, an intelligent contract module and an identity authentication module; The certificate generation module is a module responsible for the generation of CA certificates in the CA organization, receives user registration requests and generates global identifiers and CA certificates in standard format, and performs hash processing on the contents of the CA certificates and uploads them to the blockchain module; The blockchain module constructs a blockchain network with each CA node and participant as a node, the CA nodes including root CA, intermediate CA and terminal CA, and the nodes of the participants registering their identities through the CA nodes; The authority control module manages the operation permissions of different roles in the blockchain network, supports fine-grained access control, and forms a traceable operation log by using the signature mechanism of the blockchain; The intelligent contract module is an automatic logic program deployed on the blockchain, which constructs a public cross-trust list and performs operations of issuing, updating, revoking and restoring the permissions of users; The identity authentication module provides an external interface, allowing users to verify the status of their CA certificates through the intelligent contract module across chains; The blockchain network comprises blockchain nodes, an intra-chain trust model and a cross-chain trust structure; The blockchain nodes submit the identity information of the CA nodes and participants to the certificate generation module, which automatically selects root CA and intermediate CA for auditing and issuing CA certificates, which are verified through the PKI system and stored on the blockchain, and the CA nodes and participants are taken as nodes in the blockchain network; The intra-chain trust model constructs a hierarchical structure of CA nodes, with trust permissions being delegated from root CA to intermediate CA and then to terminal CA, each level of CA node holding a CA certificate issued by the upper level, forming a complete certificate chain, verifying the legitimacy of user identity using the certificate chain, and constructing a traceable identity trust path; The cross-chain trust structure constructs, the root CAs of each chain in the blockchain authenticate each other, generate a cross-trust list, write it into the intelligent contract module in each chain, use a state transition system to establish a public cross-trust list, and dynamically store the cross-chain authenticated CA certificates; The public cross-trust list realizes joint verification across chains and nodes, temporarily stores the verified cross-chain CA certificates, uses the least recently used strategy to manage the fixed-length cache, marks the expired CA certificates and invalid CA certificates as to be deleted, and periodically cleans up and updates the public cross-trust list.

2. The blockchain-based distributed CA certificate management system of claim 1, wherein: The intelligent contract module comprises a cross-chain identity authentication contract, a signature verification contract, a cross-chain data transmission contract, an operation log recording contract and a cross-chain contract list; The certificate verification intelligent contract obtains the user's own CA certificate and user ID from the blockchain, verifies whether the root CA exists in the cross-trust list of the blockchain module, parses the user CA certificate and verifies the signature validity, obtains the verification result, stores the verification result in the public cross-trust list, and returns the authentication identifier if the verification is successful, allowing the user to initiate a cross-chain request. The signature verification contract initiates a cross-chain verification request to the target chain, and attaches the signature to be verified in the request. The signature verification contract extracts the user CA certificate from the public cross-trust list, and verifies the signature of the CA certificate using the elliptic curve digital signature algorithm. If the signature is invalid, the request is rejected. If successful, the request is allowed. The cross-chain data transmission contract obtains the public key of the receiving user from the public cross-trust list during the data transmission process of the CA certificate, encrypts the data of the CA certificate using the ECC algorithm, adds a SHA-256 hash value to ensure integrity, and writes the encrypted data of the CA certificate into the state database on the target chain. The operation log recording contract records the requester's identity, request timestamp, request content summary, return result summary, and signature information, generates an operation log record, and sends it to the permission control module. The cross-chain contract list performs inter-chain function calls and data interactions, obtains interface information from the target chain, constructs call parameters, calls business contracts on the target chain, returns the results after execution, and triggers the recording operation of the operation log recording smart contract.

Images