Blockchain Consensus Node Truststore Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In blockchain networks, particularly consortium blockchains, there is a need to securely manage communications between consensus nodes and client nodes to prevent client nodes from accessing consensus messages, ensuring data privacy and security.
Innovation Solution
The solution involves configuring root certificates issued by certificate authorities (CAs) for communications between consensus nodes and between consensus nodes and client nodes, using a process that includes generating certificate signing requests (CSRs), obtaining public key certificates, and creating truststores to isolate communications, ensuring that client nodes cannot access consensus messages between consensus nodes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single truststore is used for all communications in the blockchain network, then communication simplicity is improved, but security and data privacy are worsened because client nodes can access consensus messages
Solution Approach 1:
The patent divides the single truststore into separate truststores for different communication types. One truststore contains certificates for consensus node-to-consensus node communications, while another truststore contains certificates for consensus node-to-client node communications. This segmentation ensures that client nodes can only access certificates appropriate for their communication type, preventing unauthorized access to consensus messages while maintaining operational simplicity through automated truststore management.
2Object-affected harmful factors
If separate truststores are configured for different communication types, then security and data privacy are improved, but device complexity is worsened
Solution Approach 1:
The patent implements preliminary action by automatically generating and distributing the appropriate certificates to each node before communications begin. The certificate authority pre-configures truststores with the correct certificates for each communication type, so that when consensus nodes and client nodes establish connections, the appropriate certificates are already in place. This eliminates the need for manual truststore configuration and reduces complexity while maintaining security.
Solution Approach 2:
The system implements self-service through automated certificate management where each node automatically receives and configures the appropriate certificates from the certificate authority. Consensus nodes automatically obtain certificates for both consensus-to-consensus and consensus-to-client communications, while client nodes automatically receive certificates appropriate for their communication type. This automation eliminates manual configuration complexity while maintaining the security benefits of separate truststores.
3Adaptability or versatility
If client nodes have access to all public key certificates in the network, then communication versatility is improved, but data privacy is worsened because consensus messages become accessible
Solution Approach 1:
The patent applies local quality by providing different certificate sets to different nodes based on their specific communication needs. Client nodes receive certificates only for communications with consensus nodes, while consensus nodes receive certificates for both consensus-to-consensus and consensus-to-client communications. This localized certificate distribution maintains communication versatility for each node type while preventing client nodes from accessing consensus messages, as they lack the appropriate certificates.
Data Source
AI summary
Implementations of the present disclosure include generating, by a consensus node, a certificate signing request (CSR); sending the CSR to a first certificate authority (CA); receiving a first public key certificate of the consensus node from the first CA, and a first one or more public key certificates issued by a first one or more CAs. The consensus nodes also sends the CSR to a second CA, receives a second public key certificate of the consensus node from the second CA, and a second one or more public key certificates issued by a second one or more CAs. The consensus node further configures a first truststore including the first public key certificate and the first one or more public key certificates, and a second truststore including the second public key certificate and the second one or more public key certificates.