# US 11,113,421 B2 · Secure communications in a blockchain network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,113,421 B2 - Document ID: US11113421B2 - Status: Granted - Kind: B2 - Application number: 17/132,039 - Filed: 2020-12-23 - Published: 2021-04-15 - Granted: 2021-09-07 - Earliest claimed: 2017-07-26 - Assignees: Advanced New Technologies Co., Ltd. - Applicants: Advanced New Technologies Co., Ltd. - Inventors: Honglin Qiu - Web page: https://patentgrep.com/patent/US11113421B2 ## CPC - G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures - H04L 9/0637: {Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]} - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - H04L 9/3265: {using certificate chains, trees or paths; Hierarchical trust model} - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/166: {at the transport layer} - H04W 12/03: Protecting confidentiality, e.g. by encryption - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - G06Q 2220/00: Business processing using cryptography - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract A first certificate authority (CA) trust list comprising a plurality of CA identifiers is obtained by a first node of a blockchain network. A communication request comprising a public key certificate of the second node is received by the first node from a second node of the blockchain network. A first CA identifier is determined from the received public key certificate. A determination is made as to whether the first CA identifier matches one of the plurality of CA identifiers of the first CA trust list. In response to determining that the first CA identifier matches one of the plurality of CA identifiers of the first CA trust list, the communication request is approved by the first node. In response to determining that the first CA identifier does not match one of the plurality of CA identifiers of the first CA trust list, the communication request is denied. ## Claims ### Claim 1 A computer-implemented method for improving security of a blockchain network, comprising: obtaining, by a first node of the blockchain network, a first certificate authority (CA) trust list comprising a plurality of CA identifiers; receiving, by the first node from a second node of the blockchain network, a communication request comprising a public key certificate of the second node; determining, by the first node of the blockchain network, a first CA identifier from the received public key certificate of the second node of the blockchain network; determining, by the first node of the blockchain network, that the first CA identifier matches one of the plurality of CA identifiers of the first CA trust list; in response to determining that the first CA identifier matches one of the plurality of CA identifiers of the first CA trust list, approving, by the first node of the blockchain network, the communication request, comprising transmitting, by the first node of the blockchain network and to the second node of the blockchain network, a verification request for the second node to determine whether a second CA identifier corresponding to a public key certificate of the first node matches one of a plurality of CA identifiers included in a second CA trust list of the second node, wherein the verification request comprises the public key certificate of the first node; determining, by the second node, the second CA identifier from the received public key certificate of the first node; determining whether the second CA identifier matches one of the plurality of CA identifiers of the second CA trust list of the second node; in response to determining that the second CA identifier matches one of the plurality of CA identifiers of the second CA trust list, establishing a communication session with the first node; and in response to determining that the second CA identifier does not match one of the plurality of CA identifiers of the second CA trust list, denying, by the second node, establishment of the communication session with the first node. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the first node is a consensus node configured to perform consensus verification. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the blockchain network is a consortium blockchain network. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein obtaining, by a first node of the blockchain network, the first CA trust list comprising the plurality of CA identifiers comprises one of: pre-configuring the first node with the first CA trust list; or receiving, from a CA associated with the first node, the first CA trust list. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the first CA identifier of the public key certificate of the second node is different from the second CA identifier of the public key certificate of the first node. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein receiving, by the first node from the second node of the blockchain network, the communication request comprising the public key certificate of the second node comprises: receiving, by the first node from the second node, the communication request in accordance with a transport layer security (TLS) handshake protocol. ### Claim 7 A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising: obtaining, by a first node of a blockchain network, a first certificate authority (CA) trust list comprising a plurality of CA identifiers; receiving, by the first node from a second node of the blockchain network, a communication request comprising a public key certificate of the second node; determining, by the first node of the blockchain network, a first CA identifier from the received public key certificate of the second node of the blockchain network; determining, by the first node of the blockchain network, that the first CA identifier matches one of the plurality of CA identifiers of the first CA trust list; in response to determining that the first CA identifier matches one of the plurality of CA identifiers of the first CA trust list, approving, by the first node of the blockchain network, the communication request, comprising transmitting, by the first node of the blockchain network and to the second node of the blockchain network, a verification request for the second node to determine whether a second CA identifier corresponding to a public key certificate of the first node matches one of a plurality of CA identifiers included in a second CA trust list of the second node, wherein the verification request comprises the public key certificate of the first node; determining, by the second node, the second CA identifier from the received public key certificate of the first node; determining whether the second CA identifier matches one of the plurality of CA identifiers of the second CA trust list of the second node; in response to determining that the second CA identifier matches one of the plurality of CA identifiers of the second CA trust list, establishing a communication session with the first node; and in response to determining that the second CA identifier does not match one of the plurality of CA identifiers of the second CA trust list, denying, by the second node, establishment of the communication session with the first node. ### Claim 8 (depends on 7) The non-transitory, computer-readable medium of claim 7, wherein the first node is a consensus node configured to perform consensus verification. ### Claim 9 (depends on 7) The non-transitory, computer-readable medium of claim 7, wherein the blockchain network is a consortium blockchain network. ### Claim 10 (depends on 7) The non-transitory, computer-readable medium of claim 7, wherein obtaining, by a first node of the blockchain network, the first CA trust list comprising the plurality of CA identifiers comprises one of: pre-configuring the first node with the first CA trust list; or receiving, from a CA associated with the first node, the first CA trust list. ### Claim 11 (depends on 7) The non-transitory, computer-readable medium of claim 7, wherein the first CA identifier of the public key certificate of the second node is different from the second CA identifier of the public key certificate of the first node. ### Claim 12 (depends on 7) The non-transitory, computer-readable medium of claim 7, wherein receiving, by the first node from the second node of the blockchain network, the communication request comprising the public key certificate of the second node comprises: receiving, by the first node from the second node, the communication request in accordance with a transport layer security (TLS) handshake protocol. ### Claim 13 A computer-implemented system, comprising: one or more computers; and one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising: obtaining, by a first node of a blockchain network, a first certificate authority (CA) trust list comprising a plurality of CA identifiers; receiving, by the first node from a second node of the blockchain network, a communication request comprising a public key certificate of the second node; determining, by the first node of the blockchain network, a first CA identifier from the received public key certificate of the second node of the blockchain network; determining, by the first node of the blockchain network, that the first CA identifier matches one of the plurality of CA identifiers of the first CA trust list; in response to determining that the first CA identifier matches one of the plurality of CA identifiers of the first CA trust list, approving, by the first node of the blockchain network, the communication request, comprising transmitting, by the first node of the blockchain network and to the second node of the blockchain network, a verification request for the second node to determine whether a second CA identifier corresponding to a public key certificate of the first node matches one of a plurality of CA identifiers included in a second CA trust list of the second node, wherein the verification request comprises the public key certificate of the first node; determining, by the second node, the second CA identifier from the received public key certificate of the first node; determining whether the second CA identifier matches one of the plurality of CA identifiers of the second CA trust list of the second node; in response to determining that the second CA identifier matches one of the plurality of CA identifiers of the second CA trust list, establishing a communication session with the first node; and in response to determining that the second CA identifier does not match one of the plurality of CA identifiers of the second CA trust list, denying, by the second node, establishment of the communication session with the first node. ### Claim 14 (depends on 13) The computer-implemented system of claim 13, wherein the first node is a consensus node configured to perform consensus verification. ### Claim 15 (depends on 13) The computer-implemented system of claim 13, wherein the blockchain network is a consortium blockchain network. ### Claim 16 (depends on 13) The computer-implemented system of claim 13, wherein obtaining, by a first node of the blockchain network, the first CA trust list comprising the plurality of CA identifiers comprises one of: pre-configuring the first node with the first CA trust list; or receiving, from a CA associated with the first node, the first CA trust list. ### Claim 17 (depends on 13) The computer-implemented system of claim 13, wherein the first CA identifier of the public key certificate of the second node is different from the second CA identifier of the public key certificate of the first node.