# US 12,225,139 B2 · Method for issuing identity certificate to blockchain node and related apparatus > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,225,139 B2 - Document ID: US12225139B2 - Status: Granted - Kind: B2 - Application number: 18/442,942 - Filed: 2024-02-15 - Published: 2024-06-13 - Granted: 2025-02-11 - Earliest claimed: 2019-03-07 - Assignees: Tencent Technology (Shenzhen) Company Limited - Applicants: Tencent Technology (Shenzhen) Company Limited - Inventors: Mao Cai Li; Zong You Wang; Kai Ban Zhou; Chang Qing Yang; Hu Lan; Li Kong; Jin Song Zhang; Yi Fang Shi; Geng Liang Zhu; Qu Cheng Liu; Qiu Ping Chen - Web page: https://patentgrep.com/patent/US12225139B2 ## CPC - H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures - G06Q 40/00: Finance; Insurance; Tax strategies; Processing of corporate or income taxes - H04L 9/321: {involving a third party or a trusted authority} - H04L 9/3236: {using cryptographic hash functions} - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract A method and device for issuing an identity certificate to a blockchain node in a blockchain network includes issuing a first identity certificate to a first terminal. a second identity certificate issuance request that is from the first terminal and that is made by using the first identity certificate is received and a second identity certificate is issued to the first terminal, which forwards the second identity certificate to a second terminal. A third identity certificate issuance request that is from the second terminal and that is made by using the second identity certificate is received and a third identity certificate is issued to the second terminal, which forwards the third identity certificate to a third terminal. ## Claims ### Claim 1 A method for issuing identity certificates, performed by a certificate authority system having multi-tier certificate authority nodes in a blockchain network, the method comprising: issuing a first identity certificate to a first terminal as a blockchain node of the blockchain network through a first-tier certificate authority node from the multi-tier certificate authority nodes; receiving a second identity certificate issuance request that is from the first terminal and that is made by using the first identity certificate; issuing a second identity certificate to the first terminal through a second-tier certificate authority node from the multi-tier certificate authority nodes, wherein the first terminal forwards the second identity certificate to a second terminal as a blockchain node of the blockchain network; receiving a third identity certificate issuance request that is from the second terminal and that is made by using the second identity certificate; and issuing a third identity certificate to the second terminal through a third-tier certificate authority node from the multi-tier certificate authority nodes, wherein the second terminal forwards the third identity certificate to a third terminal as a blockchain node of the blockchain network. ### Claim 2 (depends on 1) The method according to claim 1, wherein the second identity certificate issuance request is generated in response to a registration request transmitted by the second terminal to the first terminal; and wherein the third identity certificate issuance request is generated in response to a registration request transmitted by the third terminal to the second terminal having the second identity certificate. ### Claim 3 (depends on 1) The method according to claim 1, wherein the method further comprises: generating a root certificate authority node; generating a root certificate through the root certificate authority node; and generating the first-tier certificate authority node, the second-tier certificate authority node, and the third-tier certificate authority node based on the root certificate. ### Claim 4 (depends on 1) The method according to claim 1, wherein the third-tier certificate authority node comprises a certificate authority node of a service node, a certificate authority node of a non-service node, and a personal certificate authority node, wherein the third terminal comprises a service node unit terminal, a non-service node unit terminal, and a personal terminal. ### Claim 5 (depends on 4) The method according to claim 4, further comprising: issuing a proxy node initiation identity certificate to a proxy node through the first-tier certificate authority node. ### Claim 6 (depends on 1) The method according to claim 1, wherein after the issuing the first identity certificate, the method further comprises: receiving a third identity certificate issuance request that is from the first terminal and that is made by using the first identity certificate, the third identity certificate issuance request being generated in response to a registration request transmitted by the third terminal to the first terminal through the second terminal; and issuing a third identity certificate to the first terminal through the third-tier certificate authority node, so that the first terminal forwards the third identity certificate through the second terminal to the third terminal. ### Claim 7 (depends on 1) The method according to claim 1, wherein the issuing the first identity certificate through the first-tier certificate authority node further comprises: generating a public key and a private key of the first terminal by using the first-tier certificate authority node; and generating the first identity certificate for the first terminal, the first identity certificate comprising the public key of the first terminal. ### Claim 8 (depends on 7) The method according to claim 7, wherein the issuing the first identity certificate through the first-tier certificate authority node further comprises: transmitting the first identity certificate and the private key of the first terminal to the first terminal. ### Claim 9 (depends on 1) The method according to claim 1, wherein the issuing a second identity certificate to the first terminal through the second-tier certificate authority node further comprises: performing authentication on registration information by using the second-tier certificate authority node. ### Claim 10 (depends on 9) The method according to claim 9, wherein the issuing a second identity certificate to the first terminal through the second-tier certificate authority node further comprises: in response to the authentication succeeding, generating a public key and a private key of the second terminal for the second terminal; and generating the second identity certificate for the second terminal, the second identity certificate comprising the public key of the second terminal. ### Claim 11 (depends on 10) The method according to claim 10, wherein the issuing a second identity certificate to the first terminal through the second-tier certificate authority node further comprises: transmitting the second identity certificate and the private key of the second terminal to the first terminal, so that the first terminal forwards the second identity certificate and the private key of the second terminal to the second terminal. ### Claim 12 (depends on 11) The method according to claim 11, wherein the method further comprises: transmitting, by the second terminal, the second identity certificate to another blockchain node. ### Claim 13 (depends on 12) The method according to claim 12, wherein the method further comprises: signing, by the second terminal by using the private key of the second terminal, a signature to content to be transmitted to the another blockchain node; and transmitting, by the second terminal, the content and the signature to the another blockchain node together. ### Claim 14 (depends on 1) The method according to claim 1, wherein the issuing a third identity certificate to the second terminal through the third-tier certificate authority node further comprises: performing authentication on a registration information of a grassroots unit by using the third-tier certificate authority node. ### Claim 15 (depends on 14) The method according to claim 14, wherein the issuing a third identity certificate to the second terminal through the third-tier certificate authority node further comprises: in response to the authentication succeeding, generating a public key and a private key of the third terminal for the third terminal; and generating the third identity certificate for the third terminal, the third identity certificate comprising the public key of the third terminal. ### Claim 16 (depends on 15) The method according to claim 15, wherein the issuing a third identity certificate to the second terminal through the third-tier certificate authority node further comprises: transmitting the third identity certificate and the private key of the third terminal to the second terminal, so that the second terminal forwards the third identity certificate and the private key of the third terminal to the third terminal. ### Claim 17 (depends on 16) The method according to claim 16, wherein the method further comprises: transmitting, by the third terminal, the third identity certificate to another blockchain node. ### Claim 18 (depends on 17) The method according to claim 17, wherein the method further comprises: signing, by the third terminal using the private key of the third terminal, a signature to content to be transmitted to the another blockchain node; and transmitting, by the third terminal, the content and the signature to the another blockchain node together. ### Claim 19 A non-transitory computer readable medium with instructions contained thereon that, when executed by a processor, cause the processor to issue identity certificates to blockchain nodes in a blockchain network, wherein the blockchain nodes comprise a first terminal, a second terminal, a third terminal, and a certificate authority system having multi-tier certificate authority nodes; and wherein the processor is configured to execute the instructions to: issue a first identity certificate to the first terminal through a first-tier certificate authority node from the multi-tier certificate authority nodes; receive a second identity certificate issuance request that is from the first terminal and that is made by using the first identity certificate; issue a second identity certificate to the first terminal through a second-tier certificate authority node from the multi-tier certificate authority nodes, wherein the first terminal forwards the second identity certificate to the second terminal; receive a third identity certificate issuance request that is from the second terminal and that is made by using the second identity certificate; and issue a third identity certificate to the second terminal through a third-tier certificate authority node from the multi-tier certificate authority nodes, wherein the second terminal forwards the third identity certificate to the third terminal.