Blockchain-based decentralized public key management system

Abstract

A decentralized public key management system for named data networks based on blockchain, which solves the Compromised Certificate Authority (CA) Problem. The system divides the power of an individual CA among multiple Public Key Miners (PKMiners) that maintain the public key blockchains. The majority rule in name-principal validation allows the present invention to tolerate compromised PKMiners without causing any damage.

What is claimed is: 
     
         1 . A public-key management system for named data networks, comprising:
 a named data network comprising a plurality of namespaces, said named data network comprising a plurality of computer servers with one or more microprocessors, and one or more databases in electronic communication therewith; and   a public-key management system in electronic communication with said named data network, said public-key management system comprising a public-key blockchain for each namespace in said plurality of namespaces, wherein public-key blockchains are maintained by a plurality of validators that validate public keys and create blocks containing validated public keys for the blockchain;   wherein no public-key blockchain is associated with more than one namespace.   
     
     
         2 . The system of  claim 1 , wherein the plurality of validators do not include all miners of the blockchain. 
     
     
         3 . The system of  claim 1 , wherein additions, modifications or changes to the public-key blockchain for a given namespace requires consensus by a predetermined percentage of all validators. 
     
     
         4 . The system of  claim 1 , wherein additions, modifications or changes to the public-key blockchain for a given namespace requires consensus by a majority of all validators. 
     
     
         5 . The system of  claim 1 , wherein the system provides one or more programming interfaces to register a new name and public-key pair with a particular public-key blockchain for an associated namespace. 
     
     
         6 . The system of  claim 1 , wherein the system provides one or more programming interfaces to query for the latest valid public key corresponding to a given name for an associated namespace. 
     
     
         7 . The system of  claim 1 , wherein the system provides one or more programming interfaces to validate a given name and public-key pair for an associated namespace. 
     
     
         8 . The system of  claim 1 , wherein the system provides one or more programming interfaces to update a public-key for a registered name for an associated namespace. 
     
     
         9 . The system of  claim 1 , wherein the system provides one or more programming interfaces to validate a given name and public-key pair for an associated namespace. 
     
     
         10 . The system of  claim 1 , wherein updating the corresponding public key uses one or more programming interfaces to update the public-key for the registered name for the associated namespace. 
     
     
         11 . The system of  claim 1 , wherein adding the revoking record uses one or more programming interfaces to revoke the public-key for the registered name for the associated namespace. 
     
     
         12 . The system of  claim 1 , wherein each validator is a designated data miner for one or more public-key blockchains. 
     
     
         13 . The system of  claim 1 , wherein updating a corresponding public key for a registered namespace by a principal associated with that public key and a registered name is completed by appending the updated public key as a new block in the public-key blockchain after the plurality of validators validates the principal using channels specific to the registered namespace. 
     
     
         14 . The system of  claim 1 , wherein a revoking record is added to the public-key blockchain if the plurality of validators agree the public key should be revoked. 
     
     
         15 . The system of  claim 1 , wherein a power of a single Certificate Authority is distributed among the validators.