Digital certificate recovery method and apparatus

Abstract

Embodiments of the present application provide a digital certificate recovery method and device. The method comprises: determining a recovery operation being executed, wherein the recovery operation is used for recovering a certificate to be recovered; determining corresponding certificate state information of the recovery operation according to a corresponding relationship between the recovery operation and the certificate state information, wherein the certificate state information is used for indicating that the recovery operation is normally executed and completed; and saving the certificate state information when it is detected that the recovery operation is normally executed and completed, so as to monitor the digital certificate recovery by using the certificate state information. According to the embodiments of the present application, the certificate state recovery identifier is saved when the recovery operation is normally executed and completed, the execution of the recovery operation can be monitored, and thus whether the execution of the recovery operation is normal can be accurately identified.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of computer, and particularly relate to a digital certificate recovery method and device. BACKGROUND

[0002] With the development of the Internet, more and more network application systems are extended from private or internal networks to the Internet. Digital certificates have been widely used in online banking, online securities, e-government, e-commerce and other fields to ensure the confidentiality, authenticity, integrity and non-repudiation of information transmission. As the issuing management agency of digital certificates, digital certificate authentication systems have also been more and more widely used.

[0003] The digital certificate authentication system mainly includes a key management server (KM), an authentication server (CA), a registration audit server (RA) and other subsystems. The recovery operation of the digital certificate needs the cooperation and interaction of each subsystem in the digital certificate authentication system to be completed.

[0004] However, in the process of digital certificate recovery, unpredictable problems such as network anomalies, browser internal errors, user abnormal operations or device read-write anomalies may occur, which leads to abnormal interruption of the certificate recovery steps of the digital certificate, and at the same time, the step that causes the abnormality cannot be determined, so the correctness of the continued execution of the certificate recovery steps cannot be guaranteed, and thus the correctness of the recovered certificate cannot be guaranteed. SUMMARY

[0005] Therefore, embodiments of the present application provide a digital certificate recovery method and device to at least partially solve the above problems.

[0006] According to a first aspect of embodiments of the present application, a digital certificate recovery method is provided, comprising:

[0007] determining a recovery operation being executed, wherein the recovery operation is used to recover a to-be-recovered certificate;

[0008] determining corresponding certificate state information of the recovery operation according to a corresponding relationship between the recovery operation and the certificate state information, wherein the certificate state information is used to indicate that the recovery operation is normally executed and completed;

[0009] when detecting that the recovery operation is normally executed and completed, saving the certificate state information to monitor the digital certificate recovery by using the certificate state information.

[0010] In some embodiments, the certificate state information includes an unissued certificate identifier, an issued but not activated certificate identifier, an issued certificate identifier and an uninstalled certificate identifier.

[0011] The determining the corresponding certificate status information of the recovery operation according to the correspondence between the recovery operation and the certificate status information comprises:

[0012] If the recovery operation is that the registration and examination server generates a certificate recovery request according to a certificate serial number to be recovered, the certificate status information is determined as the un-issued identifier;

[0013] If the recovery operation is that the registration and examination server saves a post-recovery certificate, the certificate status information is determined as the un-installed identifier, wherein the post-recovery certificate is sent by an authentication server to the registration and examination server;

[0014] If the recovery operation is that the registration and examination server installs the post-recovery certificate, the certificate status information is determined as the issued but not activated identifier;

[0015] If the recovery operation is that the registration and examination server sends certificate recovery information to an authentication server, the certificate status information is determined as the issued identifier.

[0016] In some embodiments, the certificate status information further comprises a to-be-used identifier and a used identifier;

[0017] The determining the corresponding certificate status information of the recovery operation according to the correspondence between the recovery operation and the certificate status information comprises:

[0018] If the recovery operation is that an authentication server generates a post-recovery certificate according to received key information, the certificate status information is determined as the to-be-used identifier, wherein the key information is obtained by a key management server according to a certificate recovery request and sent to the authentication server;

[0019] If the recovery operation is that the authentication server generates key recovery information according to received certificate recovery information, the certificate status information is determined as the used identifier, wherein the certificate recovery information is sent by a registration and examination server.

[0020] In some embodiments, the certificate status information further comprises a to-be-recovered identifier and an already-recovered identifier;

[0021] The determining the corresponding certificate status information of the recovery operation according to the correspondence between the recovery operation and the certificate status information comprises:

[0022] If the recovery operation is that a key management server queries key information of a certificate to be recovered according to a certificate recovery request, the certificate status information is determined as the to-be-recovered identifier;

[0023] If the recovery operation is that the key management server receives key recovery information, the certificate state information is determined as the recovered, wherein the key recovery information is sent by an authentication server.

[0024] In some embodiments, the saving the certificate state information when detecting that the recovery operation is normally executed includes:

[0025] Detecting whether there is first certificate state information that does not match the recovery operation;

[0026] If there is, replacing the first certificate state information with the certificate state information, and saving the certificate state information.

[0027] In some embodiments, the method further includes:

[0028] When detecting abnormal execution, querying the certificate state information;

[0029] According to the correspondence between the certificate state information and the recovery operation, determining a target recovery operation that needs to be re-executed;

[0030] Sending a recovery execution instruction to a server that executes the target recovery operation, to instruct the server to re-execute the target recovery operation, wherein the server includes a registration audit server, an authentication server, and a key management server.

[0031] In some embodiments, the determining a target recovery operation that needs to be re-executed according to the correspondence between the certificate state information and the recovery operation includes:

[0032] If the certificate state information is not issued, determining that the target recovery operation is that the registration audit server generates a certificate recovery request according to a to-be-recovered certificate serial number;

[0033] If the certificate state information is an uninstalled identifier, determining that the target recovery operation is that the registration audit server saves a post-recovery certificate;

[0034] If the certificate state information is an issued but not activated identifier, determining that the target recovery operation is that the registration audit server saves a post-recovery certificate;

[0035] If the certificate state information is an issued identifier, determining that the target recovery operation is that certificate recovery information is sent to the authentication server.

[0036] In some embodiments, the determining a target recovery operation that occurs abnormally according to the correspondence between the certificate state information and the recovery operation includes:

[0037] If the certificate status information is the to-be-used identifier, it is determined that the target recovery operation is that the authentication server generates a post-recovery certificate according to the received key information;

[0038] If the certificate status information is the in-use identifier, it is determined that the target recovery operation is that the authentication server generates key recovery information according to the received certificate recovery information.

[0039] In some embodiments, the determining, according to the correspondence between the certificate status information and the recovery operation, of the target recovery operation that has an exception, includes:

[0040] If the certificate status information is the to-be-recovered identifier, it is determined that the target recovery operation is that the key management server queries key information of a to-be-recovered certificate.

[0041] According to a second aspect of the embodiments of the present application, a digital certificate recovery apparatus is provided, including:

[0042] A determining module is configured to determine a recovery operation being executed, wherein the recovery operation is used for recovering a to-be-recovered certificate.

[0043] A querying module is configured to determine, according to a correspondence between the recovery operation and certificate status information, corresponding certificate status information of the recovery operation, wherein the certificate status information is used for indicating that the recovery operation is executed normally.

[0044] A monitoring module is configured to save the certificate status information when it is detected that the recovery operation is executed normally, so as to monitor the digital certificate recovery by using the certificate status information.

[0045] According to a third aspect of the embodiments of the present application, an electronic device is provided, including a processor, a memory, a communication interface and a communication bus, the processor, the memory and the communication interface complete communication with each other through the communication bus; the memory is used for storing at least one executable instruction, and the executable instruction causes the processor to perform operations corresponding to the digital certificate recovery method according to the first aspect.

[0046] According to a fourth aspect of the embodiments of the present application, a computer storage medium is provided, and the computer storage medium stores a computer program, and the program is executed by a processor to implement the digital certificate recovery method according to the first aspect.

[0047] According to the digital certificate recovery method provided in the embodiment of the present application, firstly, the recovery operation being executed is determined, and further, the certificate state information corresponding to the recovery operation is determined according to the corresponding relationship between the recovery operation and the certificate state information. When the recovery operation is normally executed, the determined certificate state recovery information is saved, so as to monitor the digital certificate recovery by using the certificate state information. In the embodiment of the present application, the certificate state recovery identifier is saved when the recovery operation is normally executed, so as to monitor the execution of the recovery operation, thereby accurately identifying whether the execution of the recovery operation is normal, and further, identifying the recovery operation with abnormal execution by using the certificate state identifier. BRIEF DESCRIPTION OF DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments described in the present application, and other drawings can also be obtained by those skilled in the art according to these drawings.

[0049] Figure 1 The step flow chart of a digital certificate recovery method according to an embodiment of the present application;

[0050] Figure 2 The step flow chart of a digital certificate recovery method according to another embodiment of the present application;

[0051] Figure 3 The structural block diagram of a digital certificate recovery device according to an embodiment of the present application;

[0052] Figure 4 The structural schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0053] In order to make the technical solutions in the embodiments of the present application better understood by those skilled in the art, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art should belong to the scope of protection of the present application.

[0054] The specific implementation of the embodiments of the present application will be further described below with reference to the drawings of the embodiments of the present application.

[0055] The embodiment of the present application provides a digital certificate recovery method, which is applied to a digital authentication system, the digital authentication system comprises a registration audit server RA, an authentication server CA and a key management server KM, and the specific steps are as shown in the figure, comprising: Figure 1

[0056] S101, determining the recovery operation being executed.

[0057] In the embodiment of the present application, when the digital certificate authentication system recovers the certificate to be recovered in response to a certificate recovery request, the digital certificate authentication system acquires the recovery operation being executed, and then determines the recovery operation being executed. Specifically, the recovery operation of the embodiment of the present application is used to recover the certificate to be recovered, and the recovery operation is specifically executed by the registration audit server RA, the authentication server CA and the key management server KM.

[0058] S102, determining the corresponding certificate state information of the recovery operation according to the correspondence between the recovery operation and the certificate state information.

[0059] In the embodiment of the present application, the certificate state information can be pre-stored in the digital certificate authentication system, and the certificate state information has a corresponding relationship with the recovery operation. After the recovery operation is determined, the corresponding certificate state information of the recovery operation determined in S01 is determined according to the corresponding relationship between the recovery operation and the certificate state information. Specifically, the certificate state information in the embodiment of the present application is used to indicate that the recovery operation is normally executed and completed.

[0060] S103, saving the certificate state information when it is detected that the recovery operation is normally executed and completed, so as to monitor the digital certificate recovery by using the certificate state information.

[0061] In the embodiment of the present application, the digital certificate authentication system detects the execution process of the recovery operation, so as to detect whether the recovery operation is normally executed. When it is detected that the recovery operation is normally executed and completed, the certificate state information corresponding to the recovery operation normally executed and completed is saved, so as to monitor the digital certificate recovery by using the certificate state information.

[0062] The digital certificate recovery method provided by the embodiment of the present application first determines the recovery operation being executed, further determines the certificate state information corresponding to the recovery operation according to the correspondence between the recovery operation and the certificate state information, saves the determined certificate state recovery information when the recovery operation is normally executed and completed, and monitors the digital certificate recovery by using the certificate state information. In the embodiment of the present application, the certificate state recovery identifier is saved when the recovery operation is normally executed and completed, so as to monitor the execution of the recovery operation, thereby accurately identifying whether the execution of the recovery operation is normal, and further identifying the recovery operation with abnormal execution by using the certificate state identifier.​

[0063] In one example, the digital certificate of the embodiments of the present application is a digital double certificate, including an encryption certificate and a signature certificate.

[0064] In one example, the recovery operation of the embodiments of the present application can include the following steps:

[0065] The registration audit server RA queries the certificate status according to the serial number of the encryption certificate to be recovered submitted by the user;

[0066] The registration audit server RA generates a certificate recovery request according to the serial number of the encryption certificate to be recovered, and sends the certificate recovery request to the authentication server CA;

[0067] The authentication server CA parses the certificate recovery request of the registration audit server RA, queries the corresponding key identifier according to the serial number of the encryption certificate to be recovered, generates a key pair recovery request according to the key identifier, and sends the key pair recovery request to the key management server KM;

[0068] The key management server KM parses the key pair recovery request of the authentication server CA, obtains the key identifier, queries the key corresponding to the certificate to be recovered according to the key identifier, and sends the key to the authentication server CA;

[0069] The authentication server CA parses the key, generates a recovered certificate and saves it, and sends the recovered certificate to the registration audit server RA.

[0070] The registration audit server RA parses the recovered certificate and saves the double certificate information;

[0071] The registration audit server RA installs the recovered certificate to the client;

[0072] The registration audit server RA generates certificate status recovery information, and sends the certificate status recovery information to the authentication server through the message queue, and the structure of the certificate recovery information is as follows:

[0073]

[0074]

[0075] The authentication server CA subscribes to the messages of the registration audit server RA by subscribing to the Topic of the message queue, filters out the information with Tags as RecoverConfirm, receives the certificate recovery information, obtains the key identifier of the recovered certificate, generates key recovery information according to the key identifier, and sends the key recovery information through the message queue, wherein the structure of the key recovery information is as follows:

[0076]

[0077] The key management server KM receives the key recovery information by subscribing to the message queue of the topic CA and screening the information with the tag RecoverConfirm, to obtain the key identifier.

[0078] Further, the certificate state identifier of the embodiment of the application can include an unissued identifier, an issued but not activated identifier, an issued identifier, and an uninstalled identifier. According to the corresponding relationship between the recovery operation and the certificate state information, the corresponding certificate state information of the recovery operation is determined, including:

[0079] If the recovery operation is that the registration audit server generates a certificate recovery request according to the serial number of the certificate to be recovered, the certificate state information is determined as the unissued identifier. Specifically, when the recovery operation is that the registration audit server RA generates a certificate recovery request according to the serial number of the encrypted certificate to be recovered, and sends the certificate recovery request to the authentication server CA, the certificate state information is the unissued identifier.

[0080] If the recovery operation is that the registration audit server saves the post-recovery certificate, the certificate state information is determined as the uninstalled identifier, wherein the post-recovery certificate is sent by the authentication server to the registration audit server. Specifically, when the recovery operation is that the registration audit server RA parses the post-recovery certificate and saves the double certificate information, the certificate state information is determined as the uninstalled identifier.

[0081] If the recovery operation is that the registration audit server RA installs the post-recovery certificate, the certificate state information is determined as the issued but not activated identifier. When the recovery operation is that the registration audit server RA installs the post-recovery certificate to the client, the certificate state information is determined as the issued but not activated identifier.

[0082] If the recovery operation is that the registration audit server RA sends the certificate recovery information to the authentication server, the certificate state information is determined as the issued identifier. Specifically, when the recovery operation is that the registration audit server RA generates the certificate state recovery information, and the message queue sends the certificate state recovery information to the authentication server, the certificate state information is determined as the issued identifier.

[0083] Further, the certificate state information of the embodiment of the application further includes a to-be-used identifier and a used identifier. According to the corresponding relationship between the recovery operation and the certificate state information, the corresponding certificate state information of the recovery operation is determined, including:

[0084] If the recovery operation is that the authentication server generates a post-recovery certificate according to received key information, the certificate state information is determined as a to-be-used identifier. The key information is obtained by the key management server according to a certificate recovery request and sent to the authentication server. Specifically, when the recovery operation is that the authentication server CA parses a key, generates a post-recovery certificate and saves it, and sends the post-recovery certificate to the registration audit server RA, the certificate state information is the to-be-used identifier.

[0085] If the recovery operation is that the authentication server generates key recovery information according to received certificate recovery information, the certificate state information is determined as an in-use identifier, where the certificate recovery information is sent by the registration audit server. When the recovery operation is that the authentication server CA subscribes to the message queue of the Topic registration audit server RA, filters information with the Tag RecoverConfirm, receives the certificate recovery information, obtains the key identifier of the post-recovery certificate, generates the key recovery information according to the key identifier, and sends the key recovery information through the message queue, the certificate state information is determined as the in-use identifier.

[0086] Further, the certificate state information further includes a to-be-recovered identifier and a recovered identifier, and the certificate state information corresponding to the recovery operation is determined according to the correspondence between the recovery operation and the certificate state information, including:

[0087] If the recovery operation is that the key management server KM queries key information of a to-be-recovered certificate according to a certificate recovery request, the certificate state information is determined as the to-be-recovered identifier. When the recovery operation is that the key management server KM parses a key pair recovery request of the authentication server CA, obtains a key identifier, queries a key corresponding to the to-be-recovered certificate according to the key identifier, and sends the key to the authentication server CA, the certificate state information is determined as the to-be-recovered identifier.

[0088] If the recovery operation is that the key management server receives key recovery information, the certificate state information is determined as recovered, where the key recovery information is sent by the authentication server. When the recovery operation is that the key management server KM subscribes to the message queue of the Topic CA, filters information with the Tag RecoverConfirm, receives the key recovery information, and obtains the key identifier, the certificate state information is determined as the recovered information.

[0089] Further, the embodiments of the present application can further include certificate revocation information, which can include a to-be-revoked identifier and a revoked identifier. When the recovery operation is that the authentication server generates a post-recovery certificate according to received key information and determines the certificate state information as a to-be-used identifier, the certificate revocation information indicating the state of the to-be-recovered certificate can be added. Specifically, the to-be-revoked identifier can be added to the to-be-recovered certificate.

[0090] When the recovery operation is to install the recovered certificate by the registration audit server RA, and the certificate status information is determined as the issued but not activated identifier, the to-be-recovered certificate can also be added with the to-be-cancelled identifier.

[0091] When the recovery operation is to send the certificate recovery information to the authentication server by the registration audit server RA, and the certificate status information is determined as the issued identifier, the to-be-recovered certificate can also be added with the cancelled identifier.

[0092] The certificate status identifier can be used to monitor the execution of the recovery operation, and the recovery operation that is abnormal can be determined according to the certificate status identifier, so that the position of the breakpoint in the certificate recovery process can be accurately determined.

[0093] Further, as shown in FIG. 1, Figure 2 Specifically, the registration audit server RA generates a certificate recovery request according to the serial number of the to-be-recovered certificate, and determines the certificate status information as the not issued identifier. The authentication server CA parses the certificate recovery request of the registration audit server RA, queries the corresponding key identifier according to the serial number of the to-be-recovered encrypted certificate, generates a key pair recovery request according to the key identifier, and sends the key pair recovery request to the key management server KM. The key management server KM queries the key information of the to-be-recovered certificate according to the certificate recovery request, and determines the certificate status information as the to-be-recovered identifier. The authentication server CA generates a recovered certificate according to the received key information, determines the certificate status information as the to-be-used identifier, and adds the to-be-recovered certificate with the to-be-cancelled identifier. The registration audit server saves the recovered certificate, determines the certificate status information as the not installed identifier, installs the recovered certificate, determines the certificate status information as the issued but not activated identifier, and adds the to-be-recovered certificate with the to-be-cancelled identifier. The registration audit server RA sends the certificate recovery information to the authentication server, determines the certificate status information as the issued identifier, the authentication server CA generates key recovery information according to the received certificate recovery information, determines the certificate status information as the in use identifier, and the key management server KM receives the key recovery information and determines the certificate status information as the recovered.

[0094] Further, the certificate status information is saved when the recovery operation is detected to be normally executed, including:

[0095] S1031, detecting whether there is first certificate status information that does not match the recovery operation.

[0096] In the embodiment of the present application, when the recovery operation is detected to be normally executed, the certificate status information is detected to determine whether there is first certificate status information that does not match the recovery operation.

[0097] S1032, if exists, replacing the first certificate status information with the certificate status information, and saving the certificate status information.

[0098] In the embodiment of the present application, when the digital certificate authentication system detects that there is the first status certificate information which does not match the recovery operation, the digital certificate authentication system replaces the first certificate status information with the certificate recovery information to update the certificate status information, and saves the certificate status information.

[0099] Further, the embodiment of the present application can further include the following steps:

[0100] S104, querying the certificate status information when detecting the abnormal execution.

[0101] In the embodiment of the present application, when the digital certificate authentication system detects that the recovery operation is abnormally executed, the digital certificate authentication system detects the certificate status information which has been saved.

[0102] S105, determining the target recovery operation which needs to be re-executed according to the correspondence between the certificate status information and the recovery operation.

[0103] In the embodiment of the present application, the digital certificate authentication system determines the target recovery operation which needs to be re-executed according to the correspondence between the certificate status information and the recovery operation. Specifically, if the certificate status information is not yet certified, it is determined that the target recovery operation is that the registration and audit server generates a certificate recovery request according to the certificate serial number to be recovered; if the certificate status information is not installed, it is determined that the target recovery operation is that the registration and audit server saves the post-recovery certificate; if the certificate status information is certified but not activated, it is determined that the target recovery operation is that the registration and audit server saves the post-recovery certificate; if the certificate status information is certified, it is determined that the target recovery operation is that the authentication server sends the certificate recovery information; if the certificate status information is to be used, it is determined that the target recovery operation is that the authentication server generates the post-recovery certificate according to the received key information; if the certificate status information is in use, it is determined that the target recovery operation is that the authentication server generates the key recovery information according to the received certificate recovery information; and if the certificate status information is to be recovered, it is determined that the target recovery operation is that the key management server queries the key information of the certificate to be recovered.

[0104] S106, sending a recovery execution instruction to the server which executes the target recovery operation to instruct the recovery module to re-execute the target recovery operation.

[0105] In the embodiment of the present application, after the digital certificate authentication system determines the target recovery operation which needs to be re-executed, the digital certificate authentication system sends a recovery execution instruction to the server which executes the target recovery operation to instruct the recovery module to re-execute the target recovery operation.

[0106] The certificate state identifier is used to accurately determine the target recovery operation that needs to be re-executed by using the saved certificate state information when abnormal execution occurs, and then the position of the breakpoint is accurately determined, and the recovery operation is re-executed at the position of the breakpoint, so that the correctness of the certificate recovery operation is ensured.

[0107] Further, the embodiment of the application provides a digital certificate recovery device, and specifically Figure 3 as shown in the figure, comprising:

[0108] The determining module 301 is configured to determine a recovery operation being executed, wherein the recovery operation is used for recovering a certificate to be recovered.

[0109] The querying module 302 is configured to determine corresponding certificate state information of the recovery operation according to a corresponding relationship between the recovery operation and the certificate state information, wherein the certificate state information is used to indicate that the recovery operation is normally executed and completed.

[0110] The monitoring module 303 is configured to save the certificate state information when it is detected that the recovery operation is normally executed and completed, so as to monitor the digital certificate recovery by using the certificate state information.

[0111] The digital certificate recovery device of the embodiment is used to implement the corresponding digital certificate recovery method in the foregoing method embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be described herein again. In addition, the functions of each module in the deadlock processing device of the embodiment can be implemented by referring to the description of the corresponding part in the foregoing method embodiments, which will not be described herein again.

[0112] Referring to Figure 4 , a structural schematic diagram of an electronic device according to an embodiment of the application is shown, and the specific implementation of the electronic device is not limited in the embodiment of the application.

[0113] As Figure 4 shown, the electronic device can include a processor 402, a communications interface 404, a memory 406, and a communications bus 408.

[0114] Among them:

[0115] The processor 402, the communications interface 404, and the memory 406 complete the communication among each other through the communications bus 408.

[0116] The communications interface 404 is configured to communicate with other electronic devices or servers.

[0117] The processor 402 is configured to execute the program 410, and particularly configured to execute the steps of the above digital certificate recovery method embodiments.

[0118] Specifically, the program 410 can include program codes including computer operation instructions.

[0119] The processor 402 can be a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application. The one or more processors included in the smart device can be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0120] The memory 406 is configured to store the program 410. The memory 406 can include a high-speed RAM memory, and can further include a non-volatile memory such as at least one disk memory.

[0121] The program 410 is particularly configured to cause the processor 402 to perform the following operations:

[0122] In an alternative embodiment, the program 410 is further configured to cause the processor 402 to perform the steps of the program 510. The specific implementation of the steps of the program 510 can refer to the corresponding descriptions of the steps and units in the above digital certificate recovery method embodiments, and will not be described herein. Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices and modules can refer to the corresponding process descriptions in the above method embodiments, and will not be described herein.

[0123] It should be noted that, according to the needs of implementation, each component / step described in the embodiments of the present application can be split into more components / steps, or two or more components / steps or part of the operations of the components / steps can be combined into a new component / step, to achieve the purpose of the embodiments of the present application.

[0124] The methods according to the embodiments of the present application described above can be implemented in hardware, firmware, or software, or a combination thereof, and can be stored in a recording medium such as a CD ROM, RAM, floppy disk, hard disk, or magneto-optical disk, or be downloaded by a network from a remote recording medium or non-transitory machine-readable medium originally stored in a local recording medium and then stored in a local recording medium, so that the methods described herein can be processed by such software on a recording medium using a general-purpose computer, a special-purpose processor, or programmable or special-purpose hardware such as an ASIC or an FPGA. It can be understood that the computer, processor, microprocessor controller, or programmable hardware includes a storage component (e.g., RAM, ROM, flash memory, etc.) that can store or receive software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the digital certificate recovery methods described herein. Furthermore, when a general-purpose computer accesses code for implementing the digital certificate recovery methods shown herein, the execution of the code converts the general-purpose computer into a special-purpose computer for executing the digital certificate recovery methods shown herein.

[0125] Those skilled in the art can understand that the units and method steps of the examples described in combination with the embodiments disclosed herein can be realized in electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. A person skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the embodiments of the present application.

[0126] The above embodiments are only used to illustrate but not limit the embodiments of the present application, and a person of ordinary skill in the art can make various changes and modifications without departing from the spirit and scope of the embodiments of the present application, therefore all equivalent technical solutions belong to the scope of the embodiments of the present application, and the patent protection scope of the embodiments of the present application should be defined by the claims.

Claims

1. A digital certificate recovery method characterized by, The method comprises the following steps: determining a recovery operation being performed, wherein the recovery operation is used for recovering a certificate to be recovered; determining corresponding certificate state information of the recovery operation according to a correspondence between the recovery operation and the certificate state information, wherein the certificate state information is used for indicating that the recovery operation is normally performed and completed; when it is detected that the recovery operation is normally performed and completed, saving the certificate state information to monitor the digital certificate recovery by using the certificate state information; the certificate state information comprises an unissued identifier, an issued but not activated identifier, an issued identifier and an uninstalled identifier; the step of determining the corresponding certificate state information of the recovery operation according to the correspondence between the recovery operation and the certificate state information comprises: if the recovery operation is that a registration and audit server generates a certificate recovery request according to a serial number of the certificate to be recovered, the certificate state information is determined as the unissued identifier; if the recovery operation is that the registration and audit server saves a recovered certificate, the certificate state information is determined as the uninstalled identifier, wherein the recovered certificate is sent by an authentication server to the registration and audit server; if the recovery operation is that the registration and audit server installs the recovered certificate, the certificate state information is determined as the issued but not activated identifier; if the recovery operation is that the authentication server sends certificate recovery information, the certificate state information is determined as the issued identifier.

2. The method of claim 1, wherein, the certificate state information further comprises a to-be-used identifier and a used identifier; the step of determining the corresponding certificate state information of the recovery operation according to the correspondence between the recovery operation and the certificate state information comprises: if the recovery operation is that an authentication server generates a recovered certificate according to received key information, the certificate state information is determined as the to-be-used identifier, wherein the key information is obtained by a key management server according to a certificate recovery request and is sent to the authentication server; if the recovery operation is that the authentication server generates key recovery information according to received certificate recovery information, the certificate state information is determined as the used identifier, wherein the certificate recovery information is sent by a registration and audit server.

3. The method of claim 1, wherein, the certificate state information further comprises a to-be-recovered identifier and a recovered identifier; the step of determining the corresponding certificate state information of the recovery operation according to the correspondence between the recovery operation and the certificate state information comprises: if the recovery operation is that a key management server queries key information of the certificate to be recovered according to a certificate recovery request, the certificate state information is determined as the to-be-recovered identifier; if the recovery operation is that the key management server receives key recovery information, the certificate state information is determined as the recovered, wherein the key recovery information is sent by an authentication server.

4. The method of claim 1, wherein, the step of saving the certificate state information when it is detected that the recovery operation is normally performed and completed comprises: detecting whether there is first certificate state information that does not match the recovery operation; If the certificate status information exists, the first certificate status information is replaced by the certificate status information, and the certificate status information is saved.

5. The method of claim 4, wherein, The method further comprises: detecting an abnormal execution of the recovery operation; determining a target recovery operation that needs to be re-executed according to a correspondence between the certificate status information and the recovery operation; sending a recovery execution instruction to a server that executes the target recovery operation, so as to instruct the server to re-execute the target recovery operation, wherein the server comprises a registration audit server, an authentication server and a key management server.

6. The method of claim 4, wherein, The determining of the target recovery operation that needs to be re-executed according to the correspondence between the certificate status information and the recovery operation comprises: if the certificate status information is a non-certificate-issued identifier, determining that the target recovery operation is that the registration audit server generates a certificate recovery request according to a certificate serial number of a certificate to be recovered; if the certificate status information is a non-installed identifier, determining that the target recovery operation is that the registration audit server saves a post-recovery certificate; if the certificate status information is a certificate-issued-but-not-activated identifier, determining that the target recovery operation is that the registration audit server saves a post-recovery certificate; if the certificate status information is a certificate-issued identifier, determining that the target recovery operation is that the authentication server is sent certificate recovery information.

7. The method of claim 4, wherein, The determining of the target recovery operation that needs to be re-executed according to the correspondence between the certificate status information and the recovery operation comprises: if the certificate status information is a to-be-used identifier, determining that the target recovery operation is that the authentication server generates a post-recovery certificate according to received key information; if the certificate status information is a in-use identifier, determining that the target recovery operation is that the authentication server generates key recovery information according to received certificate recovery information.

8. The method of claim 4, wherein, The determining of the target recovery operation that needs to be re-executed according to the correspondence between the certificate status information and the recovery operation comprises: if the certificate status information is a to-be-recovered identifier, determining that the target recovery operation is that the key management server queries key information of a certificate to be recovered.

9. A digital certificate recovery apparatus characterized by comprising: comprise: a determining module configured to determine a recovery operation being executed, wherein the recovery operation is used for recovering a certificate to be recovered; a querying module configured to determine, according to a correspondence between the recovery operation and certificate status information, corresponding certificate status information of the recovery operation, wherein the certificate status information is used for indicating that the recovery operation is normally executed and completed; a monitoring module configured to save the certificate status information when it is detected that the recovery operation is normally executed and completed, so as to monitor the digital certificate recovery by using the certificate status information; the certificate status information comprises a non-certificate-issued identifier, a certificate-issued-but-not-activated identifier, a certificate-issued identifier and a non-installed identifier; the determining of the corresponding certificate status information of the recovery operation according to the correspondence between the recovery operation and the certificate status information comprises: if the recovery operation is that the registration audit server generates a certificate recovery request according to a certificate serial number of a certificate to be recovered, the certificate status information is determined as the non-certificate-issued identifier; If the recovery operation is that the post-recovery certificate is saved by the registration audit server, the certificate status information is determined as the uninstalled identifier, wherein the post-recovery certificate is sent by the authentication server to the registration audit server; If the recovery operation is that the post-recovery certificate is installed by the registration audit server, the certificate status information is determined as the certificate-issued-but-not-activated identifier; If the recovery operation is that the certificate recovery information is sent to the authentication server, the certificate status information is determined as the certificate-issued identifier.

Images