Method and device for updating digital certificate through code injection method

Abstract

The invention relates to the technical field of network security, and discloses a method and device for updating a digital certificate through a code injection method, the method is applied to a computing device, and the method comprises the steps that the certificate attribute of an expired digital certificate is determined, and the expired digital certificate is obtained through judgment based on the validity period range of the digital certificate collected through the code injection method; the certificate attributes comprise a storage attribute, a file attribute and a running environment attribute, the storage attribute represents the storage position of the expired digital certificate, and the file attribute represents whether the expired digital certificate can be modified or not in the running process of the computing equipment; the running environment attribute represents whether the expired digital certificate can maintain the modified state after the computing device is restarted, determining the updating mode of the expired digital certificate based on the certificate attribute, and updating the expired digital certificate into the target digital certificate by adopting the updating mode through a code injection method, so that the updating method is more convenient and accurate, and the updating efficiency is improved. The potential safety hazard of expiration of the digital certificate is reduced; and the operation and maintenance cost is saved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and provides a method and device for updating digital certificates through code injection method. Background Art

[0002] At present, the security of network data has attracted more and more attention. Websites, especially enterprise websites involving user privacy information, are constantly facing potential risks of being attacked by the network. In order to protect privacy information and improve the security of websites, various websites usually install digital certificates.

[0003] However, more and more digital certificates and shorter certificate validity periods have continuously increased the difficulty of certificate management in the system, and various problems such as expired certificates will inevitably occur. Moreover, the communication links between current computing devices are intricate, and the loading mechanisms of digital certificates in different computing devices may also be different, resulting in a cumbersome update process for expired digital certificates and poor update accuracy. Summary of the Invention

[0004] The embodiments of the present application provide a method and device for updating digital certificates through code injection method to improve the convenience and accuracy of updating digital certificates.

[0005] The specific technical solutions provided by the present application are as follows:

[0006] In a first aspect, the embodiments of the present application provide a method for updating digital certificates through code injection method, which is applied to a computing device and includes:

[0007] Determine the certificate attributes of the expired digital certificate, where the expired digital certificate is obtained by judging the validity period range of the digital certificate collected through the code injection method, and the certificate attributes include storage attributes, file attributes, and running environment attributes. The storage attributes represent the storage location of the expired digital certificate, the file attributes represent whether the expired digital certificate can be modified during the operation of the computing device, and the running environment attributes represent whether the expired digital certificate can maintain the modified state after the computing device is restarted;

[0008] Determine the update method of the expired digital certificate based on the certificate attributes, and use the update method to update the expired digital certificate to the target digital certificate through the code injection method.

[0009] Optionally, the expired digital certificate is obtained through the following method:

[0010] Collect the validity period range of the digital certificate through the code injection method;

[0011] Determine whether the valid period range is within the expiration range corresponding to the digital certificate, where the expiration range includes a period of dates between a first threshold date and a second threshold date, and the second threshold date is later than the first threshold date;

[0012] If not, then determine the digital certificate as an expired digital certificate.

[0013] Optionally, after determining the digital certificate as an expired digital certificate, it further includes:

[0014] Send a certificate reissuance request to the certificate authority, where the certificate reissuance request includes the valid period range of the expired digital certificate and the certificate feature information;

[0015] Receive the target digital certificate returned by the certificate authority, where the target digital certificate is regenerated by the certificate authority according to the target valid period range and the certificate feature information, and the target valid period range is later than the second threshold date included in the valid period range.

[0016] Optionally, determine the update method of the expired digital certificate based on the certificate attributes, including:

[0017] If the storage attribute is marked as disk storage or third-party storage, the file attribute is marked as modifiable during operation, and the running environment attribute is marked as being able to maintain the modified state after restart, then determine the update method of the expired digital certificate as replacement update;

[0018] If the storage attribute is marked as unknown storage, or the file attribute is marked as non-modifiable during operation, or the running environment attribute is marked as not being able to maintain the modified state after restart, then determine the update method of the expired digital certificate as reload update.

[0019] Optionally, determine the storage attribute, file attribute, and running environment attribute in the following ways:

[0020] Determine whether the storage method of the expired digital certificate is file stream. If so, mark the storage attribute as disk storage; if not, then if it is determined that the expired digital certificate is stored on a third-party storage platform, mark the storage attribute as third-party storage, otherwise, mark the storage attribute as unknown storage;

[0021] Determine whether the system modification permission of the expired digital certificate is read-only. If so, mark the file attribute as non-modifiable during operation; if not, mark the file attribute as modifiable during operation;

[0022] Determine whether the running environment of the expired digital certificate is a container environment. If so, mark the running environment attribute as not being able to maintain the modified state after restart; if not, mark the running environment attribute as being able to maintain the modified state after restart.

[0023] Optionally, the expired digital certificate is updated to the target digital certificate by means of code injection, including:

[0024] If the update method is replacement update, obtain the storage path of the expired digital certificate by means of code injection, and replace the expired digital certificate with the target digital certificate at the storage location represented by the storage path. Among them, if the storage attribute is marked as disk storage, the storage path is the directory of the disk storing the expired digital certificate; if the storage attribute is marked as third-party storage, the storage path is the directory of the third-party storage platform storing the expired digital certificate connected through the data update interface;

[0025] If the update method is reloading update, reload the input stream corresponding to the target digital certificate by means of code injection, and replace the expired certificate file in the memory with the target certificate file obtained after loading, where the expired certificate file is obtained by loading based on the input stream corresponding to the expired digital certificate.

[0026] Optionally, reload the input stream corresponding to the target digital certificate by means of code injection, and replace the expired certificate file in the memory with the target certificate file obtained after loading, including:

[0027] Determine each binary data included in the target digital certificate by means of code injection, and convert each binary data into a corresponding input stream;

[0028] Find the loading method associated with the expired digital certificate from the pre-established mapping table, and find the expired certificate file associated with the expired digital certificate in the memory;

[0029] Reload the input stream with the loading method to obtain the target certificate file, and replace the expired certificate file in the memory with the target certificate file.

[0030] In a second aspect, an embodiment of the present application further provides a device for updating a digital certificate by means of code injection, including:

[0031] A determination unit, configured to determine the certificate attributes of the expired digital certificate, where the expired digital certificate is obtained by judging the validity period range of the digital certificate collected by means of code injection, and the certificate attributes include storage attributes, file attributes, and running environment attributes. The storage attribute represents the storage location of the expired digital certificate, the file attribute represents whether the expired digital certificate can be modified during the operation of the computing device, and the running environment attribute represents whether the expired digital certificate can maintain the modified state after the computing device is restarted;

[0032] An update unit is used to determine the update method for an expired digital certificate based on certificate attributes, and update the expired digital certificate to a target digital certificate by using the update method through code injection.

[0033] Optionally, the expired digital certificate is obtained in the following manner:

[0034] Collect the validity period range of the digital certificate through code injection;

[0035] Determine whether the validity period range is within the expired range corresponding to the digital certificate, where the expired range includes a period of dates between a first threshold date and a second threshold date, and the second threshold date is later than the first threshold date;

[0036] If not, determine the digital certificate as an expired digital certificate.

[0037] Optionally, after determining the digital certificate as an expired digital certificate, it further includes:

[0038] Send a certificate reissuance request to the certificate authority, where the certificate reissuance request includes the validity period range and certificate feature information of the expired digital certificate;

[0039] Receive the target digital certificate returned by the certificate authority, where the target digital certificate is regenerated by the certificate authority according to the target validity period range and certificate feature information, and the target validity period range is later than the second threshold date included in the validity period range.

[0040] Optionally, to determine the update method for the expired digital certificate based on certificate attributes, the update unit is used for:

[0041] If the storage attribute is marked as disk storage or third-party storage, the file attribute is marked as modifiable during operation, and the running environment attribute is marked as being able to maintain the modified state after restart, then determine the update method for the expired digital certificate as replacement update;

[0042] If the storage attribute is marked as unknown storage, or the file attribute is marked as non-modifiable during operation, or the running environment attribute is marked as not being able to maintain the modified state after restart, then determine the update method for the expired digital certificate as reloading update.

[0043] Optionally, the storage attribute, file attribute, and running environment attribute are determined in the following manner:

[0044] Determine whether the storage method of the expired digital certificate is a file stream. If so, mark the storage attribute as disk storage; if not, if it is determined that the expired digital certificate is stored on a third-party storage platform, mark the storage attribute as third-party storage, otherwise, mark the storage attribute as unknown storage;

[0045] Determine whether the system modification permission of the expired digital certificate is read-only. If so, mark the file attribute as non-modifiable during the running process; if not, mark the file attribute as modifiable during the running process.

[0046] Determine whether the running environment of the expired digital certificate is a container environment. If so, mark the running environment attribute as unable to maintain the modified state after restart; if not, mark the running environment attribute as able to maintain the modified state after restart.

[0047] Optionally, update the expired digital certificate to the target digital certificate by means of code injection and update. The update unit is used for:

[0048] If the update method is replacement update, obtain the storage path of the expired digital certificate by means of code injection, and replace the expired digital certificate with the target digital certificate at the storage location represented by the storage path. Among them, if the storage attribute is marked as disk storage, the storage path is the directory of the disk storing the expired digital certificate; if the storage attribute is marked as third-party storage, the storage path is the directory of the third-party storage platform storing the expired digital certificate connected through the data update interface.

[0049] If the update method is reloading update, reload the input stream corresponding to the target digital certificate by means of code injection, and replace the expired certificate file in the memory with the target certificate file obtained after loading, where the expired certificate file is loaded based on the input stream corresponding to the expired digital certificate.

[0050] Optionally, reload the input stream corresponding to the target digital certificate by means of code injection, and replace the expired certificate file in the memory with the target certificate file obtained after loading, including:

[0051] Determine each binary data included in the target digital certificate by means of code injection, and convert each binary data into a corresponding input stream.

[0052] Search for the loading method associated with the expired digital certificate from the pre-established mapping table, and search for the expired certificate file associated with the expired digital certificate in the memory.

[0053] Reload the input stream with the loading method to obtain the target certificate file, and replace the expired certificate file in the memory with the target certificate file.

[0054] In a third aspect, a computing device includes:

[0055] A memory for storing executable instructions;

[0056] A processor for reading and executing executable instructions stored in a memory to implement the method according to any one of the first aspect.

[0057] Fourth aspect, a computer-readable storage medium, when the instructions in the storage medium are executed by a processor, enabling the processor to execute the method according to any one of the above-mentioned first aspects.

[0058] The beneficial effects of this application are as follows:

[0059] In summary, in the embodiments of this application, a method and device for updating a digital certificate through code injection are provided. The method is applied to a computing device and includes: determining the certificate attributes of an expired digital certificate, where the expired digital certificate is obtained by judging the validity period range of the digital certificate collected through the code injection method, and the certificate attributes include storage attributes, file attributes, and running environment attributes. The storage attributes represent the storage location of the expired digital certificate, the file attributes represent whether the expired digital certificate can be modified during the operation of the computing device, and the running environment attributes represent whether the expired digital certificate can maintain the modified state after the computing device is restarted. Determining the update method of the expired digital certificate based on the certificate attributes, and using the code injection method to update the expired digital certificate to a target digital certificate in the update method. Compared with the related art, the method for updating the digital certificate through the code injection method is more convenient and accurate, reducing the security risk of digital certificate expiration and saving the operation and maintenance cost.

[0060] Other features and advantages of this application will be described in the following specification, and some will become obvious from the specification or be understood by implementing this application. The objectives and other advantages of this application can be achieved and obtained through the structures specifically pointed out in the written specification, claims, and drawings. Description of the Drawings

[0061] The drawings described herein are used to provide a further understanding of this application and form a part of this application. The schematic embodiments of this application and their descriptions are used to explain this application and do not constitute an improper limitation to this application. In the drawings:

[0062] Figure 1 It is a schematic diagram of the system architecture for updating a digital certificate in the embodiments of this application;

[0063] Figure 2 It is a schematic diagram of a process for updating a digital certificate in the embodiments of this application;

[0064] Figure 3 It is a schematic diagram of a process for obtaining an expired digital certificate in the embodiments of this application;

[0065] Figure 4Schematic diagram of a process for obtaining a target digital certificate in an embodiment of the present application;

[0066] Figure 5 Schematic diagram of a process for determining an update method for an expired digital certificate based on certificate attributes in an embodiment of the present application;

[0067] Figure 6 Schematic diagram of a process for updating an expired digital certificate to a target digital certificate by using an update method through code injection in an embodiment of the present application;

[0068] Figure 7 Schematic diagram of a process for replacing an expired certificate file by using a reloading method in an embodiment of the present application;

[0069] Figure 8 Schematic diagram of the logical architecture of a device for updating a digital certificate by using a code injection method in an embodiment of the present application;

[0070] Figure 9 Schematic diagram of the physical architecture of a computing device in an embodiment of the present application. Detailed implementation manners

[0071] To make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application. Apparently, the described embodiments are some but not all of the embodiments of the technical solutions of the present application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments recorded in this application document without creative efforts belong to the scope protected by the technical solutions of the present application.

[0072] Terms such as "first", "second", etc. in the description and claims of the present invention and the above accompanying drawings are used to distinguish similar objects and do not necessarily need to describe a specific order or sequence. It should be understood that such data can be interchanged under appropriate circumstances so that the embodiments of the present invention described here can be implemented in an order other than those illustrated or described here.

[0073] The following first introduces the professional terms that appear in the embodiments of the present application as follows:

[0074] Digital Certificate (DC): An electronic document that uniquely identifies a person and a resource on the Internet. The certificate enables secure and confidential communication between two computing devices. Each official certificate has a validity period, and an expired certificate cannot be used during communication.

[0075] The following details the preferred implementation manners of the present application with reference to the accompanying drawings.

[0076] Refer to Figure 1 As shown, in the embodiment of the present application, the system includes at least one computing device and a certificate authority. Here, it should be noted that in order to enable better communication between each computing device, and, in order to make the communication between the certificate authority and each computing device more convenient, refer to Figure 1 As shown, the system usually also includes a digital certificate management platform.

[0077] Refer to Figure 1 As shown, the certificate authority, abbreviated as Certificate Authority (CA), is the certification authority of digital certificates and is the authoritative agency responsible for issuing and managing digital certificates. In the embodiment of the present application, it mainly receives new certificate applications, verifies the application content, and issues new certificates.

[0078] Digital certificate management platform: A system platform that uniformly manages the life cycle of all digital certificates within the system, provides a management page for digital certificate administrators or users to use, and users can view the usage status of all digital certificates within the current system through this platform. For digital certificates within the system that are about to expire and have expired, according to the user's needs, the renewal certificate request will be forwarded to the certificate CA for renewal, and the relevant newly renewed certificates will be issued to the corresponding computing devices.

[0079] Figure 1 The computing devices 1, 2, and 3 in [[ ]] exemplarily represent the digital certificates in the embodiment of the present application. Each computing device is provided with a digital certificate. Exemplarily, the computing device 1 is provided with digital certificate a, the computing device 2 is provided with digital certificate b, and the computing device 3 is provided with digital certificate c. Based on the setting of the digital certificate, secure encryption and authentication technology (Secure Sockets Layer, SSL) communication can be carried out between each computing device, and the communication process will not be elaborated here one by one. The implementation of a method for updating digital certificates through code injection is mainly executed on the computing device side, and the following is a specific introduction.

[0080] Refer to Figure 2 As shown, in the embodiment of the present application, the specific process of updating digital certificates through code injection is as follows:

[0081] Step 201: Determine the certificate attributes of the expired digital certificate, where the expired digital certificate is obtained by judging the validity period range of the digital certificate collected through the code injection method. The certificate attributes include storage attributes, file attributes, and running environment attributes. The storage attributes represent the storage location of the expired digital certificate, the file attributes represent whether the expired digital certificate can be modified during the operation of the computing device, and the running environment attributes represent whether the expired digital certificate can maintain the modified state after the computing device is restarted.

[0082] First of all, it should be noted that the above code injection method refers to inserting extra code into a program during its runtime to change the program's behavior or perform additional operations. In the embodiments of this application, the above code injection technology is mainly applied in the process of collecting and updating digital certificates. Exemplarily, during the process of collecting the validity period range, certificate subject, etc. of a digital certificate, it is necessary to inject code into the key function KeyStore.load for reading the certificate. This technical means of code injection can comprehensively monitor the digital certificates loaded in all computing devices, thereby solving the problems such as statistical omissions and duplicate statistics that are inevitable when digital certificate administrators often obtain all digital certificates through manual statistics methods such as documents.

[0083] Here, it should be noted that referring to Figure 3 as shown, the expired digital certificates are obtained through the following methods:

[0084] Step 001: Collect the validity period range of the digital certificate through the code injection method.

[0085] During the implementation process, the computing device first needs to collect the information of the digital certificate through the code injection method. Exemplarily, the above information includes the validity period range, public key, certificate subject, certificate issuer, and other information. In the embodiments of this application, it can be determined whether the corresponding digital certificate is an expired digital certificate only based on the currently collected date and the validity period range. The information other than the validity period range is collectively referred to as certificate feature information.

[0086] The above validity period range is usually a time range. For example, the validity period range of digital certificate a is from September 12, 2023 to October 11, 2023.

[0087] Step 002: Determine whether the current date is within the validity period range of the digital certificate, where the validity period range includes a period of dates between a first threshold date and a second threshold date, and the second threshold date is later than the first threshold date.

[0088] In the embodiments of this application, the above validity period range represents a time range value, usually representing a period of time between the date when the corresponding digital certificate starts to be valid and the date when it is no longer valid. For example, the expiration range of digital certificate a is from September 12, 2023 to October 11, 2023. Taking this example for illustration, the above first threshold date is September 12, 2023, and the second threshold date is October 11, 2023.

[0089] It should be noted that considering that the collection process of the SSL communication process and the validity period range, etc. is not carried out in real time, the above current date represents the date of the collection validity period range. In this way, through the comparison between the current date and the validity period range, the expired digital certificates can be determined, so that the expired digital certificates can be updated more timely.

[0090] In the specific implementation process, after collecting the current date and the validity period range, further determine whether the current date is within the validity period range.

[0091] Step 003: If it is not within the expired range, determine the digital certificate as an expired digital certificate.

[0092] In the implementation process, if the current date is not within the collected validity period range, the digital certificate corresponding to the validity period range is determined as an expired digital certificate; if the current date is within the collected validity period range, in this case, the digital certificate corresponding to the validity period range will not be determined as an expired digital certificate.

[0093] For example, the validity period range of digital certificate a is from September 12, 2023 to October 11, 2023. Then, after comparing with the validity period range of digital certificate a, it can be determined that the digital certificates within the range from September 12, 2023 to October 11, 2023 are valid digital certificates, and the digital certificates before September 12, 2023 and after October 11, 2023 are collectively referred to as expired digital certificates.

[0094] In addition, it should be noted that after determining the digital certificate as an expired digital certificate, refer to Figure 4 As shown, it also includes:

[0095] Step 101: Send a certificate reissuance request to the certificate issuing authority, where the certificate reissuance request includes the validity period range and certificate characteristic information of the expired digital certificate.

[0096] After determining the digital certificate as an expired digital certificate, the expired digital certificate will prevent the computing device where it is located from communicating with other computing devices, that is, other computing devices will reject the access of the expired digital certificate. Therefore, it is necessary to update the digital certificate of the above computing device.

[0097] In the implementation process, first generate a certificate reissuance request according to the validity period range and certificate characteristic information of the expired digital certificate, and then send the certificate reissuance request to the certificate issuing authority, or send the certificate reissuance request to the digital certificate management platform first, and then the digital certificate management platform forwards it to the certificate issuing authority.

[0098] Step 102: Receive the target digital certificate returned by the certificate authority, where the target digital certificate is regenerated by the certificate authority according to the target validity period range and the certificate feature information, and the target validity period range is later than the second threshold date included in the validity period range.

[0099] After receiving the certificate reissuance request, the certificate authority will parse the certificate reissuance request to obtain the validity period range and the certificate feature information. To generate a new digital certificate, that is, the target digital certificate, the certificate authority will first generate the target validity period range according to the validity period range. The target validity period range is later than the second threshold date included in the validity period range, that is, the originally about-to-expire or already-expired validity period range is updated to a valid non-expired date. On this basis, the target validity period range and the certificate feature information are combined to regenerate the target digital certificate.

[0100] Further, send the above target digital certificate to the computing device, or send the target digital certificate to the digital certificate management platform first, and then the digital certificate management platform sends it to the computing device. The only difference between the target digital certificate received by the computing device and the expired digital certificate is the validity period range.

[0101] In the embodiment of the present application, after determining that the digital certificate is an expired digital certificate, it is necessary to further determine the certificate attributes of the expired digital certificate. It should be noted that the above certificate attributes characterize the certificate status of the expired digital certificate and directly determine which method should be used to update the expired digital certificate. Exemplarily, the certificate attributes include storage attributes, file attributes, and running environment attributes. The storage attributes characterize the storage location of the expired digital certificate, the file attributes characterize whether the expired digital certificate can be modified during the operation of the computing device, and the running environment attributes characterize whether the expired digital certificate can maintain the modified state after the computing device restarts.

[0102] It should be noted that the above storage attributes characterize the storage location of the expired digital certificate, that is, the storage location includes disks, third-party databases, third-party remote configuration centers (cloud, virtual files, hardware firmware, etc.), and the case where the storage location is unknown.

[0103] The above file attributes characterize whether the expired digital certificate can be modified during the operation of the computing device, that is, during the operation of the computing device, that is, when the computing device is not restarted, if the expired digital certificate is readable, it means that the expired digital certificate cannot be modified, and if the expired digital certificate is writable, it means that the expired digital certificate can be modified.

[0104] The above running environment property characterizes whether the expired digital certificate can maintain the modified state after the computing device is restarted. Considering that the computing device will inevitably be restarted, after the expired digital certificate is updated to the target digital certificate, whether the target digital certificate can be successfully modified depends on whether it can maintain the modified state after the computing device is restarted.

[0105] Correspondingly, it should be noted that the storage property, file property, and running environment property are determined in the following ways:

[0106] (1) Determine whether the storage method of the expired digital certificate is a file stream. If so, mark the storage property as disk storage. If not, if it is determined that the expired digital certificate is stored on a third-party storage platform, mark the storage property as third-party storage; otherwise, mark the storage property as unknown storage.

[0107] During the implementation process, to determine the storage property of the expired digital certificate, first judge whether the storage method of the expired digital certificate is a file stream. If it is a file stream, it means that the expired digital certificate is stored on the disk, and the storage property is marked as disk storage.

[0108] If it is not a file stream, the expired digital certificate may be stored on a third-party storage platform or in an unknown storage, that is, the storage location of the expired digital certificate cannot be determined. Based on this, during the implementation process, read the stack information of the expired digital certificate, and check whether there are other data sources connected to the data update interface through the stack information and the file stream. If other data sources connected to the data update interface are found, mark the storage property as third-party storage; if no other data sources are found, mark the storage property as unknown storage.

[0109] (2) Determine whether the system modification permission of the expired digital certificate is read-only. If so, mark the file property as not modifiable during operation. If not, mark the file property as modifiable during operation.

[0110] During the implementation process, to confirm whether the expired digital certificate can be modified during operation, it is necessary to check the system modification permission of the expired digital certificate. When the system modification permission of the expired digital certificate is read-only, mark the file property as not modifiable during operation; when the system modification permission of the expired digital certificate is write-only or read-write, mark the file property as modifiable during operation.

[0111] (3) Determine whether the running environment of the expired digital certificate is a container environment. If so, mark the running environment property as unable to maintain the modified state after restart. If not, mark the running environment property as able to maintain the modified state after restart.

[0112] During the implementation process, in order to confirm whether the modification of the expired digital certificate can be maintained after the computing device is restarted, it is necessary to determine whether the running environment of the expired digital certificate is a container environment. If its running environment is a container environment, mark the running environment attribute as unable to maintain the modified state after restart; if its running environment is a non-container environment, mark the running environment attribute as able to maintain the modified state after restart.

[0113] Step 202: Determine the update method of the expired digital certificate based on the certificate attributes, and use the update method to update the expired digital certificate to the target digital certificate through code injection.

[0114] After determining the storage attribute, file attribute, and running environment attribute of the expired digital certificate, then determine the update method according to the above certificate attributes. Refer to Figure 5 as shown in

[0115] First of all, it should be added that during the use of the digital certificate, the digital certificate will be loaded first to obtain the corresponding certificate file, and this certificate file will be uniformly stored in the memory of the computing device. During the communication with other computing devices, the computing device reads the certificate file from the memory and then conducts SSL communication with other computing devices. That is to say, only the entity data in the form of binary data of the digital certificate is stored in the storage location of the digital certificate, and the actual certificate file stored in the memory participates in the communication.

[0116] Based on this, during the process of updating the digital certificate, usually two methods are adopted. Method 1: Replace and update, that is, replace the entity data in the form of binary data of the digital certificate; Method 2: Reload and update, that is, replace the certificate file in the memory.

[0117] Step 2021: If the storage attribute is marked as disk storage or third-party storage, the file attribute is marked as allowing modification during operation, and the running environment attribute is marked as able to maintain the modified state after restart, then determine that the update method of the expired digital certificate is replace and update.

[0118] During the implementation process, when it is determined that the storage location of the expired digital certificate is a definite location, including disk storage and third-party storage, which is convenient for replacing the expired digital certificate. And the expired digital certificate is allowed to be modified during operation, which will not affect the operation of the computing device. And the above modification can maintain the modified state after restart, so as to ensure that the replaced digital certificate can really play a role. Based on this, when all the above three situations are established, determine that the update method of the expired digital certificate is replace and update.

[0119] Step 2022: If the storage attribute is marked as unknown storage, or the file attribute is marked as non-modifiable during operation, or the running environment attribute is marked as unable to maintain the modified state after restart, determine that the update method for the expired digital certificate is reloading update.

[0120] During the implementation process, if the storage location of the expired digital certificate is not clear, that is, the storage attribute is marked as unknown storage; or the expired digital certificate is non-modifiable during operation, or the replaced digital certificate cannot truly take effect after the computing device restarts, that is, the running environment attribute is marked as unable to maintain the modified state after restart. In the above cases, determine that the update method for the expired digital certificate is reloading update.

[0121] Exemplarily, the expired digital certificate is updated to the target digital certificate by using the update method through code injection. Refer to Figure 6 as shown, including:

[0122] Step 2023: If the update method is replacement update, obtain the storage path of the expired digital certificate through code injection, and replace the expired digital certificate with the target digital certificate at the storage location represented by the storage path. Among them, if the storage attribute is marked as disk storage, the storage path is the directory of the disk storing the expired digital certificate. If the storage attribute is marked as third-party storage, the storage path is the directory of the third-party storage platform storing the expired digital certificate connected through the data update interface.

[0123] During the implementation process, when it is determined that the update method for the expired digital certificate is replacement update, first obtain the storage path of the expired digital certificate through code injection. That is, when the storage attribute of the expired digital certificate is marked as disk storage, obtain the directory of the disk storing the expired digital certificate as the storage path; when the storage attribute of the expired digital certificate is marked as third-party storage, obtain the directory of the third-party storage platform storing the expired digital certificate connected through the data update interface as the storage path, so that the computing device can establish a connection with the third-party storage platform through the data update interface.

[0124] During the replacement update process, under the above-obtained disk storage path (or the storage path of the third-party storage platform connected through the data update interface), first delete the expired digital certificate, and then place the target digital certificate under the above storage path. After that, restart the computing device. In this way, the updated target digital certificate will take effect automatically when the computing device starts up next time. Since the restart of the computing device often causes a short-term service interruption, this method is often applicable to the daily operation and maintenance scenario where the digital certificate is about to expire, and this scenario has better stability.

[0125] Step 2024: If the update method is reloading update, reload the input stream corresponding to the target digital certificate through the code injection method, and replace the expired certificate file in the memory with the target certificate file obtained after loading, where the expired certificate file is loaded based on the input stream corresponding to the expired digital certificate.

[0126] During the implementation process, when it is determined that the update method for updating the expired digital certificate is replacement update, it is necessary to update the expired certificate file in the memory to ensure the normal operation of the computing device. During the implementation process, first reload the input stream corresponding to the target digital certificate through the code injection method to obtain the target certificate file of the target digital certificate, then delete the expired certificate file in the memory, and place the target certificate file in the same memory.

[0127] Exemplarily, reload the input stream corresponding to the target digital certificate through the code injection method, and replace the expired certificate file in the memory with the target certificate file obtained after loading. Refer to Figure 7 as shown, including:

[0128] Step 20241: Determine each binary data included in the target digital certificate through the code injection method, and convert each binary data into a corresponding input stream.

[0129] During the implementation process, after receiving the target digital certificate returned by the certificate authority, determine each binary data included in the target digital certificate through the code injection method, then read the above binary data into the memory and convert it into a corresponding input stream in the memory, for example, a file stream in JAVA format, etc.

[0130] Step 20242: Search for the loading method associated with the expired digital certificate from the pre-established mapping table, and search for the expired certificate file associated with the expired digital certificate in the memory.

[0131] Since the communication between various computing devices is relatively complex and there are relatively many corresponding digital certificates, in the embodiments of the present application, in order to make the relationship between the computing device, the digital certificate, and the certificate file clearer, a mapping table will be pre-established. The above mapping table will store the digital certificate, the associated loading method, and the generated certificate file after loading. In this way, after loading the expired certificate file based on the input stream corresponding to the expired digital certificate, search for the loading method associated with the expired digital certificate in the above mapping table, and the found loading method can be used to generate a new certificate file.

[0132] To facilitate the subsequent update of the expired certificate file, during the implementation process, the expired certificate file associated with the expired digital certificate will also be searched for in the memory.

[0133] Step 20243: Reload the input stream using the loading method to obtain the target certificate file, and replace the expired certificate file in the memory with the target certificate file.

[0134] During the implementation process, reload the input stream using the found loading method to obtain the target certificate file. It should be noted that this loading method corresponds one-to-one with the expired digital certificate. Correspondingly, the target certificate file obtained using this loading method also corresponds one-to-one with the expired digital certificate.

[0135] During the implementation process, the original expired certificate file in the memory can no longer participate in the communication process normally. First, the expired certificate file needs to be deleted, and then the expired certificate file in the memory is replaced with the target certificate file. In this way, the subsequent communication process can use the target certificate file to implement functions such as identity authentication. Since the updated target certificate file is stored in the memory, the update of the expired digital certificate can be completed without restarting the computing device.

[0136] Based on the same inventive concept, refer to Figure 8 As shown, an apparatus for updating digital certificates by code injection method provided in an embodiment of the present application includes:

[0137] A determination unit 801, configured to determine the certificate attributes of the expired digital certificate, where the expired digital certificate is determined based on the validity period range of the digital certificate collected by the code injection method, and the certificate attributes include storage attributes, file attributes, and operating environment attributes. The storage attributes represent the storage location of the expired digital certificate, the file attributes represent whether the expired digital certificate can be modified during the operation of the computing device, and the operating environment attributes represent whether the expired digital certificate can maintain the modified state after the computing device is restarted;

[0138] An update unit 802, configured to determine the update method of the expired digital certificate based on the certificate attributes, and update the expired digital certificate to the target digital certificate by using the update method through the code injection method.

[0139] Optionally, the expired digital certificate is obtained by the following method:

[0140] Collect the validity period range of the digital certificate by the code injection method;

[0141] Judge whether the validity period range is within the expired range corresponding to the digital certificate, where the expired range includes a period of dates between the first threshold date and the second threshold date, and the second threshold date is later than the first threshold date;

[0142] If not, determine the digital certificate as the expired digital certificate.

[0143] Optionally, after determining the digital certificate as the expired digital certificate, it further includes:

[0144] Send a certificate reissuance request to the certificate authority, where the certificate reissuance request includes the validity period range of the expired digital certificate and the certificate characteristic information;

[0145] Receive the target digital certificate returned by the certificate authority, where the target digital certificate is regenerated by the certificate authority according to the target validity period range and the certificate characteristic information, and the target validity period range is later than the second threshold date included in the validity period range.

[0146] Optionally, determine the update method of the expired digital certificate based on the certificate attributes. The update unit 802 is used for:

[0147] If the storage attribute is marked as disk storage or third-party storage, the file attribute is marked as allowed to be modified during operation, and the running environment attribute is marked as able to maintain the modified state after restart, then determine that the update method of the expired digital certificate is replacement update;

[0148] If the storage attribute is marked as unknown storage, or the file attribute is marked as not allowed to be modified during operation, or the running environment attribute is marked as unable to maintain the modified state after restart, then determine that the update method of the expired digital certificate is reload update.

[0149] Optionally, determine the storage attribute, file attribute, and running environment attribute in the following ways:

[0150] Determine whether the storage method of the expired digital certificate is file stream. If so, mark the storage attribute as disk storage; if not, if it is determined that the expired digital certificate is stored in a third-party storage platform, mark the storage attribute as third-party storage, otherwise, mark the storage attribute as unknown storage;

[0151] Determine whether the system modification permission of the expired digital certificate is read-only. If so, mark the file attribute as not allowed to be modified during operation; if not, mark the file attribute as allowed to be modified during operation;

[0152] Determine whether the running environment of the expired digital certificate is a container environment. If so, mark the running environment attribute as unable to maintain the modified state after restart; if not, mark the running environment attribute as able to maintain the modified state after restart.

[0153] Optionally, use the update method to update the expired digital certificate to the target digital certificate through the code injection method. The update unit 802 is used for:

[0154] If the update method is replacement update, obtain the storage path of the expired digital certificate through the code injection method, and replace the expired digital certificate with the target digital certificate at the storage location represented by the storage path. Among them, if the storage attribute is marked as disk storage, the storage path is the directory of the disk storing the expired digital certificate; if the storage attribute is marked as third-party storage, the storage path is the directory of the third-party storage platform storing the expired digital certificate connected through the data update interface.

[0155] If the update method is reloading update, reload the input stream corresponding to the target digital certificate through the code injection method, and replace the expired certificate file in the memory with the target certificate file obtained after reloading, where the expired certificate file is loaded based on the input stream corresponding to the expired digital certificate.

[0156] Optionally, reloading the input stream corresponding to the target digital certificate through the code injection method and replacing the expired certificate file in the memory with the target certificate file obtained after reloading includes:

[0157] Determine each binary data included in the target digital certificate through the code injection method, and convert each binary data into a corresponding input stream;

[0158] Search for the loading method associated with the expired digital certificate from the pre-established mapping table, and search for the expired certificate file associated with the expired digital certificate in the memory;

[0159] Reload the input stream using the loading method to obtain the target certificate file, and replace the expired certificate file in the memory with the target certificate file.

[0160] Based on the same inventive concept, refer to Figure 9 As shown, an embodiment of the present application provides a computing device, including: a memory 901 for storing executable instructions; a processor 902 for reading and executing the executable instructions stored in the memory and executing any one of the methods in the first aspect above.

[0161] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium, when the instructions in the storage medium are executed by a processor, enabling the processor to execute any one of the methods described in the first aspect above.

[0162] In summary, in the embodiments of the present application, a method and device for updating a digital certificate through code injection are provided. The method is applied to a computing device and includes: determining the certificate attributes of an expired digital certificate, where the expired digital certificate is obtained by judging the validity period range of the digital certificate collected through the code injection method, and the certificate attributes include storage attributes, file attributes, and running environment attributes. The storage attributes represent the storage location of the expired digital certificate, the file attributes represent whether the expired digital certificate can be modified during the operation of the computing device, and the running environment attributes represent whether the expired digital certificate can maintain the modified state after the computing device is restarted. Based on the certificate attributes, determining the update method of the expired digital certificate, and using the code injection method to update the expired digital certificate to the target digital certificate in the update method. Compared with the related art, the method for updating the digital certificate through the code injection method is more convenient and accurate, reduces the security risks of digital certificate expiration, and saves operation and maintenance costs.

[0163] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product system. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product system implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0164] The present application is described with reference to the flowcharts and / or block diagrams of methods, devices (systems), and computer program product systems according to the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, as well as the combination of flows and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, such that the instructions executed by the processor of the computer or other programmable data processing devices generate a device for implementing the specified functions in Figure 1 one or more flows or multiple flows and / or blocks Figure 1 one or more blocks or multiple blocks.

[0165] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, such that the instructions stored in the computer-readable memory generate a manufactured article including an instruction device, and the instruction device implements the specified functions in Figure 1 one or more flows or multiple flows and / or blocks Figure 1 one or more blocks or multiple blocks.

[0166] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus, so that a series of operation steps are performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions for implementing the steps specified in one process or a plurality of processes and / or boxes Figure 1 one process or a plurality of processes and / or boxes Figure 1 in one box or a plurality of boxes.

[0167] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application is also intended to include these modifications and variations.

Claims

1. A method for updating a digital certificate by a code injection method, characterized in that: Applied to a computing device, the method comprises: Determine the certificate attributes of the expired digital certificate, wherein the expired digital certificate is obtained based on the validity period range of the digital certificate collected by the code injection method, and the certificate attributes include storage attributes, file attributes, and operating environment attributes, the storage attributes represent the storage location of the expired digital certificate, the file attributes represent whether the expired digital certificate can be modified during the operation of the computing device, and the operating environment attributes represent whether the expired digital certificate can maintain the modified state after the computing device is restarted; The updating method of the expired digital certificate is determined based on the certificate attribute, and the expired digital certificate is updated to a target digital certificate by adopting the updating method through a code injection method.

2. The method according to claim 1, characterized in that The expired digital certificate is obtained by: Collecting the validity period of the digital certificate through a code injection method; Determining whether the current date is within the validity period of the digital certificate, wherein the validity period includes a period of time between a first threshold date and a second threshold date, and the second threshold date is later than the first threshold date; If not, the digital certificate is determined to be the expired digital certificate.

3. The method according to claim 2, characterized in that After determining the digital certificate as the expired digital certificate, the method further includes: Sending a certificate re-issuance request to a certificate authority, wherein the certificate re-issuance request includes the validity period range and certificate feature information of the expired digital certificate; The target digital certificate returned by the certificate issuing authority is received, wherein the target digital certificate is regenerated by the certificate issuing authority according to a target validity period range and the certificate characteristic information, and the target validity period range is later than a second threshold date included in the validity period range.

4. The method according to claim 1, characterized in that The method of determining the update mode of the expired digital certificate based on the certificate attribute includes: If the storage attribute is marked as disk storage or third-party storage, the file attribute is marked as allowing modification during operation, and the operating environment attribute is marked as being able to maintain the modified state after restart, then it is determined that the update method of the expired digital certificate is replacement update; If the storage attribute is marked as unknown storage, or the file attribute is marked as unmodifiable during operation, or the operating environment attribute is marked as unable to maintain the modified state after restart, it is determined that the update method of the expired digital certificate is reload update.

5. The method according to claim 4, characterized in that The storage attribute, the file attribute and the operating environment attribute are determined in the following manner: Determine whether the storage mode of the expired digital certificate is a file stream, and if so, mark the storage attribute as disk storage; if not, if it is determined that the expired digital certificate is stored in a third-party storage platform, mark the storage attribute as third-party storage, otherwise, mark the storage attribute as unknown storage; Determine whether the system modification permission of the expired digital certificate is read-only, and if so, mark the file attribute as unmodifiable during operation; If not, marking the file attribute as allowing modification during operation; Determine whether the operating environment of the expired digital certificate is a container environment. If so, mark the operating environment attribute as being unable to maintain a modified state after restart; if not, mark the operating environment attribute as being able to maintain a modified state after restart.

6. The method according to any one of claims 1 to 5, characterized in that: The method of updating the expired digital certificate to a target digital certificate by adopting the updating method through the code injection method includes: If the update mode is replacement update, the storage path of the expired digital certificate is obtained through a code injection method, and the expired digital certificate is replaced with the target digital certificate at the storage location represented by the storage path, wherein, if the storage attribute is marked as disk storage, the storage path is the directory of the disk storing the expired digital certificate; if the storage attribute is marked as third-party storage, the storage path is the directory of a third-party storage platform connected through a data update interface storing the expired digital certificate; If the update method is a reload update, the input stream corresponding to the target digital certificate is reloaded through a code injection method, and the expired certificate file in the memory is replaced with the target certificate file obtained after loading, wherein the expired certificate file is loaded based on the input stream corresponding to the expired digital certificate.

7. The method according to claim 6, characterized in that The method of reloading the input stream corresponding to the target digital certificate by the code injection method and replacing the expired certificate file in the memory with the target certificate file obtained after loading includes: Determine each binary data included in the target digital certificate by a code injection method, and convert each binary data into the corresponding input stream; Searching for a loading method associated with the expired digital certificate from a pre-established mapping table, and searching for an expired certificate file associated with the expired digital certificate in a memory; The input stream is reloaded using the loading method to obtain the target certificate file, and the expired certificate file in the memory is replaced with the target certificate file.

8. A device for updating a digital certificate by a code injection method, characterized in that: include: a determination unit, configured to determine a certificate attribute of an expired digital certificate, wherein the expired digital certificate is obtained by judging the validity period range of the digital certificate collected by the code injection method, and the certificate attribute includes a storage attribute, a file attribute, and an operating environment attribute, wherein the storage attribute represents a storage location of the expired digital certificate, the file attribute represents whether the expired digital certificate can be modified during the operation of the computing device, and the operating environment attribute represents whether the expired digital certificate can maintain a modified state after the computing device is restarted; The updating unit is used to determine the updating method of the expired digital certificate based on the certificate attribute, and update the expired digital certificate to a target digital certificate by adopting the updating method through a code injection method.

9. A computing device, characterized in that include: A memory for storing executable instructions; A processor, configured to read and execute the executable instructions stored in the memory to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor, the processor is enabled to execute the method according to any one of claims 1 to 7.

Images