SSL / TLS digital certificate health degree intelligent scoring system and method based on multi-dimensional weighting model

Abstract

The invention relates to the technical field of network security, and discloses an SSL / TLS digital certificate health degree intelligent scoring system based on a multi-dimensional weighting model, and the system comprises a scoring engine layer which is used for calculating a health degree score based on the data of each dimension and the weight of the data, and judging a health degree grade; and the intelligent analysis layer is used for diagnosing safety problems and generating improvement suggestions. According to the SSL / TLS certificate security state evaluation method, a weighting model covering five dimensions of encryption strength, validity period, configuration, deployment and compliance is constructed, so that comprehensive and quantitative evaluation of the SSL / TLS certificate security state is realized; a 0-100 score credit score mechanism and a four-level grading system are adopted, so that the security situation is clear at a glance; through a grading alarm mechanism based on comprehensive health degree changes and key indexes, risks can be actively found; and the root cause of the safety problem can be automatically diagnosed, and specific and operable improvement suggestions with priorities are provided, so that the operation and maintenance difficulty and the dependence on professionals are remarkably reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to an SSL / TLS digital certificate health degree intelligent scoring system and method based on a multi-dimensional weighted model. BACKGROUND

[0002] SSL / TLS digital certificates are the core elements of ensuring the security of HTTPS communication of websites. At present, the security management of SSL / TLS certificates mainly relies on a variety of independent tools, for example, server configuration scoring tools provided by SSL Labs and the like, which mainly evaluate server-side configurations such as protocol versions and encryption suites, and give letter grades; certificate validity detection tools, which are used to check whether the certificate is expired and whether the certificate chain is complete; certificate management platforms (such as Qualys CertView), which are used to monitor the expiration time of the certificate; and various security scanning tools, which are used to detect known SSL / TLS vulnerabilities.

[0003] However, the prior art has the following significant defects: 1. Lack of comprehensive health degree evaluation system: the existing tools each focus on a single dimension (such as configuration or validity period), lack unified and quantitative comprehensive evaluation indexes, and cannot fully reflect the overall security health status of the certificate.

[0004] 2. Evaluation results are not intuitive: the letter grade scoring method is difficult to quantify the specific risk level, and there are too many technical terms, which is not conducive to the quick understanding of the security situation by non-professionals (such as management).

[0005] 3. Insufficient early warning capability: most tools only provide simple expiration reminders, lack of hierarchical early warning mechanism based on comprehensive risk, and cannot predict potential risks.

[0006] 4. Lack of intelligent improvement guidance: after finding problems, there is a lack of specific and operable improvement suggestions, which depend on professional operation and maintenance personnel to interpret, and the improvement priority is not clear.

[0007] 5. Blind area of deployment state monitoring: for CDN multi-node, load balancing and other distributed deployment scenarios, there is a lack of unified monitoring of the consistency and completeness of the certificate deployment.

[0008] 6. Insufficient compliance support: lack of special evaluation and automatic report generation functions for industry standards (such as PCI DSS, etc.). SUMMARY

[0009] The present application aims to provide an SSL / TLS digital certificate health degree intelligent scoring system and method based on a multi-dimensional weighted model to solve the problems raised in the background art.

[0010] To achieve the above object, the present application provides the following technical solutions: A SSL / TLS digital certificate health degree intelligent scoring system based on a multi-dimensional weighting model, comprising: A data collection layer comprising a plurality of detection modules for collecting data of the encryption strength, validity period, configuration correctness, deployment integrity and compliance of the certificate; A scoring engine layer connected with the data collection layer for calculating the health degree score based on the dimensional data and its weight and determining the health degree level; An alarm notification layer connected with the scoring engine layer for triggering a hierarchical alarm and notifying through multiple channels according to the change of the health degree score, the level degradation or the occurrence of critical problems; An intelligent analysis layer connected with the scoring engine layer and the alarm notification layer for diagnosing security problems and generating improvement suggestions; A report generation layer connected with the scoring engine layer and the intelligent analysis layer for automatically generating and exporting a compliance report.

[0011] As a further scheme of the present application, the scoring engine layer comprises: A weighting calculation engine for calculating a preliminary health degree score through a weighted summation algorithm; A veto rule judgment module connected with the weighting calculation engine for judging whether there is a preset veto problem and performing a degradation processing on the preliminary health degree score; A weight dynamic adjustment module for dynamically adjusting the weight according to different industry characteristics or customer needs; A score normalization module for normalizing the processed score to a specified interval; A hierarchical judgment module for dividing the health degree into levels according to the normalized score.

[0012] As a further scheme of the present application, the alarm notification layer comprises: A health degree grading module for automatically dividing the health degree into levels according to the health degree total score; A visual display module for displaying the alarm content through multiple visual display modes; An intelligent alarm triggering module for automatically triggering an alarm according to the health degree change.

[0013] As a further scheme of the present application, the alarm notification layer executes an alarm triggering decision logic, comprising: When the health degree score is monitored to decrease, it is judged whether the decrease amplitude exceeds a first threshold; If the decrease amplitude does not exceed the first threshold, it is further judged whether the health degree level is degraded; If the health level does not downgrade, it is further determined whether there is a preset key problem; If there is a key problem, it is further determined the severity of the key problem; According to the judgment results of the drop amplitude exceeding the threshold, the level downgrade, or the key problem, different levels of alarms are triggered and different combinations of notification channels are selected.

[0014] As a further scheme of the present application, the intelligent analysis layer comprises: A problem diagnosis engine for analyzing the scores of each dimension, identifying and diagnosing existing problems; An intelligent improvement suggestion module for automatically generating improvement suggestions according to the diagnosed problems; An improvement suggestion priority sorting module for priority sorting of the improvement suggestions according to the influencing factors.

[0015] As a further scheme of the present application, the report generation layer comprises: A compliance report template library for pre-storing a plurality of industry compliance report templates; A report content generation module for generating an executive summary, detailed evaluation results, a certificate list, problems and suggestions, and a compliance statement; A multi-format export module for exporting the final report in different formats.

[0016] As a further scheme of the present application, the report generation layer further comprises a historical data analysis and trend display module; wherein the historical data analysis and trend display module comprises a health degree historical record unit, a trend analysis unit, and a predictive analysis unit, wherein, The health degree historical record unit regularly collects and records the certificate health degree data; The trend analysis unit performs trend analysis based on the historical data; The predictive analysis unit performs prediction based on the historical data.

[0017] A SSL / TLS digital certificate health degree intelligent scoring method based on a multi-dimensional weighted model, comprising the following steps: S1, collecting multi-dimensional security data of the certificate through the data collection layer; S2, calculating the health degree score and determining the level through the scoring engine layer, wherein after the weighted calculation, it is determined whether there is a "veto" problem and the score is processed accordingly; S3, triggering hierarchical alarms according to the decision logic including the drop amplitude, the level downgrade, and the key problem through the alarm notification layer; S4, diagnosing problems and generating priority-sorted improvement suggestions through the intelligent analysis layer; S5, automatically generating and exporting a compliance report through the report generation layer.

[0018] Compared with the prior art, the present application has the following beneficial effects: The present application realizes comprehensive and quantitative evaluation of the security state of SSL / TLS certificates by constructing a weighted model covering five dimensions of encryption strength, validity period, configuration, deployment and compliance, and fills the industry gap. By adopting a credit score mechanism of 0-100 points and a four-level grading system, the security situation is clear at a glance, and the management threshold is greatly reduced. Through a hierarchical alarm mechanism based on comprehensive health degree change and key indicators, risks can be actively discovered, passive response can be changed to active prevention, and the root cause of security problems can be automatically diagnosed, and specific, operable and prioritized improvement suggestions can be provided, significantly reducing the difficulty of operation and maintenance and the dependence on professionals. BRIEF DESCRIPTION OF DRAWINGS

[0019] Figure 1 It is a framework structure schematic diagram of a SSL / TLS digital certificate health degree intelligent scoring system based on a multi-dimensional weighted model. Figure 2 It is a health degree scoring process schematic diagram in a SSL / TLS digital certificate health degree intelligent scoring system based on a multi-dimensional weighted model. Figure 3 It is a structure schematic diagram of a multi-dimensional radar in a SSL / TLS digital certificate health degree intelligent scoring system based on a multi-dimensional weighted model. Figure 4 It is a hierarchical alarm triggering decision tree schematic diagram in a SSL / TLS digital certificate health degree intelligent scoring system based on a multi-dimensional weighted model. Figure 5 It is a compliance report generation process schematic diagram in a SSL / TLS digital certificate health degree intelligent scoring system based on a multi-dimensional weighted model. DETAILED DESCRIPTION

[0020] Please refer to Figures 1 to 5 In the embodiment of the present application, a SSL / TLS digital certificate health degree intelligent scoring system based on a multi-dimensional weighted model comprises: The data acquisition layer comprises a plurality of detection modules for acquiring data of the encryption strength, validity period, configuration correctness, deployment integrity and compliance of the certificate; for example, the encryption strength dimension data is acquired by the encryption strength detection module, and the data includes: (1) TLS protocol version support, such as TLS 1.3, TLS 1.2, TLS 1.1, TLS 1.0; (2) Encryption suite configuration, such as strong encryption suite, weak encryption suite, and unsafe suite; (3) Key length, such as RSA 2048 / 4096 bits, ECC 256 / 384 bits, etc.; (4) Signature algorithms, such as SHA-256, SHA-384, SHA-1, MD5, etc.; (5) Forward secrecy support, such as Perfect Forward Secrecy; (6) Key exchange algorithm strength; The certificate validity period detection module collects certificate validity period data, which includes: certificate issuance date, certificate expiration date, remaining validity days, and total certificate validity period length. The configuration correctness detection module collects configuration correctness dimension data, namely, the correctness data of certificate and server configuration, which includes: (1) OCSP Stapling enabled status, such as whether OCSP stapling is enabled to improve verification performance; (2) HSTS configuration correctness, such as whether the HTTP strict transport security configuration is correct and whether the max-age is long enough. (3) Certificate chain integrity, such as whether intermediate certificates are fully configured; (4) CAA record configuration, such as whether the DNS CAA records are configured correctly; (5) CT log transparency, such as whether the certificate transparency log is being recorded correctly; (6) Certificate matching, such as whether the certificate domain name matches the actual domain name used; (7) SAN configuration, such as whether the Subject Alternative Name is configured correctly; The deployment integrity detection module collects deployment integrity dimension data, namely, data on the deployment status of certificates throughout the infrastructure. This data includes: (1) Multi-node deployment detection, such as detecting the deployment status of certificates on all CDN nodes, load balancers, and servers; (2) Version consistency detection, such as checking whether all nodes are using the same version of the certificate; (3) Coverage statistics, such as the number of locations where certificates should be deployed and the number of locations where they have actually been deployed; The compliance detection module collects compliance-related data, specifically whether the certificate complies with industry security standards and best practices. This data includes: (1) Industry standard compliance, such as whether it complies with the requirements of PCI DSS, Information Security Protection 2.0, GDPR and other standards; (2) Security scan pass status, such as whether it has passed a third-party security scan (e.g., SSL Labs Level A or above); (3) Detection of known vulnerabilities, such as whether there are known SSL / TLS vulnerabilities (Heartbleed, POODLE, ROBOT, etc.). (4) Encryption algorithm compliance, such as whether it uses encryption algorithms recommended by the state or industry; (5) Key length compliance: Whether the key length meets the compliance requirements; The scoring engine layer, connected to the data acquisition layer, is used to calculate a health score based on data from various dimensions and their weights, and to determine the health level. For example, the weight of encryption strength is set to 30%. Taking TLS 1.3, TLS 1.2, TLS 1.1, and TLS 1.0 as examples, the scoring rules are as follows: (1) TLS 1.3 support: Score: 100 points (2) TLS 1.2 + strong encryption suite + no weak encryption: score 80 points. (3) TLS 1.2+ has weak encryption suites: score 50 points. (4) TLS 1.0 / 1.1 or has a serious vulnerability: score 0 points; If the validity period is set to have a weight of 25%, the scoring rules are as follows, taking the remaining valid days as an example: (1) Certificate expired (remaining days < 0): Score is 0. (2) Emergency State (0 ≤ Remaining Days < 7): Score: 20 points (3) High-risk status (7 ≤ remaining days < 30): Score is 50 points. (4) Medium risk status (30 ≤ remaining days < 60): Score is 80 points. (5) Low-risk status (60 ≤ remaining days < 90): Score is 95 points. (6) Safe status (remaining days ≥ 90): score 100 points; The configuration weight is 20%; taking OCSP Stapling enabled status, HSTS configuration correctness (such as whether HTTP strict transport security configuration is correct), certificate chain integrity, CAA record configuration, CT log transparency, certificate matching, and SAN configuration as examples, a total of seven configuration items are scored as follows: Configuration score = (Number of items passed / Total number of items checked) × 100; in, (1) All 7 checks passed: score 100 points. (2) Passed 5 items, failed 2 items: score 71 points. (3) Passed 3 items, failed 4 items: score 43 points; The deployment detection has a weight of 15%; taking a node as an example, the scoring rules are as follows: (1) All nodes are deployed and consistent: score 100 points (2) Some nodes have been deployed (over 80%): Score: 80 points (3) Some nodes have been deployed (50-80%): 60 points (4) Deployment only on the main server: 30 points (5) Nodes not deployed or with inconsistent versions exist: points will be deducted accordingly; Compliance has a weight of 10%; taking five configuration items as an example: industry standard compliance, security scan pass rate, known vulnerability detection, encryption algorithm compliance, and key length compliance; the scoring rules are as follows: Compliance score = (Number of compliant items / Total number of compliance checks) × 100 in, (1) Serious security vulnerabilities exist: score drops to 0. (2) High-risk configuration errors exist: deduct 30-50 points. (3) Failure to meet mandatory industry standards: Deduct 20-40 points; The Health Score is calculated as follows: Encryption Strength Score × 0.30 + Validity Period Score × 0.25 + Configuration Score × 0.20 + Deployment Score × 0.15 + Compliance Score × 0.10. The rating engine layer includes: The weighted calculation engine is used to calculate the initial health score using a weighted summation algorithm; The veto rule judgment module, connected to the weighted calculation engine, is used to determine whether a preset veto issue exists and, based on that determination, whether to downgrade the initial health score. A veto is applied to the following serious issues: (1) Certificate expired: Total score drops to 0; (2) Serious security vulnerabilities exist (such as Heartbleed not being patched): Total score drops to 0-20 points; (3) Certificate is not trusted (self-signed or CA is not trusted): Total score drops to 0; (4) Using obsolete protocols (SSL 2.0 / 3.0): Total score drops to 0-10 points; The dynamic weight adjustment module is used to dynamically adjust weights based on different industry characteristics or customer needs. For example, in the financial industry, the compliance weight is increased to 20%, and the deployment weight is decreased to 5%; in the e-commerce industry, the encryption strength weight is increased to 35%, while other dimensions remain unchanged; in government systems, the compliance weight is increased to 25%, and the encryption strength weight is increased to 35%. The score normalization module is used to normalize the processed scores to a specified range, such as 0-100; score range rules: Lower limit handling: When the calculated score is less than 0, the final score will be forcibly set to 0. Upper limit handling: When the calculated score is greater than 100 points, the final score will be forcibly set to 100 points; Normal range: When the calculated score is between 0 and 100, the original score remains unchanged; The grading module is used to classify health status into four levels based on the normalized score, such as excellent, good, warning, and dangerous.

[0021] The alarm notification layer, connected to the scoring engine layer, is used to trigger tiered alarms and notify users through multiple channels based on changes in health scores, level downgrades, or the occurrence of critical issues. The alarm notification layer includes: The health level grading module automatically categorizes health levels based on the total health score. For example, four levels can be defined as follows: (1) Excellent level (90-100 points): Color: Green; Status: Security configuration meets best practice standards; Action: Maintain current configuration and perform routine monitoring as scheduled; (2) Good grade (70-89 points): Color: Blue Status: Basic safety requirements have been met, but there is still room for improvement; Action: Develop an optimization plan to gradually improve the safety level; (3) Warning level (50-69 points): Color: Yellow; Status: Security issues requiring attention exist; Action: Schedule immediate remediation to prevent escalation of risks; (4) Hazard level (0-49 points): Color: Red; Status: Facing a serious security threat or compliance violation; Action: Take immediate emergency measures to rectify the situation; This four-level classification system uses color coding and icons to intuitively display the security status of certificates, providing users at different levels with a clear understanding of risks and clear handling guidelines. The visualization module is used to display alarm content through various visualization methods, including: (1) Instrument panel display: A circular or semi-circular instrument panel with a score of 0 to 100 is used, and different colors are displayed according to the score range to intuitively show the current health level; (2) Radar chart display: such as Figure 3 As shown, a radar chart with five dimensions is used to clearly display the scores in each dimension and quickly identify weak points; (3) Trend chart display: A time series line chart is used to display the historical changes in health score and to help evaluate the effectiveness of safety improvements; (4) Alarm badges: Health badges are displayed in the certificate list and color coding is used to quickly identify the risk level. They can be filtered and sorted by health level. The intelligent alarm triggering module is used to automatically trigger alarms based on changes in health status; the alarm triggering conditions are as follows: (1) Health score drops by more than 10 points; (2) The health level is downgraded, such as from good to warning; (3) Key dimension scores are below the threshold, such as validity period score < 50; (4) A new security vulnerability or configuration error has been detected; Alarm notification methods: (1) Email notification (supports custom recipients); (2) SMS alert (high-risk situation); (3) Webhook push (integrated into enterprise IM system); (4) In-system message center reminders.

[0022] like Figure 4 As shown, the alarm notification layer executes the alarm triggering decision logic, including: When a decrease in health score is detected, it is determined whether the decrease exceeds the first threshold; for example, whether the decrease in health score exceeds 10 points. If the decrease does not exceed the first threshold, further determine whether the health level has been downgraded; for example, determine whether the health level has dropped from "good" to "warning". If the health level does not decline, then further determine whether there are any preset key issues; for example, the key issue of the preset key issues is a key dimension. If critical issues are found, the severity of the critical issues will be further assessed, such as a validity period score of <50; or the detection of new security vulnerabilities or configuration errors. Based on the assessment results of a decline exceeding a threshold, a downgrade in alert level, or a critical issue, different levels of alarms are triggered, and different combinations of notification channels are selected, such as email notifications, SMS alarms, webhook push notifications, or in-system message center alerts; among them, Key issues include expired certificates, serious vulnerabilities, and configuration errors. The system triggers different levels of alerts based on the severity of the key issues. Among them, expired certificates and serious vulnerabilities trigger the highest level alerts and are notified through all channels, including SMS, email, and Webhook.

[0023] The intelligent analysis layer, connected to the scoring engine layer and the alarm notification layer, is used to diagnose security issues and generate improvement suggestions; The intelligent analysis layer includes: The problem diagnosis engine is used to analyze scores across various dimensions to identify and diagnose existing problems, as follows: (1) Encryption strength dimension diagnosis: Triggering condition: Encryption strength score < 80 points; Specific problem diagnosis: ① TLS 1.3 is not enabled; Severity: High; Impact: Unable to use the latest security features; ② Weak encryption suite exists: Severity: High risk; Impact: May be vulnerable to encryption downgrade attacks; (2) Diagnosis based on certificate validity period: Triggering condition: Validity period score < 80 points; Specific problem diagnosis: ① Certificate is about to expire; Severity: dynamically determined based on the remaining days; Remaining days < 30 days: Severe; Remaining days ≥ 30 days: Moderate; Problem Description: The certificate will expire in N days; Impact: May cause service interruption and security warnings; (3) Configuration correctness dimension diagnosis: Triggering condition: Configuration score < 80 points; Specific problem diagnosis: ①OCSP Stapling is not enabled; Severity: Low risk; Impact description: Poor certificate verification performance; ②HSTS not configured; Severity: Medium risk; Impact: Users may be vulnerable to downgrade attacks; (4) Deployment integrity dimension diagnosis: Triggering condition: Deployment score < 80 points; Specific problem diagnosis: ① Incomplete node certificate deployment; Severity: High risk; Problem description: N nodes have not deployed certificates; Impact: Some services may be insecure; (5) Compliance dimension diagnosis: Triggering condition: Compliance score < 80 points; Specific problem diagnosis: ① Severity of non-compliance with industry safety standards: High risk. Impact description: May fail compliance audit. The intelligent improvement suggestion module is used to automatically generate improvement suggestions based on the diagnosed problems. The suggestion generation process is sorted according to the problem priority: such as sorting by severity in descending order: severe > high risk > medium risk > low risk; or sorting by severity weight value: severe > high risk > medium risk > low risk. Each improvement suggestion includes seven elements: priority, specific problem, improvement suggestion, operational steps, reference documents, estimated time, and difficulty level; among which, (1) The steps for enabling TLS 1.3 are as follows: S11: Check server software version requirements; S12: Update the configuration file to enable TLS 1.3; S13: Restart the service to verify that the changes have taken effect; S14: Verify the configuration using professional tools; Its reference document is: Mozilla Server Security TLS Guide; (2) The steps for handling weak encryption packages are as follows: S21: Disable insecure algorithms (RC4, 3DES, CBC mode); S22: Enable strong encryption algorithms (AES-GCM, ChaCha20-Poly1305); S23: Ensure forward confidentiality; S24: Restart to verify configuration; Its reference document: Crypto Suite Information Base; (3) The steps for the emergency certificate renewal procedure are as follows: S31: Apply to the CA for a renewal of the visa certificate; S32: Download the certificate chain file; S33: Test environment verification; S34: Production environment deployment; S35: Full node update verification; Its emergency status is indicated when the remaining days are less than 7 days. (4) The steps for configuring the HSTS are as follows: S41: Add HSTS response header; S42: Set validity period (≥1 year); S43: Consider subdomain inclusion; S44: Restart verification for the changes to take effect; Its reference document: HSTS preloaded website; (5) The steps of the distributed deployment scheme are as follows: S51: Confirm the node list; S52: Prepare certificate materials; S53: Batch deployment operation; S54: Node-by-node verification; S55: Establish a synchronization mechanism; Its reference document: Certificate Batch Deployment Guide; (6) The steps of the compliance rectification plan are as follows: S61: Research Standard Requirements; S62: Gap analysis and comparison; S63: Priority rectification; S64: Retest and verify; S65: Document archiving for future reference; Its reference document: Industry Compliance Configuration Guide; The improvement suggestion prioritization module is used to prioritize improvement suggestions based on influencing factors. For example, improvement suggestions can be prioritized based on the following influencing factors. (1) Severity (highest weight): critical > high > medium > low; (2) Scope of impact: Global problems > Local problems; (3) Urgency level: Soon to expire > Long-term optimization; (4) Improvement difficulty: Prioritize simple and quick methods; (5) Expected benefits: Prioritize those that significantly improve the total score; The final result is an improvement list with priority numbers.

[0024] The report generation layer, connected to the scoring engine layer and the intelligent analysis layer, is used to automatically generate and export compliance reports; The report generation layer includes: A compliance report template library, used to pre-store various industry compliance report templates, such as: (1) PCI DSS Compliance Report: for payment card industry standards; (2) Compliance report for Information Security Level Protection 2.0: for China's Information Security Level Protection; (3) GDPR compliance report: for EU data protection regulations; (4) SOC 2 compliance report: for service organization controls; (5) Custom templates: Supports user-defined report formats; The report content generation module is used to generate an execution summary, detailed assessment results, a certificate list, issues and recommendations, and a compliance statement. The execution summary includes: overall health score and level, summary of key findings, overview of compliance status, and major risk points. Detailed evaluation results include: score details for each dimension, pass / fail status for specific test items, basic certificate information, and configuration details; The certificate list includes: a complete list of certificates and their health status, certificate attribute information, and a list of deployment locations; The issues and suggestions include: a list of identified issues, a list of improvement suggestions, and a ranking of rectification priorities; The compliance statement includes: the compliance standards and provisions that have been met, the provisions that have not been met and the reasons for non-compliance, and a timeline for improvement plans; The multi-format export module is used to export the final report in different formats, such as PDF, Word, Excel, or HTML. Historical data analysis and trend display module; The historical data analysis and trend display module consists of a health history record unit, a trend analysis unit, and a predictive analysis unit. The health history record unit collects and records certificate health data regularly (e.g., daily), such as overall health score, scores for each dimension, pass status of test items, and alarm records. The trend analysis unit performs trend analysis based on historical data, such as... Scoring trend: Displays the curve of health status changing over time; Dimensional comparison: Compare the improvements across each dimension; Problem statistics: Statistics on the frequency of occurrence of different types of problems; Evaluation of Improvement Effectiveness: Quantifying the effectiveness of improvement measures; The predictive analytics unit makes predictions based on historical data, and the predictions include: Predict the impact of certificate expiration time on health score; Predict potential future configuration issues; We recommend the best time to renew your certificate.

[0025] A smart scoring method for the health of SSL / TLS digital certificates based on a multi-dimensional weighted model includes the following steps: S1. Collect multi-dimensional security data of the certificate through the data acquisition layer; S2. Calculate the health score and determine the level through the scoring engine layer. After weighted calculation, determine whether there is a "one-vote veto" problem and process the score accordingly. S3. Through the alarm notification layer, trigger tiered alarms based on decision logic including the magnitude of the decrease, the level of degradation, and key issues; If the health score drops by more than 10 points, an alarm will be triggered. If the decrease is less than 10 points but the health level is downgraded, an alarm will be triggered; If neither of the above occurs but a critical issue is detected, an alarm will be triggered based on the severity of the critical issue. S4. Diagnose problems through the intelligent analysis layer and generate priority-based improvement suggestions; S5. Automatically generate and export compliance reports through the report generation layer; For example, the input data for an e-commerce website's SSL certificate evaluation is as follows: TLS version: TLS 1.2 (supports strong encryption suites); Remaining validity period: 45 days; OCSP Stapling: Not enabled; HSTS: Configured; Certificate chain: Complete; CAA record: Not configured; CT log: Normal; Deployment status: Main server + 3 CDN nodes, of which 1 CDN node has an inconsistent certificate version; Compliance test: Passes the basic PCI DSS requirements, but there is a low-risk configuration issue. I. Scoring Calculation Process: (1) Encryption strength dimension score (weight 30%): TLS 1.2 + strong encryption suite: 80 points; therefore, the dimension score = 80 points; (2) Validity period dimension score (weight 25%): 45 days remaining, which falls within the 30-60 day range: 80 points; dimension score = 80 points; (3) Configuration dimension score (weight 20%): Check items: OCSP Stapling: not enabled; HSTS: configured; certificate chain: complete; CAA record: not configured; CT log: normal; certificate matching: normal; SAN configuration: normal; then the pass rate = 5 / 7 = 71.4%; dimension score = 7 points; (4) Deployment dimension score (weight 15%): There are a total of 4 nodes, 3 nodes have the same certificate, and 1 node has a different version; deployment coverage = 75%; if there is a version inconsistency problem, 10 points will be deducted, and the dimension score = 75-10=65 points; (5) Compliance dimension score (weight 10%): Inspection items: meet the basic requirements of PCI DSS; pass the security scan; if there is 1 low-risk configuration problem, deduct 5 points, dimension score = 100-5=95 points; The overall score is then calculated as follows: Total health score = Encryption strength (80) × 0.30 + Validity period (80) × 0.25 + Configuration (71) × 0.20 + Deployment (65) × 0.15 + Compliance (95) × 0.10 = 24.0 + 20.0 + 14.2 + 9.75 + 9.5 = 77.45 ≈ 78 points; Health level: Good (70-89 points, marked in blue); II. Suggestions for improvement: (1) Priority 1 (Medium): Certificate renewal; Issue: Certificate will expire in 45 days; Recommendation: Complete the certificate renewal within the next 2 weeks; Estimated time: 1-2 hours; (2) Priority 2 (High): Unify CDN node certificates; Problem: Inconsistent certificate versions on one CDN node; Recommendation: Deploy the latest certificate on all CDN nodes; Estimated time: 30-60 minutes (3) Priority 3 (low): Enable OCSP Stapling; Problem: OCSP Stapling is not enabled; Recommendation: Enable OCSP stapling in the server configuration; Estimated time: 15-30 minutes (4) Priority 4 (low): Configure CAA record; Problem: DNS CAA record not configured; Recommendation: Add CAA record in DNS to restrict CA; Estimated time: 10-20 minutes; III. Expected Improvement Results: After all improvements are completed, the health score is expected to rise to over 90 points, reaching the "Excellent" level.

[0026] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A multi-dimensional weighted model based SSL / TLS digital certificate health intelligent scoring system, characterized in that, The system comprises: a data collection layer comprising a plurality of detection modules for collecting data on the encryption strength, validity period, configuration correctness, deployment integrity and compliance of the certificate; a scoring engine layer connected to the data collection layer for calculating a health score based on the dimension data and its weight, and determining the health level; an alarm notification layer connected to the scoring engine layer for triggering a hierarchical alarm and notifying through multiple channels according to the change of the health score, the downgrade of the level or the occurrence of a key problem; an intelligent analysis layer connected to the scoring engine layer and the alarm notification layer for diagnosing security problems and generating improvement suggestions; a report generation layer connected to the scoring engine layer and the intelligent analysis layer for automatically generating and exporting a compliance report.

2. The SSL / TLS digital certificate health degree intelligent scoring system based on a multi-dimensional weighted model according to claim 1, characterized in that, The scoring engine layer comprises: a weighted calculation engine for calculating a preliminary health score by a weighted summation algorithm; a veto rule judgment module connected to the weighted calculation engine for judging whether there is a preset veto problem and whether to downgrade the preliminary health score; a weight dynamic adjustment module for dynamically adjusting the weight according to different industry characteristics or customer needs; a score normalization module for normalizing the processed score to a specified interval; a hierarchical judgment module for dividing the health level according to the normalized score.

3. The SSL / TLS digital certificate health intelligent scoring system based on a multi-dimensional weighted model of claim 1, wherein, The alarm notification layer comprises: a health level grading module for automatically dividing the health level according to the health score; a visual display module for displaying the alarm content through various visual display methods; an intelligent alarm triggering module for automatically triggering an alarm according to the change of the health score.

4. The SSL / TLS digital certificate health intelligent scoring system based on a multi-dimensional weighted model of claim 3, wherein, The alarm notification layer executes an alarm triggering decision logic, which comprises: when the health score is monitored to decrease, it is judged whether the decrease amplitude exceeds a first threshold value; if the decrease amplitude does not exceed the first threshold value, it is further judged whether the health level is downgraded; if the health level is not downgraded, it is further judged whether there is a preset key problem; if there is a key problem, it is further judged the severity of the key problem; according to the judgment results of the decrease amplitude exceeding the threshold value, the level downgrade or the key problem, different levels of alarms are triggered and different combinations of notification channels are selected.

5. The SSL / TLS digital certificate health intelligent scoring system based on multi-dimensional weighted model of claim 1, wherein, The intelligent analysis layer comprises: a problem diagnosis engine for analyzing the dimension scores to identify and diagnose existing problems; an intelligent improvement suggestion module for automatically generating improvement suggestions according to the diagnosed problems; an improvement suggestion priority sorting module for sorting the improvement suggestions according to the influencing factors.

6. The SSL / TLS digital certificate health intelligent scoring system based on multi-dimensional weighted model of claim 1, wherein, The report generation layer comprises: a compliance report template library for pre-storing a plurality of industry compliance report templates; a report content generation module for generating an executive summary, detailed evaluation results, a certificate list, problems and suggestions, and a compliance statement; a multi-format export module for exporting the final report in different formats.

7. The SSL / TLS digital certificate health intelligent scoring system based on multi-dimensional weighted model of claim 1, wherein, The report generation layer further comprises a historical data analysis and trend display module, wherein the historical data analysis and trend display module comprises a health history recording unit, a trend analysis unit and a predictive analysis unit, wherein: the health history recording unit periodically collects and records the certificate health data; the trend analysis unit analyzes the historical data to find the trend of the health score; the predictive analysis unit analyzes the historical data to predict the future trend of the health score. The trend analysis unit performs trend analysis based on historical data; The predictive analysis unit performs prediction based on historical data.

8. A method for implementing the SSL / TLS digital certificate health intelligent scoring system based on the multi-dimensional weighted model according to any one of claims 1-7, characterized in that, The process includes the following steps: S1, collecting multi-dimensional security data of the certificate through the data collection layer; S2, calculating the health score and determining the level through the scoring engine layer, wherein after weighted calculation, it is judged whether there is a "veto" problem and the score is processed accordingly; S3, triggering hierarchical alarm through the alarm notification layer according to the decision logic including the decline amplitude, level degradation and key problems; S4, diagnosing problems and generating priority-ordered improvement suggestions through the intelligent analysis layer; S5, automatically generating and exporting compliance reports through the report generation layer.

Images