Digital certificate synchronization method, device and electronic device

Abstract

The present invention discloses a method, device and electronic device for synchronizing a digital certificate. The method relates to the field of information security, and comprises: periodically acquiring characteristic information of a digital certificate on at least one target device, wherein the target device is at least used to perform a target computing task, and the target computing task is a task that requires a digital certificate; based on the characteristic information and the target characteristic information corresponding to the target digital certificate, determining an abnormal target device from at least one target device, wherein the target digital certificate is a certificate sent by the current platform to at least one target device; synchronizing the target digital certificate to the abnormal target device. The present invention solves the technical problem of different certificate versions existing in the prior art when synchronizing digital certificates to multiple related devices.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a method, device and electronic equipment for synchronizing a digital certificate. Background Art

[0002] With the popularization of mobile Internet and the development of related technologies, encrypted HTTPS (Hypertext Transfer Protocol Secure) sites have become mainstream. To use HTTPS, enterprises need to use digital certificates issued by trusted third-party authorities (such as CA (Certificate Authority) institutions) that need to be regularly updated for enterprise identity verification, data signature, data encryption and other operations. The encryption and decryption process of digital certificates requires a large number of complex asymmetric algorithm operations, and has very high requirements for device performance. In the popularization of mobile Internet, the number of users is huge, so a large number of certificate computing devices are needed to handle certificate computing needs in a distributed manner.

[0003] Digital certificates are the core security assets of an enterprise site. Digital certificates are equivalent to the identity proof of an enterprise website. If an enterprise digital certificate is leaked, the enterprise site will be counterfeited, causing losses to enterprise users. At present, most enterprises use certificate management and maintenance personnel to obtain digital certificates on local work computers and then manually upload them to the certificate computing devices one by one. During the certificate synchronization process, the administrator may have improper operations or equipment or network problems, resulting in inconsistent certificates on multiple devices, which in turn causes problems for some users to access the site.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present invention provide a method, an apparatus and an electronic device for synchronizing digital certificates, so as to at least solve the technical problem of different certificate versions existing in the prior art when synchronizing digital certificates to multiple related devices.

[0006] According to one aspect of an embodiment of the present invention, a method for synchronizing a digital certificate is provided, comprising: periodically acquiring characteristic information of a digital certificate on at least one target device, wherein the target device is at least used to execute a target computing task, the target computing task being a task requiring a digital certificate; determining an abnormal target device from at least one target device based on the characteristic information and target characteristic information corresponding to the target digital certificate, wherein the target digital certificate is a certificate sent by the current platform to the at least one target device; and synchronizing the target digital certificate to the abnormal target device.

[0007] Furthermore, the digital certificate synchronization method also includes: performing information digest calculation on each characteristic information to obtain a first information digest value corresponding to each characteristic information; obtaining a second information digest value, wherein the second information digest value is obtained by performing information digest calculation on the target characteristic information; determining that the characteristic information corresponding to the first information digest value different from the second information digest value is abnormal characteristic information, and determining that the target device corresponding to the abnormal characteristic information is an abnormal target device.

[0008] Furthermore, the digital certificate synchronization method also includes: obtaining a target digital certificate before periodically obtaining characteristic information of a digital certificate on at least one target device; encrypting the target digital certificate based on a target public key to obtain an encrypted target digital certificate; segmenting the encrypted target digital certificate to obtain a plurality of target digital certificate fragments; performing hash calculation on each target digital certificate fragment to obtain a hash value corresponding to each target digital certificate fragment; storing the plurality of hash values ​​in a distributed manner in a first storage area, storing the target private key corresponding to the target public key in a second storage area, and deleting the target digital certificate from the current platform.

[0009] Furthermore, the digital certificate synchronization method also includes: after obtaining the target digital certificate, determining the target characteristic information corresponding to the target digital certificate; performing information summary calculation on the target characteristic information to obtain a second information summary value, and storing the second information summary value in a third storage area.

[0010] Furthermore, the digital certificate synchronization method also includes: after deleting the target digital certificate from the current platform, responding to the certificate issuance instruction sent by the target object, obtaining multiple hash values ​​from the first storage area, and obtaining the target private key from the second storage area; determining the target digital certificate based on the multiple hash values ​​and the target private key; and sending the target digital certificate to at least one target device.

[0011] Furthermore, the digital certificate synchronization method also includes: obtaining multiple hash values ​​from the first storage area; determining the encrypted target digital certificate based on the multiple hash values; obtaining the target private key from the second storage area; decrypting the encrypted target digital certificate based on the target private key to obtain the target digital certificate; and synchronizing the target digital certificate to the abnormal target device.

[0012] Furthermore, the digital certificate synchronization method further includes: before synchronizing the target digital certificate to the abnormal target device, prohibiting the abnormal target device from executing the target computing task.

[0013] Furthermore, the digital certificate synchronization method also includes: determining a time range for updating the target digital certificate based on the target characteristic information; and obtaining an updated target digital certificate from a target certificate authority when the current time is within the time range for updating.

[0014] According to another aspect of an embodiment of the present invention, a digital certificate synchronization device is also provided, including: a first acquisition module, used to periodically acquire characteristic information of a digital certificate on at least one target device, wherein the target device is at least used to execute a target computing task, and the target computing task is a task that requires a digital certificate; a first determination module, used to determine an abnormal target device from at least one target device based on the characteristic information and target characteristic information corresponding to the target digital certificate, wherein the target digital certificate is a certificate sent by the current platform to at least one target device; and a synchronization module, used to synchronize the target digital certificate to the abnormal target device.

[0015] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the above-mentioned digital certificate synchronization method when running.

[0016] According to another aspect of an embodiment of the present invention, an electronic device is also provided, which includes one or more processors; a memory for storing one or more programs, so that when the one or more programs are executed by the one or more processors, the one or more processors are implemented to run the programs, wherein the programs are configured to execute the above-mentioned digital certificate synchronization method when running.

[0017] In an embodiment of the present invention, a method of resynchronizing the digital certificate of an abnormal target device among multiple target devices is adopted, by periodically acquiring characteristic information of the digital certificate on at least one target device, and then determining the abnormal target device from at least one target device based on the characteristic information and the target characteristic information corresponding to the target digital certificate, thereby synchronizing the target digital certificate to the abnormal target device.

[0018] In the above process, by periodically acquiring the characteristic information of the digital certificate on the target device and determining the abnormal target device based on the characteristic information, the digital certificate is periodically checked, so that the abnormal target device can be discovered in time. Furthermore, by synchronizing the target digital certificate to the abnormal target device, the digital certificate in the abnormal target device is effectively updated, thereby ensuring the real-time consistency and real-time validity of the digital certificates between the target devices. In addition, by determining the abnormal target device based on the characteristic information and the target characteristic information corresponding to the target digital certificate, the large amount of data transmission caused by directly acquiring the digital certificate on the target device to determine the abnormal target device and the risk of leakage of the digital certificate during the transmission process are avoided.

[0019] It can be seen that the solution provided by the present application achieves the purpose of resynchronizing the digital certificates of abnormal target devices among multiple target devices, thereby achieving the technical effect of ensuring the consistency of the versions of digital certificates between the target devices, and further solving the technical problem of different certificate versions when synchronizing digital certificates to multiple related devices in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0021] Figure 1 is a schematic diagram of an optional digital certificate synchronization and management system according to an embodiment of the present invention;

[0022] Figure 2 is a schematic diagram of an optional digital certificate synchronization method according to an embodiment of the present invention;

[0023] Figure 3 is an interactive diagram of an optional digital certificate synchronization and management system according to an embodiment of the present invention;

[0024] Figure 4 is a flow chart of an optional digital certificate synchronization method according to an embodiment of the present invention;

[0025] Figure 5 is a schematic diagram of an optional digital certificate synchronization device according to an embodiment of the present invention;

[0026] Figure 6 is a schematic diagram of an optional electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties.

[0030] Example 1

[0031] According to an embodiment of the present invention, an embodiment of a method for synchronizing a digital certificate is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0032] In this embodiment, if Figure 1 As shown, an optional digital certificate synchronization and management system is used as the execution body to execute the aforementioned digital certificate synchronization method, which at least includes a certificate issuance module and a certificate verification module, and may also include a certificate storage module and a certificate synchronization module.

[0033] Figure 2 is a schematic diagram of an optional digital certificate synchronization method according to an embodiment of the present invention, such as Figure 2 As shown, the method comprises the following steps:

[0034] Step S201, periodically obtaining characteristic information of a digital certificate on at least one target device, wherein the target device is at least used to execute a target computing task, and the target computing task is a task that requires a digital certificate.

[0035] Optionally, the characteristic information of the digital certificate on at least one of the multiple target devices can be periodically obtained through the aforementioned certificate verification module. Among them, the aforementioned target device can be a certificate computing device used by the current organization to distributely process certificate computing needs (that is, the aforementioned target computing task), and the certificate computing needs are used to implement the current organization's identity verification, data signature, data encryption and other operations based on digital certificates. Under normal circumstances, the digital certificate in the target device is issued by the digital certificate synchronization and management system in the current organization. Among them, the characteristic information of the aforementioned digital certificate may include the issuer, validity period, and issuance timestamp corresponding to the digital certificate. The aforementioned period can be one hour, one day, one week or other preset time.

[0036] It should be noted that by periodically acquiring the characteristic information of the digital certificate on the target device, on the one hand, the large amount of data transmission caused by directly acquiring the digital certificate on the target device and the risk of leakage of the digital certificate during transmission are avoided. On the other hand, subsequent periodic inspection of the digital certificate is achieved, thereby ensuring the real-time consistency and real-time validity of the digital certificate.

[0037] Step S202: determining an abnormal target device from at least one target device based on the characteristic information and the target characteristic information corresponding to the target digital certificate, wherein the target digital certificate is a certificate sent by the current platform to the at least one target device.

[0038] In step S202, the aforementioned characteristic information can be directly compared with the target characteristic information of the target digital certificate through the certificate verification module, and the target device corresponding to the characteristic information different from the target characteristic information can be determined as an abnormal target device, thereby realizing the verification of the digital certificate in each target device. Optionally, the certificate verification module can also calculate the information summary value of the aforementioned characteristic information, and compare it with the information summary value corresponding to the target characteristic information, so as to screen out the information summary value different from the information summary value corresponding to the target characteristic information, and determine the target device corresponding to the information summary value as an abnormal target device. Among them, the current platform is the aforementioned digital certificate synchronization and management system, and the information summary value corresponding to the target characteristic information can be calculated by the digital certificate synchronization and management system before issuing the certificate to the target device for the first time.

[0039] It should be noted that by determining the abnormal target device based on the characteristic information and the target characteristic information corresponding to the target digital certificate, the abnormal digital certificate can be effectively determined from the digital certificates held by the target device, thereby achieving accurate determination of the abnormal target device.

[0040] Step S203: synchronizing the target digital certificate to the abnormal target device.

[0041] Optionally, when a target device is determined to be an abnormal target device, it can be determined that the certificate verification of the device has failed, that is, it is determined that the device cannot effectively perform certificate calculation. Therefore, the abnormal target device can be resynchronized with the target digital certificate through the certificate issuance module to ensure the validity of the digital certificate in the target device, so that it can provide certificate calculation services normally and successfully carry out the corresponding business process.

[0042] Based on the scheme defined by the above steps S201 to S203, it can be known that in an embodiment of the present invention, a method of resynchronizing the digital certificate of an abnormal target device among multiple target devices is adopted, by periodically obtaining the characteristic information of the digital certificate on at least one target device, and then determining the abnormal target device from at least one target device based on the characteristic information and the target characteristic information corresponding to the target digital certificate, thereby synchronizing the target digital certificate to the abnormal target device.

[0043] It is easy to notice that in the above process, by periodically acquiring the characteristic information of the digital certificate on the target device and determining the abnormal target device based on the characteristic information, the periodic inspection of the digital certificate is realized, so that the abnormal target device can be discovered in time. Furthermore, by synchronizing the target digital certificate to the abnormal target device, the effective update of the digital certificate in the abnormal target device is realized, thereby ensuring the real-time consistency and real-time validity of the digital certificates between the target devices. In addition, by determining the abnormal target device based on the characteristic information and the target characteristic information corresponding to the target digital certificate, the large amount of data transmission caused by directly acquiring the digital certificate on the target device to determine the abnormal target device and the risk of leakage of the digital certificate during the transmission process are avoided.

[0044] It can be seen that the solution provided by the present application achieves the purpose of resynchronizing the digital certificates of abnormal target devices among multiple target devices, thereby achieving the technical effect of ensuring the consistency of the versions of digital certificates between the target devices, and further solving the technical problem of different certificate versions when synchronizing digital certificates to multiple related devices in the prior art.

[0045] In an optional embodiment, in the process of determining an abnormal target device from at least one target device based on the characteristic information and the target characteristic information corresponding to the target digital certificate, the digital certificate synchronization and management system may perform information digest calculation on each characteristic information, obtain a first information digest value corresponding to each characteristic information, and then obtain a second information digest value, thereby determining that the characteristic information corresponding to the first information digest value different from the second information digest value is abnormal characteristic information, and determining that the target device corresponding to the abnormal characteristic information is an abnormal target device. The second information digest value is obtained by performing information digest calculation on the target characteristic information.

[0046] Optionally, in this embodiment, the certificate verification module can perform information digest calculation on each characteristic information, obtain the first information digest value corresponding to each characteristic information, and compare it with the information digest value (i.e., the second information digest value) corresponding to the originally issued digital certificate (i.e., the target digital certificate), thereby determining the abnormal characteristic information and then determining the abnormal target device. Among them, the aforementioned second information digest value can be stored in the third storage area, and the third storage area can be a storage area in the digital certificate synchronization and management system, specifically, it can be a storage area in the certificate synchronization module.

[0047] It should be noted that by comparing information summary values ​​to determine abnormal target devices, the amount of data in the information comparison process can be reduced, thereby improving the comparison efficiency and further improving the efficiency of determining abnormal target devices.

[0048] In an optional embodiment, before periodically obtaining characteristic information of a digital certificate on at least one target device, the digital certificate synchronization and management system may obtain the target digital certificate, and then encrypt the target digital certificate based on the target public key to obtain an encrypted target digital certificate, and then segment the encrypted target digital certificate to obtain multiple target digital certificate fragments, and perform hash calculation on each target digital certificate fragment to obtain a hash value corresponding to each target digital certificate fragment, thereby distributing and storing the multiple hash values ​​in a first storage area, storing the target private key corresponding to the target public key in a second storage area, and deleting the target digital certificate from the current platform.

[0049] Optionally, a method for issuing a target digital certificate to a target device before verifying the consistency of the certificate of the target device is described. Figure 3 As shown, the certificate synchronization module can first apply for a target digital certificate from a trusted third-party authority (such as a CA organization) and obtain the target digital certificate issued by the organization. After that, the certificate synchronization module can send the target digital certificate to the certificate storage module, and then the certificate storage module encrypts, segments and performs hash calculations on the target digital certificate, and then stores the hash values ​​in a distributed heterogeneous storage. Among them, the aforementioned trusted third-party authority is the target certificate issuing authority in this application.

[0050] Specifically, after the certificate synchronization module sends the target digital certificate to the certificate storage module, the certificate synchronization module can delete the target digital certificate from the certificate synchronization module to prevent the risk of the target digital certificate being leaked or maliciously tampered with in the certificate synchronization module due to intentional or security attacks. At the same time, it avoids the problem of security core asset leakage that exists when storing digital certificates in multiple systems or multiple regions.

[0051] Furthermore, the certificate storage module may encrypt the target digital certificate using a self-signed public key (i.e., the aforementioned target public key) generated by an asymmetric algorithm, and then divide it into multiple sub-segments (i.e., target digital certificate segments), wherein the number of sub-segments may be preset. In this embodiment, the number of sub-segments is preferably greater than 5. Then, as Figure 3 As shown, the certificate storage module can perform a hash operation on each sub-segment using a consistent hashing algorithm to obtain a hash value corresponding to each target digital certificate segment, and then store the obtained hash value in a distributed manner in the first storage area (i.e. Figure 3 In the storage area in the first storage area), the first storage area can be an independent high-availability storage space of the digital certificate synchronization and management system. In addition, the certificate storage module can also store the self-signed key of the target digital certificate (i.e., the aforementioned target private key) in the second storage area (i.e., Figure 3 The second storage area may be a distributed storage node. The hash function is irreversible, and only the certificate storage module can retrieve the storage address of each sub-segment of the target digital certificate through the sub-segment hash value of the target digital certificate and calculate the relationship between each sub-segment.

[0052] It should be noted that by performing a series of processes such as encryption, segmentation, and hash calculation on the target digital certificate, and distributing the hash values ​​obtained after the processing, on the one hand, it is impossible for an attacker to simultaneously obtain the hash values ​​of multiple target digital certificate fragments stored in a distributed manner and the media samples of multiple target digital certificate fragments stored in a distributed manner, and it is impossible to effectively combine data in a massive amount of data. On the other hand, even if an attacker merges multiple target digital certificate fragments, the target digital certificate as a whole is encrypted by the target public key, so if the target private key cannot be obtained, the attacker cannot identify the target digital certificate. In this way, it is possible to effectively prevent the first storage area or the second storage area from being attacked, or being leaked by manually pulling the stored hash values ​​to the local area. This further improves the security of digital certificate storage.

[0053] In an optional embodiment, after obtaining the target digital certificate, the digital certificate synchronization and management system can determine the target characteristic information corresponding to the target digital certificate, and then perform an information summary calculation on the target characteristic information to obtain a second information summary value, and store the second information summary value in a third storage area.

[0054] Optionally, before the aforementioned certificate synchronization module sends the target digital certificate to the certificate storage module, the certificate synchronization module may first determine the target characteristic information corresponding to the target digital certificate, thereby performing information summary calculation on the target characteristic information to obtain a second information summary value, and then store it in a third storage area. After that, the certificate synchronization module may send the target digital certificate to the certificate storage module and delete the target digital certificate locally. Among them, the target characteristic information of the target digital certificate may also be stored in the third storage area.

[0055] It should be noted that by retaining only the information summary value corresponding to the target digital certificate in the certificate synchronization module, the target digital certificate can be avoided from being directly used during the verification of the abnormal target device, thereby further ensuring the security of the target digital certificate.

[0056] In an optional embodiment, after the target digital certificate is deleted from the current platform, the digital certificate synchronization and management system can respond to the certificate issuance instruction sent by the target object, obtain multiple hash values ​​from the first storage area, and obtain the target private key from the second storage area, and then determine the target digital certificate based on the multiple hash values ​​and the target private key, thereby sending the target digital certificate to at least one target device.

[0057] Optionally, the certificate storage module can be connected through the certificate issuance module. When the relevant staff (i.e., the aforementioned target object) determines that the digital certificate needs to be synchronized to the target device, the staff can send a certificate issuance instruction to the certificate issuance module. Afterwards, the certificate issuance module can respond to the certificate issuance instruction and send a certificate reading instruction to the certificate storage module.

[0058] Furthermore, when the certificate storage module obtains the certificate reading instruction, the certificate storage module can obtain multiple hash values ​​from the first storage area, and use the hash values ​​to combine the fragments to obtain the encrypted target digital certificate. After that, the encrypted target digital certificate can be sent to the certificate issuing module, which obtains the target private key from the second storage area and decrypts the encrypted target digital certificate based on the target private key to obtain the target digital certificate. Furthermore, if Figure 3 As shown, the certificate issuing module can automatically traverse the distributed certificate computing devices in the current organization, and then issue the target digital certificate to all certificate computing devices, so that the target device can verify the current organization and the certificate computing devices based on the target digital certificate. Figure 3 The information transmission process between the terminal devices in the middle performs certificate computing services such as identity recognition, signature, and encryption. Among them, in the process of issuing the target digital certificate to all certificate computing devices, the certificate issuing module can issue it to the target devices one by one. And after the issuance is successful, the certificate issuing module immediately executes the deletion of the target digital certificate restored in the certificate issuing module.

[0059] It should be noted that, by restoring the target digital certificate based on multiple hash values ​​and the target private key during the process of sending the target digital certificate to at least one target device, the transmission security of the target digital certificate during the issuance process is further guaranteed.

[0060] In an optional embodiment, in the process of synchronizing the target digital certificate to the abnormal target device, the digital certificate synchronization and management system can obtain multiple hash values ​​from the first storage area, and then determine the encrypted target digital certificate based on the multiple hash values, and then obtain the target private key from the second storage area, and decrypt the encrypted target digital certificate based on the target private key to obtain the target digital certificate, thereby synchronizing the target digital certificate to the abnormal target device.

[0061] Optionally, the digital certificate synchronization and management system can synchronize the target digital certificate to the abnormal target device based on the aforementioned method of sending the target digital certificate to at least one target device, so it is not repeated here.

[0062] It should be noted that, by restoring the target digital certificate based on multiple hash values ​​and the target private key during the process of synchronizing the target digital certificate to the abnormal target device, the transmission security of the target digital certificate during the issuance process is further guaranteed.

[0063] In an optional embodiment, before synchronizing the target digital certificate to the abnormal target device, the digital certificate synchronization and management system can remove it from the distributed certificate computing cluster to prohibit the abnormal target device from performing the target computing task, thereby avoiding providing erroneous certificate computing services or being unable to provide certificate computing services, which in turn leads to problems affecting the progress of service processing.

[0064] Furthermore, after synchronizing the target digital certificate to the abnormal target device, the certificate verification module can verify the digital certificate in the abnormal target device again, and when the certificate verification is successful, add it to the distributed certificate computing cluster again so that the target device can continue to provide certificate computing services.

[0065] In an optional embodiment, the digital certificate synchronization and management system can also determine the update time range of the target digital certificate based on the target characteristic information, so that when the current time is within the update time range, the updated target digital certificate is obtained from the target certificate authority.

[0066] To ensure the validity of digital certificates, digital certificates within an organization need to be updated regularly in accordance with international standards. Therefore, when the current organization obtains the target digital certificate issued by the target certificate authority for the first time, a key-value pair can be set through the certificate synchronization module, wherein the application domain name information of the current organization can be used as the key value, and the target feature information of the target digital certificate applied for based on the application domain name information can be used as the value. Afterwards, the certificate synchronization module can automatically connect to the target certificate authority, and determine the time range to be updated for the target digital certificate by reading the validity period and timestamp in the target feature information. Thus, the target certificate authority is automatically linked to obtain the updated target digital certificate according to the time requirements corresponding to the time range to be updated, and the target feature information is updated based on the feature information corresponding to the updated target digital certificate, and the corresponding information summary value is recalculated.

[0067] It should be noted that by automatically updating the target digital certificate based on the target characteristic information, it is avoided that the relevant staff forgets the expiration time, resulting in the digital certificate being unavailable and causing the enterprise site to be unable to provide services.

[0068] In an optional embodiment, an application process of the present application is described. Specifically, Figure 4 As shown, the digital certificate synchronization and management system connects to the target certificate authority through an interface and an encrypted channel, forms a key-value pair correspondence by reading the domain name information and target feature information (issuer, validity period, timestamp) corresponding to the existing target digital certificate, and automatically updates the target digital certificate from the target certificate authority according to the time requirements in the target feature information (that is, determining the expiration time of the target digital certificate) before expiration. After obtaining the target digital certificate, the digital certificate synchronization and management system reads its target feature information to calculate the information summary value (that is, the second information summary value) as a verification standard for storage, and then encrypts the target digital certificate through the target public key, segments it, and calculates the consistent hash, and then disperses and stores the obtained multiple hash values ​​on the heterogeneous distributed storage to ensure the confidentiality and high availability of the digital certificate storage.

[0069] Furthermore, if Figure 4As shown, when the target digital certificate on the target device needs to be updated, the digital certificate synchronization and management system can restore the encrypted version of the target digital certificate (that is, the encrypted target digital certificate) through the hash value index, and then decrypt it through the target private key to restore the target digital certificate. After that, the digital certificate synchronization and management system can automatically send the target digital certificate to the target device through the target device interface, and destroy the locally restored target digital certificate after sending it. After the target device feedback sends it successfully, the characteristic information of the digital certificate in the target device can be periodically read back to the certificate synchronization and management system, and the corresponding information digest value (that is, the first information digest value) can be calculated, and then compared with the information digest value calculated before sending it to confirm the consistency of the certificates used by all target devices. During the verification process, if an abnormal target device is found, the abnormal target device can be removed from the distributed certificate calculation cluster and the target digital certificate can be re-issued. On the contrary, if the verification target device passes, the target device is allowed to process the user request sent by the user through the terminal device and return the request processing result. In all the aforementioned processes, the target digital certificate is destroyed upon use, and only the target digital certificate fragment is stored in the highly available distributed storage to ensure the security of the certificate.

[0070] It can be seen that the solution provided by the present application achieves the purpose of resynchronizing the digital certificates of abnormal target devices among multiple target devices, thereby achieving the technical effect of ensuring the consistency of the versions of digital certificates between the target devices, and further solving the technical problem of different certificate versions when synchronizing digital certificates to multiple related devices in the prior art.

[0071] Example 2

[0072] According to an embodiment of the present invention, an embodiment of a digital certificate synchronization device is provided, wherein: Figure 5 is a schematic diagram of an optional digital certificate synchronization device according to an embodiment of the present invention, such as Figure 5 As shown, the device comprises:

[0073] A first acquisition module 501 is used to periodically acquire characteristic information of a digital certificate on at least one target device, wherein the target device is at least used to execute a target computing task, and the target computing task is a task that requires a digital certificate;

[0074] A first determination module 502 is used to determine an abnormal target device from at least one target device based on the characteristic information and the target characteristic information corresponding to the target digital certificate, wherein the target digital certificate is a certificate sent by the current platform to the at least one target device;

[0075] The synchronization module 503 is used to synchronize the target digital certificate to the abnormal target device.

[0076] It should be noted that the above-mentioned first acquisition module 501, first determination module 502 and synchronization module 503 correspond to steps S201 to S203 in the above-mentioned embodiment. The examples and application scenarios implemented by the three modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above-mentioned embodiment 1.

[0077] Optionally, the first determination module also includes: a first calculation submodule, used to perform information summary calculation on each feature information to obtain a first information summary value corresponding to each feature information; a second calculation submodule, used to obtain a second information summary value, wherein the second information summary value is obtained by performing information summary calculation on the target feature information; the first determination submodule, used to determine that the feature information corresponding to the first information summary value different from the second information summary value is abnormal feature information, and determine that the target device corresponding to the abnormal feature information is an abnormal target device.

[0078] Optionally, the digital certificate synchronization device also includes: a second acquisition module, used to acquire the target digital certificate; an encryption module, used to encrypt the target digital certificate based on the target public key to obtain an encrypted target digital certificate; a first processing module, used to segment the encrypted target digital certificate to obtain multiple target digital certificate fragments; a calculation module, used to perform hash calculation on each target digital certificate fragment to obtain a hash value corresponding to each target digital certificate fragment; a first storage module, used to store multiple hash values ​​in a distributed manner in a first storage area, store the target private key corresponding to the target public key in a second storage area, and delete the target digital certificate from the current platform.

[0079] Optionally, the digital certificate synchronization device also includes: a second determination module, used to determine the target characteristic information corresponding to the target digital certificate; a second storage module, used to perform information summary calculation on the target characteristic information, obtain a second information summary value, and store the second information summary value in a third storage area.

[0080] Optionally, the digital certificate synchronization device also includes: a third acquisition module, used to respond to the certificate issuance instruction sent by the target object, obtain multiple hash values ​​from the first storage area, and obtain the target private key from the second storage area; a third determination module, used to determine the target digital certificate based on multiple hash values ​​and the target private key; and a sending module, used to send the target digital certificate to at least one target device.

[0081] Optionally, the synchronization module includes: a first acquisition submodule, used to obtain multiple hash values ​​from a first storage area; a second determination submodule, used to determine the encrypted target digital certificate based on the multiple hash values; a second acquisition submodule, used to obtain a target private key from a second storage area; a decryption submodule, used to decrypt the encrypted target digital certificate based on the target private key to obtain a target digital certificate; and a synchronization submodule, used to synchronize the target digital certificate to an abnormal target device.

[0082] Optionally, the digital certificate synchronization device further includes: a second processing module, used to prohibit abnormal target devices from executing target computing tasks.

[0083] Optionally, the digital certificate synchronization device also includes: a fourth determination module, used to determine the time range for updating the target digital certificate based on the target characteristic information; and a fourth acquisition module, used to obtain the updated target digital certificate from the target certificate authority when the current time is within the time range for updating.

[0084] Example 3

[0085] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is further provided, in which a computer program is stored, wherein the computer program is configured to execute the above-mentioned digital certificate synchronization method when running.

[0086] Example 4

[0087] According to another aspect of an embodiment of the present invention, there is also provided an electronic device, wherein: Figure 6 is a schematic diagram of an optional electronic device according to an embodiment of the present invention, such as Figure 6 As shown, the electronic device includes one or more processors; a memory for storing one or more programs, which, when the one or more programs are executed by the one or more processors, enables the one or more processors to run the programs, wherein the programs are configured to execute the above-mentioned digital certificate synchronization method when running.

[0088] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0089] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0090] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0091] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0092] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0093] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0094] The above are only preferred embodiments of the present invention. It should be pointed out that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for synchronizing a digital certificate, characterized in that: include: Periodically acquiring characteristic information of a digital certificate on at least one target device, wherein the target device is at least used to execute a target computing task, the target computing task being a task requiring the digital certificate; Determine an abnormal target device from at least one target device based on the characteristic information and target characteristic information corresponding to the target digital certificate, wherein the target digital certificate is a certificate sent by the current platform to the at least one target device; Synchronizing the target digital certificate to the abnormal target device; Determining an abnormal target device from at least one target device based on the characteristic information and the target characteristic information corresponding to the target digital certificate includes: Calculate the information summary for each feature information to obtain a first information summary value corresponding to each feature information; Acquire a second information summary value, wherein the second information summary value is obtained by performing information summary calculation on the target characteristic information; The characteristic information corresponding to the first information digest value different from the second information digest value is determined to be abnormal characteristic information, and the target device corresponding to the abnormal characteristic information is determined to be the abnormal target device.

2. The method according to claim 1, characterized in that Before periodically acquiring characteristic information of a digital certificate on at least one target device, the method further includes: Obtaining the target digital certificate; Encrypting the target digital certificate based on the target public key to obtain an encrypted target digital certificate; Segmenting the encrypted target digital certificate to obtain multiple target digital certificate fragments; Performing hash calculation on each target digital certificate fragment to obtain a hash value corresponding to each target digital certificate fragment; Multiple hash values ​​are distributedly stored in a first storage area, a target private key corresponding to the target public key is stored in a second storage area, and the target digital certificate is deleted from the current platform.

3. The method according to claim 2, characterized in that After obtaining the target digital certificate, the method further includes: Determining target characteristic information corresponding to the target digital certificate; An information digest is calculated for the target characteristic information to obtain a second information digest value, and the second information digest value is stored in a third storage area.

4. The method according to claim 2, characterized in that: After deleting the target digital certificate from the current platform, the method further includes: In response to the certificate issuing instruction sent by the target object, obtain the multiple hash values ​​from the first storage area, and obtain the target private key from the second storage area; determining the target digital certificate based on the plurality of hash values ​​and the target private key; The target digital certificate is sent to the at least one target device.

5. The method according to claim 2, characterized in that: Synchronizing the target digital certificate to the abnormal target device includes: Acquire the plurality of hash values ​​from the first storage area; Determining the encrypted target digital certificate based on the multiple hash values; Acquire the target private key from the second storage area; decrypting the encrypted target digital certificate based on the target private key to obtain the target digital certificate; The target digital certificate is synchronized to the abnormal target device.

6. The method according to claim 1, characterized in that Before synchronizing the target digital certificate to the abnormal target device, the method further includes: The abnormal target device is prohibited from executing the target computing task.

7. The method according to claim 1, characterized in that The method further comprises: Determine a time range for updating the target digital certificate based on the target characteristic information; When the current time is within the time range to be updated, an updated target digital certificate is obtained from a target certificate issuing authority.

8. A digital certificate synchronization device, characterized in that: include: A first acquisition module, configured to periodically acquire characteristic information of a digital certificate on at least one target device, wherein the target device is at least used to execute a target computing task, the target computing task being a task requiring the digital certificate; A first determination module, configured to determine an abnormal target device from at least one target device based on the characteristic information and target characteristic information corresponding to a target digital certificate, wherein the target digital certificate is a certificate sent by the current platform to the at least one target device; A synchronization module, used for synchronizing the target digital certificate to the abnormal target device; The first determination module also includes: A first calculation submodule, used to perform information summary calculation on each feature information to obtain a first information summary value corresponding to each feature information; A second calculation submodule is used to obtain a second information summary value, wherein the second information summary value is obtained by performing information summary calculation on the target feature information; The first determination submodule is used to determine that characteristic information corresponding to a first information digest value different from the second information digest value is abnormal characteristic information, and determine that a target device corresponding to the abnormal characteristic information is the abnormal target device.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program is configured to execute the digital certificate synchronization method described in any one of claims 1 to 7 when running.

10. An electronic device, characterized in that: The electronic device includes one or more processors; A memory for storing one or more programs, which, when executed by the one or more processors, enables the one or more processors to run the programs, wherein the programs are configured to execute the method for synchronizing digital certificates as described in any one of claims 1 to 7 when running.

Images