Management method and device for revoked certificate information, and certificate management system

Abstract

The present application discloses a method and device for managing revoked certificate information, and a certificate management system. The method is applied to a certificate management system and includes: based on a streaming processing mechanism, receiving and parsing a certificate revocation list file to obtain multiple sets of corresponding organization information and revoked certificate information; converting each revoked certificate information into a specified format and storing it in a non-relational database; receiving and responding to a revoked certificate status query request sent by an application service, loading the non-relational database, retrieving and reading the target revoked certificate information corresponding to the revoked certificate status query request, and determining a query result for the target revoked certificate based on the target revoked certificate information, and returning the result to the application service, wherein the query result includes at least the certificate status of the target revoked certificate. The present application avoids the memory overflow problem caused by an overly large certificate revocation list file; improves the speed and efficiency of revoked certificate status queries; and improves the reference value of the query results.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method and device for managing revoked certificate information, and a certificate management system. Background Art

[0002] In the PKI (Public Key Infrastructure) system, the Certificate Revocation List (CRL) file stores information about user certificates revoked by the Certificate Authority (CA). Reading the information in the CRL file is a way to verify the validity of the user certificate. Currently, both the Java JDK package and the third-party library Bouncycastle have the function of parsing CRL files in DER format. However, the CRL file information needs to be parsed and read into the memory at one time. For a large and long-running CA system, the CRL file generated may reach more than ten GB, while some small application servers may only have a few GB of memory and are unable to process such a large CRL file at one time. In addition, the existing processing method is very slow and inefficient, and the response speed to certificate status query requests is also slow. Summary of the Invention

[0003] In response to the above situation, the embodiments of the present application propose a method, device, and certificate management system for managing revoked certificate information. The method uses streaming processing and parsing of CRL files to avoid storing all information in the memory at one time, which may cause memory overflow. After streaming parsing the CRL file, the obtained revoked certificate information is converted into a specific format and stored in a non-relational database. This can not only reduce the data storage size, but also utilize the high read and write performance of the non-relational database to quickly respond to revoked certificate status query requests, thereby overcoming at least part of the shortcomings of the existing technology.

[0004] First, an embodiment of the present application provides a method for managing revoked certificate information, which is applied to a certificate management system and includes:

[0005] Based on the streaming processing mechanism, the certificate revocation list file is received and parsed to obtain multiple sets of corresponding organization information and revoked certificate information; and each revoked certificate information is converted into a specified format and stored in a non-relational database;

[0006] Receive and respond to a revoked certificate status query request sent by an application service, load into a non-relational database, retrieve and read target revoked certificate information corresponding to the revoked certificate status query request, and determine a query result of a target revoked certificate based on the target revoked certificate information, and return it to the application service, wherein the query result includes at least the certificate status of the target revoked certificate.

[0007] In a second aspect, an embodiment of the present application further provides a device for managing revoked certificate information, the device comprising:

[0008] The parsing and storage unit is used to receive and parse the certificate revocation list file based on a streaming processing mechanism to obtain multiple sets of corresponding organization information and revoked certificate information; and convert each revoked certificate information into a specified format and store it in a non-relational database;

[0009] The retrieval and return unit is used to receive and respond to the revoked certificate status query request sent by the application service, load the non-relational database, retrieve and read the target revoked certificate information corresponding to the revoked certificate status query request, and determine the target revoked certificate status according to the target revoked certificate information, and return it to the application service.

[0010] In a third aspect, an embodiment of the present application further provides a certificate management system, wherein the certificate management system is deployed with the above-mentioned management device for revoked certificate information; the certificate management system can also be communicatively connected to an operation and maintenance terminal, a non-relational database, and an application service;

[0011] The operation and maintenance terminal is used to upload a certificate revocation list file to the certificate management system;

[0012] The non-relational database is used to store revoked certificate information in a specified format;

[0013] The application service is used to send a certificate revocation status query request to the certificate management system and receive a query result returned by the certificate management system.

[0014] In a fourth aspect, an embodiment of the present application further provides an electronic device, comprising: a processor; and a memory arranged to store computer-executable instructions, wherein the executable instructions, when executed, enable the processor to perform any of the above methods.

[0015] In a fifth aspect, an embodiment of the present application further provides a computer-readable storage medium, which stores one or more programs. When the one or more programs are executed by an electronic device including multiple applications, the electronic device executes any of the above methods.

[0016] At least one of the above technical solutions adopted in the embodiments of the present application can achieve the following beneficial effects:

[0017] The present application provides a method for managing revoked certificate information, which can be applied to a certificate management system. On the one hand, the method is based on a streaming processing mechanism, receives and parses a received certificate revocation list file, and converts the revoked certificate information in the obtained data into a specified form, and stores it in a non-relational database. By adopting a streaming processing method, the method can receive and process at the same time, avoiding the method of storing the entire certificate revocation list file in memory and then processing it in the prior art, and avoiding the memory overflow problem caused by the certificate revocation list file being too large; on the other hand, due to the fast reading and writing speed of the non-relational database, the certificate management system can quickly respond to the revoked certificate status query request sent by the application service, significantly improving the speed of the revoked certificate status query and improving the query efficiency; and the present application can return the certificate status of the revoked certificate with a clear meaning, making the query result more intuitive and improving the reference significance of the query result. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0019] Figure 1 A schematic diagram showing the structure of a certificate management system according to an embodiment of the present application is shown;

[0020] Figure 2 A schematic diagram illustrating a process of managing revoked certificate information according to an embodiment of the present application is shown;

[0021] Figure 3 A schematic diagram showing a flow chart of a method for managing revoked certificate information according to another embodiment of the present application is shown;

[0022] Figure 4 A schematic diagram showing the structure of a device for managing certificate revocation information according to an embodiment of the present application is shown;

[0023] Figure 5 This is a structural diagram of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0024] To make the purpose, technical solutions, and advantages of this application more clear, the technical solutions of this application will be clearly and completely described below in conjunction with the specific embodiments of this application and the corresponding drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0025] The following describes in detail the technical solutions provided by various embodiments of the present application in conjunction with the accompanying drawings.

[0026] In a PKI (Public Key Infrastructure) system, a Certificate Revocation List (CRL) stores information about user certificates revoked by a Certificate Authority (CA). Reading information from a CRL file is one way to verify the validity of a user certificate. Conventional methods for managing a Certificate Revocation List (CRL) file typically read the entire CRL file and construct a very large processing object into memory. This can be very difficult or even impossible for a server with limited memory to process if the CRL file is particularly large.

[0027] In this regard, this application proposes a method for managing revoked certificate information, which can be implemented through a certificate management system. Figure 1 A schematic diagram of the structure of a certificate management system according to an embodiment of the present application is shown. Figure 1 It can be seen that the certificate management system 100 includes a management device 110 ( Figure 4 ), the certificate revocation information management device 110 can implement the certificate revocation information management method proposed in this application; the certificate management system 100 can also be externally connected to the operation and maintenance terminal 200, the non-relational database 300, and the application service 400. In other embodiments, the non-relational database 300 can also be deployed locally in the certificate management system 100 if the hardware conditions of the certificate management system 100 permit (this situation is not shown in the figure), and this application does not limit this. The non-relational database 300 can be any one of the existing technologies, such as Redis.

[0028] In addition, in other embodiments of the present application, the certificate management system can also be communicatively connected to a relational database 500. The relational database 500 can be any one of the existing technologies, such as a MySQL database, which is mainly used to persist data.

[0029] Figure 2 A flow chart showing a method for managing revoked certificate information according to an embodiment of the present application is shown. Figure 1 The certificate management system shown is implemented from Figure 2 It can be seen that this embodiment includes at least steps S110 to S120:

[0030] Step S110: Based on the streaming processing mechanism, receive and parse the certificate revocation list file to obtain multiple sets of corresponding organization information and revoked certificate information; and convert each revoked certificate information into a specified format and store it in a non-relational database.

[0031] In this application, the management of revoked certificate information is mainly divided into two parts: one is the parsing and processing of the revocation list file (CRL file); the other is the response to the revoked certificate status query request.

[0032] Please refer to Figure 1 The operation and maintenance personnel can upload the certificate revocation list file (CRL file) to the certificate management system 100 on the operation and maintenance terminal 200. The CRL file is usually a very large file in the ASN.1 encoding rule data format (or DER format), and its size is usually more than ten GB or even larger. It contains information about thousands of user certificates that have been revoked by the certificate authority (CA).

[0033] In the prior art, the CRL file is usually processed by loading the entire file into the memory and then processing it. If the CRL file is too large and the system memory is small, it will cause processing difficulties or even memory overflow.

[0034] Different from the existing technology, the present application adopts a streaming processing mechanism in parsing the CRL file. The so-called streaming processing mechanism processes or loads data through a stream, that is, it processes while loading. The processed data is removed from the memory in time to achieve the purpose of reducing memory usage and realizing the purpose of using a small memory to process large files.

[0035] Specifically, when receiving and parsing the certificate revocation list file, the certificate revocation list file is received and parsed based on the streaming processing mechanism. After parsing, multiple sets of one-to-one corresponding organization information and revocation certificate information can be obtained. A set of corresponding organization information and revocation certificate information can be recorded as an information array, wherein the organization information mainly includes but is not limited to the information of the organization (CA) that issues the certificate, such as the application name, the organization's social identification number, etc. For a certificate issuing organization, this information is the same; the revocation certificate information may include but is not limited to a certificate's CA signature information, the revocation certificate serial number, etc. and a lot of information.

[0036] During the parsing process of the CRL file, the parsed information can be stored in a non-relational database while being parsed. When storing, only the revoked certificate information can be stored, and the revoked certificate information can be converted into a specified format, such as a key-value pair format that meets the storage requirements of the non-relational database.

[0037] In some embodiments of the present application, for a revoked certificate information, the revoked certificate information can be filtered. Since the CRL file includes a lot of complex or redundant information, these can be filtered to obtain important information related to the revoked certificate, including but not limited to one-to-one corresponding agency certificate signatures (CA certificate signatures), revoked certificate serial numbers, revocation dates of revoked certificates, and revocation status codes, etc.; these data are then converted into key-value pairs, specifically, the agency certificate signature and the revoked certificate serial number are used as the keys of the key-value pair, and the revocation date of the revoked certificate and the revocation status code are used as the values ​​of the key-value pair; the keys and values ​​in the obtained key-value pairs are stored correspondingly in the non-relational database.

[0038] That is, for each set of information arrays, the revoked certificate information can be stored in a non-relational database in the form of key-value, where key = institution certificate signature + revoked certificate serial number; value = revocation date of revoked certificate + revocation status code.

[0039] In some embodiments, when each piece of revoked certificate information is stored in the non-relational database based on a streaming processing mechanism, the number of revoked certificate information stored in the non-relational database can be counted; whenever the count value reaches a preset threshold, the corresponding agency information and revoked certificate information in the memory of the certificate management system are deleted, and the step of counting the number of revoked certificate information stored in the non-relational database is performed again.

[0040] If the preset threshold is 1000, each time 1000 revoked certificate information is read from the memory of the certificate management system 100 and converted into a special format, it is stored in a non-relational database. After storing these 1000 revoked certificate information, the 1000 revoked certificate information in the memory of the certificate management system 100 is deleted, that is, the storage space of the memory can be restored in time; then the count is cleared and recounted, and after storing 1000 revoked certificate information again, the 1000 revoked certificate information in the memory of the certificate management system 100 is deleted.

[0041] The revoked certificate information is stored in a non-relational database in the form of key-value pairs, mainly taking advantage of the high performance and fast reading and writing of the non-relational database, which helps to respond to subsequent revoked certificate status query requests.

[0042] In other embodiments of the present application, data backtracking or the need to query original data may sometimes occur. Therefore, in order to persist the CRL file, the method further includes: storing the multiple sets of corresponding organization information and revoked certificate information obtained by parsing in a relational database to persist the organization information and the revoked certificate information. Subsequently, if data backtracking is required, the data can be read from the relational database.

[0043] Step S120: Receive and respond to the revoked certificate status query request sent by the application service, load into the non-relational database, retrieve and read the target revoked certificate information corresponding to the revoked certificate status query request, and determine the query result of the target revoked certificate based on the target revoked certificate information, and return it to the application service, wherein the query result includes at least the certificate status of the target revoked certificate.

[0044] The application service 400 may send a revoked certificate status query request to the certificate management system 100 to obtain the certificate status of the target revoked certificate.

[0045] After receiving the revoked certificate status query request from the application service 400, the certificate management system 100 can parse the revoked certificate status query request to obtain the necessary information for querying the target revoked certificate information, and then load it into the non-relational database 300, search according to the necessary information parsed, find the target revoked certificate information, and determine the query result of the target revoked certificate based on the queried target revoked certificate information, and return it to the application service 400. The query result includes at least the certificate status of the target revoked certificate, and the certificate status includes but is not limited to revoked, expired, or unknown status.

[0046] Specifically, by parsing the revocation certificate status query request, the institutional certificate signature and the revocation certificate serial number of the target revocation certificate indicated by the revocation certificate status query request can be obtained. It should be noted that the revocation certificate serial numbers issued by different institutions may be repeated, while the revocation certificate serial numbers issued by the same institution will not be repeated. Therefore, when determining a target revocation certificate, it can be determined in combination with the institutional certificate signature and the revocation certificate serial number. After loading into a non-relational database, the institutional certificate signature and the revocation certificate serial number of the determined target revocation certificate are retrieved and matched to determine a key (key) that is consistent with the institutional certificate signature and the revocation certificate serial number as the target key; then the value (value) corresponding to the target key is read to obtain the revocation certificate revocation date (if any) and revocation status code of the target revocation certificate.

[0047] After the target revocation certificate information is queried, the query result of the target revocation certificate can be determined based on the target revocation certificate information, and then the determined query result is returned to the application service 400; in some cases, since the target revocation certificate to be queried is not stored in non-relational data, the target revocation certificate information corresponding to the revocation certificate status query request cannot be retrieved in the revocation certificate information. In this case, the certificate status of the target revocation certificate is determined to be "unknown status", and "unknown status" is returned to the application service 400 as the query result.

[0048] In some embodiments of the present application, determining the query result of the target revocation certificate based on the target revocation certificate information may specifically include: if the revocation status code is a first preset code, determining that the certificate status of the target revocation certificate is expired; if the revocation status code is a second preset code, determining that the certificate status of the target revocation certificate is revoked, and reading the revocation certificate revocation date of the target revocation certificate.

[0049] Assuming the first preset code is 507 and the second preset code is 703, if the revocation status code of the queried target revocation certificate is 507, the certificate status of the target revocation certificate is determined to be "expired", and "expired" is returned as the query result to the application service 400. If the revocation status code of the queried target revocation certificate is 703, the certificate status of the target revocation certificate is determined to be "revoked". At this time, the revocation date of the revocation certificate in value can be further read, and "revoked" and the read "revocation date of the revocation certificate" are returned as the query result to the application service 400.

[0050] Depend on Figure 2 As can be seen from the method shown, the present application provides a method for managing revoked certificate information, which can be applied to a certificate management system. On the one hand, the method is based on a streaming processing mechanism, receives and parses the received certificate revocation list file, and converts the revoked certificate information in the obtained data into a specified form, and stores it in a non-relational database. By adopting a streaming processing method, it can receive and process at the same time, avoiding the method of storing the entire certificate revocation list file in the memory and then processing it in the prior art, and avoiding the memory overflow problem caused by the certificate revocation list file being too large; on the other hand, due to the fast reading and writing speed of the non-relational database, the certificate management system can quickly respond to the revoked certificate status query request sent by the application service, which significantly improves the speed of the revoked certificate status query and improves the query efficiency; and the present application can return the certificate status of the revoked certificate with a clear meaning, making the query result more intuitive and improving the reference significance of the query result.

[0051] Figure 3A flow chart showing a method for managing revoked certificate information according to another embodiment of the present application is shown. Figure 3 It can be seen that this embodiment includes:

[0052] On the operation and maintenance terminal, upload the CRL file to the certificate management system.

[0053] The certificate management system, based on a streaming processing mechanism, parses CRL files and stores complete organization information and revoked certificate information; it then filters the revoked certificate information, converts the filtered revoked certificate information into key-value pairs, and stores them.

[0054] Application service, sends a request to query the revoked certificate status.

[0055] The certificate management system parses the request, obtains the agency certificate signature and the revoked certificate serial number, searches for the target key based on the agency certificate signature and the revoked certificate serial number, reads the corresponding value, determines the query result, and returns it.

[0056] Figure 4 The structure diagram of a device for managing certificate revocation information according to an embodiment of the present application is shown. The device 110 for managing certificate revocation information includes:

[0057] The parsing and storage unit 111 is used to receive and parse the certificate revocation list file based on a streaming processing mechanism to obtain multiple sets of corresponding organization information and revoked certificate information; and convert each revoked certificate information into a specified format and store it in a non-relational database;

[0058] The retrieval and return unit 112 is used to receive and respond to the revoked certificate status query request sent by the application service, load it into the non-relational database, retrieve and read the target revoked certificate information corresponding to the revoked certificate status query request, and determine the target revoked certificate status based on the target revoked certificate information, and return it to the application service.

[0059] In some embodiments of the present application, in the above-mentioned device, the parsing and storage unit 111 is further used to store the multiple sets of corresponding organization information and revocation certificate information in a relational database to persist the organization information and the revocation certificate information.

[0060] In some embodiments of the present application, in the above-mentioned device, the parsing and storage unit 111 is used to filter the revocation certificate information for a revocation certificate information to obtain the corresponding agency certificate signature, revocation certificate serial number, revocation certificate revocation date, and revocation status code; use the agency certificate signature and the revocation certificate serial number as the key of a key-value pair, and use the revocation certificate revocation date and the revocation status code as the value of the key-value pair; and store the key and value in the key-value pair in the non-relational database.

[0061] In some embodiments of the present application, in the above-mentioned device, the parsing and storage unit 111 is also used to count the number of revoked certificate information stored in the non-relational database; whenever the count value reaches a preset threshold, the corresponding agency information and revoked certificate information in the memory of the certificate management system are deleted, and the step of counting the number of revoked certificate information stored in the non-relational database is executed again.

[0062] In some embodiments of the present application, in the above-mentioned device, the retrieval and return unit 112 is used to parse the revocation certificate status query request, obtain the agency certificate signature and the revocation certificate serial number of the target revocation certificate indicated by the revocation certificate status query request; load it into the non-relational database, match it according to the agency certificate signature and the revocation certificate serial number of the target revocation certificate, and determine the target key corresponding to the target revocation certificate; read the value corresponding to the target key, and obtain the revocation certificate revocation date and the revocation status code of the target revocation certificate.

[0063] In some embodiments of the present application, in the above-mentioned device, the retrieval and return unit 112 is used to determine that the certificate status of the target revocation certificate is expired if the revocation status code is a first preset code; if the revocation status code is a second preset code, determine that the certificate status of the target revocation certificate is revoked, and read the revocation date of the revocation certificate of the target revocation certificate.

[0064] In some embodiments of the present application, in the above-mentioned device, the retrieval and return unit 112 is further used to determine that the certificate status of the target revoked certificate is unknown if the target revoked certificate information corresponding to the revoked certificate status query request cannot be retrieved in the revoked certificate information.

[0065] It should be noted that the above-mentioned certificate revocation information management device can respectively implement the above-mentioned certificate revocation information management method, which will not be described in detail here.

[0066] Figure 5 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. Figure 5At the hardware level, the electronic device includes a processor and, optionally, an internal bus, a network interface, and memory. The memory may include internal memory, such as high-speed random-access memory (RAM), or non-volatile memory, such as at least one disk drive. Of course, the electronic device may also include other hardware required for its services.

[0067] The processor, network interface, and memory can be interconnected via an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0068] The memory is used to store programs. Specifically, the program may include program code, which includes computer operating instructions. The memory may include internal memory and non-volatile memory, and provides instructions and data to the processor.

[0069] The processor reads the corresponding computer program from the non-volatile memory into the internal memory and then runs it, forming a management device for revoked certificate information at the logical level. The processor executes the program stored in the memory and is specifically used to perform the aforementioned method.

[0070] The above application Figure 4The method performed by the certificate revocation information management device disclosed in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by hardware integrated logic circuits in the processor or by software instructions. The above processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The various methods, steps, and logic block diagrams disclosed in the embodiments of this application can be implemented or executed. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of this application can be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the memory, and the processor reads the information in the memory and, in conjunction with its hardware, completes the steps of the above method.

[0071] The electronic device may also perform Figure 4 The method executed by the management device for revoking certificate information in the Figure 4 The functions of the illustrated embodiment will not be described in detail in the embodiments of the present application.

[0072] The embodiment of the present application also provides a computer-readable storage medium, which stores one or more programs, wherein the one or more programs include instructions, which, when executed by an electronic device including multiple application programs, can enable the electronic device to execute Figure 4 The method executed by the management device for revoking certificate information in the illustrated embodiment is specifically used to execute the aforementioned method.

[0073] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0074] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0075] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0076] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0077] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0078] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0079] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0080] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0081] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0082] The foregoing is merely an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A method for managing revoked certificate information, characterized in that: The method is applied to a certificate management system, and the method includes: Based on the streaming processing mechanism, the certificate revocation list file is received and parsed to obtain multiple sets of corresponding organization information and revoked certificate information; and each revoked certificate information is converted into a specified format and stored in a non-relational database; receiving and responding to a revoked certificate status query request sent by an application service, loading the non-relational database, retrieving and reading target revoked certificate information corresponding to the revoked certificate status query request, and determining a query result of a target revoked certificate based on the target revoked certificate information, and returning the result to the application service, wherein the query result includes at least the certificate status of the target revoked certificate; The converting the revoked certificate information into a specified format and storing the information in a non-relational database includes: For a piece of revoked certificate information, filtering the revoked certificate information to obtain the corresponding institution certificate signature, revoked certificate serial number, revoked certificate revocation date, and revocation status code; Using the agency certificate signature and the revocation certificate serial number as keys of a key-value pair, and using the revocation date of the revocation certificate and the revocation status code as values ​​of the key-value pair; The keys and values ​​in the key-value pairs are stored correspondingly in the non-relational database.

2. The method according to claim 1, characterized in that The method further comprises: The plurality of sets of corresponding organization information and revocation certificate information are stored in a relational database to persist the organization information and the revocation certificate information.

3. The method according to claim 1, characterized in that The converting the revoked certificate information into a specified format and storing the information in the non-relational database further includes: Counting the amount of revoked certificate information stored in the non-relational database; Whenever the count value reaches a preset threshold, the corresponding organization information and revoked certificate information in the memory of the certificate management system are deleted, and the step of counting the number of revoked certificate information stored in the non-relational database is performed again.

4. The method according to claim 1, wherein The retrieving and reading target revoked certificate information corresponding to the revoked certificate status query request includes: Parsing the revoked certificate status query request to obtain the agency certificate signature and revoked certificate serial number of the target revoked certificate indicated by the revoked certificate status query request; Loading the data into the non-relational database, matching the target revocation certificate with the target certificate revocation signature and the revocation certificate serial number, and determining a target key corresponding to the target revocation certificate; The value corresponding to the target key is read to obtain the revocation certificate revocation date and the revocation status code of the target revocation certificate.

5. The method according to claim 3, characterized in that The step of determining a query result of a target certificate revocation according to the target certificate revocation information includes: If the revocation status code is a first preset code, determining that the certificate status of the target revocation certificate is expired; If the revocation status code is a second preset code, the certificate status of the target revocation certificate is determined to be revoked, and the revocation date of the revocation certificate of the target revocation certificate is read.

6. The method according to claim 5, characterized in that The method further comprises: If the target revoked certificate information corresponding to the revoked certificate status query request cannot be retrieved from the revoked certificate information, it is determined that the certificate status of the target revoked certificate is unknown.

7. A management device for revoked certificate information, characterized in that: The device comprises: The parsing and storage unit is used to receive and parse the certificate revocation list file based on a streaming processing mechanism to obtain multiple sets of corresponding organization information and revoked certificate information; and convert each revoked certificate information into a specified format and store it in a non-relational database; a retrieval and return unit, configured to receive and respond to a revoked certificate status query request sent by an application service, load the information into a non-relational database, retrieve and read target revoked certificate information corresponding to the revoked certificate status query request, determine a target revoked certificate status based on the target revoked certificate information, and return the information to the application service; The parsing and storage unit is used to filter the revocation certificate information for a revocation certificate information to obtain the corresponding institution certificate signature, revocation certificate serial number, revocation certificate revocation date, and revocation status code; use the institution certificate signature and the revocation certificate serial number as the key of a key-value pair, and use the revocation certificate revocation date and the revocation status code as the value of the key-value pair; and store the key and value in the key-value pair in the non-relational database.

8. A certificate management system, characterized in that: The certificate management system is deployed with the management device for revoked certificate information according to claim 7; the certificate management system can also be communicatively connected to an operation and maintenance terminal, a non-relational database, and an application service; The operation and maintenance terminal is used to upload a certificate revocation list file to the certificate management system; The non-relational database is used to store revoked certificate information in a specified format; The application service is used to send a certificate revocation status query request to the certificate management system and receive a query result returned by the certificate management system.

9. The certificate management system according to claim 8, characterized in that: The certificate management system can also be connected to a relational database for communication; The parsing and storage unit is further configured to store the plurality of corresponding sets of organization information and certificate revocation information in a relational database; The relational database is used to persist the institution information and the revoked certificate information.

Images