A certificate management method

Abstract

A certificate management method disclosed in the present application relates to the field of network transmission security technology. According to the operating process relationship between a certificate application device and a cooperating device regarding task processing, a task association factor between devices is set, historical network call information of the certificate application device is obtained, the historical network call information of the certificate application device and the network call behavior standard library are analyzed and compared, and according to the analysis and comparison results, a network call security factor is set, a comprehensive analysis of the task association factor between devices and the network call security factor is conducted, and a hidden danger evaluation of certificate authorization is performed on the certificate application device to obtain an authorization hidden danger value, and then the operation safety of the certificate application device is finally judged based on the authorization hidden danger value. The result of the judgment on the certificate application device is more accurate, which effectively improves the security of certificate management.

Description

Technical Field

[0001] The present invention relates to the technical field of system network transmission security, and in particular to a certificate management method. Background Art

[0002] A digital certificate is a digital certification that marks the identity information of all communicating parties in a system network communication. People can use it to identify each other in network communications, so a digital certificate is also called a digital ID. A digital certificate ensures the integrity and security of information and data of network users in computer network communications in the form of encryption or decryption.

[0003] As enterprises have higher and higher requirements for management systems, the functions of enterprise management systems are also increasing, and the number of devices used to run enterprise management system functions is also increasing. In order to ensure the security of data communication between the service devices, digital certificates are needed to verify different devices. Digital certificates are generally issued by a certificate issuing device to a certificate applying device and can be used to prove the identity of the certificate applying device.

[0004] The existing digital certificate issuance process is that after the certificate issuance device receives the certificate application information, it generates a certificate based on the certificate application information, and then sends it to the certificate application device. During the sending process, since the certificate application device with security risks cannot be effectively identified, the overall security of the enterprise management system data communication is not high. Summary of the invention

[0005] The purpose of the present invention is to provide a method for effectively monitoring the security of certificate application equipment to improve the security of certificate application.

[0006] Therefore, the present invention discloses a certificate management method, including:

[0007] The certificate issuing device obtains the certificate application information sent by the certificate application device, and determines, based on the certificate application information, a cooperating device with which the certificate application device needs to establish an encrypted data channel;

[0008] According to the relationship between the operation flow of task processing between the certificate application device and the cooperating device, setting the task correlation factor between the devices;

[0009] Build a standard library of network call behavior based on the historical network call information of all devices running the management system;

[0010] Acquire historical network call information of the certificate application device, analyze and compare the historical network call information of the certificate application device with the network call behavior standard library, and set a network call security factor according to the analysis and comparison results;

[0011] According to the network call security factor of the certificate application device and the task association factor between devices, the risk evaluation of certificate authorization of the certificate application device is performed to obtain an authorization risk value. If the authorization risk value is higher than a preset value, the certificate issuing device is prohibited from sending a certificate to the certificate application device.

[0012] In some embodiments of the present application, in order to obtain the authorization risk value, a method for evaluating the certificate authorization risk of the certificate application device is disclosed. The method for evaluating the certificate authorization risk of the certificate application device includes:

[0013] An authorization risk evaluation model is established to obtain the network call security factor and the inter-device task association factor, and the authorization risk value is calculated and analyzed based on the relationship between the network call security factor and the inter-device task association factor relative to the certificate authorization behavior.

[0014] In some embodiments of the present application, a method for evaluating the risk of certificate authorization by the certificate application device is further disclosed, and an expression for evaluating the risk of certificate authorization by the certificate application device is disclosed. The expression for evaluating the risk of certificate authorization by the certificate application device is:

[0015]

[0016] Among them, y is the authorization risk value, x1 is the network call security factor, x2 is the task association factor between devices, and k is the conversion coefficient.

[0017] In some embodiments of the present application, in order to determine the task correlation factor between devices, a method for setting the task correlation factor between devices is disclosed. The method for setting the task correlation factor between devices includes:

[0018] Acquire historical task process information, and establish a device association tree diagram for different task types based on the historical task process information;

[0019] Determining the type of work performed by the certificate application device according to the certificate application information sent by the certificate application device;

[0020] Determine the device association tree diagram of the application according to the work type performed by the certificate application device, scan and analyze the device association tree diagram of the application, determine the node where the cooperating device is located, and record the traversal nodes from the node where the certificate application device is located to the node where the cooperating device is located;

[0021] According to the number of the traversal nodes, a task correlation factor between devices is set.

[0022] In some embodiments of the present application, in order to determine the network call security factor, a method for setting the network call security factor is disclosed. The method for setting the network call security factor includes:

[0023] Generate a historical task list of the certificate application device according to the historical network call information of the certificate application device, determine each network call situation in the historical task list, compare each network call situation with the network call behavior standard library, and record the network call situation that meets the network call behavior standard library;

[0024] A network call security factor is set according to the ratio of the number of network call situations that meet the network call behavior standard library in the historical operation of the certificate application device to the total number of network call situations.

[0025] In some embodiments of the present application, the specific content of the network call behavior annotation library is disclosed, and the network call behavior standard library includes a number of tasks and network call behaviors corresponding to the tasks.

[0026] In some embodiments of the present application, the specific content of the network calling behavior is disclosed, and the network calling behavior includes the called network port, the order of called network ports, the retention time of called network ports, the called network address, the order of called network addresses, the retention time of called network addresses and the packet sending frequency of the called network address.

[0027] In some embodiments of the present application, in order to record the network call situation that complies with the network call behavior standard library, the method for determining whether the network call situation complies with the network call behavior standard library includes:

[0028] Associating a sub-element score with each behavior element of the network call behavior standard library;

[0029] Comparing the behavior element of the network call behavior with the behavior element of the network call behavior standard library, and summing the sub-element scores of the matching behavior elements to obtain a matching score;

[0030] If the matching score is greater than or equal to a preset value, it is determined that the network call situation conforms to the network call behavior standard library.

[0031] In some embodiments of the present application, an expression for determining the matching score is disclosed, and the calculation expression for the matching score is:

[0032] Q=R1Q1+R2Q2+R3Q3+...+RnQn;

[0033] Among them, Q is the match score, Q1, Q2, Q3, ..., Qn are sub-element scores of different behavior elements respectively, R1, R2, R3, ..., Rn are the match judgment coefficients of Q1, Q2, Q3, ..., Qn respectively, if a behavior element of the network call behavior is consistent with the behavior element of the network call behavior standard library, the corresponding judgment coefficient is 1, if not, the corresponding judgment coefficient is 0.

[0034] In some embodiments of the present invention, in order to generate certificate application information, the certificate application device is improved, and a certificate management tool is provided on the certificate application device. The certificate management tool is used to fill in certificate requirement information to generate certificate application information.

[0035] This application discloses a certificate management method, which has the following advantages compared with the general certificate management method:

[0036] 1. According to the operating process relationship between the certificate application device and the cooperating device regarding task processing, set the task correlation factor between devices. The task correlation factor between devices is used to express the closeness of the process relationship between different devices regarding the same task processing. If in the processing flow of the same task, the farther the process relationship between different devices is, the smaller the task correlation factor between devices is. The task correlation factor between devices can be used to reflect to a certain extent whether there are hidden dangers in the current operation of the certificate application device, so as to determine whether to send a certificate to the certificate application device, thereby improving the security of certificate management.

[0037] 2. Obtain the historical network call information of the certificate application device, analyze and compare the historical network call information of the certificate application device with the network call behavior standard library, and set the network call security factor according to the analysis and comparison results. The network call security factor is a dynamic variable for evaluating the security status of the network call behavior. The higher the degree of consistency between the historical network call information and the network call behavior standard library, the higher the network call security factor. The network call security factor can be used to reflect to a certain extent whether there are hidden dangers in the historical operation process of the certificate application device, so as to determine whether to send a certificate to the certificate application device, thereby improving the security of certificate management.

[0038] 3. Comprehensively analyze the task association factors and network call security factors between devices, evaluate the risks of certificate authorization for the certificate application device to obtain the authorization risk value, and then finally judge the operation safety of the certificate application device based on the authorization risk value. The judgment result of the certificate application device is more accurate, which effectively improves the security of certificate management.

[0039] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 A method step diagram of a certificate management method in an embodiment of the present application;

[0041] Figure 2 A method step diagram for setting task correlation factors between devices in an embodiment of the present application;

[0042] Figure 3 A method step diagram for setting a network call security factor in an embodiment of the present application;

[0043] Figure 4 This is a system process step diagram for generating a certificate in an embodiment of the present application. DETAILED DESCRIPTION

[0044] The technical solution of the present invention is further described below through the accompanying drawings and embodiments.

[0045] The following will be combined with the accompanying drawings and specific embodiments to clearly and completely describe the technical solution of the present invention. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and cannot be understood as limiting the scope of protection of the present invention. The skilled person in the field can make some non-essential improvements and adjustments based on the content of the present invention described below. In the present invention, unless otherwise clearly specified and limited, the technical terms used in this application should be the usual meanings understood by the technicians of the present invention. The terms "connected", "connected", "fixed", "set", etc. should be understood in a broad sense, which can be fixed connection, detachable connection, or integrated; can be directly connected, or indirectly connected through an intermediate medium; can be mechanically connected or electrically connected. Unless otherwise clearly defined. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to the specific circumstances. Unless otherwise clearly specified and limited, the first feature "above" or "below" the second feature can be that the first and second features are in direct contact, or the first and second features are in indirect contact through an intermediate medium. Moreover, the first feature "above" or "above" or "above" the second feature can be that the first feature is directly above or obliquely above the second feature, or simply means that the first feature is higher in level than the second feature. A first feature being "below" or "below" or "below" a second feature may mean that the first feature is directly below or obliquely below the second feature, or simply means that the first feature is smaller in horizontal height than the second feature. Relational terms such as first, second, etc. are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. It should be noted that similar numbers and letters represent similar items in the following figures, and therefore, once an item is defined in one figure, it does not need to be further defined or explained in subsequent figures.

[0046] Example:

[0047] The purpose of the present invention is to provide a method for effectively monitoring the security of certificate application equipment to improve the security of certificate application.

[0048] See also Figure 1 Therefore, the present invention discloses a certificate management method, including:

[0049] Step S100: The certificate issuing device obtains the certificate application information sent by the certificate application device, and determines, based on the certificate application information, a cooperating device with which the certificate application device needs to establish an encrypted data channel.

[0050] Step S200: setting an inter-device task association factor according to the operation process relationship between the certificate application device and the cooperating device regarding task processing.

[0051] It should be understood that the inter-device task correlation factor is used to express the closeness of the process relationship between different devices regarding the same task processing. If in the processing flow of the same task, the farther the process relationship between different devices is, the smaller the inter-device task correlation factor is.

[0052] Step S300: construct a network call behavior standard library based on the historical network call information of all devices running the management system.

[0053] It should be understood that the network call behavior standard library includes several jobs or tasks. Different jobs or tasks correspond to corresponding network call behaviors. The network call behavior can be the called network port, the order of called network ports, the retention time of called network ports, the called network address, the order of called network addresses, the retention time of called network addresses and the packet sending frequency of the called network address.

[0054] Step S400, obtaining the historical network call information of the certificate application device, analyzing and comparing the historical network call information of the certificate application device with the network call behavior standard library, and setting the network call security factor according to the analysis and comparison results.

[0055] It should be understood that the network call safety factor is a dynamic variable for evaluating the safety status of network call behavior. The higher the degree of consistency between the historical network call information and the network call behavior standard library, the higher the network call safety factor.

[0056] Step S500, based on the network call security factor of the certificate application device and the task association factor between devices, the risk evaluation of certificate authorization of the certificate application device is performed to obtain an authorization risk value. If the authorization risk value is higher than a preset value, the certificate issuing device is prohibited from sending a certificate to the certificate application device.

[0057] In some embodiments of the present application, in order to obtain the authorization risk value, a method for evaluating the certificate authorization risk of the certificate application device is disclosed. The method for evaluating the risk of certificate authorization of the certificate application device includes: establishing an authorization risk evaluation model, obtaining the network call security factor and the task association factor between devices, and calculating and analyzing the relationship between the network call security factor and the task association factor between devices relative to the certificate authorization behavior to obtain the authorization risk value.

[0058] It should be understood that the authorized hidden danger assessment model can be understood as a program that can obtain corresponding results by inputting various parameters. Corresponding expressions are set inside the program to calculate and analyze the various input parameters.

[0059] In some embodiments of the present application, a method for evaluating the risk of certificate authorization by the certificate application device is further disclosed, and an expression for evaluating the risk of certificate authorization by the certificate application device is disclosed. The expression for evaluating the risk of certificate authorization by the certificate application device is:

[0060]

[0061] Among them, y is the authorization risk value, x1 is the network call security factor, x2 is the task association factor between devices, and k is the conversion coefficient.

[0062] It should be understood that the It expresses the security of the system regarding certificate authorization. x1, as a network call security factor, expresses the dynamic variables regarding security of a device during the network call process. Its impact on the security of certificate authorization should increase proportionally. x2, as a task association factor between devices, expresses the closeness of the relationship between the two devices in the daily task processing operation process when a network data transmission connection is established between devices. Therefore, the larger the task association factor between devices, the same trend is observed in the impact on the security of certificate authorization. However, as the task association factor between devices increases, the impact on the security of certificate authorization decreases.

[0063] In some embodiments of the present application, in order to determine the task correlation factor between the devices, refer to Figure 2 , discloses a method for setting the task correlation factor between the devices, the method for setting the task correlation factor between the devices comprising:

[0064] Step S201, obtaining historical task process information, and establishing a device association tree diagram for different task types according to the historical task process information.

[0065] Step S202: determining the type of work to be performed by the certificate application device according to the certificate application information sent by the certificate application device.

[0066] Step S203, according to the work type performed by the certificate application device, determine the device association tree diagram of the application, scan and analyze the device association tree diagram of the application, determine the node where the cooperating device is located, and record the traversal nodes from the node where the certificate application device is located to the node where the cooperating device is located.

[0067] Step S204: setting the task correlation factor between devices according to the number of the traversed nodes.

[0068] In some embodiments of the present application, in order to determine the network call security factor, refer to Figure 3 , discloses a method for setting the network call security factor, the method for setting the network call security factor comprising:

[0069] Step S401, based on the historical network call information of the certificate application device, generate a historical task list of the certificate application device, determine each network call situation in the historical task list, compare each network call situation with the network call behavior standard library, and record the network call situation that conforms to the network call behavior standard library.

[0070] Step S402, setting a network call security factor according to the ratio of the number of network call situations that meet the network call behavior standard library in the historical operation of the certificate application device to the total number of network call situations.

[0071] In some embodiments of the present application, the specific content of the network call behavior annotation library is disclosed, and the network call behavior standard library includes a number of tasks and network call behaviors corresponding to the tasks.

[0072] In some embodiments of the present application, the specific content of the network calling behavior is disclosed, and the network calling behavior includes the called network port, the order of called network ports, the retention time of called network ports, the called network address, the order of called network addresses, the retention time of called network addresses and the packet sending frequency of the called network address.

[0073] In some embodiments of the present application, in order to record the network call situation that complies with the network call behavior standard library, the method for determining whether the network call situation complies with the network call behavior standard library includes:

[0074] In the first step, each behavior element of the network call behavior standard library is associated with a sub-element score.

[0075] It should be understood that the behavior elements refer to the called network port, the order of called network ports, the retention time of called network ports, the called network address, the order of called network addresses, the retention time of called network addresses and the packet sending frequency of the called network address.

[0076] In the second step, the behavior elements of the network call behavior are compared with the behavior elements of the network call behavior standard library, and the sub-element scores of the matching behavior elements are summed to obtain a matching score.

[0077] In the third step, if the matching score is greater than or equal to a preset value, it is determined that the network call situation conforms to the network call behavior standard library.

[0078] In some embodiments of the present application, an expression for determining the matching score is disclosed, and the calculation expression for the matching score is:

[0079] Q=R1Q1+R2Q2+R3Q3+...+RnQn.

[0080] Among them, Q is the match score, Q1, Q2, Q3, ..., Qn are sub-element scores of different behavior elements respectively, R1, R2, R3, ..., Rn are the match judgment coefficients of Q1, Q2, Q3, ..., Qn respectively, if a behavior element of the network call behavior is consistent with the behavior element of the network call behavior standard library, the corresponding judgment coefficient is 1, if not, the corresponding judgment coefficient is 0.

[0081] In some embodiments of the present invention, in order to generate certificate application information, the certificate application device is improved, and a certificate management tool is provided on the certificate application device. The certificate management tool is used to fill in certificate requirement information to generate certificate application information.

[0082] In some embodiments of the present application, in order to further illustrate the technical solution of the present application, a system operation process for issuing certificates is also disclosed.

[0083] See also Figure 4 , the system operation process includes:

[0084] 1. System flow of certificate generation:

[0085] Step one, start.

[0086] In the second step, the certificate management tool of the certificate application device fills in the certificate requirement information, generates the certificate application information and sends it to the certificate issuing device.

[0087] The third step is to perform system verification on the certificate application information.

[0088] In the fourth step, if the verification is passed, a certificate is generated. If the verification is not passed, an error message is returned to the certificate application device.

[0089] Step 5: Store the generated certificate in the certificate application device.

[0090] Step 6. End.

[0091] This application discloses a certificate management method, which has the following advantages compared with the general certificate management method:

[0092] 1. According to the operating process relationship between the certificate application device and the cooperating device regarding task processing, set the task correlation factor between devices. The task correlation factor between devices is used to express the closeness of the process relationship between different devices regarding the same task processing. If in the processing flow of the same task, the farther the process relationship between different devices is, the smaller the task correlation factor between devices is. The task correlation factor between devices can be used to reflect to a certain extent whether there are hidden dangers in the current operation of the certificate application device, so as to determine whether to send a certificate to the certificate application device, thereby improving the security of certificate management.

[0093] 2. Obtain the historical network call information of the certificate application device, analyze and compare the historical network call information of the certificate application device with the network call behavior standard library, and set the network call security factor according to the analysis and comparison results. The network call security factor is a dynamic variable for evaluating the security status of the network call behavior. The higher the degree of consistency between the historical network call information and the network call behavior standard library, the higher the network call security factor. The network call security factor can be used to reflect to a certain extent whether there are hidden dangers in the historical operation process of the certificate application device, so as to determine whether to send a certificate to the certificate application device, thereby improving the security of certificate management.

[0094] 3. Comprehensively analyze the task association factors and network call security factors between devices, evaluate the risks of certificate authorization for the certificate application device to obtain the authorization risk value, and then finally judge the operation safety of the certificate application device based on the authorization risk value. The judgment result of the certificate application device is more accurate, which effectively improves the security of certificate management.

[0095] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that they can still modify or replace the technical solution of the present invention with equivalents, and these modifications or equivalent replacements cannot cause the modified technical solution to deviate from the spirit and scope of the technical solution of the present invention.

Claims

1. A certificate management method, characterized in that: include: The certificate issuing device obtains the certificate application information sent by the certificate application device, and determines, based on the certificate application information, a cooperating device with which the certificate application device needs to establish an encrypted data channel; According to the relationship between the operation flow of task processing between the certificate application device and the cooperating device, setting the task correlation factor between the devices; Build a standard library of network call behavior based on the historical network call information of all devices running the management system; Acquire historical network call information of the certificate application device, analyze and compare the historical network call information of the certificate application device with the network call behavior standard library, and set a network call security factor according to the analysis and comparison results; According to the network call security factor of the certificate application device and the task association factor between devices, the risk evaluation of certificate authorization of the certificate application device is performed to obtain an authorization risk value. If the authorization risk value is higher than a preset value, the certificate issuing device is prohibited from sending a certificate to the certificate application device.

2. A certificate management method according to claim 1, characterized in that: The method for evaluating the hidden dangers of certificate authorization for the certificate application device includes: An authorization risk evaluation model is established to obtain the network call security factor and the inter-device task association factor, and the authorization risk value is calculated and analyzed based on the relationship between the network call security factor and the inter-device task association factor relative to the certificate authorization behavior.

3. A certificate management method according to claim 2, characterized in that: The risk evaluation expression for performing certificate authorization on the certificate application device is: Among them, y is the authorization risk value, x1 is the network call security factor, x2 is the task association factor between devices, and k is the conversion coefficient.

4. A certificate management method according to claim 1, characterized in that: The method for setting the task correlation factor between the devices includes: Acquire historical task process information, and establish a device association tree diagram for different task types based on the historical task process information; Determining the type of work performed by the certificate application device according to the certificate application information sent by the certificate application device; Determine the device association tree diagram of the application according to the work type performed by the certificate application device, scan and analyze the device association tree diagram of the application, determine the node where the cooperating device is located, and record the traversal nodes from the node where the certificate application device is located to the node where the cooperating device is located; According to the number of the traversal nodes, a task correlation factor between devices is set.

5. A certificate management method according to claim 1, characterized in that: The method for setting the network call security factor includes: Generate a historical task list of the certificate application device according to the historical network call information of the certificate application device, determine each network call situation in the historical task list, compare each network call situation with the network call behavior standard library, and record the network call situation that meets the network call behavior standard library; A network call security factor is set according to the ratio of the number of network call situations that meet the network call behavior standard library in the historical operation of the certificate application device to the total number of network call situations.

6. A certificate management method according to claim 5, characterized in that: The network call behavior standard library includes a plurality of tasks and network call behaviors corresponding to the tasks.

7. A certificate management method according to claim 6, characterized in that: The network calling behavior includes the called network port, the order of called network ports, the retention time of called network ports, the called network address, the order of called network addresses, the retention time of called network addresses and the packet sending frequency of the called network address.

8. A certificate management method according to claim 7, characterized in that: The method for determining whether the network call situation complies with the network call behavior standard library includes: Associating a sub-element score with each behavior element of the network call behavior standard library; Comparing the behavior element of the network call behavior with the behavior element of the network call behavior standard library, and summing the sub-element scores of the matching behavior elements to obtain a matching score; If the matching score is greater than or equal to a preset value, it is determined that the network call situation conforms to the network call behavior standard library.

9. A certificate management method according to claim 8, characterized in that: The calculation expression of the matching score is: Q=R1Q1+R2Q2+R3Q3+...+RnQn; Among them, Q is the match score, Q1, Q2, Q3, ..., Qn are sub-element scores of different behavior elements respectively, R1, R2, R3, ..., Rn are the match judgment coefficients of Q1, Q2, Q3, ..., Qn respectively, if a behavior element of the network call behavior is consistent with the behavior element of the network call behavior standard library, the corresponding judgment coefficient is 1, if not, the corresponding judgment coefficient is 0.

10. A certificate management method according to claim 1, characterized in that: The certificate application device is provided with a certificate management tool, and the certificate management tool is used to fill in certificate requirement information to generate certificate application information.

Images