Certificate resolution verification, signature verification method and platform based on Nginx
By using Nginx-based certificate parsing and verification and signature verification methods, combined with encryption cards conforming to national cryptographic standards, the convenience, compatibility, and security issues of traditional digital signature technology under C/S architecture are resolved. This achieves high-performance signature verification services and supports rapid deployment under B/S architecture and efficient operation of the encryption card module.
Patent Information
- Application Number
- CN202211736772.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-12-31
- Publication Date
- 2026-03-03
- Estimated Expiration
- 2042-12-31
AI Technical Summary
Traditional digital signature technology has shortcomings in terms of convenience, compatibility, security, and computational performance under a client/server architecture, especially in servers and clients using the OpenSSL cryptographic library.
This paper adopts a certificate parsing and verification method based on Nginx, combined with an encryption card that conforms to the national cryptographic standard. It utilizes Nginx's high-performance HTTP service to achieve high-performance digital signature, verification, and data encapsulation and decapsulation functions. It adopts a B/S architecture and performs hash calculation, signing, and verification through the encryption card module.
It improves the compatibility, convenience, and security of signature verification services, meets the high-performance signature verification requirements of commercial cryptographic algorithms, and supports rapid deployment in different systems and environments.
Smart Images
Figure CN116208338B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of digital encryption technology, and in particular to a certificate parsing and verification, signature verification method and platform based on Nginx. Background Technology
[0002] With the comprehensive development of informatization in my country and the deepening of informatization construction in various fields such as e-government, e-commerce and enterprises, the requirements for identity authentication, data signing, signature data verification, and signature authenticity and validity authentication in the transaction process are becoming increasingly sophisticated, leading to a growing demand for high-performance signature verification systems that use commercial cryptographic algorithms.
[0003] Traditional digital signature technology typically involves the signer generating a key pair under the protection of a trusted medium, signing the data using the private key, and sending the message, public key, and signature result to the verifier, who then uses the public key to verify the signature.
[0004] Traditional application scenarios typically employ a client / server architecture, where the server acts as the signer and the client as the verifier. Because most servers and clients utilize the OpenSSL cryptographic library to implement major cryptographic algorithms, commonly used keys, and certificate encapsulation, significant shortcomings exist in terms of convenience, compatibility, security, and computational performance. Summary of the Invention
[0005] The purpose of this invention is to propose a certificate parsing and verification, signature verification method and platform based on Nginx. By utilizing Nginx's high-performance HTTP service and combining it with an encryption card that conforms to national cryptographic standards, it can achieve high-performance digital signature, verification, data encapsulation and decapsulation functions, improve the compatibility, convenience and security of signature verification services, meet the high-performance signature verification requirements of the aforementioned commercial cryptographic algorithms, and solve the shortcomings in convenience, compatibility, security and computing performance in traditional application scenarios.
[0006] The technical solution adopted in this invention is as follows:
[0007] This invention relates to a certificate parsing and verification, and signature verification method based on Nginx, comprising the following steps:
[0008] The Nginx HTTP service module waits to receive HTTP requests. Utilizing Nginx's multi-process working mode, multiple processes can listen for HTTP requests simultaneously.
[0009] After receiving an HTTP request, the Nginx HTTP service module parses the HTTP request format. If the request information does not conform to the definition in the Nginx HTTP service module, a request failure message is returned.
[0010] The signature verification interface module performs data parsing and preprocessing based on the content of the HTTP request data.
[0011] Based on the content of the HTTP request, the encryption card module performs corresponding processing, including hash calculation, signing, and signature verification, while GmSSL performs certificate parsing and verification.
[0012] The signature verification interface module encapsulates the processing results into a data structure.
[0013] The HTTP request response returns the processing result.
[0014] Furthermore, the Nginx HTTP service module parses the HTTP request format, the signature verification interface module performs data parsing preprocessing based on the HTTP request data content, the encryption card module performs hash calculations, signatures, and verifications, and GmSSL performs certificate parsing and verification. The processing results are encapsulated in a data structure. If any of the above steps results in an error, an error log is recorded, and an error request is returned in the HTTP response.
[0015] Furthermore, the signature verification interface module performs data parsing preprocessing based on the HTTP request data content. Specifically, the signature verification interface module parses the request body data parameters carried in the HTTP request, mainly including the following two categories:
[0016] The String type is base64 decoded and then decoded using the OCTET STRING structure of ASN.1.
[0017] The Certificate type parameter is base64 decoded and then parsed in DER format, resulting in X509 type data.
[0018] Furthermore, the specific process for handling signature requests by the encryption card module is as follows:
[0019] Obtain key pairs from an external key management system;
[0020] The encryption card calculates a hash value for the signed data;
[0021] Use an encryption card to sign the hash value;
[0022] If any step in the above signature request processing steps fails, the data will be recorded in the error log.
[0023] Furthermore, the specific process for the signature verification request processing by the encryption card module is as follows:
[0024] The certificate can be either externally transmitted certificate content or externally transmitted certificate serial number. If it is externally transmitted certificate content, the certificate public key can be obtained directly. If it is externally transmitted certificate serial number, the certificate public key needs to be obtained from the certificate management system. Then, the encryption card calculates the hash value of the original data and verifies the signature using the hash value.
[0025] Furthermore, the signature verification interface module encapsulates the processing results into a data structure. The data structure of different HTTP request processing results follows the signature verification technical specifications issued by the State Cryptography Administration. Specifically, the data structure encapsulation for different HTTP requests is as follows:
[0026] The String type is encoded using the ASN.1 structure OCTET STRING, and then encoded using base64.
[0027] The Certificate type parameter should be encoded in DER format.
[0028] The certificate parsing and verification, signature verification platform based on Nginx includes an Nginx HTTP service module, a signature verification interface module, and an encryption card module. The modules communicate with each other through function calls.
[0029] The Nginx HTTP service module provides HTTP services, including HTTP request receiving and sending functions;
[0030] The signature verification interface module, as a submodule of Nginx, provides services for parsing and verifying digital certificates, digital signatures and verifications, and parsing and encapsulating message signatures.
[0031] The encryption card module uses national cryptographic algorithms to parse and verify digital certificates and perform signature verification. The encryption card module includes an encryption card software function library and an encryption card hardware device.
[0032] Furthermore, it also includes a management service platform, which provides full lifecycle management of keys and certificates. This platform is used to manage the keys and certificates used for signing, verification, certificate parsing, and certificate authentication, including the generation, import, and deletion of keys, as well as the import, deletion, and updating of certificates.
[0033] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:
[0034] This invention relates to a certificate parsing and verification, signature verification method and platform based on Nginx. The overall platform adopts a B / S architecture and uses software and hardware to work together. The software is an Nginx submodule, which can be quickly deployed and applied in different systems and environments. By utilizing Nginx's high-performance HTTP service and combining it with encryption card hardware that conforms to national cryptographic standards, high-performance digital signature, verification, and data encapsulation and decapsulation functions are realized, improving the security, compatibility, and convenience of the signature verification service. Attached Figure Description
[0035] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly described below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort, wherein:
[0036] Figure 1 This is a flowchart of the method of the present invention;
[0037] Figure 2 This is a flowchart of the request data parsing process in this invention;
[0038] Figure 3 This is a flowchart of the signature request processing in this invention;
[0039] Figure 4 This is a flowchart of the signature verification request processing in this invention;
[0040] Figure 5 This is a flowchart of the signature request encapsulation process in this invention.
[0041] Figure 6 This is a platform structure diagram of the present invention. Detailed Implementation
[0042] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only for explaining the invention and are not intended to limit the invention; that is, the described embodiments are merely some embodiments of the invention, and not all embodiments. The components of the embodiments of the invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.
[0043] It should be noted that the terms “comprising,” “including,” or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.
[0044] The features and performance of the present invention will be further described in detail below with reference to embodiments.
[0045] Example 1
[0046] This invention relates to a certificate parsing and verification, and signature verification method based on Nginx, such as... Figure 1 As shown, it includes the following steps:
[0047] The Nginx HTTP service module waits to receive HTTP requests. Utilizing Nginx's multi-process working mode, multiple processes can listen for HTTP requests simultaneously.
[0048] After receiving an HTTP request, the Nginx HTTP service module parses the HTTP request format. If the request information does not conform to the definition in the Nginx HTTP service module, a request failure message is returned.
[0049] The signature verification interface module performs data parsing and preprocessing based on the content of the HTTP request data.
[0050] The signature verification interface module performs data parsing preprocessing based on the HTTP request data content. Specifically, the signature verification interface module parses the request body data parameters carried by the HTTP request, mainly including the following two categories:
[0051] The String type is base64 decoded and then decoded using the OCTET STRING structure of ASN.1.
[0052] The Certificate type parameter is base64 decoded and then parsed in DER format, resulting in X509 type data.
[0053] The specific process of data parsing is as follows: Figure 2 As shown, the details are as follows:
[0054] Retrieve all request parameters. If this fails, log an error and return an error response. If successful, parse the parameters according to the request type. If parsing fails, log an error and return an error response. If parsing succeeds, the parsing process ends.
[0055] Based on the content of the HTTP request, the encryption card module performs corresponding processing, including hash calculation, signing, and signature verification, while GmSSL performs certificate parsing and verification.
[0056] The encryption card module handles the signature request process as follows: Figure 3 As shown, specifically:
[0057] Obtain key pairs from an external key management system;
[0058] The encryption card calculates a hash value for the signed data;
[0059] Use an encryption card to sign the hash value;
[0060] If any step in the above signature request processing steps fails, the data will be recorded in the error log.
[0061] The encryption card module processes signature verification requests as follows: Figure 4 As shown, specifically:
[0062] The certificate can be either externally transmitted certificate content or externally transmitted certificate serial number. If it is externally transmitted certificate content, the certificate public key can be obtained directly. If it is externally transmitted certificate serial number, the certificate public key needs to be obtained from the certificate management system. Then, the encryption card calculates the hash value of the original data and verifies the signature using the hash value.
[0063] If any of the following steps fails: obtaining the certificate from the certificate management system, obtaining the certificate public key, calculating the hash value of the original data using the encryption card, and verifying the signature using the encryption card, an error log will be recorded and an error response will be returned. Similarly, if the signature verification request does not contain externally input certificate content or an externally input certificate serial number, an error log will also be recorded and an error response will be returned.
[0064] The signature verification interface module encapsulates the processing results into a data structure.
[0065] Preferably, the signature verification interface module encapsulates the processing results into a data structure. The data structure of different HTTP request processing results follows the signature verification technical specifications issued by the State Cryptography Administration. Specifically, the data structure encapsulation for different HTTP requests is as follows:
[0066] The String type is encoded using the ASN.1 structure OCTET STRING, and then encoded using base64.
[0067] The Certificate type parameter should be encoded in DER format.
[0068] For data encapsulation of signature requests, both PKCS1 and PKCS7 data structures are supported. The specific process is as follows: Figure 5 As shown, the PKCS1 / PKCS7 data encapsulation process is as follows:
[0069] Determine the signature interface type: PKCS1 (digital signature) or PKCS7 (message signature). Define the PKCS1 or PKCS7 data structure according to the national cryptographic standard. Assign corresponding data to the relative positions of the PKCS1 or PKCS7 data structure. The ASN.1 library converts the data structure into a binary array, then performs base64 encoding. The signature data encapsulation is complete. If the ASN.1 library fails to convert the data structure into a binary array or fails to perform base64 encoding, an error log is recorded, indicating that the signature data encapsulation has failed.
[0070] HTTP request responses return processing results; different HTTP request return data message formats follow the signature verification technical specifications issued by the State Cryptography Administration.
[0071] Preferably, the Nginx HTTP service module parses the HTTP request format, the signature verification interface module performs data parsing preprocessing based on the HTTP request data content, the encryption card module performs hash calculation, signature, and verification, and GmSSL performs certificate parsing and verification. The processing results are encapsulated in a data structure. If any of the above steps results in an error, an error log is recorded, and an error request is returned in the HTTP response.
[0072] Example 2
[0073] Certificate resolution and verification, signature verification platform based on Nginx, such as Figure 6 As shown, it includes an Nginx HTTP service module, a signature verification interface module, and an encryption card module. The modules communicate with each other through function calls.
[0074] The Nginx HTTP service module provides HTTP services, including HTTP request receiving and sending functions;
[0075] The signature verification interface module, as a submodule of Nginx, provides services for parsing and verifying digital certificates, digital signatures and verifications, and parsing and encapsulating message signatures.
[0076] The encryption card module uses national cryptographic algorithms to parse and verify digital certificates and perform signature verification. The encryption card module includes an encryption card software function library and an encryption card hardware device.
[0077] Preferably, it also includes a management service platform, which provides key lifecycle management and certificate management, and is used to manage the keys and certificates used for signing, verification, certificate parsing and certificate verification, including key generation, import and deletion, as well as certificate import, deletion and update.
[0078] To meet the high-performance signature verification requirements of the aforementioned commercial cryptographic algorithms and address the shortcomings in convenience, compatibility, security, and computational performance in traditional application scenarios, this invention provides a method and platform for certificate and cryptographic services based on Nginx, including digital certificate parsing and verification, digital signature and verification, and message signature encapsulation and decapsulation.
[0079] This invention is implemented as a submodule of Nginx, enabling rapid deployment and application in different systems and environments; it adopts the HTTP protocol, namely the Nginx HTTP service module, which enables different systems to access the signature verification service, improving the compatibility and convenience of the signature verification service; and it supports HTTPS, improving the security of network communication.
[0080] This invention supports national commercial cryptographic algorithms such as SM1, SM2, SM3, and SM4, and follows the SM2 algorithm specification and signature verification technical specification issued by the State Cryptography Administration. It realizes the encapsulation and decapsulation operations of various data structures in the specification, thereby improving the security and compatibility of the signature verification service.
[0081] This invention adopts a B / S architecture and uses software and hardware collaboration. It utilizes the high-performance HTTP service provided by Nginx and combines it with encryption card hardware to achieve high-performance signature verification operations.
[0082] This invention constructs a complete set of digital certificate parsing and verification, signature verification system, which can be built according to specific business applications to provide a management service with functions such as key lifecycle management and certificate management.
[0083] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be conceived by those skilled in the art within the technical scope disclosed in the present invention without creative effort should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope defined in the claims.
Claims
1. A certificate parsing verification and signature verification method based on Nginx, characterized in that, Comprise the following steps: The Nginx http service module waits to receive an http request, and utilizes the multi-process working mode of Nginx, so that multiple processes can simultaneously listen to the http request; After the Nginx http service module receives the http request, the Nginx http module performs format analysis on the http request, and if the request information does not conform to the request information defined in the Nginx http service module, the request failure information is returned; The signature verification interface module performs data analysis preprocessing according to the http request data content, and the signature verification interface module analyzes the body request data carried by the http request, including the following two types: The String string type is decoded by base64 and then decoded by ASN.1 structure OCTET STRING; The Certificate certificate type parameter is decoded by base64 and then decoded by DER format, and is parsed into X509 type data; According to the http request content, the encryption card module performs corresponding processing, including Hash operation, signature, signature verification, GmSSL certificate analysis and verification; The signature verification interface module encapsulates the processing result data structure, and the data structure of different http request processing results complies with the signature verification technical specification published by the National Cryptography Bureau, and the data structure encapsulation of different http requests is specifically: The String string type is encoded by ASN.1 structure OCTET STRING, and then encoded by base64; The Certificate certificate type parameter is encoded by DER format; The http request response returns the processing result.
2. The Nginx-based certificate resolution verification, signature verification method according to claim 1, characterized in that: The Nginx http service module performs format analysis on the http request, the signature verification interface module performs data analysis preprocessing according to the http request data content, the encryption card module performs Hash operation, signature, signature verification, GmSSL certificate analysis and verification, and the processing result is encapsulated by data structure, and if any step in the above process is wrong, the error log is recorded, and the http response returns the error request.
3. The Nginx-based certificate resolution verification, signature verification method according to claim 1, characterized in that, The encryption card module for signature request processing process is specifically: Obtain the key pair from the external key management system; The encryption card calculates the hash value of the signature data; The encryption card signs the hash value; If any step in the above signature request processing steps is wrong, the data error log is recorded.
4. The Nginx-based certificate resolution verification, signature verification method according to claim 1, characterized in that, The encryption card module for signature verification request processing process is specifically: The external certificate content or external certificate serial number is transmitted, if the external certificate content is directly obtained, the certificate public key is obtained, if the external certificate serial number is transmitted, the certificate public key is obtained after the certificate is obtained from the certificate management system, then the encryption card calculates the hash value of the original data, and the encryption card verifies the hash value.
5. The certificate resolution verification, signature verification platform based on Nginx, characterized in that, The certificate analysis and verification, signature verification method of any one of claims 1-4 is used to execute the certificate analysis and verification, signature verification method, comprising an Nginx http service module, a signature verification interface module and an encryption card module, and the modules communicate with each other in the form of function call; The Nginx http service module provides an http service, including http request receiving and sending functions; The signature verification interface module, as a submodule of the Nginx, provides digital certificate analysis and verification, digital signature and verification, and message signature analysis and encapsulation services; The encryption card module performs digital certificate analysis and verification and signature verification through a national encryption algorithm. The encryption card module includes an encryption card software function library and an encryption card hardware device.
6. The Nginx-based certificate resolution verification, signature verification platform according to claim 5, characterized in that: The management service platform is further included. The management service platform provides key full life cycle management and certificate management, and is used for managing keys and certificates used for signature, verification, certificate analysis and certificate verification, including key generation, import, deletion, and certificate import, deletion, update.
Citation Information
Patent Citations
Block chain-based evidence storage method, device and equipment, and medium
CN111552676A