Health examination method and device, electronic equipment and storage medium

Abstract

The present disclosure provides a health check method and device, electronic equipment and storage medium, which can be applied to the field of information security, the field of finance or other fields. The method applied to a first device of a first network layer includes: in response to triggering a timing task, for each first component service configured in the first device, determining a second device configured with a second component service from a second network layer, wherein the second network layer is a downstream network layer of the first network layer, and the first component service corresponds to the second component service; and performing health check on a plurality of certificate components included in the second component service by using a plurality of desensitization certificates included in the first component service, to obtain the health status of each of the plurality of certificate components.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of information security and finance, and more particularly, to a health check method, device, equipment, medium and program product. BACKGROUND

[0002] Health check refers to monitoring a target network protocol address, detecting whether a backend server can normally provide services through health check, and isolating an unavailable backend server, so as to ensure timely and correct response to user requests and high availability of architecture. Meanwhile, in some scenarios, to ensure the security of network layer data transmission, after the client sends a request, the client not only needs to verify the legality of the service party, but also the service party needs to verify the legality of the client user identity, that is, two-way Secure Socket Layer (SSL) authentication. Currently, one SSL service may support multiple complex types of certificate authentication, and the availability of the certificate will affect whether the service can be normally performed, so health check in the two-way SSL authentication scenario is very important.

[0003] In the process of implementing the present disclosure, the inventors have found that at least the following problems exist in the related art: When performing health check in the two-way SSL authentication scenario, in order to simulate the client to complete the two-way authentication with the downstream security gateway, the upstream network layer device needs to deploy the client certificate, which may cause leakage of the client certificate information; meanwhile, one Secure Socket Layer service may support multiple complex types of certificate authentication, but the health check in the prior art can usually only detect one type of certificate in the complex type, and cannot comprehensively cover multiple complex type detection and achieve accurate fault isolation, thereby causing performance loss. SUMMARY

[0004] Therefore, the present disclosure provides a health check method, device, electronic equipment, readable storage medium and computer program product.

[0005] One aspect of the present disclosure provides a health check method applied to a first device of a first network layer, including:

[0006] In response to triggering a timing task, for each first component service configured in the first device, determining a second device configured with a second component service from a second network layer, wherein the second network layer is a downstream network layer of the first network layer, and the first component service corresponds to the second component service; and

[0007] Performing health check on multiple certificate components included in the second component service by using multiple desensitization certificates included in the first component service, to obtain the health status of each of the multiple certificate components.

[0008] According to an embodiment of the present disclosure, the above-mentioned health check on the plurality of certificate components included in the second component service by the plurality of desensitized certificates included in the first component service includes: for each desensitized certificate, determining a target certificate component from the plurality of certificate components based on the desensitized certificate; and initiating a mutual authentication request to the target certificate component in the second device by the desensitized certificate to determine the health status of the target certificate component.

[0009] According to an embodiment of the present disclosure, the above-mentioned determination of the target certificate component from the plurality of certificate components based on the desensitized certificate includes: determining the target certificate component from the plurality of certificate components based on the encryption type of the desensitized certificate, wherein the encryption type of the target certificate component is the same as the encryption type of the desensitized certificate.

[0010] According to an embodiment of the present disclosure, the above-mentioned determination of the target certificate component from the plurality of certificate components based on the desensitized certificate includes: determining the target certificate component from the plurality of certificate components based on the encryption type and the domain name of the desensitized certificate, wherein the encryption type of the target certificate component is the same as the encryption type of the desensitized certificate, and the domain name of the target certificate component is the same as the domain name of the desensitized certificate.

[0011] According to an embodiment of the present disclosure, the above-mentioned initiation of the mutual authentication request to the target certificate component in the second device by the desensitized certificate to determine the health status of the target certificate component includes: initiating the mutual authentication request to the target certificate component by the desensitized certificate to establish a communication link between the first device and the target certificate component; determining that the health status of the target certificate component indicates that the certificate is available in the case of determining that the communication link is successfully established; and determining that the health status of the target certificate component indicates that the certificate is unavailable in the case of determining that the communication link fails to be established.

[0012] According to an embodiment of the present disclosure, in the case of determining that the communication link is successfully established, the time consumption of the establishment of the communication link is determined; in the case of the time consumption being greater than or equal to a preset time length, it is determined that the health status of the target certificate component indicates that the certificate is unavailable; and in the case of the time consumption being less than the preset time length, it is determined that the health status of the target certificate component indicates that the certificate is available.

[0013] According to an embodiment of the present disclosure, the desensitized certificate is generated based on the public part of a client certificate, and the client certificate is related to the target certificate component.

[0014] According to an embodiment of the present disclosure, for each of the above-mentioned certificate components, in a case where the health status of the above-mentioned certificate component is represented as the certificate being unavailable, the above-mentioned certificate component is isolated.

[0015] Another aspect of the present disclosure provides a health inspection apparatus applied to a first device of a first network layer, the apparatus comprising:

[0016] A second device determination module is configured to, in response to a trigger timing task, determine, for each first component service configured in the first device, a second device configured with a second component service from a second network layer, wherein the second network layer is a downstream network layer of the first network layer, and the first component service corresponds to the second component service.

[0017] A health status determination module is configured to perform health inspection on a plurality of certificate components included in the second component service by using a plurality of desensitized certificates included in the first component service, to obtain the health status of each of the plurality of certificate components.

[0018] Another aspect of the present disclosure provides an electronic device comprising: one or more processors; a memory configured to store one or more instructions, wherein the one or more instructions, when executed by the one or more processors, cause the one or more processors to implement the method as described above.

[0019] Another aspect of the present disclosure provides a computer-readable storage medium storing computer-executable instructions, wherein the instructions, when executed, implement the method as described above.

[0020] Another aspect of the present disclosure provides a computer program product comprising computer-executable instructions, wherein the instructions, when executed, implement the method as described above.

[0021] According to an embodiment of the present disclosure, when different desensitized certificates are configured in the first device, each desensitized certificate can be used to perform health inspection on the corresponding certificate component in the second device, to determine the health status of each certificate component in the second device. Because the technical means of using the desensitized certificates configured in the first device to simulate the client certificate is adopted, the technical problem that the deployment of real client certificates may cause the leakage of client certificate information in the prior art is at least partially overcome, and the information security of the client is thus ensured. Because the technical means of using the desensitized certificates to perform health inspection on each corresponding certificate component in the second device to determine the health status of each certificate component is adopted, the technical problem that the precise isolation of the faulty certificate component cannot be achieved is at least partially overcome, and the technical effect of reducing performance loss is thus achieved. BRIEF DESCRIPTION OF DRAWINGS

[0022] The above and other objects, features and advantages of the present disclosure will become more apparent from the following description when taken in conjunction with the accompanying drawings, in which:

[0023] Figure 1 A schematic diagram of bidirectional Secure Sockets Layer authentication in the related art is shown schematically;

[0024] Figure 2 A schematic diagram of a deep health check process in a bidirectional Secure Sockets Layer scenario in the related art is shown schematically;

[0025] Figure 3 An exemplary system architecture to which the health check method and apparatus of the present disclosure can be applied is shown schematically;

[0026] Figure 4 A flowchart of a health check method according to an embodiment of the present disclosure is shown schematically;

[0027] Figure 5 A flowchart of determining a target certificate component health state according to an embodiment of the present disclosure is shown schematically;

[0028] Figure 6 A schematic diagram of a health check method applied in a bidirectional Secure Sockets Layer scenario according to an embodiment of the present disclosure is shown schematically;

[0029] Figure 7 A schematic diagram of another health check method applied in a bidirectional Secure Sockets Layer scenario according to an embodiment of the present disclosure is shown schematically;

[0030] Figure 8 A block diagram of a health check apparatus according to an embodiment of the present disclosure is shown schematically; and

[0031] Figure 9 A block diagram of an electronic device adapted to implement the health check method according to an embodiment of the present disclosure is shown schematically. DETAILED DESCRIPTION

[0032] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It is to be understood, however, that the description is merely exemplary and is intended to provide a thorough understanding of the present disclosure. The following description, given together with the accompanying drawings, is intended to provide a thorough understanding of the present disclosure. The description of known structures and techniques can be omitted to avoid obscuring the concept of the present disclosure.

[0033] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0034] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0035] When using expressions such as "at least one of A, B, and C," the expression should generally be interpreted in accordance with the meaning commonly understood by a person skilled in the art (e.g., "a system having at least one of A, B, and C" should include, but is not limited to, systems having A alone, having B alone, having C alone, having A and B, having A and C, having B and C, and / or having A, B, and C, etc.). Similarly, when using expressions such as "at least one of A, B, or C," the expression should generally be interpreted in accordance with the meaning commonly understood by a person skilled in the art (e.g., "a system having at least one of A, B, or C" should include, but is not limited to, systems having A alone, having B alone, having C alone, having A and B, having A and C, having B and C, and / or having A, B, and C, etc.).

[0036] Secure Hypertext Transfer Protocol (HTTPS): This protocol introduces Secure Sockets Layer (TLS) between the application layer Hypertext Transfer Protocol (HTTP) messages and the transport layer Transmission Control Protocol (TCP), employing cryptographic techniques to protect HTTP messages. It ensures the authenticity of the HTTP endpoints (the client and server are genuine and trustworthy, not impersonated), the confidentiality of the data (HTTP messages are encrypted, so even if eavesdropped, the plaintext cannot be obtained), and the integrity of the data (HTTP messages have integrity protection mechanisms; if tampered with, the receiver can detect it).

[0037] Figure 1 A schematic diagram illustrating bidirectional secure socket layer authentication in related technologies is shown.

[0038] Figure 1A simple model of two-way SSL authentication for a financial field, personal and enterprise customers and financial institutions. Figure 1 As shown in the figure, the 4-layer load balancing layer (L4 load balancing layer), intelligent domain name system (DNS) resolution layer, SSL gateway layer, and web / app server are all composed of multiple devices to build a high-availability architecture in a master-slave or cluster mode.

[0039] The client 101 issues an HTTPS service request, and SSL two-way authentication is required between the client 101 and the SSL gateway layer 103, and all data message interactions between them are in cipher text. After the SSL gateway layer completes the two-way SSL authentication with the client, it forwards the plaintext data to the web / app server 104 for application layer processing.

[0040] The upstream L4 / DNS layer 102 initiates an HTTPS deep health check to the downstream full link, which is used to isolate the fault of a single SSL security gateway device and achieve service high availability. Since the SSL service type deployed on the SSL gateway is two-way authentication, the upstream L4 / DNS device must also belong to the client certificate, so as to simulate the client to complete the two-way authentication with the SSL security gateway.

[0041] The SSL gateway layer 103 initiates an HTTP deep health check to the downstream web / app server 104, which is used to isolate the fault of a single web / app server and achieve service high availability.

[0042] During the research, it was found that the main defects of the existing HTTPS deep health check in the two-way SSL scenario are: in order to simulate the client to complete the two-way authentication with the SSL gateway layer, the upstream L4 / DNS device needs to deploy the client certificate, which may cause the leakage of client certificate information and pose a security risk; with the continuous development of SSL technology, the service type deployed on the SSL security gateway is gradually diversified, and a SSL service may support multiple types of complex certificates such as asymmetric encryption algorithm (e.g. RSA), elliptic curve cryptography (ECC), and national encryption algorithm (e.g. SM2), for example: RSA+SM2, ECC+SM2, or complex types such as dozens of protocol extension (SNI) strategies and certificates. The existing HTTPS deep health check in the two-way SSL scenario can usually only detect one type of certificate in the complex type, and cannot comprehensively cover multiple complex type detection and achieve precise fault isolation.

[0043] Figure 2A schematic diagram of a deep health check process in a related art bidirectional Secure Sockets Layer scenario is shown.

[0044] As shown in Figure 2 , an example is given for the scenario shown in Figure 1 . Component service a can support client access holding A certificate or B certificate, and component service β can support client access holding C certificate or D certificate. In order to achieve business high availability, real client certificates need to be deployed in component service a and β to simulate client-initiated bidirectional SSL HTTPS deep health check requests.

[0045] Virtual service a and virtual service β are deployed in each device in the SSL gateway layer, and each virtual service corresponds to the corresponding component service in the upstream L4 / DNS layer device. When the request stream of the A certificate client is transferred to virtual service a 203 in device 1, the A certificate module is used for processing, and when the request stream of the B certificate client is transferred to virtual service a 203, the B certificate module is used for processing. And it is known that Figure 2 , in virtual service a 203 of device 1, the A certificate module can be normally used, and the B certificate module fails, but since only one type of client certificate can be deployed in the component service, and only a bidirectional SSL HTTPS deep health check request can be initiated according to the certificate type, only the A certificate module in virtual service a 203 can be initiated health check, and when the result of the health check is normal, it is considered that the B certificate module can also be normally used, so that the request of the B certificate client is transmitted into the B module for processing, which causes an error, affecting the use of the client user.

[0046] Similarly, it is known that Figure 2 , in virtual service β 204 in device 2, the C certificate module is normal but the D certificate module has a problem, and the client certificate deployed in the corresponding component service in the upstream L4 / DNS layer device is C certificate, so only the C certificate health check request can be initiated, so that after the health check, it is found that the C certificate module is a faulty module, it is considered that virtual service β 204 is totally abnormal and is isolated as a whole, so that all related requests of the C certificate client and the D certificate client are sent to virtual service β of device 1, so that the performance pressure of device 1 is multiplied.

[0047] Therefore, the deep health check in the bidirectional Secure Sockets Layer scenario in the related art has the problems of client private key information leakage, abnormal certificate module not being isolated resulting in business success rate being damaged, and normal certificate module being mis-isolated resulting in unnecessary performance pressure.

[0048] Therefore, the embodiments of the present disclosure provide a health check method, a health check device, an electronic device, a readable storage medium and a computer program product. The method applied to a first device of a first network layer includes: in response to a trigger timing task, determining, for each first component service configured in the first device, a second device configured with a second component service from a second network layer, wherein the second network layer is a downstream network layer of the first network layer, and the first component service corresponds to the second component service; and performing health check on a plurality of certificate components included in the second component service by using a plurality of desensitization certificates included in the first component service, to obtain a health status of each of the plurality of certificate components.

[0049] It should be noted that the health check method and device determined by the embodiments of the present disclosure can be used in the field of information security or the field of finance. The health check method and device determined by the embodiments of the present disclosure can also be used in any field other than the field of information security and the field of finance, for example, the field of computer technology. The application field of the health check method and device determined by the embodiments of the present disclosure is not limited.

[0050] In the embodiments of the present disclosure, the collection, updating, analysis, processing, use, transmission, provision, disclosure, storage and the like of the data involved (for example, including but not limited to user personal information) comply with the provisions of relevant laws and regulations, are used for legal purposes, and do not violate public order and good customs. In particular, necessary measures are taken for user personal information to prevent illegal access to user personal information data, and to maintain user personal information security, network security and national security.

[0051] In the embodiments of the present disclosure, the authorization or consent of the user is obtained before the user personal information is acquired or collected.

[0052] Figure 3 An exemplary system architecture to which the health check method and device according to the embodiments of the present disclosure can be applied is schematically shown. It should be noted that, Figure 3 The system architecture shown is only an example of a system architecture to which the embodiments of the present disclosure can be applied, to help those skilled in the art understand the technical content of the present disclosure, but does not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios.

[0053] As Figure 3 shown, the system architecture 300 according to the embodiment can include terminal devices 301, 302, 303, a network 304 and a server 305. The network 304 is used as a medium to provide a communication link between the terminal devices 301, 302, 303 and the server 305. The network 304 can include various connection types, such as wired and / or wireless communication links, etc.

[0054] The user can use the terminal devices 301, 302, and 303 to interact with the server 305 through the network 304 to receive or send messages, etc. Various communication client applications can be installed on the terminal devices 301, 302, and 303, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, and / or social platform software, etc. (only as examples).

[0055] The terminal devices 301, 302, and 303 can be various electronic devices with display screens and supporting web browsing, including but not limited to smartphones, tablet computers, laptop computers, desktop computers, etc.

[0056] The server 305 can be a server providing various services, such as a background management server supporting websites browsed by the user using the terminal devices 301, 302, and 303 (only as an example). The background management server can analyze and process received user requests, etc., and feed back the processing results (such as web pages, information, or data, etc. obtained or generated according to user requests) to the terminal devices.

[0057] It should be noted that the health examination method provided by the embodiments of the present disclosure can generally be executed by the server 305. Accordingly, the health examination apparatus provided by the embodiments of the present disclosure can generally be arranged in the server 305. The health examination method provided by the embodiments of the present disclosure can also be executed by a server or a server cluster different from the server 305 and capable of communicating with the terminal devices 301, 302, and 303 and / or the server 305. Accordingly, the health examination apparatus provided by the embodiments of the present disclosure can also be arranged in a server or a server cluster different from the server 305 and capable of communicating with the terminal devices 301, 302, and 303 and / or the server 305. Alternatively, the health examination method provided by the embodiments of the present disclosure can also be executed by the terminal devices 301, 302, or 303, or by other terminal devices different from the terminal devices 301, 302, or 303. Accordingly, the apparatus provided by the embodiments of the present disclosure can also be arranged in the terminal devices 301, 302, or 303, or in other terminal devices different from the terminal devices 301, 302, or 303.

[0058] For example, any one of the terminal devices 301, 302, or 303 (for example, the terminal device 301, but not limited thereto) initiates a health examination request, and then the terminal device 301 can execute the health examination method provided by the embodiments of the present disclosure locally, or send the health examination request to other terminal devices, servers, or server clusters, and execute the health examination method provided by the embodiments of the present disclosure by the other terminal devices, servers, or server clusters receiving the request.

[0059] It should be understood that Figure 1 The number of terminal devices, networks and servers in the above-mentioned embodiments is only illustrative. Any number of terminal devices, networks and servers can be provided according to implementation needs.

[0060] Figure 4 A flowchart of a health check method according to an embodiment of the present disclosure is illustratively shown.

[0061] As Figure 4 shown, the method includes operations S401-S402.

[0062] In operation S401, in response to a trigger timing task, for each first component service configured in the first device, a second device configured with a second component service is determined from a second network layer, wherein the second network layer is a downstream network layer of the first network layer, and the first component service corresponds to the second component service.

[0063] According to an embodiment of the present disclosure, corresponding component services are included in the first network layer and the second network layer. The first component service in the first network layer and the second component service in the second network layer can perform bidirectional authentication, such as SSL bidirectional authentication.

[0064] According to an embodiment of the present disclosure, by determining the second service component corresponding to the first component service in the first network layer from the second network layer, the corresponding service component can be determined for subsequent health check, thereby accelerating the health check rate.

[0065] In operation S402, the multiple certificate components included in the second component service are respectively health checked by the multiple desensitization certificates included in the first component service, and the health status of each of the multiple certificate components is obtained.

[0066] According to an embodiment of the present disclosure, the desensitization certificate included in the first component service is related to the service type of the first component service and the service client certificate information.

[0067] According to an embodiment of the present disclosure, in the first network layer, one device can support multiple component services, and different desensitization certificates of different encryption types and belonging to different domain names can be configured in each component service.

[0068] According to an embodiment of the present disclosure, the certificate component included in the second component service corresponds to the desensitization certificate included in the first component service.

[0069] According to the embodiment of the present disclosure, when different desensitization certificates are configured in the first device, the health of the corresponding certificate components in the second device can be checked using each desensitization certificate to determine the health status of each certificate component in the second device. Because the technical means of configuring different desensitization certificates in the first device to simulate the client certificate is adopted, at least part of the technical problems that the deployment of real client certificates in the prior art may cause the leakage of client certificate information, and thus the security of the client is ensured. Because the technical means of checking the health of the corresponding certificate components in the second device using the desensitization certificate to determine the health status of each certificate component is adopted, at least part of the technical problems that the failure of the certificate component cannot be accurately isolated are overcome, and thus the technical effect of reducing the performance loss is achieved.

[0070] The method shown in Figures 5-7 will be further described below with reference to specific embodiments. Figure 4

[0071] Figure 5 The flowchart for determining the health status of the target certificate component according to the embodiment of the present disclosure is schematically shown.

[0072] As shown in Figure 5 , the process of determining the health status of the target certificate component includes operations S501-S502.

[0073] In operation S501, for each desensitization certificate, the target certificate component is determined from the plurality of certificate components based on the desensitization certificate.

[0074] In operation S502, a two-way authentication request is initiated to the target certificate component in the second device using the desensitization certificate to determine the health status of the target certificate component.

[0075] According to the embodiment of the present disclosure, when the health of the target certificate component is checked, the target certificate component is first determined from the plurality of certificate components using the desensitization certificate, and then the two-way authentication between the desensitization certificate and the target certificate component is performed to determine the health status of the target certificate component.

[0076] According to the embodiment of the present disclosure, the target certificate component is determined using the desensitization certificate, and the health status of the target certificate component is determined using the target certificate component, which can determine the health status of each certificate component in each second device, ensure that the components with healthy health status perform business processing, and isolate the certificate components with certificate unavailability, so that the business can be accurately allocated to the available certificate components when the business is allocated, and at least part of the performance loss and error conditions caused by the error isolation of the available certificate components or the non-isolation of the unavailable certificate caused by the inaccurate isolation in the prior art are overcome. ​

[0077] According to an embodiment of the present disclosure, the determining, based on the desensitized certificate, the target certificate component from the plurality of certificate components, at operation S501 can include the following operations.

[0078] The target certificate component is determined from the plurality of certificate components based on the encryption type of the desensitized certificate, wherein the encryption type of the target certificate component is the same as the encryption type of the desensitized certificate.

[0079] According to an embodiment of the present disclosure, the desensitized certificate can perform mutual authentication on the certificate components of the same encryption type, thereby simulating the mutual authentication process of the real client and the downstream network layer, without deploying the real client certificate, so as to realize the health check on the certificate components in the downstream network layer device, and further ensure the security of the client information.

[0080] According to an embodiment of the present disclosure, the determining, based on the desensitized certificate, the target certificate component from the plurality of certificate components, at operation S501 can include the following operations.

[0081] The target certificate component is determined from the plurality of certificate components based on the encryption type and the domain name of the desensitized certificate, wherein the encryption type of the target certificate component is the same as the encryption type of the desensitized certificate, and the domain name of the target certificate component is the same as the domain name of the desensitized certificate.

[0082] According to an embodiment of the present disclosure, the target certificate component in the plurality of certificate components can also be determined according to the encryption type and the domain name of the desensitized certificate, and then mutual authentication is performed, thereby simulating the mutual authentication process of the real client and the downstream network layer, without deploying the real client certificate, so as to ensure the security of the client information.

[0083] According to an embodiment of the present disclosure, the initiating, by the first device, a mutual authentication request to the target certificate component in the second device using the desensitized certificate to determine the health status of the target certificate component, at operation S502 can include the following operations.

[0084] The mutual authentication request is initiated to the target certificate component using the desensitized certificate to establish a communication link between the first device and the target certificate component; in a case where it is determined that the communication link is established successfully, the health status of the target certificate component is determined to be certificate available; and in a case where it is determined that the communication link is established unsuccessfully, the health status of the target certificate component is determined to be certificate unavailable.

[0085] According to an embodiment of the present disclosure, when performing mutual authentication of the desensitized certificate and the target component, first, the establishment of the communication link is performed, if the establishment of the communication link is successful, it can be considered that the health status of the target certificate component is certificate available, if the establishment fails, it can be considered that the health status of the target certificate component is certificate unavailable, and the health status of the target certificate component is determined by whether the establishment of the communication link is successful, so that the health of the certificate component in each second device can be checked quickly and accurately.

[0086] According to an embodiment of the present disclosure, in the case where it is determined that the establishment of the communication link is successful, the time consumed by the establishment of the communication link is determined, in the case where the time consumed by the establishment is greater than or equal to a preset time length, it is determined that the health status of the target certificate component is certificate unavailable, and in the case where the time consumed by the establishment is less than the preset time length, it is determined that the health status of the target certificate component is certificate available.

[0087] According to an embodiment of the present disclosure, the preset time length is not limited, and can be set according to specific requirements.

[0088] According to an embodiment of the present disclosure, after the establishment of the communication link is successful, the time consumed by the establishment of the communication link can also be determined, if the time consumed is too long, it is also considered that the certificate is unavailable, and then the certificate component that may have a performance failure can be isolated, so as to avoid that the certificate component with a problem causes an error in the subsequent business processing process.

[0089] According to an embodiment of the present disclosure, the desensitized certificate is generated based on the public part of the client certificate, and the client certificate is related to the target certificate component.

[0090] According to an embodiment of the present disclosure, the client certificate includes a public part and a secret part, and the desensitized certificate can be generated according to the public part, so as to ensure that the content of the desensitized certificate has the ability to effectively simulate the real client certificate.

[0091] According to an embodiment of the present disclosure, for each certificate component, in the case where the health status of the certificate component is certificate unavailable, the certificate component is isolated.

[0092] According to an embodiment of the present disclosure, the certificate component with the health status of certificate unavailable is accurately isolated. According to a preset recovery strategy, when it is found that the health status of the certificate component is certificate available through health check, the accurate recovery is performed.

[0093] It should be noted that, unless it is explicitly stated that there is an execution sequence between different operations, or there is an execution sequence between different operations in the technical implementation, the execution sequence between multiple operations can not be distinguished, and multiple operations can be executed simultaneously.

[0094] Figure 6 A schematic diagram of a health check method applied to a bidirectional Secure Sockets Layer scenario is shown.

[0095] As shown in Figure 6 , a schematic description of the health check method is given in the case of a bidirectional SSL complex scenario with RSA and SM2 certificates, ECC and SM2 certificates.

[0096] Assume that the first network layer is the L4 / DNS layer, and the second network layer is the SSL gateway layer, and further includes a downstream network layer, the web server layer, of the second network layer. The first network layer includes a first component service, for example, component service a 601 and component service b 602 of the L4 / DNS layer. The second network layer includes a plurality of second devices, each of which is configured with a second component service, which can include a plurality of certificate components, for example, component service a 603 of device 1 in the SSL gateway layer includes an SM2 certificate component and an RSA certificate component.

[0097] In order to achieve business high availability, a deep health check of the second component service of the SSL gateway layer is required, and therefore a desensitization certificate needs to be configured in the first component service, for example, the HTTPS deep health check SM2+RSA desensitization certificate is configured in component service a 601 of the L4 / DNS layer, and then a bidirectional SSL HTTPS deep health check request can be initiated by simulating a client. Both certificate desensitization and security problem of key leakage risk are achieved.

[0098] Component service a 603 in device 1 of the SSL gateway layer corresponds to component service a 601 of the upstream L4 / DNS layer, and component service a 603 supports SSL bidirectional authentication of both SM2 and RSA protocols on one network link. When the request of RSA client a flows to service a of component service a 603, the RSA certificate component is used for processing, and when the request of SM2 client a flows to service a of 603, the SM2 certificate component is used for processing. When the health check based on the SM2 desensitization certificate and the RSA desensitization certificate in component service a of the L4 / DNS layer shows that the SM2 certificate component of service a of component service a 603 is normal and the RSA certificate component is faulty, component service a 603 will not be isolated as a whole, resulting in an increase in the performance pressure of device 2. On the contrary, component service a 601 can accurately identify the specific situation of service a of component service a 603. The RSA module of service a of component service a 603 will be precisely fault-isolated, and the SM2 module will normally receive the request of SM2 client a.

[0099] The component service β 606 in the device 2 of the SSL gateway layer is the same as its corresponding component service β 602 of the upstream L4 / DNS layer. The component service β 606 supports SSL bidirectional authentication of both SM2 and ECC protocols on one network link. When the request stream of the ECC client β flows to the component service β 606, the ECC certificate component is used for processing; when the request stream of the SM2 client β flows to the component service β 606, the SM2 certificate component is used for processing. When the SM2 certificate component of the component service β 606 fails and the ECC certificate component is normal, the SM2 certificate component of the component service β 606 will not be mistakenly considered normal and continue to be assigned transaction requests, resulting in a probabilistic error. On the contrary, the component service β 602 can accurately identify the specific situation of the component service β 606. The SM2 certificate component of the component service β 606 will be accurately isolated, and the ECC certificate component will normally receive the request of the ECC client β.

[0100] Figure 7 Another application of the health check method in the bidirectional secure socket layer scenario is schematically shown.

[0101] As Figure 7 shown, a bidirectional SSL complex scenario with SNI multi-domain name is taken as an example for schematic illustration. It is also assumed that the first network layer is the L4 / DNS layer, the second network layer is the SSL gateway layer, and the second network layer further includes a downstream network layer, i.e., a web server layer. The first network layer includes a first component service, for example, a component service δ 701. The second network layer includes a plurality of second devices, each of which is configured with a second component service. The second component service can include a plurality of certificate components, for example, a component service δ 610 in the device 1 of the SSL gateway layer, which includes an RSA SNI1 certificate component, an RSA SNI2 certificate component, and an RSA SNI3 certificate component. Among them, the domain name extension of the RSA certificate is only an example, and the SM2, ECC, etc. can also be extended, for example, if the SM2 certificate is extended by domain name, the certificate component included in the device of the SSL gateway layer can be SM2 SNI1 certificate component, SM2 SNI2 certificate component, and SM2 SNI3 certificate component.

[0102] The L4 / DNS layer includes a component service δ 701. The component service δ 701 is deployed with RSA SNI1 desensitization certificate, RSA SNI2 desensitization certificate, and RSA SNI3 desensitization certificate to simulate the client to initiate a bidirectional SSL HPPTS deep health check request. The plurality of desensitization certificates configured can cover all SNI domain name strategy certificates and service links, and avoid the risk of key leakage through certificate decryption.

[0103] The component service δ702 of the device 1 in the SSL gateway layer corresponds to the component service δ701 of the upstream L4 / DNS layer. The component service δ702 supports SSL mutual authentication of three domain names SNI1, SNI2, and SNI3 and their respective corresponding certificates simultaneously on one network link. When the request flow of the SNI1 client is transferred to the component service δ702, the SNI1 certificate component is used for processing; when the request is for the SNI2 client, the SNI2 certificate component is used for processing; and when the request is for the SNI3 client, the SNI3 certificate component is used for processing. When the SNI1 certificate component is normal and the SNI2 and SNI3 modules are faulty, the component service δ702 will not be mistakenly considered to be completely normal, but will accurately isolate the faulty SNI2 and SNI3 certificate components, and the requests of the SNI2 and SNI3 clients will not be allocated to the faulty SNI2 and SNI3 certificate components for processing, so that the problem of performance pressure increase or performance loss of the device 1 caused by misjudgment can be avoided.

[0104] The component service δ703 of the device 2 in the SSL gateway layer is the same as the above. When the SNI1 certificate component is faulty and the SNI2 and SNI3 certificate components are normal, the component service δ703 in the device 2 will not be mistakenly considered to be completely abnormal, but will accurately isolate the faulty SNI1 certificate component, thereby avoiding the problem of performance pressure increase or performance loss of the device 1 caused by misjudgment.

[0105] Figure 8 A block diagram of a health check device according to an embodiment of the present disclosure is schematically shown.

[0106] As shown in Figure 8 The health check device 800 applied to a first device of a first network layer includes a second device determination module 810 and a health state determination module 820.

[0107] The second device determination module 810 is configured to, in response to a trigger timing task, for each first component service configured in the first device, determine a second device configured with a second component service from a second network layer, wherein the second network layer is a downstream network layer of the first network layer, and the first component service corresponds to the second component service.

[0108] The health state determination module 820 is configured to perform health check on a plurality of certificate components included in the second component service by using a plurality of desensitization certificates included in the first component service, to obtain the health state of each of the plurality of certificate components.

[0109] According to an embodiment of the present disclosure, the health state determination module 820 can include:

[0110] A target certificate component determination sub-module is configured to, for each desensitization certificate, determine a target certificate component from the plurality of certificate components based on the desensitization certificate.

[0111] The health status determination submodule is configured to initiate a bidirectional authentication request to a target certificate component in the second device by using the desensitized certificate, to determine a health status of the target certificate component.

[0112] According to an embodiment of the present disclosure, the target certificate component determination submodule can include a target certificate component determination unit.

[0113] The first target certificate component determination unit is configured to determine the target certificate component from the plurality of certificate components based on an encryption type of the desensitized certificate, wherein the encryption type of the target certificate component is the same as the encryption type of the desensitized certificate.

[0114] According to an embodiment of the present disclosure, the target certificate component determination submodule can further include:

[0115] The second target certificate component determination unit is configured to determine the target certificate component from the plurality of certificate components based on the encryption type and a domain name of the desensitized certificate, wherein the encryption type of the target certificate component is the same as the encryption type of the desensitized certificate, and the domain name of the target certificate component is the same as the domain name of the desensitized certificate.

[0116] According to an embodiment of the present disclosure, the health status determination submodule includes a communication link establishment unit, a first health status determination unit, and a second health status determination unit.

[0117] The communication link establishment unit is configured to initiate the bidirectional authentication request to the target certificate component by using the desensitized certificate, to establish a communication link between the first device and the target certificate component.

[0118] The first health status determination unit is configured to determine that the health status of the target certificate component is represented as certificate available, in a case where it is determined that the communication link is established successfully.

[0119] The second health status determination unit is configured to determine that the health status of the target certificate component is represented as certificate unavailable, in a case where it is determined that the communication link is not established successfully.

[0120] According to an embodiment of the present disclosure, the health check apparatus 800 further includes an establishment time consumption determination module, a third health status determination module, and a fourth health status determination module.

[0121] The establishment time consumption determination module is configured to determine an establishment time consumption of the communication link, in a case where it is determined that the communication link is established successfully.

[0122] The third health state determining module is configured to determine that the health state of the target certificate component is represented as certificate unavailable when the establishment time consumption is greater than or equal to the preset time length.

[0123] The fourth health state determining module is configured to determine that the health state of the target certificate component is represented as certificate available when the establishment time consumption is less than the preset time length.

[0124] According to an embodiment of the present disclosure, the health check device 800 further comprises a desensitized certificate generating module.

[0125] The desensitized certificate generating module is configured to generate the desensitized certificate based on the public part of the client certificate related to the target certificate component.

[0126] According to an embodiment of the present disclosure, the health check device 800 further comprises a certificate component isolation processing module.

[0127] The certificate component isolation processing module is configured to, for each of the certificate components, isolate the certificate component when the health state of the certificate component is represented as certificate unavailable.

[0128] Any one or more of the modules, sub-modules, units, sub-units according to the embodiments of the present disclosure, or at least part of functions of any one or more of the modules, sub-modules, units, sub-units, can be implemented in one module. Any one or more of the modules, sub-modules, units, sub-units according to the embodiments of the present disclosure can be split into multiple modules for implementation. Any one or more of the modules, sub-modules, units, sub-units according to the embodiments of the present disclosure can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on substrate, a system on package, an application specific integrated circuit (ASIC), or any other reasonable way of hardware or firmware through integration or packaging of circuits, or in any one of software, hardware and firmware or in an appropriate combination of any of the above. Alternatively, one or more of the modules, sub-modules, units, sub-units according to the embodiments of the present disclosure can be at least partially implemented as computer program modules that can perform corresponding functions when the computer program modules are run.

[0129] For example, any of the second device determining module 810 and the health status determining module 820 can be combined in one module / unit / sub-unit, or any of the modules / units / sub-units can be split into multiple modules / units / sub-units. Alternatively, at least part of the functions of one or more of the modules / units / sub-units can be combined with at least part of the functions of other modules / units / sub-units, and implemented in one module / unit / sub-unit. According to an embodiment of the present disclosure, at least one of the second device determining module 810 and the health status determining module 820 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on board, a system on package, an application specific integrated circuit (ASIC), or any other reasonable manner of integrating or packaging a circuit, etc. or implemented by hardware or firmware, or implemented in any one of software, hardware and firmware or in a proper combination of any of them. Alternatively, at least one of the second device determining module 810 and the health status determining module 820 can be at least partially implemented as a computer program module which, when executed, can perform the corresponding functions.

[0130] Figure 9 A block diagram of an electronic device suitable for implementing the health check method according to an embodiment of the present disclosure is schematically shown. Figure 9 The electronic device shown is merely an example and should not bring any limitation to the functions and use range of the embodiments of the present disclosure.

[0131] As shown in Figure 9 The computer electronic device 900 according to an embodiment of the present disclosure includes a processor 901 which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 902 or loaded from a storage portion 908 into a random access memory (RAM) 903. The processor 901 can include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset, and / or a special-purpose microprocessor (such as an application specific integrated circuit (ASIC)), etc. The processor 901 can also include an on-board memory for cache use. The processor 901 can include a single processing unit or multiple processing units for performing different actions of the method processes according to embodiments of the present disclosure.

[0132] In the RAM 903, various programs and data required for the operation of the electronic device 900 are stored. The processor 901, the ROM 902, and the RAM 903 are connected to each other via the bus 904. The processor 901 performs various operations according to the method flow of the embodiments of the present disclosure by executing the programs stored in the ROM 902 and / or the RAM 903. It should be noted that the programs can also be stored in one or more memories other than the ROM 902 and the RAM 903. The processor 901 can also perform various operations according to the method flow of the embodiments of the present disclosure by executing the programs stored in the one or more memories.

[0133] According to an embodiment of the present disclosure, the electronic device 900 can further include an input / output (I / O) interface 905, which is also connected to the bus 904. The electronic device 900 can further include one or more of the following components connected to the input / output (I / O) interface 905: an input part 906 including a keyboard, a mouse, etc.; an output part 907 including a display such as a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage part 908 including a hard disk, etc.; and a communication part 909 including a network interface card such as a LAN card, a modem, etc. The communication part 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output (I / O) interface 905 as necessary. A removable medium 911 such as a magnetic disk, a magneto-optical disk, a semiconductor memory, etc. is attached to the drive 910 as necessary, so that a computer program read out therefrom is installed in the storage part 908 as necessary.

[0134] According to an embodiment of the present disclosure, the method flow according to the embodiments of the present disclosure can be implemented as a computer software program. For example, the embodiments of the present disclosure include a computer program product comprising a computer program carrying out the method shown in the flowchart, which is stored on a computer readable storage medium. In such embodiments, the computer program can be downloaded and installed from a network by the communication part 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, the above-described functions defined in the system of the embodiments of the present disclosure are performed. According to an embodiment of the present disclosure, the system, the device, the apparatus, the module, the unit, etc. described above can be implemented by computer program modules.

[0135] The present disclosure also provides a computer readable storage medium, which can be included in the device / apparatus / system described in the above embodiments, or exist separately without being assembled into the device / apparatus / system. The above computer readable storage medium carries one or more programs, which when executed, implement the method according to the embodiments of the present disclosure.

[0136] According to an embodiment of the present disclosure, the computer readable storage medium can be a non-volatile computer readable storage medium. For example, it can include, but is not limited to: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In this disclosure, a computer readable storage medium can be any tangible medium that contains or stores a program, which can be used by or in connection with an instruction execution system, apparatus, or device.

[0137] For example, according to an embodiment of the present disclosure, the computer readable storage medium can include one or more memories of the ROM 902 and / or the RAM 903 described above and / or other than the ROM 902 and the RAM 903.

[0138] Embodiments of the present disclosure also include a computer program product, which includes a computer program containing program codes for executing the method provided by the embodiments of the present disclosure, and when the computer program product is run on an electronic device, the program codes are used to make the electronic device implement the health check method provided by the embodiments of the present disclosure.

[0139] When the computer program is executed by the processor 901, the above functions defined in the system / apparatus of the embodiments of the present disclosure are performed. According to an embodiment of the present disclosure, the above described system, apparatus, module, unit, etc. can be implemented by computer program modules.

[0140] In one embodiment, the computer program can rely on tangible storage media such as optical storage media, magnetic storage media, etc. In another embodiment, the computer program can also be transmitted, distributed, downloaded and installed in the form of signals on a network medium, and be downloaded and installed through the communication part 909 and / or installed from the detachable medium 911. The program codes contained in the computer program can be transmitted by any appropriate network medium, including but not limited to wireless, wired, etc., or any suitable combination of the foregoing.

[0141] According to embodiments of the present disclosure, program code of a computer program provided by embodiments of the present disclosure can be written in any combination of one or more programming languages, and specifically, can be implemented using a high-level procedural and / or object-oriented programming language, and / or an assembly / machine language. Programming languages include, but are not limited to, Java, C++, python, "C" language, or similar programming languages. Program code can execute entirely on a user's computing device, partly on a user device, partly on a remote computing device, or entirely on a remote computing device or server. In the latter scenario, the remote computing device can be connected to the user's computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computing device, such as through the Internet using an Internet Service Provider.

[0142] The flow diagrams and the block diagrams in the drawings are illustrations of architectures, functionalities, and operations of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flow diagrams or block diagrams can represent a module, a segment, or a portion of code, which comprises one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and / or flow diagrams, and combinations thereof, can be implemented by special purpose hardware-based systems that perform the specified functions or operations, or combinations of special purpose hardware and computer instructions.

[0143] Embodiments of the present disclosure have been described. However, these embodiments are merely intended to illustrate the present disclosure, and are not intended to limit the scope of the present disclosure. Although each of the embodiments is described above separately, this does not mean that the measures in each of the embodiments cannot be used advantageously in combination. The scope of the present disclosure is defined by the appended claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art can make various substitutions and modifications, and these substitutions and modifications should all fall within the scope of the present disclosure.

Claims

1. A health check method, applied to a first device in a first network layer, the method comprising: In response to triggering a scheduled task, for each first component service configured in the first device, a second device configured with a second component service is determined from the second network layer, wherein the second network layer is a downstream network layer of the first network layer, and the first component service corresponds to the second component service; and The health status of each of the multiple certificate components included in the second component service is obtained by using the multiple de-identified certificates included in the first component service.

2. The method according to claim 1, wherein, The step of using the multiple de-identified certificates included in the first component service to perform health checks on the multiple certificate components included in the second component service, and obtaining the health status of each of the multiple certificate components, includes: For each de-identified certificate, a target certificate component is determined from the plurality of certificate components based on the de-identified certificate; and The de-identified certificate is used to initiate a two-way authentication request to the target certificate component in the second device to determine the health status of the target certificate component.

3. The method according to claim 2, wherein, The step of determining the target certificate component from the plurality of certificate components based on the de-identified certificate includes: Based on the encryption type of the de-identified certificate, the target certificate component is determined from the plurality of certificate components, wherein the encryption type of the target certificate component is the same as the encryption type of the de-identified certificate.

4. The method according to claim 2, wherein, The step of determining the target certificate component from the plurality of certificate components based on the de-identified certificate includes: Based on the encryption type and domain name of the de-identified certificate, the target certificate component is determined from the plurality of certificate components, wherein the encryption type of the target certificate component is the same as the encryption type of the de-identified certificate, and the domain name of the target certificate component is the same as the domain name of the de-identified certificate.

5. The method according to claim 2, wherein, The step of initiating a two-way authentication request to the target certificate component in the second device using the de-identified certificate to determine the health status of the target certificate component includes: The first device initiates a two-way authentication request to the target certificate component using the de-identified certificate, thereby establishing a communication link between the first device and the target certificate component. If the communication link is successfully established, the health status of the target certificate component is determined to be that the certificate is available; and If the communication link establishment fails, the health status of the target certificate component is determined to be that the certificate is unavailable.

6. The method according to claim 5, further comprising: If the communication link is successfully established, determine the time taken to establish the communication link. If the establishment time is greater than or equal to a preset time, the health status of the target certificate component is determined to be that the certificate is unavailable; as well as If the establishment time is less than the preset time, the health status of the target certificate component is determined to be that the certificate is available.

7. The method according to any one of claims 2 to 6, wherein, The de-identified certificate is generated based on the public portion of the client certificate, which is associated with the target certificate component.

8. The method according to any one of claims 1 to 6, further comprising: For each of the certificate components, if the health status of the certificate component indicates that the certificate is unavailable, the certificate component is isolated.

9. A health check device, applied to a first device in a first network layer, the device comprising: The second device determination module is used to determine, in response to triggering a timed task, a second device configured with a second component service from a second network layer for each first component service configured in the first device, wherein the second network layer is a downstream network layer of the first network layer, and the first component service corresponds to the second component service. The health status determination module is used to perform health checks on the multiple certificate components included in the second component service using the multiple de-identified certificates included in the first component service, and to obtain the health status of each of the multiple certificate components.

10. An electronic device, comprising: One or more processors; Memory, used to store one or more instructions. When the one or more instructions are executed by the one or more processors, the one or more processors cause the one or more processors to implement the method of any one of claims 1 to 8.

11. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the method of any one of claims 1 to 8.

12. A computer program product comprising computer-executable instructions, which, when executed, are used to implement the method of any one of claims 1 to 8.

Images