A certificate online status query method and system combined with quantum-resistant algorithm

Abstract

The present application relates to a method and system for querying the online status of a certificate in combination with a quantum-resistant algorithm, which belongs to the field of encryption technology. The method is applied to an online query system for querying the status of a certificate, and the method comprises: obtaining a request instruction sent by a terminal device; outputting a query instruction when it is determined that the request instruction is verified to be passed, wherein the query instruction and the request instruction contain the same identifier, and the identifier has a unique corresponding digital certificate; receiving result data returned by a certificate issuing system after receiving the query instruction, wherein the result data contains the status of the digital certificate corresponding to the identifier; encrypting the result data using a quantum-resistant algorithm and a protocol key algorithm to obtain response data. The present application combines a traditional encryption algorithm with a quantum-resistant encryption algorithm to improve the reliability of the query result of a digital certificate.

Description

Technical Field

[0001] The present application relates to the field of encryption technology, and in particular to a method and system for querying the online status of a certificate in combination with a quantum-resistant algorithm. Background Art

[0002] Digital certificates can effectively verify the authenticity of the identities of both communicating parties and ensure the security of data transmission. However, before using a digital certificate, you need to verify its validity in advance.

[0003] At present, the validity of digital certificates is often queried in real time through the online certificate status query system. Specifically, the online certificate status query system first sets the encryption algorithm in advance, and then uses the set encryption algorithm to verify the validity of the digital certificate. However, with the development of quantum computers, the security of traditional encryption algorithms in the online certificate status query system has been threatened. For example, the RSA algorithm based on the large number factorization problem and the elliptic curve cryptography (ECC) algorithm based on the discrete logarithm problem, the complex encryption logic of the two can be quickly cracked under the high-speed computing power of quantum computers, resulting in low reliability of the query results. Summary of the invention

[0004] In order to solve the problem of low reliability of digital certificate query results, the present application provides a certificate online status query method and system combined with a quantum-resistant algorithm.

[0005] In a first aspect of the present application, a method for online status query of a certificate combined with a quantum-resistant algorithm is provided, the method being applied in an online status query system of a certificate, comprising:

[0006] Obtain the request instruction sent by the terminal device;

[0007] Outputting a query instruction when it is determined that the request instruction is verified to be successful, the query instruction and the request instruction contain the same identifier, and the identifier has a unique corresponding digital certificate;

[0008] Receiving result data returned by the certificate issuing system after receiving the query instruction, the result data including the status of the digital certificate corresponding to the identifier;

[0009] The result data is encrypted using a quantum-resistant algorithm and a protocol key algorithm to obtain response data.

[0010] By adopting the above technical solution, when the terminal device queries the status of the digital certificate, it does not directly access the certificate issuance system, but uses the certificate status online query system as an intermediate agent. During the proxy process, the certificate status online query system executes operations such as verifying the request instruction of the terminal device and encrypting the data returned by the certificate issuance system. In addition, the encryption algorithm used is a combination of the traditional protocol key algorithm and the quantum-resistant algorithm, which enhances the security of the result data returned by the certificate issuance system to ensure the reliability of the response data returned to the terminal device, that is, the reliability of the status of the digital certificate obtained by the terminal device is guaranteed.

[0011] In a possible implementation, the step of encrypting the result data using a quantum-resistant algorithm and a protocol key algorithm to obtain response data includes:

[0012] Signing the result data using a private key in the quantum-resistant algorithm to obtain first signature data;

[0013] Putting the quantum-resistant algorithm and the first signature data into the result data to obtain intermediate data;

[0014] Signing the intermediate data using the private key in the protocol key algorithm to obtain second signature data;

[0015] The protocol key algorithm and the second signature data are placed into the intermediate data to obtain the response data.

[0016] By adopting the above technical solution, the present application combines the quantum-resistant algorithm and the protocol key algorithm to encrypt the result data to obtain the response data, which can greatly reduce the possibility of the obtained response data being hacked during transmission and improve the reliability of the status of the digital certificate obtained by the terminal device.

[0017] In a possible implementation manner, the step of placing the quantum-resistant algorithm and the first signature data into the result data to obtain intermediate data includes:

[0018] The quantum-resistant algorithm and the first signature data are placed in an extension item of the result data to obtain the intermediate data, where the extension item is an optional field in a header of the result data.

[0019] By adopting the above technical solution, the quantum-resistant algorithm and the first signature data are placed in the extension item of the result data, which can not only reduce the impact on the result data, such as placing them in other fields of the result data, which may cause confusion in the result data. On the other hand, it can also facilitate the terminal device to quickly locate the quantum-resistant algorithm in the extension item after obtaining the response data, thereby improving the efficiency of decrypting the response data.

[0020] In a possible implementation manner: before using the private key in the protocol key algorithm to sign the intermediate data, the method includes:

[0021] Establishing a connection with the certificate issuing system;

[0022] Establish the protocol key algorithm.

[0023] By adopting the above technical solution, the protocol supported by the certificate issuing system is first identified, and then a protocol key algorithm is established based on the protocol, so that the established protocol key algorithm is more compatible with the certificate issuing system, providing technical guarantee for subsequent normal access to the certificate issuing system.

[0024] In a possible implementation manner, the step of outputting a query instruction when the request instruction is verified to be successful includes:

[0025] Parsing the request instruction to obtain a request data format and the identifier;

[0026] When it is determined that the request data format is the same as the protocol format supported by the certificate status online query system, and a digital certificate corresponding to the identifier exists in the certificate issuing system, it is determined that the request instruction verification is passed;

[0027] The query instruction is generated and output according to the identifier.

[0028] By adopting the above technical solution, after receiving the request instruction, the request instruction needs to be verified. Only when the request instruction verification is passed will the query instruction be output, thereby driving the certificate issuance system to query the status of the digital certificate, so as to ensure that the terminal device performs secure access.

[0029] In a second aspect of the present application, a certificate online status query method combined with a quantum-resistant algorithm is provided, the method being applied in a terminal device, comprising:

[0030] After establishing a connection with the certificate status online query system, outputting a request instruction, the request instruction including an identifier;

[0031] Receiving response data returned by the online certificate status query system after receiving the request instruction;

[0032] The response data is parsed to obtain the status of the digital certificate corresponding to the identifier.

[0033] In a possible implementation manner, the parsing the response data to obtain the status of the digital certificate corresponding to the identifier includes:

[0034] When it is determined that the response data has passed the verification, parsing the response data to obtain the protocol key algorithm, the second signature data and the intermediate data;

[0035] When it is determined that the intermediate data verification passes, parsing the intermediate data to obtain the quantum-resistant algorithm, the first signature data, and the result data;

[0036] When it is determined that the result data has passed the verification, the result data is parsed to obtain the status of the digital certificate corresponding to the identifier.

[0037] By adopting the above technical solution, after the terminal device receives the response data, it also needs to go through multiple layers of verification to obtain the status of the digital certificate, so as to ensure the reliability of the status of the digital certificate queried by the terminal device.

[0038] In a possible implementation manner, the determining that the response data passes verification includes:

[0039] When it is determined that the format of the response data is the same as the protocol format supported by the certificate status online query system, it is determined that the response data verification has passed.

[0040] By adopting the above technical solution, when the format of the response data is different from the protocol format supported by the certificate issuing system, it means that the response data may have been replaced, resulting in a change in the protocol format. Therefore, it is necessary to verify whether the format of the response data is the same as the protocol format supported by the certificate issuing system.

[0041] In the third aspect of the present application, a certificate online status query system combined with a quantum-resistant algorithm is provided. The system includes a certificate online status query system and multiple terminal devices, and the certificate online status query system and any one of the multiple terminal devices can execute the above-mentioned certificate online status query method combined with a quantum-resistant algorithm.

[0042] By adopting the above technical solution, multiple terminal devices can query the status of the digital certificates they need through an online certificate status query system, thereby improving the efficiency of querying digital certificates.

[0043] In summary, the present application includes the following beneficial technical effects:

[0044] On the one hand, when the terminal device queries the status of the digital certificate, it does not directly access the certificate issuance system, but uses the certificate status online query system as an intermediate agent. During the proxy process, the certificate status online query system executes operations such as verifying the request instructions of the terminal device and encrypting the data returned by the certificate issuance system. In addition, the encryption algorithm used is a combination of the traditional protocol key algorithm and the quantum-resistant algorithm to enhance the security of the result data returned by the certificate issuance system to ensure the reliability of the response data returned to the terminal device, that is, the reliability of the status of the digital certificate obtained by the terminal device is guaranteed. On the other hand, after the terminal device receives the response data, it also needs to go through multiple layers of verification to obtain the status of the digital certificate, so as to further ensure the reliability of the status of the digital certificate queried by the terminal device. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 It is a schematic diagram of an exemplary operating environment of an embodiment of the present application.

[0046] Figure 2 It is a flowchart of a certificate online status query method combined with a quantum-resistant algorithm according to an embodiment of the present application.

[0047] Explanation of the accompanying symbols: 1. Terminal device; 2. Certificate status online query system; 3. Certificate issuance system. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0049] Figure 1 A schematic diagram of an exemplary operating environment in which an embodiment of the present application can be implemented is shown, the operating environment comprising a terminal device 1, an online certificate status query system 2 and a certificate issuing system 3, wherein the terminal device 1 is used to send a query instruction to the certificate issuing system 3 through the online certificate status query system 2, so that the certificate issuing system 3 returns the status of the digital certificate required by the terminal device 1, and the status of the digital certificate includes three states: valid, expired, and revoked.

[0050] The terminal device 1 is a smart device such as a mobile phone, a tablet, a computer, etc., and there are n terminal devices 1, where n≥2. When a user needs to verify the status of a digital certificate, he can send a request instruction to the online certificate status query system 2 through the terminal device 1, and then drive the online certificate status query system 2 to send a query instruction to the certificate issuing system 3 to request the certificate issuing system 3 to query the status of the digital certificate.

[0051] The certificate status online query system 2 and the certificate issuing system 3 are both set up in the server. The two can be deployed in the same server or in different servers, but the certificate status online query system 2 is the credit system of the certificate issuing system 3, and the certificate status online query system 2 has the authority to access the certificate issuing system 3.

[0052] In a specific example, the terminal device 1 and the certificate status online query system 2 are combined into a certificate status online query system combined with a quantum-resistant algorithm. Figure 1 In the example, n terminal devices 1 all query the status of the digital certificates they need through the same certificate status online query system 2.

[0053] In order to facilitate the description of the working process of the certificate online status query system combined with the quantum-resistant algorithm, this application proposes a certificate online status query method combined with the quantum-resistant algorithm, such as Figure 2 As shown, the main process of the method is described as follows.

[0054] Step S101: Establish an encryption algorithm, where the encryption algorithm includes a protocol key algorithm and a quantum-resistant algorithm.

[0055] The certificate status online query system 2 serves as a credit system of the certificate issuing system 3, and it can communicate with the certificate issuing system 3 through a wired transmission mode or a wireless transmission mode. The wired transmission mode is such as an Ethernet cable or a serial cable, and the wireless transmission mode is such as WIFI, near-field communication technology or a mobile network, and the mobile network is such as a 4G network or a 5G network. After the communication link is determined to be established, in order to ensure the security of the communication between the two parties, it is also necessary to establish an encryption algorithm that can be adapted to the certificate issuing system 3. In a specific example, the established protocol key algorithm is an OCSP signature certificate, and the type of the OCSP signature certificate is one of RSA, SM2, and ECC. RSA, SM2 and ECC are three common encryption algorithms. The full name of RSA is Rivest-Shamir-Adleman algorithm, which is mainly used for digital signatures, key exchange and data encryption / decryption. SM2 is an elliptic curve public key cryptographic algorithm standard formulated by a professional department, and is also mainly used for digital signatures, key exchange and data encryption / decryption. The full name of ECC is Commercial Encryption Algorithm, which is also mainly used for data encryption / decryption and supports packet encryption and stream encryption. These three traditional encryption algorithms can all be applied to the certificate status online query system 2 and certificate issuance system 3 of this example. Specifically, RSA adopts SHA1WITHRSA signature algorithm or SHA256WITHRSA signature algorithm, SM2 adopts SM3WITHSM2 signature algorithm, and ECC adopts SHA1WITHECDSA signature algorithm or SHA256WITHECDSA signature algorithm.

[0056] In other examples, the certificate status online query system 2 automatically agrees on a protocol with the certificate issuing system 3 and accesses data in the certificate issuing system 3 based on the agreed protocol.

[0057] At the same time, the certificate status online query system 2 also automatically generates an anti-quantum algorithm, which is one of the CRYSTALS-Dilithium, FALCON and SPHINCS+ algorithms. CRYSTALS-Dilithium, FALCON and SPHINCS+ algorithms are three new lattice-based digital signature algorithms that are not attacked by quantum computers and are considered to be reliable signature schemes in the future. Of course, the certificate status online query system 2 can also regularly replace one of the CRYSTALS-Dilithium, FALCON and SPHINCS+ algorithms as an anti-quantum algorithm to further improve the security of the certificate status online query system 2 when accessing the certificate issuance system 3.

[0058] The terminal device 1 also establishes a connection with the online certificate status query system 2 in advance. The connection can also be established by wired connection or wireless connection, which is not limited here. After the terminal device 1 establishes a connection with the online certificate status query system 2, it obtains and imports the OCSP signature certificate from the online certificate status query system 2, that is, imports the protocol key algorithm. At the same time, the terminal device 1 also needs to identify the protocol supported by the online certificate status query system 2. In a specific example, the protocol supported by the online certificate status query system 2 is the online certificate status protocol (OCSP).

[0059] Step S102: Terminal device 1 sends a request instruction.

[0060] When the terminal device 1 needs to query the status of the digital certificate, it sends a request instruction to the certificate status online query system 2. The request instruction can be data manually input into the terminal device 1 by the user or data imported into the terminal device 1, or data automatically generated by the terminal device 1. This example takes the request instruction automatically generated by the terminal device 1 as an example for explanation.

[0061] Specifically, the request instruction includes a request data format and an identifier. The request data format refers to the format of the request instruction. The terminal device 1 needs to know the protocol format supported by the certificate status online query system 2, and then generate a request instruction with the same protocol format supported by the certificate status online query system 2. In a specific example, the protocol format supported by the certificate status online query system 2 is data in an ASN structure, and the data in the ASN structure is the basic format of the OCSP protocol, so the request data format needs to be set to an ASN structure. In other examples, when the protocol supported by the certificate status online query system 2 is other protocols, the request data format also changes as the protocol supported by the certificate status online query system 2 changes. Each identifier has a unique corresponding digital certificate, so the identifier can be one of the identifiers of the digital certificate version number, certificate serial number, CA identifier, signature algorithm identifier, issuer name, and certificate validity period, or a combination of multiple identifiers.

[0062] After generating the request instruction, the terminal device 1 sends the request instruction to the certificate status online query system 2 .

[0063] Step S103: When the certificate status online query system 2 determines that the request instruction has been verified, it outputs a query instruction, and the query instruction and the request instruction contain the same identifier.

[0064] After receiving the request instruction, the certificate status online query system 2 verifies whether the request instruction meets the requirements: the request data format is the same as the protocol format supported by the certificate status online query system 2, and the digital certificate corresponding to the identifier exists in the certificate issuing system 3. If the request instruction meets the above requirements, it is determined that the request instruction verification is passed; otherwise, it is determined that the request instruction verification is not passed, and the received request instruction is intercepted and cleared.

[0065] Based on the request instruction that has passed the verification, the certificate status online query system 2 generates a query instruction corresponding to the request instruction. Specifically, it only retains the identifier in the request instruction and resets the source device, setting the source device to the IP address of the certificate online query system to avoid the certificate issuing system 3 directly returning data to the terminal device 1 after responding to the query instruction.

[0066] Finally, the certificate status online query system 2 sends the query instruction that has been set to the certificate issuing system 3.

[0067] Step S104: the certificate status online query system 2 receives result data returned by the certificate issuing system 3, where the result data includes the status of the digital certificate corresponding to the identifier.

[0068] After receiving the query instruction, the certificate issuing system 3 first extracts the identifier in the query instruction and searches for the digital certificate corresponding to the identifier in the database, which is specially used to store digital certificates in the certificate issuing system 3. Then, according to the search result, the certificate issuing system 3 reads the status of the digital certificate and returns the status of the digital certificate as result data to the certificate status online query system 2, that is, the certificate status online query system 2 receives the result data.

[0069] Step S105, the certificate status online query system 2 uses a quantum-resistant algorithm and a protocol key algorithm to encrypt the result data to obtain response data.

[0070] Based on the obtained result data, the certificate status online query system 2 first encrypts it using an anti-quantum algorithm, specifically: using the private key in the anti-quantum algorithm to sign the result data to obtain the first signature data, and then putting the anti-quantum algorithm and the first signature data into the extension item of the result data to obtain the intermediate data. It should be noted that the extension item is an optional field in the header of the result data, that is, there is a customizable extension field in the result data, and the anti-quantum algorithm and the first signature data are put into the field.

[0071] Then, the protocol key algorithm is used to encrypt the intermediate data. Specifically, the intermediate data is first signed with the private key of the protocol key algorithm to obtain the second signature data, and then the protocol key algorithm and the second signature data are placed in the intermediate data to obtain the response data.

[0072] Finally, the response data is returned to the terminal device 1, so that the terminal device 1 can check the status of the required digital certificate.

[0073] Step S106 : The terminal device 1 receives the response data returned by the online certificate status query system 2 .

[0074] In a specific example, a mapping table is provided in the certificate status online query system 2, which can establish a mapping relationship between the request instruction and the query instruction. Therefore, after receiving the result data corresponding to the query instruction, the encrypted response data is returned to the terminal device 1 that outputs the request instruction according to the mapping relationship between the request instruction and the query instruction, that is, the terminal device 1 receives the response data.

[0075] Step S107: The terminal device 1 parses the response data to obtain the status of the digital certificate corresponding to the identifier.

[0076] Based on the obtained response data, first verify the legitimacy of the response data, that is, verify whether the format of the response data is the same as the request data format of the request instruction. If they are the same, the verification is successful; otherwise, it is considered that the verification has failed, and it is necessary to return to step S102 and resend a new request instruction.

[0077] Based on the verified response data, the terminal device 1 first parses the response data to obtain the protocol key algorithm, the second signature data and the intermediate data, uses the public key in the protocol key algorithm to decrypt the intermediate data, and then verifies the legitimacy of the intermediate data, that is, verifies whether the format of the intermediate data is the same as the request data format of the request instruction. If they are the same, the verification is successful; otherwise, the verification is considered to have failed, and it is necessary to return to step S102 and resend a new request instruction.

[0078] Based on the verified intermediate data, the terminal device 1 then parses the intermediate data to obtain the quantum-resistant algorithm, the first signature data and the result data, and uses the public key of the quantum-resistant algorithm to decrypt the result data to obtain the status of the digital certificate corresponding to the identifier. Of course, the decrypted result data also needs to verify whether the format of the result data is the same as the request data format of the request instruction. If they are the same, the verification is passed; otherwise, the verification is considered to have failed, and the status of the digital certificate obtained at this time is untrustworthy, and it is necessary to return to step S102 and resend a new request instruction.

[0079] In summary, when the terminal device 1 inquires about the status of the digital certificate, it does not directly access the certificate issuing system 3, but uses the credit system (certificate status online query system 2) as an intermediate agent, and in the proxy process, executes operations such as verifying the request instruction of the terminal device 1 and encrypting the data returned by the certificate issuing system 3. Moreover, the encryption algorithm used is a combination of the traditional protocol key algorithm and the anti-quantum algorithm, which enhances the security of the result data returned by the certificate issuing system 3 and ensures the reliability of the response data returned to the terminal device 1. At the same time, after receiving the response data, the terminal device 1 also needs to go through multiple layers of verification to obtain the status of the digital certificate. If any layer of verification fails, it will be queried again, which ensures the reliability of the status of the digital certificate queried by the terminal device 1.

[0080] In order to better execute the program of the above method, the present application also provides a certificate online status query device combined with a quantum-resistant algorithm, which includes a memory and a processor.

[0081] The memory may be used to store instructions, programs, codes, code sets or instruction sets. The memory may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function, and instructions for implementing the above-mentioned certificate online status query method combined with an anti-quantum algorithm, etc.; the data storage area may store data involved in the above-mentioned certificate online status query method combined with an anti-quantum algorithm, etc.

[0082] The processor may include one or more processing cores. The processor calls the data stored in the memory by running or executing the instructions, programs, code sets or instruction sets stored in the memory, performs various functions of the present application and processes data. The processor may be at least one of a special purpose integrated circuit, a digital signal processor, a digital signal processing device, a programmable logic device, a field programmable gate array, a central processing unit, a controller, a microcontroller and a microprocessor. It is understandable that for different devices, the electronic device used to implement the above-mentioned processor function can also be other, and the embodiments of the present application are not specifically limited.

[0083] The present application also provides a computer-readable storage medium, for example, including: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes. The computer-readable storage medium stores a computer program that can be loaded by a processor and execute the above-mentioned certificate online status query method combined with a quantum-resistant algorithm.

[0084] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the aforementioned disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present application (but not limited to) by each other to form a technical solution.

Claims

1. A certificate online status query method combined with a quantum-resistant algorithm, applied to a certificate online status query system (2), characterized in that: include: Obtaining a request instruction sent by the terminal device (1); Outputting a query instruction when it is determined that the request instruction is verified to be successful, the query instruction and the request instruction contain the same identifier, and the identifier has a unique corresponding digital certificate; Receiving result data returned by the certificate issuing system (3) after receiving the query instruction, the result data containing the status of the digital certificate corresponding to the identifier; The result data is encrypted using a quantum-resistant algorithm and a protocol key algorithm to obtain response data, including: Signing the result data using a private key in the quantum-resistant algorithm to obtain first signature data; Putting the quantum-resistant algorithm and the first signature data into the result data to obtain intermediate data includes: putting the quantum-resistant algorithm and the first signature data into an extension item of the result data to obtain the intermediate data, wherein the extension item is an optional field in the header of the result data; Signing the intermediate data using the private key in the protocol key algorithm to obtain second signature data; The protocol key algorithm and the second signature data are placed in the intermediate data to obtain the response data.

2. The certificate online status query method combined with quantum-resistant algorithm according to claim 1 is characterized in that: Before the private key in the protocol key algorithm is used to sign the intermediate data, the method includes: Establishing a connection with the certificate issuing system (3); Establish the protocol key algorithm.

3. The certificate online status query method combined with quantum-resistant algorithm according to claim 1 is characterized in that: The step of outputting the query instruction when the request instruction is verified to be successful comprises: Parsing the request instruction to obtain a request data format and the identifier; When it is determined that the format of the request data is the same as the protocol format supported by the online certificate status query system (2), and a digital certificate corresponding to the identifier exists in the certificate issuing system (3), it is determined that the request instruction verification is passed; The query instruction is generated and output according to the identifier.

4. A certificate online status query method combined with a quantum-resistant algorithm, applied to a terminal device (1), characterized in that: include: After establishing a connection with the certificate status online query system (2), a request instruction is output, wherein the request instruction includes an identifier; Receiving response data returned by the certificate status online query system (2) after receiving the request instruction; Parsing the response data to obtain the status of the digital certificate corresponding to the identifier includes: When it is determined that the response data has been verified, the response data is parsed to obtain the protocol key algorithm, the second signature data and the intermediate data; the step of determining that the response data has been verified includes: when it is determined that the format of the response data is the same as the protocol format supported by the certificate status online query system (2), determining that the response data has been verified; When it is determined that the intermediate data verification passes, parsing the intermediate data to obtain the quantum-resistant algorithm, the first signature data, and the result data; When it is determined that the result data has passed the verification, the result data is parsed to obtain the status of the digital certificate corresponding to the identifier.

5. A certificate online status query system combined with a quantum-resistant algorithm, characterized in that: The invention comprises an online certificate status query system (2) and a plurality of terminal devices (1), wherein the online certificate status query system (2) is used to execute the method as claimed in any one of claims 1 to 3, and any one of the plurality of terminal devices (1) is used to execute the method as claimed in claim 4.

Images