Connection processing method, apparatus, device, medium, and product

Abstract

Embodiments of the present application disclose a connection processing method and device, equipment, medium and product, and relate to the technical field of information security. In the case that the digital certificate of a client is revoked, certificate information of the revoked digital certificate is acquired and stored in a remote dictionary service (redis) database; based on the certificate information, client information for establishing a connection with a gateway based on the revoked digital certificate is determined from the redis database; and the client information is broadcasted, so that an application server disconnects the connection between the client and the gateway based on the client information. That is, in the case that the digital certificate of a client is revoked, the client information corresponding to the digital certificate can be broadcasted in a timely manner, so that the application server can disconnect the connection between the client with the revoked digital certificate and the gateway in a timely manner, thereby ensuring information security.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a connection method, apparatus, device, medium and product. Background Technology

[0002] In the Internet of Things (IoT) field, to ensure information security between clients and servers, it is necessary to verify the identities of both. Digital certificates can be used to verify the identities of clients and servers.

[0003] In practical applications, client digital certificates may be misused. Therefore, it is necessary to verify client digital certificates. Disconnecting the client from the gateway when it is found that the client's digital certificate has been misused is of great significance to ensuring information security.

[0004] Existing connection handling solutions primarily rely on Certificate Revocation Lists (CRLs) or Online Certificate Status Protocols (OCSPs). These methods, when it's determined that the client's digital certificate is being used abnormally and the client has already established a connection with the gateway, cannot promptly disconnect the client from the gateway, posing a significant security risk. Summary of the Invention

[0005] This application provides a connection processing method, apparatus, device, medium, and product that can solve the problem that in related technologies, when it is determined that the client's digital certificate is being used abnormally and the client has already established a connection with the gateway, the connection between the client and the gateway cannot be disconnected in a timely manner, resulting in significant security risks.

[0006] In a first aspect, embodiments of this application provide a connection processing method, including:

[0007] If the client's digital certificate is revoked, retrieve the certificate information of the revoked digital certificate and store it in the remote dictionary service Redis database;

[0008] Based on the certificate information, determine the client information that established a connection with the gateway based on the revoked digital certificate from the Redis database;

[0009] Broadcast client information so that the application server can disconnect the client from the gateway based on the client information.

[0010] Secondly, embodiments of this application provide a connection processing method, including:

[0011] Upon receiving a connection request from a client, obtain the client's certificate information. The connection request is used to request the establishment of a connection with the gateway.

[0012] Based on the certificate information, the remote dictionary service Redis database is searched to determine whether the client's digital certificate has been revoked. The Redis database is used to store the certificate information of revoked digital certificates.

[0013] If it is determined that the client's digital certificate has been revoked, the client's connection to the gateway will be denied.

[0014] Thirdly, embodiments of this application provide a connection processing apparatus, including:

[0015] The acquisition module is used to retrieve the certificate information of a revoked digital certificate when the client's digital certificate is revoked, and store it in a remote dictionary service Redis database;

[0016] The determination module is used to determine, from the Redis database, the client information that established the connection with the gateway based on the revoked digital certificate, according to the certificate information;

[0017] The broadcast module is used to broadcast client information so that the application server can disconnect the client from the gateway based on the client information.

[0018] Fourthly, embodiments of this application provide a connection processing apparatus, including:

[0019] The acquisition module is used to obtain the client's certificate information when a connection request is received from the client. The connection request is used to request to establish a connection with the gateway.

[0020] The determination module is used to search the remote dictionary service Redis database based on the certificate information to determine whether the client's digital certificate has been revoked. The Redis database is used to store the certificate information of revoked digital certificates.

[0021] The processing module is used to refuse a client's connection to the gateway if it is determined that the client's digital certificate has been revoked.

[0022] Fifthly, embodiments of this application provide a connection processing device, including:

[0023] processor;

[0024] Memory is used to store computer program instructions;

[0025] When computer program instructions are executed by the processor, they implement the method described in the first aspect or the method described in the second aspect.

[0026] In a sixth aspect, embodiments of this application provide a computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, implement the method described in the first aspect or the method described in the second aspect.

[0027] In a seventh aspect, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the method described in the first aspect or the method described in the second aspect.

[0028] In this embodiment, when a client's digital certificate is revoked, the certificate information of the revoked digital certificate is obtained and stored in a remote dictionary service Redis database. Based on the certificate information, client information that established a connection with the gateway based on the revoked digital certificate is determined from the Redis database. The client information is then broadcast so that the application server can disconnect the connection between the client and the gateway based on the client information. In other words, this embodiment can promptly broadcast the client information corresponding to the revoked digital certificate when the client's digital certificate is revoked, enabling the application server to promptly disconnect the client with the revoked digital certificate from the gateway, thus ensuring information security. Attached Figure Description

[0029] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0030] Figure 1 A flowchart illustrating a connection processing method provided in an embodiment of this application;

[0031] Figure 2 This is a schematic diagram of the processing procedure of a PKI system provided in an embodiment of this application;

[0032] Figure 3 A flowchart illustrating another connection processing method provided in an embodiment of this application;

[0033] Figure 4 A schematic diagram illustrating the processing procedure of a gateway provided in an embodiment of this application;

[0034] Figure 5 A structural diagram of a connection processing device provided in an embodiment of this application;

[0035] Figure 6 A structural diagram of another connection processing device provided in an embodiment of this application;

[0036] Figure 7This is a structural diagram of a connection processing device provided in an embodiment of this application. Detailed Implementation

[0037] The features and exemplary embodiments of various aspects of this application will now be described in detail. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only configured to explain this application and are not configured to limit this application. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples of this application.

[0038] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0039] The relevant technologies are mainly based on CRL or OCSP to determine whether the client's digital certificate has been revoked.

[0040] A Certificate Authority List (CRL) is a periodically published digital signature file containing a list of revoked digital certificates. The CRL is signed by a Certificate Authority (CA) to ensure its integrity and trustworthiness. The CA typically lists the serial numbers and revocation dates of all revoked certificates in the CRL. The gateway periodically downloads the latest CRL file, usually via HTTP or LDAP protocols. The CA's public key is used to verify the CRL's signature to ensure its authenticity. The gateway stores the CRL locally and checks the client's certificate in the CRL when establishing a connection with a client to determine if the certificate is valid.

[0041] OCSP is a protocol for real-time certificate status queries that does not require periodic downloads of CRL files. Gateways can verify the validity of client certificates via OCSP requests. By configuring the OCSP interface address of the Certificate Authority (CA), the gateway sends a query request to the OCSP server during the client's connection establishment process. This request includes information about the certificate to be verified. The OCSP server responds immediately, returning the certificate's status, typically "revoked," "valid," or "unknown." The gateway determines whether to trust the certificate based on the OCSP server's response, thus establishing a connection.

[0042] Both of these methods fail to disconnect the client from the gateway in a timely manner when it is determined that the client's certificate has been used abnormally and the client has already established a connection with the gateway, posing a significant security risk.

[0043] To address this issue, this application provides a connection processing method, apparatus, device, medium, and product that can solve the problem that when related technologies determine that a client's digital certificate is being used abnormally and the client has already established a connection with the gateway, they cannot promptly disconnect the client from the gateway, leading to significant security risks, thereby improving information security.

[0044] In this embodiment of the application, when a client's digital certificate is revoked, the client information corresponding to the digital certificate can be broadcast in a timely manner, so that the application server can disconnect the client with the revoked digital certificate from the gateway in a timely manner, thus ensuring information security.

[0045] The connection processing methods, devices, equipment, media, and products provided in this application will be described below with reference to specific embodiments.

[0046] Figure 1 This is a flowchart illustrating a connection processing method provided in an embodiment of this application. This connection processing method can be applied to Public Key Infrastructure (PKI) systems. Figure 1 As shown, the connection processing method may include the following steps:

[0047] S110. If the client's digital certificate is revoked, obtain the certificate information of the revoked digital certificate and store it in the remote dictionary service Redis database.

[0048] S120. Based on the certificate information, determine the client information that established the connection with the gateway based on the revoked digital certificate from the Redis database.

[0049] S130, Broadcast client information so that the application server can disconnect the client from the gateway based on the client information.

[0050] The above steps are explained in detail below:

[0051] In S110, whether a client's digital certificate needs to be revoked can be determined by the risk control system or specified by the administrator. For example, when the risk control system detects abnormal behavior from a client connected to the gateway, it can call the PKI system's interface to notify the PKI system to revoke the specified client's digital certificate.

[0052] The certificate information of a digital certificate may include, for example, the certificate serial number and certificate fingerprint, and may also include the certificate content.

[0053] Taking certificate information, including certificate serial number and certificate fingerprint, as an example, after a PKI system revokes a client's digital certificate, it can store the certificate serial number and certificate fingerprint as keys in a Redis database. That is, every time a PKI system revokes a client's digital certificate, it stores the certificate serial number and certificate fingerprint as keys in a Redis database, achieving timely updates to the Redis database.

[0054] For example, the Redis database may include a revoked certificate list, which stores certificate information of revoked digital certificates, such as certificate serial numbers and certificate fingerprints. This facilitates subsequent verification of connection requests by clients by the gateway based on the revoked certificate list in the Redis database. In other words, this embodiment can update the revoked certificate list in real time based on the revocation status of digital certificates, improving client verification efficiency.

[0055] In S120, the Redis database can store not only certificate information for revoked digital certificates, but also the mapping between certificate information and client information for established connections. Client information may include, for example, the client's Internet Protocol Address (IP address) and port number.

[0056] In other words, in addition to the revoked certificate list, the Redis database also includes a first relation table. The first relation table is used to store the correspondence between certificate information and client information with established connections. The first relation table is updated by the gateway according to the connection status between the client and the corresponding gateway.

[0057] For example, when establishing a new connection, the gateway can add a mapping between the certificate information and client information corresponding to the newly established connection to the first relation table. When the gateway disconnects from a client, the gateway can delete the certificate information and client information corresponding to the disconnection from the first relation table, thereby realizing real-time updates to the first relation table.

[0058] For example, the gateway can be implemented based on OpenResty. The gateway can be configured to enable two-way authentication.

[0059] Based on the certificate information of the revoked digital certificate, the Redis database can be searched to identify the client information that has established a connection based on the revoked digital certificate, providing a basis for timely disconnection of the client's illegal connection.

[0060] For example, the above S120 may include the following steps:

[0061] Based on the certificate information of the revoked digital certificate, search the first relation table to determine the client information corresponding to the revoked certificate information.

[0062] Because the first relation table stores the correspondence between certificate information of established connections and corresponding client information, if an established connection exists for a revoked certificate, the client information associated with the revoked certificate can be determined by looking up the first relation table. This provides a basis for broadcasting the client information later, and the application server can then disconnect the illegal connection in a timely manner to ensure information security.

[0063] In S130, after the PKI system retrieves the client information corresponding to the revoked digital certificate from the Redis database, it can broadcast the client information associated with the revoked digital certificate, namely the client's IP address and port number, through a message queue.

[0064] By subscribing to this broadcast message, the application server can obtain the IP address and port number of the client whose connection needs to be disconnected, thereby proactively disconnecting the client's illegal connection and ensuring information security.

[0065] In other words, after a client's digital certificate is revoked, the PKI system of this application embodiment can retrieve the client information associated with the revoked certificate from the Redis database and broadcast the client information, so that the application server can promptly disconnect the illegal connection established by the revoked certificate based on the client information in the broadcast message, thereby improving information security.

[0066] Taking the risk control system's determination that the currently connected client poses a risk as an example, for instance, Figure 2 As shown:

[0067] S210. The risk control system determines that the currently connected client poses a risk, calls the PKI system's interface, and notifies the PKI system that the currently connected client poses a risk.

[0068] The S220 and PKI systems revoke the digital certificates of the corresponding clients and write the certificate serial number and certificate fingerprint of the revoked digital certificates into the revoked certificate list in the Redis database.

[0069] S230. At the same time, the PKI system searches the first relation table of the Redis database based on the certificate information of the revoked certificate to obtain the connection information that the revoked certificate has established, that is, the client information of the associated client.

[0070] The S240 and PKI systems broadcast the client's IP address and port number of the illegal connection.

[0071] S250: The application server subscribes to the broadcast message and disconnects the illegal connection based on the client IP address and port number in the broadcast message, thus ensuring information security.

[0072] Taking its application in gateways as an example, such as Figure 3 As shown, the connection processing method may include the following steps:

[0073] S310. Upon receiving a connection request from a client, obtain the client's certificate information.

[0074] The connection request is used to request the establishment of a connection with the gateway.

[0075] S320. Based on the certificate information, search the remote dictionary service Redis database to determine whether the client's digital certificate has been revoked.

[0076] The Redis database is used to store certificate information for revoked digital certificates.

[0077] S330. If it is determined that the client's digital certificate has been revoked, refuse the client's connection to the gateway.

[0078] The above steps are explained in detail below:

[0079] In S310, the connection request is used to request the establishment of a connection with the gateway. For example, the connection request may include the client's certificate information.

[0080] For example, after receiving a connection request from a client, the gateway can parse the connection request and obtain the client's certificate information.

[0081] For example, the connection request may also include the client's IP address and port number for subsequent connection establishment.

[0082] In S320, for example, based on the obtained certificate information, the revoked certificate list in the Redis database can be searched to determine whether the certificate information exists in the revoked certificate list.

[0083] For example, if the certificate information exists in the revoked certificate list, it means that the client's digital certificate has been revoked; if the certificate information does not exist in the revoked certificate list, it means that the client's digital certificate has not been revoked.

[0084] Because the list of revoked certificates can be updated in real time according to the PKI system, the efficiency of certificate verification is improved when verifying the client's digital certificate.

[0085] In S330, when it is determined that a client's digital certificate has been revoked, i.e., the client's certificate information exists in the revoked certificate list in the Redis database, the gateway can refuse the client's connection. This can avoid problems such as information leakage caused by unauthorized client connections and improve information security.

[0086] Upon receiving a connection request from a client, this embodiment of the application can match the corresponding certificate information with the revoked certificate list in the Redis database. If it is determined that the client's certificate has been revoked, the client's connection will be rejected. Since the revoked certificate list is updated in real time, this embodiment of the application can verify whether the client's certificate has been revoked in real time, thus improving the certificate verification efficiency.

[0087] In some embodiments, after S320, the connection processing method may further include the following steps:

[0088] Locate the gateway's shared memory to determine if the client's Internet Protocol (IP) address is disabled. The shared memory is used to store the IP addresses of disabled clients.

[0089] Accordingly, the above-mentioned S320 may include the following steps:

[0090] If it is determined that the client's Internet Protocol address is not disabled, the remote dictionary service Redis database is searched based on the certificate information to determine whether the client's digital certificate has been revoked.

[0091] For example, before searching the Redis database, it can be determined whether the client's IP address is disabled. For instance, if it is determined that the client's IP address is disabled, the client's connection can be rejected directly without searching the Redis database, thereby shortening the search time and improving verification efficiency.

[0092] For example, if it is determined that the client's IP address is not disabled, the Redis database can be searched to determine whether the client's certificate has been revoked. This can prevent the client from making a large number of Redis requests due to continuous retries.

[0093] For example, the client's IP address can be compared with local shared memory to determine if the client's IP address exists in the shared memory. If the client's IP address exists in the shared memory, it can be determined that the client's IP address is disabled; otherwise, it can be determined that the client's IP address is not disabled. The shared memory is used to store disabled client IP addresses, and the duration for which each client is disabled can be set according to actual needs, for example, it can be disabled for 30 minutes.

[0094] For example, when it is determined that a client's certificate has been revoked, the client's IP address can be written to local shared memory, thereby reducing Redis requests and shortening the response time.

[0095] In some embodiments, after S320, the connection processing method may further include the following steps:

[0096] Establish a connection between the client and the gateway, provided that the client's digital certificate has not been revoked;

[0097] Store the client's certificate information and client information in the Redis database.

[0098] For example, when the gateway determines that the client's certificate has not been revoked, it can establish a connection with the client and store the client's certificate serial number and certificate fingerprint as key values, and store the correspondence between the client's certificate information and the current connection information, namely the client's IP address and port number, in the first relation table of the Redis database.

[0099] Since a single client certificate can establish multiple connections, the Redis database can use a Map structure for storage, where each key-value pair in the Map corresponds to a client's IP address and port number.

[0100] In other words, after a new connection is established, the corresponding certificate information and connection information can be stored in the Redis database, realizing real-time updates to the Redis database. Thus, when it is determined that the current connection is an illegal connection, the corresponding client information can be obtained in a timely manner through the Redis database, and the illegal connection can be disconnected in a timely manner to ensure information security.

[0101] In some embodiments, after establishing a connection between the client and the gateway, the connection processing method may further include the following steps:

[0102] If the client is detected to have disconnected from the gateway, the client's certificate information and client information will be deleted from the Redis database.

[0103] For example, after detecting that the client has lost connection with the gateway, the gateway can clear the client's certificate information and client information stored in the Redis database.

[0104] In other words, the gateway can update the first relationship table in real time based on the connection status between the client and the gateway. This allows the gateway to promptly retrieve the corresponding client information from the Redis database when a connection is determined to be illegitimate, thereby disconnecting the illegitimate connection in a timely manner and ensuring information security.

[0105] For example, such as Figure 4 As shown, after the two-way authentication function is enabled, S410, the gateway's preprocessing module obtains the client's certificate information and client information; S420, it determines whether the client's IP address is disabled based on the client information; if disabled, proceed to S430, if not disabled, proceed to S440; S440, it queries whether the certificate of the current connection has been revoked; if revoked, proceed to S430, if not revoked, proceed to S450; S450, it stores the certificate information and the current connection information; S460, it forwards the client's connection request to the application server; S470, when a connection is detected to be disconnected, the gateway's post-processing module deletes the stored certificate information and the current connection information, and also deletes the certificate information and the current connection information stored in the Redis database.

[0106] Based on the same inventive concept, this application also provides a connection processing device, which is described below in conjunction with... Figure 5 The connection processing apparatus provided in the embodiments of this application will be described in detail.

[0107] Figure 5 This is a structural diagram of a connection processing device provided in an embodiment of this application.

[0108] like Figure 5 As shown, the connection processing device 500 may include:

[0109] The acquisition module 501 is used to retrieve the certificate information of the revoked digital certificate when the client's digital certificate is revoked, and store it in the remote dictionary service Redis database;

[0110] The determination module 502 is used to determine, from the Redis database, the client information that established the connection with the gateway based on the revoked digital certificate, according to the certificate information;

[0111] Broadcast module 503 is used to broadcast client information so that the application server can disconnect the client from the gateway based on the client information.

[0112] In this embodiment of the application, when a client's digital certificate is revoked, the client information corresponding to the digital certificate can be broadcast in a timely manner, so that the application server can disconnect the client with the revoked digital certificate from the gateway in a timely manner, thus ensuring information security.

[0113] In some embodiments, the certificate information includes the certificate serial number and certificate fingerprint of the digital certificate;

[0114] Client information includes the client's port number and Internet Protocol address.

[0115] In some embodiments, the Redis database includes a first relation table, which stores the correspondence between certificate information and client information with established connections. The first relation table is updated by the gateway according to the connection status between the client and the corresponding gateway.

[0116] Module 502 is specifically used for:

[0117] Based on the certificate information of the revoked digital certificate, search the first relation table to determine the client information corresponding to the revoked certificate information.

[0118] Figure 5 Each module in the illustrated device has the ability to implement Figures 1-2 The functions of each step and the corresponding technical effects are described briefly and will not be elaborated here.

[0119] Based on the same inventive concept, this application also provides a connection processing device, which is described below in conjunction with... Figure 6 The connection processing apparatus provided in the embodiments of this application will be described in detail.

[0120] Figure 6 This is a structural diagram of a connection processing device provided in an embodiment of this application.

[0121] like Figure 6 As shown, the connection processing device 600 may include:

[0122] The acquisition module 601 is used to acquire the client's certificate information upon receiving a connection request from the client. The connection request is used to request the establishment of a connection with the gateway.

[0123] The determination module 602 is used to search the remote dictionary service Redis database based on the certificate information to determine whether the client's digital certificate has been revoked. The Redis database is used to store the certificate information of revoked digital certificates.

[0124] Processing module 603 is used to refuse a client's connection to the gateway if it is determined that the client's digital certificate has been revoked.

[0125] Upon receiving a connection request from a client, this embodiment of the application can match the corresponding certificate information with the revoked certificate list in the Redis database. If it is determined that the client's certificate has been revoked, the client's connection will be rejected. Since the revoked certificate list is updated in real time, this embodiment of the application can verify whether the client's certificate has been revoked in real time, thus improving the certificate verification efficiency.

[0126] In some embodiments, the determining module 602 is further configured to, based on the certificate information, search the remote dictionary service Redis database to determine whether the client's digital certificate has been revoked, search the gateway's shared memory to determine whether the client's Internet Protocol address has been disabled, and the shared memory is used to store the Internet Protocol address of the disabled client.

[0127] Module 602 is specifically used for:

[0128] If it is determined that the client's Internet Protocol address is not disabled, the remote dictionary service Redis database is searched based on the certificate information to determine whether the client's digital certificate has been revoked.

[0129] In some embodiments, the connection processing device 600 may further include:

[0130] Establish a module to establish a connection between the client and the gateway after determining that the client's digital certificate has not been revoked by module 602, which searches the remote dictionary service Redis database based on the certificate information.

[0131] The storage module is used to store the client's certificate information and client information in the Redis database.

[0132] In some embodiments, the connection processing device 600 may further include:

[0133] The delete module is used to delete the client's certificate information and client information from the Redis database after the connection between the client and the gateway is established by the establishment module, and if the connection between the client and the gateway is detected to be lost.

[0134] Figure 6 Each module in the illustrated device has the ability to implement Figures 3-4 The functions of each step and the corresponding technical effects are described briefly and will not be elaborated here.

[0135] Based on the same inventive concept, embodiments of this application also provide a connection processing device. The following, in conjunction with… Figure 7 The connection processing device provided in the embodiments of this application will be described in detail.

[0136] like Figure 7As shown, the connection processing device 700 may include a processor 710 and a memory 720 for storing computer program instructions.

[0137] The processor 710 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0138] Memory 720 may include mass storage for data or instructions. For example, and not limitingly, memory 720 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. In one instance, memory 720 may include removable or non-removable (or fixed) media, or memory 720 may be non-volatile solid-state memory. In one instance, memory 720 may be read-only memory (ROM). In one instance, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM), or flash memory, or a combination of two or more of these.

[0139] The processor 710 reads and executes computer program instructions stored in the memory 720 to achieve... Figures 1-4 The method in the illustrated embodiment achieves... Figures 1-4 The corresponding technical effects achieved by the methods in the illustrated embodiments are described briefly and will not be elaborated further here.

[0140] In one example, the connection processing device 700 may further include a communication interface 730 and a bus 740. Wherein, as... Figure 7 As shown, the processor 710, memory 720, and communication interface 730 are connected via bus 740 and communicate with each other.

[0141] The communication interface 730 is mainly used to realize communication between various modules, devices and / or equipment in the embodiments of this application.

[0142] Bus 740 includes hardware, software, or both, that couples the components of the connection processing device 700 together. For example, and not as a limitation, bus 740 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 740 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, this application contemplates any suitable bus or interconnect.

[0143] When a client's digital certificate is revoked, the connection processing device 700 obtains the certificate information of the revoked digital certificate and stores it in a remote dictionary service Redis database. Then, it can execute the connection processing method described in this embodiment, thereby achieving connection processing. Figures 1-2 The described connection processing method and Figure 5 The described connection processing device.

[0144] Upon receiving a connection request from a client, the connection processing device 700 obtains the client's certificate information and can then execute the connection processing method described in this embodiment, thereby achieving connection. Figure 3 The described connection processing method and Figure 6 The described connection processing device.

[0145] Furthermore, in conjunction with the connection processing methods in the above embodiments, this application embodiment can provide a computer storage medium for implementation. This computer storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the connection processing methods in the above embodiments.

[0146] In addition, this application also provides a computer program product, including a computer program, which is executed by at least one processor to implement the various processes of the above-described connection processing method embodiments and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0147] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0148] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0149] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0150] The aspects of embodiments of this application have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to create a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by dedicated hardware performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0151] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A connection handling method, characterized by, include: If the client's digital certificate is revoked, obtain the certificate information of the revoked digital certificate and store it in the remote dictionary service Redis database; Based on the certificate information, determine from the Redis database the client information that established a connection with the gateway based on the revoked digital certificate; The client information is broadcast so that the application server disconnects the client from the gateway based on the client information.

2. The method according to claim 1, characterized in that, The certificate information includes the certificate serial number and certificate fingerprint of the digital certificate; The client information includes the client's port number and Internet Protocol address.

3. The method according to claim 1 or 2, characterized in that, The Redis database includes a first relation table, which stores the correspondence between certificate information and client information with established connections. The first relation table is updated by the gateway according to the connection status between the client and the corresponding gateway. The step of determining, based on the certificate information, the client information that established the connection with the gateway based on the revoked digital certificate from the Redis database includes: Based on the certificate information of the revoked digital certificate, the first relationship table is searched to determine the client information corresponding to the revoked certificate information.

4. A connection processing method, characterized in that, include: Upon receiving a connection request from a client, the certificate information of the client is obtained, and the connection request is used to request the establishment of a connection with the gateway; Based on the certificate information, the remote dictionary service Redis database is searched to determine whether the client's digital certificate has been revoked. The Redis database is used to store the certificate information of revoked digital certificates. If it is determined that the client's digital certificate has been revoked, the client's connection to the gateway will be denied. If the client's digital certificate has not been revoked, a connection is established between the client and the gateway. If the client's digital certificate has been revoked, the connection is disconnected. The disconnection operation is performed by the application server based on client information. The client information is determined by the PKI system from the Redis database based on the certificate information, and broadcast by the PKI system. The certificate information is obtained by the PKI system when the client's digital certificate has been revoked.

5. The method according to claim 4, characterized in that, Before determining whether the client's digital certificate has been revoked by searching the remote dictionary service Redis database based on the certificate information, the method further includes: Locate the shared memory of the gateway to determine whether the Internet Protocol address of the client is disabled. The shared memory is used to store the Internet Protocol addresses of disabled clients. The step of searching the remote dictionary service Redis database based on the certificate information to determine whether the client's digital certificate has been revoked includes: If it is determined that the client's Internet Protocol address is not disabled, the remote dictionary service Redis database is searched based on the certificate information to determine whether the client's digital certificate has been revoked.

6. The method according to claim 4, characterized in that, After establishing a connection between the client and the gateway if the client's digital certificate has not been revoked, and disconnecting the connection with the client if the client's digital certificate has been revoked, the method further includes: The client's certificate information and client information are stored in the Redis database.

7. The method according to claim 4, characterized in that, After establishing the connection between the client and the gateway, the method further includes: If the client is detected to have disconnected from the gateway, the client's certificate information and client information will be deleted from the Redis database.

8. A connection processing device, characterized in that, include: The acquisition module is used to acquire the certificate information of the revoked digital certificate when the client's digital certificate is revoked, and store it in the remote dictionary service Redis database; The determination module is used to determine, from the Redis database, client information that establishes a connection with the gateway based on the revoked digital certificate, according to the certificate information; The broadcast module is used to broadcast the client information so that the application server can disconnect the client from the gateway based on the client information.

9. A connection processing device, characterized in that, include: The acquisition module is used to acquire the certificate information of the client upon receiving a connection request from the client, wherein the connection request is used to request the establishment of a connection with the gateway; The determination module is used to search the remote dictionary service Redis database based on the certificate information to determine whether the client's digital certificate has been revoked. The Redis database is used to store the certificate information of the revoked digital certificate. The processing module is configured to refuse the client's connection to the gateway if it is determined that the client's digital certificate has been revoked; The processing module is further configured to establish a connection between the client and the gateway if it is determined that the client's digital certificate has not been revoked, and to disconnect the connection with the client if the digital certificate of the connected client has been revoked. The disconnection operation is performed by the application server based on the client information. The client information is determined by the PKI system from the Redis database based on the certificate information and broadcast by the PKI system. The certificate information is obtained by the PKI system when the client's digital certificate has been revoked.

10. A connection processing device, characterized in that, include: processor; Memory is used to store computer program instructions; When the computer program instructions are executed by the processor, the method as described in any one of claims 1-3, or the method as described in any one of claims 4-7, is implemented.

11. A computer-readable storage medium storing computer program instructions thereon, characterized in that, When the computer program instructions are executed by the processor, the method as described in any one of claims 1-3, or the method as described in any one of claims 4-7, is implemented.

12. A computer program product, characterized in that, It includes a computer program, which, when executed by a processor, implements the method as described in any one of claims 1-3, or the method as described in any one of claims 4-7.

Images