Method and system for realizing interconnection and intercommunication of multiple CA digital certificates

Abstract

The invention relates to the technical field of digital certificates, in particular to a multi-CA digital certificate interconnection and intercommunication implementation method and system. The method comprises the following steps: acquiring certificate information of each CA mechanism; accessing the approved CA mechanism to a multi-CA mutual identification platform; digital certificate interconnection and mutual identification are carried out based on a multi-CA mutual identification platform, and the multi-CA mutual identification platform receives a certificate verification request sent by a requester through an API interface, verifies the validity of a certificate by using the credible CA of the platform, and returns a verification result to the requester; and calling the digital certificate of the multi-CA mutual identification platform based on the government affair service system for verification to complete digital certificate mutual identification. According to the method, step-by-step implementation and rolling development are effectively realized, the requirements of interconnection and intercommunication, password compliance, security authentication, transmission encryption and the like of multi-party authentication of each business system which is urgently needed at present are met firstly, and then step-by-step improvement of an application system and a new product is enhanced on the basis of the existing system.

Description

Technical Field

[0001] The present invention relates to the technical field of digital certificates, and in particular to a method and system for realizing the interconnection and intercommunication of multiple CA digital certificates. Background Art

[0002] In today's digital age, digital certificates have been widely used as an important tool to ensure network security and information credibility. However, due to the independent operation of different CA institutions, the digital certificates they issue lack a unified mutual recognition mechanism, resulting in many limitations and inconveniences in the use of digital certificates in cross-institutional and cross-domain business scenarios.

[0003] In the field of government services, numerous business systems and applications require a high degree of trust and security, but due to the incompatibility of digital certificates from different CA institutions, information sharing and business collaboration face huge challenges. When users apply for government services, they may need to apply and process repeatedly because the digital certificates they use are not recognized by certain systems. This not only increases the burden on users, but also reduces the efficiency and quality of government services.

[0004] In addition, with the rapid development of the digital economy, cooperation and exchanges between enterprises are becoming more frequent, and the demand for interconnection and interoperability of digital certificates is becoming more urgent. However, the existing CA system lacks an effective integration and mutual recognition mechanism, which limits the business expansion and information flow between enterprises.

[0005] In order to solve the above problems, it is imperative to achieve the interconnection and interoperability of multi-CA digital certificates in order to break the information silos, improve the availability and versatility of digital certificates, and provide strong support for the development of government services and the digital economy. Summary of the invention In order to solve the above-mentioned problems, the present invention provides a method and system for realizing the interconnection and intercommunication of multiple CA digital certificates.

[0006] In a first aspect, the present invention provides a method for implementing the interconnection and interoperability of multiple CA digital certificates, which adopts the following technical solution: A method for implementing multi-CA digital certificate interconnection and interoperability, comprising: Obtain certificate information from each CA organization; Connect the approved CA organizations to the multi-CA mutual recognition platform; Digital certificates are interconnected and mutually recognized based on a multi-CA mutual recognition platform, wherein the multi-CA mutual recognition platform receives a certificate verification request sent by a requester through an API interface, verifies the validity of the certificate using the platform's trusted CA, and returns the verification result to the requester; The government service system calls the digital certificate of the multi-CA mutual recognition platform for verification and completes the mutual recognition of digital certificates.

[0007] Furthermore, the CA organization that has passed the review is connected to the multi-CA mutual recognition platform, including registering the CA organization that has passed the review based on the multi-CA mutual recognition platform, registering the root certificate and issuer information of the CA organization, as a screening condition for the subsequent configuration of the digital certificate trusted service.

[0008] Furthermore, the CA organization that has passed the review is connected to the multi-CA mutual recognition platform, and the CA organization provides its own certificate trust chain when submitting a registration access application to the multi-CA mutual recognition platform. After the registration access application is approved, the multi-CA mutual recognition platform adds the CA organization certificate trust chain to the trusted certificate chain resource pool, identifies the CA organization as a trusted CA organization, and the digital certificate issued by the CA organization is a trusted digital certificate.

[0009] Furthermore, the accessing of the approved CA institution to the multi-CA mutual recognition platform also includes, after registration and access, accessing LDAP&OCSP&CRL to the multi-CA mutual recognition platform and performing accessibility testing.

[0010] Furthermore, the validity of the certificate is verified by the trusted CA of the platform, including when a certificate verification request arrives, the multi-CA mutual recognition platform extracts the certificate to be verified from the verification request, verifies its issuer information according to the issuer subject in the certificate, searches for the trusted CA level according to the issuer information, and obtains the issuer's certificate and CRL address information.

[0011] Furthermore, the digital certificate verification based on the government service system calling the multi-CA mutual recognition platform includes calling the Web Service interface of the multi-CA mutual recognition platform based on the government service system, submitting the digital certificate to be verified to the digital certificate mutual recognition platform, and verifying the digital certificate based on the digital certificate mutual recognition platform.

[0012] Furthermore, the digital certificate is verified based on the digital certificate mutual recognition platform, including after the mutual recognition platform receives the digital certificate information, verifying whether the digital certificate belongs to a registered user in the mutual recognition platform, if not registered, returning an error message, if it is a registered user, parsing the certificate issuing authority information, determining whether the application allows the CA organization to access, if allowed, sending a verification request to the signature verification server to verify the validity of the digital certificate, if not allowed, returning an error.

[0013] Furthermore, the verification of the digital certificate based on the digital certificate mutual recognition platform also includes the signature verification server automatically downloading the CRL list from the CA institution CRL issuance point at a regular interval, performing verification according to the verification strategy, and feeding back the result to the digital certificate mutual recognition platform.

[0014] In a second aspect, a multi-CA digital certificate interconnection and interoperability implementation system includes: CA institution management module, used for registration access, management and deregistration of CA institutions; Multi-CA mutual recognition platform, used for mutual recognition of digital certificates of CA institutions based on the multi-CA mutual recognition platform; The digital certificate mutual recognition platform is used to access the digital certificates of multiple CA mutual recognition platforms and perform certificate verification to achieve mutual recognition with government systems.

[0015] Furthermore, it also includes mutual recognition middleware, which is used to provide unified identity authentication, authorization management and responsibility identification for CA organizations.

[0016] Furthermore, the CA organization management module includes a CA registration and management unit, a CA organization trust link access unit, and an LDAP / OCSP / CRL access unit.

[0017] In summary, the present invention has the following beneficial technical effects: The method for realizing the interconnection and intercommunication of multiple CA digital certificates of the present invention effectively realizes step-by-step implementation and rolling development. It first meets the interconnection and intercommunication of multiple-party authentication of various business systems, password compliance, security authentication, transmission encryption and other requirements that are urgently needed, and then strengthens the gradual improvement of application systems and new products on the basis of existing systems. The system of the present invention realizes autonomous controllability, stability and reliability. Following the currently released series of specifications and relying on the existing information security operation and maintenance services, it ensures the autonomous controllability, safety and reliability of the application of the integrated government service platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is a schematic diagram of a multi-CA digital certificate interconnection and interoperability implementation system according to Embodiment 1 of the present invention; Figure 2 It is a schematic diagram of a method for implementing the interconnection and interoperability of multiple CA digital certificates according to Example 1 of the present invention. DETAILED DESCRIPTION

[0019] The present invention is further described in detail below in conjunction with the accompanying drawings.

[0020] Example 1 Reference Figure 1 A method for implementing multi-CA digital certificate interconnection and interoperability in this embodiment includes: Obtain certificate information from each CA organization; Connect the approved CA organizations to the multi-CA mutual recognition platform; Digital certificates are interconnected and mutually recognized based on a multi-CA mutual recognition platform, wherein the multi-CA mutual recognition platform receives a certificate verification request sent by a requester through an API interface, verifies the validity of the certificate using the platform's trusted CA, and returns the verification result to the requester; The government service system calls the digital certificate of the multi-CA mutual recognition platform for verification and completes the mutual recognition of digital certificates.

[0021] The CA organization that has passed the review is connected to the multi-CA mutual recognition platform, including registering the CA organization that has passed the review based on the multi-CA mutual recognition platform, registering the root certificate and issuer information of the CA organization, as a screening condition for the subsequent configuration of the digital certificate trusted service.

[0022] The step of connecting the approved CA organization to the multi-CA mutual recognition platform also includes the CA organization providing its own certificate trust chain when submitting a registration access application to the multi-CA mutual recognition platform. After the registration access application is approved, the multi-CA mutual recognition platform adds the CA organization certificate trust chain to the trusted certificate chain resource pool, identifies the CA organization as a trusted CA organization, and the digital certificate issued by the CA organization is a trusted digital certificate.

[0023] The step of connecting the approved CA organizations to the multi-CA mutual recognition platform also includes connecting LDAP&OCSP&CRL to the multi-CA mutual recognition platform after registration and access, and performing accessibility testing.

[0024] The method of using the platform's trusted CA to verify the validity of the certificate includes: when a certificate verification request arrives, the multi-CA mutual recognition platform extracts the certificate to be verified from the verification request, verifies the issuer information according to the issuer subject in the certificate, searches for the trusted CA level according to the issuer information, and obtains the issuer's certificate and CRL address information.

[0025] The digital certificate verification based on the government service system calling the multi-CA mutual recognition platform includes calling the Web Service interface of the multi-CA mutual recognition platform based on the government service system, submitting the digital certificate to be verified to the digital certificate mutual recognition platform, and verifying the digital certificate based on the digital certificate mutual recognition platform.

[0026] The digital certificate is verified based on the digital certificate mutual recognition platform, including after the mutual recognition platform receives the digital certificate information, verifying whether the digital certificate belongs to a registered user in the mutual recognition platform, if not registered, returning an error message, if it is a registered user, parsing the certificate issuing authority information, judging whether the application allows the CA organization to access, if allowed, sending a verification request to the signature verification server to verify the validity of the digital certificate, if not allowed, returning an error.

[0027] The verification of the digital certificate based on the digital certificate mutual recognition platform also includes the signature verification server automatically downloading the CRL list from the CA institution CRL issuance point at a regular interval, performing verification according to the verification strategy, and feeding back the result to the digital certificate mutual recognition platform.

[0028] like Figure 2As shown, the solution of this embodiment is specifically as follows: (1) CA organization management ①CA registration and management a) CA Registration and Filing The basis of CA interoperability certification is the registration and filing of trusted CA institutions. After the CA institution is registered, its products and services can be connected to the multi-CA mutual recognition platform.

[0029] Registration of approved CA organizations mainly involves registering the root certificate and issuer information of the CA organization, which will serve as screening criteria for the subsequent configuration of digital certificate trusted services; and adding the organization's information to the CA organization trust list as an optional attribution item for subsequent electronic certification product registration.

[0030] After passing the review, the registered CA organizations are allowed to provide CA certification services in the government service field.

[0031] b) CA Management CA management content includes the deregistration of CA organizations, the deactivation and activation of digital certificate verification services, and the update of LDAP&OCSP&CRL addresses.

[0032] The multi-CA mutual recognition platform interacts with the servers of various CA institutions through the LDAP&OCSP&CRL addresses configured in the system to perform CRL checks, OCSP services, and certificate-related downloads.

[0033] ②CA institution trust link entry When a CA institution submits a registration access application to the multi-CA mutual recognition platform, it provides its own certificate trust chain. After the registration access application is approved, the platform adds the CA institution certificate trust chain to the trusted certificate chain resource pool, identifies the CA institution as a trusted CA institution, and the digital certificate issued by the CA institution is a trusted digital certificate.

[0034] ③LDAP&OCSP&CRL access After the CA registration access approval is successful, LDAP & OCSP & CRL must be connected to the multi-CA mutual recognition platform and accessibility testing must be carried out. Only after the test is passed can the CA institution officially provide services to the outside world.

[0035] (2) Digital certificate interconnection, mutual recognition and middleware ① Digital certificate CA mutual recognition Digital certificate CA interoperability authentication is mainly reflected in digital certificate verification, which is the core content of the multi-CA mutual recognition platform. The system realizes certificate verification online.

[0036] The multi-CA mutual recognition platform provides certificate verification services, which is the core part of the whole system. It provides services to the outside world in the form of standard APIs, accepts certificate verification requests sent from the outside world, verifies the validity of the certificate using trusted CAs, and sends the verification results back to the requester.

[0037] When a certificate verification request arrives, the certificate to be verified is extracted from the request, and its issuer is verified according to the issuer subject in the certificate. Then, based on the issuer information, a trusted CA organization is searched to obtain the issuer's certificate and CRL address and other related information, thereby verifying the validity of the certificate.

[0038] The verification process is as follows: 1. Parse the certificate path. If the root CA of the entity certificate to be verified is parsed, a certificate path from the root CA to the certificate to be verified is formed. If the path construction is successful, continue to execute. Otherwise, search for certificates one level at a time, construct a trust path, and perform OCSP verification. 2. Download the CRL list in advance. 3. Use the CA certificate to verify the CRL list to confirm that the source of the CRL list is credible. 4. Check whether the user certificate is valid. 5. Use the CA certificate to verify the CA signature on the user certificate to see if it is issued by the CA. 6. Check the CRL list to see if the user certificate has been revoked. 7. Get the verification result.

[0039] Digital certificate mutual recognition process: The government service system calls the mutual recognition platform Web Service interface and submits the digital certificate to be verified to the digital certificate mutual recognition system for verification.

[0040] (1) When a government service system has a digital certificate verification requirement, it submits the digital certificate information to the mutual recognition platform for verification; (2) After receiving the certificate information, the mutual recognition platform verifies whether the certificate belongs to a registered user in the mutual recognition platform. If not, an error message is returned. If it is a registered user, the platform parses the certificate authority information to determine whether the application allows the CA to access. If allowed, a verification request is sent to the signature verification server to verify the validity of the digital certificate. If not allowed, an error message is returned. (3) The signature verification server automatically downloads the CRL list from the CA CRL issuing point at regular intervals, verifies it according to the verification strategy, and feeds back the results to the mutual recognition platform: Verify whether the certificate is issued by a trusted authority; Verify that the certificate is within the validity period; Verify the certificate status through CRL or OCSP.

[0041] (4) The mutual recognition platform saves the verification log and feeds back the verification results to the government service system.

[0042] At this point, the mutual recognition of digital certificates is completed.

[0043] Example 2 This embodiment provides a system for implementing the interconnection and interoperability of multiple CA digital certificates, including: CA institution management module, used for registration access, management and deregistration of CA institutions; Multi-CA mutual recognition platform, used for mutual recognition of digital certificates of CA institutions based on the multi-CA mutual recognition platform; The digital certificate mutual recognition platform is used to access the digital certificates of multiple CA mutual recognition platforms and perform certificate verification to achieve mutual recognition with government systems.

[0044] It also includes mutual recognition middleware, which is used to provide unified identity authentication, authorization management and responsibility identification for CA organizations.

[0045] The CA organization management module includes a CA registration and management unit, a CA organization trust link access unit, and an LDAP / OCSP / CRL access unit.

[0046] Specifically, like Figure 1 As shown, the multi-CA digital certificate interconnection and interoperability implementation system of this embodiment includes a CA institution management module, a multi-CA mutual recognition platform and a digital certificate mutual recognition platform, wherein the CA institution management module includes a CA registration and filing module, a CA institution trust chain access module and an LDAP&OCSP&CRL access module, and the multi-CA mutual recognition platform provides certificate verification services, which is the core part of the whole system. It provides services to the outside in the form of standard APIs, accepts certificate verification requests sent from the outside, verifies the validity of the certificate using a trusted CA, and sends the verification results back to the requester.

[0047] As a further embodiment, The multi-CA mutual recognition middleware provides a standardized interface for connecting to business application systems upwards; it connects to cryptographic media from different manufacturers downwards to integrate the access interfaces of multiple cryptographic media, achieve unified access, and provide support for upper-level digital certificate applications. Through the multi-CA mutual recognition platform, digital certificate interconnection and mutual recognition services can be provided for the integrated government service platform. The client only needs to integrate a set of digital certificate interfaces and certificate assistants to realize the application of different CA digital certificates on the client.

[0048] The above are all preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Therefore, any equivalent changes made based on the structure, shape, and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for implementing the interconnection and interoperability of multiple CA digital certificates, characterized in that: include: Obtain certificate information from each CA organization; Connect the approved CA organizations to the multi-CA mutual recognition platform; Digital certificates are interconnected and mutually recognized based on a multi-CA mutual recognition platform, wherein the multi-CA mutual recognition platform receives a certificate verification request sent by a requester through an API interface, verifies the validity of the certificate using the platform's trusted CA, and returns the verification result to the requester; The government service system calls the digital certificate of the multi-CA mutual recognition platform for verification and completes the mutual recognition of digital certificates.

2. A method for implementing multi-CA digital certificate interconnection and interoperability according to claim 1, characterized in that: The CA organization that has passed the review is connected to the multi-CA mutual recognition platform, including registering the CA organization that has passed the review based on the multi-CA mutual recognition platform, registering the root certificate and issuer information of the CA organization, as a screening condition for the subsequent configuration of the digital certificate trusted service.

3. A method for realizing interconnection and intercommunication of multiple CA digital certificates according to claim 2, characterized in that: The step of connecting the approved CA organization to the multi-CA mutual recognition platform also includes the CA organization providing its own certificate trust chain when submitting a registration access application to the multi-CA mutual recognition platform. After the registration access application is approved, the multi-CA mutual recognition platform adds the CA organization certificate trust chain to the trusted certificate chain resource pool, identifies the CA organization as a trusted CA organization, and the digital certificate issued by the CA organization is a trusted digital certificate.

4. A method for realizing interconnection and intercommunication of multiple CA digital certificates according to claim 3, characterized in that: The step of connecting the approved CA organizations to the multi-CA mutual recognition platform also includes connecting LDAP&OCSP&CRL to the multi-CA mutual recognition platform after registration and access, and performing accessibility testing.

5. A method for realizing interconnection and intercommunication of multiple CA digital certificates according to claim 4, characterized in that: The method of using the platform's trusted CA to verify the validity of the certificate includes: when a certificate verification request arrives, the multi-CA mutual recognition platform extracts the certificate to be verified from the verification request, verifies the issuer information according to the issuer subject in the certificate, searches for the trusted CA level according to the issuer information, and obtains the issuer's certificate and CRL address information.

6. A method for realizing interconnection and intercommunication of multiple CA digital certificates according to claim 5, characterized in that: The digital certificate verification based on the government service system calling the multi-CA mutual recognition platform includes calling the Web Service interface of the multi-CA mutual recognition platform based on the government service system, submitting the digital certificate to be verified to the digital certificate mutual recognition platform, and verifying the digital certificate based on the digital certificate mutual recognition platform.

7. A method for realizing interconnection and intercommunication of multiple CA digital certificates according to claim 6, characterized in that: The digital certificate is verified based on the digital certificate mutual recognition platform, including after the mutual recognition platform receives the digital certificate information, verifying whether the digital certificate belongs to a registered user in the mutual recognition platform, if not registered, returning an error message, if it is a registered user, parsing the certificate issuing authority information, judging whether the application allows the CA organization to access, if allowed, sending a verification request to the signature verification server to verify the validity of the digital certificate, if not allowed, returning an error.

8. A method for realizing interconnection and intercommunication of multiple CA digital certificates according to claim 7, characterized in that: The verification of the digital certificate based on the digital certificate mutual recognition platform also includes the signature verification server automatically downloading the CRL list from the CA institution CRL issuance point at a regular interval, performing verification according to the verification strategy, and feeding back the result to the digital certificate mutual recognition platform.

9. A system for realizing interconnection and intercommunication of multiple CA digital certificates, characterized in that: include: CA institution management module, used for registration access, management and deregistration of CA institutions; Multi-CA mutual recognition platform, used for mutual recognition of digital certificates of CA institutions based on the multi-CA mutual recognition platform; The digital certificate mutual recognition platform is used to access the digital certificates of multiple CA mutual recognition platforms and perform certificate verification to achieve mutual recognition with government systems.

10. A system for realizing interconnection and intercommunication of multiple CA digital certificates according to claim 9, characterized in that: It also includes mutual recognition middleware, which is used to provide unified identity authentication, authorization management and responsibility identification for CA organizations.

Images