Certificate data updating method of resource public key infrastructure and related equipment

Abstract

According to the certificate data updating method of the resource public key infrastructure and the related equipment, the resource public key infrastructure comprises a certificate management unit, the method is applied to the certificate management unit, and the method comprises the steps that firstly, multiple pieces of basic data are acquired, and the basic data comprise prefix data and autonomous domain data; then, selecting updated basic data from the multiple pieces of basic data based on the prefix data and the autonomous domain data; and finally, on the basis of the updated basic data, obtaining updated certificate data, and updating certificate data of the certificate management unit on the basis of the updated certificate data, so as to reduce the certificate data acquisition amount in each certificate data updating process, thereby effectively improving the updating efficiency when the certificate data is updated.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a certificate data updating method and related equipment for a resource public key infrastructure. Background Art

[0002] Resource Public Key Infrastructure is a system for managing digital certificates. In resource public key infrastructure, certificate data update is an important part of maintaining system security and effectiveness.

[0003] In the related art, for certificate updates in resource public key infrastructure, each certificate data management node usually first obtains all basic data in the resource public key infrastructure from a public basic data acquisition website, and then inputs each basic data into another public certificate data query website to obtain the corresponding certificate data, which is then stored in the database of the certificate data management node itself to complete the update process. However, using this method to update certificate data requires obtaining all certificate data each time before updating, and its update efficiency is too low. Summary of the invention

[0004] The embodiments of the present application provide a certificate data update method and related devices for a resource public key infrastructure, which can improve the update efficiency of certificate data update in the resource public key infrastructure.

[0005] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present application proposes a certificate data updating method of a resource public key infrastructure, wherein the resource public key infrastructure includes a certificate management unit, and the method is applied to the certificate management unit, and the method includes:

[0006] Acquire multiple pieces of basic data, wherein the basic data includes prefix data and autonomous domain data;

[0007] Selecting updated basic data from the plurality of basic data based on the prefix data and the autonomous domain data;

[0008] Based on the update basic data, update certificate data is obtained, and based on the update certificate data, the certificate data of the certificate management unit is updated.

[0009] In some embodiments, the certificate management unit is provided with a basic data table, the basic data table stores a plurality of historical basic data, and the updating basic data is selected from the plurality of basic data based on the prefix data and the autonomous domain data, including:

[0010] Matching each of the basic data with the multiple historical basic data one by one, filtering the basic data whose prefix data and the autonomous domain data are consistent with the historical basic data;

[0011] The remaining basic data is used as the updated basic data, and the updated basic data is stored in the basic data table as new historical basic data.

[0012] In some embodiments, the step of constructing the basic data table includes:

[0013] Acquire a plurality of pieces of the historical basic data and a data sequence number of each piece of the historical basic data, wherein the data sequence number is obtained based on the acquisition time of the historical basic data;

[0014] Each of the data serial numbers is saved in correspondence with the data information in the corresponding historical basic data one by one to obtain the basic data table.

[0015] In some embodiments, the certificate management unit is provided with a distributed computing engine, and obtaining the updated certificate data based on the updated basic data includes:

[0016] Writing the updated basic data into a real-time message queue;

[0017] Obtaining the update basic data from the message queue using the distributed computing engine;

[0018] The updated basic data is input into a certificate data acquisition website by utilizing the distributed computing engine to obtain the updated certificate data generated by the certificate data acquisition website according to the updated basic data.

[0019] In some embodiments, the update basic data is a plurality of pieces, and the using the distributed computing engine to input the update basic data into a certificate data acquisition website to obtain the update certificate data generated by the certificate data acquisition website according to the update basic data includes:

[0020] Using the distributed computing engine, the current update basic data is input into the certificate data acquisition website to acquire the certificate data, and the input time information of the input moment is acquired;

[0021] Acquire waiting time information, and when the difference between the waiting time information and the input time information reaches a preset restart time, stop acquiring the certificate data of the current update basic data, and input the next update basic data into the certificate data acquisition website to acquire the certificate data;

[0022] The historical basic data corresponding to the current updated basic data in the basic data table is deleted.

[0023] In some embodiments, the step of establishing the preset restart time includes:

[0024] Obtaining a first response time average and a first response time maximum of the certificate data acquisition website for all the updated basic data in a first time period in the past, and obtaining a second response time average and a second response time maximum of the certificate data acquisition website for all the updated basic data in a second time period in the past, wherein the first time period is less than the second time period;

[0025] Performing data averaging processing on the first response time mean and the first response time maximum to obtain a first time mean, and performing data averaging processing on the second response time mean and the second response time maximum to obtain a second time mean;

[0026] The first weighted time is obtained by multiplying the first time average by the first weight, the second weighted time is obtained by multiplying the second time average by the second weight, the first weighted time and the second weighted time are accumulated to obtain the preset restart time, the first weight is greater than the second weight, and the sum of the first weight and the second weight is equal to one.

[0027] In some embodiments, updating the certificate data of the certificate management unit based on the updated certificate data includes:

[0028] Acquire the certificate data format, perform format verification on the update certificate data based on the certificate data format, and obtain an update verification result;

[0029] When the update verification result indicates that the certificate format of the updated certificate data is correct, the updated certificate data is written into the certificate database of the certificate management unit to update the certificate data of the certificate management unit.

[0030] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present application proposes a certificate data updating device of a resource public key infrastructure, wherein the resource public key infrastructure includes a certificate management unit, the device is configured with the certificate management unit, and the device includes:

[0031] An acquisition module, used for acquiring a plurality of basic data, wherein the basic data includes prefix data and autonomous domain data;

[0032] An update data selection module, configured to select update basic data from the plurality of basic data based on the prefix data and the autonomous domain data;

[0033] The certificate data updating module is used to obtain updated certificate data based on the updated basic data, and to update the certificate data of the certificate management unit based on the updated certificate data.

[0034] To achieve the above-mentioned purpose, the third aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, it implements the certificate data update method of the resource public key infrastructure as described in the first aspect.

[0035] To achieve the above-mentioned purpose, the fourth aspect of an embodiment of the present application proposes a storage medium, which is a computer-readable storage medium, and the storage medium stores a computer program. When the computer program is executed by a processor, it implements the certificate data update method of the resource public key infrastructure described in the first aspect above.

[0036] The certificate data updating method and related equipment of the resource public key infrastructure proposed in the embodiment of the present application, the resource public key infrastructure includes a certificate management unit, the method is applied to the certificate management unit, the method includes: first, obtaining multiple basic data, the basic data includes prefix data and autonomous domain data; then, selecting updated basic data from the multiple basic data based on the prefix data and the autonomous domain data; finally, based on the updated basic data, obtaining updated certificate data, and updating the certificate data of the certificate management unit based on the updated certificate data. After the certificate management unit in the embodiment of the present application obtains multiple basic data from the basic data acquisition website, combined with the characteristic that the prefix data or autonomous domain data in the basic data will definitely change after the basic data is updated, the prefix data and autonomous domain data in the multiple basic data are used to filter out the newly added or modified updated basic data, and only obtain the certificate data corresponding to the updated basic data from the certificate data query website, so as to reduce the amount of certificate data obtained in each certificate data update process, thereby effectively improving the update efficiency when the certificate data is updated.

[0037] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a structural diagram of a resource public key infrastructure provided by an embodiment of the present application.

[0039] Figure 2 This is a flowchart of a method for updating certificate data of a resource public key infrastructure provided by another embodiment of the present application.

[0040] Figure 3 This is a flowchart for constructing a basic data table provided in another embodiment of the present application.

[0041] Figure 4It is a schematic diagram of a basic data table provided in yet another embodiment of the present application.

[0042] Figure 5 yes Figure 2 Flow chart of step 202 in FIG.

[0043] Figure 6 yes Figure 2 Flow chart of step 203 in FIG.

[0044] Figure 7 yes Figure 6 Flowchart of step 603 in FIG.

[0045] Figure 8 This is a flow chart for generating a preset restart time provided by another embodiment of the present application.

[0046] Fig. 9 yes Figure 7 Flowchart of step 702 in FIG.

[0047] Fig.10 This is a flowchart of certificate data update of a resource public key infrastructure provided by another embodiment of the present application.

[0048] Fig.11 This is a flowchart of a method for updating certificate data of a resource public key infrastructure provided by another embodiment of the present application.

[0049] Fig.12 It is a schematic diagram of the hardware structure of an electronic device provided in yet another embodiment of the present application. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0051] It should be noted that although the functional modules are divided in the device schematic and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart.

[0052] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0053] First, some nouns involved in this application are analyzed:

[0054] Resource Public Key Infrastructure (RPKI) is a framework for securely managing the Internet routing system. It provides a way to verify the owners and authorized users of network resources and prevent attacks such as route hijacking and IP address spoofing. RPKI is based on the principles of public key infrastructure (PKI) and uses digital certificates to verify the owners of network resources. It involves the following main components: Certificate Authority (CA): CA is responsible for issuing digital certificates to confirm the identity of the owner of network resources and authorize their use. The CA's certificate is called the RPKI root certificate. Resource Holder: Resource holders are organizations or individuals who own Internet resources (such as IP address segments). They obtain digital certificates from CA to prove their resource ownership. Router Validator: Router Validator is a software or hardware device used to verify digital certificates from RPKI and ensure that only authorized routes are accepted and propagated by filtering the routing table.

[0055] By using RPKI, network operators can verify the legitimacy of routing information received from other network operators and reject untrusted routes. This helps reduce the risk of route hijacking and spoofing attacks and improves the security and stability of the Internet routing system. It should be noted that RPKI is a complex system that requires the cooperation of network operators, Internet service providers, and other relevant parties to achieve effective deployment and operation. It plays an important role in protecting the Internet routing system from malicious attacks.

[0056] A digital certificate is a security credential used to verify and confirm identity in network communications. It is built on the concepts of public key cryptography and public key infrastructure. A digital certificate uses a digital signature to ensure the integrity and authenticity of the certificate, and uses a public key for identity authentication and encrypted communications. A digital certificate contains a series of key information. The first is the subject identifier, which uniquely identifies the owner of the certificate, usually the name of an organization or individual. Secondly, a digital certificate contains a public key associated with the certificate owner, which is used to encrypt and decrypt data and verify digital signatures. In addition, a digital certificate also contains a digital signature, which is calculated by the certificate authority (CA) using its private key to encrypt the contents of the certificate and is used to verify the integrity and authenticity of the certificate.

[0057] API is the abbreviation of Application Programming Interface. It is a set of definitions, protocols and tools for building software applications. In simple terms, API can be regarded as a way for different software to communicate, allowing different programs to interact and share data without having to understand the internal structure or functional implementation details of each component.

[0058] Resource Public Key Infrastructure is a system for managing digital certificates. In resource public key infrastructure, certificate data update is an important part of maintaining system security and effectiveness.

[0059] In the related art, for certificate updates in a resource public key infrastructure, each certificate data management node usually first goes to a public basic data acquisition website to obtain all basic data in the resource public key infrastructure, and then inputs each basic data into another public certificate data query website to obtain the corresponding certificate data, which is then stored in the certificate data management node's own database to complete the update process.

[0060] However, since all the basic data in the resource public key infrastructure changes irregularly, it may be added or modified. In addition, there are generally nearly 600,000 basic data in a full resource public key infrastructure. Each time the certificate data corresponding to the 600,000 basic data is obtained, the efficiency of the acquisition will be relatively low due to network problems, resulting in low efficiency in updating certificate resources.

[0061] In order to improve the update efficiency of certificate data updates in the resource public key infrastructure, the certificate management unit in the embodiment of the present application obtains multiple basic data from the basic data acquisition website. Combined with the characteristic that the prefix data or autonomous domain data in the basic data will definitely change after the basic data is updated, the prefix data and autonomous domain data in the multiple basic data are used to filter out the newly added or modified updated basic data, and only obtains the certificate data corresponding to the updated basic data from the certificate data query website, so as to reduce the amount of certificate data obtained in each certificate data update process, thereby effectively improving the update efficiency when the certificate data is updated.

[0062] The following will further describe the certificate data update method and related devices of the resource public key infrastructure provided by the embodiment of the present application. In order to better explain the certificate data update method of the resource public key infrastructure provided by the embodiment of the present application, this embodiment first describes a resource public key infrastructure of the present application. Figure 1 As shown in FIG. 1 , it is a schematic diagram of the structure of a resource public key infrastructure provided by an embodiment of the present application. Figure 1As shown in , the resource public key infrastructure includes multiple certificate management units that are associated in a hierarchical manner, wherein the certificate management units include the main management unit (IANA), the regional management unit (APCIN) and the local management unit (including the local registration unit 1 (CNNIC), the local registration unit 2 (IPNIC) and the local registration unit 3 (TWNIC)) from top to bottom, and each certificate management unit is provided with a certificate database for storing all certificate data (including CA certificate data and ROA certificate data) in the resource public key infrastructure. It can be understood that, as Figure 1 The resource public key infrastructure shown only uses the three-layer certificate management unit (five units in total) as an example. In fact, the resource public key infrastructure has many units, and the number of certificate management units does not affect the use of the certificate data update method of the resource public key infrastructure provided in this application.

[0063] based on Figure 1 The resource public key infrastructure shown in the figure, the certificate data updating method of the resource public key infrastructure in the embodiment of the present application will be described in detail below. The certificate data updating method of the resource public key infrastructure provided in the embodiment of the present application is applied to any certificate management unit in the resource public key infrastructure.

[0064] Reference Figure 2 , which is an optional flowchart of the certificate data updating method of the resource public key infrastructure provided in the embodiment of the present application, Figure 2 The method in the embodiment may include but is not limited to steps 201 to 203. Figure 2 The order of step 201 to step 203 is not specifically limited, and the order of steps can be adjusted or some steps can be reduced or added according to actual needs.

[0065] Step 201: Acquire multiple pieces of basic data, where the basic data includes prefix data and autonomous domain data.

[0066] Step 201 is described in detail below.

[0067] In some embodiments, after the certificate management unit responds to the certificate data update request, it will first use the public API to go to the public basic data acquisition website to obtain multiple basic data of the resource public key infrastructure. It is understandable that the amount of basic data obtained at this time is very large, generally close to 600,000; but each time the update is made, the amount of new or changed basic data will not be large, usually a few hundred pieces of data (the amount is related to the update cycle interval). Therefore, if the certificate data corresponding to all the basic data is obtained through another public certificate data query website every time an update is made, there will be a large amount of redundant data, and the update time will be greatly increased.

[0068] Among them, the public basic data acquisition website is: https: / / rpki.cloudflare.com / rpki.json; the public certificate data query website is: https: / / rpki.cloudflare.com / api / graphql.

[0069] In order to improve the update efficiency, it is necessary to select the newly added or changed basic data from all the basic data each time as the update basic data that really needs to be updated. Therefore, this embodiment uses the historical basic data obtained in the past update link to build a basic data table, so as to facilitate the subsequent use of the basic data table to select the update basic data in the real-time update. The following will further describe how to build the basic data table.

[0070] Reference Figure 3 , the steps of constructing the basic data table include the following steps 301 to 302.

[0071] Step 301: Acquire multiple pieces of historical basic data and the data sequence number of each piece of historical basic data.

[0072] Step 302: Save each data sequence number in correspondence with the data information in the corresponding historical basic data one by one to obtain a basic data table.

[0073] Steps 301 to 302 are described in detail below.

[0074] In some embodiments, the certificate management unit obtains multiple historical basic data in the past update link, and obtains the corresponding data serial number based on the acquisition time sequence when each historical basic data is obtained, and then saves each data serial number and the data information in the corresponding historical basic data one by one to obtain the basic data table. Figure 4 , is a schematic diagram of a basic data table provided in an embodiment of the present application. Figure 4 As shown in , the basic data table stores multiple pieces of data information of historical basic data arranged according to serial numbers, wherein the data information of each piece of historical basic data generally includes prefix data (prefix), autonomous domain data (asn), the name of the certificate management unit corresponding to the basic data, the time data corresponding to the basic data, and the data length, etc.

[0075] Step 202: Select and update basic data from multiple basic data based on the prefix data and the autonomous domain data.

[0076] Step 202 is described in detail below.

[0077] In some embodiments, in order to effectively and accurately filter out truly newly added or changed basic data from multiple basic data, the characteristic that the prefix data or autonomous domain data in the basic data will definitely change after the basic data is updated will be utilized, so as to filter from the pre-constructed basic data table based on the prefix data and autonomous domain data in each basic data to obtain suitable updated basic data, as described in detail below.

[0078] Reference Figure 5 , based on the prefix data and the autonomous domain data, selecting and updating basic data from multiple basic data includes the following steps 501 to 502.

[0079] Step 501: Match each basic data with multiple historical basic data one by one, and filter basic data whose prefix data and autonomous domain data are consistent with the historical basic data.

[0080] Step 502: Use the remaining basic data as updated basic data, and store the updated basic data as new historical basic data in the basic data table.

[0081] Steps 501 to 502 are described in detail below.

[0082] In some embodiments, after obtaining multiple basic data in the current certificate data update link, the prefix data and autonomous domain data in each basic data are used as a combined key to match the prefix data and autonomous domain data in multiple historical basic data stored in the basic data table, and then a removal engine is used to filter out the basic data whose prefix data and autonomous domain data in the multiple basic data are consistent with any historical basic data in the basic data table.

[0083] After all basic data have been verified, the remaining basic data will be used as updated basic data, and these updated basic data will be stored in the basic data table as new historical basic data to facilitate matching evidence in the next certificate data update phase.

[0084] It can be understood that updating all basic data in the basic data means that any one of the prefix data and the autonomous domain data has changed.

[0085] Through the above steps 501 to 502, the characteristic that the prefix data or autonomous domain data in the basic data will definitely change after the basic data is updated is utilized, and matching and screening are performed on the basic data table pre-constructed using the data information of the past historical basic data to accurately obtain the updated basic data that is truly newly added or changed, so that when only the certificate data corresponding to the updated basic data is obtained later, the update efficiency of the certificate data update of the certificate management unit can be more effectively improved.

[0086] Step 203: Based on the updated basic data, updated certificate data is obtained, and the certificate data of the certificate management unit is updated based on the updated certificate data.

[0087] Step 203 is described in detail below.

[0088] In some embodiments, after obtaining truly newly added or changed updated basic data by screening the basic data, the updated certificate data corresponding to these updated basic data will be further obtained through a public certificate data acquisition website, so as to update the certificate data in the certificate database in the certificate management unit with these updated certificate data to complete the certificate data update process, as described below.

[0089] Reference Figure 6 , based on the update basic data, obtaining the update certificate data, including the following steps 601 to 603.

[0090] Step 601: Write the updated basic data into the real-time message queue.

[0091] Step 602: Utilize the distributed computing engine to obtain update basic data from the message queue.

[0092] Step 603: Using the distributed computing engine, the update basic data is input into the certificate data acquisition website to obtain the update certificate data generated by the certificate data acquisition website according to the update basic data.

[0093] The following is about steps 601 to 603.

[0094] In some embodiments, the determined update basic data are first written into a real-time Kafka message queue. Then, the distributed computing engine Flink is used to read the update basic data in the Kafka message queue in real time, and after reading a piece of update basic data, the update certificate data (including CA certificate data and ROA certificate data) corresponding to the update basic data is obtained from a public certificate data acquisition website, and the update certificate data is stored in the corresponding certificate table (including CA certificate table and ROA certificate table) in the certificate database.

[0095] It is understandable that the update basic data is written into the real-time Kafka message queue in order to ensure the real-time reading of the update basic data by the distributed computing engine Flink. If text storage is used, the distributed computing engine Flink cannot obtain it in real time and will become offline. Therefore, the use of the Kafka message queue can indirectly improve the update efficiency of the certificate data update.

[0096] In addition, when using the distributed computing engine Flink to obtain the updated certificate data corresponding to the updated basic data from the certificate data acquisition website, since the server of the certificate data acquisition website is usually far away, it is easy to cause the website response of the certificate data acquisition website to time out due to network problems such as network anomalies, thereby limiting the update efficiency of the certificate data update. Based on this, in this embodiment, the response time of each certificate data acquisition process for updating the basic data is monitored, and corresponding processing is taken to improve the update efficiency, as described below.

[0097] Reference Figure 7 , using a distributed computing engine to input the updated basic data into a certificate data acquisition website, and obtaining updated certificate data generated by the certificate data acquisition website based on the updated basic data, including the following steps 701 to 703.

[0098] Step 701: Use a distributed computing engine to input the current update basic data into a certificate data acquisition website to acquire certificate data, and acquire input time information of the input moment.

[0099] Step 702: Obtain waiting time information. When the difference between the waiting time information and the input time information reaches the preset restart time, stop the current certificate data acquisition of the updated basic data, and input the next updated basic data into the certificate data acquisition website for certificate data acquisition.

[0100] Step 703: Delete the historical basic data in the basic data table that corresponds to the current updated basic data.

[0101] Steps 701 to 703 are described in detail below.

[0102] In some embodiments, when the current update basic data is input into the certificate data acquisition website using the distributed computing engine to acquire the certificate data, the input time information of the input moment of the current update basic data into the certificate data acquisition website is also acquired. Then, in the process of waiting for the certificate data acquisition website to feedback the certificate data, the waiting time information (i.e., real-time time information) is acquired in real time, and the waiting response time after the current update basic data is input into the certificate data acquisition website is obtained based on the difference between the waiting time information and the input time information.

[0103] When the waiting response time reaches the preset restart time, it will be considered that the response time is too long after the current update basic data is input into the certificate data acquisition website due to network abnormalities and other problems. At this time, the certificate data acquisition of the current update basic data is stopped, and the next update basic data is input into the certificate data acquisition website for certificate data acquisition, and the historical basic data corresponding to the current update basic data in the basic data packet is deleted, so that the certificate data of the (i.e. the current) update basic data can be obtained again when the certificate data is updated next time.

[0104] Through the above steps 701 to 703, the waiting response time obtained by the difference between the input time information corresponding to the current update basic data input into the certificate data acquisition website and the real-time waiting time information is compared with the preset restart time, and the certificate data acquisition of the update basic data whose waiting response time exceeds the preset restart time is suspended, and the certificate data acquisition of the next update basic data is carried out, effectively avoiding the situation where the certificate data acquisition website is stuck due to network anomalies and the certificate data acquisition cannot be continued, so as to improve the update efficiency of the certificate data update; and the corresponding updated basic data in the basic data table is deleted, so as to obtain the certificate data corresponding to the basic data again when the certificate data is updated next time, so as to improve the reliability of the certificate data update.

[0105] In addition, the setting of the preset restart time is related to the response time parameter of the certificate data acquisition website, and can be further customized in combination with the requirements of the certificate management unit, such as 3 minutes, or can be adaptively set based on historical response times, as described below.

[0106] Reference Figure 8 , the steps of constructing the preset restart time include the following steps 801 to 803.

[0107] Step 801: Obtain the first response time average and the first response time maximum of the certificate data acquisition website for all updated basic data in the past first time period, and obtain the second response time average and the second response time maximum of the certificate data acquisition website for all updated basic data in the past second time period.

[0108] Step 802: performing data averaging processing on the first response time mean and the first response time maximum to obtain a first time mean, and performing data averaging processing on the second response time mean and the second response time maximum to obtain a second time mean.

[0109] Step 803: multiply the first time mean by the first weight to obtain the first weighted time, multiply the second time mean by the second weight to obtain the second weighted time, and add the first weighted time and the second weighted time to obtain the preset restart time.

[0110] The following is a detailed description of steps 801 to 803.

[0111] In some embodiments, during the process of past certificate data update, the certificate management unit also obtains and stores in real time the response time x of the certificate data acquisition website for all the updated basic data in a plurality of preset time periods (including the first time period t1 of a short time period in the recent period, and then the second time period t2 of a relatively long time period, and t1 < t2), and takes the average value and the maximum value of these response times to obtain the first response time average value and the first response time maximum value y1 corresponding to the first time period, and the second response time average value and the second response time maximum value y2 corresponding to the second time period.

[0112] Next, perform data averaging on the first response time average value and the first response time maximum value y1 to obtain the first time average value and perform data averaging on the second response time average value and the second response time maximum value y2 to obtain the second time average value Then multiply the first time average value by the first weight α1 to obtain the first weighted time, multiply the second time average value by the second weight α2 to obtain the second weighted time, and accumulate the first weighted time and the second weighted time to obtain the preset restart time

[0113] Among them, since the first time period is smaller than the second time period, that is, the first time period is closer to the current update moment compared to the second time period, the data information of the first time average value corresponding to the first time period can better reflect the feedback time of the current network state of the online certificate data acquisition website at the current moment. Therefore, the first weight α1 is greater than the second weight α2, and the sum of the first weight and the second weight is equal to one.

[0114] Through the above steps 801 to 803, by using the response time average value and the response time maximum value corresponding to two recent time periods of the certificate data acquisition website, and further combining different weights corresponding to different time periods, a preset restart time more suitable for the current network state at the current update moment can be better generated.

[0115] Refer to Fig. 9 , and update the certificate data of the certificate management unit based on the updated certificate data, including the following steps 901 to 902.

[0116] Step 901: Obtain the certificate data format, perform format verification on the update certificate data based on the certificate data format, and obtain an update verification result.

[0117] Step 902: When the update verification result indicates that the certificate format of the updated certificate data is correct, the updated certificate data is written into the certificate database of the certificate management unit to update the certificate data of the certificate management unit.

[0118] Steps 901 to 902 are described in detail below.

[0119] In some embodiments, in order to better ensure the reliability of certificate data updates, after obtaining the updated certificate data returned by the certificate data acquisition website, the obtained updated certificate data is format checked according to the obtained certificate data format. When the update check result indicates that the certificate format of the updated certificate data is correct, the updated certificate data is written into the certificate database of the certificate management unit to update the certificate data of the certificate management unit, thereby effectively improving the reliability of certificate data updates.

[0120] Reference Fig.10 , is a flow chart of a certificate data update process of a resource public key infrastructure provided by an embodiment of the present application. Fig.10 As shown in , the certificate management unit first uses a crawler to cyclically obtain the public basic data acquisition website (https: / / rpki.cloudflare.com / rpki.json) to obtain a json file of hundreds of thousands of lines of basic data, and then clarifies the json file of the basic data, and matches each basic data (using prefix data and autonomous domain data) with the pre-built RPKI (resource public key infrastructure) basic data table one by one to determine whether there is corresponding basic data, and writes the non-existent basic data as updated basic data (i.e., changed data) into the basic data table and the Kafka message queue cluster, and then reads each updated basic data in the Kaafka message queue in real time through the distributed computing engine and inputs it into the public certificate data query website (https: / / rpki.cloudflare.com / api / graphql), and obtains the corresponding updated certificate data at the preset restart time, so as to write the ca certificate data in the updated certificate data into the ca certificate data table of the RPKI of the certificate management unit, and write the roa certificate data in the updated certificate data into the roa certificate data table of the RPKI of the certificate management unit. In addition, when the preset restart time is exceeded in the process of obtaining the updated certificate data of a certain updated basic data, the data corresponding to the updated basic data in the RPKI basic data table is deleted to be obtained when the certificate data is updated next time.

[0121] The certificate data updating method and related equipment of the resource public key infrastructure proposed in the embodiment of the present application, the resource public key infrastructure includes a certificate management unit, the method is applied to the certificate management unit, and the method includes: first, obtaining multiple basic data, the basic data includes prefix data and autonomous domain data; then, matching each basic data with multiple historical basic data one by one, filtering the basic data whose prefix data and autonomous domain data are consistent with the historical basic data, using the remaining basic data as the updated basic data, and storing the updated basic data as new historical basic data in the basic data table; finally, writing the updated basic data into a real-time message queue, using a distributed computing engine to obtain the updated basic data from the message queue, using the distributed computing engine to input the current updated basic data into a certificate data acquisition website for certificate data acquisition, and obtaining input time information at the input moment, obtaining waiting time information, when the difference between the waiting time information and the input time information reaches a preset restart time, stopping the certificate data acquisition of the current updated basic data, and inputting the next updated basic data into the certificate data acquisition website for certificate data acquisition, deleting the historical basic data corresponding to the current updated basic data in the basic data table, and updating the certificate data of the certificate management unit based on the updated certificate data.

[0122] After obtaining multiple basic data from the basic data acquisition website, the certificate management unit in the embodiment of the present application uses the characteristic that the prefix data or autonomous domain data in the basic data will definitely change after the basic data is updated, and combines the basic data table pre-constructed by using the data information of the past historical basic data for matching and screening, so as to accurately obtain the updated basic data that is truly newly added or changed, so as to more effectively improve the update efficiency of the certificate data update of the certificate management unit when only the certificate data corresponding to the updated basic data is obtained later; and compare the waiting response time obtained by using the difference between the input time information corresponding to the input of the current updated basic data into the certificate data acquisition website and the real-time waiting time information with the preset restart time, The acquisition of certificate data for the updated basic data whose waiting response time exceeds the preset restart time is suspended, and the next acquisition of certificate data for the updated basic data is carried out, effectively avoiding the situation where the certificate data acquisition website is stuck due to network abnormalities and cannot continue to acquire certificate data, so as to improve the update efficiency of certificate data update; and the corresponding updated basic data that is stuck in the basic data table is deleted, so that the certificate data corresponding to the basic data can be obtained again when the certificate data is updated next time, so as to improve the reliability of certificate data update; and only the certificate data corresponding to the updated basic data is obtained from the certificate data query website, so as to reduce the amount of certificate data acquired during each certificate data update process, thereby effectively improving the update efficiency when the certificate data is updated.

[0123] The present application also provides a certificate data updating device for a resource public key infrastructure, which can implement the certificate data updating method for the resource public key infrastructure. Fig.11 , the device 1100 comprises:

[0124] An acquisition module 1110 is used to acquire multiple pieces of basic data, where the basic data includes prefix data and autonomous domain data;

[0125] An update data selection module 1120, for selecting update basic data from a plurality of basic data based on prefix data and autonomous domain data;

[0126] The certificate data updating module 1130 is used to obtain updated certificate data based on the updated basic data, and to update the certificate data of the certificate management unit based on the updated certificate data.

[0127] In some embodiments, the update data selection module 1120 is further used to:

[0128] Match each basic data with multiple historical basic data one by one, and filter the basic data whose prefix data and autonomous domain data are consistent with the historical basic data;

[0129] The remaining basic data is used as the updated basic data, and the updated basic data is stored in the basic data table as the new historical basic data.

[0130] In some embodiments, the acquisition module 1110 is further configured to:

[0131] Obtain multiple pieces of historical basic data and the data sequence number of each piece of historical basic data, where the data sequence number is obtained based on the acquisition time of the historical basic data;

[0132] Each data sequence number is saved in correspondence with the data information in the corresponding historical basic data one by one to obtain a basic data table.

[0133] In some embodiments, the certificate data update module 1130 is further configured to:

[0134] Write the updated basic data into the real-time message queue;

[0135] Use the distributed computing engine to obtain and update basic data from the message queue;

[0136] The updated basic data is input into the certificate data acquisition website by utilizing the distributed computing engine, and the updated certificate data generated by the certificate data acquisition website according to the updated basic data is obtained.

[0137] In some embodiments, the certificate data update module 1130 is further configured to:

[0138] Using a distributed computing engine, the current update basic data is input into a certificate data acquisition website to acquire the certificate data, and the input time information of the input moment is acquired;

[0139] Obtain waiting time information. When the difference between the waiting time information and the input time information reaches the preset restart time, stop the current certificate data acquisition of the updated basic data, and input the next updated basic data into the certificate data acquisition website to obtain the certificate data;

[0140] Delete the historical basic data in the basic data table that corresponds to the current updated basic data.

[0141] In some embodiments, the certificate data update module 1130 is further configured to:

[0142] Obtaining a first response time average and a first response time maximum value of the certificate data acquisition website for all updated basic data in a first time period in the past, and obtaining a second response time average and a second response time maximum value of the certificate data acquisition website for all updated basic data in a second time period in the past, wherein the first time period is less than the second time period;

[0143] Performing data averaging processing on the first response time mean and the first response time maximum value to obtain a first time mean, and performing data averaging processing on the second response time mean and the second response time maximum value to obtain a second time mean;

[0144] The first weighted time is obtained by multiplying the first time mean by the first weight, the second weighted time is obtained by multiplying the second time mean by the second weight, the first weighted time and the second weighted time are accumulated to obtain the preset restart time, the first weight is greater than the second weight, and the sum of the first weight and the second weight is equal to one.

[0145] In some embodiments, the certificate data update module 1130 is further configured to:

[0146] Obtain the certificate data format, perform format verification on the updated certificate data based on the certificate data format, and obtain the update verification result;

[0147] When the update verification result indicates that the certificate format of the updated certificate data is correct, the updated certificate data is written into the certificate database of the certificate management unit to update the certificate data of the certificate management unit.

[0148] In the above embodiments, the description of each embodiment has its own emphasis. For the part that is not described in detail in a certain embodiment, the specific implementation method of the certificate data updating device of the resource public key infrastructure is basically the same as the specific implementation method of the certificate data updating method of the above resource public key infrastructure, and will not be repeated here.

[0149] In an embodiment of the present application, after obtaining multiple basic data from a basic data acquisition website, the certificate data update device of the resource public key infrastructure utilizes the characteristic that after the basic data is updated, the prefix data or autonomous domain data in the basic data will definitely change, and combines it with the basic data table pre-constructed using the data information of the past historical basic data for matching and screening, so as to accurately obtain the updated basic data that is truly newly added or changed, so as to more effectively improve the update efficiency of the certificate data update of the certificate management unit when only the certificate data corresponding to the updated basic data is obtained subsequently; and, utilize the waiting response time obtained by the difference between the input time information corresponding to the time when the current updated basic data is input into the certificate data acquisition website and the real-time waiting time information and the preset restart time The comparison is performed between the two time periods, and the acquisition of certificate data for the updated basic data whose waiting response time exceeds the preset restart time is suspended, and the acquisition of certificate data for the next updated basic data is performed, so as to effectively avoid the situation where the certificate data acquisition website is stuck due to network abnormalities and the certificate data acquisition cannot be continued, so as to improve the update efficiency of the certificate data update; and the corresponding updated basic data that is stuck in the basic data table is deleted, so that the certificate data corresponding to the basic data can be obtained again when the certificate data is updated next time, so as to improve the reliability of the certificate data update; and only the certificate data corresponding to the updated basic data is obtained from the certificate data query website, so as to reduce the amount of certificate data obtained during each certificate data update process, thereby effectively improving the update efficiency when the certificate data is updated.

[0150] The present application also provides an electronic device, including:

[0151] at least one memory;

[0152] at least one processor;

[0153] at least one program;

[0154] The program is stored in the memory, and the processor executes the at least one program to implement the certificate data update method of the resource public key infrastructure implemented in the present application. The electronic device can be any intelligent terminal including a mobile phone, a tablet computer, a personal digital assistant (PDA), a car computer, etc.

[0155] See also Fig.12 , Fig.12 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0156] The processor 1201 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0157] The memory 1202 can be implemented in the form of ROM (Read Only Memory), static storage device, dynamic storage device or RAM (Random Access Memory). The memory 1202 can store operating systems and other applications. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1202, and the processor 1201 calls and executes the certificate data update method of the resource public key infrastructure of the embodiment of this application;

[0158] Input / output interface 1203, used to implement information input and output;

[0159] The communication interface 1204 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.);

[0160] A bus 1205 that transmits information between various components of the device (e.g., the processor 1201, the memory 1202, the input / output interface 1203, and the communication interface 1204);

[0161] The processor 1201 , the memory 1202 , the input / output interface 1203 and the communication interface 1204 are connected to each other in communication within the device via the bus 1205 .

[0162] An embodiment of the present application further provides a storage medium, which is a computer-readable storage medium and stores a computer program. When the computer program is executed by a processor, the certificate data updating method of the resource public key infrastructure is implemented.

[0163] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0164] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0165] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0166] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0167] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0168] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0169] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0170] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. The mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0171] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0172] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0173] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0174] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A method for updating certificate data of a resource public key infrastructure, It is characterized in that The resource public key infrastructure includes a certificate management unit, the method is applied to the certificate management unit, and the method includes: Acquire multiple pieces of basic data, wherein the basic data includes prefix data and autonomous domain data; Selecting updated basic data from the plurality of basic data based on the prefix data and the autonomous domain data; Based on the update basic data, update certificate data is obtained, and based on the update certificate data, the certificate data of the certificate management unit is updated.

2. The certificate data updating method of the resource public key infrastructure according to claim 1, It is characterized in that The certificate management unit is provided with a basic data table, the basic data table stores a plurality of historical basic data, and the updating basic data is selected from the plurality of basic data based on the prefix data and the autonomous domain data, including: Matching each of the basic data with the multiple historical basic data one by one, filtering the basic data whose prefix data and the autonomous domain data are consistent with the historical basic data; The remaining basic data is used as the updated basic data, and the updated basic data is stored in the basic data table as new historical basic data.

3. The certificate data updating method of the resource public key infrastructure according to claim 2, It is characterized in that The steps of constructing the basic data table include: Acquire a plurality of pieces of the historical basic data and a data sequence number of each piece of the historical basic data, wherein the data sequence number is obtained based on the acquisition time of the historical basic data; Each of the data sequence numbers is saved in correspondence with the data information in the corresponding historical basic data one by one to obtain the basic data table.

4. The certificate data updating method of the resource public key infrastructure according to claim 2, It is characterized in that The certificate management unit is provided with a distributed computing engine, and the updating certificate data is obtained based on the updating basic data, including: Writing the updated basic data into a real-time message queue; Obtaining the update basic data from the message queue using the distributed computing engine; The updated basic data is input into a certificate data acquisition website by utilizing the distributed computing engine to obtain the updated certificate data generated by the certificate data acquisition website according to the updated basic data.

5. The certificate data updating method of the resource public key infrastructure according to claim 4, It is characterized in that The update basic data is a plurality of pieces, and the use of the distributed computing engine to input the update basic data into the certificate data acquisition website to obtain the update certificate data generated by the certificate data acquisition website according to the update basic data includes: Using the distributed computing engine, the current update basic data is input into the certificate data acquisition website to acquire the certificate data, and the input time information of the input moment is acquired; Acquire waiting time information, and when the difference between the waiting time information and the input time information reaches a preset restart time, stop acquiring the certificate data of the current update basic data, and input the next update basic data into the certificate data acquisition website to acquire the certificate data; The historical basic data corresponding to the current updated basic data in the basic data table is deleted.

6. The certificate data updating method of the resource public key infrastructure according to claim 5, It is characterized in that The steps of constructing the preset restart time include: Obtaining a first response time average and a first response time maximum of the certificate data acquisition website for all the updated basic data in a first time period in the past, and obtaining a second response time average and a second response time maximum of the certificate data acquisition website for all the updated basic data in a second time period in the past, wherein the first time period is less than the second time period; Performing data averaging processing on the first response time mean and the first response time maximum to obtain a first time mean, and performing data averaging processing on the second response time mean and the second response time maximum to obtain a second time mean; The first weighted time is obtained by multiplying the first time average by the first weight, the second weighted time is obtained by multiplying the second time average by the second weight, the first weighted time and the second weighted time are accumulated to obtain the preset restart time, the first weight is greater than the second weight, and the sum of the first weight and the second weight is equal to one.

7. The certificate data updating method of the resource public key infrastructure according to claim 1, It is characterized in that The updating of the certificate data of the certificate management unit based on the updated certificate data comprises: Acquire the certificate data format, perform format verification on the update certificate data based on the certificate data format, and obtain an update verification result; When the update verification result indicates that the certificate format of the updated certificate data is correct, the updated certificate data is written into the certificate database of the certificate management unit to update the certificate data of the certificate management unit.

8. A certificate data updating device for a resource public key infrastructure, It is characterized in that The resource public key infrastructure includes a certificate management unit, the device is provided with the certificate management unit, and the device includes: An acquisition module, used for acquiring a plurality of basic data, wherein the basic data includes prefix data and autonomous domain data; An update data selection module, configured to select update basic data from the plurality of basic data based on the prefix data and the autonomous domain data; The certificate data updating module is used to obtain updated certificate data based on the updated basic data, and to update the certificate data of the certificate management unit based on the updated certificate data.

9. An electronic device, It is characterized in that The method comprises a memory and a processor, wherein the memory stores a computer program, and the processor implements the certificate data updating method of the resource public key infrastructure as claimed in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium having a computer program stored thereon, It is characterized in that When the computer program is executed by a processor, the certificate data updating method of the resource public key infrastructure according to any one of claims 1 to 7 is implemented.

Images