Certificate verification method and device based on certificate trust transparency technology

Abstract

The invention provides a certificate authentication method and device based on a certificate trust transparentizing technology, and relates to the technical field of information processing.The method is used for a website server and comprises the steps that a CA trust policy key pair and a certificate key pair to be applied for are generated; generating a certificate signing and issuing request according to the CA trust policy public key and the certificate public key, sending the certificate signing and issuing request to the CA, and receiving and storing a certificate signed and issued by the CA; a CA trust policy record is generated according to the signed certificate, and after the CA trust policy record is signed through a CA trust policy private key, the signed CA trust policy record and a CA trust policy public key are safely sent to a trust policy transparent management server for storage; and when an access request of the client is received, the certificate is sent to the client for verification, and if the verification result is untrusted, the client inquires the CA trust policy record from the trust policy transparent management server, and supplemental verification is carried out on the certificate.

Description

Technical Field

[0001] The present invention relates to the field of information processing technology, and in particular to a certificate verification method and device based on certificate trust transparency technology. Background Art

[0002] Public Key Infrastructure (Web PKI) is the cornerstone of secure Internet communications. The Transport Layer Security Protocol (SSL / TLS) is inseparable from the support of the public key infrastructure. It uses key technologies such as public key digital certificates, certificate authorities (CAs), certificate verification and public key encryption to provide a secure encrypted communication channel for the Internet, helping communication terminals to establish trust and protect the confidentiality, integrity, authenticity and verifiability of Internet communications. CA is responsible for issuing digital certificates used to verify the identity of websites and service entities. It is the trust anchor of the Web PKI system and usually includes root CA and intermediate CA. A digital certificate is a data structure containing a public key, subject information and a signature, which is used to establish a chain of trust.

[0003] In the existing certificate verification system, generally includes CA, Web server and terminal browser, see Figure 1 . Normally, one-way authentication generally includes: the Web server generates a certificate signing application CSR and sends it to the CA. The CA verifies and generates a website certificate and issues it to the Web server. The Web server configures the certificate on the SSL gateway and enables HTTP. The terminal browser accesses the HTTP website, reads the website certificate during the TLS handshake process, and queries the trusted root certificate list to verify the validity of the website certificate.

[0004] However, the prior art has the following problems: the certificate verification process lacks flexibility and interoperability. The web server, as the domain name owner, has no right to determine its own CA trust policy, and the client's verification of the website certificate depends on the trusted root certificate list. Once an individual CA is deleted from the trusted root certificate list by mistake or misoperation, or the website certificate signed by the CA requested by the web server is not in the trusted root certificate list, it will cause irreversible consequences, such as making all network service encrypted communication services that rely on the digital certificate issued by the CA no longer available.

[0005] How to overcome the lack of flexibility and interoperability in the certificate verification process in the prior art is a technical problem that needs to be solved in the prior art. Summary of the invention

[0006] The present invention provides a certificate verification method and device based on certificate trust transparency technology, which are used to solve the defects of lack of flexibility and interoperability in the certificate verification process in the prior art.

[0007] The present invention provides a certificate verification method based on certificate trust transparency technology, which is used for a website server, wherein the website server is connected to a trust policy transparent management server, and the website server requests a signed certificate from a certificate issuing authority CA; The method comprises: Generate a CA trust policy key pair and a key pair for the certificate to be applied for; wherein the CA trust policy key pair includes a CA trust policy public key and a CA trust policy private key, and the key pair for the certificate to be applied for includes a certificate public key and a certificate private key of the certificate to be applied for; Generate a certificate issuance request according to the CA trust policy public key and the certificate public key, send the certificate issuance request to the CA, receive and save the certificate issued by the CA; wherein the certificate includes the CA trust policy public key; Generate a CA trust policy record according to the issued certificate, sign the CA trust policy record with the CA trust policy private key, and securely send the signed CA trust policy record and the CA trust policy public key to the trust policy transparent management server for storage; When receiving an access request from the client, the certificate is sent to the client so that the client verifies the certificate based on the trusted root certificate list maintained by itself. If the verification result is trustworthy, a secure channel is established to achieve secure communication between the client and the server. If the verification result is untrustworthy, the client queries the trust policy transparent management server for the CA trust policy record, and performs additional verification on the certificate based on the obtained CA trust policy record.

[0008] According to a certificate verification method based on certificate trust transparency technology provided by the present invention, the website server is loaded with a trust anchor manager, and the website server stores a CA root certificate corresponding to the CA; Sending the certificate issuance request to the CA and receiving the certificate issued by the CA includes: Determine a custom CA trust policy and determine at least one CA to which the certificate issuance request is to be sent; Sending the certificate issuance request to the at least one CA through the trust anchor manager; wherein the certificate public keys in the certificate issuance request corresponding to each CA are different from each other; receiving, by the trust anchor manager, at least one certificate issued by a CA; Generate a CA trust policy record based on the issued certificate, including: Determine the CA root certificate corresponding to the issued certificate, and generate the CA trust policy record according to the issued certificate and its corresponding CA root certificate, wherein the CA trust policy record includes a list of trusted CA root certificates.

[0009] According to a certificate verification method based on certificate trust transparency technology provided by the present invention, after sending the certificate issuance request to the CA and receiving the certificate issued by the CA, the method further includes: If the trusted CA root certificate needs to be updated, determine the target CA based on the CA root certificate in the saved CA trust policy record and the CA root certificate that needs to be updated. Send a certificate issuance request to the target CA, receive and save the certificate issued by the target CA; According to the certificate issued by the target CA, the trusted certificate is updated, and according to the CA root certificate corresponding to the updated certificate, an updated CA trust policy record is generated. After the updated CA trust policy record is signed by the CA trust policy private key, the updated CA trust policy record and the CA trust policy public key carrying the signature are sent to the trust policy transparent management server for storage.

[0010] According to a certificate verification method based on certificate trust transparency technology provided by the present invention, the website server also includes: an authoritative domain name server, which is used to store the node address of the trust policy transparent management server; After securely sending the signed CA trust policy record and CA trust policy public key to the trust policy transparent management server for storage, the method further includes: Receiving a trust policy deployment signature timestamp returned by the trust policy transparent management server, wherein the trust policy deployment signature timestamp is generated by the trust policy transparent management server adding a timestamp to the signed CA trust policy record, and the trust policy deployment signature timestamp carries a node address; The node address corresponding to the trust policy deployment signature timestamp is stored in an authoritative domain name server.

[0011] According to a certificate verification method based on certificate trust transparency technology provided by the present invention, before the client queries the trust policy transparency management server for CA trust policy records, the method further includes: Receive address query request from client; According to the address query request, the authoritative domain name server is queried for a node address corresponding to the address query request, so that the client accesses the trust policy transparent management server according to the node address.

[0012] According to a certificate verification method based on certificate trust transparency technology provided by the present invention, the client is loaded with a terminal trust enhancement verifier; Sending the certificate to the client so that the client verifies the certificate based on a trusted root certificate list maintained by the client, including: Sending the certificate to a terminal trust enhancement verifier of a client, so that the terminal trust enhancement verifier of the client verifies the certificate based on a trusted root certificate list maintained by the terminal trust enhancement verifier; If the verification result is untrustworthy, the client queries the trust policy transparent management server for the CA trust policy record and performs additional verification on the certificate based on the obtained CA trust policy record, including: If the verification result is untrustworthy, the terminal trust enhancement verifier of the client is made to query the trust policy transparent management server for the CA trust policy record, and perform supplementary verification on the certificate according to the obtained CA trust policy record.

[0013] According to a certificate verification method based on certificate trust transparency technology provided by the present invention, the signed CA trust policy record and CA trust policy public key are securely sent to a trust policy transparency management server for storage, including: The signed CA trust policy record and the CA trust policy public key are securely sent to the trust policy transparent management server, so that the trust policy transparent management server verifies the signed CA trust policy record, and after passing the credibility and integrity check, uses the Merkle tree and the sparse Merkle tree to store the signed CA trust policy record; The Merkle tree is used to store CA trust policy records, and the Merkle tree root is signed by the trust policy transparent management server to ensure data integrity; the sparse Merkle tree is used to provide proof of the non-existence of the CA trust policy record to quickly determine the storage location of the CA trust policy record.

[0014] The present invention also provides a certificate verification device based on certificate trust transparency technology, which is arranged on a website server, the website server is connected to a trust policy transparent management server, and the website server requests a signed certificate from a certificate issuing authority CA; The device comprises: A key pair generation module, used to generate a CA trust policy key pair and a key pair for a certificate to be applied for; wherein the CA trust policy key pair includes a CA trust policy public key and a CA trust policy private key, and the key pair for a certificate to be applied for includes a certificate public key and a certificate private key of the certificate to be applied for; The certificate receiving module is used to generate a certificate issuance request according to the CA trust policy public key and the certificate public key, and send the certificate issuance request to the CA, receive the certificate issued by the CA and save it; wherein the certificate includes the CA trust policy public key; A trust policy uploading module is used to generate a CA trust policy record according to the issued certificate, sign the CA trust policy record with the CA trust policy private key, and then securely send the signed CA trust policy record and the CA trust policy public key to the trust policy transparent management server for storage; The request processing module is used to send the certificate to the client upon receiving an access request from the client, so that the client can verify the certificate based on the trusted root certificate list maintained by itself. If the verification result is reliable, the establishment of a secure channel is initiated to achieve secure communication between the client and the server; if the verification result is unreliable, the client queries the trust policy transparent management server for the CA trust policy record, and performs additional verification on the certificate based on the obtained CA trust policy record.

[0015] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the certificate verification method based on the certificate trust transparency technology as described above are implemented.

[0016] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the above-mentioned certificate verification methods based on the certificate trust transparency technology.

[0017] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the steps of the certificate verification method based on any of the certificate trust transparency technologies described above are implemented.

[0018] The certificate verification method and device based on certificate trust transparency technology provided by the present invention store, query and supervise CA trust policy records through a newly added trust policy transparency management server, ensure the integrity of CA trust policy records and provide existence proof, the website server can declare CA trust policy according to its own security needs, and realize flexible deployment of CA trust policy; and when the website server receives an access request from a client, it first sends the certificate to the client for verification based on the trusted root certificate list maintained by itself, if the verification result is credible, then establish secure communication between the client and the server; if the verification result is untrustworthy, the client can query the CA trust policy record from the trust policy transparency management server, and perform supplementary verification on the certificate according to the obtained CA trust policy record, so that even if the signature certificate requested by the website server does not exist in the trusted root certificate list, it will not affect the certificate verification process, thereby improving the flexibility and interoperability of certificate verification. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 It is a schematic diagram of a certificate verification system in the prior art.

[0021] Figure 2 It is a schematic diagram of a certificate trust transparency system provided by an embodiment of the present invention.

[0022] Figure 3 This is one of the flow charts of the certificate verification method based on the certificate trust transparency technology provided by the embodiment of the present invention.

[0023] Figure 4 This is the second flow chart of the certificate verification method based on the certificate trust transparency technology provided by the embodiment of the present invention.

[0024] Figure 5 This is the third flow chart of the certificate verification method based on the certificate trust transparency technology provided by the embodiment of the present invention.

[0025] Figure 6 This is the fourth flow chart of the certificate verification method based on the certificate trust transparency technology provided by the embodiment of the present invention.

[0026] Figure 7 It is a structural schematic diagram of a certificate verification device based on certificate trust transparency technology provided by the present invention.

[0027] Figure 8 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] First, the terms involved in this embodiment are explained schematically.

[0030] (1) Certificate Signing Request (CSR): It is a signature request file required to apply for a digital certificate from a certificate authority. It contains data such as the public key, organization information, domain name, etc. for the CA to verify and issue the certificate.

[0031] (2) CA Trust Policy (CTP): used to declare a PKI trust anchor for a specific domain name (i.e., a list of root certificates trusted by the domain name owner), including the domain name, request type, policy submission or update timestamp, certificate data, trust policy, and signature. The trust policy includes the effective time and a hash list of trusted root certificates. The data structure of CTP is as follows: Struct {

[0032] List <domain>domain_list; Uint64 start_time; Uint64 match_method; String match_type; List <trustedca>trust_ca_list; SignatureAlgorithm algorithm; SignatureValue signature; } CTP

[0033] Among them, domain_list is the domain name list for which the domain name owner needs to deploy CA trust policy, which can be a wildcard domain name or a non-wildcard domain name. When submitting the policy, the wildcard domain name needs to be checked for conflict with the deployed non-wildcard domain name; start_time identifies the effective time of the current trust policy record; match_method indicates the method used by the client to verify the record after receiving the trust policy. When the value is 0, it means that the trusted CA root certificate file hash list is stored in trust_ca_list, and when the value is 1, it means that the trusted CA unique identification name list is stored; match_type is the storage format of the data in trust_ca_list. For example, when the value is original, it means that the trust_ca_list stores the original binary data list of the certificate, when the value is sha256, it means that the trusted certificate SHA 256 hash value is stored, and when the value is sha512, it means that the trusted certificate SHA 512 hash value is stored; trust_ca_list identifies the trusted certificate list or trusted CA list; algorithm indicates the signature algorithm for ensuring the integrity of CTP, and signature is the signature value.

[0034] (3) CA Trust Policy Public Key (TPK): The domain name owner or certificate holder can use this public key to sign the CTP data to prevent any subject from tampering with the CTP data and to ensure the credibility of the CTP data. TPK data can be written into the certificate file through the custom X.509 certificate extension field trust_policy_public_key to complete the public key publishing process.

[0035] (4) CA Trust Secret / Private Key (TSK): private key data corresponding to TPK.

[0036] (5) Trust policy deployment signature timestamp (SPT): It is generated by the trust policy transparent management server through public key signature after the CTP data is successfully stored, and returned to the trust policy submitter.

[0037] In order to achieve the flexibility and interoperability of certificate verification claimed in this embodiment, and to overcome the technical defect in the prior art that the deletion or addition of CA certificates will lead to the failure of certificate verification, the embodiment of the present invention designs a certificate trust transparency system (CTT) for domain name owners to customize the verification strategy. Before introducing the certificate verification method of this embodiment, the certificate trust transparency system of the embodiment of the present invention is first introduced.

[0038] See also Figure 2 The certificate trust transparency system in this embodiment includes the following parts: Website server: As the domain name owner, it requests a signed certificate from the certificate issuing authority, saves the signed certificate to the trust policy transparent management server, and sends the certificate to the client for verification when the client requests verification.

[0039] Client: includes TLS clients such as browsers. When a client accesses a website server, it needs to request the website server's certificate for verification, and after verification, establish a secure channel with the server to achieve communication.

[0040] Certificate Authority (CA): used to issue certificates based on the server's certificate issuance request.

[0041] Trust Anchor Manager (T-Manager): loaded in the website server and used to implement the above functions of the website server.

[0042] Authoritative domain name server: used to store the node address of the trust policy transparent management server. It is an abstract logical entity. The actual physical machine can be a distributed hierarchical structure and managed by the website server. The website server can directly configure and modify the data stored in the authoritative domain name server.

[0043] Terminal Trust Enhanced Validator (T-Validator): Loaded in the client and used to implement the above functions of the client.

[0044] Trust policy transparent management server (T-Publisher): This is a new server added to this embodiment compared to the prior art, which saves the CA trust policy record and sends the CA trust policy record to the client when the client requests to query the CA trust policy record. The trust policy transparent management server can ensure the integrity, credibility and auditability of the CA trust policy record.

[0045] Security Assumptions: (1) All domain name owners and clients are trustworthy; (2) CAs may issue unauthorized certificates or maliciously revoke valid certificates, and the root certificate list may intentionally delete trusted root certificates; (3) The trust policy transparent management server T-Publisher may promise to publish but not actually publish the CA trust policy data submitted by the domain name owner.

[0046] Combine the following Figure 3-Figure 8 A certificate verification method and device based on certificate trust transparency technology according to an embodiment of the present invention are described.

[0047] The embodiment of the present invention discloses a certificate verification method based on certificate trust transparency technology, which is used for a website server. The website server is connected to a trust policy transparent management server, and the website server requests a signed certificate from a certificate issuing authority CA. See also Figure 3 , the method comprising: 301. Generate a CA trust policy key pair and a key pair for a certificate to be applied for; wherein the CA trust policy key pair includes a CA trust policy public key and a CA trust policy private key, and the key pair for a certificate to be applied for includes a certificate public key and a certificate private key of the certificate to be applied for.

[0048] In this embodiment, the website server, as the domain name owner, can generate two key pairs at the same time.

[0049] CA trust policy key pair<TSK,TPK> , where TSK is the CA trust policy private key and TPK is the CA trust policy public key. The CA trust policy key pair is used to sign the trust policy record, where the CA trust policy public key is written into the extension of the certificate.

[0050] Certificate key pair to be applied for<SK,PK> , where SK is the private key of the certificate and PK is the public key of the certificate. The key pair of the certificate to be applied for is used to apply for a certificate from the CA. Different CAs have different key pairs for the certificate to be applied for.

[0051] 302. Generate a certificate issuance request according to the CA trust policy public key and the certificate public key, send the certificate issuance request to the CA, receive the certificate issued by the CA and save it.

[0052] It should be noted that when the website server requests a certificate from the CA, the certificate issuance request sent will only include the public key, and the private key is not sent to the CA.

[0053] In this embodiment, the certificate signing request (CSR) includes the certificate common name, organization name, address and other subject information, and the CA trust policy public key (TPK) needs to be added.

[0054] Specifically, step 302 includes: determining a customized CA trust policy, determining at least one CA to which the certificate issuance request is to be sent; sending the certificate issuance request to at least one CA through a trust anchor manager; and receiving a certificate issued by at least one CA through the trust anchor manager.

[0055] The certificate public keys in the certificate issuance requests corresponding to each CA are different.

[0056] For example, CA includes CA1, CA2 and CA3. The website server determines that the CA root certificates to be trusted are CA1 root certificate and CA2 root certificate, and sends certificate issuance requests to CA1 and CA2 respectively. Correspondingly, the website server generates a certificate issuance request CSR1 based on PK1 and TPK and sends it to CA1. CA1 signs the website certificate based on CSR1 and returns the signed certificate Cert1; generates a certificate issuance request CSR2 based on PK2 and TPK and sends it to CA2. CA2 signs the website certificate based on CSR2 and returns the signed certificate Cert2. The generated certificate can be stored in the storage space of the website server, and when an access request from the client is received, the certificate will be sent to the client.

[0057] It should be explained that the root certificate is the basis for the CA to establish trust with the website server. The website certificate issued by the CA must have a trusted root certificate to be valid. In other words, the root certificate represents the trust of the CA. The root certificate is a special certificate, and its issuer is not the CA, but itself.

[0058] 303. Generate a CA trust policy record according to the issued certificate, sign the CA trust policy record with the CA trust policy private key, and securely send the signed CA trust policy record and the CA trust policy public key to the trust policy transparent management server for storage.

[0059] Among them, generating a CA trust policy record based on the issued certificate includes: determining the CA root certificate corresponding to the issued certificate, generating a CA trust policy record based on the issued certificate and its corresponding CA root certificate, wherein the CA trust policy record includes a list of trusted CA root certificates.

[0060] For example, if the website server receives certificates issued by the CA including Cert1 and Cert2, the corresponding root certificates RootCert1 and RootCert2 are determined according to Cert1 and Cert2 respectively, and then a CA root certificate list is generated according to the root certificates RootCert1 and RootCert2.

[0061] In addition, after the CA trust policy record is signed by the CA trust policy private key, the signed CA trust policy record and the CA trust policy public key are securely sent to the trust policy transparent management server, so that the trust policy transparent management server can verify the signed CA trust policy record. After passing the credibility and integrity check, the signed CA trust policy record is stored by using the Merkle tree and sparse Merkle tree. Among them, the Merkle tree is used to store the CA trust policy record, and the Merkle tree root is signed by the trust policy transparent management server to ensure data integrity; the sparse Merkle tree is used to provide proof of the non-existence of the CA trust policy record to quickly determine the storage location of the CA trust policy record. The trust policy transparent management server can ensure the integrity, credibility and auditability of the CA trust policy record.

[0062] Furthermore, after receiving the signed CA trust policy record CTP or the updated CA trust policy record CTP', the trust policy transparent management server T-Publisher needs to verify the CTP or CTP'.

[0063] Generally, it includes the following four items: certificate validity verification; verification of the match between the certificate domain name and the trust policy domain name; verification of the validity of the trust policy; and verification of ownership of the domain name by the trust policy submitter.

[0064] After the verification is passed, the trust policy transparent management server T-Publisher stores the received CA trust policy record CTP or the updated CA trust policy record CTP'.

[0065] 304. When receiving an access request from the client, the certificate is sent to the client so that the client verifies the certificate based on a list of trusted root certificates maintained by itself. If the verification result is trustworthy, a secure channel is established to achieve secure communication between the client and the server. If the verification result is untrustworthy, the client queries the trust policy transparent management server for the CA trust policy record, and performs additional verification on the certificate based on the obtained CA trust policy record.

[0066] Specifically, the client itself maintains a trusted root certificate list, which contains hundreds of CA's corresponding root certificates, for verifying the requested certificate. The trusted root certificate list can be maintained by a third-party manufacturer and saved in the client's browser. However, if the CA is lost or deleted by mistake, or the certificate sent by the server to the client includes the certificate of the newly added CA, the verification result is unreliable. If the solution of the prior art is followed, this situation may lead to the mid-end of the communication service.

[0067] However, in the method of this embodiment, if the verification result is untrustworthy, the client can query the trust policy transparent management server for the CA trust policy record, and perform additional verification on the certificate based on the obtained CA trust policy record. Through this setting, the website server can define the CA trust policy according to its own security needs. Even if there is a new certificate, the client can complete the verification without affecting the certificate verification process, thereby improving the flexibility and interoperability of certificate verification.

[0068] Specifically, the process of the client verifying the certificate based on the trusted root certificate list maintained by itself and the process of querying the CA trust policy record from the trust policy transparent management server and performing additional verification of the certificate based on the obtained CA trust policy record can all be completed through the terminal trust enhancement verifier T-Validator loaded by the client.

[0069] The certificate verification method based on certificate trust transparency technology provided by the embodiment of the present invention stores, queries and supervises CA trust policy records through a newly added trust policy transparency management server, ensures the integrity of CA trust policy records and provides existence proof, and the website server can declare the CA trust policy according to its own security requirements to achieve flexible deployment of the CA trust policy; and when the website server receives an access request from a client, it first sends the certificate to the client for verification based on the trusted root certificate list maintained by itself, and if the verification result is credible, secure communication between the client and the server is established; if the verification result is untrustworthy, the client can query the CA trust policy record from the trust policy transparency management server, and perform additional verification on the certificate based on the obtained CA trust policy record, so that even if the signed certificate requested by the website server does not exist in the trusted root certificate list, it will not affect the certificate verification process, thereby improving the flexibility and interoperability of certificate verification.

[0070] Furthermore, the website server may also update the CA trust policy. In this case, see Figure 4 , the method comprising: 401. If the trusted CA root certificate needs to be updated, the target CA is determined according to the CA root certificate in the saved CA trust policy record and the CA root certificate that needs to be updated.

[0071] For example, the CA root certificates in the CA trust policy saved by the website server include CA1 root certificate and CA2 root certificate. Now the website server needs to change to trust CA1 and CA3 root certificates. Since CA1 root certificate already exists, the website server needs to obtain CA3 root certificate to replace CA2 root certificate, so the target CA is determined to be CA3.

[0072] 402. Send a certificate issuance request to the target CA, receive and save the certificate issued by the target CA.

[0073] 403. Update the trusted CA certificate according to the certificate issued by the target CA, generate an updated CA trust policy record according to the CA root certificate corresponding to the updated CA certificate, sign the updated CA trust policy record with the CA trust policy private key, and securely send the updated CA trust policy record and the CA trust policy public key carrying the signature to the trust policy transparent management server for storage.

[0074] After obtaining and saving the certificate Cert3 issued by CA3, the website server determines the corresponding root certificate RootCert3 based on the certificate Cert3, and then generates an updated CA trust policy record CTP' based on the root certificates RootCert1 and RootCert3, signs CTP' with the CA trust policy private key TSK, and sends it to the trust policy transparent management server T-publisher for storage. This process uses cryptographic technology to ensure the integrity and authenticity of the information.

[0075] Through steps 401 to 403, the website server can declare the CA trust policy according to its own security needs, that is, the domain name independently selects the CA root certificate list; the domain name owner can independently select the CA trust policy management system to manage and maintain its trust policy, and only the domain name owner can deploy and update the trust policy record corresponding to its domain name.

[0076] Furthermore, after securely sending the signed CA trust policy record and CA trust policy public key to the trust policy transparent management server for storage, the trust policy transparent management server will also add a timestamp to the signed CA trust policy record, and after successfully storing the CA trust policy record, return the trust policy deployment signature timestamp SPT to the website server.

[0077] See also Figure 5 , the method further comprises: 501. Receive a trust policy deployment signature timestamp SPT returned by a trust policy transparent management server, wherein the trust policy deployment signature timestamp is generated by the trust policy transparent management server adding a timestamp to a signed CA trust policy record; the trust policy deployment signature timestamp carries a node address.

[0078] 502. Store the node address corresponding to the trust policy deployment signature timestamp in an authoritative domain name server.

[0079] Through steps 501 to 502, the website server can store the T-Publisher node address corresponding to the signed CA trust policy record in the authoritative domain name server. In subsequent steps, when the client requests to access the trust policy transparent management server T-Publisher, it can first obtain the corresponding T-Publisher node address from the authoritative domain name server.

[0080] Correspondingly, when the client verifies the certificate based on the trusted root certificate list maintained by itself and the result is untrustworthy, before the client queries the trust policy transparent management server for the CA trust policy record, see Figure 6 , the method further comprises: 601. Receive an address query request from a client.

[0081] 602. According to the address query request, query the authoritative domain name server for a node address corresponding to the address query request, so that the client accesses the trust policy transparent management server according to the node address.

[0082] Because the client itself does not know the node address of the trust policy transparent management server T-Publisher, through steps 601~602, the client can determine the node address to be accessed, and access T-Publisher according to the node address, request to obtain the CA trust policy record, and perform additional verification on the certificate based on the obtained CA trust policy record.

[0083] In order to facilitate understanding of the overall solution of this embodiment, this embodiment also discloses a method, and describes in detail the execution steps of the certificate trust transparency system of this embodiment.

[0084] by Figure 2 For example, the certificate verification method of this embodiment includes: S1. Generate a trust policy key pair. The domain name owner generates a CA trust policy key pair.<TSK,TPK> , used to sign the trust policy record data; and the certificate key pair to be applied for, used to apply for a website certificate from the CA.

[0085] In this embodiment, the domain name owner is the website server.

[0086] S2. Certificate application and issuance: The domain name owner sends a certificate issuance request to at least one CA through T-Manager to apply for a certificate.

[0087] Among them, the certificate signing request (CSR) contains the certificate common name, organization name, address and other subject information, and the CA trust policy public key (TPK) needs to be added.

[0088] S3, CA trust policy submission. The domain name owner generates a CA trust policy record CTP based on the current trust policy for the CA root certificate and other anchor points, signs the CTP with the CA trust policy private key TSK, and securely submits the signed CTP and CA trust policy public key TPK to T-Publisher. This process uses cryptographic technology to ensure the integrity, authenticity, and non-repudiation of information.

[0089] S4. CA trust policy update. When the domain name owner updates the trust anchor point (for example, initially trusting CA1's root certificate, and then changing to CA2's root certificate), it is necessary to generate a CA trust policy record CTP' based on the latest trust policy and sign CTP' with TSK. Then CTP' and CA trust policy public key TPK are securely submitted to the trust policy transparent management server T-Publisher. This process uses cryptographic technology to ensure the integrity and authenticity of the information.

[0090] S5. CA trust policy credibility and integrity verification. After receiving the CTP submission or update request, the trust policy transparent management server T-Publisher needs to complete the following verifications, including: Verification of the effectiveness of trust strategies; Trust policy submitter's ownership verification of domain name.

[0091] S6. CA trust policy deployment and disclosure. The trust policy data management system T-Publisher stores the CA trust policy records CTP submitted by the domain name owner to ensure that CTP is append-only, verifiable, and publicly auditable. T-Publisher allows user terminals and domain name owners to query and supervise CTP data. After the domain name owner submits CTP / CTP', T-Publisher needs to add a timestamp to the record. After the CTP data is successfully stored, T-Publisher needs to return the trust policy deployment signature timestamp SPT to the domain name owner or T-Manager. The node address corresponding to the trust policy deployment signature timestamp SPT is stored in the authoritative domain name server.

[0092] T-Publisher can store CTP data through Merkle tree and sparse Merkle tree. Merkle tree is used to store CTP data, and T-Publisher signs the Merkle tree root to ensure data integrity; sparse Merkle tree can provide proof of non-existence of CTP, which can be used to quickly determine the storage location of CTP and provide efficient query capabilities. It is recommended that T-Publisher use different signature keys for signature timestamp and Merkle tree root.

[0093] S7. The terminal obtains the certificate and verifies it. After sending an access request to the server and obtaining the certificate returned by the server, the terminal trust enhancement validator T-Validator first performs a standardized TLS certificate verification process such as certificate validity and credibility verification based on the trusted root certificate list maintained by the browser or operating system.

[0094] If the certificate verification result is "root certificate trusted", the secure channel establishment is initiated to communicate securely with the server.

[0095] If the certificate verification result is "root certificate is untrusted", the terminal trust enhancement validator T-Validator queries T-Publisher for the CA trust policy record CTP corresponding to the currently visited domain name, and then completes the enhanced certificate credibility verification according to the CA trust policy deployed in the CTP record.

[0096] The method of this embodiment can also achieve the following technical effects: (1) Flexible trust: Domain name owners can declare CA trust policies based on their own security needs, that is, the domain name can independently select a trusted CA root certificate list. Domain name owners can independently select a CA trust policy management system to manage and maintain their trust policies, and only domain name owners can deploy and update the trust policy data corresponding to their domain names.

[0097] (2) Security enhancement: The solution of the present invention preferentially completes certificate credibility verification based on the client's own list of trusted root certificates. If and only if the certificate is not trusted, it will attempt to complete supplementary certificate verification by querying the CA trust policy record from the trust policy transparent management server, ensuring compatibility with existing protocols.

[0098] (3) The trust policy can be publicly verified, which is convenient for audit and supervision. In this embodiment, the trust policy management system honestly records the CA trust policy declared by the domain name owner, ensures the integrity of the CA trust policy, and prevents the policy from being tampered with.

[0099] (4) The trust policy is easy to manage and maintain: In the solution of this embodiment, the certificate, CA trust policy and trust policy public key are decoupled. When adding a trusted root certificate or updating the CA trust policy, it is only necessary to complete the signature of the newly trusted certificate issuance request to generate a new certificate, without revoking the already issued certificate.

[0100] The following describes a certificate verification device based on certificate trust transparency technology provided by an embodiment of the present invention. The certificate verification device based on certificate trust transparency technology described below and the certificate verification method based on certificate trust transparency technology described above can refer to each other.

[0101] The embodiment of the present invention provides a certificate verification device based on certificate trust transparency technology, which is arranged on a website server, the website server is connected to a trust policy transparent management server, and the website server requests a signed certificate from a certificate issuing authority CA; See also Figure 7 , the device comprises: The key pair generation module 701 is used to generate a CA trust policy key pair and a key pair for a certificate to be applied for; wherein the CA trust policy key pair includes a CA trust policy public key and a CA trust policy private key, and the key pair for a certificate to be applied for includes a certificate public key and a certificate private key of the certificate to be applied for; The certificate receiving module 702 is used to generate a certificate issuance request according to the CA trust policy public key and the certificate public key, and send the certificate issuance request to the CA, receive the certificate issued by the CA and save it; wherein the certificate includes the CA trust policy public key; The trust policy uploading module 703 is used to generate a CA trust policy record according to the issued certificate, sign the CA trust policy record with the CA trust policy private key, and then securely send the signed CA trust policy record and the CA trust policy public key to the trust policy transparent management server for storage; The request processing module 704 is used to send the certificate to the client upon receiving an access request from the client, so that the client can verify the certificate based on the trusted root certificate list maintained by itself. If the verification result is trustworthy, a secure channel is established to achieve secure communication between the client and the server. If the verification result is untrustworthy, the client queries the trust policy transparent management server for the CA trust policy record, and performs additional verification on the certificate based on the obtained CA trust policy record.

[0102] Optionally, the website server is loaded with a trust anchor manager, and the website server stores a CA root certificate corresponding to the CA; The certificate receiving module 702 is specifically used for: Determine a custom CA trust policy and determine at least one CA to which the certificate issuance request is to be sent; Sending the certificate issuance request to the at least one CA through the trust anchor manager; wherein the certificate public keys in the certificate issuance request corresponding to each CA are different from each other; receiving, by the trust anchor manager, at least one certificate issued by a CA; The trust policy upload module 703 is specifically used for: Determine the CA root certificate corresponding to the issued certificate, and generate the CA trust policy record according to the issued certificate and its corresponding CA root certificate, wherein the CA trust policy record includes a list of trusted CA root certificates.

[0103] Optionally, the device further comprises: An update module is used to determine a target CA according to the CA root certificate in the saved CA trust policy record and the CA root certificate to be updated after sending the certificate issuance request to the CA and receiving the certificate issued by the CA, if the trusted CA root certificate needs to be updated; The certificate receiving module 702 is used to send a certificate issuance request to the target CA, receive and save the certificate issued by the target CA; The trust policy upload module 703 is used to update the trusted CA certificate according to the certificate issued by the target CA, generate an updated CA trust policy record according to the CA root certificate corresponding to the updated CA certificate, sign the updated CA trust policy record with the CA trust policy private key, and send the updated CA trust policy record and CA trust policy public key carrying the signature to the trust policy transparent management server for storage.

[0104] Optionally, the website server further comprises: an authoritative domain name server for storing a node address of a trust policy transparent management server; The device also includes a timestamp storage module, which is used to: After sending the signed CA trust policy record and CA trust policy public key to the trust policy transparent management server for storage, receiving the trust policy deployment signature timestamp returned by the trust policy transparent management server, wherein the trust policy deployment signature timestamp is generated by the trust policy transparent management server adding a timestamp to the signed CA trust policy record, and the trust policy deployment signature timestamp carries a node address; The node address corresponding to the trust policy deployment signature timestamp is stored in an authoritative domain name server.

[0105] Optionally, the device further comprises: an address query module, configured to receive an address query request from the client before enabling the client to query the trust policy transparent management server for the CA trust policy record; According to the address query request, the authoritative domain name server is queried for a node address corresponding to the address query request, so that the client accesses the trust policy transparent management server according to the node address.

[0106] Optionally, the client is loaded with a terminal trust enhancement verifier; The request processing module 704 is specifically used for: Sending the certificate to a terminal trust enhancement verifier of a client, so that the terminal trust enhancement verifier of the client verifies the certificate based on a trusted root certificate list maintained by the terminal trust enhancement verifier; If the verification result is untrustworthy, the terminal trust enhancement verifier of the client queries the trust policy transparent management server for the CA trust policy record, and performs additional verification on the certificate based on the obtained CA trust policy record.

[0107] Optionally, the trust policy upload module 703 is specifically used to: The signed CA trust policy record and the CA trust policy public key are securely sent to the trust policy transparent management server, so that the trust policy transparent management server verifies the signed CA trust policy record, and after passing the credibility and integrity check, uses the Merkle tree and the sparse Merkle tree to store the signed CA trust policy record; The Merkle tree is used to store CA trust policy records, and the Merkle tree root is signed by the trust policy transparent management server to ensure data integrity; the sparse Merkle tree is used to provide proof of the non-existence of the CA trust policy record to quickly determine the storage location of the CA trust policy record.

[0108] The certificate verification device based on certificate trust transparency technology provided by the embodiment of the present invention stores, queries and supervises CA trust policy records through a newly added trust policy transparency management server, ensures the integrity of CA trust policy records and provides existence proof. The website server can declare the CA trust policy according to its own security requirements to achieve flexible deployment of the CA trust policy; and when the website server receives an access request from a client, it first sends the certificate to the client for verification based on the trusted root certificate list maintained by itself. If the verification result is credible, secure communication between the client and the server is established; if the verification result is untrustworthy, the client can query the CA trust policy record from the trust policy transparency management server, and perform additional verification on the certificate based on the obtained CA trust policy record. In this way, even if the signed certificate requested by the website server does not exist in the trusted root certificate list, it will not affect the certificate verification process, thereby improving the flexibility and interoperability of certificate verification.

[0109] Figure 8 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 8 As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830 and a communication bus 840, wherein the processor 810, the communication interface 820 and the memory 830 communicate with each other through the communication bus 840. The processor 810 may call the logic instructions in the memory 830 to execute the certificate verification method based on the certificate trust transparency technology, including: Generate a CA trust policy key pair and a key pair for the certificate to be applied for; wherein the CA trust policy key pair includes a CA trust policy public key and a CA trust policy private key, and the key pair for the certificate to be applied for includes a certificate public key and a certificate private key of the certificate to be applied for; Generate a certificate issuance request according to the CA trust policy public key and the certificate public key, send the certificate issuance request to the CA, receive and save the certificate issued by the CA; wherein the certificate includes the CA trust policy public key; Generate a CA trust policy record according to the issued certificate, sign the CA trust policy record with the CA trust policy private key, and securely send the signed CA trust policy record and the CA trust policy public key to the trust policy transparent management server for storage; When receiving an access request from the client, the certificate is sent to the client so that the client can verify the certificate based on the trusted root certificate list maintained by itself. If the verification result is trustworthy, the establishment of a secure channel is initiated to achieve secure communication between the client and the server. If the verification result is untrustworthy, the client queries the trust policy transparent management server for the CA trust policy record, and performs additional verification on the certificate based on the obtained CA trust policy record.

[0110] In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0111] On the other hand, the present invention further provides a computer program product, the computer program product includes a computer program, the computer program can be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer can execute the certificate verification method based on the certificate trust transparency technology provided by the above methods, including: Generate a CA trust policy key pair and a key pair for the certificate to be applied for; wherein the CA trust policy key pair includes a CA trust policy public key and a CA trust policy private key, and the key pair for the certificate to be applied for includes a certificate public key and a certificate private key of the certificate to be applied for; Generate a certificate issuance request according to the CA trust policy public key and the certificate public key, send the certificate issuance request to the CA, receive and save the certificate issued by the CA; wherein the certificate includes the CA trust policy public key; Generate a CA trust policy record according to the issued certificate, sign the CA trust policy record with the CA trust policy private key, and securely send the signed CA trust policy record and the CA trust policy public key to the trust policy transparent management server for storage; When receiving an access request from the client, the certificate is sent to the client so that the client can verify the certificate based on the trusted root certificate list maintained by itself. If the verification result is trustworthy, the establishment of a secure channel is initiated to achieve secure communication between the client and the server. If the verification result is untrustworthy, the client queries the trust policy transparent management server for the CA trust policy record, and performs additional verification on the certificate based on the obtained CA trust policy record.

[0112] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the computer program is executed by a processor to execute the certificate verification method based on the certificate trust transparency technology provided by the above methods, including: Generate a CA trust policy key pair and a key pair for the certificate to be applied for; wherein the CA trust policy key pair includes a CA trust policy public key and a CA trust policy private key, and the key pair for the certificate to be applied for includes a certificate public key and a certificate private key of the certificate to be applied for; Generate a certificate issuance request according to the CA trust policy public key and the certificate public key, send the certificate issuance request to the CA, receive and save the certificate issued by the CA; wherein the certificate includes the CA trust policy public key; Generate a CA trust policy record according to the issued certificate, sign the CA trust policy record with the CA trust policy private key, and securely send the signed CA trust policy record and the CA trust policy public key to the trust policy transparent management server for storage; When receiving an access request from the client, the certificate is sent to the client so that the client can verify the certificate based on the trusted root certificate list maintained by itself. If the verification result is trustworthy, the establishment of a secure channel is initiated to achieve secure communication between the client and the server. If the verification result is untrustworthy, the client queries the trust policy transparent management server for the CA trust policy record, and performs additional verification on the certificate based on the obtained CA trust policy record.

[0113] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0114] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0115] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.< / trustedca> < / domain>

Claims

1. A certificate verification method based on certificate trust transparency technology, characterized in that: Used for a website server, the website server is connected to a trust policy transparent management server, and the website server requests a signed certificate from a certificate issuing authority CA; The method comprises: Generate a CA trust policy key pair and a key pair for the certificate to be applied for; wherein the CA trust policy key pair includes a CA trust policy public key and a CA trust policy private key, and the key pair for the certificate to be applied for includes a certificate public key and a certificate private key of the certificate to be applied for; Generate a certificate issuance request according to the CA trust policy public key and the certificate public key, send the certificate issuance request to the CA, receive and save the certificate issued by the CA; wherein the certificate includes the CA trust policy public key; Generate a CA trust policy record according to the issued certificate, sign the CA trust policy record with the CA trust policy private key, and securely send the signed CA trust policy record and the CA trust policy public key to the trust policy transparent management server for storage; When receiving an access request from the client, the certificate is sent to the client so that the client verifies the certificate based on the trusted root certificate list maintained by itself. If the verification result is trustworthy, a secure channel is established to achieve secure communication between the client and the server. If the verification result is untrustworthy, the client queries the trust policy transparent management server for the CA trust policy record, and performs additional verification on the certificate based on the obtained CA trust policy record.

2. The certificate verification method based on certificate trust transparency technology according to claim 1 is characterized in that: The website server is loaded with a trust anchor manager, and the website server stores a CA root certificate corresponding to the CA; Sending the certificate issuance request to the CA and receiving the certificate issued by the CA includes: Determine a custom CA trust policy and determine at least one CA to which the certificate issuance request is to be sent; Sending the certificate issuance request to the at least one CA through the trust anchor manager; wherein the certificate public keys in the certificate issuance request corresponding to each CA are different from each other; receiving, by the trust anchor manager, at least one certificate issued by a CA; Generate a CA trust policy record based on the issued certificate, including: Determine the CA root certificate corresponding to the issued certificate, and generate the CA trust policy record according to the issued certificate and its corresponding CA root certificate, wherein the CA trust policy record includes a list of trusted CA root certificates.

3. The certificate verification method based on certificate trust transparency technology according to claim 1 is characterized in that: After sending the certificate issuance request to the CA and receiving the certificate issued by the CA, the method further includes: If the trusted CA root certificate needs to be updated, determine the target CA based on the CA root certificate in the saved CA trust policy record and the CA root certificate that needs to be updated. Send a certificate issuance request to the target CA, receive and save the certificate issued by the target CA; According to the certificate issued by the target CA, the trusted certificate is updated, and according to the CA root certificate corresponding to the updated certificate, an updated CA trust policy record is generated. After the updated CA trust policy record is signed by the CA trust policy private key, the updated CA trust policy record and the CA trust policy public key carrying the signature are sent to the trust policy transparent management server for storage.

4. The certificate verification method based on certificate trust transparency technology according to claim 1 is characterized in that: The website server also includes: an authoritative domain name server for storing the node address of the trust policy transparent management server; After securely sending the signed CA trust policy record and CA trust policy public key to the trust policy transparent management server for storage, the method further includes: Receiving a trust policy deployment signature timestamp returned by the trust policy transparent management server, wherein the trust policy deployment signature timestamp is generated by the trust policy transparent management server adding a timestamp to the signed CA trust policy record, and the trust policy deployment signature timestamp carries a node address; The node address corresponding to the trust policy deployment signature timestamp is stored in an authoritative domain name server.

5. The certificate verification method based on certificate trust transparency technology according to claim 4 is characterized in that: Before the client queries the trust policy transparent management server for the CA trust policy record, the following steps are also included: Receive address query request from client; According to the address query request, the authoritative domain name server is queried for a node address corresponding to the address query request, so that the client accesses the trust policy transparent management server according to the node address.

6. The certificate verification method based on certificate trust transparency technology according to claim 5 is characterized in that: The client is loaded with a terminal trust enhancement verifier; Sending the certificate to the client so that the client verifies the certificate based on a trusted root certificate list maintained by the client, including: Sending the certificate to a terminal trust enhancement verifier of a client, so that the terminal trust enhancement verifier of the client verifies the certificate based on a trusted root certificate list maintained by the terminal trust enhancement verifier; If the verification result is untrustworthy, the client queries the trust policy transparent management server for the CA trust policy record and performs additional verification on the certificate based on the obtained CA trust policy record, including: If the verification result is untrustworthy, the terminal trust enhancement verifier of the client is made to query the trust policy transparent management server for the CA trust policy record, and perform supplementary verification on the certificate according to the obtained CA trust policy record.

7. The certificate verification method based on certificate trust transparency technology according to claim 1 is characterized in that: The signed CA trust policy record and CA trust policy public key are securely sent to the trust policy transparent management server for storage, including: The signed CA trust policy record and the CA trust policy public key are securely sent to the trust policy transparent management server, so that the trust policy transparent management server verifies the signed CA trust policy record, and after passing the credibility and integrity check, uses the Merkle tree and the sparse Merkle tree to store the signed CA trust policy record; The Merkle tree is used to store CA trust policy records, and the Merkle tree root is signed by the trust policy transparent management server to ensure data integrity; the sparse Merkle tree is used to provide proof of the non-existence of the CA trust policy record to quickly determine the storage location of the CA trust policy record.

8. A certificate verification device based on certificate trust transparency technology, characterized in that: Set up on a website server, the website server is connected to a trust policy transparent management server, and the website server requests a signed certificate from a certificate issuing authority CA; The device comprises: A key pair generation module, used to generate a CA trust policy key pair and a key pair for a certificate to be applied for; wherein the CA trust policy key pair includes a CA trust policy public key and a CA trust policy private key, and the key pair for a certificate to be applied for includes a certificate public key and a certificate private key of the certificate to be applied for; A certificate receiving module, used to generate a certificate issuance request according to the CA trust policy public key and the certificate public key, and send the certificate issuance request to the CA, receive the certificate issued by the CA and save it; wherein the certificate includes the CA trust policy public key; A trust policy uploading module is used to generate a CA trust policy record according to the issued certificate, sign the CA trust policy record with the CA trust policy private key, and then securely send the signed CA trust policy record and the CA trust policy public key to the trust policy transparent management server for storage; The request processing module is used to send the certificate to the client upon receiving an access request from the client, so that the client can verify the certificate based on the trusted root certificate list maintained by itself. If the verification result is reliable, the establishment of a secure channel is initiated to achieve secure communication between the client and the server; if the verification result is unreliable, the client queries the trust policy transparent management server for the CA trust policy record, and performs additional verification on the certificate based on the obtained CA trust policy record.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the certificate verification method based on the certificate trust transparency technology as described in any one of claims 1 to 7 are implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the certificate verification method based on the certificate trust transparency technology as claimed in any one of claims 1 to 7 are implemented.

Images