Website access method, device, equipment and medium based on alliance root certificate

Abstract

The present application discloses a website access method, device, equipment and medium based on an alliance root certificate. By obtaining a website access request triggered by a target browser for a target website, the website access request is sent to a target server corresponding to the target website; the target website certificate and the corresponding website certificate chain fed back by the target server for the target website are obtained, and the registration address of the target website certificate is determined; when it is detected that the registration address of the target website certificate is the second region, and the website certificate chain contains the first root certificate, the multiple hierarchical certificates indicated by the website certificate chain are verified in sequence; when the verification result is that the verification of each hierarchical certificate indicated by the website certificate chain is passed, it is confirmed that the website certificate chain is a certificate trust chain formed based on the first root certificate, and the target website is determined as a shared website address issued by the certificate trust alliance system; the target browser is controlled to access the shared website address. The access requirements to websites in other regions are met.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a website access method, device, equipment and medium based on an alliance root certificate. Background Art

[0002] The Certificate Authority (CA) is an authority responsible for issuing and managing digital certificates. It has broad credibility in the field of digital certificates, and the root CA is the top-level certification authority in the digital certificate certification system. It is at the top of the entire trust chain. At present, CA institutions in some countries are restricted by the root CAs of other countries, which results in a large number of website certificates needing to be issued by the root CAs of other countries, making the management rights of website certificates restricted to other countries, and facing the problem of website certificate revocation or suspension, which is limited.

[0003] In order to avoid the management rights of website certificates being restricted by other countries and facing the problem of website certificate revocation or suspension, the related technology creates a self-signed CA and forcibly installs the certificate issued by the self-signed CA on the browser, so that the browser can access various websites issued by the self-signed CA. However, this method requires the use of a specific browser to install the certificate issued by the self-signed CA, and the self-signed CA may not be trusted by most browsers, and cannot access websites issued by other CAs. Summary of the invention

[0004] The embodiments of the present application provide a website access method, apparatus, device and medium based on an alliance root certificate, which can avoid the management rights of the website certificate being restricted by other countries and facing the risk of revocation or suspension of the website certificate, improve the credibility of the digital certificate authentication center, and meet the access needs of websites issued by digital certificate authentication centers in other regions.

[0005] In a first aspect, an embodiment of the present application provides a website access method based on an alliance root certificate, which is applied to a terminal, wherein a target browser on the terminal has at least a first root certificate built in, and the first root certificate is issued by a first certificate service system in a first region, and the first certificate service system and a second certificate service system in a second region form a certificate trust alliance system, and the method includes:

[0006] Obtaining a website access request triggered by the target browser for a target website, and sending the website access request to a target server corresponding to the target website;

[0007] Obtaining the target website certificate and the corresponding website certificate chain fed back by the target server for the target website, and determining the registration address of the target website certificate;

[0008] When it is detected that the registration address of the target website certificate is the second region, and the website certificate chain includes the first root certificate, sequentially verifying multiple hierarchical certificates indicated by the website certificate chain to obtain a verification result;

[0009] When the verification result is that the verification of each level certificate indicated by the website certificate chain is passed, confirming that the website certificate chain is a certificate trust chain formed based on the first root certificate, and determining the target website address as a shared website address issued by the certificate trust alliance system;

[0010] The target browser is controlled to access the shared website address.

[0011] In a second aspect, an embodiment of the present application provides a website access device based on an alliance root certificate, which is applied to a terminal, wherein a target browser on the terminal has at least a first root certificate built in, and the first root certificate is issued by a first certificate service system in a first region, and the first certificate service system and a second certificate service system in a second region form a certificate trust alliance system, including:

[0012] An acquisition unit, configured to acquire a website access request triggered by the target browser for a target website, and send the website access request to a target server corresponding to the target website;

[0013] A determination unit, configured to obtain a target website certificate and a corresponding website certificate chain fed back by the target server for the target website, and determine a registration address of the target website certificate;

[0014] a verification unit, configured to, when detecting that the registration address of the target website certificate is the second region and the website certificate chain includes the first root certificate, sequentially verify the multiple hierarchical certificates indicated by the website certificate chain to obtain a verification result;

[0015] a confirmation unit, configured to, when the verification result is that the verification of each level certificate indicated by the website certificate chain is passed, confirm that the website certificate chain is a certificate trust chain formed based on the first root certificate, and determine the target website address as a shared website address issued by the certificate trust alliance system;

[0016] The access unit is used to control the target browser to access the shared website address.

[0017] In some implementations, the verification unit is further configured to:

[0018] Determine in sequence the target website certificate of the first level in the website certificate chain, and the superior certificates of other levels after the target website certificate;

[0019] Obtaining the initial superior certificate for issuing the target website certificate, and obtaining the website certificate content of the target website certificate;

[0020] Decrypt the signature information of the target website certificate according to the public key of the initial superior certificate to obtain the content to be compared;

[0021] When the content to be compared is consistent with the content of the website certificate, it is confirmed that the verification of the first-level certificate in the website certificate chain has passed;

[0022] In a manner of decrypting the next-level certificate using the public key of the previous-level certificate, the upper-level certificates of other levels in the website certificate chain are verified in sequence to obtain a verification result.

[0023] In some implementations, the upper certificate of the last level in the website certificate chain is the first root certificate; and the verification unit is further configured to:

[0024] In accordance with the method of decrypting the next-level certificate by the public key of the previous-level certificate, sequentially perform a level-by-level incremental signature verification on any upper-level certificate in the website certificate chain except the first root certificate to obtain a verification sub-result;

[0025] When it is determined according to the verification sub-result that the verification progress reaches the target superior certificate of the next level of the first root certificate, obtaining the reference certificate content corresponding to the target superior certificate, and decrypting the signature information of the target superior certificate according to the public key of the first root certificate to obtain the target decrypted content;

[0026] When the reference certificate content is consistent with the target decrypted content, determining that the verification result is that the verification of each level certificate indicated by the website certificate chain is passed;

[0027] When the reference certificate content is inconsistent with the target decrypted content, it is determined that the verification result is that the verification of each level certificate indicated by the website certificate chain fails.

[0028] In some embodiments, the confirmation unit is further used to:

[0029] When the website certificate chain includes at least one hierarchical certificate belonging to the second zone that is directly issued by the first root certificate, determining the website certificate chain as a certificate trust chain formed based on the first root certificate;

[0030] The target website address corresponding to the target website certificate on the certificate trust chain is determined to be a shared website address issued by the certificate trust alliance system.

[0031] In some implementations, the certificate trust alliance system is formed by the first root certificate signing the second certificate service information of the second certificate service system, and the second root certificate of the second region signing the first certificate service information of the first certificate service system.

[0032] In some implementations, the first certificate service information includes first root service information corresponding to the first root certificate, and the second certificate service information includes second root service information corresponding to a second root certificate belonging to the second region;

[0033] The certificate trust alliance system is composed of the first certificate service system and the second certificate service system after the first root certificate completes signing the second root service information of the second area and the second root certificate completes signing the first root service information of the first area.

[0034] In some embodiments, the first certificate service information includes first intermediate service information trusted by the first root certificate in the first region, and the second certificate service information includes second intermediate service information trusted by the second root certificate in the second region;

[0035] The certificate trust alliance system is composed of the first certificate service system and the second certificate service system after the first root certificate completes signing the second intermediate service information and the second root certificate completes signing the first intermediate service information.

[0036] In some implementations, the target browser also has a second root certificate of the second zone built in, and the certificate trust alliance system is composed based on the first root certificate and the second root certificate built in the target browser;

[0037] The website access device based on the alliance root certificate also includes a second access unit, which is used to:

[0038] When it is detected that the registration address of the target website certificate is the first area or the second area, determining the target website address as a trusted website address issued by the certificate trust alliance system;

[0039] The target browser is controlled to access the trusted website address.

[0040] In some implementations, the website access device based on the federation root certificate further includes a third access unit, configured to:

[0041] When it is detected that the registration address of the target website certificate is the first area, the target website address is determined to be a trusted website address issued by the first certificate service system;

[0042] The target browser is controlled to access the trusted website address.

[0043] In addition, an embodiment of the present application also provides a computer-readable storage medium, which stores a plurality of instructions, and the instructions are suitable for a processor to load to execute the above-mentioned website access method based on the alliance root certificate.

[0044] The website access method based on the alliance root certificate provided in the embodiment of the present application is applied to a terminal, and the target browser on the terminal has at least a first root certificate built in, the first root certificate is issued by a first certificate service system in a first area, and the first certificate service system and the second certificate service system in a second area form a certificate trust alliance system, by obtaining a website access request triggered by a target browser for a target website, sending the website access request to a target server corresponding to the target website; obtaining a target website certificate and a corresponding website certificate chain fed back by the target server for the target website, and determining a registration address of the target website certificate; when it is detected that the registration address of the target website certificate is the second area, and the website certificate chain contains the first root certificate, sequentially verifying multiple hierarchical certificates indicated by the website certificate chain to obtain a verification result; when the verification result is that the verification of each hierarchical certificate indicated by the website certificate chain is passed, confirming that the website certificate chain is a certificate trust chain formed based on the first root certificate, and determining the target website as a shared website address issued by the certificate trust alliance system; and controlling the target browser to access the shared website address.

[0045] From the above, it can be concluded that by embedding the first root certificate of the first area on the target browser, and the certificate service system of the first area and the certificate service system of the second area form a certificate trust alliance system. Based on this, when the target browser on the terminal needs to access the target website corresponding to the target URL, the target server corresponding to the target website will return the target website certificate and the corresponding website certificate chain information corresponding to the target URL. Then, if the registration place of the target website certificate belongs to the second area, and the website certificate chain contains the first root certificate, the multiple hierarchical certificates indicated by the website certificate chain are verified level by level in sequence to obtain the verification result. Finally, if the verification result indicates that each hierarchical certificate indicated by the website certificate chain has been verified, it is confirmed that the website certificate chain is a certificate trust chain formed based on the first root certificate, and the target URL is a shared website address issued by the certificate trust alliance system. The target browser with the built-in first root certificate can access the shared website address. In this way, the first area and the second area have independent certificate service systems (i.e., digital certificate authentication systems), which prevents the management rights of website certificates from being restricted by other areas and faces the risk of website certificate revocation or suspension. The certificate service systems of the first area and the second area form a certificate trust alliance system to improve the credibility of digital certificate authentication centers between different areas. Browsers with built-in root certificates of any member of the alliance can access websites issued in the certificate trust alliance system, meeting the access needs to websites issued by digital certificate authentication centers in other areas. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0047] Figure 1 A schematic diagram of a scenario of a website access system based on an alliance root certificate provided in an embodiment of the present application;

[0048] Figure 2 A schematic diagram of the steps of the website access method based on the alliance root certificate provided in the embodiment of the present application;

[0049] Figure 3 An example diagram of the architecture of the certificate trust alliance system provided in the embodiment of the present application;

[0050] Figure 4 An example diagram of a certificate trust alliance system when a browser provided in an embodiment of the present application has built-in root certificates for multiple regions;

[0051] Figure 5An example diagram of a certificate trust alliance system formed by cross-signatures between autonomous roots in multiple regions provided in an embodiment of the present application;

[0052] Figure 6 An example diagram of a certificate trust alliance system formed after the autonomous roots of each region provide in an embodiment of the present application sign the intermediate roots of other regions;

[0053] Figure 7 An example diagram of an architecture scenario of a first certificate service system under a certificate trust alliance system provided in an embodiment of the present application;

[0054] Figure 8 A schematic diagram of the structure of a website access device based on an alliance root certificate provided in an embodiment of the present application;

[0055] Fig. 9 A schematic diagram of the structure of a terminal provided in an embodiment of the present application;

[0056] Fig.10 A schematic diagram of the structure of a server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0057] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0058] It can be understood that in the specific implementation of this application, related key data such as certificates, URLs, website certificate chains, registration addresses, etc. are involved. When the above embodiments of this application are applied to specific products or technologies, it is necessary to obtain the object's permission or consent, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards.

[0059] In addition, when the embodiment of the present application needs to obtain key data, a separate license or separate consent for key data related to the certificate, website, website certificate chain, registration address, etc. will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining a separate license or separate consent for key data related to the certificate, website, website certificate chain, registration address, etc., the necessary data for the normal operation of the embodiment of the present application will be obtained.

[0060] It should be noted that in some processes described in the specification, claims and the above-mentioned drawings, multiple steps appearing in a specific order are included, but it should be clearly understood that these steps may not be executed in the order in which they appear in this document or may be executed in parallel. The step numbers are only used to distinguish different steps, and the numbers themselves do not represent any execution order. In addition, descriptions such as "first", "second" or "target" in this document are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0061] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0062] The embodiments of the present application provide a website access method, apparatus, computer-readable storage medium, and computer equipment based on an alliance root certificate. Specifically, the website access method based on an alliance root certificate in the embodiments of the present application can be performed by a computer device, which can be a server or a user terminal or other device. Among them, the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. Among them, the user terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, a smart home appliance, a car terminal, an intelligent voice interaction device, an aircraft, etc., but is not limited to this.

[0063] For ease of understanding, this application will describe the implementation process of the website access method based on the alliance root certificate from multiple embodiments, as follows:

[0064] For example, see Figure 1 , which is a scenario diagram of a website access system based on an alliance root certificate provided in an embodiment of the present application. In this scenario, the system includes a certificate trust alliance system and a terminal.

[0065] The certificate trust alliance system includes a first certificate service system in a first area and a second certificate service system in a second area. The first certificate service system may be composed of a first root server (a root server of a digital certificate authentication center, which belongs to the source of the first area and the top-level digital certificate authentication center) and a first intermediate root server authenticated and trusted by the first root server. The first intermediate root server may also continue to authenticate and trust the root server of the next level, such as a website server or a root server of a lower level, which will not be described in detail here. Similarly, the second certificate service system may be composed of a second root server (a root server of a digital certificate authentication center, which belongs to the source of the second area and the top-level digital certificate authentication center) and a second intermediate root server authenticated and trusted by the second root server. The second intermediate root server may also continue to authenticate and trust the root server of the next level, such as a website server or a root server of a lower level, which will not be described in detail here.

[0066] It should be noted that the first certificate service system and the second certificate service system may also have only a root server and a subordinate server, that is, only two levels of certificate servers are maintained, or there may be more levels of certificate servers. For example, taking the first certificate service system as an example, it may include the highest-level first root server, the second-highest-level first intermediate server, the first intermediate server of the next level under the second-highest-level first intermediate server, and so on, until the first subordinate server of the lowest level; in addition, under the highest-level first root server, there may be parallel branches between the intermediate servers of any other levels, that is, the same level may include multiple intermediate servers, which depends on the actual situation and is not limited here.

[0067] A client may be installed on the terminal, and the client may be a target browser or other application for accessing a website or application page. Taking the target browser as the client as an example, the target browser may be equipped with a first root certificate. When executing the website access method based on the alliance root certificate, the specific steps are as follows: obtaining a website access request triggered by the target browser for a target website, and sending the website access request to a target server corresponding to the target website; obtaining a target website certificate and a corresponding website certificate chain fed back by the target server for the target website, and determining a registration address of the target website certificate; when it is detected that the registration address of the target website certificate is the second area, and the website certificate chain contains the first root certificate, verifying the multiple hierarchical certificates indicated by the website certificate chain in sequence to obtain a verification result; when the verification result is that the verification of each hierarchical certificate indicated by the website certificate chain is passed, confirming that the website certificate chain is a certificate trust chain formed based on the first root certificate, and determining the target website as a shared website address issued by the certificate trust alliance system; and controlling the target browser to access the shared website address.

[0068] In this way, by embedding the first root certificate of the first area on the target browser, the first root certificate is issued by the first certificate service system of the first area, and specifically can be issued by the highest-level source digital certificate authentication center (first root server) in the first certificate service system, and the certificate service system of the first area and the certificate service system of the second area form a certificate trust alliance system. Based on this, when the target browser on the terminal needs to access the target website corresponding to the target URL, the target server corresponding to the target website will return the target website certificate and the corresponding website certificate chain information corresponding to the target URL. Then, if the registration place of the target website certificate belongs to the second area, and the website certificate chain contains the first root certificate, the multiple hierarchical certificates indicated by the website certificate chain are verified layer by layer in sequence to obtain the verification result. Finally, if the verification result indicates that each hierarchical certificate indicated by the website certificate chain has been verified, it is confirmed that the website certificate chain is a certificate trust chain formed based on the first root certificate, and the target URL is a shared website address issued by the certificate trust alliance system. The target browser with the built-in first root certificate can access the shared website address. In this way, the first region and the second region both have independent certificate service systems (i.e., digital certificate authentication systems), which prevents the management rights of website certificates from being restricted by other regions and the risk of website certificate revocation or suspension. In addition, the certificate service systems of the first region and the second region form a certificate trust alliance, which improves the credibility of digital certificate authentication centers between different regions and meets the needs for access to websites issued by digital certificate authentication centers in other regions.

[0069] For ease of understanding, the steps of the website access method based on the alliance root certificate will be described in detail below. It should be noted that the order of the following embodiments is not intended to limit the preferred order of the embodiments.

[0070] See also Figure 2 , Figure 2 The following is a flow chart of the steps of the website access method based on the alliance root certificate provided in the embodiment of the present application. In the embodiment of the present application, the website access method based on the alliance root certificate can be executed by a computer device, such as a server or a terminal. For example, taking the terminal execution as an example, when the processor on the terminal executes the program instructions corresponding to the website access method based on the alliance root certificate, the specific process is as follows:

[0071] 101. Obtain a website access request triggered by a target browser for a target website, and send the website access request to a target server corresponding to the target website.

[0072] A digital certificate is a digital certificate that marks the identity information of the communicating parties in Internet communication. People can use it to identify each other's identity on the Internet. The Digital Certificate Authority (CA) is the authority responsible for issuing and managing digital certificates. It has extensive credibility in the field of digital certificates. Digital certificates are generally obtained by signing the corresponding data information by the Digital Certificate Authority, indicating the target identity corresponding to the signed data information.

[0073] However, there is no unified digital certificate management and issuance agency in the world. The CA systems built in most regions (such as countries / regions / continents / provinces, etc.) are subject to unified review and management by government departments. For regions where the Public Key Infrastructure (PKI) technology started relatively late, although some CA agencies have been established, most of them are subject to the root CAs of other regions and cannot achieve self-management. For example, among the current global CA-issued certificates, the number of digital certificates issued by some countries accounts for 80%, which leads to the fact that most of the certificates of important websites in other countries are also issued by the CA of that country, making the management rights of these website certificates controlled by the CA of the issuing country. In addition, for countries where PKI developed relatively late, there are many important systems that have not yet deployed digital certificates, and many important systems have deployed digital certificates issued independently that are not trusted by browsers, which leads to major risks in the secure communication between the system and users.

[0074] In order to avoid the management rights of website certificates being restricted by other countries and facing the risk of website certificate revocation or suspension, the relevant technology creates an autonomous CA that issues its own certificates and forcibly installs the certificates issued by the autonomous CA on the browser so that the browser can access various websites issued by the autonomous CA. However, this method requires the use of a specific browser to install the certificates issued by the autonomous CA, and the autonomous CA may not be trusted by most browsers and cannot access websites issued by other CAs.

[0075] In the embodiment of the present application, a website access method based on an alliance root certificate is executed, and the alliance root certificate can be an autonomous root certificate self-signed by an autonomous root in any region within the certificate trust alliance, such as the first root certificate, the second root certificate, the third root certificate, etc. Specifically, each region is set with an autonomous certificate root service (the highest-level digital certificate authentication center), which can be used to issue digital certificates (such as website certificates) in their respective regions, which can avoid the management rights of website certificates being restricted by other countries and facing the risk of revocation or suspension of website certificates; and, by establishing a trust alliance between digital certificate authentication centers in multiple regions, for example, taking the first region and the second region as an example, a common certificate trust alliance system is constructed for the first certificate service system of the first region and the second certificate service system of the second region, so as to improve the credibility of digital certificate authentication centers between different regions, so that the browser can trust and install the root certificate of any region of the "certificate trust alliance system", such as the first root certificate and / or the second root certificate; further, as long as the browser has a built-in root certificate of any region, such as the first root certificate and / or the second root certificate, it can access websites in any region within the alliance, meeting the access requirements for websites issued by digital certificate authentication centers in other regions.

[0076] It should be noted that in order to access websites issued by digital certificate authentication centers in other regions, the following conditions must be met: Taking a terminal as an example, the target browser on the terminal has at least a first root certificate built in, which refers to an autonomous root certificate obtained by self-signing with the autonomous root (CA) of the first region, indicating the highest identity and authority of the autonomous root (CA) of the first region. The first root certificate is issued by the first certificate service system of the first region, such as the first root certificate is specifically issued by the first root server in the first certificate service system of the first region according to the information of the first autonomous root, and the first certificate service system and the second certificate service system of the second region form a certificate trust alliance system. Based on this, the first certificate service system to which the first root certificate belongs and the second certificate service system of the second region form a certificate trust alliance system, which can be understood as mutual trust between the first region and the second region. When the target browser has a built-in first root certificate belonging to the first region, due to the certificate trust relationship between the first region and the second region, the target browser can also trust the certificate of the second region, such as trusting the target website certificate belonging to the second region. Therefore, when the target browser has a built-in first root certificate of the first region, it can access the target website of the second region.

[0077] The "region" described in the embodiments of the present application may refer to a region divided by geographical location, administrative management, longitude and latitude, territory, etc. For example, the first region and the second region may represent different national regions, i.e., territorial regions of different countries, and may also be understood as different digital certificate service regions.

[0078] For example, in the international community, domains can be divided according to national entities. The first region and the second region represent different national regions respectively. At this time, each national region has an independent top-level digital certificate authentication center (i.e., an autonomous root CA). Taking the first region as an example, the certificate corresponding to the top-level digital certificate authentication center (the first root CA) is the first root certificate, and the subordinates of the first root CA also have corresponding first intermediate root CAs, first subordinate root CAs, etc., indicating that a region contains root CAs of different levels. These multiple root CAs of different levels form a multi-level root CA system. The root CA of each level or each root CA can be regarded as a certificate server. The multi-level root CA system of the first region can be regarded as a first certificate service system composed of multiple certificate servers in the first region.

[0079] Similarly, the certificate corresponding to the highest-level digital certificate authentication center (second root CA) in the second area is the second root certificate, and the second root CA also has corresponding second intermediate root CAs, second subordinate root CAs, etc., indicating that a region contains root CAs of different levels. These multiple root CAs of different levels form a multi-level root CA system. The root CA of each level or each root CA can be regarded as a certificate server. The multi-level root CA system of the second area can be regarded as a second certificate service system composed of multiple certificate servers in the second area.

[0080] It should be noted that in the PKI system, the issuance of certificates is based on a strict hierarchy and trust chain transmission. For example, taking the first region as an example, assuming that R1 represents the highest-level digital certificate issuing center in the first region as the root CA, M1 represents the middle-level digital certificate issuing center in the second region, and S1 represents the low-level digital certificate issuing center in the first region, then the root CA (such as R1) is the top authority of the entire trust system. It has the highest level of trust and is responsible for issuing certificates for the intermediate root (such as M1). After the intermediate root M1 obtains the certificate R1M1 from the root R1, a trust path from M1 to R1 is established. Similarly, the intermediate root M1 can be responsible for issuing certificates for the subordinate root S1. After the subordinate root S1 obtains the certificate M1S1 from the intermediate root M1, a trust path from S1 to M1 is established; this process is one-way, that is, the upper CA issues certificates to the lower entity to transfer trust.

[0081] Furthermore, the first certificate service system in the first area and the second certificate service system in the second area form a certificate trust alliance system, so that the certificate belonging to the first certificate service system and the certificate belonging to the second certificate service system trust each other.

[0082] In some implementations, the certificate service information of the root CA of other regions can be signed by the high-level root certificate of each region to establish a certificate trust relationship between different regions, thereby forming a common certificate trust alliance system. For example, taking the first region and the second region as an example, the certificate trust alliance system is formed by the first root certificate signing the second certificate service information of the second certificate service system, and the second root certificate of the second region signing the first certificate service information of the first certificate service system.

[0083] The first certificate service information may be information of a first certificate server at any level in the first region, such as the public key, identity, validity period, etc. of the root at the level. The second certificate service information may be information of a second certificate server at any level in the second region, such as the public key, identity, validity period, etc. of the root at the level.

[0084] It should be noted that, for ease of understanding, the embodiments of this application are only described with respect to the first region and the second region, and may also include the third region, the fourth region, the fifth region, etc. The implementation process involved in multiple regions is consistent with that involved in the two regions, and the embodiments of this application are not repeated. It should be noted that, in the embodiments of this application, the first root certificate built into the first region is used as an example, and the second region may be any region other than the first region, and the second region may also represent multiple regions.

[0085] For example, Figure 3 The example diagram of the architecture of the certificate trust alliance system provided in the embodiment of the present application is combined with Figure 3As shown, the system architecture includes a first autonomous root in the first area, a second autonomous root in the second area, and a third autonomous root in the third area. The autonomous root in each area independently corresponds to a root CA server, such as a first certificate server in the first area, a second certificate server in the second area, and a third certificate server in the third area. The first autonomous root, the second autonomous root, and the third autonomous root are cross-signed, that is, mutually signed. For example, the private key of the first root certificate of the first autonomous root R1 signs the certificate service information of the second autonomous root R2 to obtain certificate R1-R2, and the private key of the first root certificate of the first autonomous root R1 signs the certificate service information of the third autonomous root R2 to obtain certificate R1-R2. The private key of the second root certificate of the second autonomous root R2 signs the certificate service information of the first autonomous root R1 to obtain certificate R2-R1, the private key of the second root certificate of the second autonomous root R2 signs the certificate service information of the third autonomous root R3 to obtain certificate R2-R3, the private key of the third root certificate of the third autonomous root R3 signs the certificate service information of the second autonomous root R2 to obtain certificate R3-R2, and the private key of the third root certificate of the third autonomous root R3 signs the certificate service information of the first autonomous root R1 to obtain certificate R3-R1. In this way, the cross-signatures between the autonomous roots of the three regions are completed, and the alliance root CA system, that is, the certificate trust alliance system, is established.

[0086] It should be noted that when the autonomous roots of multiple regions sign each other, each autonomous root has multiple certificates. For example, taking the first region and the second region as an example, the self-signature of the first (autonomous) root server of the first region can obtain the first root certificate (R1). Similarly, the self-signature of the second (autonomous) root server of the second region can obtain the second root certificate (R2). Assuming that the first root certificate signs the certificate service information of the second autonomous root of the second region to obtain the first trusted root certificate (R1-R2), the second root certificate signs the certificate service information of the first autonomous root of the first region to obtain the second trusted root certificate (R2-R1). It can be seen that the first autonomous root of the first region has the first root certificate (R1) and the first trusted root certificate (R2-R1), while the second autonomous root of the second region has the second root certificate (R2) and the second trusted root certificate (R1-R2). Therefore, the autonomous root of each region has two different certificates, and these two certificates each have unique roles and functions in the PKI system.

[0087] For example, taking the autonomous root of the second region as an example, the second root certificate (R2), a self-signed certificate, is the cornerstone of its identity identification. It contains key information such as its own public key, identity, and validity period. The self-signature ensures the integrity and non-tamperability of the certificate, establishes the initial trust point for it in the system, and is used to prove the legitimacy of its identity to other entities. This certificate plays a key role when R2 operates independently or interacts with the upper-level root CA, and is the underlying support for building a trust hierarchy. The second trusted root certificate (R1-R2) is the embodiment of the authorization and authentication of the autonomous root R1 in the first region to the second autonomous root R2 in the second region. It is of great significance in the alliance root system (certificate trust alliance system) or cross-regional root trust scenario. Its generation is based on R2 submitting a certificate request (including public key, identity and other information) to R1. The first root certificate R1 uses the private key to encrypt the request data hash value as a signature and attaches it to the request information. The certificate indicates that the second autonomous root R2 has obtained the trust endorsement of the first autonomous root R1 in the first region, so that the entity that trusts the autonomous root R1 (such as a browser or other application) can verify the signature and trust the second autonomous root R2 with the public key of the first root certificate, expanding the trust domain of the second autonomous root in the second region, such as expanding the trust domain to the coverage of the first autonomous root R1 in the first region. In this way, it lays a solid trust foundation for users in the alliance to encrypt and access websites issued by CAs in other regions within the trust alliance, promotes mutual trust and mutual visits of cross-regional websites, and realizes the autonomous root-based system of each region (such as a country), solves the current problem of certificate restrictions with other regions, and realizes mutual trust between autonomous roots in different regions, which is of great significance.

[0088] In a regional root service system, the high-level root service signs the information of the lower-level root service to issue a digital certificate to the lower-level root service to achieve trust transfer. For example, see Figure 3 As shown, the first autonomous root (first root certificate server) of the first region signs the certificate service information of the first intermediate root, which may include the public key, identity, validity period and other information of the first intermediate root. The certificate service information of the first intermediate root is signed using the private key of the first root certificate, and the certificate R1-M1 issued by the first autonomous root for the first intermediate root can be obtained, which can be understood as the digital certificate of the intermediate root. It should be noted that in the certificate system of a region, since the highest-level digital certificate authentication center (autonomous root CA) is the top authority of the entire trust system, it has the highest trust level. Therefore, only the autonomous root CA can self-sign its own certificate service information (such as the public key, identity, validity period and other information of the first autonomous root) to obtain the first root certificate, while the certificates of roots at other levels (such as intermediate roots) do not need to be obtained through self-signature, but need to be signed and issued by the first autonomous root to achieve trust transfer and ensure the credibility of the certificate.

[0089] Figure 3As shown, the first intermediate root server (first intermediate root CA) in the first area can obtain the corresponding target website certificate based on the website information (such as address, public key, identification, etc.) to sign a target website, and the browser can establish a connection with the target website through the handshake of the Transport Layer Security Protocol (TLS) to achieve access to the target website. It should be noted that before the browser successfully accesses the target website, it is necessary to verify the security and credibility of the website certificate. The verification process will be introduced later. It should be noted that due to Figure 3 The certificate service systems of the first, second and third regions constitute a certificate trust alliance system. The target website can be understood as a trusted website in the certificate trust alliance system. As long as the browser has the first root certificate of the first region, and / or the second root certificate of the second region, and / or the third root certificate of the third region built in, the target website can be accessed.

[0090] In some implementations, the target browser's certificate trust store may have a first root certificate of the first region built in, and the target browser may also have a second root certificate of the second region built in, and the certificate trust alliance system is composed of the first root certificate and the second root certificate built in the target browser.

[0091] For example, Figure 4 This is an example diagram of a certificate trust alliance system when a browser has built-in root certificates for multiple regions provided in an embodiment of the present application. Figure 4 As shown, taking the first region and the second region as an example, a trust chain is not established between the first certificate service system in the first region and the second certificate service system in the second region, but there is an autonomous root CA library in each region of the certificate trust alliance system. For example, the autonomous root CA library includes a first root certificate (R1) and a second root certificate (R2). The certificate trust library of the target browser also has the first root certificate (R1) and the second root certificate (R2) built in, so as to build a trust chain to the root CA of the first region and the second region on the browser side, so as to enable the browser to access the websites of each region in the certificate trust alliance.

[0092] Specifically, the target browser uses the first root certificate (R1) of the first zone and the second root certificate (R2) of the second zone to satisfy the user's access to the website issued by the built-in first root certificate (R1) and the second root certificate (R2). Among them, the alliance root CA certificate library can be provided, and the remote root CA certificate download service can be provided. The target browser can download and install through the root certificate service to realize the information anchor of the root CA of each zone in the alliance as the basis of trust. Figure 4As shown, the highest-level root (R1 CA ROOT) of the first region self-signs to obtain a first root certificate (R1), and signs the information of the website service of the first region (such as public key, website address, domain name, identity identifier, etc.) through the private key of the first root certificate to issue a first website (cn-first website address.cn), and the first website has a corresponding first website certificate; similarly, the highest-level root (R2 CA ROOT) of the second region self-signs to obtain a second root certificate (R2), and signs the information of the website service of the second region (such as public key, website address, domain name, identity identifier, etc.) through the private key of the second root certificate to issue a second website (cn-second website address.cn), and the second website has a corresponding second website certificate; by embedding the first root certificate and the second root certificate in the certificate trust store of the browser, at this time, the browser can access the first website corresponding to the first website address based on the certificate trust chain formed by the first website certificate and the first root certificate, and the browser can access the second website corresponding to the second website address based on the certificate trust chain formed by the second website certificate and the second root certificate.

[0093] In some embodiments, the autonomous roots between different regions can build a certificate trust alliance system by cross-signing, so that the certificates between the first region and the second region are mutually trusted to form a certificate trust chain. For example, the first certificate service information includes the first root service information corresponding to the first root certificate, and the second certificate service information includes the second root service information corresponding to the second root certificate belonging to the second region; the certificate trust alliance system is composed of the first certificate service system and the second certificate service system after the first root certificate completes the signature of the second root service information of the second region and the second root certificate completes the signature of the first root service information of the first region.

[0094] For example, Figure 5 An example diagram of a certificate trust alliance system formed by cross-signatures between autonomous roots in multiple regions provided in an embodiment of the present application; Figure 7 This is an example diagram of the architecture scenario of the first certificate service system under the certificate trust alliance system provided in the embodiment of the present application. Figure 5 and Figure 7As shown, the highest-level root (R1 CA ROOT) of the first region self-signs to obtain a first root certificate (R1), and signs the information of the website service of the first region (such as public key, website address, domain name, identity identifier, etc.) through the private key of the first root certificate to issue a first website (cn-first website address.cn), and the first website has a corresponding first website certificate; similarly, the highest-level root (R2 CA ROOT) of the second region self-signs to obtain a second root certificate (R2), and signs the information of the website service of the second region (such as public key, website address, domain name, identity identifier, etc.) through the private key of the second root certificate to issue a second website (cn-second website address.cn), and the second website has a corresponding second website certificate.

[0095] Furthermore, the information of the second autonomous root (R2 CA ROOT) of the second region is signed by the private key of the first root certificate (R1) to obtain the second trusted root certificate (R1-R2). In addition, the information of the first autonomous root (R1 CA ROOT) of the first region can also be signed by the private key of the second root certificate (R2) to obtain the first trusted root certificate (R2-R1). Based on this, a certificate trust alliance system is established between the first autonomous root of the first region and the second autonomous root of the second region. When the certificate trust store of the target browser only has the first root certificate built in, the browser can access the first website (cn-first website.cn) issued by the private key of the first root certificate, and since the certificate trust alliance system is established between the first autonomous root of the first region and the second autonomous root of the second region, the first autonomous root trusts the second autonomous root of the second region. At this time, the browser with only the first root certificate built in can also trust the second website (cn-second website.cn) issued by the second autonomous root, and the browser can access the second website (cn-second website.cn) issued by the private key of the second root certificate.

[0096] In some embodiments, for each autonomous root of each region, the information of the intermediate roots of other regions can be signed respectively to build a certificate trust alliance system, so that the certificates between the first region and the second region are mutually trusted, such as the website certificates of the first region and the second region are trusted, forming a certificate trust chain. For example, the first certificate service information includes the first intermediate service information trusted by the first root certificate in the first region, and the second certificate service information includes the second intermediate service information trusted by the second root certificate in the second region; the certificate trust alliance system is composed of the first certificate service system and the second certificate service system after the first root certificate completes the signature on the second intermediate service information and the second root certificate completes the signature on the first intermediate service information.

[0097] For example, Figure 6This is an example diagram of a certificate trust alliance system formed after the autonomous roots of each region provided by the embodiments of the present application sign the intermediate roots of other regions. Combining Figure 6 and Figure 7 As shown, the highest-level root (R1 CAROOT) of the first region self-signs to obtain the first root certificate (R1), and uses the private key of the first root certificate to sign the information of the intermediate root M1 in the first region (such as the public key, identity identifier, validity period, etc. of the intermediate root) to obtain the first intermediate root certificate (M1), and the first intermediate root certificate (M1) signs the information of the website service (such as public key, website address, domain name, identity identifier, etc.) to issue the first website (cn-first website address.cn), and the first website has a corresponding first website certificate; similarly, the highest-level root (R2 CA ROOT) of the second region self-signs to obtain the second root certificate (R2), and uses the private key of the second root certificate to sign the information of the intermediate root M2 in the second region (such as the public key, identity identifier, validity period, etc. of the intermediate root) to obtain the first intermediate root certificate (M2), and the second intermediate root certificate (M2) signs the information of the website service in the second region (such as public key, website address, domain name, identity identifier, etc.) to issue the second website (cn-second website address.cn), and the second website has a corresponding second website certificate.

[0098] Furthermore, use the private key of the first root certificate (R1) to sign the information of the second intermediate root (M2) in the second region to obtain the second trusted intermediate root certificate (R1-M2). In addition, the private key of the second root certificate (R2) can also be used to sign the information of the first intermediate root (M1) in the first region to obtain the first trusted root certificate (R2-M1). Based on this, a certificate trust alliance system is established between the first certificate service system in the first region and the second certificate service system in the second region. When only the first root certificate is built into the certificate trust library of the target browser, the browser can access the first website (cn-first website address.cn) signed by the private key of the first intermediate root certificate (M1). And because a certificate trust alliance system is established between the first region and the second region, the first autonomous root trusts the second intermediate root in the second region. At this time, the browser with only the first root certificate built in can also trust the second website (cn-second website address.cn) signed by the second autonomous root, and the browser can access the second website (cn-second website address.cn) issued by the second intermediate root (M2).

[0099] The above are multiple implementation examples of forming a certificate trust alliance system between multiple regions. One or a combination of them can be selected to build a certificate trust alliance system to achieve access to websites belonging to other regions, meet the needs of cross-regional access, improve the credibility and security of website access, and improve website access efficiency.

[0100] In the embodiment of the present application, based on the trust basis of the above certificate trust alliance system, a website access method based on the alliance root certificate is executed, and websites in any area within the alliance can be accessed. Specifically, the terminal can detect the website access request triggered by the target browser for the target website, and the website access request carries the target website address of the target website to be visited, and sends the website access request to the target server corresponding to the target website, so that the target server returns the corresponding target website certificate and website certificate chain for the target website requested to be visited. In order to subsequently determine whether the target website to be visited by the target browser is credible and safe based on the target website certificate and website certificate chain, so as to share access to the websites issued within the alliance.

[0101] The target URL refers to the network address (URL, Uniform Resource Locator) of the corresponding target website, which belongs to the web address on the Internet. It can be composed of an Internet Protocol address (IP address) and a domain name address. Specifically, the computer is a digital world. Any information is represented in a digital form in the computer. Even if a person's name is represented in the computer, there is a corresponding digital code corresponding to it. In the network world, in order to accurately find the destination computer, each computer must be marked with a unique address. Just like you must know the other party's phone number when making a phone call, this number must also be unique. Usually, this address is represented by four decimal (i.e. IPv4) numbers separated by decimal points, which is called an IP address. IP is the abbreviation of Internet Protocol.

[0102] The target server refers to the server of the target website corresponding to the target URL, which can be understood as the backend of the corresponding target website, used to provide data support. Specifically, the target server can be a computer device or software system used to store, process and transmit web pages (or other network resources). When the user enters the URL in the browser and presses the Enter key, the browser will send a request to the server corresponding to the URL. After receiving the request, the server will search and return the corresponding resources (such as web page files, pictures, videos, etc.) to the browser, so that users can access and view these contents, providing web page access services for users.

[0103] Through the above method, the website access request triggered by the target browser for the target URL can be detected. The website access request carries the target URL of the target website to be visited, and the website access request is sent to the target server corresponding to the target website, so that the target server returns the corresponding target website certificate and website certificate chain for the target website requested to be accessed, so as to subsequently determine whether the target website to be visited by the target browser is trustworthy and secure based on the target website certificate and website certificate chain, so as to share access to websites issued within the alliance.

[0104] 102. Obtain the target website certificate and the corresponding website certificate chain fed back by the target server for the target website, and determine the registration address of the target website certificate.

[0105] In an embodiment of the present application, after sending a website access request to a target server corresponding to a target website, the target server can obtain a response to the website access request carrying a target URL, and return a target website certificate corresponding to the target URL, as well as a website certificate chain corresponding to the target website certificate. Furthermore, the terminal also determines the registration address of the target website to determine whether it has access rights to the target website corresponding to the target URL, so that certificate verification can be performed later when access rights are obtained, thereby determining whether the website is trustworthy at the current moment and improving the reliability of website access.

[0106] Among them, the target website certificate can be an identity certificate of the target website corresponding to the target URL, which is a digital certificate used to prove the authenticity of the website identity and ensure the secure transmission of data in network communications. The website certificate contains information such as the website domain name, organization name, and geographic location, which is used to clarify the website identity and ensure that the user's access to the website is consistent with expectations; in addition, the website certificate may also contain the website server public key. When the user establishes a secure connection with the website (such as HTTPS), the browser uses the public key to encrypt data transmission, and only the server uses the private key to decrypt it, ensuring that the data is not stolen or tampered with during network transmission, protecting the security of sensitive information. In the public key infrastructure (PKI) system, the website certificate is based on asymmetric encryption technology, and contains website identity information, public key, and certificate authority (CA) signature, etc., to provide security for secure communication between the website and the user.

[0107] Among them, the website certificate chain can be understood as an ordered combination of a series of digital certificates, which is used to establish a trust path between the website certificate and the trusted root certificate authority (Root Certificate Authority, root CA), ensuring the authenticity of the website identity and the security of data transmission in network communications. The website certificate chain provides the basis for identity authentication and encrypted communications in network communications. In the public key infrastructure (PKI) system, the website certificate chain plays a key role in delivering trust. The website certificate chain can include an end-entity certificate and an (autonomous) root certificate. In addition, there may also be intermediate certificates between the end-entity certificate and the (autonomous) root certificate.

[0108] Among them, the terminal entity certificate is the starting end of the website certificate chain. It is the entity certificate directly issued to the website, that is, the target website certificate, which is used to prove the identity of the target website. For example, the SSL / TLS certificate of a website is the terminal entity certificate, which contains the website's domain name, public key, and certificate validity period, etc., and is used to verify the identity of the website when establishing a secure connection between the client and the website server. When a user visits the website, the browser first receives this terminal entity certificate.

[0109] Among them, in some embodiments, the terminal entity certificate is not a certificate directly issued by the autonomous root, but a certificate issued by one or more intermediate root services. In this case, the website certificate chain contains an intermediate certificate, which is located between the terminal entity certificate and the autonomous root certificate and plays the role of transferring trust. Each intermediate certificate contains information about the upper-level root service that issued the intermediate certificate (i.e., the next CA in the certificate chain) and its own public key and other information. For example, an enterprise may apply for a certificate from a commercial CA organization. The commercial CA organization acts as an intermediate CA and uses its own private key to issue a certificate to the enterprise. This certificate is the intermediate CA certificate. When the browser verifies the certificate of the enterprise website, it will first verify the validity of the intermediate CA certificate, and then trace back to the higher-level CA certificate through the intermediate certificate. The above is an example and is not a specific limitation.

[0110] Among them, the autonomous root certificate is the certificate at the end of the website certificate chain. It is the foundation and trust anchor of the entire certificate trust system. The autonomous root certificate is self-signed, that is, it uses the autonomous root CA's own private key to sign its own public key and identity information. Autonomous root certificates are widely trusted and are usually pre-built into operating systems, browsers, mobile devices and other systems.

[0111] Specifically, the website certificate chain starts with the website certificate and traces back to the intermediate certificates at all levels, until it reaches the root CA certificate. As a trust anchor, the root CA is the most trusted entity in the entire PKI system. Through the certificate chain, the trust of the root CA can be passed to the website certificate level by level, allowing users to trust the identity of the website. For example, when the browser only has the first root certificate built in, when a user visits a target website corresponding to a target URL, the browser will verify the website certificate chain. If each certificate in the chain can pass the verification and is ultimately traced back to the trusted first root certificate, the browser will consider the target website to be trustworthy, thereby establishing a secure communication connection.

[0112] In addition, each certificate in the website certificate chain signs its subordinate certificates, and the signing process uses the private key of the superior certificate to encrypt the contents of the subordinate certificate. When verifying the certificate chain, the integrity and authenticity of the subordinate certificate can be verified by using the public key of the superior certificate to decrypt the signature, ensuring that the certificate has not been tampered with during transmission. This layer-by-layer verification mechanism ensures the reliability of the entire trust chain from the root CA to the website certificate, preventing the risk of man-in-the-middle attacks and forged certificates.

[0113] It should be noted that the website certificate chain can be generated by the target server corresponding to the target website and returned to the terminal after generation. In addition, it can also be generated by the terminal. The process of the terminal generating the website certificate chain is as follows:

[0114] For example, when a user requests to access the target website corresponding to the target URL through a target browser, the target server of the target website will send its digital certificate (i.e., the target website certificate) to the target browser. This target website certificate is obtained by the website from the root CA of the upper level to which it belongs, and is used to prove the authenticity of the website. For example, when a user visits a foreign e-commerce website, the server will send the website certificate to the user's browser when establishing a connection.

[0115] First, after receiving the website certificate, the target browser will first parse the format and content of the certificate. It will extract key information from the certificate, such as the website's domain name (used to confirm whether the certificate matches the website visited by the user), the certificate issuer (that is, the CA information that issued the certificate), the certificate's validity period (to ensure that the certificate is valid at the current time), the certificate's serial number (used to uniquely identify the certificate), and the website server's public key (used for subsequent encrypted communications). This information is the basis for building a certificate chain and verifying the validity of the certificate.

[0116] Then, getting the issuer information from the certificate is an important step in building the certificate chain. The browser determines which CA issued the certificate for the website by reading the issuer field in the certificate. For example, if the certificate shows that it was issued by an intermediate CA, the browser knows that it needs to further find the certificate of the intermediate CA to build the certificate chain.

[0117] Furthermore, the browser will first search for the certificate of the issuer CA (i.e., the superior certificate) in the local preset trust store. Modern browsers usually have built-in certificates of some world-renowned root CAs. These certificates serve as trust anchors to verify the validity of other certificates. If the certificate of the issuer CA is found in the local trust store, the browser can obtain information such as the public key in the certificate to verify the signature of the website certificate. If the corresponding certificate is not found in the local trust store, the browser may try to obtain it from other channels, such as querying the CA's certificate distribution point (CDP) through the network or using a pre-configured backup certificate store.

[0118] Finally, once the superior certificate is found, the browser will repeat the above parsing and searching process, that is, parsing the superior certificate, obtaining its issuer information, and then continuing to search for the superior certificate in the local trust store or other channels until the root CA certificate is found or the termination condition of the trust chain is reached (such as the superior certificate cannot be found or the trust anchor is encountered). Through such layer-by-layer tracing, the browser gradually builds a complete certificate chain from the website certificate to the root CA certificate. For example, if the website certificate is issued by Intermediate CA1, and the certificate of Intermediate CA1 is issued by Root CA2, the browser will first obtain the certificate of Intermediate CA1, and then obtain the certificate of Root CA2, thus forming a certificate chain of "Website Certificate-Intermediate CA1 Certificate-Root CA2 Certificate".

[0119] Among them, the registration address refers to the address information provided by the target website when applying for a digital certificate (i.e., the target website certificate). It is part of the identity information of the website certificate owner. It clarifies the geographical location or registration place of the certificate owner, which helps to further confirm the identity of the certificate owner in network communications. Especially in cross-border or cross-regional business scenarios, the registration address can provide important information such as the jurisdiction of the certificate owner, assisting in verifying the authenticity and legitimacy of its identity.

[0120] In some implementations, when determining the registration address of the target website certificate, the address of the upper-level root server that issued the target website certificate (the address of the upper-level root CA) can be determined first, and the address of the upper-level root server is used as the registration address of the target website certificate. Exemplarily, the website certificate clearly marks the issuer, that is, the name and related information of the certificate authority (CA). The operating location of well-known CA institutions is mostly open and transparent, and the territorial area to which they belong can be found from their registration or official publications. For example, for large commercial CA institutions, the region to which they belong can be determined, and then the country indirectly associated with the website certificate can be determined. If the website certificate is issued by a root CA institution in a certain target area, it can be preliminarily determined to be related to the target area.

[0121] It is understandable that the autonomous root server is the source of certificate trust, which determines the ownership and management scope of the certificate system. Some regions establish local root CAs to manage website certificates in their regions, and the subject of the certificate management region can be traced back from the root server. For example, if the root CA established in the first region issues a website certificate, it can indicate that the website certificate is under the management framework of the first region.

[0122] It should be noted that the target website certificate can also contain information about the organization to which the website belongs, such as the organization name, registered address, etc. The registered address often contains a national identifier, which can determine the regional jurisdiction of the organization's operations, and thus infer that the certificate issuance service is located in that region. For example, if the company's registered address is in the first region, its website certificate serves the business platform in the first region. Therefore, the registered address is related to the business environment and legal framework of the first region.

[0123] In addition, the target website certificate is often closely tied to the domain name, and the domain name registration information includes the registrant's nationality or the country where the registration management agency is located. Most countries have their own domain name registration management agencies. Based on the domain name suffix (such as ".cn", ".us", etc.) and the region where the registration management agency is located, the region to which the target website corresponding to the target website certificate belongs can be determined, thereby determining the registration address.

[0124] Through the above method, the target website certificate returned by the target server and the website certificate chain corresponding to the target website certificate can be obtained. Then, the terminal also determines the registration address of the target website to determine whether it has access rights to the target website corresponding to the target URL, so that certificate verification can be performed later when it has access rights, thereby determining whether the website is trustworthy at the current moment and improving the reliability of website access.

[0125] 103. When it is detected that the registration address of the target website certificate is the second region and the website certificate chain includes the first root certificate, multiple hierarchical certificates indicated by the website certificate chain are verified in sequence to obtain a verification result.

[0126] In an embodiment of the present application, after obtaining the target website certificate, the website certificate chain, and determining the registration address of the target website certificate, it can be determined whether the registration address belongs to the first area and the second area associated in the certificate trust alliance system. If it is determined that the registration address of the target website certificate is the second area, and the website certificate chain contains the first root certificate, it means that the target browser with the built-in first root certificate has access rights to the target website. At this time, it is necessary to further verify the multiple hierarchical certificates indicated by the website certificate chain to determine whether the certificates on the website certificate chain are safe and reliable, thereby improving the security of website access.

[0127] In some implementations, "sequentially verifying multiple hierarchical certificates indicated by the website certificate chain to obtain verification results" in step 103 may include:

[0128] (103.1) sequentially determine the target website certificate of the first level in the website certificate chain, and the superior certificates of other levels after the target website certificate;

[0129] (103.2) Obtaining the initial superior certificate for issuing the target website certificate, and obtaining the website certificate content of the target website certificate;

[0130] (103.3) Decrypt the signature information of the target website certificate according to the public key of the initial superior certificate to obtain the content to be compared;

[0131] (103.4) When the content to be compared is consistent with the content of the website certificate, it is confirmed that the verification of the first-level certificate in the website certificate chain has passed;

[0132] (103.5) According to the method of decrypting the next-level certificate by the public key of the previous-level certificate, the upper-level certificates of other levels in the website certificate chain are verified in sequence to obtain the verification result.

[0133] Among them, the website certificate chain can contain multiple levels of certificates. The first level in the website certificate chain is the target website certificate, which is regarded as the lowest level, and the certificate adjacent to the target website certificate in the website certificate chain is the second-level certificate. The second-level certificate is the upper-level certificate of the target website certificate, that is, the initial upper-level certificate. The target website certificate is issued by the second-level certificate. If the website certificate chain also includes a third-level certificate, the third-level certificate is the upper-level certificate of the second-level certificate. For other levels of certificates, the above examples can be used for analogy, and they will not be repeated here.

[0134] Specifically, first, determine the target website certificate of the first level in the website certificate chain, and determine the superior certificates of other levels after the target website certificate, determine the initial superior certificate that issues the target website certificate from the superior certificates of other levels, that is, the second-level certificate, and obtain the website certificate content of the target website certificate, which is not limited to the public key, identity identifier (such as number, website, domain name, etc.), certificate validity period, etc. of the website certificate. Then, according to the public key of the second-level certificate, decrypt the signature information of the target website certificate to obtain the decrypted content, that is, the content to be compared, and compare the content to be compared with the website certificate content of the target website certificate one by one to determine whether they are consistent, such as whether the public keys are consistent, whether the identity identifiers are consistent, whether the certificate validity period is consistent, etc. If the two are consistent, it means that the verification of the target website certificate has passed.

[0135] Furthermore, the second-level certificate of the website certificate chain is verified until each level of the certificate in the website certificate chain is verified. Specifically, the upper-level certificates of other levels in the website certificate chain can be verified in sequence in the manner of decrypting the lower-level certificate with the public key of the upper-level certificate to obtain the verification result. In this way, the certificates of multiple levels on the website certificate chain can be verified level by level, and the signature information of the lower-level certificate can be decrypted using the public key of the upper-level certificate to verify the legitimacy and security of the certificates at each level based on the decrypted content, to ensure that the certificates on the website certificate chain are credible, to ensure the security and credibility of the target website to be visited, and to improve the security of cross-regional website access.

[0136] In some embodiments, the superior certificate of the last level in the website certificate chain is the first root certificate, and step (103.5) may include: performing incremental signature verification on any superior certificate in the website certificate chain except the first root certificate in sequence in a manner of decrypting the next level certificate by the public key of the previous level certificate to obtain a verification sub-result; when it is determined according to the verification sub-result that the verification progress reaches the target superior certificate of the next level of the first root certificate, obtaining the reference certificate content corresponding to the target superior certificate, and decrypting the signature information of the target superior certificate according to the public key of the first root certificate to obtain the target decrypted content; when the reference certificate content is consistent with the target decrypted content, determining the verification result as a passed verification of each level certificate indicated in the website certificate chain; when the reference certificate content is inconsistent with the target decrypted content, determining the verification result as a failed verification of each level certificate indicated in the website certificate chain.

[0137] Among them, the target superior certificate refers to the superior certificate of the target website certificate. Specifically, the target website certificate belongs to the bottom-level certificate in the website certificate chain. The target superior certificate is relative to the target website certificate, and the first root certificate is the highest-level superior certificate in the current website certificate chain. It is ranked at the penultimate level to indicate the highest level.

[0138] Specifically, for the superior certificates from the second level to the penultimate level (i.e., the highest level such as the level below the first autonomous root) in the website certificate chain, the signature verification is performed in sequence on any superior certificate except the first root certificate in the website certificate chain in a layer-by-layer incremental manner according to the method of decrypting the next-level certificate using the public key of the previous-level certificate to obtain the verification sub-result.

[0139] For example, in this verification process, for each level certificate, the public key of the next level certificate in the website certificate chain is used to decrypt the signature information of the previous level certificate. For example, the public key of the third level certificate decrypts the signature information of the second level certificate, and the public key of the fourth level certificate decrypts the signature information of the third level certificate, and so on. The decrypted target content is compared with the content of the corresponding level certificate. For example, the target content obtained by decrypting the second level certificate using the private key of the third level certificate is compared with the content of the second level certificate for verification. If the verification passes, the signature information of the third level certificate is decrypted using the public key of the fourth level certificate for verification, and so on. The verification is implemented in a step-by-step incremental verification manner for the superior certificates from the second level to the penultimate level (i.e., the highest level such as the next level of the first autonomous root) in the website certificate chain.

[0140] When the verification result is that the verification of the superior certificate at the third-to-last level in the website certificate chain is passed, the verification of the superior certificate at the third-to-last level in the website certificate chain begins, that is, the current verification progress reaches the target superior certificate at the next level of the first root certificate. At this time, the reference certificate content corresponding to the target superior certificate is obtained, and the signature information of the target superior certificate is decrypted according to the public key of the first root certificate to obtain the target decrypted content; further, the target decrypted content is compared with the reference certificate content. If the reference certificate content is consistent with the target decrypted content, the verification result is determined to be that the verification of each level certificate indicated by the website certificate chain is passed; if the reference certificate content is inconsistent with the target decrypted content, the verification result is determined to be that the verification of each level certificate indicated by the website certificate chain is failed.

[0141] It should be noted that the relevant content such as "decrypted content", "target decrypted content", "target content obtained by decryption" in the embodiments of the present application can also be hash values, which are compared by decrypting the hash values ​​to determine whether the verification is passed. Exemplarily, the target browser will perform a hash operation on the content of the subordinate certificate (except the signature part) to obtain a hash value, and then use the public key in the superior certificate to decrypt the signature part in the subordinate certificate to obtain another hash value. If the two hash values ​​are equal, it means that the certificate has not been tampered with after signing, and the signature is valid. For example, for a website certificate, the browser uses the public key in the intermediate CA1 certificate to verify its signature; for an intermediate CA1 certificate, the browser uses the public key in the root CA2 certificate to verify its signature.

[0142] Furthermore, in addition to signature verification, the browser will also check the integrity and validity of the certificate chain, including whether the certificate is within the validity period, whether the certificate has been revoked (by querying the certificate revocation list or the Online Certificate Status Protocol), whether all certificates in the website's certificate chain form a continuous chain of trust (that is, whether the issuer of each certificate is consistent with the subject of the parent certificate), etc. If any problems are found during the verification process, such as expired certificates, invalid signatures, or revoked certificates, the browser will prompt the user that there is a security risk and may block access to the website.

[0143] After that, if the entire certificate chain is verified and the root CA certificate (such as the first root certificate) is trusted by the target browser (usually because the root CA certificate is pre-built into the browser's trust store or recognized through other trust mechanisms), the target browser considers the website certificate to be trustworthy, and can establish a secure connection and continue to communicate with the website. At this point, the user can access the website normally, and in subsequent communications, the browser will use the public key in the website certificate to encrypt the data to ensure the confidentiality and integrity of the data during transmission.

[0144] Through the above method, it can be determined whether the registration address belongs to the first area and the second area associated in the certificate trust alliance system. If it is determined that the registration address of the target website certificate is the second area, and the website certificate chain contains the first root certificate, it means that the target browser with the built-in first root certificate has access rights to the target website. At this time, it is necessary to further verify the multiple hierarchical certificates indicated by the website certificate chain to determine whether the certificates on the website certificate chain are safe and reliable, thereby improving the security of website access.

[0145] 104. When the verification result is that the verification of each level certificate indicated by the website certificate chain is passed, it is confirmed that the website certificate chain is a certificate trust chain formed based on the first root certificate, and the target website address is determined as a shared website address issued by the certificate trust alliance system.

[0146] In an embodiment of the present application, after verifying the multiple hierarchical certificates indicated by the website certificate chain in sequence to obtain verification results, if the verification result indicates that the verification of each hierarchical certificate indicated by the website certificate chain is passed, it means that the first autonomous root trusts each certificate on the website certificate chain. Therefore, the website certificate chain is determined to be a certificate trust chain formed based on the first root certificate. Since the target browser has the first root certificate built in, the target browser is trustworthy to the target website corresponding to the target URL. Therefore, the target URL is determined to be a shared website address issued by the certificate trust alliance system, indicating that the target website corresponding to the target URL with a registered address in the second area is shared with users in other areas within the trust alliance. For example, taking the first certificate service system in the first area and the second certificate service system in the second area to form a certificate trust alliance system as an example, it means that a browser with the first root certificate and / or the second root certificate can access the shared website address. In this way, on the basis of each area having an autonomous root, cross-regional certificate trust transmission and sharing are realized, thereby realizing cross-regional website access with reliability.

[0147] Among them, the shared website address can be the website address under the entire trust alliance system, and the browser or application holding the root certificate of any region under the alliance system can access the shared website address. Specifically, the autonomous root certificate of each region in the trust alliance can directly issue one or more website certificates, or the intermediate root under the autonomous root service system can issue one or more website certificates. Each website certificate corresponds to a website. The certificate trust alliance system created between autonomous root services in different regions can use the address of the website issued by each region as the shared website address under the certificate trust alliance system. It should be noted that when confirming whether a URL is a shared website address under the certificate trust alliance system, the certificate chain needs to be verified. Only when the verification passes and it is determined to be trusted by the autonomous roots of one or more regions, can it be confirmed that the URL belongs to the shared website address under the certificate trust alliance system, and then the target website of the shared website address can be accessed.

[0148] In some embodiments, it can be confirmed whether the website certificate chain contains a second trusted intermediate root certificate of the second region issued by the private key of the first root certificate. If so, it is determined that the website certificate chain is a certificate trust chain formed based on the first root certificate, and the target website address is determined to be a shared website address issued by the certificate trust alliance system. For example, "confirming that the website certificate chain is a certificate trust chain formed based on the first root certificate, and determining the target website address as a shared website address issued by the certificate trust alliance system" in step 104 may include: when the website certificate chain contains at least one hierarchical certificate belonging to the second region that is directly issued by the first root certificate, the website certificate chain is determined to be a certificate trust chain formed based on the first root certificate; and the target website address corresponding to the target website certificate on the certificate trust chain is determined to be a shared website address issued by the certificate trust alliance system.

[0149] Specifically, when the verification result indicates that the verification of each hierarchical certificate has passed, it is further determined whether the website certificate chain contains at least one hierarchical certificate belonging to the second region that is directly issued by the first root certificate, that is, whether the private key of the first root certificate has previously issued the information of the second intermediate root of the second region to obtain the second trusted intermediate root certificate, and the second trusted intermediate root certificate is located on the current website certificate chain. If it exists, it is determined that the first root certificate trusts the second intermediate root issued by the second region, and then it is confirmed that the website certificate chain containing the second trusted intermediate root certificate is a certificate trust chain formed based on the first root certificate. Further, the target website corresponding to the target website can be understood as a trusted website on the certificate trust chain, and the target website is trusted by the first autonomous root. Therefore, the target website is a shared website address issued by the certificate trust alliance system, specifically a shared website address issued by the second certificate service system of the second region in the certificate trust alliance system. In this way, certificates can be shared and transferred in the trust alliance, and cross-regional transfer of trust relationships can be realized, such as trust transfer across national regions, to meet users' security access needs for cross-regional websites.

[0150] Through the above method, when the verification of each level certificate indicated by the website certificate chain is passed, it can be confirmed that the website certificate chain is a certificate trust chain formed based on the first root certificate, and the target browser with the first root certificate built-in is trustworthy to the target website corresponding to the target URL. Therefore, the target URL is determined to be a shared website address issued by the certificate trust alliance system. Based on this, a browser with a root certificate of any region in the certificate trust alliance system can access the shared website address. In this way, cross-regional certificate trust transmission and sharing are realized, thereby realizing cross-regional website access with reliability.

[0151] 105. Control the target browser to access the shared website address.

[0152] In an embodiment of the present application, after confirming that the website certificate chain is a certificate trust chain formed based on the first root certificate, and determining the target URL as a shared website address issued by the certificate trust alliance system, since the target browser has a built-in root certificate of the first region, and the first root service system of the first region corresponding to the first root certificate is a member of the certificate trust alliance system, based on the transfer of certificate trust relationships between different regions within the certificate trust alliance system, the target browser with the built-in first root certificate trusts the shared website address. Therefore, the terminal can control the target browser to access the shared website address to obtain the content of the target website corresponding to the shared website address. In this way, the user's demand for secure access to cross-regional websites is met with reliability.

[0153] In the embodiment of the present application, the certificate trust store of the target browser can have both the first root certificate and the second root certificate built in. At this time, even if there is no additional trust connection created between the first certificate service system of the first area and the certificate service system of the second area, a certificate trust alliance system can be established based on the first root certificate and the second root certificate built in the certificate trust store of the target browser, thereby realizing the trust of the root service between the first area and the second area. At this time, when the target browser requests to access the target website, if the registered address of the target website is the first area or the second area, it can be directly accessed.

[0154] In some embodiments, the target browser also has a built-in second root certificate of the second region, and the certificate trust alliance system is based on the built-in first root certificate and the second root certificate of the target browser. The method also includes: when it is detected that the registration address of the target website certificate is the first region or the second region, the target website address is determined as a trusted website address issued under the certificate trust alliance system; and the target browser is controlled to access the trusted website address.

[0155] Specifically, in the case where the target browser has a first root certificate of the first region and a second root certificate of the second region pre-built in, when the target browser triggers a website access request for the target URL, the target server of the target website will return the target website certificate and the corresponding website certificate chain. Furthermore, if it is determined that the registration address of the target website certificate is the first region or the second region, since the target browser has the first root certificate and the second root certificate built in, the websites belonging to the first region or the second region are trustworthy. At this time, it can be understood that there is no problem of cross-regional website access. Therefore, the target URL can be determined as a trusted website address issued under the certificate trust alliance system, and the target browser can be controlled to access the trusted website address.

[0156] It should be noted that the signature verification of each level of certificates in the website certificate chain can also be performed first to obtain the verification result. If the verification result determines that the verification of each level of certificates indicated by the website certificate chain has passed, the target URL is determined to be a trusted website address issued by the certificate trust alliance system, and the target browser is controlled to access the trusted website address. The process of "signature verification of each level of certificates in the website certificate chain" can be referred to above and will not be repeated here.

[0157] In some implementations, since the target browser has a built-in first root certificate, when it is detected that the registration address of the target website certificate is the first region, the target website address is determined to be a trusted website address issued by the first certificate service system; and the target browser is controlled to access the trusted website address. In this way, the target website is issued under the certificate system of the first autonomous root of the first region, avoiding the target website certificate being restricted by the certificate system of other regions, and since the first autonomous root of the first region and the second autonomous root of any other second region except the first region form a certificate trust alliance system, instead of relying on the trust of a single region, it is trusted by other regions, thereby improving the credibility of the digital certificate authentication center of the first region, so that the browser can trust the first root certificate of the first region, and the root certificates of other regions are also trusted by the target browser. In this way, the scope of browser certificate trust is broadened, which is convenient for cross-regional certificate trust and website mutual access, and has reliability.

[0158] In the embodiment of the present application, the target browser can detect changes in certificate status (such as revocation, expiration, etc.) in real time and process them immediately. Specifically, a system is established that can monitor the status of certificates within the alliance in real time. When the certificate status changes abnormally, an early warning is issued to the relevant parties in a timely manner to further improve the security and reliability of network communications, ensure that users can know the validity of the certificate in a timely manner when visiting the website, and avoid security risks caused by certificate problems.

[0159] In some implementations, the target browser may detect the certificate status of the built-in first root certificate in real time, and when the certificate status of the first root certificate is abnormal, request to update the first root certificate with the abnormal certificate status. Specifically, before step 105, it may include:

[0160] At preset intervals, the certificate status of the first root certificate built into the target browser is obtained; when the certificate status of the first root certificate is abnormal, the abnormal status prompt information of the first root certificate is sent to the target page of the target browser; when a certificate update request triggered by the abnormal status prompt information is detected, a first root certificate update request is generated according to the first root certificate identifier corresponding to the first root certificate, and the first root certificate update request is sent to the first certificate service system; the target first root certificate sent back by the first certificate service system is obtained, and the target first root certificate is installed into the certificate trust store of the target browser. Then step 105 includes: when it is detected that the target browser has completed installing the target first root certificate, the target browser is controlled to access the shared website address.

[0161] For example, the terminal can periodically (e.g., every hour) detect the certificate status information built into the target browser, and the certificate status information is not limited to the certificate serial number, validity period, revocation status, etc. This information can be transmitted through a secure communication protocol (e.g., HTTPS) to ensure the confidentiality and integrity of the information during transmission. The acquired certificate status information is analyzed in real time. By comparing the current status of the first root certificate with the previously recorded status and checking whether the validity period of the certificate is approaching, it is determined whether the certificate is in a normal state. For revoked certificates, the monitoring server records the revocation time and reason; for certificates that are about to expire (e.g., the remaining validity period is less than one week), it is marked as a warning state. Further, when an abnormal certificate status (e.g., revocation or warning) is detected, the display interface / page of the target browser can be displayed to push warning information. The push method of warning information can be diversified, for example, sending email notifications, publishing alarm messages, and / or displaying on the page of the target browser through images, animations, dynamic pictures, etc. It will prompt whether to actively request to update the first root certificate. If the user triggers the update of the first root certificate with abnormal certificate status through the target browser, the new target first root certificate will be downloaded from the first certificate service system, and the new target first root certificate will be installed in the certificate trust store of the target browser to replace the original first root certificate with abnormal certificate status, thereby improving the security of website access.

[0162] As can be seen from the above, the website access method based on the alliance root certificate of the embodiment of the present application is applied to a terminal, and the target browser on the terminal has at least a first root certificate built in. The first root certificate is issued by a first certificate service system in the first area. The first certificate service system and the second certificate service system in the second area form a certificate trust alliance system, and the website access request triggered by the target browser for the target website address is obtained, and the website access request is sent to the target server corresponding to the target website address; the target website certificate and the corresponding website certificate chain fed back by the target server for the target website address are obtained, and the registration address of the target website certificate is determined; when it is detected that the registration address of the target website certificate is the second area, and the website certificate chain contains the first root certificate, the multiple hierarchical certificates indicated by the website certificate chain are verified in sequence to obtain the verification result; when the verification result is that the verification of each hierarchical certificate indicated by the website certificate chain is passed, it is confirmed that the website certificate chain is a certificate trust chain formed based on the first root certificate, and the target website address is determined as a shared website address issued by the certificate trust alliance system; the target browser is controlled to access the shared website address.

[0163] Based on this, by embedding the first root certificate of the first area on the target browser, and the certificate service system of the first area and the certificate service system of the second area form a certificate trust alliance system. Based on this, when the target browser on the terminal needs to access the target website corresponding to the target URL, the target server corresponding to the target website will return the target website certificate and the corresponding website certificate chain information corresponding to the target URL. Furthermore, if the registration place of the target website certificate belongs to the second area, and the website certificate chain contains the first root certificate, the multiple hierarchical certificates indicated by the website certificate chain are verified level by level in sequence to obtain the verification result. Finally, if the verification result indicates that each hierarchical certificate indicated by the website certificate chain has been verified, it is confirmed that the website certificate chain is a certificate trust chain formed based on the first root certificate, and the target URL is a shared website address issued by the certificate trust alliance system. The target browser with the built-in first root certificate can access the shared website address. In this way, the first region and the second region both have independent certificate service systems (i.e., digital certificate authentication systems), which prevents the management rights of website certificates from being restricted by other regions and the risk of website certificate revocation or suspension. In addition, the certificate service systems of the first region and the second region form a certificate trust alliance, which improves the credibility of digital certificate authentication centers between different regions and meets the needs for access to websites issued by digital certificate authentication centers in other regions.

[0164] The specific implementation of the above steps can be found in the previous embodiments, which will not be described in detail here.

[0165] In order to facilitate better implementation of the website access method based on the alliance root certificate provided in the embodiment of the present application, the embodiment of the present application also provides a system architecture based on the above-mentioned website access method based on the alliance root certificate. The meanings of the terms are the same as those in the above-mentioned website access method based on the alliance root certificate, and the specific implementation details can refer to the description in the method embodiment.

[0166] See also Figure 8 , Figure 8 The schematic diagram of the architecture of the website access system based on the alliance root certificate provided in the embodiment of the present application, the website access system based on the alliance root certificate may include a target node and a target delegation node.

[0167] The acquisition unit 401 is used to acquire a website access request triggered by a target browser for a target website, and send the website access request to a target server corresponding to the target website;

[0168] The determination unit 402 is used to obtain the target website certificate and the corresponding website certificate chain fed back by the target server for the target website, and determine the registration address of the target website certificate;

[0169] The verification unit 403 is used to verify the multiple hierarchical certificates indicated by the website certificate chain in sequence to obtain a verification result when it is detected that the registration address of the target website certificate is the second area and the website certificate chain includes the first root certificate;

[0170] The confirmation unit 404 is used to confirm that the website certificate chain is a certificate trust chain formed based on the first root certificate when the verification result is that the verification of each level certificate indicated by the website certificate chain is passed, and determine the target website address as a shared website address issued by the certificate trust alliance system;

[0171] The access unit 405 is used to control the target browser to access the shared website address.

[0172] In some implementations, the verification unit 403 is further configured to:

[0173] Determine in sequence the target website certificate of the first level in the website certificate chain and the superior certificates of other levels after the target website certificate;

[0174] Obtain the initial superior certificate for issuing the target website certificate, and obtain the website certificate content of the target website certificate;

[0175] Decrypt the signature information of the target website certificate according to the public key of the initial superior certificate to obtain the content to be compared;

[0176] When the content to be compared is consistent with the content of the website certificate, it is confirmed that the verification of the first-level certificate in the website certificate chain has passed;

[0177] By decrypting the next-level certificate using the public key of the previous-level certificate, the upper-level certificates of other levels in the website certificate chain are verified in sequence to obtain the verification result.

[0178] In some implementations, the upper certificate of the last level in the website certificate chain is the first root certificate; the verification unit 403 is further used to:

[0179] According to the method of decrypting the next-level certificate with the public key of the previous-level certificate, perform incremental signature verification on any upper-level certificate in the website certificate chain except the first root certificate to obtain the verification sub-result;

[0180] When it is determined according to the verification sub-result that the verification progress reaches the target superior certificate of the next level of the first root certificate, the reference certificate content corresponding to the target superior certificate is obtained, and the signature information of the target superior certificate is decrypted according to the public key of the first root certificate to obtain the target decrypted content;

[0181] When the reference certificate content is consistent with the target decrypted content, the verification result is determined to be that the verification of each level certificate indicated by the website certificate chain is passed;

[0182] When the reference certificate content is inconsistent with the target decrypted content, it is determined that the verification result is that the verification of each level certificate indicated by the website certificate chain fails.

[0183] In some implementations, the confirmation unit 404 is further configured to:

[0184] When the website certificate chain includes at least one hierarchical certificate belonging to the second zone that is directly issued by the first root certificate, determining the website certificate chain as a certificate trust chain formed based on the first root certificate;

[0185] The target website address corresponding to the target website certificate on the certificate trust chain is determined to be a shared website address issued by the certificate trust alliance system.

[0186] In some implementations, the certificate trust alliance system is formed by signing the second certificate service information of the second certificate service system with the first root certificate, and signing the first certificate service information of the first certificate service system with the second root certificate of the second region.

[0187] In some embodiments, the first certificate service information includes first root service information corresponding to the first root certificate, and the second certificate service information includes second root service information corresponding to the second root certificate belonging to the second region;

[0188] The certificate trust alliance system is composed of a first certificate service system and a second certificate service system after the first root certificate completes signing the second root service information of the second area and the second root certificate completes signing the first root service information of the first area.

[0189] In some embodiments, the first certificate service information includes first intermediate service information trusted by a first root certificate in a first region, and the second certificate service information includes second intermediate service information trusted by a second root certificate in a second region;

[0190] The certificate trust alliance system is composed of a first certificate service system and a second certificate service system after the first root certificate completes signing the second intermediate service information and the second root certificate completes signing the first intermediate service information.

[0191] In some embodiments, the target browser also has a second root certificate of the second region built in, and the certificate trust alliance system is composed of the first root certificate and the second root certificate built in the target browser;

[0192] The website access device based on the alliance root certificate also includes a second access unit, which is used to:

[0193] When it is detected that the registration address of the target website certificate is the first area or the second area, the target website address is determined to be a trusted website address issued under the certificate trust alliance system;

[0194] Control the target browser to access trusted website addresses.

[0195] In some implementations, the website access apparatus based on the federation root certificate further includes a third access unit, configured to:

[0196] When it is detected that the registration address of the target website certificate is in the first region, the target website address is determined to be a trusted website address issued by the first certificate service system;

[0197] Control the target browser to access trusted website addresses.

[0198] As can be seen from the above, in the embodiment of the present application, the first root certificate of the first area is built into the target browser, and the certificate service system of the first area and the certificate service system of the second area form a certificate trust alliance system. Based on this, when the target browser on the terminal needs to access the target website corresponding to the target URL, the target server corresponding to the target website will return the target website certificate and the corresponding website certificate chain information corresponding to the target URL. Furthermore, if the registration place of the target website certificate belongs to the second area, and the website certificate chain contains the first root certificate, the multiple hierarchical certificates indicated by the website certificate chain are verified level by level in sequence to obtain the verification result. Finally, if the verification result indicates that each hierarchical certificate indicated by the website certificate chain has been verified, it is confirmed that the website certificate chain is a certificate trust chain formed based on the first root certificate, and the target URL is a shared website address issued by the certificate trust alliance system. The target browser with the built-in first root certificate can access the shared website address. In this way, the first region and the second region both have independent certificate service systems (i.e., digital certificate authentication systems), which prevents the management rights of website certificates from being restricted by other regions and the risk of website certificate revocation or suspension. In addition, the certificate service systems of the first region and the second region form a certificate trust alliance, which improves the credibility of digital certificate authentication centers between different regions and meets the needs for access to websites issued by digital certificate authentication centers in other regions.

[0199] The specific implementation of each of the above units can be found in the previous embodiments, which will not be described in detail here.

[0200] Reference Fig. 9 , Fig. 9 To implement the structural block diagram of part of the terminal 140 of the embodiment of the present disclosure, the terminal 140 includes: a radio frequency (RF) circuit 510, a memory 515, an input unit 530, a display unit 540, a sensor 550, an audio circuit 560, a wireless fidelity (WiFi) module 570, a processor 580, and a power supply 590. Those skilled in the art will understand that the structure of the terminal 140 shown in the figure does not constitute a limitation on mobile phones or computers, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0201] The RF circuit 510 may be used for receiving and sending signals during information transmission or communication. In particular, after receiving downlink information from the base station, the information is sent to the processor 580 for processing. In addition, the uplink data is sent to the base station.

[0202] The memory 515 may be used to store software programs and modules. The processor 580 executes various functional applications and data processing of the terminal by running the software programs and modules stored in the memory 515 .

[0203] The input unit 530 may be used to receive input digital or character information and generate key signal input related to the terminal's settings and function control. Specifically, the input unit 530 may include a touch panel 531 and other input devices 532 .

[0204] The display unit 540 may be used to display input information or provided information and various menus of the terminal. The display unit 540 may include a display panel 541 .

[0205] The audio circuit 560 , the speaker 561 , and the microphone 562 may provide an audio interface.

[0206] In this embodiment, the processor 580 included in the terminal 140 can execute the website access method based on the alliance root certificate of the previous embodiment.

[0207] The terminal 140 of the embodiment of the present disclosure includes but is not limited to mobile phones, computers, intelligent voice interaction devices, smart home appliances, vehicle terminals, aircraft, etc. The embodiment of the present invention can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, assisted driving, etc.

[0208] Fig.10 The structural block diagram of part of the server 110 for implementing the embodiment of the present disclosure. The server 110 may have relatively large differences due to different configurations or performances, and may include one or more central processing units (CPU) 622 (for example, one or more processors) and a memory 632, and one or more storage media 620 (for example, one or more mass storage devices) storing application programs 642 or data 644. Among them, the memory 632 and the storage medium 620 can be temporary storage or permanent storage. The program stored in the storage medium 620 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations in the server 110. Furthermore, the central processing unit 622 can be configured to communicate with the storage medium 620 and execute a series of instruction operations in the storage medium 620 on the server 110.

[0209] The server 110 may also include one or more power supplies 626, one or more wired or wireless network interfaces 650, one or more input and output interfaces 658, and / or one or more operating systems 641, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0210] The central processor 622 in the server 110 may be used to execute the website access method based on the federation root certificate of the embodiment of the present disclosure, which is specifically as follows:

[0211] Applied to a terminal, a target browser on the terminal has at least a first root certificate built in, the first root certificate is issued by a first certificate service system in a first area, the first certificate service system and a second certificate service system in a second area form a certificate trust alliance system, by obtaining a website access request triggered by a target browser for a target website, the website access request is sent to a target server corresponding to the target website; the target website certificate and the corresponding website certificate chain fed back by the target server for the target website are obtained, and the registration address of the target website certificate is determined; when it is detected that the registration address of the target website certificate is the second area, and the website certificate chain contains the first root certificate, multiple hierarchical certificates indicated by the website certificate chain are verified in sequence to obtain a verification result; when the verification result is that the verification of each hierarchical certificate indicated by the website certificate chain is passed, it is confirmed that the website certificate chain is a certificate trust chain formed based on the first root certificate, and the target website is determined as a shared website address issued by the certificate trust alliance system; and the target browser is controlled to access the shared website address.

[0212] The embodiment of the present disclosure further provides a computer-readable storage medium, which is used to store program codes, and the program codes are used to execute the website access method based on the alliance root certificate of each of the above embodiments, which is as follows:

[0213] Applied to a terminal, a target browser on the terminal has at least a first root certificate built in, the first root certificate is issued by a first certificate service system in a first area, the first certificate service system and a second certificate service system in a second area form a certificate trust alliance system, by obtaining a website access request triggered by a target browser for a target website, the website access request is sent to a target server corresponding to the target website; the target website certificate and the corresponding website certificate chain fed back by the target server for the target website are obtained, and the registration address of the target website certificate is determined; when it is detected that the registration address of the target website certificate is the second area, and the website certificate chain contains the first root certificate, multiple hierarchical certificates indicated by the website certificate chain are verified in sequence to obtain a verification result; when the verification result is that the verification of each hierarchical certificate indicated by the website certificate chain is passed, it is confirmed that the website certificate chain is a certificate trust chain formed based on the first root certificate, and the target website is determined as a shared website address issued by the certificate trust alliance system; and the target browser is controlled to access the shared website address.

[0214] The embodiment of the present disclosure also provides a computer program product, which includes a computer program. A processor of a computer device reads and executes the computer program, so that the computer device executes the above-mentioned website access method based on the alliance root certificate.

[0215] In addition, the terms "comprises" and "includes" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, apparatus, product or device that includes a series of steps or elements is not necessarily limited to those steps or elements explicitly listed, but may include other steps or elements not explicitly listed or inherent to such process, method, product or device.

[0216] It should be understood that in the present disclosure, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0217] It should be understood that in the description of the embodiments of the present disclosure, the meaning of multiple (or multiple items) is more than two, greater than, less than, exceed, etc. are understood as not including the number, and above, below, within, etc. are understood as including the number.

[0218] In the several embodiments provided in the present disclosure, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0219] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0220] In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0221] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present disclosure is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present disclosure. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store program codes.

[0222] It should also be understood that the various implementations provided in the embodiments of the present disclosure can be combined arbitrarily to achieve different technical effects.

[0223] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program that has a predetermined function and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories), or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0224] The above is a specific description of the implementation methods of the present disclosure, but the present disclosure is not limited to the above implementation methods. Technical personnel familiar with the art can also make various equivalent modifications or substitutions without violating the spirit of the present disclosure. These equivalent modifications or substitutions are all included in the scope defined by the claims of the present disclosure.

Claims

1. A website access method based on an alliance root certificate, characterized in that: Applied to a terminal, a target browser on the terminal has at least a first root certificate built in, the first root certificate is issued by a first certificate service system in a first region, the first certificate service system and a second certificate service system in a second region form a certificate trust alliance system, the method comprising: Obtaining a website access request triggered by the target browser for a target website, and sending the website access request to a target server corresponding to the target website; Obtaining the target website certificate and the corresponding website certificate chain fed back by the target server for the target website, and determining the registration address of the target website certificate; When it is detected that the registration address of the target website certificate is the second region, and the website certificate chain includes the first root certificate, sequentially verifying multiple hierarchical certificates indicated by the website certificate chain to obtain a verification result; When the verification result is that the verification of each level certificate indicated by the website certificate chain is passed, confirming that the website certificate chain is a certificate trust chain formed based on the first root certificate, and determining the target website address as a shared website address issued by the certificate trust alliance system; The target browser is controlled to access the shared website address.

2. The website access method based on the alliance root certificate according to claim 1, characterized in that: The step of sequentially verifying the multiple hierarchical certificates indicated by the website certificate chain to obtain verification results includes: Determine in sequence the target website certificate of the first level in the website certificate chain, and the superior certificates of other levels after the target website certificate; Obtaining the initial superior certificate for issuing the target website certificate, and obtaining the website certificate content of the target website certificate; Decrypt the signature information of the target website certificate according to the public key of the initial superior certificate to obtain the content to be compared; When the content to be compared is consistent with the content of the website certificate, it is confirmed that the verification of the first-level certificate in the website certificate chain has passed; In a manner of decrypting the next-level certificate using the public key of the previous-level certificate, the upper-level certificates of other levels in the website certificate chain are verified in sequence to obtain a verification result.

3. The website access method based on the alliance root certificate according to claim 2, characterized in that: The upper certificate of the last level in the website certificate chain is the first root certificate; The method of decrypting the next-level certificate by the public key of the previous-level certificate sequentially verifies the upper-level certificates of other levels in the website certificate chain to obtain verification results, including: In accordance with the method of decrypting the next-level certificate by the public key of the previous-level certificate, sequentially perform a level-by-level incremental signature verification on any upper-level certificate in the website certificate chain except the first root certificate to obtain a verification sub-result; When it is determined according to the verification sub-result that the verification progress reaches the target superior certificate of the next level of the first root certificate, obtaining the reference certificate content corresponding to the target superior certificate, and decrypting the signature information of the target superior certificate according to the public key of the first root certificate to obtain the target decrypted content; When the reference certificate content is consistent with the target decrypted content, determining that the verification result is that the verification of each level certificate indicated by the website certificate chain is passed; When the reference certificate content is inconsistent with the target decrypted content, it is determined that the verification result is that the verification of each level certificate indicated by the website certificate chain fails.

4. The website access method based on the alliance root certificate according to any one of claims 1 to 3, characterized in that: The step of confirming that the website certificate chain is a certificate trust chain formed based on the first root certificate, and determining the target website address as a shared website address issued by the certificate trust alliance system, includes: When the website certificate chain includes at least one hierarchical certificate belonging to the second zone that is directly issued by the first root certificate, determining the website certificate chain as a certificate trust chain formed based on the first root certificate; The target website address corresponding to the target website certificate on the certificate trust chain is determined to be a shared website address issued by the certificate trust alliance system.

5. The website access method based on the alliance root certificate according to claim 4 is characterized in that: The certificate trust alliance system is formed by the first root certificate signing the second certificate service information of the second certificate service system, and the second root certificate of the second area signing the first certificate service information of the first certificate service system.

6. The website access method based on the alliance root certificate according to claim 5, characterized in that: The first certificate service information includes first root service information corresponding to the first root certificate, and the second certificate service information includes second root service information corresponding to a second root certificate belonging to the second region; The certificate trust alliance system is composed of the first certificate service system and the second certificate service system after the first root certificate completes signing the second root service information of the second area and the second root certificate completes signing the first root service information of the first area.

7. The website access method based on the alliance root certificate according to claim 5, characterized in that: The first certificate service information includes first intermediate service information trusted by the first root certificate in the first region, and the second certificate service information includes second intermediate service information trusted by the second root certificate in the second region; The certificate trust alliance system is composed of the first certificate service system and the second certificate service system after the first root certificate completes signing the second intermediate service information and the second root certificate completes signing the first intermediate service information.

8. The website access method based on the alliance root certificate according to any one of claims 1 to 3, characterized in that: The target browser also has a second root certificate of the second zone built in, the certificate trust alliance system is composed based on the first root certificate and the second root certificate built in the target browser, and the method further includes: When it is detected that the registration address of the target website certificate is the first area or the second area, determining the target website address as a trusted website address issued by the certificate trust alliance system; The target browser is controlled to access the trusted website address.

9. The website access method based on the alliance root certificate according to any one of claims 1 to 3, characterized in that: The method further comprises: When it is detected that the registration address of the target website certificate is the first area, determining the target website address as a trusted website address issued by the first certificate service system; The target browser is controlled to access the trusted website address.

10. A website access device based on an alliance root certificate, characterized in that: Applied to a terminal, a target browser on the terminal has at least a first root certificate built in, the first root certificate is issued by a first certificate service system in a first area, the first certificate service system and a second certificate service system in a second area form a certificate trust alliance system, including: An acquisition unit, configured to acquire a website access request triggered by the target browser for a target website, and send the website access request to a target server corresponding to the target website; A determination unit, configured to obtain a target website certificate and a corresponding website certificate chain fed back by the target server for the target website, and determine a registration address of the target website certificate; a verification unit, configured to, when detecting that the registration address of the target website certificate is the second region and the website certificate chain includes the first root certificate, sequentially verify the multiple hierarchical certificates indicated by the website certificate chain to obtain a verification result; a confirmation unit, configured to, when the verification result is that the verification of each level certificate indicated by the website certificate chain is passed, confirm that the website certificate chain is a certificate trust chain formed based on the first root certificate, and determine the target website address as a shared website address issued by the certificate trust alliance system; The access unit is used to control the target browser to access the shared website address.

11. A computer device, characterized in that: The computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the website access method based on the alliance root certificate according to any one of claims 1 to 9 is implemented.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the website access method based on the alliance root certificate as described in any one of claims 1 to 9.

Images