A batch fully automated certificate automatic detection and renewal method and system

Abstract

The patent application of the present invention provides a method and system for automatic detection and renewal of certificates in batches, including: based on the acquired certificate key information of the batch certificates, using a detection engine to identify the certificates to be renewed from the batch certificates; generating a corresponding certificate renewal task according to the certificates to be renewed; according to the certificate renewal task, using multiple encryption technologies to autonomously interact with the certificate issuing authority for certificate renewal to complete the certificate renewal task; the present invention solves the problem that the manual renewal process is complicated and prone to errors by identifying the certificates to be renewed from the batch certificates and performing autonomous certificate renewal interactions; and multiple security encryptions are performed on the certificate renewal tasks during the interaction process to prevent data leakage or tampering, thereby improving data security protection; the present invention can intelligently detect certificates that are about to expire, automatically initiate the renewal process and complete the replacement deployment of certificates to reduce the risk of manual intervention and operational errors.

Description

Technical Field

[0001] The patent application of this invention belongs to the technical field of automatic certificate detection, and specifically relates to a batch fully automated certificate automatic detection and renewal method and system. Background Art

[0002] With the rapid development of the Internet and the popularization of informatization, all walks of life are increasingly relying on digital certificates. As an important part of modern information security, digital certificates are widely used in fields such as identity authentication, data encryption, and communication security, providing reliable security for data transmission between users. Especially in highly sensitive fields such as finance, medical care, e-commerce, and government, the correct use and effective management of digital certificates are crucial. However, as the scale of business continues to expand, the number of certificates that enterprises and institutions need to manage is growing exponentially, which has triggered a series of technical challenges.

[0003] Currently, an important issue in digital certificate management is how to efficiently detect and renew certificates that are about to expire. Certificate expiration can lead to service interruptions, security vulnerabilities, and even significant economic losses. For example, if an enterprise's HTTPS (Hypertext Transfer Protocol Secure) certificate is not renewed in time, the website will be inaccessible or marked as unsafe by the browser; if the enterprise's code signing certificate expires, it may cause users to lose trust in the software, and may even allow malicious attackers to forge signatures, causing security risks. Therefore, ensuring the real-time validity and availability of certificates is an important part of maintaining information security.

[0004] Currently, the detection and renewal of digital certificates mainly rely on manual or semi-automatic management methods. This traditional method has many limitations in large-scale certificate management scenarios: (1) Manual detection is inefficient; (2) The renewal process is complicated and prone to errors; (3) Security guarantees are insufficient. Summary of the invention

[0005] In order to overcome the above-mentioned deficiencies of the prior art, the present invention patent application proposes a batch fully automated certificate automatic detection and renewal method, including:

[0006] Based on the obtained certificate key information of the batch certificates, a detection engine is used to identify the certificates to be renewed from the batch certificates;

[0007] Generate a corresponding certificate renewal task according to the certificate to be renewed;

[0008] According to the certificate renewal task, multiple encryption technologies are used to autonomously interact with the certificate issuing authority to complete the certificate renewal task.

[0009] Preferably, the step of using a detection engine based on the acquired certificate key information of the batch certificates to identify the certificates to be renewed from the batch certificates includes:

[0010] Using a built-in scanning device to scan the batch of certificates to obtain key information of the certificates;

[0011] Based on the key information of the certificates, a pre-set detection engine is used to check the validity period of each certificate in the batch of certificates, and identify the certificates to be renewed;

[0012] The key certificate information includes one or more of the following: certificate type, certificate validity period, certificate issuing authority and certificate associated services.

[0013] Preferably, generating a corresponding certificate renewal task according to the certificate to be renewed includes:

[0014] Classifying the certificates to be renewed according to certificate types to obtain certificates to be renewed for each certificate type;

[0015] According to the validity period of the certificate, setting the certificate expiration status of the certificate to be renewed in each certificate type;

[0016] Generate a corresponding certificate renewal task based on the certificate key information and certificate expiration status of the certificate to be renewed in each certificate type;

[0017] Among them, the certificate types of the batch certificates include one or more of the following: SSL digital certificates and client certificates; the certificate expiration status includes one or more of the following: certificate is about to expire, certificate emergency expiration status; the certificate renewal task includes: the type of certificate to be renewed, the certificate expiration status, the expiration time of the certificate to be renewed, the associated service information and the relevant configuration required for renewal.

[0018] Preferably, the certificate renewal task is completed by using multiple encryption technologies and autonomously interacting with a certificate authority for certificate renewal, including:

[0019] According to the certificate renewal task, matching the renewal process template corresponding to the certificate to be renewed from a preset renewal process template library;

[0020] For the certificate renewal task, multiple encryption technologies are used in combination with the renewal process template, and autonomous interaction is performed with the certificate issuing authority corresponding to the certificate to be renewed through a renewal agreement to complete the certificate renewal task.

[0021] Preferably, the multiple encryption technology includes a quantum key management algorithm and a channel encryption technology; for the certificate renewal task, the multiple encryption technology is used in combination with the renewal process template, and autonomous interaction is performed with the certificate authority corresponding to the certificate to be renewed through a renewal agreement to complete the certificate renewal task, including:

[0022] Using the quantum key management algorithm, encrypting the original key of the certificate to be renewed corresponding to the certificate renewal task to obtain an encrypted certificate to be renewed;

[0023] The encrypted certificate to be renewed and other related documents are used as information exchange data; the other related documents include a renewal request form;

[0024] The channel encryption technology is used to encrypt the interactive channel to obtain an encrypted interactive channel;

[0025] The renewal agreement is adopted, and according to the renewal process template, the information interaction data is sent to the main interface of the certificate issuing authority through the encrypted interaction channel, and autonomous interaction is performed with the certificate issuing authority to complete the certificate renewal task.

[0026] Preferably, the mathematical expression of the quantum encryption key is as follows:

[0027]

[0028] in, is the i-th quantum encryption key, For quantum encryption algorithms, is the ith original key, is the quantum entanglement state value, is the security evaluation value of the i-th original key, For quantum keys.

[0029] Preferably, the renewal agreement is adopted, and according to the renewal process template, the information interaction data is sent to the main interface of the certificate authority through the encrypted interaction channel, and autonomous interaction is performed with the certificate authority to complete the certificate renewal task, including:

[0030] Adopting a renewal agreement and following a renewal process template, sending the information interaction data to a main interface of a certificate issuing authority through the encrypted interaction channel, autonomously interacting with the certificate issuing authority, and obtaining an interaction result;

[0031] When the interaction result shows that the certificate renewal fails, the certificate to be renewed is interacted with the corresponding certificate issuing authority again at a preset time interval;

[0032] When the number of interactions reaches a preset number of interactions, based on the information interaction data, the certificate authority is interacted with through the backup interface of the certificate authority, and the interaction result is fed back;

[0033] When the interaction result shows that the certificate renewal fails, the certificate renewal task is fed back to the administrator, and the certificate renewal task is completed by the administrator.

[0034] Preferably, when the interaction result shows that the certificate renewal fails, the certificate renewal task is fed back to the administrator, and after the administrator completes the certificate renewal task, the method further includes:

[0035] View the renewal information of the certificate through a visual interface;

[0036] The renewal information includes one or more of the following: certificate renewal status, certificate renewal progress and certificate renewal history record.

[0037] Based on the same inventive concept, the patent application of the present invention also provides a batch fully automated certificate automatic detection and renewal system, including: a certificate identification module to be renewed, a certificate renewal task generation module and a certificate renewal task execution module;

[0038] The certificate-to-be-renewed identification module is used to identify the certificates to be renewed from the batch certificates using a detection engine based on the acquired certificate key information of the batch certificates;

[0039] The certificate renewal task generation module is used to generate a corresponding certificate renewal task according to the certificate to be renewed;

[0040] The certificate renewal task execution module is used to autonomously interact with the certificate issuing authority for certificate renewal according to the certificate renewal task by using multiple encryption technologies to complete the certificate renewal task.

[0041] Preferably, the certificate-to-be-renewed identification module is specifically used to:

[0042] Using a built-in scanning device to scan the batch of certificates to obtain key information of the certificates;

[0043] Based on the key information of the certificates, a pre-set detection engine is used to check the validity period of each certificate in the batch of certificates, and identify the certificates to be renewed;

[0044] The key certificate information includes one or more of the following: certificate type, certificate validity period, certificate issuing authority and certificate associated services.

[0045] Preferably, the certificate renewal task generation module is specifically used to:

[0046] Classifying the certificates to be renewed according to certificate types to obtain certificates to be renewed for each certificate type;

[0047] According to the validity period of the certificate, setting the certificate expiration status of the certificate to be renewed in each certificate type;

[0048] Generate a corresponding certificate renewal task based on the certificate key information and certificate expiration status of the certificate to be renewed in each certificate type;

[0049] Among them, the certificate types of the batch certificates include one or more of the following: SSL digital certificates and client certificates; the certificate expiration status includes one or more of the following: certificate is about to expire, certificate emergency expiration status; the certificate renewal task includes: the type of certificate to be renewed, the certificate expiration status, the expiration time of the certificate to be renewed, the associated service information and the relevant configuration required for renewal.

[0050] Preferably, the certificate renewal task execution module includes:

[0051] A renewal process template matching submodule, used to match the renewal process template corresponding to the certificate to be renewed from a preset renewal process template library according to the certificate renewal task;

[0052] The renewal interaction submodule is used to adopt multiple encryption technologies in combination with the renewal process template for the certificate renewal task, and autonomously interact with the certificate issuing authority corresponding to the certificate to be renewed through the renewal agreement to complete the certificate renewal task.

[0053] Preferably, the multiple encryption technology includes a quantum key management algorithm and a channel encryption technology; the renewal interaction submodule includes:

[0054] The certificate to be renewed encryption unit is used to encrypt the original key of the certificate to be renewed corresponding to the certificate renewal task by using the quantum key management algorithm to obtain an encrypted certificate to be renewed;

[0055] An information interaction data generating unit, used to use the encrypted certificate to be renewed and other related documents as information interaction data; the other related documents include a renewal request form;

[0056] A channel encryption unit, used to encrypt the interactive channel using the channel encryption technology to obtain an encrypted interactive channel;

[0057] The autonomous interaction unit is used to adopt the renewal agreement and send the information interaction data to the main interface of the certificate authority through the encrypted interaction channel according to the renewal process template, and autonomously interact with the certificate authority to complete the certificate renewal task.

[0058] Preferably, the mathematical expression of the quantum encryption key is as follows:

[0059]

[0060] in, is the i-th quantum encryption key, For quantum encryption algorithms, is the ith original key, is the quantum entanglement state value, is the security evaluation value of the i-th original key, For quantum keys.

[0061] Preferably, the autonomous interaction unit is specifically used for:

[0062] Adopting a renewal agreement and following a renewal process template, sending the information interaction data to a main interface of a certificate issuing authority through the encrypted interaction channel, autonomously interacting with the certificate issuing authority, and obtaining an interaction result;

[0063] When the interaction result shows that the certificate renewal fails, the certificate to be renewed is interacted with the corresponding certificate issuing authority again at a preset time interval;

[0064] When the number of interactions reaches a preset number of interactions, based on the information interaction data, the certificate authority is interacted with through the backup interface of the certificate authority, and the interaction result is fed back;

[0065] When the interaction result shows that the certificate renewal fails, the certificate renewal task is fed back to the administrator, and the certificate renewal task is completed by the administrator.

[0066] Preferably, the system further comprises: a renewal information display module; the renewal information display module is used to:

[0067] View the renewal information of the certificate through a visual interface;

[0068] The renewal information includes one or more of the following: certificate renewal status, certificate renewal progress and certificate renewal history record.

[0069] Based on the same inventive concept, the patent application of the present invention also provides an electronic device, comprising: at least one processor and a memory; the memory and the processor are connected via a bus;

[0070] The memory is used to store one or more programs;

[0071] When the one or more programs are executed by the at least one processor, a batch fully automated certificate automatic detection and renewal method as described above is implemented.

[0072] Based on the same inventive concept, the patent application of the present invention also provides a readable storage medium on which a computer program and an execution program are stored. When the execution program is executed, a batch fully automated certificate automatic detection and renewal method as described above is implemented.

[0073] Compared with the closest prior art, the patent application of this invention has the following beneficial effects:

[0074] The patent application of the present invention provides a method and system for automatic detection and renewal of certificates in batches, including: based on the acquired certificate key information of the batch certificates, using a detection engine to identify the certificates to be renewed from the batch certificates; generating a corresponding certificate renewal task according to the certificates to be renewed; according to the certificate renewal task, using multiple encryption technologies to autonomously interact with the certificate issuing authority for certificate renewal to complete the certificate renewal task; the present invention solves the problem that the manual renewal process is complicated and prone to errors by identifying the certificates to be renewed from the batch certificates and performing autonomous certificate renewal interactions; and multiple security encryptions are performed on the certificate renewal tasks during the interaction process to prevent data leakage or tampering, thereby improving data security protection; the present invention can intelligently detect certificates that are about to expire, automatically initiate the renewal process and complete the replacement deployment of certificates to reduce the risk of manual intervention and operational errors. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] Figure 1 A flow chart of a batch fully automated certificate automatic detection and renewal method provided for the patent application of the present invention;

[0076] Figure 2 A schematic diagram of a batch fully automated certificate automatic detection and renewal system provided for the patent application of the present invention;

[0077] Figure 3 A schematic structural diagram of an electronic device provided for the patent application of the present invention. DETAILED DESCRIPTION

[0078] The specific implementation methods of the patent application of the present invention are further described in detail below in conjunction with the accompanying drawings.

[0079] Embodiment 1:

[0080] The present invention patent application provides a batch fully automated certificate automatic detection and renewal method such as Figure 1 As shown, including:

[0081] Step 1: Based on the obtained certificate key information of the batch certificates, a detection engine is used to identify the certificates to be renewed from the batch certificates;

[0082] Step 2: Generate a corresponding certificate renewal task according to the certificate to be renewed;

[0083] Step 3: According to the certificate renewal task, multiple encryption technologies are used to autonomously interact with the certificate issuing authority to complete the certificate renewal task.

[0084] At present, the detection and renewal of digital certificates mainly rely on manual or semi-automated management methods. This traditional method has many limitations in large-scale certificate management scenarios: (1) Manual detection is inefficient; in most cases, operation and maintenance personnel need to regularly check the validity period of the certificate and manually initiate the renewal process. However, this manual detection method is easily affected by human factors, such as forgetting to check or delaying the operation, which may increase the risk of certificate expiration. In addition, manual detection requires checking the status of various certificates one by one, which is time-consuming and labor-intensive and difficult to meet the needs of large-scale certificate management; (2) The renewal process is complicated and prone to errors; different types of certificates may be issued by different certificate authorities (CAs), and the renewal process of each CA is different, involving a series of complex steps, such as generating a new key pair, submitting a renewal request, verifying the identity of the applicant, and downloading and deploying a new certificate. During the manual operation, any error in any step may lead to renewal failure or security issues, such as key leakage or certificate mismatch; (3) Lack of unified management capabilities for multiple certificate types; most current certificate management tools only support a certain type of certificate (such as SSL (Secure Socket Layer, digital certificates such as electronic copies of certificates) / TLS (Transport Layer (4) Insufficient security: In the traditional renewal process, especially when key generation and certificate deployment are performed on different devices or environments, the transmission and storage of keys and sensitive information may pose security risks. For example, transmitting private key files in an unencrypted or unverified network environment may lead to private key leakage, thereby endangering system security; (5) Insufficient support for fault handling and status feedback: Current certificate management tools usually cannot provide an effective fault recovery mechanism when renewal tasks fail. For example, when the renewal request is interrupted due to network fluctuations or CA service abnormalities, the operation and maintenance personnel need to manually retry or re-initiate the renewal application, further increasing the management workload. In addition, most tools lack real-time status feedback and reporting functions, which prevents operation and maintenance personnel from timely understanding the progress or problems of renewal and making it difficult to respond to potential risks quickly.

[0085] In one implementation, the step 1 above, based on the acquired certificate key information of the batch certificates, uses a detection engine to identify the certificates to be renewed from the batch certificates, including:

[0086] Using a built-in scanning device to scan the batch of certificates to obtain key information of the certificates;

[0087] For example, the built-in scanning device supports communicating with the target device through HTTPS, SMIME and TLS protocols to obtain key certificate information.

[0088] For example, when the system is initially deployed, the built-in scanning module performs preliminary detection on all batch certificates in the network environment and collects key information of the batch certificates, including certificate type, issuing authority, validity period, associated services and devices, etc.

[0089] For example, the system supports communicating with the target device through multiple protocols (such as HTTPS, SMIME (Secure Multipurpose Internet Mail Extensions, a security protocol for email), TLS), so as to fully grasp the status of the certificates to be managed; after the information collection is completed, the key information of these certificates is stored in an encrypted certificate database.

[0090] Based on the key information of the certificates, a pre-set detection engine is used to check the validity period of each certificate in the batch of certificates, and identify the certificates to be renewed;

[0091] For example, the detection engine can automatically identify multiple types of certificates, including but not limited to SSL certificates, client certificates, code signing certificates, and device authentication certificates; the system uses a customized detection engine to regularly scan the validity period of all certificates according to the preset detection plan; the detection plan can be adjusted according to enterprise needs, such as setting the detection frequency, specifying the priority of specific certificates, etc.; the renewal task priority is dynamically adjusted to ensure that certificates for critical services are renewed first.

[0092] Among them, the key certificate information includes one or more of the following: certificate type, certificate validity period, certificate issuing authority and certificate associated service; the present invention uses a customized detection engine, which can automatically scan different types of certificates (such as SSL certificates, client certificates, etc.), check their validity periods, and support cross-platform certificate detection.

[0093] In one implementation, the step 2 described above, generating a corresponding certificate renewal task according to the certificate to be renewed, includes:

[0094] Classifying the certificates to be renewed according to certificate types to obtain certificates to be renewed for each certificate type;

[0095] According to the validity period of the certificate, setting the certificate expiration status of the certificate to be renewed in each certificate type;

[0096] For example, an expiration analysis is performed based on the expiration time of the certificate, the expiring certificates are categorized and marked, and certificate expiration statuses such as "expiring soon" and "urgent expiration" are set. The certificate expiration status is stored in real time and synchronously updated to the above-mentioned certificate database, and a test report is generated for the administrator's reference.

[0097] Generate a corresponding certificate renewal task based on the certificate key information and certificate expiration status of the certificate to be renewed in each certificate type;

[0098] Among them, the certificate types of the batch certificates include one or more of the following: SSL digital certificates and client certificates; the certificate expiration status includes one or more of the following: certificate expiration status, certificate emergency expiration status; the certificate renewal task includes: certificate type to be renewed, certificate expiration status, certificate expiration time to be renewed, associated service information, and related configurations required for renewal; the present invention is compatible with multiple certificate types. In actual application scenarios, enterprises often need to manage multiple types of certificates. Future solutions should have high compatibility, support various certificate types (such as SSL / TLS, code signing, device authentication, etc.), and provide a unified management platform to simplify the operation process.

[0099] In one implementation, the above step 3 uses multiple encryption technologies to autonomously interact with the certificate authority to renew the certificate according to the certificate renewal task, and completes the certificate renewal task, including:

[0100] According to the certificate renewal task, matching the renewal process template corresponding to the certificate to be renewed from a preset renewal process template library;

[0101] For example, for different types of certificates and issuing authorities, the system automatically matches the corresponding renewal process template to ensure the efficiency and accuracy of the renewal task execution.

[0102] For the certificate renewal task, multiple encryption technologies are used in combination with the renewal process template, and autonomous interaction is performed with the certificate issuing authority corresponding to the certificate to be renewed through a renewal agreement to complete the certificate renewal task.

[0103] For example, the system implements the renewal operation through an interface with a certificate authority (CA), such as an API (Application Programming Interface) or other communication protocols. The entire renewal process does not require human intervention. The system dynamically adjusts the execution order according to the priority and status of the renewal task to ensure that certificates for critical services are renewed first. The present invention can configure renewal strategies according to the characteristics of different certificates and adopt multiple encryption technologies to ensure the security of keys during the renewal process.

[0104] In one implementation, the multiple encryption technology includes a quantum key management algorithm and a channel encryption technology; for the certificate renewal task, the multiple encryption technology is combined with the renewal process template, and autonomous interaction is performed with the certificate authority corresponding to the certificate to be renewed through a renewal agreement to complete the certificate renewal task, including:

[0105] Using the quantum key management algorithm, encrypting the original key of the certificate to be renewed corresponding to the certificate renewal task to obtain an encrypted certificate to be renewed;

[0106] For example, the relevant sensitive information in the renewal process is also encrypted and protected; therefore, the quantum key management algorithm includes quantum key distribution and generation process, key encryption processing process, sensitive information encryption protection process and key wrapping storage; in the quantum key distribution and generation process, a high-security key is generated for the certificate renewal task. Specifically, the BB84 protocol or the E91 protocol is used to generate a random original key; in the key encryption processing process, the quantum encryption algorithm used is a symmetric encryption algorithm, such as the AES-256 symmetric encryption algorithm, and the specific encryption process is shown in the following formula; in the sensitive information encryption protection process, the identified sensitive information is first summarized, and then each sensitive information is encrypted in turn, similar to the encryption process of the original key of the certificate to be renewed; in the key wrapping storage, the encrypted key and key metadata (such as encryption algorithm identifier, quantum key version number, etc.) are encapsulated as a key data packet, and the key data packet is stored using distributed storage technology (such as blockchain or distributed database) to ensure its integrity and traceability.

[0107] The encrypted certificate to be renewed and other related documents are used as information exchange data; the other related documents include a renewal request form;

[0108] The channel encryption technology is used to encrypt the interactive channel to obtain an encrypted interactive channel;

[0109] For example, the interactive data with the certificate authority CA (such as renewal requests, certificate files, etc.) are all transmitted using encrypted channels to prevent man-in-the-middle attacks.

[0110] The renewal agreement is adopted, and according to the renewal process template, the information interaction data is sent to the main interface of the certificate issuing authority through the encrypted interaction channel, and autonomous interaction is performed with the certificate issuing authority to complete the certificate renewal task.

[0111] For example, submit a renewal application to a certificate authority (CA) and attach relevant verification information, such as a CSR (Certificate Signing Request) file; receive the renewal certificate issued by the CA and verify its validity; automatically deploy the new certificate to the specified server or device to replace the old certificate.

[0112] Examples also include: the system uses multi-factor authentication technology to verify the identity of the renewal task to ensure the legitimacy of the renewal application.

[0113] In one implementation, the mathematical expression of the quantum encryption key is as follows:

[0114]

[0115] in, is the i-th quantum encryption key, For quantum encryption algorithms, is the ith original key, is the quantum entanglement state value, is the security evaluation value of the i-th original key, For quantum keys.

[0116] In one implementation, the renewal agreement is adopted, and according to the renewal process template, the information interaction data is sent to the main interface of the certificate authority through the encrypted interaction channel, and autonomous interaction is performed with the certificate authority to complete the certificate renewal task, including:

[0117] Adopting a renewal agreement and following a renewal process template, sending the information interaction data to a main interface of a certificate issuing authority through the encrypted interaction channel, autonomously interacting with the certificate issuing authority, and obtaining an interaction result;

[0118] When the interaction result shows that the certificate renewal fails, the certificate to be renewed is interacted with the corresponding certificate issuing authority again at a preset time interval;

[0119] For example, if an abnormal situation (such as network interruption, CA service unavailability, etc.) is encountered during the detection or renewal process, the fault self-healing function will be triggered. First, the system will automatically retry the failed operation within the specified time interval.

[0120] When the number of interactions reaches a preset number of interactions, based on the information interaction data, the certificate authority is interacted with through the backup interface of the certificate authority, and the interaction result is fed back;

[0121] For example, when the primary interface of the CA is unavailable, the system will switch to the backup interface or request other certification paths to complete the renewal.

[0122] When the interaction result shows that the certificate renewal fails, the certificate renewal task is fed back to the administrator, and the certificate renewal task is completed by the administrator.

[0123] For example, if the task cannot be completed after multiple retries, the system will notify the administrator via email, SMS or other means to facilitate timely intervention.

[0124] In one implementation, when the interaction result shows that the certificate renewal fails, the certificate renewal task is fed back to the administrator, and after the administrator completes the certificate renewal task, the method further includes:

[0125] View the renewal information of the certificate through a visual interface;

[0126] The renewal information includes one or more of the following: certificate renewal status, certificate renewal progress and certificate renewal history record.

[0127] For example, the system provides a visual monitoring interface, through which administrators can view key information such as certificate status, detection progress, renewal task execution status, etc. in real time; the system will automatically generate historical records of detection and renewal, including task execution time, success rate, failure reason analysis, etc., for administrators to conduct subsequent audits and management; the report content can be exported to common formats, such as PDF (Portable Document Format) and CSV (Comma-Separated Values) for archiving; the present invention can effectively solve the shortcomings of traditional certificate management methods, realize the full life cycle automated management of large-scale certificates, greatly improve management efficiency and security, and adapt to a variety of application scenarios and complex business needs; the present invention also needs to have a fault self-healing function, automatically retry or switch to a backup plan when renewal fails, to ensure the reliability of the renewal task.

[0128] The method of the present invention is suitable for large-scale certificate management scenarios, reducing manual intervention and improving certificate management efficiency; the system automatically detects certificates to be renewed in batches, identifies certificates that are about to expire, and generates renewal tasks according to preset rules to avoid the risk of missing or delaying renewal; a customized detection engine is used to automatically scan different types of certificates (such as SSL certificates, client certificates, etc.), check their validity periods, and support cross-platform certificate detection; an automatic renewal function is implemented, and the system interacts with a certificate authority (CA) through an API or other protocols to automatically submit a renewal application and complete the certificate renewal operation; multiple encryption technologies are introduced to ensure that the key and related sensitive information of the certificate are encrypted during the renewal process to prevent data leakage or tampering; the system has a fault self-healing function, and when the detection or renewal operation fails, it can automatically retry or provide an administrator notification function to ensure the reliability of the renewal process; real-time monitoring and report generation functions are provided, and administrators can view the certificate status, renewal progress and historical records through a visual interface to facilitate subsequent management and auditing.

[0129] The present invention solves the problem that the manual renewal process is complicated and prone to errors by identifying certificates to be renewed from batch certificates and performing autonomous certificate renewal interaction; and multiple security encryptions are performed on the certificate renewal task during the interaction process to prevent data leakage or tampering, thereby improving data security protection; the present invention can intelligently detect certificates that are about to expire, automatically initiate the renewal process and complete the replacement deployment of certificates to reduce the risk of manual intervention and operational errors.

[0130] Embodiment 2:

[0131] Based on the same inventive concept, the present invention patent application also provides a batch fully automated certificate automatic detection and renewal system such as Figure 2 As shown, it includes: a certificate identification module to be renewed, a certificate renewal task generation module and a certificate renewal task execution module;

[0132] The certificate-to-be-renewed identification module is used to identify the certificates to be renewed from the batch certificates using a detection engine based on the acquired certificate key information of the batch certificates;

[0133] The certificate renewal task generation module is used to generate a corresponding certificate renewal task according to the certificate to be renewed;

[0134] The certificate renewal task execution module is used to autonomously interact with the certificate issuing authority for certificate renewal according to the certificate renewal task by using multiple encryption technologies to complete the certificate renewal task.

[0135] Preferably, the certificate-to-be-renewed identification module is specifically used to:

[0136] Using a built-in scanning device to scan the batch of certificates to obtain key information of the certificates;

[0137] Based on the key information of the certificates, a pre-set detection engine is used to check the validity period of each certificate in the batch of certificates, and identify the certificates to be renewed;

[0138] The key certificate information includes one or more of the following: certificate type, certificate validity period, certificate issuing authority and certificate associated services.

[0139] Preferably, the certificate renewal task generation module is specifically used to:

[0140] Classifying the certificates to be renewed according to certificate types to obtain certificates to be renewed for each certificate type;

[0141] According to the validity period of the certificate, setting the certificate expiration status of the certificate to be renewed in each certificate type;

[0142] Generate a corresponding certificate renewal task based on the certificate key information and certificate expiration status of the certificate to be renewed in each certificate type;

[0143] Among them, the certificate types of the batch certificates include one or more of the following: SSL digital certificates and client certificates; the certificate expiration status includes one or more of the following: certificate is about to expire, certificate emergency expiration status; the certificate renewal task includes: the type of certificate to be renewed, the certificate expiration status, the expiration time of the certificate to be renewed, the associated service information and the relevant configuration required for renewal.

[0144] Preferably, the certificate renewal task execution module includes:

[0145] A renewal process template matching submodule, used to match the renewal process template corresponding to the certificate to be renewed from a preset renewal process template library according to the certificate renewal task;

[0146] The renewal interaction submodule is used to adopt multiple encryption technologies in combination with the renewal process template for the certificate renewal task, and autonomously interact with the certificate issuing authority corresponding to the certificate to be renewed through the renewal agreement to complete the certificate renewal task.

[0147] Preferably, the multiple encryption technology includes a quantum key management algorithm and a channel encryption technology; the renewal interaction submodule includes:

[0148] The certificate to be renewed encryption unit is used to encrypt the original key of the certificate to be renewed corresponding to the certificate renewal task by using the quantum key management algorithm to obtain an encrypted certificate to be renewed;

[0149] An information interaction data generating unit, used to use the encrypted certificate to be renewed and other related documents as information interaction data; the other related documents include a renewal request form;

[0150] A channel encryption unit, used to encrypt the interactive channel using the channel encryption technology to obtain an encrypted interactive channel;

[0151] The autonomous interaction unit is used to adopt the renewal agreement and send the information interaction data to the main interface of the certificate authority through the encrypted interaction channel according to the renewal process template, and autonomously interact with the certificate authority to complete the certificate renewal task.

[0152] Preferably, the mathematical expression of the quantum encryption key is as follows:

[0153]

[0154] in, is the i-th quantum encryption key, For quantum encryption algorithms, is the ith original key, is the quantum entanglement state value, is the security evaluation value of the i-th original key, For quantum keys.

[0155] Preferably, the autonomous interaction unit is specifically used for:

[0156] Adopting a renewal agreement and following a renewal process template, sending the information interaction data to a main interface of a certificate issuing authority through the encrypted interaction channel, autonomously interacting with the certificate issuing authority, and obtaining an interaction result;

[0157] When the interaction result shows that the certificate renewal fails, the certificate to be renewed is interacted with the corresponding certificate issuing authority again at a preset time interval;

[0158] When the number of interactions reaches a preset number of interactions, based on the information interaction data, the certificate authority is interacted with through the backup interface of the certificate authority, and the interaction result is fed back;

[0159] When the interaction result shows that the certificate renewal fails, the certificate renewal task is fed back to the administrator, and the certificate renewal task is completed by the administrator.

[0160] Preferably, the system further comprises: a renewal information display module; the renewal information display module is used to:

[0161] View the renewal information of the certificate through a visual interface;

[0162] The renewal information includes one or more of the following: certificate renewal status, certificate renewal progress and certificate renewal history record.

[0163] Example 3

[0164] like Figure 3 As shown, the present invention also provides an electronic device, which may be a computer device, a single-chip device, an intelligent mobile device, etc. The electronic device in this embodiment may include a processor, a memory, a transceiver component, etc. The memory, the processor, and the transceiver component are connected via a bus; the memory may be used to store an execution program, and an exemplary execution program may include instructions; the processor is used to execute the instructions stored in the memory. The memory may also be used to store data, which may be called and / or modified when the instructions are executed.

[0165] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions in a storage medium to implement the corresponding method flow or corresponding functions, so as to realize the steps of a batch fully automated certificate automatic detection and renewal method in the above embodiment.

[0166] Example 4

[0167] Based on the same inventive concept, the present invention also provides a readable storage medium, specifically an electronic device readable storage medium (Memory), which is a memory device in an electronic device for storing programs and data. It can be understood that the storage medium here can include both built-in storage media in electronic devices and extended storage media supported by electronic devices. The storage medium provides a storage space, which stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by a processor are also stored in the storage space, and these instructions can be one or more execution programs (including program codes). It should be noted that the storage medium here can be a high-speed RAM memory or a non-volatile memory, such as at least one disk memory. The processor loads and executes one or more instructions stored in the storage medium, which can implement the steps of a batch fully automated certificate automatic detection and renewal method in the above embodiment.

[0168] It should be understood by those skilled in the art that the embodiments of the present invention patent application can be provided as methods, systems, or computer program products. Therefore, the present invention patent application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention patent application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0169] The present invention patent application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present invention patent application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0170] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0171] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0172] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the patent application of the present invention rather than to limit its protection scope. Although the patent application of the present invention is described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that after reading the patent application of the present invention, those skilled in the art can still make various changes, modifications or equivalent substitutions to the specific implementation methods of the application, but these changes, modifications or equivalent substitutions are all within the protection scope of the claims to be approved.

Claims

1. A batch fully automated certificate automatic detection and renewal method, characterized in that: include: Based on the obtained certificate key information of the batch certificates, a detection engine is used to identify the certificates to be renewed from the batch certificates; Generate a corresponding certificate renewal task according to the certificate to be renewed; According to the certificate renewal task, matching the renewal process template corresponding to the certificate to be renewed from a preset renewal process template library; Using a quantum key management algorithm, encrypting the original key of the certificate to be renewed corresponding to the certificate renewal task to generate a quantum encryption key; According to the quantum encryption key, relevant sensitive information in the renewal process is encrypted to generate an encrypted certificate to be renewed; The encrypted certificate to be renewed and other related documents are used as information exchange data; the other related documents include a renewal request form; Adopt channel encryption technology to encrypt the interactive channel to obtain an encrypted interactive channel; Adopting the renewal agreement and following the renewal process template, the information interaction data is sent to the main interface of the certificate authority through the encrypted interaction channel, and autonomous interaction is performed with the certificate authority to complete the certificate renewal task; The detection engine identifies the certificate to be renewed according to a pre-set detection plan; the detection plan includes: setting the detection frequency and specifying the priority of a specific certificate.

2. The method according to claim 1, characterized in that The method of using a detection engine based on the acquired certificate key information of the batch certificates to identify the certificates to be renewed from the batch certificates includes: Using a built-in scanning device to scan the batch of certificates to obtain key information of the certificates; Based on the key information of the certificates, a pre-set detection engine is used to check the validity period of each certificate in the batch of certificates, and identify the certificates to be renewed; The key certificate information includes one or more of the following: certificate type, certificate validity period, certificate issuing authority and certificate associated services.

3. The method according to claim 2, characterized in that The step of generating a corresponding certificate renewal task according to the certificate to be renewed includes: Classifying the certificates to be renewed according to certificate types to obtain certificates to be renewed for each certificate type; According to the validity period of the certificate, setting the certificate expiration status of the certificate to be renewed in each certificate type; Generate a corresponding certificate renewal task based on the certificate key information and certificate expiration status of the certificate to be renewed in each certificate type; Among them, the certificate types of the batch certificates include one or more of the following: SSL digital certificates and client certificates; the certificate expiration status includes one or more of the following: certificate is about to expire, certificate emergency expiration status; the certificate renewal task includes: the type of certificate to be renewed, the certificate expiration status, the expiration time of the certificate to be renewed, the associated service information and the relevant configuration required for renewal.

4. The method according to claim 1, characterized in that The mathematical expression of the quantum encryption key is as follows: in, is the i-th quantum encryption key, For quantum encryption algorithms, is the ith original key, is the quantum entanglement state value, is the security evaluation value of the i-th original key, For quantum keys.

5. The method according to claim 1, characterized in that The renewal protocol is adopted, and according to the renewal process template, the information interaction data is sent to the main interface of the certificate authority through the encrypted interaction channel, and autonomous interaction is performed with the certificate authority to complete the certificate renewal task, including: Adopting a renewal agreement and following a renewal process template, sending the information interaction data to a main interface of a certificate issuing authority through the encrypted interaction channel, autonomously interacting with the certificate issuing authority, and obtaining an interaction result; When the interaction result shows that the certificate renewal fails, the certificate to be renewed is interacted with the corresponding certificate issuing authority again at a preset time interval; When the number of interactions reaches a preset number of interactions, based on the information interaction data, the user interacts with the certificate authority through the backup interface of the certificate authority and feeds back the interaction result; When the interaction result shows that the certificate renewal fails, the certificate renewal task is fed back to the administrator, and the certificate renewal task is completed by the administrator.

6. The method according to claim 5, characterized in that When the interaction result shows that the certificate renewal fails, the certificate renewal task is fed back to the administrator, and after the administrator completes the certificate renewal task, the method further includes: View the renewal information of the certificate through a visual interface; The renewal information includes one or more of the following: certificate renewal status, certificate renewal progress and certificate renewal history record.

7. A batch fully automated certificate automatic detection and renewal system, characterized in that: include: Certificate to be renewed identification module, certificate renewal task generation module, renewal process template matching module, key encryption module, encrypted certificate to be renewed generation module, information interaction data generation module, channel encryption module and autonomous interaction module; The certificate-to-be-renewed identification module is used to identify the certificates to be renewed from the batch certificates using a detection engine based on the acquired certificate key information of the batch certificates; The certificate renewal task generation module is used to generate a corresponding certificate renewal task according to the certificate to be renewed; The renewal process template matching module is used to match the renewal process template corresponding to the certificate to be renewed from a preset renewal process template library according to the certificate renewal task; The key encryption module is used to encrypt the original key of the certificate to be renewed corresponding to the certificate renewal task using a quantum key management algorithm to generate a quantum encryption key; The encrypted certificate to be renewed generation module is used to encrypt the relevant sensitive information in the renewal process according to the quantum encryption key to generate an encrypted certificate to be renewed; The information interaction data generation module is used to use the encrypted certificate to be renewed and other related documents as information interaction data; the other related documents include a renewal request form; The channel encryption module is used to encrypt the interactive channel using the channel encryption technology to obtain an encrypted interactive channel; The autonomous interaction module is used to adopt the renewal agreement and send the information interaction data to the main interface of the certificate authority through the encrypted interaction channel according to the renewal process template, and autonomously interact with the certificate authority to complete the certificate renewal task; The detection engine identifies the certificate to be renewed according to a pre-set detection plan; the detection plan includes: setting the detection frequency and specifying the priority of a specific certificate.

8. The system according to claim 7, characterized in that The certificate-to-be-renewed identification module is specifically used for: Using a built-in scanning device to scan the batch of certificates to obtain key information of the certificates; Based on the key information of the certificates, a pre-set detection engine is used to check the validity period of each certificate in the batch of certificates, and identify the certificates to be renewed; The key certificate information includes one or more of the following: certificate type, certificate validity period, certificate issuing authority and certificate associated services.

Images