Website access method and device, electronic equipment and storage medium

Abstract

According to the website access method and device, the electronic equipment and the storage medium, the method comprises the steps that firstly, a target root certificate mechanism corresponding to a target website is determined from multiple root certificate mechanisms, and the multiple root certificate mechanisms are located in the same alliance certificate block chain; the alliance certificate block chain is at least used for storing an institution root certificate of each root certificate institution; then, obtaining a target institution root certificate corresponding to the target root certificate institution from the alliance certificate block chain; and finally, the target website is accessed based on the target mechanism root certificate, so that the website access reliability of the network equipment is greatly improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a website access method, device, electronic device and storage medium. Background Art

[0002] Public key infrastructure is a system that uses public key cryptography to achieve secure communication and digital signatures. In a public key infrastructure, there are usually multiple layers of certificate authorities that are linked layer by layer, and these certificate authorities manage the certificate resources of all certificate authorities that are linked to them in the lower layers.

[0003] In the related art, when a network device accesses a website, it uses the relevant certificate resources for verification, and only after the verification is passed is the network device allowed to access the website, thereby ensuring the security of the website access. However, the upper-level certificate authority is usually set up in different regions and managed by the management object of the region. When using the original method to access the website, there are problems such as the different regions between the network device and the upper-level certificate authority, network and human interference, which make the certificate resources used by the network device invalid, thereby failing to perform normal website access. Summary of the invention

[0004] The embodiments of the present application provide a website access method, device, electronic device and storage medium, which can effectively improve the reliability of website access by network devices.

[0005] To achieve the above purpose, a first aspect of an embodiment of the present application proposes a website access method, the method comprising:

[0006] Determine a target root certificate authority corresponding to the target website from a plurality of root certificate authorities, wherein the plurality of root certificate authorities are located in the same alliance certificate blockchain, and the alliance certificate blockchain is used to store at least an institutional root certificate of each of the root certificate authorities;

[0007] Obtaining a target organization root certificate corresponding to the target root certificate authority from the alliance certificate blockchain;

[0008] The target website is accessed based on the target organization root certificate.

[0009] In some embodiments, obtaining a target authority root certificate corresponding to the target root certificate authority from the alliance certificate blockchain includes:

[0010] Obtaining root authority identifiers and authority root certificates of all root certificate authorities from the alliance certificate blockchain;

[0011] A target organization identifier corresponding to the target root certificate authority is obtained, and the target organization root certificate is selected from a plurality of organization root certificates based on the target organization identifier.

[0012] In some embodiments, obtaining the root authority identifiers and authority root certificates of all root certificate authorities from the alliance certificate blockchain includes:

[0013] Get the preset acquisition cycle time;

[0014] Based on the preset acquisition cycle time, the root authority identifiers and authority root certificates of all root certificate authorities are periodically acquired from the alliance certificate blockchain.

[0015] In some embodiments, obtaining a preset acquisition cycle time includes:

[0016] Obtaining a first update interval mean and a first update interval median of the alliance certificate blockchain for all newly added block information in a first time period in the past, and obtaining a second update interval mean and a second update interval median of the alliance certificate blockchain for all newly added block information in a second time period in the past, wherein the first time period is less than the second time period;

[0017] Performing data averaging processing on the first update interval mean and the first update interval median to obtain a first interval mean, and performing data averaging processing on the second update interval mean and the second update interval median to obtain a second interval mean;

[0018] The first weight interval is obtained by multiplying the first interval mean by the first weight, the second weight interval is obtained by multiplying the second interval mean by the second weight, the first weight interval and the second weight interval are accumulated to obtain the preset acquisition cycle time, the first weight is greater than the second weight, and the sum of the first weight and the second weight is equal to one.

[0019] In some embodiments, the network device stores a backup organization root certificate corresponding to the target organization identifier, and obtaining the root organization identifiers and organization root certificates of all root certificate organizations from the alliance certificate blockchain includes:

[0020] Sending an access request to the target website based on the backup organization root certificate;

[0021] Receiving failure feedback information issued by the website server corresponding to the target website according to the access request and the backup agency root certificate;

[0022] According to the failure feedback information, the root authority identifiers and the authority root certificates of all the root certificate authorities are obtained from the alliance certificate blockchain.

[0023] In some embodiments, the network device stores the certificate validity period corresponding to the target organization identifier, and obtaining the root organization identifiers and organization root certificates of all root certificate organizations from the alliance certificate blockchain includes:

[0024] If the current time is not within the validity period of the certificate, the root authority identifiers and the root certificates of all root certificate authorities are obtained from the alliance certificate blockchain.

[0025] In some embodiments, before obtaining the target agency root certificate corresponding to the target root certificate authority from the alliance certificate blockchain, when a new root certificate authority joins the alliance certificate blockchain, at least one of the agency root certificate, root agency identification, agency registration information, region code, applicable software information, and region signature information of the new root certificate authority is synchronized on the chain.

[0026] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present application provides a website access device, the device comprising:

[0027] An institution determination module, used to determine a target root certificate authority corresponding to a target website from a plurality of root certificate authorities, wherein the plurality of root certificate authorities are located in the same alliance certificate blockchain, and the alliance certificate blockchain is used to store at least an institution root certificate of each of the root certificate authorities;

[0028] A certificate acquisition module, used to obtain a target institution root certificate corresponding to the target root certificate authority from the alliance certificate blockchain;

[0029] A login module is used to access the target website based on the target organization root certificate.

[0030] To achieve the above-mentioned purpose, a third aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the website access method described in the first aspect is implemented.

[0031] To achieve the above-mentioned purpose, the fourth aspect of an embodiment of the present application proposes a storage medium, which is a computer-readable storage medium, and the storage medium stores a computer program. When the computer program is executed by a processor, the website access method described in the first aspect is implemented.

[0032] The website access method, device, electronic device and storage medium proposed in the embodiment of the present application include: first, determining the target root certificate authority corresponding to the target website from multiple root certificate authorities, the multiple root certificate authorities are located in the same alliance certificate blockchain, and the alliance certificate blockchain is at least used to store the institutional root certificate of each root certificate authority; then, obtaining the target institution root certificate corresponding to the target root certificate authority from the alliance certificate blockchain; finally, accessing the target website based on the target institution root certificate. The embodiment of the present application utilizes the alliance certificate blockchain to manage multiple root certificate authorities in the same or different regions in an alliance, and utilizes the characteristic that the blockchain's chain information cannot be tampered with, so that the legitimate institution root of each root certificate authority in the alliance is stored and chained in the alliance certificate blockchain, so that when the network device accesses the target website, the target institution root certificate corresponding to the target root certificate authority corresponding to the target website obtained from the alliance certificate blockchain can be used to perform normal target website access, so as to avoid the possibility of invalid certificates, thereby greatly improving the reliability of website access by network devices.

[0033] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a structural diagram of a website public key infrastructure provided by an embodiment of the present application.

[0035] Figure 2 This is a flowchart of a website access method provided by another embodiment of the present application.

[0036] Figure 3 This is a schematic diagram of the architecture of a root certificate authority alliance provided in yet another embodiment of the present application.

[0037] Figure 4 yes Figure 2 Flow chart of step 202 in FIG.

[0038] Figure 5 yes Figure 4 Flow chart of step 401 in FIG.

[0039] Figure 6 yes Figure 5 Flow chart of step 501 in FIG.

[0040] Figure 7 yes Figure 4 Another flow chart of step 401 in FIG.

[0041] Figure 8 yes Figure 4 Another flow chart of step 401 in FIG.

[0042] Fig. 9 It is a structural diagram of a website access device provided in one embodiment of the present application.

[0043] Fig.10 This is a schematic diagram of the hardware structure of an electronic device provided in yet another embodiment of the present application. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0045] It should be noted that although the functional modules are divided in the device schematic and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart.

[0046] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0047] First, some nouns involved in this application are analyzed:

[0048] Web Public Key Infrastructure (WebPKI) is a system that uses public key cryptography to achieve secure communication and digital signatures. It provides a trust model that allows users to be sure that the person they are communicating with is trustworthy and that the content of the communication will not be tampered with.

[0049] Reference Figure 1 , is a schematic diagram of the structure of a website public key infrastructure provided by an embodiment of the present application. Figure 1 As shown in , in the related art, it is usually composed of multiple certificate authorities associated layer by layer, including a root certificate authority at the top layer, multiple upper certificate authorities associated with the root certificate authority, and multiple lower certificate authorities associated with the upper certificate authority, and each lower certificate authority is associated with multiple website servers for performing resource certificate authorization on these website servers so that these website servers can manage multiple resource websites. It can be understood that the embodiment of the present application is illustrated with only three layers of certificate authorities, and in actual applications, there are usually more certificate authority architectures than three layers.

[0050] When any network device accesses a resource website managed by a network server, the network device usually uses the pre-acquired agency certificate of the certificate authority corresponding to the network server as login verification information. Then, when the network server receives the access request and agency certificate of the network device, it will perform verification based on the agency certificate and allow the network device to access the resource website after the verification is passed, thereby ensuring the security of website access.

[0051] However, if Figure 1 As shown in the website public key infrastructure, generally speaking, the root certificate authority and the upper certificate authority are usually set up in different regions and managed by the management object of the region. When network devices in different regions need to access resource websites indirectly managed by the upper certificate authority in the region, there are trust issues due to the different regions between the network devices and the upper certificate authority, network and human interference, etc., as described below.

[0052] 1) Risk of root CA stopping issuing certificates (isolation and blinding risk): When the certificate resource registration used by a website server in a certain region depends on the root certificate authority in another region, once the root certificate authority in the other region does not issue a resource certificate to the website server due to distrust between the two regions, or due to network problems between the two regions, the resource website managed by the network server will not be able to be used normally.

[0053] 2) Risk of root CA revoking issued certificates (disappearance risk): When the certificate resource registration used by a website server in a certain region depends on the root certificate authority in another region, once the root certificate authority in the other region cancels the resource certificate originally issued to the website server due to distrust between the two regions, the encryption services of all domain name websites of the website server will disappear, and the encryption services between the corresponding domain name websites and users will be interrupted, causing the entire network system to be paralyzed.

[0054] 3) Risk of certificate tampering (hijacking risk): When the certificate resource registration used by a website server in a certain region depends on the root certificate authority in another region, when the root certificate authority in another region is attacked or performs malicious operations or issues certificates containing false information, it is easy for the resource website held by the website server to be attacked or even hijacked.

[0055] 4) Information security risk: When the certificate resource registration used by a website server in a certain region depends on the root certificate authority in another region, the daily traffic network service information of the website server in that region (such as website access information of network devices) will be mastered by the root certificate authority in another region. If the relationship between the two regions is not harmonious, it will cause serious information security leakage risks.

[0056] In reality, in the current website public key infrastructure, many root certificate authorities are usually set up in a few regions, and then the root certificate authorities in a few regions are directly or indirectly associated with website servers in most regions. When there is distrust or conflict between regions, the above four malicious situations will easily occur, making the reliability of network devices for website access low.

[0057] Based on this, in order to effectively improve the reliability of website access by network devices, the embodiment of the present application utilizes the alliance certificate blockchain to manage multiple root certificate authorities in the same or different regions in an alliance, and utilizes the characteristic that the blockchain's on-chain information cannot be tampered with, and stores the legitimate agency root of each root certificate authority in the alliance on the alliance certificate blockchain. Therefore, when the network device accesses the target website, the target agency root certificate corresponding to the target root certificate authority corresponding to the target website obtained from the alliance certificate blockchain can be used to perform normal target website access, so as to avoid the possibility of invalid certificates, thereby greatly improving the reliability of website access by network devices.

[0058] The website access method, device, electronic device and storage medium provided by the embodiments of the present application will be further described below. The website access method is applied to any network device.

[0059] Reference Figure 2 , is an optional flow chart of the website access method provided in the embodiment of the present application, Figure 2 The method in the embodiment may include but is not limited to steps 201 to 203. Figure 2 The order of step 201 to step 203 is not specifically limited, and the order of steps can be adjusted or some steps can be reduced or added according to actual needs.

[0060] Step 201: Determine a target root certificate authority corresponding to a target website from multiple root certificate authorities.

[0061] Step 201 is described in detail below.

[0062] In some embodiments, in order to avoid the problem mentioned in the related art that the certificate resources used by the network device are invalid due to the different regions between the network device and the upper-level certificate authority, network and human interference, etc. Figure 1 In addition to the website public key infrastructure architecture shown in the figure, a new root certificate authority alliance is also built. Figure 3 , is a schematic diagram of the architecture of a root certificate authority alliance provided in an embodiment of the present application. Figure 3As shown in , multiple root certificate authorities (which can be Figure 1 The upper-level certificate authorities or root certificate authorities or even the certificate authorities at a certain level in the middle shown in the figure form an institution alliance together, and then all the root certificate authorities in the alliance trust each other's root certificates, and each root certificate authority directly or indirectly authorizes multiple website servers.

[0063] Thus, it can be achieved that the root certificates held by all root certificate authorities in the root certificate authority alliance are generated based on the cross-signature of the root certificate authorities of each other. It can be understood that the root certificate authority refers to the random number private key generated by the root certificate authority.

[0064] In addition, the root certificate authority alliance is also provided with an alliance certificate blockchain, which stores the root authority related information of all root certificate authorities in the root certificate authority alliance, wherein the root authority related information includes: institution root certificate, root authority identification, institution registration information, certificate validity period, region code, applicable software information (i.e. the browser software name and version applicable to the resource website corresponding to the institution certificate), region signature information, and region code of all root certificate authorities in the institution alliance. It is understandable that in the root certificate authority alliance, there may be a situation where a region has multiple root certificate authorities, and the root authority related information of multiple root certificate authorities in the region are all stored in the alliance certificate blockchain. Thus, the characteristic that the blockchain's on-chain information cannot be tampered with is utilized to avoid the possibility that the institution root certificate obtained by the network device from the alliance certificate blockchain is invalid.

[0065] In addition, when a new root certificate authority joins the root certificate authority alliance, that is, joins the alliance certificate blockchain, the root authority-related information and chain-up time of the new root certificate authority are chained and stored in the alliance certificate blockchain to generate a new block.

[0066] Based on Figure 3 In the root certificate authority alliance shown, when any network device that can be connected to the alliance certificate blockchain responds to the access request of the resource website (i.e., the target website) managed within the root certificate authority alliance, the network device first determines the website server corresponding to the target website, and then further determines the target root certificate authority corresponding to the target website from multiple root certificate authorities based on the certificate authority to which the website server belongs.

[0067] Step 202: Obtain the target authority root certificate corresponding to the target root certificate authority from the alliance certificate blockchain.

[0068] Step 202 is described in detail below.

[0069] In some embodiments, after the network device determines the target root certificate authority, in order to further ensure that the target website can be accessed normally, the network device will obtain the target organization root certificate corresponding to the target root certificate authority from the alliance certificate blockchain, so as to facilitate the subsequent use of the target organization root certificate to access the target website. The following will further describe how to obtain the target organization root certificate from the alliance certificate blockchain.

[0070] Reference Figure 4 , obtaining the target agency root certificate corresponding to the target root certificate authority from the alliance certificate blockchain, including the following steps 401 to 402.

[0071] Step 401: Obtain the root authority identifiers and authority root certificates of all root certificate authorities from the alliance certificate blockchain.

[0072] Step 402: Obtain a target organization identifier corresponding to a target root certificate authority, and select a target organization root certificate from multiple organization root certificates based on the target organization identifier.

[0073] Steps 401 to 402 are described in detail below.

[0074] In some embodiments, in order to improve the efficiency of obtaining the institutional root certificate, after determining the target root certificate authority, the network device obtains the root authority identifiers and institutional root certificates of all root certificate authorities in the root certificate authority alliance from the alliance certificate blockchain in advance, and then installs these institutional root certificates in the network device, so that the network device can use these institutional root certificates when accessing the resource website through the browser carried by the network device. Then, the target institution identifier corresponding to the target root certificate authority is further determined, so as to determine the target institutional root certificate from multiple institutional root certificates using the target institution identifier.

[0075] Since it is cumbersome and has high communication overhead for the network device to obtain relevant data information from the alliance certificate blockchain each time it visits a resource website, and the information in the alliance certificate blockchain is not frequently added, in order to further reduce the communication overhead, this embodiment will pre-acquire the root agency identifiers and agency root certificates of all root certificate agencies in the alliance certificate blockchain and save them in the storage device of the network device for use when visiting the resource website (including the target website), as described in detail below.

[0076] Reference Figure 5 , obtaining the root authority identifiers and authority root certificates of all root certificate authorities from the alliance certificate blockchain, including the following steps 501 to 502.

[0077] Step 501: Obtain a preset acquisition cycle time.

[0078] Step 502: periodically obtain the root authority identifiers and authority root certificates of all root certificate authorities from the alliance certificate blockchain based on a preset acquisition cycle time.

[0079] Steps 501 to 502 are described in detail below.

[0080] In some embodiments, in order to effectively reduce the communication overhead of network devices, frequency information is added in advance based on the data of the alliance certificate blockchain to obtain a preset acquisition cycle time, and then based on the preset acquisition cycle time, the root agency identifiers and agency root certificates of all root certificate authorities are periodically obtained from the alliance certificate blockchain and saved in the storage device of the network device for use when accessing resource websites (including target websites).

[0081] Through the above steps 501 to 502, the root organization identifiers and organization root certificates of all root certificate authorities are periodically obtained from the alliance certificate blockchain using the preset acquisition cycle time obtained from the frequency information of the data addition of the alliance certificate blockchain. Therefore, when the network device visits the target website, the target organization root certificate required by the target website can be directly used without the need to obtain data from the alliance certificate blockchain again, thereby effectively reducing the communication overhead of the network device.

[0082] How to determine the preset acquisition cycle time will be further described below.

[0083] Reference Figure 6 , obtaining a preset acquisition cycle time, including the following steps 601 to 603.

[0084] Step 601: Obtain a first update interval mean and a first update interval median of the alliance certificate blockchain for all newly added block information in a first time period in the past, and obtain a second update interval mean and a second update interval median of the alliance certificate blockchain for all newly added block information in a second time period in the past.

[0085] Step 602: Perform data averaging processing on the first update interval mean and the first update interval median to obtain a first interval mean, and perform data averaging processing on the second update interval mean and the second update interval median to obtain a second interval mean.

[0086] Step 603: multiply the first interval mean by the first weight to obtain a first weight interval, multiply the second interval mean by the second weight to obtain a second weight interval, and accumulate the first weight interval and the second weight interval to obtain a preset acquisition cycle time.

[0087] Steps 601 to 603 are described in detail below.

[0088] In some embodiments, in order to generate an appropriate preset acquisition cycle time, the first update intervals x between every two consecutive new blocks (i.e., a new root certificate authority joins the root certificate authority alliance, and the root institution-related information of the new root certificate authority is uploaded to the blockchain to generate a new block) in the preset time periods in the alliance certificate blockchain for multiple past preset time periods (including the first time period t1 of a short time period in the recent period and the second time period t2 of a relatively long time period, and t1 < t2) are obtained, and the average value and median of these first update intervals x are calculated to obtain the first update interval average value corresponding to the first time period and the first update interval median y1, as well as the second update interval average value corresponding to the second time period and the second update interval median y2.

[0089] Next, the data of the first update interval average value and the first update interval median y1 are averaged to obtain the first interval average value and the data of the second update interval average value and the second update interval median y2 are averaged to obtain the second interval average value Then, the first interval average value is multiplied by the first weight α1 to obtain the first weighted interval, the second interval average value is multiplied by the second weight α2 to obtain the second weighted interval, and finally the first weighted interval and the second weighted interval are accumulated to obtain the preset restart time

[0090]

[0091] Among them, since the first time period is smaller than the second time period, that is, the first time period is closer to the current update moment compared to the second time period, the data information of the first interval average value corresponding to the first time period can better reflect the new block addition interval of the alliance certificate blockchain at the current moment. Therefore, the first weight α1 is greater than the second weight α2, and the sum of the first weight and the second weight is equal to one.

[0092] Through the above steps 601 to step 603, by using the update interval average value and update interval median corresponding to two recent time periods in the alliance certificate blockchain, and further combining different weights corresponding to different time periods, a preset restart time that better conforms to the new block addition interval of the alliance certificate blockchain at the current moment can be generated.

[0093] Referring to Figure 7 , to obtain the root institution identifiers and institutional root certificates of all root certificate authorities from the alliance certificate blockchain, the following steps 701 to step 703 are further included.

[0094] Step 701: Send an access request to a target website based on the backup organization root certificate.

[0095] Step 702: Receive failure feedback information sent by the website server corresponding to the target website according to the access request and the backup agency root certificate.

[0096] Step 703: According to the failure feedback information, the root authority identifiers and the root certificates of all root certificate authorities are obtained from the alliance certificate blockchain.

[0097] Steps 701 to 703 are described in detail below.

[0098] In some embodiments, after the network device obtains the root organization identifiers and organization root certificates of all root certificate authorities from the alliance certificate blockchain in advance and stores them in a storage device as backup data (including the backup organization root certificate corresponding to the target organization identifier), the network device sends an access request to the target website based on the backup organization root certificate. At this time, the organization root certificate corresponding to the target organization identifier has been updated, that is, the organization root of the target root certificate authority itself has been updated, so that the organization root certificate has been updated. At this time, the target root certificate authority will chain the updated root organization related information again in the alliance certificate blockchain to generate a new block, but this new block occurs within a preset acquisition cycle time (that is, after the network device last acquired data in the alliance certificate blockchain and before the next data acquisition in the alliance certificate blockchain).

[0099] At this time, the network device will receive the access request of the target website issued by the network device and the failure feedback information issued by the backup agency root certificate from the website server corresponding to the target website. Based on this, the network device will obtain the root agency identifier and agency root certificate of all root certificate agencies from the alliance certificate blockchain again according to the failure feedback information, so as to obtain the new target agency root certificate of the target root certificate agency corresponding to the target website, so as to facilitate the subsequent use of the new target agency root certificate to access the target website again.

[0100] Reference Figure 8 , obtaining the root authority identifiers and authority root certificates of all root certificate authorities from the alliance certificate blockchain, also includes the following step 801.

[0101] Step 801: If the current time is not within the validity period of the certificate, obtain the root authority identifier and the root certificate of all root certificate authorities from the alliance certificate blockchain.

[0102] Step 801 is described in detail below.

[0103] In some embodiments, the institution root certificate held by each root certificate management agency has a certain certificate validity period (i.e., it is not held for an unlimited time), and because the certificate validity period is also stored in the alliance certificate blockchain, when the network device obtains data in the alliance certificate blockchain, it will also obtain the certificate validity period corresponding to each institution root certificate. When accessing the target website, if it is determined that the current time is not within the certificate validity period of the target institution root certificate, the network device will again obtain the root institution identifier and institution root certificate of all root certificate authorities from the alliance certificate blockchain, so as to obtain a new target institution root certificate of the target root certificate authority corresponding to the target website, thereby facilitating the subsequent use of the new target institution root certificate to access the target website.

[0104] Step 203: Access the target website based on the target organization root certificate.

[0105] Step 203 is described in detail below.

[0106] In some embodiments, after obtaining the target organization's root certificate, the network device uses the browser it carries to log in to the address corresponding to the target website, and sends the target organization's root certificate to the target website so that the server corresponding to the target website can verify whether the network device is an identity that can access the target website based on the target organization's root certificate, and after the verification is successful, establish an encrypted connection (such as HTTPS) between the browser and the target website so that the network device can access the target website.

[0107] It is understandable that the network device generally refers to the network device in the region where all the root certificate authorities in the root certificate authority alliance are located, but the network devices in other regions that can be connected to the alliance certificate blockchain can also implement the above-mentioned website access method.

[0108] The website access method, device, electronic device and storage medium proposed in the embodiment of the present application include: first, determining a target root certificate authority corresponding to a target website from multiple root certificate authorities, wherein the multiple root certificate authorities are located in the same alliance certificate blockchain, and the alliance certificate blockchain is used to store at least the institutional root certificate of each root certificate authority; then, obtaining a first update interval mean and a first update interval median for all newly added block information in a first time period in the past from the alliance certificate blockchain, and obtaining a second update interval mean and a second update interval median for all newly added block information in a second time period in the past from the alliance certificate blockchain, wherein the first time period is smaller than the second time period, and performing data averaging processing on the first update interval mean and the first update interval median A first interval mean is obtained, and a second update interval mean and a second update interval median are processed for data averaging to obtain a second interval mean, the first interval mean is multiplied by a first weight to obtain a first weight interval, the second interval mean is multiplied by a second weight to obtain a second weight interval, the first weight interval and the second weight interval are accumulated to obtain a preset acquisition cycle time, the first weight is greater than the second weight, and the sum of the first weight and the second weight is equal to one, based on the preset acquisition cycle time, the root organization identifier and the organization root certificate of all root certificate authorities are periodically obtained from the alliance certificate blockchain, the target organization identifier corresponding to the target root certificate authority is obtained, and the target organization root certificate is selected from multiple organization root certificates based on the target organization identifier; finally, the target website is accessed based on the target organization root certificate.

[0109] The embodiment of the present application utilizes the alliance certificate blockchain to manage multiple root certificate authorities in the same or different regions, and utilizes the characteristic that the blockchain's on-chain information cannot be tampered with to store the legitimate institution root of each root certificate authority in the alliance on the alliance certificate blockchain. Therefore, when a network device accesses a target website, it can use the target institution root certificate corresponding to the target root certificate authority corresponding to the target website obtained from the alliance certificate blockchain to access the target website normally, so as to avoid the possibility of invalid certificates, thereby greatly improving the reliability of website access by network devices. In addition, the frequency information added by the alliance certificate blockchain is used to The preset acquisition cycle time obtained by the information is used to periodically obtain the root organization identifiers and organization root certificates of all root certificate authorities from the alliance certificate blockchain, so that when the network device visits the target website, the target organization root certificate required by the target website can be directly used without having to obtain data from the alliance certificate blockchain again, thereby effectively reducing the communication overhead of the network device; and, by using the update interval mean and update interval median corresponding to the recent two time periods of the alliance certificate blockchain, and further combining the different weights corresponding to different time periods, a preset restart time for the new block addition interval of the alliance certificate blockchain that is more in line with the current moment can be better generated.

[0110] The present application also provides a website access device that can implement the above website access method. Fig. 9 , the device 900 comprises:

[0111] An institution determination module 910 is used to determine a target root certificate authority corresponding to a target website from a plurality of root certificate authorities, wherein the plurality of root certificate authorities are located in the same alliance certificate blockchain, and the alliance certificate blockchain is used to store at least an institution root certificate of each root certificate authority;

[0112] The certificate acquisition module 920 is used to obtain the target organization root certificate corresponding to the target root certificate authority from the alliance certificate blockchain;

[0113] The login module 930 is used to access the target website based on the target organization root certificate.

[0114] In some embodiments, the certificate acquisition module 920 is further configured to:

[0115] Obtain the root authority identifier and authority root certificate of all root certificate authorities from the alliance certificate blockchain;

[0116] A target organization identifier corresponding to a target root certificate authority is obtained, and a target organization root certificate is selected from multiple organization root certificates based on the target organization identifier.

[0117] In some embodiments, the certificate acquisition module 920 is further configured to:

[0118] Get the preset acquisition cycle time;

[0119] Based on the preset acquisition cycle time, the root authority identifiers and authority root certificates of all root certificate authorities are periodically obtained from the alliance certificate blockchain.

[0120] In some embodiments, the certificate acquisition module 920 is further configured to:

[0121] Obtaining a first update interval mean and a first update interval median of the alliance certificate blockchain for all newly added block information in a first time period in the past, and obtaining a second update interval mean and a second update interval median of the alliance certificate blockchain for all newly added block information in a second time period in the past, wherein the first time period is less than the second time period;

[0122] Performing data averaging processing on the first update interval mean and the first update interval median to obtain a first interval mean, and performing data averaging processing on the second update interval mean and the second update interval median to obtain a second interval mean;

[0123] The first weight interval is obtained by multiplying the first interval mean by the first weight, the second weight interval is obtained by multiplying the second interval mean by the second weight, the first weight interval and the second weight interval are accumulated to obtain the preset acquisition cycle time, the first weight is greater than the second weight, and the sum of the first weight and the second weight is equal to one.

[0124] In some embodiments, the certificate acquisition module 920 is further configured to:

[0125] Send an access request to the target website based on the backup organization's root certificate;

[0126] Receiving failure feedback information sent by the website server corresponding to the target website according to the access request and the root certificate of the backup organization;

[0127] According to the failure feedback information, the root authority identifiers and authority root certificates of all root certificate authorities are obtained from the alliance certificate blockchain.

[0128] In some embodiments, the certificate acquisition module 920 is further configured to:

[0129] If the current time is not within the validity period of the certificate, the root authority identifiers and root certificates of all root certificate authorities are obtained from the alliance certificate blockchain.

[0130] In the above embodiments, the description of each embodiment has its own emphasis. For the part not described in detail in a certain embodiment, the specific implementation of the website access device is basically the same as the specific implementation of the above website access method, and will not be repeated here.

[0131] In the embodiment of the present application, the website access device of the present application utilizes the alliance certificate blockchain to manage multiple root certificate authorities in the same or different regions, and utilizes the characteristic that the blockchain's on-chain information cannot be tampered with, so that the legitimate institution root of each root certificate authority in the alliance is stored and chained in the alliance certificate blockchain, so that when the network device accesses the target website, the target institution root certificate corresponding to the target root certificate authority corresponding to the target website obtained from the alliance certificate blockchain can be used to perform normal target website access, so as to avoid the possibility of invalid certificate, thereby greatly improving the reliability of website access by the network device; in addition, by utilizing the alliance certificate blockchain The preset acquisition cycle time obtained from the frequency information of new data additions is used to periodically obtain the root organization identifiers and organization root certificates of all root certificate authorities from the alliance certificate blockchain, so that when the network device visits the target website, the target organization root certificate required by the target website can be directly used without having to obtain data from the alliance certificate blockchain again, thereby effectively reducing the communication overhead of the network device; and, by utilizing the update interval mean and update interval median corresponding to the recent two time periods of the alliance certificate blockchain, and further combining the different weights corresponding to different time periods, a preset restart time for the new block addition interval of the alliance certificate blockchain that is more in line with the current moment can be better generated.

[0132] The present application also provides an electronic device, including:

[0133] at least one memory;

[0134] at least one processor;

[0135] at least one program;

[0136] The program is stored in the memory, and the processor executes the at least one program to implement the website access method implemented in the present application. The electronic device can be any intelligent terminal including a mobile phone, a tablet computer, a personal digital assistant (PDA), a car computer, etc.

[0137] See also Fig.10 , Fig.10 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0138] The processor 1001 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0139] The memory 1002 can be implemented in the form of ROM (Read Only Memory), static storage device, dynamic storage device or RAM (Random Access Memory). The memory 1002 can store operating systems and other applications. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1002, and the processor 1001 calls and executes the website access method of the embodiments of this application;

[0140] Input / output interface 1003, used to implement information input and output;

[0141] The communication interface 1004 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.);

[0142] A bus 1005 , which transmits information between various components of the device (e.g., the processor 1001 , the memory 1002 , the input / output interface 1003 , and the communication interface 1004 );

[0143] The processor 1001 , the memory 1002 , the input / output interface 1003 and the communication interface 1004 are connected to each other in communication within the device via the bus 1005 .

[0144] An embodiment of the present application further provides a storage medium, which is a computer-readable storage medium and stores a computer program. When the computer program is executed by a processor, the above-mentioned website access method is implemented.

[0145] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0146] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0147] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0148] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0149] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0150] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0151] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0152] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. The mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0153] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0154] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0155] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0156] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A website access method, characterized in that: include: Determine a target root certificate authority corresponding to the target website from a plurality of root certificate authorities, wherein the plurality of root certificate authorities are located in the same alliance certificate blockchain, and the alliance certificate blockchain is used to store at least an institutional root certificate of each of the root certificate authorities; Obtaining a target organization root certificate corresponding to the target root certificate authority from the alliance certificate blockchain; The target website is accessed based on the target organization root certificate.

2. The website access method according to claim 1, characterized in that: The obtaining, from the alliance certificate blockchain, a target agency root certificate corresponding to the target root certificate agency comprises: Obtaining root authority identifiers and authority root certificates of all root certificate authorities from the alliance certificate blockchain; A target organization identifier corresponding to the target root certificate authority is obtained, and the target organization root certificate is selected from a plurality of organization root certificates based on the target organization identifier.

3. The website access method according to claim 2, characterized in that: The obtaining the root authority identifiers and authority root certificates of all root certificate authorities from the alliance certificate blockchain includes: Get the preset acquisition cycle time; Based on the preset acquisition cycle time, the root authority identifiers and authority root certificates of all root certificate authorities are periodically acquired from the alliance certificate blockchain.

4. The website access method according to claim 3, characterized in that: The step of obtaining a preset acquisition cycle time includes: Obtaining a first update interval mean and a first update interval median of the alliance certificate blockchain for all newly added block information in a first time period in the past, and obtaining a second update interval mean and a second update interval median of the alliance certificate blockchain for all newly added block information in a second time period in the past, wherein the first time period is less than the second time period; Performing data averaging processing on the first update interval mean and the first update interval median to obtain a first interval mean, and performing data averaging processing on the second update interval mean and the second update interval median to obtain a second interval mean; The first weight interval is obtained by multiplying the first interval mean by the first weight, the second weight interval is obtained by multiplying the second interval mean by the second weight, the first weight interval and the second weight interval are accumulated to obtain the preset acquisition cycle time, the first weight is greater than the second weight, and the sum of the first weight and the second weight is equal to one.

5. The website access method according to claim 2, characterized in that: The network device stores a backup organization root certificate corresponding to the target organization identifier, and the step of obtaining the root organization identifiers and organization root certificates of all root certificate organizations from the alliance certificate blockchain includes: Sending an access request to the target website based on the backup organization root certificate; Receiving failure feedback information issued by the website server corresponding to the target website according to the access request and the backup agency root certificate; According to the failure feedback information, the root authority identifiers and the authority root certificates of all the root certificate authorities are obtained from the alliance certificate blockchain.

6. The website access method according to claim 2, characterized in that: The network device stores the certificate validity period corresponding to the target organization identifier, and the obtaining the root organization identifiers and organization root certificates of all root certificate organizations from the alliance certificate blockchain includes: If the current time is not within the validity period of the certificate, the root authority identifiers and the root certificates of all root certificate authorities are obtained from the alliance certificate blockchain.

7. The website access method according to claim 1, characterized in that: Before obtaining the target organization root certificate corresponding to the target root certificate authority from the alliance certificate blockchain, when a new root certificate authority joins the alliance certificate blockchain, at least one of the organization root certificate, root organization identification, organization registration information, region code, applicable software information, and region signature information of the new root certificate authority is synchronously uploaded to the chain.

8. A website access device, characterized in that: include: An institution determination module, used to determine a target root certificate authority corresponding to a target website from a plurality of root certificate authorities, wherein the plurality of root certificate authorities are located in the same alliance certificate blockchain, and the alliance certificate blockchain is used to store at least an institution root certificate of each of the root certificate authorities; A certificate acquisition module, used to obtain a target institution root certificate corresponding to the target root certificate authority from the alliance certificate blockchain; A login module is used to access the target website based on the target organization root certificate.

9. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and the processor implements the website access method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the website access method according to any one of claims 1 to 7 is implemented.

Images