Distributed digital certificate verification method and system and electronic equipment

Abstract

The invention provides a distributed digital certificate verification method and system and electronic equipment, and the method comprises the steps: receiving an installation package which is from a server and carries a digital certificate, and the digital certificate comprises first total hardware information of a distributed node server and a unique application identifier of an application; installing the digital certificate based on the installation package, and obtaining current second total hardware information of the distributed node server; comparing the second total hardware information with the first total hardware information carried by the digital certificate, and if it is determined that the digital certificate is successfully installed according to a comparison result, obtaining single hardware information of a node server currently connected with the client; and matching the single hardware information with the first total hardware information, and determining whether the digital certificate is successfully verified. Therefore, each application has a unique application identifier, data isolation is carried out among the applications, digital verification of multiple applications can be efficiently completed in a distributed scene, and the expandability is high.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a distributed digital certificate verification method, system and electronic device. Background Art

[0002] In the construction of modern enterprise informatization, with the rapid development of cloud computing, big data and Internet of Things technologies, application systems are gradually transforming to distributed and microservice architectures to adapt to the growing business needs and user access. Although the distributed deployment of application systems to multiple node servers can improve the scalability and fault tolerance of the system and ensure the stable operation of the system in a high-concurrency environment, multiple applications on the server may need to verify their digital certificates, which brings new challenges to the authorization and verification of digital certificates. In related technologies, a single node server is usually used as the authorization object of the digital certificate, so that the installation and verification of the digital certificate can be centralized.

[0003] However, there are a large number of distributed servers, which may increase or decrease dynamically with the development of business. Each node may run multiple different applications, each of which requires independent digital certificates for secure communication and data encryption. If digital certificates are still installed on each node server, the efficiency of digital certificate verification will be low, especially in the case of high concurrent access. Therefore, how to efficiently verify the digital certificates of applications in distributed scenarios is an urgent problem to be solved. Summary of the invention

[0004] In order to provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. The summary is not an extensive review, nor is it intended to identify key / critical components or delineate the scope of protection of these embodiments, but rather serves as a prelude to the detailed description that follows.

[0005] In view of the above-mentioned shortcomings of the prior art, the present application discloses a distributed digital certificate verification method, system and electronic device to solve the technical problem of how to efficiently isolate and verify the digital certificate of an application in a distributed scenario.

[0006] In a first aspect, the present application provides a distributed digital certificate verification method, the method comprising: receiving an installation package carrying a digital certificate from a server, the digital certificate comprising first total hardware information of a distributed node server and a unique application identifier of an application; installing the digital certificate based on the installation package, and obtaining the current second total hardware information of the distributed node server; comparing the second total hardware information with the first total hardware information carried by the digital certificate, and if it is determined based on the comparison result that the digital certificate has been successfully installed, obtaining single hardware information of the node server to which the client is currently connected; matching the single hardware information with the first total hardware information to determine whether the digital certificate has been successfully verified.

[0007] In one embodiment of the present application, before receiving the installation package carrying the digital certificate from the server, it also includes: obtaining the access address of the service instance deployed on each of the node servers, the access address including the network address and the port number; concurrently calling the interface of each service instance according to the access address of each service instance, obtaining the single hardware information of each node server, and using it as the first total hardware information of the distributed node service; generating a digital signature request based on the first total hardware information and the application identifier of the target application and sending it to the server, so that the server responds to the digital signature request and generates the digital certificate, and the target application is the application for which the digital certificate is to be applied.

[0008] In one embodiment of the present application, the installation package is decompressed to determine the files included in the installation package; if the installation package only includes the files corresponding to the digital certificate and the public key, the digital certificate is asymmetrically decrypted according to the public key, and the digital certificate is installed, wherein the digital certificate is asymmetrically encrypted via a private key, and the storage path of the private key corresponds one-to-one to the application identifier.

[0009] In one embodiment of the present application, the second total hardware information is compared with the first total hardware information carried by the digital certificate, including: if the second total hardware information is consistent with the first total hardware information in the digital certificate, it is determined that the digital certificate has been installed successfully; if the second total hardware information is inconsistent with the first total hardware information in the digital certificate, it is determined that the digital certificate has failed to be installed.

[0010] In one embodiment of the present application, matching the single hardware information with the first total hardware information to determine whether the digital certificate is successfully verified includes:

[0011] If the first total hardware information includes the single hardware information, determining that the digital certificate verification is successful;

[0012] If the first total hardware information does not include the single hardware information, it is determined that the digital certificate verification fails.

[0013] In one embodiment of the present application, before matching the single hardware information with the first total hardware information and determining whether the digital certificate has been successfully verified, it also includes: constructing a certificate management object based on the successfully installed digital certificate, and using the application identifier carried by the digital certificate as the unique object identifier of the certificate management object; encrypting the certificate management object and caching it in the memory of the target node server, the cache time of the certificate management object in the memory is set to the certificate validity period carried in the digital certificate, and the target node server is the node server currently connected to the client; if the application sends a request to the target node server for the first time, reading the target certificate management object in the memory, the target certificate management object is the certificate management object corresponding to the application identifier of the application; if the target certificate management object is read, verifying the digital certificate corresponding to the target management object; if the target certificate management object is not read, the digital certificate corresponding to the target management object is expired and no longer verified.

[0014] In a second aspect, the present application provides another distributed digital certificate verification method, the method comprising: receiving a digital signature request for an application, the digital signature request carrying first total hardware information of a distributed node server and a unique application identifier of the application; in response to the digital signature request, generating a digital certificate in combination with the first total hardware information and the application identifier; sending the digital certificate to a client so that the client installs the digital certificate, and obtaining single hardware information of the node server to which the client is currently connected, matching the single hardware information with the first total hardware information, and determining whether the digital certificate is successfully verified.

[0015] In one embodiment of the present application, sending the digital certificate to the client also includes: determining the storage path of the private key of the digital certificate based on the application identifier, the application identifier and the private key correspond one-to-one, and the digital certificate carries the certificate validity period, the first total hardware information and the application identifier; obtaining the private key from the storage path to asymmetrically encrypt the digital certificate; compressing the encrypted digital certificate and the public key corresponding to the private key to obtain an installation package; and sending the installation package to the client.

[0016] In the third aspect, the present application provides a distributed digital certificate verification system, the system comprising: a client and a server; generating a digital signature request for an application on the client, the digital signature request carrying a first total hardware information of a distributed node server and a unique application identifier of the application; using the server to respond to the digital signature request, generating a digital certificate in combination with the first total hardware information and the application identifier; using the client to install the digital certificate from the server, and obtain the current second total hardware information of the distributed node server; comparing the second total hardware information with the first total hardware information carried by the digital certificate, and if it is determined that the digital certificate is successfully installed based on the comparison result, obtaining the single hardware information of the node server to which the client is currently connected; matching the single hardware information with the first total hardware information to determine whether the digital certificate is successfully verified.

[0017] In a fourth aspect, the present application also provides an electronic device comprising: a processor, a memory and a communication bus; the communication bus is used to connect the processor and the memory; the processor is used to execute a computer program stored in the memory to implement the distributed digital certificate verification method as described in the above embodiments.

[0018] Beneficial effects of the present application: The present application proposes a distributed digital certificate verification method, system and electronic device. By receiving a digital certificate sent by a server containing the first total hardware information and application identification summarized by a distributed node server, the digital certificate can be associated with the application and each node server respectively. In this way, on the one hand, when installing a digital certificate, it is only necessary to match the current second total hardware information of the distributed node server with the first total hardware information contained in the digital certificate, and the application can complete the efficient authorization of the digital certificate on all node servers, and the digital certificates of different applications have different application identifications, which is conducive to the digital certificate authorization and subsequent isolation verification of different applications in distributed scenarios. On the other hand, the verification of the digital certificate can be realized by matching the single hardware information of the node server currently connected by the client with the first total hardware information, thereby improving the efficiency of the digital certificate verification of the application.

[0019] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0021] Figure 1 is a flow chart of a distributed digital certificate verification method shown in an exemplary embodiment of the present application;

[0022] Figure 2 is a flow chart of another distributed digital certificate verification method shown in an exemplary embodiment of the present application;

[0023] Figure 3 is a block diagram of a distributed digital certificate verification system shown in an exemplary embodiment of the present application;

[0024] Figure 4 It is a structural diagram of a computer system suitable for implementing the electronic device of the present application, shown as an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0025] The following will describe the implementation methods of the present application with reference to the accompanying drawings and preferred embodiments. Those skilled in the art can easily understand other advantages and effects of the present application from the contents disclosed in this specification. The present application can also be implemented or applied through other different specific implementation methods, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present application. It should be understood that the preferred embodiments are only for illustrating the present application, not for limiting the scope of protection of the present application.

[0026] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present application, and thus the drawings only show components related to the present application rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the form, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0027] In the following description, a large number of details are discussed to provide a more thorough explanation of the embodiments of the present application. However, it is obvious to those skilled in the art that the embodiments of the present application can be implemented without these specific details. In other embodiments, well-known structures and devices are shown in the form of block diagrams rather than in detail to avoid making the embodiments of the present application difficult to understand.

[0028] See also Figure 1, is a flow chart of a distributed digital certificate verification method shown in an exemplary embodiment of the present application. The distributed digital certificate verification method can be executed by a client, such as Figure 1 As shown, in an exemplary embodiment, the distributed digital certificate verification method includes at least steps S110 to S140, which are described in detail as follows:

[0029] Step S110: receiving an installation package carrying a digital certificate from a server, where the digital certificate includes first overall hardware information of a distributed node server and a unique application identifier of an application.

[0030] In one embodiment of the present application, the first total hardware information included in the digital certificate is the total hardware information of all node servers that is collected by the client and sent to the server, that is, the hardware information of each node server in the distributed deployment is summarized, including at least the MAC address (Media Access Control Address) of each node, and the MAC addresses of different node servers are separated when stored, for example, separated by English commas to form a MAC address list; it can also include the name, IP address (Internet Protocol Address), motherboard serial number and CPU (central processing unit) serial number of each node server, and the collection of hardware information can be adjusted according to actual conditions. For multiple information of the same category in the total hardware information (such as the MAC addresses of multiple node servers), they can be spliced ​​into a VALUE value (information value), and a unique KEY value is determined for each category of information, that is, each KEY value corresponds to a VALUE value, where the VALUE value can be a string, an array or other JSON (i.e., a lightweight data exchange format) object, and is stored in a preset database. In addition, digital certificates, applications, and distributed node servers are associated through unique application identifiers, and data isolation is achieved between different applications. In this way, even if the distributed node servers are scalable, the applications can quickly associate with the expanded node servers and reallocate the corresponding digital certificates.

[0031] In one embodiment of the present application, since the distributed node servers have dynamic scalability, the node servers may be dynamically increased or decreased due to business needs. In order to ensure that the client can obtain the latest hardware information of the current distributed node server in real time, the client provides an information refresh interface for the distributed node server to facilitate obtaining the latest summarized total hardware information (i.e., the second hardware information) of the current distributed node server, thereby ensuring the accuracy of the hardware information and improving the success rate of digital certificate verification; in addition, the client also provides an information download interface for the distributed node server to output the total hardware information of the distributed node server to the local computer in JSON format.

[0032] Specifically, before receiving the installation package from the server, it also includes: obtaining the access address of the service instance deployed on each node server, the access address includes the network address and the port number; concurrently calling the interface of each service instance according to the access address of each service instance, obtaining the single hardware information of each node server, and using it as the first total hardware information of the distributed node service; generating a digital signature request based on the first total hardware information and the application identifier of the target application and sending it to the server, so that the server responds to the digital signature request and generates a digital certificate, and the target application is the application for which the digital certificate is to be applied.

[0033] In one embodiment of the present application, in order to improve the efficiency of collecting single hardware information of each node server, based on the access address of each service instance, the interface of each service instance is concurrently called by the thread pool to obtain the single hardware information of each node server, wherein the thread pool includes multiple concurrently executed threads of the same number as each service instance, and each thread calls the interface of a service instance to collect the single hardware information of the node server corresponding to the service instance, and finally the single hardware information collected by each thread is summarized to obtain the first total hardware information. In addition, after all threads are executed, it is necessary to determine whether all threads have obtained the single hardware information. If any thread does not obtain the single hardware information, the first total hardware information acquisition fails and needs to be re-acquired.

[0034] In one embodiment of the present application, a preset application programming interface (Application Programming Interface, API) or a pre-written monitoring SHELL script (i.e., a script used to automatically monitor the status and performance of service instances, usually written in Shell language) is called to obtain the service instance deployed on each node server. The API is combined with the monitoring SHELL script to obtain a list of distributed service instances. The distributed service instance list includes all currently running service instances. A service instance refers to a service running on a service node. Each service instance has its own configuration parameters and running status, and can be accessed through a specific port and protocol.

[0035] In one embodiment of the present application, since each node server can run one or more service instances, there may be multiple service instances running on the same IP address (i.e., network address) but on different ports. Therefore, after obtaining the access address of the service instance deployed on each node server, it is necessary to perform deduplication processing on each of the service instances according to the IP address, and use the remaining service instances after deduplication as the target service instance, that is, filter out the service instances with duplicate IP addresses, and only retain one service instance with the same IP address as the target service instance. Then, according to the access address of each target service instance, the interface of each target service instance is concurrently called to obtain the single hardware information of each node server. The single hardware information is the hardware information of a node server, such as the MAC address, name, IP address, motherboard serial number, and CPU serial number of the node server.

[0036] Step S120: Install the digital certificate based on the installation package, and obtain the current second total hardware information of the distributed node server.

[0037] Specifically, installing a data certificate includes: decompressing the installation package and determining the files included in the installation package; if the installation package only includes the files corresponding to the digital certificate and the public key, asymmetrically decrypting the digital certificate according to the public key and installing the digital certificate, wherein the digital certificate is asymmetrically encrypted via the private key, and the storage path of the private key corresponds one-to-one to the application identifier.

[0038] In one embodiment of the present application, the digital certificate is generated by the server and sent to the client for installation. In order to improve the security of the digital certificate, the digital certificate is encrypted on the server using a private key and decrypted on the client using a public key. Furthermore, in order to improve the flexibility and scalability of digital certificate management for different applications, a private key is generated based on the globally unique application identifier of each application to generate a private key that corresponds to the application identifier, so that the storage path of the specified private key corresponds to the application identifier, and the encryption and decryption processing of each digital certificate is isolated.

[0039] In one embodiment of the present application, in order to ensure the successful installation of the digital certificate, the integrity of the installation package needs to be verified to avoid unnecessary subsequent installations. Taking the example that the file corresponding to the digital certificate is a file with a .LIC stamp, and the file corresponding to the public key is a file with a .CER stamp, if the installation package is decompressed and only the .LIC file and the .CER file exist in the installation package, the .LIC file is installed, and the digital certificate is asymmetrically decrypted based on the CER file during the installation process.

[0040] In one embodiment of the present application, asymmetric encryption and decryption of digital certificates may be performed using an RSA algorithm (asymmetric encryption algorithm) or other algorithms, such as an ECC algorithm (elliptic curve encryption algorithm), without limitation.

[0041] Step S130, comparing the second total hardware information with the first total hardware information carried in the digital certificate, if it is determined according to the comparison result that the digital certificate is successfully installed, obtaining the single hardware information of the node server to which the client is currently connected.

[0042] Specifically, in order to ensure that the application can effectively install the digital certificate on each node server and complete the authorization of the digital certificate, it is necessary to determine whether the installation is successful, including: comparing the second total hardware information with the first total hardware information carried by the digital certificate, including: if the second total hardware information is consistent with the first total hardware information in the digital certificate, it is determined that the digital certificate has been installed successfully; if the second total hardware information is inconsistent with the first total hardware information in the digital certificate, it is determined that the digital certificate has been installed unsuccessfully.

[0043] In one embodiment of the present application, the second total hardware information is obtained in the same manner as the first total hardware information, that is, it is obtained by calling the interface implemented by the service. The difference is that the first total hardware information is previously sent by the client to the server to generate a digital certificate. However, due to the scalability of the distributed node servers, there may be dynamically increased or decreased node servers. Therefore, the client needs to re-collect the current latest total hardware information, that is, the second total hardware information. If the first total hardware information is consistent with the second total hardware information, it means that the digital certificate has been successfully installed. In this way, each node server can be used as the authorized object of the digital certificate, and the digital certificate and the application correspond one-to-one. The application no longer needs to install different digital certificates separately on each node server, making the digital certificate management and verification of multiple applications more flexible and simple.

[0044] Step S140, matching the single hardware information with the first total hardware information to determine whether the digital certificate is successfully verified.

[0045] In one embodiment of the present application, a single piece of hardware information only includes the hardware information of a node server. When a communication connection is established between a client and a node server, in order to ensure the security of communication and the integrity of data, it is necessary to verify the digital certificate of the node server to ensure that the digital certificate is valid. Moreover, if the client needs to perform digital certificate verification on each possible node server, this will greatly increase the complexity of the verification. Therefore, in order to optimize performance and reduce resource consumption, the client only performs digital certificate verification on the currently connected node server.

[0046] In one embodiment of the present application, verifying the digital certificate includes: if the first total hardware information contains a single hardware information (i.e., the single hardware information is a subset or component of the total information), the digital certificate is considered to be valid and the verification is successful; if the first total hardware information does not contain the single hardware information, the digital certificate is considered to have been tampered with or is not applicable to the currently connected node server, and the verification fails. In this way, the verification of the digital certificate only needs to verify the single hardware information, avoiding unnecessary global verification and improving the efficiency and flexibility of digital certificate verification.

[0047] In one embodiment of the present application, if the client is currently connected to multiple node servers, the single hardware information of each node server is matched with the first total hardware information respectively, and the digital certificate of each node server currently connected is verified respectively.

[0048] In one embodiment of the present application, before verifying the digital certificate, it is necessary to first determine whether the digital certificate has expired based on the validity period of the digital certificate.

[0049] Specifically, determining whether a digital certificate is expired includes: constructing a certificate management object based on the successfully installed digital certificate, and using the application identifier carried by the digital certificate as the unique object identifier of the certificate management object; encrypting the certificate management object and caching it in the memory of the target node server, and setting the cache time of the certificate management object in the memory to the certificate validity period carried in the digital certificate, and the target node server is the node server currently connected to the client; if the application sends a request to the target node server for the first time, reading the target certificate management object in the memory, and the target certificate management object is the certificate management object corresponding to the application identifier of the application; if the target certificate management object is read, verifying the digital certificate corresponding to the target management object; if the target certificate management object is not read, the digital certificate corresponding to the target management object has expired and is no longer verified.

[0050] In one embodiment of the present application, when the digital certificate is successfully installed, a certificate management object is first constructed based on the application identifier carried by the digital certificate, so that the application and the certificate management object correspond one-to-one, avoiding confusion between different applications. Then, the certificate management object is encrypted, serialized and cached in the memory of the node server to which the client is currently connected. The memory can use REDIS (Remote Dictionary Server). The certificate management object uses the application identifier as the key, that is, as an object identifier, and the cache time is set to the certificate validity period of the digital certificate. In this way, by judging whether the cache of the certificate management object is expired, it can be determined whether the digital certificate is expired.

[0051] Through the above method, the digital certificate is cached in the server memory as a certificate management object. When verification is required, the digital certificate can be quickly read and verified, which improves the verification efficiency. There is no need to install and maintain the digital certificate separately on each node server. The centralized management and caching mechanism of the certificate management object simplifies the management process of digital certificates.

[0052] See also Figure 2 , is a flow chart of a distributed digital certificate verification method shown in an exemplary embodiment of the present application. The distributed digital certificate verification method can be executed by the server, such as Figure 2 As shown, in an exemplary embodiment, the distributed digital certificate verification method includes at least steps S210 to S230, which are described in detail as follows:

[0053] Step S210: receiving a digital signature request of an application, where the digital signature request carries the first total hardware information of the distributed node server and a unique application identifier of the application.

[0054] In one embodiment of the present application, a digital signature request is sent from client to client, the first total hardware information summarizes the single hardware information of each node server in the distributed deployment, and the application identifier is used to isolate the generation, management and verification of digital certificates between different applications.

[0055] Step S220: In response to the digital signature request, generate a digital certificate by combining the first overall hardware information and the application identifier.

[0056] In one embodiment of the present application, when generating a digital certificate, the server encapsulates the certificate validity period, the first total hardware information and the application identifier of the digital certificate into the digital certificate, and also specifies the storage path of the private key applied to the digital certificate on the server according to the application identifier. The certificate validity period includes the effective time and the expiration time. During the certificate validity period, the digital certificate is considered valid and can be used for encrypted communication and identity authentication. Once the digital certificate expires, it will no longer be trusted and needs to be regenerated.

[0057] In one embodiment of the present application, the server can call a digital certificate production API to generate a digital certificate. The digital certificate production API will use a private key to perform RSA asymmetric encryption on the digital certificate to improve the efficiency of digital certificate generation and ensure the security and integrity of the digital certificate.

[0058] In one embodiment of the present application, the generated digital certificate is stored in a temporary file directory of the server, which helps to improve the immediate availability of the digital certificate and reduce the possibility of the digital certificate being exposed to potential risks for a long time.

[0059] Step S230, sending the digital certificate to the client so that the client can install the digital certificate, and obtain the single hardware information of the node server to which the client is currently connected, matching the single hardware information with the first total hardware information, and determining whether the digital certificate is successfully verified.

[0060] In one embodiment of the present application, sending a digital certificate to a client also includes: determining the storage path of a private key of the digital certificate based on an application identifier, the application identifier and the private key correspond one-to-one, and the digital certificate carries the certificate validity period, the first total hardware information and the application identifier; obtaining the private key from the storage path to asymmetrically encrypt the digital certificate; compressing the encrypted digital certificate and the public key corresponding to the private key to obtain an installation package; and sending the installation package to the client.

[0061] In one embodiment of the present application, when generating a private key, it is necessary to configure the alias of the private key entry (set as the application identifier), the length of the private key library, the certificate validity period, the private key library password, the private key entry password, the storage path, and the customer information of the encapsulated digital certificate, the customer information includes but is not limited to the first name and last name, the name of the organizational unit, the name of the organization, the city or region name, the state or province name, and the two-letter country code of the unit. Then, based on the above configuration information of the private key, write the command line of KEYTOOL (key and certificate management tool), and execute the command on the server to generate the private key, or the server can also directly call the API interface of the KEYTOOL component to generate the private key corresponding to the application and store it in the private key library.

[0062] In one embodiment of the present application, the installation and verification of the digital certificate in step S230 may refer to the contents of the above steps S130 and S240, and will not be repeated here.

[0063] Through the above method, the hardware information of each node server in the scalable distributed deployment is collected concurrently, and the application uses a unique application identifier for data isolation, so that the digital certificate authorization and verification has the three characteristics of distributed, highly scalable and multi-application.

[0064] The distributed digital certificate verification method provided by the present application has the following advantages: on the one hand, when installing a digital certificate, it is only necessary to match the current second total hardware information of the distributed node server with the first total hardware information contained in the digital certificate, and the application can complete the efficient authorization of the digital certificate on all node servers, and the digital certificates of different applications have different application identifiers, which is conducive to the digital certificate authorization and subsequent isolation verification of different applications in distributed scenarios; on the other hand, the digital certificate verification can be realized by matching the single hardware information of the node server currently connected to the client with the first total hardware information, thereby improving the efficiency of the digital certificate verification of the application.

[0065] See also Figure 3 , is a block diagram of a distributed digital certificate verification system shown in an exemplary embodiment of the present application. Figure 3 As shown, in an exemplary embodiment, the distributed digital certificate verification system includes at least a client 310 and a server 320, which are described in detail as follows:

[0066] Generate a digital signature request for the application at the client 310, where the digital signature request carries the first total hardware information of the distributed node server and a unique application identifier of the application;

[0067] Using the server 320 to generate a digital certificate in response to the digital signature request by combining the first total hardware information and the application identifier;

[0068] The digital certificate from the server 320 is installed using the client 310, and the second total hardware information of the distributed node server is obtained; the second total hardware information is compared with the first total hardware information carried by the digital certificate. If the digital certificate is successfully installed based on the comparison result, the single hardware information of the node server currently connected to the client 310 is obtained; the single hardware information is matched with the first total hardware information to determine whether the digital certificate is successfully verified.

[0069] It should be noted that the distributed digital certificate verification system provided in the above embodiment and the distributed digital certificate verification method provided in the above embodiment belong to the same concept, wherein the contents of the operations performed by each module have been described in detail in the method embodiment and will not be repeated here.

[0070] The present application also provides an electronic device, comprising: a processor, a memory and a communication bus; the communication bus is used to connect the processor and the memory; the processor is used to execute a computer program stored in the memory to implement a distributed digital certificate verification method as in the above embodiment.

[0071] See also Figure 4 , shows a schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application. It should be noted that, Figure 4 The computer system 400 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0072] like Figure 4As shown, the computer system 400 includes a central processing unit (CPU) 401, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 402 or the program loaded from the storage part 408 to the random access memory (RAM) 403, such as executing the method in the above embodiment. In the RAM 403, various programs and data required for system operation are also stored. The CPU 401, ROM 402 and RAM 403 are connected to each other through a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0073] The following components are connected to the I / O interface 405: an input section 406 including a keyboard, a mouse, etc.; an output section 407 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage section 408 including a hard disk, etc.; and a communication section 409 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 409 performs communication processing via a network such as the Internet. A drive 410 is also connected to the I / O interface 409 as needed. A removable medium 411, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 410 as needed so that a computer program read therefrom is installed into the storage section 408 as needed.

[0074] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 409, and / or installed from a removable medium 411. When the computer program is executed by a central processing unit (CPU) 401, various functions defined in the system of the present application are executed.

[0075] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0076] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0077] The above embodiments are merely illustrative of the principles and effects of the present application, and are not intended to limit the present application. Anyone familiar with the technology may modify or change the above embodiments without violating the spirit and scope of the present application. Therefore, all equivalent modifications or changes made by a person of ordinary skill in the art without departing from the spirit and technical ideas disclosed in the present application shall still be covered by the claims of the present application.

Claims

1. A distributed digital certificate verification method, characterized in that: The method comprises: Receiving an installation package carrying a digital certificate from a server, wherein the digital certificate includes first overall hardware information of a distributed node server and a unique application identifier of an application; Installing the digital certificate based on the installation package, and acquiring the second total hardware information of the distributed node server; Comparing the second total hardware information with the first total hardware information carried by the digital certificate, and if it is determined according to the comparison result that the digital certificate is successfully installed, obtaining the single hardware information of the node server to which the client is currently connected; The single hardware information is matched with the first total hardware information to determine whether the digital certificate is successfully verified.

2. The distributed digital certificate verification method according to claim 1, characterized in that: Before receiving the installation package carrying the digital certificate from the server, the method further includes: Obtaining an access address of a service instance deployed on each of the node servers, the access address including a network address and a port number; Concurrently calling the interfaces of the service instances according to the access addresses of the service instances, obtaining the single hardware information of the node servers and using it as the first total hardware information of the distributed node service; A digital signature request is generated based on the first total hardware information and the application identifier of the target application and sent to the server, so that the server generates the digital certificate in response to the digital signature request. The target application is the application for which the digital certificate is to be applied.

3. The distributed digital certificate verification method according to claim 1, characterized in that: The installing the digital certificate based on the installation package includes: Decompressing the installation package to determine the files included in the installation package; If the installation package only includes the files corresponding to the digital certificate and the public key, the digital certificate is asymmetrically decrypted according to the public key and the digital certificate is installed, wherein the digital certificate is asymmetrically encrypted via a private key, and the storage path of the private key corresponds one-to-one to the application identifier.

4. The distributed digital certificate verification method according to any one of claims 1 to 3, characterized in that: The comparing the second total hardware information with the first total hardware information carried by the digital certificate includes: If the second total hardware information is consistent with the first total hardware information in the digital certificate, it is determined that the digital certificate is successfully installed; If the second total hardware information is inconsistent with the first total hardware information in the digital certificate, it is determined that the installation of the digital certificate has failed.

5. The distributed digital certificate verification method according to any one of claims 1 to 3, characterized in that: The matching of the single hardware information with the first total hardware information to determine whether the digital certificate is successfully verified includes: If the first total hardware information includes the single hardware information, determining that the digital certificate verification is successful; If the first total hardware information does not include the single hardware information, it is determined that the digital certificate verification fails.

6. The distributed digital certificate verification method according to any one of claims 1 to 3, characterized in that: Before matching the single hardware information with the first total hardware information to determine whether the digital certificate is successfully verified, the method further includes: Construct a certificate management object based on the successfully installed digital certificate, and use the application identifier carried by the digital certificate as the unique object identifier of the certificate management object; The certificate management object is encrypted and cached in the memory of the target node server, the cache time of the certificate management object in the memory is set to the certificate validity period carried in the digital certificate, and the target node server is the node server currently connected to the client; If the application sends a request to the target node server for the first time, read the target certificate management object in the memory, where the target certificate management object is the certificate management object corresponding to the application identifier of the application; If the target certificate management object is read, verifying the digital certificate corresponding to the target management object; If the target certificate management object is not read, the digital certificate corresponding to the target management object is expired and no verification is performed.

7. A distributed digital certificate verification method, characterized in that: The method comprises: Receive a digital signature request for an application, the digital signature request carrying first total hardware information of a distributed node server and a unique application identifier of the application; In response to the digital signature request, generating a digital certificate in combination with the first overall hardware information and the application identifier; The digital certificate is sent to the client so that the client installs the digital certificate, obtains the single hardware information of the node server to which the client is currently connected, matches the single hardware information with the first total hardware information, and determines whether the digital certificate is successfully verified.

8. The distributed digital certificate verification method according to claim 7, characterized in that: The sending of the digital certificate to the client further includes: Determine a storage path of a private key of the digital certificate according to the application identifier, the application identifier and the private key correspond one to one, and the digital certificate carries the certificate validity period, the first total hardware information and the application identifier; Obtaining the private key from the storage path to perform asymmetric encryption on the digital certificate; Compressing the encrypted digital certificate and the public key corresponding to the private key to obtain an installation package; Send the installation package to the client.

9. A distributed digital certificate verification system, characterized in that: The system comprises: a client and a server; Generating a digital signature request for the application on the client, the digital signature request carrying the first total hardware information of the distributed node server and a unique application identifier of the application; generating a digital certificate by using the server in response to the digital signature request and combining the first overall hardware information and the application identifier; The digital certificate from the server is installed using the client, and the second total hardware information of the distributed node server is obtained; the second total hardware information is compared with the first total hardware information carried by the digital certificate. If the digital certificate is successfully installed according to the comparison result, the single hardware information of the node server to which the client is currently connected is obtained; the single hardware information is matched with the first total hardware information to determine whether the digital certificate is successfully verified.

10. An electronic device, characterized in that: include: processor, memory, and communications bus; The communication bus is used to connect the processor and the memory; The processor is configured to execute the computer program stored in the memory to implement the method according to any one of claims 1 to 8.

Images