Digital certificate security audit system and method based on multimodal analysis and cross-cloud architecture

Abstract

The present invention relates to the field of digital certificate audit technology, and specifically to a digital certificate security audit system and method based on a multimodal analysis cross-cloud architecture. The system includes: a cross-cloud certificate acquisition module, a multimodal risk analysis module, and a dynamic risk assessment module; the cross-cloud certificate acquisition module collects metadata of digital certificates from different cloud platforms for distributed storage and caching; the multimodal risk analysis module performs certificate chain parsing, permission policy verification, and dynamic file type detection on digital certificates, generating multimodal analysis results and comprehensive risk scores; the dynamic risk assessment module performs risk prediction on digital certificates based on a pre-trained LSTM prediction model combined with the multimodal analysis results, generating a risk heat map and remediation suggestions. The present invention can realize integrated auditing of dynamic risk identification and cross-cloud environments, not only with high audit efficiency, but also with risk prediction and remediation response.

Description

Technical Field

[0001] The present invention relates to the field of digital certificate audit technology, and more specifically to a digital certificate security audit system and method based on multimodal analysis and cross-cloud architecture. Background Art

[0002] Current cross-cloud certificate management systems face the following technical bottlenecks: 1. Difficulty adapting to heterogeneous environments. Certificate storage formats vary significantly across cloud platforms, making adaptation difficult and requiring customized parsing logic. 2. Low audit efficiency. Traditional tools rely on single-point scanning, making it difficult to achieve efficient, parallel auditing across cloud clusters. 3. Fragmented security policies. Certificate permission policies on each cloud platform are independent of each other, lacking global consistency analysis and easily leading to compliance risks.

[0003] Although the existing JCE architecture supports certificate parsing, it cannot meet the needs of dynamic expansion across clouds and lacks compatibility with cloud-native services.

[0004] Therefore, how to achieve dynamic risk identification and integrated auditing across cloud environments is an urgent problem that technical personnel in this field need to solve. Summary of the Invention

[0005] In view of this, the present invention provides a digital certificate security audit system and method based on multimodal analysis of cross-cloud architecture, which can realize dynamic risk identification and integrated auditing across cloud environments. It not only has high audit efficiency, but also can realize risk prediction and repair response.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] In a first aspect, the present invention provides a digital certificate security audit system based on a multimodal analysis cross-cloud architecture, comprising: a cross-cloud certificate collection module, a multimodal risk analysis module, and a dynamic risk assessment module;

[0008] The cross-cloud certificate collection module is used to adapt to different cloud platforms and collect metadata of digital certificates of different cloud platforms across clouds for distributed storage and caching;

[0009] The multimodal risk analysis module is used to retrieve the metadata of the target digital certificate from the cache, perform certificate chain parsing, permission policy verification and file type dynamic detection on it, and generate multimodal analysis results and comprehensive risk scores;

[0010] The dynamic risk assessment module predicts the risk of digital certificates based on a pre-trained LSTM prediction model combined with multimodal analysis results, and generates a risk heat map and repair suggestions.

[0011] Furthermore, the cross-cloud certificate collection module includes: a cloud platform adaptation layer, a data collection layer, a data standardization engine, and a distributed storage manager;

[0012] The cloud platform adaptation layer is used to uniformly encapsulate the API interfaces of different cloud platforms, shield the underlying differences, and provide a standardized certificate metadata access interface;

[0013] The data collection layer is used to capture various digital certificates of multiple cloud platforms using concurrent certificate sniffing, and automatically deploy lightweight probes to the edge nodes of each cloud platform using containerization technology based on the edge node identifiers of each cloud platform, and monitor digital certificate change events in real time through the lightweight probes;

[0014] The data standardization engine is used to convert heterogeneous data collected from various cloud platforms into a unified JSON structure;

[0015] The distributed storage manager is used to encrypt digital certificate metadata using a symmetric encryption algorithm, store the encrypted data in a distributed manner in a persistent database, write it into the cache, and eliminate low-frequency data in the cache according to a preset cache elimination strategy.

[0016] Furthermore, the change events monitored by the lightweight probe include lifecycle events, content change events and security events; wherein, the lifecycle events include certificate addition, revocation and expiration; the content change events include private key replacement, certificate chain update and permission policy modification; the security event is the malicious tampering of the key file.

[0017] Furthermore, the data collection layer is also used to dynamically expand or shrink the deployment of lightweight probes according to changes in the cloud platform edge nodes. When a new cloud platform edge node registration event is detected, the lightweight probe is automatically deployed under the new cloud platform edge node. When a cloud platform edge node is detected to be offline, the probe deployed on the edge node is deleted.

[0018] Furthermore, the unified JSON structure includes the following core fields:

[0019] "cert_id", "issuer", "expiration", "key_algorithm", "permissions", "storage_path", "hash_alg", and "risk_tags" represent "unique identifier", "issuing authority", "expiration time", "algorithm type", "policy-associated permissions", "key storage path", "certificate digest algorithm", and "risk tags", respectively.

[0020] Furthermore, the cross-cloud certificate collection module also includes a key vault for centrally managing the API list used by each cloud platform to obtain digital certificates and the obtained digital certificate key information.

[0021] Furthermore, the multimodal risk analysis module includes a certificate / key detector, a policy compliance detector, a file type detector, and a multimodal data fusion engine;

[0022] The certificate / key detector is used to parse the extension field of the X.509 certificate and verify the integrity of the certificate chain; extract the private key in the PKCS#12 format, attempt to parse the PFX or JKS certificate library file through the password library collision method, and detect the password strength; use the Shannon entropy formula to calculate the entropy value of the byte sequence of the private key data. If the entropy value is less than a custom threshold, the current private key data is stored in plain text or weakly encrypted, and a risk label is generated;

[0023] The policy compliance detector is used to verify whether the access rights of the digital certificate are consistent with the pre-defined IAM policy. If not, unauthorized access exists and a risk tag is generated;

[0024] The file type detector is used to parse the file header in real time to determine whether the extension has been maliciously tampered with, and to detect in real time whether non-certificate files are mixed into the certificate directory to generate a risk label;

[0025] The multimodal data fusion engine is used to fuse the multimodal risk detection results, perform standardized scoring based on each risk detection result, and then perform weighted summation to obtain a comprehensive risk score.

[0026] Furthermore, the dynamic risk assessment module includes an LSTM prediction model, a heat map generator, and an automated response engine;

[0027] The LSTM prediction model is trained based on historical certificate time series data, and predicts the risk probability of digital certificates based on the current multimodal analysis results, determines the risk level, and adjusts the risk level threshold based on business priorities;

[0028] The heat map generator is used to display certificates in layers according to cloud platform, business unit and risk level, and supports drilling down to view certificate details;

[0029] The automated response engine is used to adopt different response strategies according to risk levels.

[0030] Furthermore, the dynamic risk assessment module also includes: a work order unit, an alarm unit and a log unit; for a digital certificate with a high risk level, the automated response engine triggers the work order unit to generate a work order and revoke the digital certificate; for a digital certificate with a medium risk level, the automated response engine triggers the alarm unit to push an alarm that the digital certificate needs to be updated; for a certificate with a low risk level, the automated response engine triggers the log unit to record a log and include the digital certificate in the periodic inspection plan.

[0031] In a second aspect, the present invention provides a digital certificate security audit method based on multimodal analysis across cloud architecture, which is applied to the above-mentioned system, including:

[0032] Collect digital certificate metadata from different cloud platforms across clouds for distributed storage and caching;

[0033] Retrieve the metadata of the target digital certificate from the cache, perform certificate chain parsing, permission policy verification, and dynamic file type detection on it, and generate multimodal analysis results and comprehensive risk scores;

[0034] Based on the pre-trained LSTM prediction model and combined with multimodal analysis results, risk prediction of digital certificates is performed to generate risk heat maps and repair suggestions.

[0035] It can be seen from the above technical solutions that compared with the prior art, the present invention has the following beneficial effects:

[0036] 1. The present invention can achieve adaptation with different cloud platforms and digital certificate collection, and then conduct batch unified audits of digital certificates in different cloud environments and different storage formats, thereby improving the audit efficiency of cross-cloud certificates.

[0037] 2. This invention combines static analysis (certificate chain analysis and permission policy verification) with dynamic analysis (file type detection) to monitor digital certificates. It can identify common risks such as weak algorithms, permission leaks, and unencrypted keys, expanding risk identification coverage and comprehensively ensuring certificate security. Furthermore, through dynamic threshold adjustment and intelligent analysis, false positive rates are significantly reduced.

[0038] 3. The present invention is not limited to risk assessment of the current status of the certificate, but can also predict the risk of the future status, automatically generate repair suggestions based on the prediction results, and improve the efficiency of automated repair. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0040] Figure 1 A schematic diagram of the structure of the digital certificate security audit system based on multimodal analysis and cross-cloud architecture provided by the present invention;

[0041] Figure 2 This is a schematic diagram of the structure of the cross-cloud certificate collection module provided by the present invention;

[0042] Figure 3 A schematic diagram of the structure of the multimodal risk analysis module provided by the present invention;

[0043] Figure 4 This is a structural diagram of the dynamic risk assessment module provided by the present invention. DETAILED DESCRIPTION

[0044] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0045] like Figure 1 As shown, an embodiment of the present invention discloses a digital certificate security audit system based on a multimodal analysis cross-cloud architecture, including: a cross-cloud certificate collection module, a multimodal risk analysis module and a dynamic risk assessment module;

[0046] The cross-cloud certificate collection module is used to adapt to different cloud platforms and collect metadata of digital certificates from different cloud platforms for distributed storage and caching;

[0047] The multimodal risk analysis module is used to retrieve the metadata of the target digital certificate from the cache, perform certificate chain parsing, permission policy verification, and dynamic file type detection on it, and generate multimodal analysis results and comprehensive risk scores;

[0048] The dynamic risk assessment module predicts the risks of digital certificates based on a pre-trained LSTM prediction model combined with multimodal analysis results, and generates risk heat maps and repair suggestions.

[0049] The specific structure and functions of each of the above modules are further explained below.

[0050] like Figure 2 As shown, the cross-cloud certificate collection module includes: cloud platform adaptation layer, data collection layer, data standardization engine, distributed storage manager and key vault;

[0051] The cloud platform adaptation layer is used to uniformly encapsulate the API interfaces of different cloud platforms, shield the underlying differences, and provide standardized certificate metadata (such as certificate chain, private key path, and permission policy) access interfaces.

[0052] The data collection layer is used to capture various digital certificates of multiple cloud platforms using concurrent certificate sniffing, and automatically deploy lightweight probes to the edge nodes of each cloud platform using containerization technology based on the edge node identifiers of each cloud platform, and monitor digital certificate change events in real time through lightweight probes.

[0053] Concurrent certificate sniffing technology employs multi-threaded scanning across multiple cloud nodes, avoiding the efficiency bottlenecks of traditional single-threaded scanning. Specifically, the target cloud platform cluster is sharded by node or region, assigned to different sniffer instances, and the concurrency rate is adjusted based on node resource usage (e.g., ≤100 API calls per second). This enables audits at the thousand-node level, reducing the time from hours to minutes, adapting to the dynamic expansion of cloud environments.

[0054] Lightweight probes use containerization technologies (such as Docker) to support automatic deployment on edge nodes. During deployment, lightweight probes are packaged as Docker images, including certificate monitoring logic, cloud platform SDKs, and dependent libraries. The cloud platform automatically obtains edge node identifiers, eliminating the need for manual configuration. Once the node identifier is obtained, the probe is automatically deployed on the edge node using the identifier.

[0055] Lightweight probes regularly poll the cloud platform API (with a polling interval of ≤5 seconds) to detect changes and compare them before and after. They also support TLS two-way authentication to ensure the security of API calls and prevent man-in-the-middle attacks. They use the file system inotify (Linux) to monitor certificate storage paths (such as / etc / ssl / certs) for file creation, modification, and deletion.

[0056] The lightweight probe monitors change events including lifecycle events, content change events, and security events. Lifecycle events include certificate addition (such as uploading to cloud storage), revocation (CA-initiated revocation), and expiration (expiration of validity period). Content change events include private key replacement, certificate chain updates (such as intermediate CA replacement), and permission policy modifications (such as IAM policy binding adjustments). Security events include malicious tampering with key files. When high-risk events (such as private key modifications) are detected, real-time analysis is triggered first.

[0057] More advantageously, the data collection layer is also used to dynamically expand or shrink the deployment of lightweight probes based on changes in the cloud platform edge nodes. When a new cloud platform edge node registration event is detected, the lightweight probe is automatically deployed under the new cloud platform edge node. When a cloud platform edge node is detected to be offline, the probe deployed on the edge node is deleted.

[0058] The data standardization engine is used to convert heterogeneous data collected from various cloud platforms into a unified JSON structure; the unified JSON structure contains the following core fields:

[0059] "cert_id", "issuer", "expiration", "key_algorithm", "permissions", "storage_path", "hash_alg", and "risk_tags" respectively represent "unique identifier", "issuing authority", "expiration time", "algorithm type", "policy-associated permissions", "key storage path", "certificate digest algorithm", and "risk tags" (such as weak algorithm and overly broad permissions).

[0060] The distributed storage manager encrypts digital certificate metadata using a symmetric encryption algorithm (such as AES / SM4), distributes the encrypted data to a persistent database, writes it to the cache, and evicts infrequently used data from the cache based on a pre-set cache eviction policy. Furthermore, the manager centrally stores the APIs used by various cloud platforms to obtain digital certificates, along with the obtained digital certificate keys, in a key vault for management.

[0061] Specifically, the distributed storage manager can also dynamically manage keys in conjunction with the key management service to ensure data security at rest and in transit. The key management service allows for the addition, deletion, import, and destruction of user private keys, dynamically managing user private keys. The key generated by the key management service is used to encrypt collected metadata, preventing clear text transmission during transmission and ensuring data security. The encrypted metadata is then stored in the database to ensure secure data storage.

[0062] In addition, by building a distributed cache (such as one based on the Redis Cluster framework), millisecond-level responses are supported, and a preset cache eviction strategy is used to eliminate low-frequency data, thereby improving query efficiency. The cache eviction strategy can use the LFU algorithm, whose core logic is to prioritize the least frequently accessed data. Low-frequency data refers to data in the cache that is accessed less frequently or infrequently, for example:

[0063] 1. Certificate metadata that has not been queried for a long time (such as historical audit records and expired certificate information).

[0064] 2. Certificates that have little relevance to current business (such as certificates for non-core systems).

[0065] 3. Certificate policies that are rarely referenced in static configuration.

[0066] Long-term cache usage of this type of data can reduce the cache hit rate for high-frequency data (such as recently active certificates and core system certificate information), impacting query efficiency. By eliminating low-frequency data, cache resource allocation can be optimized to ensure fast access to high-frequency data (millisecond-level response).

[0067] The specific operation process of the cross-cloud certificate collection module includes:

[0068] 1. User initiates a request: The user sends a certificate collection instruction to the cloud platform adaptation layer.

[0069] 2. Call the cloud interface: The cloud platform adapter layer calls the Azure Key Management Library interface (such as the Get Certificate List API) to pull the original certificate data from the cloud platform.

[0070] 3. Monitor change events: The cloud platform adaptation layer subscribes to certificate change events (such as certificate expiration, renewal, etc.) to the lightweight probe; the probe monitors Azure event push in real time through a publish / subscribe model (similar to a message queue).

[0071] 4. Actively push changes: The probe will send the monitored certificate change data (such as newly issued certificates) back to the cloud platform adaptation layer in real time.

[0072] 5. Data format standardization: The cloud platform adaptation layer sends the original certificate metadata to the data standardization engine, which converts the data according to predefined JSON format specifications (such as unified date format, field naming, etc.).

[0073] 6. Encrypted storage and caching: The standardized data is transferred to the distributed storage manager, which performs the following operations:

[0074] (1) Use AES-256 encryption algorithm to protect data.

[0075] (2) Store the encrypted data in a persistent database (such as MySQL).

[0076] (3) Simultaneously write to the Redis cache to increase subsequent access speed.

[0077] 7. Result feedback: The storage results are transmitted back layer by layer (storage manager → standardization engine → cloud platform adaptation layer → user), and the user is finally notified that the collection is complete.

[0078] like Figure 3As shown, the multimodal risk analysis module includes a certificate / key detector, a policy compliance detector, a file type detector, and a multimodal data fusion engine.

[0079] The certificate / key checker performs the following checks:

[0080] 1) Parse the extended fields of X.509 certificates (such as Subject Alternative Name and CRL distribution points), verify the integrity of the certificate chain, and identify potential risks of intermediate CA organizations.

[0081] 2) Extract the private key in PKCS#12 format, try to parse the PFX or JKS certificate library file through the password library collision method, and check the password strength.

[0082] Password repository collision refers to the attempt to brute force or intelligently guess the encryption password of a PFX (PKCS#12) or JKS (Java KeyStore) certificate repository file using a predefined common password dictionary or rule library (such as the top 100,000 weak passwords or common enterprise password patterns).

[0083] The steps for collision detection in the cryptographic library are:

[0084] Password library preparation: built-in common password combinations (such as 123456, password@2023), industry default passwords (such as changeit), and historically leaked passwords of the enterprise.

[0085] Tool call: Use JCE (JCE is a Java cryptography toolkit used for certificate parsing, key management, encryption and decryption, etc.) to provide the KeyStore class to attempt to decrypt the PFX / JKS file using the password in the password library.

[0086] Multi-threaded acceleration: Tries multiple passwords in parallel (e.g., 1000 times per second) and eliminates incorrect passwords through failed responses.

[0087] Password strength assessment: If a password in the password database is successfully decrypted, it will be marked as a "weak password" and must be forcibly replaced.

[0088] 3) The entropy value of the byte sequence of the private key data is calculated using the Shannon entropy formula. If the entropy value is less than the custom threshold, the current private key data is stored in plain text or weakly encrypted, and a risk label is generated.

[0089] The policy compliance detector verifies whether the access permissions of a digital certificate are consistent with pre-defined IAM policies. If not, unauthorized access is detected and a risk tag is generated. For example, a policy simulator can be used to simulate actual usage scenarios of certificate permissions to verify whether the IAM policy and certificate permissions are consistent. If unauthorized behavior is detected, it is marked as a compliance risk.

[0090] The file type detector is used to parse file headers in real time, distinguish certificate files (.pem / .crt, etc.), key files (.key / .pri, etc.) and obfuscated attack files (such as malicious images disguised as certificates), determine whether the extension has been maliciously tampered with (such as disguising .exe as .crt), and detect in real time whether non-certificate files (such as images, executable files, etc.) are mixed in the certificate directory, generating risk labels.

[0091] The multimodal data fusion engine is used to fuse multimodal risk detection results, perform standardized scoring based on each risk detection result, assign corresponding weights to different risk categories (for example, a weak algorithm weight of 0.3, and an overly broad authority weight of 0.5), and then perform the weighted summation to obtain a comprehensive risk score.

[0092] The specific operation process of the multimodal risk analysis module is as follows:

[0093] 1. User-initiated request: The user submits a risk analysis request to the distributed storage manager, requesting a security assessment of the target certificate or key.

[0094] 2. Query metadata: The distributed storage manager quickly retrieves the metadata of the target certificate (such as certificate chain, validity period, issuer, etc.) from the Redis cache.

[0095] 3. Parsing the certificate chain: The distributed storage manager sends the certificate data to the certificate / key parser, which recursively parses the certificate chain (including root certificates, intermediate certificates, etc.) and extracts key information (such as public keys and signature algorithms).

[0096] 4. Verify permission policy: The certificate / key parser passes the parsing results to the policy compliance verifier, which calls the IAM policy to check whether the access rights of the certificate comply with security specifications (such as the principle of least privilege).

[0097] 5. Detect file type: The compliance checker sends the file path of the certificate or key to the file type detector. The file type detector determines the actual file type by parsing the file header to prevent file spoofing attacks.

[0098] 6. Calculate risk score: The certificate chain, file type, and permission policy data detection results are sent to the multimodal data fusion engine. The engine combines factors such as algorithm vulnerability weights (such as weak signature algorithms) and permission risks (such as over-authorization) to calculate a comprehensive risk score.

[0099] 7. Return analysis results: The final risk score is returned by the fusion engine to the storage manager and displayed to the user. The user can take appropriate security measures based on the score.

[0100] like Figure 4As shown in the figure, the dynamic risk assessment module includes an LSTM prediction model, a heat map generator, an automated response engine, a work order unit, an alarm unit, and a log unit.

[0101] The LSTM prediction model is trained based on historical certificate time series data. It predicts the risk probability of digital certificates based on the current multimodal analysis results, determines the risk score and risk level, and adjusts the risk level threshold based on business priorities (for example, the financial system has a higher priority).

[0102] The heat map generator is used to display certificates in layers by cloud platform, business unit, and risk level, and supports drilling down to view certificate details, allowing users to gradually drill down from a summary view to view more detailed subset data.

[0103] The automated response engine is used to adopt different response strategies based on risk levels.

[0104] For digital certificates with a high risk level (score ≥ 80), the automated response engine triggers the work order unit to generate a work order and revoke the digital certificate;

[0105] For digital certificates with a medium risk level (40 ≤ score < 80), the automated response engine triggers the alarm unit to push an alarm indicating that the digital certificate needs to be updated;

[0106] For certificates with a low risk level (score <40), the automated response engine triggers the log unit to record the log and include the digital certificate in the periodic inspection plan.

[0107] In other embodiments, the present invention further provides a digital certificate security audit method based on multimodal analysis across cloud architecture, which is applied in the above system and includes:

[0108] Collect digital certificate metadata from different cloud platforms across clouds for distributed storage and caching;

[0109] Retrieve the metadata of the target digital certificate from the cache, perform certificate chain parsing, permission policy verification, and dynamic file type detection on it, and generate multimodal analysis results and comprehensive risk scores;

[0110] Based on the pre-trained LSTM prediction model and combined with the results of multimodal analysis, the risk probability of digital certificates is predicted, and a risk heat map and repair suggestions are generated.

[0111] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0112] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A digital certificate security audit system based on multimodal analysis and cross-cloud architecture, characterized by: include: Cross-cloud certificate collection module, multimodal risk analysis module, and dynamic risk assessment module; The cross-cloud certificate collection module is used to adapt to different cloud platforms and collect metadata of digital certificates of different cloud platforms across clouds for distributed storage and caching; The multimodal risk analysis module is used to retrieve the metadata of the target digital certificate from the cache, perform certificate chain parsing, permission policy verification and file type dynamic detection on it, and generate multimodal analysis results and comprehensive risk scores; The dynamic risk assessment module predicts the risk of digital certificates based on the pre-trained LSTM prediction model combined with multimodal analysis results, and generates a risk heat map and repair suggestions; The cross-cloud certificate collection module includes: a cloud platform adaptation layer and a data collection layer; The cloud platform adaptation layer is used to uniformly encapsulate the API interfaces of different cloud platforms, shield the underlying differences, and provide a standardized certificate metadata access interface; The data collection layer is used to capture various digital certificates of multiple cloud platforms using concurrent certificate sniffing, and automatically deploy lightweight probes to the edge nodes of each cloud platform using containerization technology based on the edge node identifiers of each cloud platform, and monitor digital certificate change events in real time through the lightweight probes; The data collection layer is also used to dynamically expand or shrink the deployment of lightweight probes based on changes in the cloud platform edge nodes. When a new cloud platform edge node registration event is detected, the lightweight probe is automatically deployed under the new cloud platform edge node. When a cloud platform edge node is detected to be offline, the probe deployed at the edge node is deleted.

2. The digital certificate security audit system based on multimodal analysis and cross-cloud architecture according to claim 1 is characterized in that: The cross-cloud certificate acquisition module also includes a data standardization engine and a distributed storage manager; The data standardization engine is used to convert heterogeneous data collected from various cloud platforms into a unified JSON structure; The distributed storage manager is used to encrypt digital certificate metadata using a symmetric encryption algorithm, store the encrypted data in a distributed manner in a persistent database, write it into the cache, and eliminate low-frequency data in the cache according to a preset cache elimination strategy.

3. The digital certificate security audit system based on multimodal analysis and cross-cloud architecture according to claim 1 is characterized in that: The change events monitored by the lightweight probe include lifecycle events, content change events and security events; among them, the lifecycle events include certificate addition, revocation and expiration; the content change events include private key replacement, certificate chain update and permission policy modification; the security event is the malicious tampering of the key file.

4. The digital certificate security audit system based on multimodal analysis and cross-cloud architecture according to claim 2 is characterized in that: The unified JSON structure contains the following core fields: "cert_id", "issuer", "expiration", "key_algorithm", "permissions", "storage_path", "hash_alg", and "risk_tags" represent "unique identifier", "issuing authority", "expiration time", "algorithm type", "policy association authority", "key storage path", "certificate digest algorithm", and "risk tag" respectively.

5. The digital certificate security audit system based on multimodal analysis and cross-cloud architecture according to claim 1 is characterized in that: The cross-cloud certificate collection module also includes a key vault for centrally managing the API list used by each cloud platform to obtain digital certificates and the obtained digital certificate key information.

6. The digital certificate security audit system based on multimodal analysis and cross-cloud architecture according to claim 1 is characterized in that: The multimodal risk analysis module includes a certificate / key detector, a policy compliance detector, a file type detector, and a multimodal data fusion engine; The certificate / key detector is used to parse the extension field of the X.509 certificate and verify the integrity of the certificate chain; extract the private key in the PKCS#12 format, attempt to parse the PFX or JKS certificate library file through the password library collision method, and detect the password strength; use the Shannon entropy formula to calculate the entropy value of the byte sequence of the private key data. If the entropy value is less than a custom threshold, the current private key data is stored in plain text or weakly encrypted, and a risk label is generated; The policy compliance detector is used to verify whether the access rights of the digital certificate are consistent with the pre-defined IAM policy. If they are inconsistent, unauthorized access exists and a risk tag is generated; The file type detector is used to parse the file header in real time to determine whether the extension has been maliciously tampered with, and to detect in real time whether non-certificate files are mixed into the certificate directory to generate a risk label; The multimodal data fusion engine is used to fuse the multimodal risk detection results, perform standardized scoring based on each risk detection result, and then perform weighted summation to obtain a comprehensive risk score.

7. The digital certificate security audit system based on multimodal analysis and cross-cloud architecture according to claim 1 is characterized in that: The dynamic risk assessment module includes an LSTM prediction model, a heat map generator, and an automated response engine; The LSTM prediction model is trained based on historical certificate time series data, and predicts the risk probability of digital certificates based on the current multimodal analysis results, determines the risk level, and adjusts the risk level threshold based on business priorities; The heat map generator is used to display certificates in layers according to cloud platform, business unit and risk level, and supports drilling down to view certificate details; The automated response engine is used to adopt different response strategies according to risk levels.

8. The digital certificate security audit system based on multimodal analysis and cross-cloud architecture according to claim 7 is characterized in that: The dynamic risk assessment module also includes: a work order unit, an alarm unit and a log unit; for a digital certificate with a high risk level, the automated response engine triggers the work order unit to generate a work order and revoke the digital certificate; for a digital certificate with a medium risk level, the automated response engine triggers the alarm unit to push an alarm indicating that the digital certificate needs to be updated; for a certificate with a low risk level, the automated response engine triggers the log unit to record a log and include the digital certificate in a periodic inspection plan.

9. A digital certificate security audit method based on multimodal analysis across cloud architecture, characterized in that: The system is applied in any one of claims 1 to 8, comprising: Collect digital certificate metadata from different cloud platforms across clouds for distributed storage and caching; Retrieve the metadata of the target digital certificate from the cache, perform certificate chain parsing, permission policy verification, and dynamic file type detection on it, and generate multimodal analysis results and comprehensive risk scores; Based on the pre-trained LSTM prediction model and combined with multimodal analysis results, risk prediction of digital certificates is performed to generate risk heat maps and repair suggestions.

Images