Certificate information processing method and device and computer equipment

Abstract

The invention relates to the technical field of information security, and discloses a certificate information processing method and device and computer equipment, and the method comprises the steps: receiving a certificate revocation instruction which carries a certificate serial number of a revoked certificate; hash operation is carried out on the certificate serial number to obtain compressed data, the compressed data comprises a first sequence and a second sequence, the first sequence is used for being stored in a bucket data list, and the second sequence is used for updating a revocation bitmap; on the basis of the compressed data, revoked cache information is updated, the revoked cache information is used for representing all revoked certificate information, and the revoked cache information comprises the bucket data list and the revoked bitmap. Therefore, the certificate serial number is reasonably compressed and cached, and the resource consumption for caching the revoked certificate is effectively reduced.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a certificate information processing method, device and computer equipment. Background Art

[0002] In a PKI (Public Key Infrastructure) system, certificate verification requires checking whether a certificate has been revoked. The main methods for querying certificate status from a CA (Certificate Authority, also known as a certificate authority, responsible for producing and signing digital certificates) include using CRLs (Certificate Revocation Lists) and OCSP (Online Certificate Status Protocol). Since CAs typically only publish new CRLs at regular intervals, they cannot reflect the actual status of certificates in a timely manner. Therefore, OCSP is the current mainstream method for querying certificate status.

[0003] In order to further speed up the response speed of the certificate status, OCSP usually uses caching technology to cache the serial numbers of revoked certificates. Specifically, the serial numbers of revoked certificates can be cached directly, or the serial numbers of revoked certificates can be cached using a Bloom filter. If cached directly, since the size of the certificate serial number is 20 bytes, as the number of revoked certificates increases, directly caching the certificate serial number will lead to excessive memory usage and excessive resource usage. If a Bloom filter is used for caching, although the Bloom filter can reduce memory usage and improve resource utilization to a certain extent, the Bloom filter is irreversible and cannot be dynamically expanded. In addition, the Bloom filter does not support deletion operations and cannot cope with the situation where the certificate is restored after revocation. Therefore, how to reasonably cache the serial numbers of revoked certificates has become a technical problem that needs to be solved urgently. Summary of the Invention

[0004] In view of this, the present invention provides a certificate information processing method, apparatus and computer equipment to solve the technical problem of how to reasonably cache the serial numbers of revoked certificates, which has become an urgent problem to be solved.

[0005] In a first aspect, the present invention provides a certificate information processing method, the method comprising:

[0006] Receive a certificate revocation instruction, which carries the certificate serial number of the revoked certificate;

[0007] Perform a hash operation on the certificate serial number to obtain compressed data, which includes a first sequence and a second sequence. The first sequence is used to store in the bucket data list, and the second sequence is used to update the revocation bitmap.

[0008] Based on the compressed data, the revocation cache information is updated. The revocation cache information is used to represent all revoked certificate information. The revocation cache information includes a bucket data list and a revocation bitmap.

[0009] The certificate information processing method of the embodiment of the present invention, when receiving a revocation instruction carrying the certificate serial number of a revoked certificate, performs a hash operation on the certificate serial number, and combines a bucket and a bitmap method to obtain compressed data. Further, based on the compressed data, the revocation cache information used to represent the certificate information of all revoked certificates is updated. Thus, the certificate serial number is reasonably compressed and cached, effectively reducing the resource consumption of caching the revoked certificate.

[0010] In some optional implementations, before receiving the certificate revocation instruction, the method further includes:

[0011] Configure revocation cache information;

[0012] Get a list of serial numbers of revoked certificates;

[0013] Initialize revocation cache information based on the sequence number list.

[0014] The certificate information processing method of the embodiment of the present invention initializes the revocation cache information based on the serial number list of the revoked certificates before receiving the certificate revocation instruction, and obtains the revocation cache information, which effectively reduces resource consumption and improves resource utilization. It is convenient for subsequent operations such as querying and deleting the revoked certificates based on the revocation cache information, and significantly improves the convenience of revoked certificate management.

[0015] In some optional implementations, updating revocation cache information based on compressed data includes:

[0016] Store the first sequence directly into the bucket data list;

[0017] Treat the second sequence as a binary number and convert the second sequence into a decimal integer i;

[0018] Set the i-th bit of the revocation bitmap to 1.

[0019] The certificate information processing method of an embodiment of the present invention divides the result of a hash operation on a certificate serial number into a first sequence and a second sequence. The first sequence is directly stored in a bucket data list, and after customizing the second sequence, the revocation bitmap in the revocation cache information is updated. Thus, while the first sequence, which represents the uniqueness of the certificate serial number of a revoked certificate, is stored in the revocation cache information, the revocation bitmap is updated based on the second sequence, effectively compressing the certificate serial number and significantly improving cache resource utilization.

[0020] In some optional embodiments, the revocation cache information further includes a compression option for characterizing a compression mode of the certificate serial number;

[0021] Update revocation cache information based on compressed data, including:

[0022] Detect the number of revocations of revoked certificates;

[0023] When the number of revocations reaches a set threshold, the compression option is set to a first value representing a low compression mode.

[0024] In some optional implementations, updating the revocation cache information based on the compressed data further includes:

[0025] When the number of revocations is less than a set threshold, the updated revocation bitmap is compressed twice, and the compression option is set to a second value representing a high compression mode.

[0026] In the certificate information processing method of an embodiment of the present invention, the revocation cache information also includes a compression option for representing the compression mode of the certificate serial number. When updating the revocation cache information based on the compressed data, the revocation count of the revoked certificate is also detected. If the revocation count is less than a set threshold, the updated revocation bitmap is compressed twice, and the compression option is set to a second value representing a high compression mode. Thus, in the case of a small number of revoked certificates, the updated revocation bitmap is compressed twice, effectively avoiding the waste of storage resources caused by a large number of redundant bits in the revocation cache information, further freeing up resources and significantly improving resource utilization.

[0027] In some optional implementations, performing secondary compression on the updated revocation bitmap includes:

[0028] Determine the offset of the first high bit with a value of 1 from the start bit in the revocation bitmap;

[0029] Determine the offset between each high bit with a value of 1 and the previous high bit with a value of 1 in the revocation bitmap;

[0030] Determine the maximum offset value of multiple offsets;

[0031] Based on the maximum offset value, determining the number of offset storage bits for storing multiple offsets;

[0032] Based on the determined number of offset storage bits, a plurality of offsets are stored in a set order.

[0033] The certificate information processing method of the embodiment of the present invention performs secondary compression through the offset between the bits with a value of 1 in the revocation bitmap. The processing process is relatively simple, and the revocation cache information is fully retained. This effectively ensures the efficiency of subsequent queries on the certificate revocation status while significantly improving resource utilization.

[0034] In some optional embodiments, after updating the revocation cache information based on the compressed data, or after initializing the revocation cache information based on the sequence number list, the method further includes:

[0035] Receive a certificate query instruction, the query instruction carries the certificate serial number of the queried certificate;

[0036] Perform hash operation on the certificate serial number to obtain compressed data;

[0037] Based on the compressed data, the revocation cache information is traversed and queried to determine the validity of the certificate serial number.

[0038] The certificate information processing method of the present invention determines the validity of the certificate serial number by performing a hash operation on the certificate serial number to obtain compressed data. Based on the compressed data, the revocation cache information is traversed and queried, thereby simplifying the query operation and effectively improving the efficiency of certificate revocation status query.

[0039] In some optional embodiments, after updating the revocation cache information based on the compressed data, or after initializing the revocation cache information based on the sequence number list, the method further includes:

[0040] Receive a deletion instruction for revoking a certificate, the deletion instruction carrying the certificate serial number of the certificate to be deleted;

[0041] Perform hash operation on the certificate serial number to obtain compressed data;

[0042] Based on the compressed data, the revocation cache information is traversed and queried, and the compressed data is deleted from the revocation cache information.

[0043] The certificate information processing method of an embodiment of the present invention, upon receiving a deletion instruction for a revoked certificate, performs a hash operation on the certificate serial number that is identical to the certificate serial number used when the certificate was revoked. Based on the compressed data obtained from the hash operation, the method performs a traversal query on the revocation cache information and deletes the compressed data from the revocation cache information, thereby enabling the recovery of revoked certificates with simplified deletion operations. This significantly improves cache resource utilization for revoked certificates while fully ensuring the recoverability of revoked certificates, significantly enhancing the user experience.

[0044] In a second aspect, the present invention provides a certificate information processing device, the device comprising:

[0045] A receiving module, configured to receive a certificate revocation instruction, wherein the revocation instruction carries the certificate serial number of the revoked certificate;

[0046] A first compression module is used to perform a hash operation on the certificate serial number to obtain compressed data, where the compressed data includes a first sequence and a second sequence, the first sequence is used to store in the bucket data list, and the second sequence is used to update the revocation bitmap;

[0047] The update module is used to update the revocation cache information based on the compressed data. The revocation cache information is used to represent all revoked certificate information.

[0048] In a third aspect, the present invention provides a computer device comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the certificate information processing method of the first aspect or any corresponding embodiment thereof by executing the computer instructions. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0050] Figure 1 is a flow chart of a certificate information processing method according to an embodiment of the present invention;

[0051] Figure 2 is a flowchart of another certificate information processing method according to an embodiment of the present invention;

[0052] Figure 3 is a schematic diagram of compression operation according to an embodiment of the present invention;

[0053] Figure 4 is a schematic diagram of a secondary compression operation according to an embodiment of the present invention;

[0054] Figure 5 is a flowchart of another certificate information processing method according to an embodiment of the present invention;

[0055] Figure 6 1 is a flow chart of certificate query in high compression mode in a certificate information processing method according to an embodiment of the present invention;

[0056] Figure 7 is a flowchart of another certificate information processing method according to an embodiment of the present invention;

[0057] Figure 8 A schematic diagram of a compression recovery operation flow in a high compression mode in a certificate information processing method according to an embodiment of the present invention;

[0058] Figure 9 is a structural block diagram of a certificate information processing device according to an embodiment of the present invention;

[0059] Figure 10 Schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0060] To make the purpose, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative efforts shall fall within the scope of protection of the present invention.

[0061] In order to reasonably compress and cache the certificate serial number to effectively save storage resources, and support querying the compressed cache information to determine the validity of the certificate, the embodiment of the present invention provides a certificate information processing method, apparatus and computer equipment.

[0062] According to an embodiment of the present invention, an embodiment of a certificate information processing method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0063] In this embodiment, a certificate information processing method is provided, which can be used in computer equipment, terminals or servers, etc. Figure 1 : is a flowchart of a certificate information processing method according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0064] Step S101: receiving a certificate revocation instruction, where the revocation instruction carries the certificate serial number of the revoked certificate.

[0065] Specifically, upon receiving a certificate revocation instruction, it is necessary to perform the specific revocation operation based on the certificate serial number of the revoked certificate carried in the revocation instruction, and cache the certificate information of the revoked certificate. Here, the certificate serial number is generally a 160-bit sequence, which occupies a relatively large amount of storage resources. Directly caching the certificate serial number will occupy a large amount of storage resources, resulting in resource waste. Therefore, the following steps S102 and other operation steps are continued to be performed to reasonably compress the certificate serial number.

[0066] Step S102: Perform a hash operation on the certificate serial number to obtain compressed data. The compressed data includes a first sequence and a second sequence. The first sequence is used to store in the bucket data list, and the second sequence is used to update the revocation bitmap.

[0067] Specifically, the certificate serial number of the revoked certificate can be hashed using the murmurhash algorithm (a non-cryptographic hash function) to obtain a 32-bit hash result H. The hash result H is referred to as compressed data herein and elsewhere in this document. The hash result H can be divided into the upper 16 bits and the lower 16 bits. The upper 16 bits of the hash result H are referred to as the first sequence, and the lower 16 bits of the hash result H are referred to as the second sequence herein and elsewhere in this document.

[0068] The murmurhash algorithm utilizes efficient operations like multiplication and rotation, resulting in very fast computational speed. Its implementation is concise and requires little memory, making it suitable for memory-sensitive applications. Furthermore, the murmurhash algorithm exhibits high balance and a low collision rate for large blocks of data, making it more stable within hash tables.

[0069] Step S103: Based on the compressed data, update the revocation cache information, where the revocation cache information is used to represent all revoked certificate information. The revocation cache information includes a bucket data list and a revocation bitmap.

[0070] In some optional implementations, the revocation cache information is pre-initialized. Furthermore, when initializing the revocation cache information, if a revoked certificate already exists, a serial number list of the revoked certificates is also required to initialize the revoked certificates. The serial number list is a collection of serial numbers of multiple revoked certificates.

[0071] In some optional implementations, step S103 may include:

[0072] Step S1031: directly store the first sequence into the bucket data list.

[0073] A bucket is a data structure primarily used to group and sort data. Here, the bucket data list can be pre-initialized before receiving the certificate revocation instruction. Then, after obtaining the first and second sequences of the certificate serial number compressed data in step S102, the first sequence is directly stored in the bucket data list.

[0074] Step S1032: The second sequence is treated as a binary number and converted into a decimal integer i.

[0075] The second sequence has 16 bits, and the second sequence can be regarded as a binary number and converted into a decimal integer i. For example, if the second sequence of the compressed data is "1000000000000001", the decimal integer converted thereto is 32769.

[0076] Step S1033: Set the i-th bit in the revocation bitmap to 1.

[0077] In some optional implementations, the revocation bitmap is also part of the pre-initialized revocation cache information. The revocation bitmap can be a bit array B data , bit array B data The length can be 2 16 bit. At this time, set the i-th bit in the revocation bitmap to 1.

[0078] The certificate information processing method of the embodiment of the present invention divides the result of the hash operation on the certificate serial number into two parts, a first sequence and a second sequence, directly stores the first sequence in the bucket data list, and after customizing the second sequence, updates the revocation bitmap in the revocation cache information. Thus, while storing the first sequence for representing the uniqueness of the certificate serial number of the revoked certificate in the revocation cache information, and updating the revocation bitmap based on the second sequence, the certificate serial number is effectively compressed, and the resource utilization of the cache is significantly improved. Thus, when a revocation instruction carrying the certificate serial number of the revoked certificate is received, a hash operation is performed on the certificate serial number, and compressed data is obtained by combining the bucket and bitmap method. Further, based on the compressed data, the revocation cache information for representing the certificate information of all revoked certificates is updated. Thus, the certificate serial number is reasonably compressed and cached, effectively reducing the resource consumption of caching the revoked certificate.

[0079] In this embodiment, a certificate information processing method is provided, which can be used in computer equipment, terminals or servers, etc. Figure 2 FIG. 1 is a flow chart of another method for processing certificate information according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0080] Step S201: configure and revoke cache information.

[0081] In some optional implementations, this operation is also called data initialization. Specifically, first initialize the revocation bitmap for storing data. The revocation bitmap can be a bit array B data , where bit array B data The length is 2 16 bit. Secondly, initialize the bucket data list L for storing bucket data bucket .

[0082] In some optional implementations, in order to avoid the situation where there are few revoked certificates, the bit array B data A large number of bits are redundant, resulting in low resource utilization and waste of resources. In view of the situation where the number of revoked certificates is small, a high compression mode is set. Correspondingly, the operation of only using algorithms such as the murmurhash algorithm to hash the certificate serial number and update the revocation cache information is called a low compression mode. In this case, it is necessary to count the number of revoked certificates, configure the compression options used to characterize the compression mode of the certificate serial number, and configure the number of offset storage bits required to store the offset in the high compression process. Among them, the offset refers to the offset of the first high bit with a value of 1 in the revocation bitmap from the starting bit and the offset between each high bit with a value of 1 in the revocation bitmap and the high bit with a value of 1 in the previous high bit with a value of 1.

[0083] Therefore, in some optional implementations, a bit array B for storing the number of revoked certificates is also pre-initialized. count , length B data 3 times of that. And initialize the compression option C, length is 1 bit, further, also initialize the offset storage bit N offset wait.

[0084] Step S202: Obtain a list of serial numbers of revoked certificates.

[0085] The serial number list of revoked certificates is a list of serial numbers of multiple revoked certificates combined together.

[0086] Step S203: Initialize revocation cache information based on the serial number list.

[0087] Here, the specific operation of step S203 is basically the same as that of step S101 starting from receiving the certificate serial number. If there is a certificate that has been revoked initially, the serial number list of multiple revoked certificates is L serialNumber , then for the serial number list L serialNumber For details, please refer to Figure 3, for element l in the list serialNumber Use the murmurhash algorithm to perform hash operations and obtain a 32-bit hash result H. Divide the result H into the high 16 bits H height And the lower 16-bit H low The high 16 bits of H height That is the first sequence, the lower 16 bits of H low This is the second sequence. height The value of H is used as a bucket. low Convert H to an integer i. height Store in bucket data list L bucket In the example, bitmap B data The i-th bit position in is 1.

[0088] Furthermore, in some optional implementations, if the number of revoked certificates is greater than a set threshold, then B count The integer value represented by the 3ith to 3i+2th bits in the B is increased by 1 and updated to B count The compression option C is set to 0, indicating low compression mode.

[0089] If the number of revoked certificates is relatively small, B data Therefore, a high compression mode can be used, that is, B data Further compression is performed. Here, the high compression mode will be described in more detail in step S206, referring to the secondary compression operation in step S206, which will not be repeated here. After secondary compression, the compressed bit array B can be obtained. compress , and B data Release resources.

[0090] The certificate information processing method of the embodiment of the present invention initializes the revocation cache information based on the serial number list of the revoked certificates before receiving the certificate revocation instruction, and obtains the revocation cache information, which effectively reduces resource consumption and improves resource utilization. It is convenient for subsequent operations such as querying and deleting the revoked certificates based on the revocation cache information, and significantly improves the convenience of revoked certificate management.

[0091] Step S204: Receive a certificate revocation instruction, where the revocation instruction carries the certificate serial number of the revoked certificate.

[0092] For details, please see Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0093] Step S205: Perform a hash operation on the certificate serial number to obtain compressed data. The compressed data includes a first sequence and a second sequence. The first sequence is used to store in the bucket data list, and the second sequence is used to update the revocation bitmap.

[0094] For details, please see Figure 1 Step S102 of the illustrated embodiment will not be described in detail here.

[0095] Step S206: Based on the compressed data, update the revocation cache information, where the revocation cache information is used to represent all revoked certificate information. The revocation cache information includes a bucket data list and a revocation bitmap.

[0096] In some optional implementations, step S206 may include:

[0097] Step S2061: directly store the first sequence into the bucket data list.

[0098] Step S2062: Treat the second sequence as a binary number and convert the second sequence into a decimal integer i.

[0099] Step S2063: Set the i-th bit of the revocation bitmap to 1.

[0100] The above steps S2062 to S2063 may refer to steps S1031 to S1033 in the above step S103 for details, and the details are not repeated here.

[0101] In some other optional implementations, the revocation cache information further includes a compression option for representing a compression mode of the certificate serial number. Step S206 further includes:

[0102] Step S2064: Detect the number of revocations of the revoked certificate.

[0103] This step can be performed during the process of initializing the revocation cache information or during the process of updating the revocation cache information. The number of revocations of revoked certificates can be obtained by using a statistical method.

[0104] Step S2065: When the number of revocations reaches a set threshold, the compression option is set to a first value representing a low compression mode.

[0105] The first value may be 0.

[0106] In some further optional implementations, updating the revocation cache information based on the compressed data further includes:

[0107] Step S2066: When the number of revocations is less than the set threshold, the updated revocation bitmap is compressed twice, and the compression option is set to a second value representing a high compression mode.

[0108] The second value may be 1.

[0109] In the certificate information processing method of an embodiment of the present invention, the revocation cache information also includes a compression option for representing the compression mode of the certificate serial number. When updating the revocation cache information based on the compressed data, the revocation count of the revoked certificate is also detected. If the revocation count is less than a set threshold, the updated revocation bitmap is compressed twice, and the compression option is set to a second value representing a high compression mode. Thus, in the case of a small number of revoked certificates, the updated revocation bitmap is compressed twice, effectively avoiding the waste of storage resources caused by a large number of redundant bits in the revocation cache information, further freeing up resources and significantly improving resource utilization.

[0110] In some optional implementations, step S2066 may include:

[0111] Step a1: Determine the offset of the first high bit with a value of 1 from the start bit in the revocation bitmap.

[0112] Step a2: Determine the offset between each high bit with a value of 1 in the revocation bitmap and the high bit with a value of 1 before it.

[0113] Specifically, the process of determining the offset in step a1 and step a2 can refer to Figure 4 The position of the bit that is 1 in the sequence “00001000000010000010010…”. Taking the offset of this sequence gives “6,8,6,4…”.

[0114] Step a3: determining a maximum offset value of the multiple offsets.

[0115] For example, referring to step a1 and step a2, the maximum offset is 8.

[0116] Step a4: determining the number of offset storage bits for storing multiple offsets based on the maximum offset value.

[0117] For example, the maximum offset is 8. Since the offset value cannot be zero and is at least 1, when storing the offset, you can first decrement the offset by 1 and then store it. In this way, 0 to 7 include 8 numbers. Therefore, the number of offset storage bits required to store a single offset is 3.

[0118] Step a5: storing multiple offsets in a set order based on the determined number of offset storage bits.

[0119] Specifically, you can subtract 1 from all offsets in "6,8,6,4..." to get "5,7,5,3...". The storage format can be referred to Figure 3"101", "111", "101", "011" in .

[0120] It should be noted that the serial number lists and revocation bitmaps of multiple certificates are relatively long and are limited by the layout of the attached drawings. Figure 3 and Figure 4 The serial numbers in the list are incomplete, that is, the listed certificate serial numbers are incomplete.

[0121] The certificate information processing method of the embodiment of the present invention performs secondary compression through the offset between the bits with a value of 1 in the revocation bitmap. The processing process is relatively simple, and the revocation cache information is fully retained. This effectively ensures the efficiency of subsequent queries on the certificate revocation status while significantly improving resource utilization.

[0122] For other implementation details, see Figure 1 Step S103 of the illustrated embodiment will not be described in detail here.

[0123] In this embodiment, a certificate information processing method is provided, which can be used in computer equipment, terminals or servers, etc. Figure 5 FIG. 1 is a flow chart of another method for processing certificate information according to an embodiment of the present invention. Figure 5 As shown, the process includes the following steps:

[0124] Step S501: configure and revoke cache information.

[0125] For details, please see Figure 2 Step S201 of the illustrated embodiment will not be described in detail here.

[0126] Step S502: Obtain a serial number list of revoked certificates.

[0127] For details, please see Figure 2 Step S202 of the illustrated embodiment will not be described in detail here.

[0128] Step S503: Initialize revocation cache information based on the serial number list.

[0129] For details, please see Figure 2 Step S203 of the illustrated embodiment will not be described in detail here.

[0130] Step S504: Receive a certificate revocation instruction, where the revocation instruction carries the certificate serial number of the revoked certificate.

[0131] For details, please see Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0132] Step S505: Perform a hash operation on the certificate serial number to obtain compressed data. The compressed data includes a first sequence and a second sequence. The first sequence is used to store in the bucket data list, and the second sequence is used to update the revocation bitmap.

[0133] For details, please see Figure 1 Step S102 of the illustrated embodiment will not be described in detail here.

[0134] Step S506: Based on the compressed data, update the revocation cache information, where the revocation cache information is used to represent all revoked certificate information. The revocation cache information includes a bucket data list and a revocation bitmap.

[0135] For details, please see Figure 1 Steps S102 and S103 of the embodiment shown Figure 2 Step S206 of the illustrated embodiment will not be described in detail here.

[0136] Step S507: Receive a certificate query instruction, where the query instruction carries the certificate serial number of the queried certificate.

[0137] It should be noted that in some embodiments, the high compression mode may not be configured. In other optional implementations, the high compression mode may be configured.

[0138] For implementations configured with high compression mode, when receiving a certificate query instruction, the value of compression mode C must be checked first. If compression mode C is 0, it is low compression mode. If compression mode C is 1, it is high compression mode.

[0139] For two different compression modes, step S508 and step S509 are slightly different.

[0140] Step S508: Perform a hash operation on the certificate serial number to obtain compressed data.

[0141] For details, please refer to step S102.

[0142] Step S509: Based on the compressed data, the revocation cache information is traversed and queried to determine the validity of the certificate serial number.

[0143] Specifically, in the element query under low compression mode, the certificate serial number is first hashed using the murmurhash algorithm to obtain a 32-bit hash result H. The result H is divided into the high 16 bits of H heigh And the lower 16-bit H low If L bucket There is H height element, and B data Medium H lowIf the corresponding bit value is 1, it means that the current certificate may be revoked; otherwise, the current certificate must not be revoked.

[0144] In the element query under high compression mode, the certificate serial number is first hashed using the murmurhash algorithm to obtain a 32-bit hash result H. The result H is divided into the high 16 bits of H heigh And the lower 16-bit H low . compress Store the number of bits N according to the offset offset Divide into multiple bit arrays and store them in list L data , where the length of each bit array is N offset .

[0145] In order to explain the scheme more clearly, here for the certificate query in high compression mode, after receiving the certificate query instruction, the hash operation is performed in step S508 to obtain the high 16 bits of H heigh And the lower 16-bit H low . And perform secondary compression using the operation of step S2066 to obtain the compressed bit array B compress .

[0146] Further, provide Figure 6 The diagram shows the certificate query process in high compression mode.

[0147] Specifically, they may include:

[0148] Step b1: H low Convert to integer N index , initialize N cur is 0.

[0149] Step b2: Compress the bit array B compress Store the number of bits N according to the offset offset Divide into multiple bit arrays and store them in list L data .

[0150] Among them, the length of each bit array is N offset .

[0151] Step b3, traverse L data , take out element l from the list data .

[0152] Step b4, bit array l data Convert to integer i, let N cur =N cur +i.

[0153] Among them, step b3 and step b4 are executed until the traversal ends or N cur >=N index .

[0154] Step b5, determine whether Ldata is traversed or N cur >=N index .

[0155] If L bucket There is H height elements, and N cur =N index , it means that the current certificate may be revoked, and step b6 is executed. Otherwise, the current certificate must not be revoked. The current certificate is the certificate corresponding to the certificate serial number carried by the query instruction in step S507.

[0156] Step b6, output N index and N cur .

[0157] The certificate information processing method of the present invention determines the validity of the certificate serial number by performing a hash operation on the certificate serial number to obtain compressed data. Based on the compressed data, the revocation cache information is traversed and queried, thereby simplifying the query operation and effectively improving the efficiency of certificate revocation status query.

[0158] In this embodiment, a certificate information processing method is provided, which can be used in computer equipment, terminals or servers, etc. Figure 7 FIG. 1 is a flow chart of another method for processing certificate information according to an embodiment of the present invention. Figure 7 As shown, the process includes the following steps:

[0159] Step S701: configure and revoke cache information.

[0160] For details, please see Figure 2 Step S201 of the illustrated embodiment will not be described in detail here.

[0161] Step S702: Obtain a list of serial numbers of revoked certificates.

[0162] For details, please see Figure 2 Step S202 of the illustrated embodiment will not be described in detail here.

[0163] Step S703: Initialize revocation cache information based on the serial number list.

[0164] For details, please see Figure 2 Step S203 of the illustrated embodiment will not be described in detail here.

[0165] Step S704: Receive a certificate revocation instruction, where the revocation instruction carries the certificate serial number of the revoked certificate.

[0166] For details, please see Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0167] Step S705: Perform a hash operation on the certificate serial number to obtain compressed data. The compressed data includes a first sequence and a second sequence. The first sequence is used to store in the bucket data list, and the second sequence is used to update the revocation bitmap.

[0168] For details, please see Figure 1 Step S102 of the illustrated embodiment will not be described in detail here.

[0169] Step S706: Based on the compressed data, update the revocation cache information, where the revocation cache information is used to represent all revoked certificate information. The revocation cache information includes a bucket data list and a revocation bitmap.

[0170] For details, please see Figure 1 Steps S102 and S103 of the embodiment shown Figure 2 Step S206 of the illustrated embodiment will not be described in detail here.

[0171] Step S707: receiving a deletion instruction for revoking the certificate, where the deletion instruction carries the certificate serial number of the certificate to be deleted.

[0172] It should be noted that in some embodiments, the high compression mode may not be configured. In other optional implementations, the high compression mode may be configured.

[0173] For implementations configured with high compression mode, when receiving a certificate deletion instruction, the value of compression mode C must be checked first. If compression mode C is 0, it is low compression mode. If compression mode C is 1, it is high compression mode.

[0174] Step S708: Perform a hash operation on the certificate serial number to obtain compressed data.

[0175] For details, please refer to step S102.

[0176] Step S709: Based on the compressed data, perform a traversal query on the revocation cache information, and delete the compressed data from the revocation cache information.

[0177] Specifically, to delete an element in low compression mode, first use the murmurhash algorithm to perform a hash operation on the certificate serial number to be deleted, and obtain a 32-bit hash result H. The result H is divided into the high 16 bits of H heigh And the lower 16-bit H low, and H heigh The value of H is used as a bucket. low Convert to integer i. If L bucket There is H heigh And bitmap B data If the i-th bit position of is 1, then the bitmap B data The i-th bit position of B is set to 0, and B count The integer value represented by the 3ith to 3i+2th bits in the B is reduced by 1 and updated to B count 3i to 3i+2.

[0178] For element deletion in high compression mode, in high compression mode, firstly, the compression recovery operation is required to update the compressed B in the process of revoking the cache information. compress Restore to the state without secondary compression, and delete elements by referring to the process of element deletion in low compression mode. Then recalculate N by referring to the secondary compression operation in step S206. offset And get the compressed bit array B compress .

[0179] The compression recovery operation refers to the compressed bitmap B compress Restore to the state without secondary compression. Although the compressed data recovery operation will have a certain impact on efficiency, this operation is only used for element insertion and element deletion in high compression mode. In the context of cached revocation certificate serial numbers, insertion and deletion operations are relatively rare, so the impact of this operation on efficiency is limited. For specific operations, please refer to Figure 8 Provided compression recovery process flow diagram. May include:

[0180] Step c1, initialize bit array B data , used to store uncompressed data.

[0181] Among them, the uncompressed bit array B data , length can be 2 16 bit.

[0182] Step c2, compress the bit array B compress Store the number of bits N according to the offset offset Divide into multiple sub-arrays and store them in list L data .

[0183] Among them, the length of each bit array is N offset .

[0184] Step c3, traverse L data Remove element l from the list data .

[0185] Step c4, convert the elements in the list into integers i and write the bit array B data The i-th bit position of is 1.

[0186] Step c5, determine L data Check whether the traversal is completed. If so, execute step c6; if not, execute step c3 and continue traversal.

[0187] Step c6, output the recovered bit array B data .

[0188] In order to explain the scheme more clearly, here for the certificate query in high compression mode, after receiving the certificate query instruction, the hash operation is performed in step S708 to obtain the high 16 bits of H heigh And the lower 16-bit H low . And perform secondary compression using the operation of step S2066 to obtain the compressed bit array B compress .

[0189] The certificate information processing method of an embodiment of the present invention, upon receiving a deletion instruction for a revoked certificate, performs a hash operation on the certificate serial number that is identical to the certificate serial number used when the certificate was revoked. Based on the compressed data obtained from the hash operation, the method performs a traversal query on the revocation cache information and deletes the compressed data from the revocation cache information, thereby enabling the recovery of revoked certificates with simplified deletion operations. This significantly improves cache resource utilization for revoked certificates while fully ensuring the recoverability of revoked certificates, significantly enhancing the user experience.

[0190] This embodiment also provides a certificate information processing device for implementing the above-mentioned embodiments and preferred implementations. Details already described will not be repeated. As used below, the term "module" may refer to a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementation using hardware, or a combination of software and hardware, is also possible and contemplated.

[0191] This embodiment provides a certificate information processing device, such as Figure 9 Shown, including:

[0192] A certificate information processing device, comprising:

[0193] Receiving module 901, used to receive a certificate revocation instruction, the revocation instruction carries the certificate serial number of the revoked certificate;

[0194] A first compression module 902 is configured to perform a hash operation on the certificate serial number to obtain compressed data, where the compressed data includes a first sequence and a second sequence. The first sequence is used to store the certificate in the bucket data list, and the second sequence is used to update the revocation bitmap.

[0195] The updating module 903 is used to update the revocation cache information based on the compressed data. The revocation cache information is used to represent all revoked certificate information.

[0196] In some optional embodiments, the device further comprises:

[0197] Configuration module, used to configure revocation cache information;

[0198] List acquisition module, used to obtain the serial number list of revoked certificates;

[0199] The initialization module is used to initialize the revocation cache information based on the serial number list.

[0200] In some optional implementations, the updating module 903 includes:

[0201] a storage unit, configured to store the first sequence directly into the bucket data list;

[0202] a conversion unit for treating the second sequence as binary digits and converting the second sequence into a decimal integer i;

[0203] A setting unit is used to set the i-th bit of the revocation bitmap to 1.

[0204] In some optional embodiments, the revocation cache information further includes a compression option for characterizing a compression mode of the certificate serial number;

[0205] The update module 903 further includes:

[0206] A quantity detection unit, used to detect the revocation quantity of revoked certificates;

[0207] The low compression unit is configured to set the compression option to a first value representing a low compression mode when the number of revocations reaches a set threshold.

[0208] In some optional implementations, the updating module 903 further includes:

[0209] The high compression unit is used to perform secondary compression on the updated revocation bitmap when the number of revocations is less than a set threshold, and set the compression option to a second value representing a high compression mode.

[0210] In some optional embodiments, the high compression unit includes:

[0211] The first offset subunit is used to determine the offset of the first high bit with a value of 1 from the start bit in the revocation bitmap;

[0212] The second offset subunit is used to determine the offset between each high bit with a value of 1 in the revocation bitmap and the high bit with a value of 1 before;

[0213] A maximum offset subunit, configured to determine a maximum offset value of a plurality of offsets;

[0214] a bit number determination subunit, configured to determine, based on a maximum offset value, a number of offset storage bits for storing a plurality of offsets;

[0215] The storage subunit is used to store multiple offsets in a set order based on the determined number of offset storage bits.

[0216] In some optional embodiments, the device further comprises:

[0217] A query instruction module is used to receive a certificate query instruction after updating the revocation cache information based on the compressed data or after initializing the revocation cache information based on the serial number list, where the query instruction carries the certificate serial number of the queried certificate;

[0218] The second compression module is used to perform a hash operation on the certificate serial number to obtain compressed data;

[0219] The validity query module is used to traverse and query the revocation cache information based on compressed data to determine the validity of the certificate serial number.

[0220] In some optional embodiments, the device further comprises:

[0221] A deletion instruction module, configured to receive a deletion instruction for a revoked certificate after updating the revocation cache information based on the compressed data or initializing the revocation cache information based on the serial number list, wherein the deletion instruction carries the certificate serial number of the certificate to be deleted;

[0222] A third compression module is used to perform a hash operation on the certificate serial number to obtain compressed data;

[0223] The certificate recovery module is used to traverse and query the revocation cache information based on the compressed data, and delete the compressed data from the revocation cache information.

[0224] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0225] The certificate information processing device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0226] The embodiment of the present invention also provides a computer device having the above Figure 9 The certificate information processing device shown.

[0227] See also Figure 10 , Figure 10 is a structural diagram of a computer device provided by an optional embodiment of the present invention, such as Figure 10 As shown, the computer device includes: one or more processors 10, memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components utilize different buses to communicate with each other and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in the memory or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Equally, multiple computer devices can be connected, and each device provides part of the necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 10 A processor 10 is taken as an example.

[0228] The processor 10 may be a central processing unit, a network processor, or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit, a programmable logic device, or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic, or any combination thereof.

[0229] The memory 20 stores instructions that can be executed by at least one processor 10, so as to enable at least one processor 10 to execute the method shown in the above embodiment.

[0230] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store data created based on the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely located relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0231] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0232] The computer device further includes a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0233] The embodiment of the present invention also provides a computer-readable storage medium. The above-mentioned method according to the embodiment of the present invention can be implemented in hardware, firmware, or implemented as a computer code that can be recorded in a storage medium, or implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and downloaded through a network and will be stored in a local storage medium, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state drive, etc.; further, the storage medium can also include a combination of the above-mentioned types of memory. It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor or hardware, the method shown in the above embodiment is implemented.

[0234] A portion of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the form in which the computer program instruction exists in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc. Accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium that can be accessed by the computer.

[0235] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations shall all fall within the scope defined by the accompanying technical solutions.

Claims

1. A certificate information processing method, characterized in that: The method comprises: receiving a certificate revocation instruction, the revocation instruction carrying the certificate serial number of the revoked certificate; Performing a hash operation on the certificate serial number to obtain compressed data, the compressed data including a first sequence and a second sequence, the first sequence being used to store in a bucket data list, and the second sequence being used to update a revocation bitmap; Based on the compressed data, revocation cache information is updated, where the revocation cache information is used to represent all revoked certificate information, and the revocation cache information includes a bucket data list and a revocation bitmap.

2. The method according to claim 1, characterized in that Before receiving the certificate revocation instruction, the method further includes: Configure revocation cache information; Get a list of serial numbers of revoked certificates; Initialize the revocation cache information based on the serial number list.

3. The method according to claim 1, characterized in that The updating of revocation cache information based on the compressed data includes: directly storing the first sequence into the bucket data list; Treat the second sequence as binary digits and convert the second sequence into a decimal integer i; Set the i-th bit of the revocation bitmap to 1.

4. The method according to claim 1, wherein The compressed data further includes a compression option for characterizing a compression mode of the certificate serial number; The updating of the revocation cache information based on the compressed data further includes: Detect the number of revocations of revoked certificates; When the number of revocations reaches a set threshold, the compression option is set to a first value representing a low compression mode.

5. The method according to claim 4, characterized in that The updating of the revocation cache information based on the compressed data further includes: When the number of revocations is less than a set threshold, the updated revocation bitmap is compressed twice, and the compression option is set to a second value representing a high compression mode.

6. The method according to claim 5, characterized in that The second compression of the updated revocation bitmap includes: Determine the offset of the first high bit with a value of 1 from the start bit in the revocation bitmap; Determine the offset between each high bit with a value of 1 and the previous high bit with a value of 1 in the revocation bitmap; Determine the maximum offset value of multiple offsets; Based on the maximum offset value, determining the number of offset storage bits for storing multiple offsets; Based on the determined number of offset storage bits, the plurality of offsets are stored in a set order.

7. The method according to claim 1, characterized in that After updating the revocation cache information based on the compressed data, the method further includes: Receive a certificate query instruction, the query instruction carrying the certificate serial number of the queried certificate; Performing a hash operation on the certificate serial number to obtain compressed data; Based on the compressed data, the revocation cache information is traversed and queried to determine the validity of the certificate serial number.

8. The method according to claim 1, characterized in that After updating the revocation cache information based on the compressed data, the method further includes: receiving a deletion instruction for revoking a certificate, the deletion instruction carrying a certificate serial number of the certificate to be deleted; Performing a hash operation on the certificate serial number to obtain compressed data; Based on the compressed data, the revocation cache information is traversed and queried, and the compressed data is deleted from the revocation cache information.

9. A certificate information processing device, characterized in that: The device comprises: A receiving module, configured to receive a certificate revocation instruction, wherein the revocation instruction carries a certificate serial number of a revoked certificate; A first compression module is configured to perform a hash operation on the certificate serial number to obtain compressed data, wherein the compressed data includes a first sequence and a second sequence, wherein the first sequence is used to store in a bucket data list, and the second sequence is used to update a revocation bitmap; The update module is used to update the revocation cache information based on the compressed data, wherein the revocation cache information is used to represent all revoked certificate information.

10. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the certificate information processing method according to any one of claims 1 to 8 by executing the computer instructions.

Images