Digital certificate reliability level identification and verification method and apparatus, and electronic device

Abstract

The invention provides a digital certificate reliability level identification and verification method and device and electronic equipment, and relates to the technical field of information security, and the method comprises the steps that a registration mechanism obtains a digital certificate request sent by an applicant; the registration institution determines the type and the reliability level of the digital certificate based on the digital certificate request, and identifies the identity of the applicant; the certificate authority embeds a dominant reliability level identification extension item in the digital certificate based on the digital certificate type and the reliability level thereof; wherein the dominant reliability level identifier extension item comprises a digital certificate reliability level identifier, an identity authentication field, a password component identifier, a certificate purpose identifier and a conformity auditing identifier; and the certificate issuing mechanism carries out digital signature on the digital certificate containing the dominant reliability level identification extension item to obtain the digital certificate with the dominant reliability level identification. According to the invention, the method eliminates the dependence on an external certificate strategy file through embedding the structured RCStatements extension item in the digital certificate, and avoids the risk of file failure.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method, device and electronic equipment for identifying and verifying the reliability level of a digital certificate. Background Art

[0002] ITU-T X.509 is an internationally recognized standard that defines the format for public key certificates (digital certificates). It binds identities to public keys through digital signatures and plays a fundamental role in public key infrastructure (PKI). Digital certificates provide information security services such as integrity, authenticity, confidentiality, and non-repudiation, and are widely used for various purposes, including identity authentication, encrypted communications, and electronic signatures.

[0003] The basic structure of a digital certificate includes the version number, serial number, signature algorithm ID, issuer name, validity period, subject name, subject public key information, and optional extension fields (such as certificate policy and key usage). The purpose, legal applicability, reliability level, and authentication method of a digital certificate are generally determined using a common verification method, namely, verifying the certificate policy, key usage, and other extensions in the certificate.

[0004] In the application of digital certificates, it is necessary to determine and verify the reliability level of digital certificates. Currently, the existing PKI technology certificate format and verification method are still used.

[0005] The existing digital certificate reliability verification method has the following shortcomings: 1. Verification requires obtaining external files other than the certificate content, such as certificate policies, for interpretation. However, there is a risk that external files may be inaccessible. 2. The certificate policy is a comprehensive summary document of the certificate. It is necessary to traverse the entire document to obtain the reliability level content, which lacks verification independence and intuitiveness; 3. In applications, it is difficult for all parties to intuitively and automatically determine the reliability level of digital certificates quickly.

[0006] Therefore, a method, device and electronic device for identifying and verifying the reliability level of a digital certificate are proposed. Summary of the Invention

[0007] This specification provides a method, device, and electronic device for identifying and verifying the reliability level of digital certificates. By embedding a structured RCStatements extension in a digital certificate, it eliminates dependence on external certificate policy files, avoids the risk of file expiration, and helps business application systems quickly identify certificates of the required reliability level and verify compliance with the certificate reliability level. This specification provides a method for identifying the reliability level of a digital certificate, including: The registration authority obtains the digital certificate request sent by the applicant; The registration authority determines the type of the digital certificate and its reliability level based on the digital certificate request, and authenticates the identity of the applicant; When the identity authentication of the applicant is normal, the certificate issuing authority embeds an explicit reliability level identification extension in the digital certificate based on the type of the digital certificate and its reliability level; wherein the explicit reliability level identification extension includes a digital certificate reliability level identifier, an identity authentication field, a cryptographic component identifier, a certificate purpose identifier, and a compliance audit identifier; The certificate issuing authority digitally signs the digital certificate containing the explicit reliability level identification extension item to obtain a digital certificate with the explicit reliability level identification.

[0008] Optionally, before the registration authority obtains the digital certificate request sent by the applicant, the registration authority may: The certificate issuing authority formulates digital certificate policies and business rules, and issues certificate configuration rule templates to the registration authority.

[0009] This specification provides a method for verifying the reliability level of a digital certificate, including: Obtain a digital certificate with an explicit reliability rating logo; Performing explicit identification extension verification on the digital certificate with the explicit reliability level identification, and outputting a reliability level compliance verification result; When the reliability level compliance verification result is compliance, the verification of the digital certificate with the explicit reliability level identifier is completed.

[0010] Optionally, before obtaining the digital certificate with an explicit reliability level identifier, the process includes: The relying party formulates a checking strategy for the explicit reliability level identification extension of the digital certificate based on the application scenario, and configures the checking strategy and its associated data set to the verification system.

[0011] Optionally, the performing explicit identification extension verification on the digital certificate with the explicit reliability level identification includes: Parse the reliability level identification field of the digital certificate to extract the certificate type and reliability level compliance statement; Verify the identity authentication field to confirm that the applicant's identity authentication result is normal; Verify the cryptographic component identification field, matching the commercial cryptographic product certification certificate number stored locally with the national cryptographic authority filing information stored locally; Verify the certificate purpose identification field to confirm the compliance of the certificate purpose; Parse the compliance audit identification field to confirm the continuous compliance audit results.

[0012] This specification provides a device for identifying the reliability level of a digital certificate, including: The first acquisition module is used for the registration authority to obtain the digital certificate request sent by the applicant; an authentication module, configured for the registration authority to determine the type of the digital certificate and its reliability level based on the digital certificate request, and to authenticate the identity of the applicant; an embedding module configured to, when the identity authentication of the applicant is normal, cause the certificate issuing authority to embed an explicit reliability level identification extension in the digital certificate based on the type of the digital certificate and its reliability level; wherein the explicit reliability level identification extension includes a digital certificate reliability level identifier, an identity authentication field, a cryptographic component identifier, a certificate purpose identifier, and a compliance audit identifier; The signature module is used for the certificate issuing authority to digitally sign the digital certificate containing the explicit reliability level identification extension item to obtain a digital certificate with the explicit reliability level identification.

[0013] Optionally, before the first acquisition module, the following steps are included: The certificate issuing authority formulates digital certificate policies and business rules, and issues certificate configuration rule templates to the registration authority.

[0014] This specification provides a digital certificate reliability verification device, including: A second acquisition module is used to obtain a digital certificate with an explicit reliability level identifier; A verification module, configured to verify the explicit identification extension item of the digital certificate with the explicit reliability level identification, and output a reliability level compliance verification result; The verification completion module is used to complete the verification of the digital certificate with the explicit reliability level identifier when the reliability level compliance verification result is compliance.

[0015] Optionally, before the second acquisition module, the following steps are included: The relying party formulates a checking strategy for the explicit reliability level identification extension of the digital certificate based on the application scenario, and configures the checking strategy and its associated data set to the verification system.

[0016] Optionally, the verification module includes: Parse the reliability level identification field of the digital certificate to extract the certificate type and reliability level compliance statement; Verify the identity authentication field to confirm that the applicant's identity authentication result is normal; Verify the cryptographic component identification field, matching the commercial cryptographic product certification certificate number stored locally with the national cryptographic authority filing information stored locally; Verify the certificate purpose identification field to confirm the compliance of the certificate purpose; Parse the compliance audit identification field to confirm the continuous compliance audit results.

[0017] This specification also provides an electronic device, wherein the electronic device includes: A processor; and a memory storing computer-executable instructions, which, when executed, cause the processor to perform any of the above methods.

[0018] This specification also provides a computer-readable storage medium, wherein the computer-readable storage medium stores one or more programs, and when the one or more programs are executed by a processor, any of the above methods is implemented.

[0019] In the present invention, by embedding a structured RCStatements extension (including five self-verification fields such as the reliability level identifier) ​​in the digital certificate, the dependence on external certificate policy files is eliminated and the risk of file invalidation is avoided; during verification, the fields in the certificate are directly parsed to realize automatic verification of the reliability level, solving the problem of low efficiency of traditional manual interpretation; at the same time, the abstract reliability level requirements are translated into field rules to generate a traceable electronic evidence chain, realizing end-to-end mechanized reliability level compliance judgment, which helps the business application system to quickly identify certificates of the required reliability level and verify the compliance of the certificate reliability level. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0021] Figure 1 A schematic diagram illustrating the principle of a method for identifying the reliability level of a digital certificate provided in an embodiment of this specification; Figure 2 A schematic diagram illustrating the principle of a method for verifying the reliability level of a digital certificate provided in an embodiment of this specification; Figure 3 A schematic diagram of the structure of a device for identifying the reliability level of a digital certificate provided in an embodiment of this specification; Figure 4 A schematic diagram of the structure of a digital certificate reliability level verification device provided in an embodiment of this specification; Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of this specification; Figure 6 A schematic diagram of a computer-readable medium provided in accordance with an embodiment of this specification. DETAILED DESCRIPTION

[0022] The following description is intended to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are for illustrative purposes only, and those skilled in the art will readily appreciate other obvious variations. The basic principles of the present invention defined in the following description may be applied to other embodiments, variations, improvements, equivalents, and other technical solutions that do not depart from the spirit and scope of the present invention.

[0023] The following is combined with Figure 1-6 The exemplary embodiments of the present invention are described more fully. However, the exemplary embodiments can be implemented in various forms, and the present invention should not be construed as being limited to the embodiments set forth herein. On the contrary, providing these exemplary embodiments enables the present invention to be more comprehensive and complete, and more conveniently conveys the inventive concept to those skilled in the art. In the figures, the same reference numerals represent the same or similar elements, components, or parts, and thus their repeated description will be omitted.

[0024] Under the premise of being consistent with the technical concept of the present invention, the features, structures, characteristics or other details described in a specific embodiment do not exclude that they can be combined in one or more other embodiments in a suitable manner.

[0025] In the description of specific embodiments, the features, structures, characteristics, or other details of the present invention are described to enable those skilled in the art to fully understand the embodiments. However, this does not preclude those skilled in the art from practicing the technical solutions of the present invention without one or more of the specific features, structures, characteristics, or other details.

[0026] The flowcharts shown in the accompanying drawings are for illustrative purposes only and do not necessarily include all contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may be decomposed, while others may be combined or partially combined. Therefore, the actual execution order may vary depending on the actual situation.

[0027] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically separate entities. That is, these functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0028] The term "and / or" or "and / or" includes all combinations of any one or more of the associated listed items.

[0029] Figure 1 A schematic diagram of the principles of a method for identifying the reliability level of a digital certificate provided in an embodiment of this specification may include: Optionally, before S110, the steps include: The certificate issuing authority formulates digital certificate policies and business rules, and issues certificate configuration rule templates to the registration authority.

[0030] In the specific implementation of this specification, a certificate authority (CA) develops a policy framework defining the technical requirements for digital certificate reliability levels (e.g., identity strength and cryptographic component benchmarks) based on international standards and industry specifications, and converts this into a machine-readable structured configuration template. This template is securely distributed to a registration authority (RA) via a cryptographic signature channel. The RA system parses the template and automatically matches the reliability level to the certificate request, achieving zero-ambiguity in policy implementation and automated level binding. When the CA updates the policy, an incremental synchronization mechanism ensures that the new regulations take effect in real time across all RAs in the network, dynamically maintaining the compliance and cross-border mutual recognition compatibility of the certificate system, and providing standardized pre-conditions for the reliable generation of RCStatements extensions.

[0031] S110: The registration authority obtains the digital certificate request sent by the applicant; S120: The registration authority determines the type of the digital certificate and its reliability level based on the digital certificate request, and authenticates the identity of the applicant; S130: When the identity authentication of the applicant is normal, the certificate issuing authority embeds an explicit reliability level identification extension in the digital certificate based on the type of the digital certificate and its reliability level; wherein the explicit reliability level identification extension includes a digital certificate reliability level identifier, an identity authentication field, a cryptographic component identifier, a certificate purpose identifier, and a compliance audit identifier; S140: The certificate issuing authority digitally signs the digital certificate containing the explicit reliability level identification extension to obtain a digital certificate with an explicit reliability level identification.

[0032] In the specific implementation of this specification, the registration authority parses the content of the digital certificate request, automatically associates the certificate type with the reliability level based on a pre-configured rule base, and completes the identity verification of the applicant through multi-factor authentication. After verification, the certificate authority dynamically generates a structured RCStatements extension in the X.509 certificate extension area. As shown in Table 1, this extension explicitly embeds five self-verifying elements: reliability level identification, identity authentication method, cryptographic security standard, usage scenario, and compliance audit status. After digital signature, it forms a digital certificate with self-contained trust evidence. This process achieves end-to-end automated trust anchoring, avoiding reliance on external policy files and manual interpretation ambiguity. Its standardized field design provides an unambiguous verification foundation for cross-border mutual recognition, reconstructing an efficient and reliable digital trust system.

[0033] Table 1 Content and definition of digital certificate reliability level extension items Figure 2 A schematic diagram of a method for verifying the reliability level of a digital certificate provided in an embodiment of this specification may include: Optionally, before S210, the steps include: The relying party formulates a checking strategy for the explicit reliability level identification extension of the digital certificate based on the application scenario, and configures the checking strategy and its associated data set to the verification system.

[0034] In the specific implementation of this specification, the relying party extracts and generates a machine-executable explicit reliability level identification extension verification policy based on the security requirements of the business scenario, converting abstract rules into verification instructions for certificate embedded fields (such as reliability level and cryptographic standard). At the same time, the necessary reference data is pre-stored in the verification system's security sandbox, creating a completely self-contained closed-loop verification environment. This process achieves lossless translation from business security intent to technical verification, mitigating external data access risks. Through hot reloading mechanisms and isolation from multi-tenant policies, it ensures the autonomy, real-time performance, and reliability of the verification system in complex scenarios such as cross-border network outages, reshaping the foundation for efficient and anti-interference digital trust verification.

[0035] S210: Obtaining a digital certificate with an explicit reliability level identification; S220: Performing explicit identification extension verification on the digital certificate with the explicit reliability level identification, and outputting a reliability level compliance verification result; S230: When the reliability level compliance verification result is compliance, the verification of the digital certificate with the explicit reliability level identifier is completed.

[0036] Optionally, the step S220 includes: Parse the reliability level identification field of the digital certificate to extract the certificate type and reliability level compliance statement; Verify the identity authentication field to confirm that the applicant's identity authentication result is normal; Verify the cryptographic component identification field, matching the commercial cryptographic product certification certificate number stored locally with the national cryptographic authority filing information stored locally; Verify the certificate purpose identification field to confirm the compliance of the certificate purpose; Parse the compliance audit identification field to confirm the continuous compliance audit results.

[0037] In a specific implementation of this specification, the verification system parses the five self-verifying fields of the RCStatements extension within a digital certificate (reliability level identifier, identity authentication field, cryptographic component identifier, certificate purpose identifier, and compliance audit identifier). Through field verification, it achieves machine translation of reliability level requirements: abstract compliance requirements are converted into technical rules such as cryptographic standard matching and audit time verification, completing full-factor verification in a closed environment. The verification log automatically generates a non-repudiation electronic evidence chain, ultimately outputting a final determination of reliability level compliance. This method eliminates the reliance on cross-border document retrieval and manual interpretation, achieves reliability level verification, and adapts to multi-jurisdictional compliance requirements with a flexible field combination mechanism, reconstructing a trusted verification foundation for high-throughput scenarios.

[0038] In the present invention, by embedding a structured RCStatements extension (including five self-verification fields such as the reliability level identifier) ​​in the digital certificate, the dependence on external certificate policy files is eliminated and the risk of file invalidation is avoided; during verification, the fields in the certificate are directly parsed to realize automatic verification of the reliability level, solving the problem of low efficiency of traditional manual interpretation; at the same time, the abstract reliability level requirements are translated into field rules to generate a traceable electronic evidence chain, realizing end-to-end mechanized reliability level compliance judgment, which helps the business application system to quickly identify certificates of the required reliability level and verify the compliance of the certificate reliability level.

[0039] Figure 3 This is a schematic diagram of a device for identifying the reliability level of a digital certificate provided in an embodiment of this specification. The device may include: The first acquisition module 10 is used for the registration authority to obtain the digital certificate request sent by the applicant; An authentication module 20, configured for the registration authority to determine the type of the digital certificate and its reliability level based on the digital certificate request, and to authenticate the identity of the applicant; The embedding module 30 is configured to embed, by the certificate issuing authority, an explicit reliability level identifier extension in the digital certificate based on the type of the digital certificate and its reliability level when the identity authentication of the applicant is normal; wherein the explicit reliability level identifier extension includes a digital certificate reliability level identifier, an identity authentication field, a cryptographic component identifier, a certificate purpose identifier, and a compliance audit identifier; The signature module 40 is used for the certificate issuing authority to digitally sign the digital certificate containing the explicit reliability level identification extension to obtain a digital certificate with the explicit reliability level identification.

[0040] Optionally, before the first obtaining module 10, the following steps are included: The certificate issuing authority formulates digital certificate policies and business rules, and issues certificate configuration rule templates to the registration authority.

[0041] The functions of the device in the embodiment of the present invention have been described in the above method embodiment. Therefore, for details not fully described in this embodiment, please refer to the relevant description in the above embodiment and will not be repeated here.

[0042] Figure 4 A schematic diagram of a digital certificate reliability verification device provided in an embodiment of this specification, the device may include: A second obtaining module 50 is used to obtain a digital certificate with an explicit reliability level identifier; Verification module 60, configured to verify the explicit identification extension item of the digital certificate with the explicit reliability level identification and output a reliability level compliance verification result; The verification completion module 70 is configured to complete the verification of the digital certificate with the explicit reliability level identifier when the reliability level compliance verification result is compliance.

[0043] Optionally, before the second acquisition module 50, the following steps are included: The relying party formulates a checking strategy for the explicit reliability level identification extension of the digital certificate based on the application scenario, and configures the checking strategy and its associated data set to the verification system.

[0044] Optionally, the verification module 60 includes: Parse the reliability level identification field of the digital certificate to extract the certificate type and reliability level compliance statement; Verify the identity authentication field to confirm that the applicant's identity authentication result is normal; Verify the cryptographic component identification field, matching the commercial cryptographic product certification certificate number stored locally with the national cryptographic authority filing information stored locally; Verify the certificate purpose identification field to confirm the compliance of the certificate purpose; Parse the compliance audit identification field to confirm the continuous compliance audit results.

[0045] The functions of the device in the embodiment of the present invention have been described in the above method embodiment. Therefore, for details not fully described in this embodiment, please refer to the relevant description in the above embodiment and will not be repeated here.

[0046] Based on the same inventive concept, an embodiment of this specification also provides an electronic device.

[0047] The following describes an electronic device embodiment of the present invention, which can be considered a specific physical implementation of the method and apparatus embodiments of the present invention described above. Details described in the electronic device embodiment of the present invention should be considered supplementary to the above-mentioned method or apparatus embodiments; details not disclosed in the electronic device embodiment of the present invention can be implemented with reference to the above-mentioned method or apparatus embodiments.

[0048] Figure 5 This is a schematic diagram of the structure of an electronic device provided in the embodiment of this specification. Figure 5 The electronic device 300 according to this embodiment of the present invention will be described. Figure 5 The electronic device 300 shown is merely an example and should not limit the functions and scope of use of the embodiments of the present invention.

[0049] like Figure 5 As shown, electronic device 300 is implemented as a general-purpose computing device. Components of electronic device 300 may include, but are not limited to, at least one processing unit 310, at least one storage unit 320, a bus 330 connecting various system components (including storage unit 320 and processing unit 310), and a display unit 340.

[0050] The storage unit stores program codes that can be executed by the processing unit 310, so that the processing unit 310 performs the steps according to various exemplary embodiments of the present invention described in the above processing method section of this specification. For example, the processing unit 310 can perform the following steps: Figure 1 and / or the steps shown in 2.

[0051] The storage unit 320 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 3201 and / or a cache memory unit 3202 , and may further include a read-only memory unit (ROM) 3203 .

[0052] The storage unit 320 may also include a program / utility 3204 having a set (at least one) of program modules 3205, such program modules 3205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each of which or some combination may include an implementation of a network environment.

[0053] Bus 330 may represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0054] The electronic device 300 may also communicate with one or more external devices 400 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable viewers to interact with the electronic device 300, and / or any device that enables the electronic device 300 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed through an input / output (I / O) interface 350. Furthermore, the electronic device 300 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through a network adapter 360. The network adapter 360 may communicate with other modules of the electronic device 300 through the bus 330. It should be understood that although Figure 5 Not shown, other hardware and / or software modules may be used in conjunction with the electronic device 300, including but not limited to microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0055] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the exemplary embodiments described in the present invention can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the embodiment of the present invention can be embodied in the form of a software product, which can be stored in a computer-readable storage medium (which can be a CD-ROM, USB flash drive, mobile hard disk, etc.) or on a network, and includes a number of instructions to enable a computing device (which can be a personal computer, server, or network device, etc.) to execute the above method according to the present invention. When the computer program is executed by a data processing device, the computer-readable medium is enabled to implement the above method of the present invention, that is: Figure 1 and / or the method shown in 2.

[0056] Figure 6 A schematic diagram of a computer-readable medium provided in accordance with an embodiment of this specification.

[0057] accomplish Figure 1The computer program of the method shown in and / or 2 can be stored on one or more computer-readable media. The computer-readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or component, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0058] The computer-readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, wherein the readable program code is carried. The data signal propagated may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or component. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination thereof.

[0059] The program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, and the like, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the viewer computing device, partially on the viewer device, as a stand-alone software package, partially on the viewer computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the viewer computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0060] In summary, the present invention can be implemented in hardware, or as a software module running on one or more processors, or a combination thereof. Those skilled in the art will appreciate that, in practice, general-purpose data processing devices such as microprocessors or digital signal processors (DSPs) can be used to implement some or all of the functions of some or all of the components according to the embodiments of the present invention. The present invention can also be implemented as a device or apparatus program (e.g., a computer program or computer program product) for performing part or all of the methods described herein. Such a program implementing the present invention can be stored on a computer-readable medium or in the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

[0061] The specific embodiments described above further illustrate the objectives, technical solutions, and beneficial effects of the present invention. It should be understood that the present invention is not inherently related to any specific computer, virtual device, or electronic device, and various general-purpose devices can also implement the present invention. The above description is only a specific embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention shall be included in the scope of protection of the present invention.

[0062] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments.

[0063] The foregoing is merely an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A method for identifying the reliability level of a digital certificate, characterized in that: include: The registration authority obtains the digital certificate request sent by the applicant; The registration authority determines the type of the digital certificate and its reliability level based on the digital certificate request, and authenticates the identity of the applicant; When the identity authentication of the applicant is normal, the certificate issuing authority embeds an explicit reliability level identification extension in the digital certificate based on the type of the digital certificate and its reliability level; wherein the explicit reliability level identification extension includes a digital certificate reliability level identifier, an identity authentication field, a cryptographic component identifier, a certificate purpose identifier, and a compliance audit identifier; The certificate issuing authority digitally signs the digital certificate containing the explicit reliability level identification extension item to obtain a digital certificate with the explicit reliability level identification.

2. The method for identifying the reliability level of a digital certificate according to claim 1, wherein: Before the registration authority obtains the digital certificate request sent by the applicant, it includes: The certificate issuing authority formulates digital certificate policies and business rules, and issues certificate configuration rule templates to the registration authority.

3. A method for verifying the reliability level of a digital certificate, characterized in that: include: Obtain a digital certificate with an explicit reliability rating logo; Performing explicit identification extension verification on the digital certificate with the explicit reliability level identification, and outputting a reliability level compliance verification result; When the reliability level compliance verification result is compliance, the verification of the digital certificate with the explicit reliability level identifier is completed.

4. The method for verifying the reliability level of a digital certificate according to claim 3, wherein: Before obtaining the digital certificate with the explicit reliability level identifier, the process includes: The relying party formulates a checking strategy for the explicit reliability level identification extension of the digital certificate based on the application scenario, and configures the checking strategy and its associated data set to the verification system.

5. The method for verifying the reliability level of a digital certificate according to claim 4, wherein: The performing of explicit identification extension verification on the digital certificate with the explicit reliability level identification includes: Parse the reliability level identification field of the digital certificate to extract the certificate type and reliability level compliance statement; Verify the identity authentication field to confirm that the applicant's identity authentication result is normal; Verify the cryptographic component identification field, matching the commercial cryptographic product certification certificate number stored locally with the national cryptographic authority filing information stored locally; Verify the certificate purpose identification field to confirm the compliance of the certificate purpose; Parse the compliance audit identification field to confirm the continuous compliance audit results.

6. A device for identifying the reliability level of a digital certificate, characterized in that: include: The first acquisition module is used for the registration authority to obtain the digital certificate request sent by the applicant; an authentication module, configured for the registration authority to determine the type of the digital certificate and its reliability level based on the digital certificate request, and to authenticate the identity of the applicant; an embedding module configured to, when the identity authentication of the applicant is normal, cause the certificate issuing authority to embed an explicit reliability level identification extension in the digital certificate based on the type of the digital certificate and its reliability level; wherein the explicit reliability level identification extension includes a digital certificate reliability level identifier, an identity authentication field, a cryptographic component identifier, a certificate purpose identifier, and a compliance audit identifier; The signature module is used for the certificate issuing authority to digitally sign the digital certificate containing the explicit reliability level identification extension item to obtain a digital certificate with the explicit reliability level identification.

7. A device for verifying the reliability level of a digital certificate, characterized in that: include: A second acquisition module is used to obtain a digital certificate with an explicit reliability level identifier; A verification module, configured to verify the explicit identification extension item of the digital certificate with the explicit reliability level identification and output a reliability level compliance verification result; The verification completion module is used to complete the verification of the digital certificate with the explicit reliability level identifier when the reliability level compliance verification result is compliance.

8. An electronic device, wherein: The electronic device includes: A processor; and a memory storing computer-executable instructions, which, when executed, cause the processor to perform the method according to any one of claims 1 to 5.

9. A computer-readable storage medium, wherein: The computer-readable storage medium stores one or more programs, and when the one or more programs are executed by a processor, the method of any one of claims 1 to 5 is implemented.

Images