Digital certificate management method, device, equipment, medium and program product

Abstract

The invention provides a digital certificate management method. The method can be applied to the technical fields of big data and financial science and technology. The method is applied to a server for distributing a digital certificate in a distributed server cluster, and comprises the following steps: acquiring a digital certificate application element, and generating a digital certificate request file and a private key based on the digital certificate application element. Wherein the private key is a private key of an environment system which cannot carry out data transmission and is bound with a server used for distributing the digital certificate. And sending the digital certificate request file to a digital certificate issuing mechanism for generating a digital certificate. Wherein the digital certificate comprises a public key corresponding to the private key, and the private key is used for verifying the digital certificate. And acquiring the digital certificate, and distributing the digital certificate to a server for authenticating the digital certificate in a distributed server cluster. The invention further provides a digital certificate management device and equipment, a storage medium and a program product.

Description

Technical Field

[0001] This application relates to the field of financial technology, specifically to the field of big data technology, and in particular to a digital certificate management method, apparatus, device, medium, and program product. Background Technology

[0002] To ensure data and code security, businesses, including banks, widely use server-side digital certificates in scenarios such as website access for customer systems, identity verification between application systems, and device network access authentication. An increasing number of modern websites employ password protection technology to achieve fully encrypted website transmission, preventing data theft or tampering during transmission and ensuring the authenticity of the communicating parties' identities. Digital certificates serve as crucial credentials for both clients and servers to prove the identity of the parties involved.

[0003] In existing technologies, the private key corresponding to the digital certificate issued by the digital certificate authority is usually sent to the authentication server. When an authentication request is received, the digital certificate is verified using the private key. However, since there is a risk of leakage of the private key during data transmission, there is a security risk in digital certificate authentication. Summary of the Invention

[0004] In view of the above problems, this application provides a digital certificate management method, apparatus, device, medium and program product.

[0005] According to a first aspect of this application, a digital certificate management method is provided, applied to a server in a distributed server cluster for distributing digital certificates. The method includes: obtaining digital certificate application elements; generating a digital certificate request file and a private key based on the digital certificate application elements, wherein the generated digital certificate request file and the private key are mapped, and the private key is a private key of the environment system bound to the server for distributing digital certificates that cannot be transmitted; sending the digital certificate request file to a digital certificate authority to generate a digital certificate, wherein the digital certificate includes a public key corresponding to the private key, and the private key is used to verify the digital certificate; and obtaining the digital certificate and distributing the digital certificate to servers in the distributed server cluster for authenticating digital certificates.

[0006] According to an embodiment of this application, generating a digital certificate request file and a private key based on the digital certificate application elements includes: obtaining a standard document for a digital certificate request file from the certificate authority; generating standard rules based on the standard document for the certificate request file; and performing a standardization verification on the digital certificate application elements according to the standard rules. If the verification passes, a digital certificate request file and a private key are generated based on the digital certificate application elements.

[0007] According to an embodiment of this application, the method further includes: encrypting and backing up the private key.

[0008] According to a second aspect of this application, a digital certificate management method is provided, applied to a server in a distributed server cluster used for authenticating digital certificates. The method includes: in response to a digital certificate authentication request from a client, sending the digital certificate to a server in the distributed server cluster used for distributing digital certificates for digital certificate verification; obtaining the successfully verified digital certificate from the server in the distributed server cluster used for distributing digital certificates; detecting whether the successfully verified digital certificate is within its validity period; and if the successfully verified digital certificate is within its validity period, determining that the digital certificate authentication is successful.

[0009] According to an embodiment of this application, sending the digital certificate to a server in a distributed server cluster for distributing digital certificates includes: obtaining a first node identifier of the server for distributing digital certificates and a second node identifier of the server for authenticating digital certificates; generating an optimal transmission path between the server for distributing digital certificates and the server for authenticating digital certificates based on the first node identifier and the second node identifier; and obtaining the digital certificate and sending the digital certificate to the server in the distributed server cluster for distributing digital certificates based on the optimal transmission path.

[0010] According to an embodiment of this application, generating the optimal transmission path between the server for distributing digital certificates and the server for authenticating digital certificates based on the first node identifier and the second node identifier includes: obtaining all node identifiers in the distributed server cluster and constructing a network topology map; and obtaining the path with the fewest network transmission node identifiers between the first node identifier and the second node identifier based on the network topology map, thereby generating the optimal transmission path between the server for distributing digital certificates and the server for authenticating digital certificates.

[0011] According to an embodiment of this application, generating an optimal transmission path between the server for distributing digital certificates and the server for authenticating digital certificates based on the first node identifier and the second node identifier includes: calculating the network idle rate of multiple paths between the first node identifier and the second node identifier; and obtaining the path with the highest idle rate to generate the optimal transmission path between the server for distributing digital certificates and the server for authenticating digital certificates.

[0012] According to a third aspect of this application, a digital certificate management device is provided, applied to a server in a distributed server cluster for distributing digital certificates. The device includes: a first acquisition module, configured to acquire digital certificate application elements, and generate a digital certificate request file and a private key based on the digital certificate application elements, wherein the generated digital certificate request file and the private key are mapped, and the private key is a private key of the environment system of the server used for distributing digital certificates that cannot be transmitted; a first generation module, configured to send the digital certificate request file to a digital certificate authority to generate a digital certificate, wherein the digital certificate includes a public key corresponding to the private key, and the private key is used to verify the digital certificate; and a first distribution module, configured to acquire the digital certificate and distribute the digital certificate to servers in the distributed server cluster used for authenticating digital certificates.

[0013] According to a fourth aspect of this application, a digital certificate management device is provided, applied to a server in a distributed server cluster for authenticating digital certificates. The device includes: a first sending module, configured to send the digital certificate to a server in the distributed server cluster for distributing digital certificates in response to a digital certificate authentication request from a client, for digital certificate verification; a first detection module, configured to obtain the successfully verified digital certificate from the server in the distributed server cluster for distributing digital certificates, and detect whether the successfully verified digital certificate is within its validity period; and a first determining module, configured to determine that the digital certificate authentication is successful if the successfully verified digital certificate is within its validity period.

[0014] According to a fifth aspect of this application, an electronic device is provided, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0015] A sixth aspect of this application also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0016] A seventh aspect of this application also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method.

[0017] This application significantly enhances the security of digital certificates by generating a private key during the certificate generation process. This private key is permanently bound to the server environment used to distribute the digital certificate and cannot be transmitted via data transfer. The private key is completely non-exportable, invisible, and cannot be transmitted over the network, greatly improving its security. Because the private key is immovable, it must be sent back to the server that generated it for verification during digital certificate authentication, thus improving the security and reliability of the digital certificate. Furthermore, since only the digital certificate itself is distributed, without encrypting the private key, it saves computer resources and improves computational efficiency. This solves the technical problem in existing technologies where the private key can be exported and transmitted over the network, posing a risk of leakage and thus security risks to digital certificate authentication. Attached Figure Description

[0018] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0019] Figure 1 The illustrations depict application scenarios of digital certificate management methods, apparatuses, devices, media, and program products according to embodiments of this application.

[0020] Figure 2 A flowchart illustrating a digital certificate management method applied to a server for distributing digital certificates in a distributed server cluster, according to an embodiment of this application, is shown schematically.

[0021] Figure 3 A flowchart illustrating a digital certificate management method for a server used for authenticating digital certificates in a distributed server cluster, according to an embodiment of this application, is shown schematically.

[0022] Figure 4 This illustration schematically shows a flowchart of a digital certificate sending process to a server for distributing digital certificates in a digital certificate management method applied to a server for authenticating digital certificates in a distributed server cluster, according to an embodiment of this application.

[0023] Figure 5 The flowchart illustrates a specific embodiment of the digital certificate management method according to the present application.

[0024] Figure 6 This schematically illustrates a structural block diagram of a digital certificate management device applied to a server for distributing digital certificates in a distributed server cluster according to an embodiment of this application;

[0025] Figure 7 This schematically illustrates a structural block diagram of a digital certificate management device applied to a server for authenticating digital certificates in a distributed server cluster according to an embodiment of this application;

[0026] Figure 8 A block diagram schematically illustrates an electronic device suitable for implementing a digital certificate management method according to an embodiment of this application. Detailed Implementation

[0027] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0028] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0029] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0030] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0031] The accompanying drawings show some block diagrams and / or flowcharts. It should be understood that some blocks or combinations thereof in the block diagrams and / or flowcharts can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable control device, so that when executed by the processor, these instructions can create means for implementing the functions / operations described in these block diagrams and / or flowcharts.

[0032] First, the technical terms used in this article are explained as follows:

[0033] A digital certificate is a trusted digital document digitally signed by an authoritative, credible, and impartial third-party digital certificate authority. It represents the identity of the parties involved in communication and provides a method for verifying the identity of communication entities.

[0034] Server-side digital certificate: A digital certificate deployed on the server (not the client).

[0035] The node identifier of a server is a security credential used to uniquely identify and verify the identity of each physical or power server in the cluster.

[0036] Breadth-first search is an algorithm that performs traversal or searching in data structures such as graphs or trees.

[0037] This application provides a digital certificate management method applied to servers in a distributed server cluster used for distributing digital certificates. The method includes: obtaining digital certificate application elements; generating a digital certificate request file and a private key based on the digital certificate application elements; wherein the generated digital certificate request file is mapped to the private key, and the private key is a private key of the environment system bound to the server used for distributing digital certificates, which cannot be transmitted via data; sending the digital certificate request file to a digital certificate authority to generate a digital certificate; wherein the digital certificate includes a public key corresponding to the private key, and the private key is used to verify the digital certificate; and obtaining the digital certificate and distributing the digital certificate to servers in the distributed server cluster used for authenticating digital certificates.

[0038] According to the embodiments of this application, during the digital certificate generation process, the generated private key is a private key of the environment system bound to the server used to distribute the digital certificate, which cannot be transmitted via data. The private key is completely unexportable, invisible, and cannot be transmitted over the network, greatly improving its security. Because the private key is immovable, it must be sent back to the server that generated the private key for digital certificate verification during the digital certificate authentication process, thereby improving the security and reliability of the digital certificate. Furthermore, since only the digital certificate is distributed during distribution, without encrypting the private key, it saves computer resources and improves computational efficiency. This solves the technical problem in existing technologies where the private key can be exported and transmitted over the network, posing a risk of leakage and leading to security risks in digital certificate authentication.

[0039] Figure 1 The illustration schematically depicts application scenarios of digital certificate management methods, apparatus, devices, media, and program products according to embodiments of this application. It should be noted that... Figure 1The examples shown are merely examples of scenarios in which the embodiments of this application can be applied, to help those skilled in the art understand the technical content of this application, but do not mean that the embodiments of this application cannot be used in other devices, systems, environments or scenarios.

[0040] like Figure 1 As shown, application scenario 100 according to this embodiment may include an application scenario of digital certificate management. Network 104 is used as a medium to provide a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. Network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, etc.

[0041] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0042] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0043] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0044] It should be noted that the digital certificate management method provided in this application embodiment can generally be executed by server 105. Server 105 includes servers for distributing digital certificates and servers for authenticating digital certificates; correspondingly, the digital certificate management device provided in this application embodiment can generally be set in server 105. The digital certificate management method provided in this application embodiment can also be executed by a server or server cluster that is different from server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or server 105. Correspondingly, the digital certificate management device provided in this application embodiment can also be set in a server or server cluster that is different from server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or server 105.

[0045] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0046] The following will be based on Figure 1 The described scene, through Figures 2-5 The digital certificate management method according to the disclosed embodiments is described in detail. It should be noted that the above application scenarios are shown only to facilitate understanding of the spirit and principles of this application, and the implementation methods of this application are not limited in any way. Rather, the implementation methods of this application can be applied to any applicable scenario.

[0047] Figure 2 A flowchart illustrating a digital certificate management method applied to a server for distributing digital certificates in a distributed server cluster, according to an embodiment of this application, is shown schematically.

[0048] like Figure 2 As shown, the method 200 includes steps S201 to S203.

[0049] Step S201: Obtain digital certificate application elements, and generate a digital certificate request file and a private key based on the digital certificate application elements. The generated digital certificate request file and the private key are mapped to each other. The private key is a private key of the environment system of the server used to distribute digital certificates that cannot be transmitted.

[0050] For example, elements of a digital certificate application may include: certificate category, certificate type, certificate request file format, algorithm and bit width, issuing authority, and common name. Certificate categories include test certificates and production certificates, while certificate types include client digital certificates and server digital certificates.

[0051] For example, generating a digital certificate request file and private key based on the digital certificate application elements includes: obtaining a standard document for digital certificate request files from the certificate authority; generating standard rules based on the standard document; and performing a standardization verification on the digital certificate application elements according to the standard rules. If the verification passes, a digital certificate request file and private key are generated based on the digital certificate application elements. If the verification fails, an error message is returned and a notification is sent.

[0052] By generating standard rules based on the standard documents of certificate authorities, and performing standard verification on the elements of digital certificate application, the standardization and reliability of the generated digital certificate request file and private key can be achieved.

[0053] Furthermore, the private key can be encrypted and backed up. The private key file is not viewable in plaintext, cannot be duplicated, is deployed only at a single point, and cannot be exported. Backing up the private key prevents loss due to its loss and improves the reliability of digital certificate verification in digital certificate authentication.

[0054] Step S202: Send the digital certificate request file to a digital certificate authority to generate a digital certificate, wherein the digital certificate includes a public key corresponding to the private key, and the private key is used to verify the digital certificate.

[0055] Step S203: Obtain the digital certificate and distribute the digital certificate to the servers in the distributed server cluster used for authenticating digital certificates.

[0056] For example, after obtaining a digital certificate officially issued by a digital certificate authority, a digital certificate deployment and distribution application is submitted. The system can verify whether the certificate deployment application matches the corresponding encryption channel protocol attributes and whether the certificate format meets the requirements. If the verification passes, the distribution and deployment are initiated; if the verification fails, an error message is returned to the submitter.

[0057] Figure 3 The flowchart illustrates a digital certificate management method for a server used for authenticating digital certificates in a distributed server cluster, according to an embodiment of this application.

[0058] like Figure 3 As shown, the method 300 includes steps S301 to S303.

[0059] Step S301: In response to the client's digital certificate authentication request, the digital certificate is sent to the server in the distributed server cluster that distributes digital certificates for digital certificate verification.

[0060] Figure 4The illustration schematically shows a flowchart of a digital certificate sending process to a server for distributing digital certificates in a digital certificate management method applied to a server for authenticating digital certificates in a distributed server cluster, according to an embodiment of this application.

[0061] like Figure 4 As shown, the method 400 includes steps S401 to S403.

[0062] Step S401: Obtain the first node identifier of the server used to distribute digital certificates and the second node identifier of the server used to authenticate digital certificates.

[0063] Step S402: Based on the first node identifier and the second node identifier, generate the optimal transmission path between the server for distributing digital certificates and the server for authenticating digital certificates.

[0064] For example, generating the optimal transmission path between a server distributing digital certificates and a server authenticating digital certificates may include: obtaining the identifiers of all nodes in the distributed server cluster and constructing a network topology map; and based on the network topology map, obtaining the path with the fewest network transmission node identifiers between the first node identifier and the second node identifier, thereby generating the optimal transmission path between the server distributing digital certificates and the server authenticating digital certificates. Specifically, the steps are: collecting the identifier of each server node by deploying a lightweight agent program on each server node in the distributed cluster or by polling using a management protocol provided by the network device, and constructing a network topology map. In the network topology map, starting from the first node identifier and ending at the second node identifier, a breadth-first search algorithm is used to obtain the path with the fewest identifiers, thereby generating the optimal transmission path between the server distributing digital certificates and the server authenticating digital certificates.

[0065] By constructing a network topology map, the optimal transmission path can be generated between the server used for distributing digital certificates and the server used for authenticating digital certificates. This can save network resources at the routing level and improve the efficiency of digital certificate transmission.

[0066] For example, generating the optimal transmission path between a server distributing digital certificates and a server authenticating digital certificates may further include: calculating the network idle rate of multiple paths between the first node identifier and the second node identifier; and obtaining the path with the highest idle rate to generate the optimal transmission path between the server distributing digital certificates and the server authenticating digital certificates. Specifically, this includes: calculating the network utilization of adjacent nodes in a distributed server cluster, and calculating the network idle rate of adjacent nodes based on the network utilization. Based on a preset candidate strategy, n candidate paths are selected, where n is an integer and greater than 0. The total network idle rate of the n candidate paths is calculated, and the candidate path with the highest total network idle rate is selected as the optimal transmission path between the server distributing digital certificates and the server authenticating digital certificates.

[0067] By calculating the network idle rate, the path with the highest idle rate is selected as the optimal transmission path between the server distributing digital certificates and the server authenticating digital certificates. This effectively utilizes network resources, improves network resource utilization, and increases the efficiency of digital certificate transmission.

[0068] Digital certificate verification involves: sending the officially issued digital certificate from the Certificate Authority back to the server used to distribute digital certificates; the server then verifies the certificate against the private key; if verification is successful, a verified digital certificate is generated. The verified digital certificate is then backed up using a special encryption method that only the encrypted channel protocol gateway can recognize, and then transmitted back to the server used to authenticate the digital certificate in a restored manner.

[0069] Step S403: Obtain the digital certificate and, based on the optimal transmission path, send the digital certificate to the server in the distributed server cluster used for distributing digital certificates.

[0070] By sending digital certificates to servers in a distributed server cluster that distribute digital certificates based on the optimal transmission path, the transmission efficiency of digital certificates can be improved and network resources can be saved.

[0071] Return to reference Figure 3 In step S302, a successfully verified digital certificate is obtained from the server in the distributed server cluster used for distributing digital certificates, and it is detected whether the successfully verified digital certificate is within its validity period.

[0072] For example, in addition to checking whether a successfully verified digital certificate is within its validity period, it can also check whether a successfully verified digital certificate is in a normal activation state.

[0073] Step S303: If the successfully verified digital certificate is within its validity period, then the digital certificate authentication is determined to be successful.

[0074] If the successfully verified digital certificate is not valid, a digital certificate expiration reminder will be sent. An application for certificate extension can be made to the Digital Certificate Authority (DCA). After obtaining a formally extended digital certificate from the DCA, a digital certificate renewal application should be submitted. Digital certificate renewal may include verification of the validity of the renewal request, specifically verifying whether the submitted certificate renewal application matches the corresponding encryption channel protocol attributes and whether the certificate format meets the requirements. If the verification passes, digital certificate authentication is initiated, sending the formally extended digital certificate from the DCA to the digital certificate distribution server for re-pairing and verification with the private key file, completing the verification. Then, the successfully verified digital certificate is backed up and sent using a special encryption method that only the encryption channel protocol gateway can recognize; if the verification fails, an error message is returned.

[0075] The technical means of verifying digital certificates by sending them back to the server used to distribute them improves the security and reliability of digital certificate authentication.

[0076] Furthermore, when a service needs to be taken offline, the corresponding digital certificate also needs to be revoked and taken offline. First, an application to the digital certificate authority (CCA) is required to revoke the digital certificate. When the service needs to be taken offline and the digital certificate has already been revoked by the CCA, an application needs to be made to the digital certificate distribution server node to revoke and take offline the digital certificate, i.e., delete it. Before executing the revocation and offline process, it is necessary to verify whether the applicant's permissions allow them to perform the revocation operation, and also to verify whether the digital certificate is in an invalid state that has already been revoked by the CCA. If the verification passes, the revocation operation is executed; if the verification fails, the revocation is not executed. Simultaneously, a special encryption method dedicated to the encrypted channel protocol gateway is used, and the entire certificate set is backed up regularly for necessary fault recovery. Furthermore, the private key is never exported separately throughout the entire process, ensuring the security and reliability of the certificate. When it is necessary to restore the digital certificate, the paired and verified certificate is directly restored, ensuring security and reliability while maximizing the speed and efficiency of fault recovery.

[0077] According to the embodiments of this application, a closed-loop, unified, standardized, intelligent, and private key leakage-proof security management can be effectively implemented for the entire lifecycle of digital certificates, including application, creation and issuance, legality verification, deployment and use, monitoring and reminders, renewal and change, backup and recovery, and revocation and decommissioning. It is also flexibly compatible with diversified standard systems, improving the security, convenience, and standardization of the digital lifecycle.

[0078] Figure 5 The flowchart illustrates a specific embodiment of the digital certificate management method according to an embodiment of this application.

[0079] like Figure 5As shown, this embodiment 500 includes steps S501 to S510.

[0080] Step S501: The server used to distribute digital certificates submits certificate application elements.

[0081] Step S502: The server used to distribute digital certificates generates a certificate request file and a private key file.

[0082] Step S503: The server used to distribute digital certificates provides the certificate request file to the digital certificate authority.

[0083] Step S504: The server used to distribute digital certificates obtains the public key certificate and other encrypted files issued by the digital certificate authority.

[0084] Step S505: The server for distributing digital certificates distributes digital certificates to the server for authenticating digital certificates, so as to pair and verify them with the private key file before digital certificate authentication.

[0085] Step S506: The server used to distribute digital certificates encrypts and stores the private key. The private key is not allowed to be exported separately. The private key adopts an encryption method integrated with the encryption channel protocol gateway and the private key is not allowed to be exported separately in plaintext.

[0086] Step S507: The server used to distribute digital certificates backs up the private key. The private key file cannot be viewed in plaintext, cannot be generated repeatedly, and is deployed at a single point. Therefore, the private key needs to be encrypted and backed up to prevent the private key from being lost when the certificate is issued and returned, which would prevent the certificate pairing from being completed.

[0087] In step S508, when a digital certificate requires pre-authentication verification, the server used to authenticate the digital certificate sends the digital certificate back and completes the verification with the private key.

[0088] Step S509, if the verification passes.

[0089] In step S510, the server for distributing digital certificates sends the digital certificate to the server for authenticating digital certificates to complete the digital certificate authentication.

[0090] Furthermore, the deployment cluster involves encrypted channel protocol services related to digital certificates. The entire lifecycle of a digital certificate adheres to relevant standards and specifications. The embodiments of this application provide unified and standardized digital certificate application, verification, monitoring, deployment and distribution, update, revocation, backup, and recovery operations for encrypted channel protocol service clusters across different standards and specifications.

[0091] According to the embodiments of this application, a closed-loop, unified, standardized, intelligent, and private key leakage-proof security management can be effectively implemented for the entire lifecycle of digital certificates, including application, creation and issuance, legality verification, deployment and use, monitoring and reminders, renewal and change, backup and recovery, and revocation and decommissioning. It is also flexibly compatible with diversified standard systems, improving the security, convenience, and standardization of the digital lifecycle.

[0092] Figure 6 The diagram illustrates a structural block diagram of a digital certificate management device applied to a server in a distributed server cluster for distributing digital certificates, according to an embodiment of this application.

[0093] like Figure 6 As shown, the device 600 includes: a first acquisition module 601, a first generation module 602, and a first distribution module 603.

[0094] The first acquisition module 601 is used to acquire digital certificate application elements, and generate a digital certificate request file and a private key based on the digital certificate application elements. The generated digital certificate request file and the private key are mapped, and the private key is a private key of the environment system bound to the server used to distribute digital certificates, which cannot be transmitted via data. In one embodiment, the first acquisition module 601 can be used to execute step S201 described above.

[0095] The first acquisition module 601 includes a second generation module and a third generation module.

[0096] The second generation module is used to obtain the standard document of digital certificate request file from the certificate authority and generate standard rules based on the standard document of certificate request file.

[0097] The third generation module is used to perform standard verification on the digital certificate application elements according to the standard rules. If the verification passes, a digital certificate request file and a private key are generated based on the digital certificate application elements.

[0098] The first generation module 602 is used to send the digital certificate request file to a digital certificate authority to generate a digital certificate. The digital certificate includes a public key corresponding to the private key, and the private key is used to verify the digital certificate. In one embodiment, the first generation module 602 can be used to execute step S202 described above, which will not be repeated here.

[0099] The first distribution module 603 is used to obtain the digital certificate and distribute the digital certificate to servers in the distributed server cluster used for authenticating digital certificates. In one embodiment, the first distribution module 603 can be used to perform step S203 described above, which will not be repeated here.

[0100] The device 600 also includes a first backup module for encrypting and backing up the private key.

[0101] According to embodiments of this application, any plurality of modules among the first acquisition module 601, the first generation module 602, and the first distribution module 603 can be merged into one module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this application, at least one of the first acquisition module 601, the first generation module 602, and the first distribution module 603 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented by any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any appropriate combination of any of these three implementation methods. Alternatively, at least one of the first acquisition module 601, the first generation module 602, and the first distribution module 603 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0102] Figure 7 The diagram illustrates a structural block diagram of a digital certificate management device applied to a server for authenticating digital certificates in a distributed server cluster, according to an embodiment of this application.

[0103] like Figure 7 As shown, the device 700 includes: a first transmitting module 701, a first detecting module 702, and a first determining module 703.

[0104] The first sending module 701 is configured to, in response to a client's digital certificate authentication request, send the digital certificate to a server in a distributed server cluster that distributes digital certificates for digital certificate verification. In one embodiment, the first sending module 701 may be used to execute step S301 described above.

[0105] The first sending module 701 includes: a second acquisition module, a fourth generation module, and a second sending module.

[0106] The second acquisition module is used to acquire the first node identifier of the server used for distributing digital certificates and the second node identifier of the server used for authenticating digital certificates. In one embodiment, the second acquisition module can be used to perform step S401 described above, which will not be repeated here.

[0107] The fourth generation module is used to generate the optimal transmission path between the server for distributing digital certificates and the server for authenticating digital certificates based on the first node identifier and the second node identifier. In one embodiment, the fourth generation module can be used to perform step S402 described above, which will not be repeated here.

[0108] The fourth generation module includes: the third acquisition module and the fifth generation module.

[0109] The third acquisition module is used to acquire the identifiers of all nodes in the distributed server cluster and construct a network topology diagram.

[0110] The fifth generation module is used to obtain the path with the fewest network transmission node identifiers between the first node identifier and the second node identifier based on the network topology map, and generate the optimal transmission path between the server for distributing digital certificates and the server for authenticating digital certificates.

[0111] The fourth generation module also includes the first calculation module and the sixth generation module.

[0112] The first calculation module is used to calculate the network idle rate of multiple paths between the first node identifier and the second node identifier.

[0113] The sixth generation module is used to obtain the path with the highest idle rate and generate the optimal transmission path between the server used to distribute digital certificates and the server used to authenticate digital certificates.

[0114] The second sending module is used to obtain the digital certificate and, based on the optimal transmission path, send the digital certificate to the server in the distributed server cluster used for distributing digital certificates. In one embodiment, the second sending module can be used to execute step S403 described above, which will not be repeated here.

[0115] The first detection module 702 is used to obtain a successfully verified digital certificate from the server in the distributed server cluster that distributes digital certificates, and to detect whether the successfully verified digital certificate is within its validity period. In one embodiment, the first detection module 702 can be used to execute step S302 described above, which will not be repeated here.

[0116] The first determining module 703 is used to determine that the digital certificate authentication is successful if the successfully verified digital certificate is within its validity period. In one embodiment, the first determining module 703 can be used to execute step S303 described above, which will not be repeated here.

[0117] According to embodiments of this application, any plurality of modules among the first transmitting module 701, the first detecting module 702, and the first determining module 703 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this application, at least one of the first transmitting module 701, the first detecting module 702, and the first determining module 703 can be at least partially implemented as a hardware circuit, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented by any other reasonable means of integrating or packaging the circuit, or implemented in any one of the three methods of software, hardware, and firmware, or in a suitable combination of any of these. Alternatively, at least one of the first transmitting module 701, the first detecting module 702, and the first determining module 703 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0118] Figure 8 A block diagram schematically illustrates an electronic device suitable for implementing a digital certificate management method according to an embodiment of this application.

[0119] like Figure 8 As shown, an electronic device 800 according to an embodiment of this application includes a processor 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage portion 808 into a random access memory (RAM) 803. The processor 801 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 801 may also include onboard memory for caching purposes. The processor 801 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this application.

[0120] RAM 803 stores various programs and data required for the operation of electronic device 800. Processor 801, ROM 802, and RAM 803 are interconnected via bus 804. Processor 801 executes various operations of the method flow according to embodiments of this application by executing programs in ROM 802 and / or RAM 803. It should be noted that the programs may also be stored in one or more memories other than ROM 802 and RAM 803. Processor 801 may also execute various operations of the method flow according to embodiments of this application by executing programs stored in said one or more memories.

[0121] According to embodiments of this application, the electronic device 800 may further include an input / output (I / O) interface 805, which is also connected to a bus 804. The electronic device 800 may also include one or more of the following components connected to the input / output (I / O) interface 805: an input section 806 including a keyboard, mouse, etc.; an output section 807 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a LAN card, modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to the input / output (I / O) interface 805 as needed. A removable medium 811, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 810 as needed so that computer programs read from it can be installed into the storage section 808 as needed.

[0122] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0123] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include ROM 802 and / or RAM 803 and / or one or more memories other than ROM 802 and RAM 803 described above.

[0124] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code enables the computer system to implement the digital certificate management method provided in the embodiments of this application.

[0125] When the computer program is executed by the processor 801, it performs the functions defined in the system / apparatus of this application embodiment. According to the embodiments of this application, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0126] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 809, and / or installed from a removable medium 811. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0127] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 809, and / or installed from the removable medium 811. When the computer program is executed by the processor 801, it performs the functions defined in the system of this application embodiment. According to the embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0128] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0129] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0130] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. A digital certificate management method, characterized in that, This method, applied to servers in a distributed server cluster used for distributing digital certificates, includes: Obtain digital certificate application elements, and generate a digital certificate request file and a private key based on the digital certificate application elements. The generated digital certificate request file and the private key are mapped to each other. The private key is a private key of the environment system of the server used to distribute digital certificates that cannot be transmitted. The digital certificate request file is sent to a digital certificate authority to generate a digital certificate, wherein the digital certificate includes a public key corresponding to the private key, and the private key is used to verify the digital certificate; and Obtain the digital certificate and distribute it to servers in the distributed server cluster used for authenticating digital certificates.

2. The method according to claim 1, wherein generating a digital certificate request file and a private key based on the digital certificate application elements includes: Obtain the standard document for digital certificate request files from the certificate authority, and generate standard rules based on the standard document for certificate request files; as well as The digital certificate application elements are subjected to standard verification according to the standard rules. If the verification passes, a digital certificate request file and a private key are generated based on the digital certificate application elements.

3. The method according to claim 2 or 3, characterized in that, The method also includes: encrypting and backing up the private key.

4. A digital certificate management method, characterized in that, This method, applied to servers used for authenticating digital certificates in a distributed server cluster, includes: In response to the client's digital certificate authentication request, the digital certificate is sent to a server in the distributed server cluster that distributes digital certificates for digital certificate verification. Obtain a successfully verified digital certificate from the server in the distributed server cluster used for distributing digital certificates, and check whether the successfully verified digital certificate is within its validity period; and If the verified digital certificate is within its validity period, then the digital certificate authentication is considered successful.

5. The method according to claim 4, characterized in that, Sending the digital certificate to a server in a distributed server cluster used for distributing digital certificates includes: Obtain the first node identifier of the server used to distribute digital certificates and the second node identifier of the server used to authenticate digital certificates; Based on the first node identifier and the second node identifier, an optimal transmission path is generated between the server for distributing digital certificates and the server for authenticating digital certificates; and Obtain a digital certificate and, based on the optimal transmission path, send the digital certificate to a server in the distributed server cluster used for distributing digital certificates.

6. The method according to claim 5, characterized in that, Based on the first node identifier and the second node identifier, the optimal transmission path is generated between the server for distributing digital certificates and the server for authenticating digital certificates, including: Obtain the identifiers of all nodes in the distributed server cluster and construct a network topology graph; and Based on the network topology map, obtain the path with the fewest network transmission node identifiers between the first node identifier and the second node identifier, and generate the optimal transmission path between the server for distributing digital certificates and the server for authenticating digital certificates.

7. The method according to claim 5, characterized in that, Based on the first node identifier and the second node identifier, the optimal transmission path is generated between the server for distributing digital certificates and the server for authenticating digital certificates, including: Calculate the network idle rate of multiple paths between the first node identifier and the second node identifier; and Obtain the path with the highest idle rate and generate the optimal transmission path between the server used to distribute digital certificates and the server used to authenticate digital certificates.

8. A digital certificate management device, characterized in that, A server used in a distributed server cluster for distributing digital certificates, the device comprising: The first acquisition module is used to acquire digital certificate application elements, and generate a digital certificate request file and a private key based on the digital certificate application elements. The generated digital certificate request file and the private key are mapped to each other. The private key is a private key of the environment system of the server used to distribute digital certificates that cannot be transmitted. A first generation module is configured to send the digital certificate request file to a digital certificate authority to generate a digital certificate, wherein the digital certificate includes a public key corresponding to the private key, and the private key is used to verify the digital certificate; and The first distribution module is used to obtain the digital certificate and distribute the digital certificate to the servers in the distributed server cluster used for authenticating digital certificates.

9. A digital certificate management device, characterized in that, A device for use in a distributed server cluster for authenticating digital certificates, comprising: The first sending module is used to respond to the client's digital certificate authentication request by sending the digital certificate to a server in the distributed server cluster that distributes digital certificates for digital certificate verification. The first detection module is used to obtain a successfully verified digital certificate from the server in the distributed server cluster used for distributing digital certificates, and to detect whether the successfully verified digital certificate is within its validity period; and The first determining module is used to determine that the digital certificate authentication is successful if the successfully verified digital certificate is within its validity period.

10. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

12. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images