Method for measuring credibility of digital certificate and digital signature based on feature vector algorithm

Abstract

The invention discloses a method for measuring the credibility of a digital certificate and a digital signature based on a feature vector algorithm, which relates to the technical field of computers, and comprises the following steps of: analyzing a format field of the digital certificate, extracting field information, mapping into credibility factors of multiple dimensions according to a mapping rule, and generating a credibility feature vector; calculating the comprehensive feature intensity of the credibility feature vector by using the Euclidean norm to obtain a quantitative credibility value; according to the quantitative credibility value, performing credibility calculation on each digital certificate in a certificate chain formed by digital signature verification to generate a digital certificate credibility sequence; and according to the credibility sequence of the digital certificates and the sequence positions of the digital certificates in the link, sequentially decreasing weight values are distributed to the digital certificates, and a weight corresponding set which is verified to be qualified is generated. According to the invention, certificate link measurement and use operation are separated, the design is simplified, the flexibility and expansibility are improved, and the security guarantee capability of digital signature verification is integrally enhanced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a method for measuring the credibility of digital certificate and digital signature based on feature vector algorithm. BACKGROUND

[0002] With the rapid development of the digital era, public key infrastructure (PKI) has become a key technology system to ensure network communication security and identity authentication. PKI realizes the verification of user identity and public key through digital certificate and key management, establishes a secure communication channel, and ensures the confidentiality and integrity of data transmission. Its core relies on the certificate authority (CA) to issue, manage and revoke digital certificates, forming a certificate chain composed of root certificates and intermediate certificates, extending the trust boundary, and realizing hierarchical trust transmission from root certificates to terminal certificates. As the foundation of the PKI system, CA certificates are not only the core elements of digital security, but also related to the security protection of national digital sovereignty. By establishing local CA institutions and root certificate systems, the country reduces dependence on external technology and ensures the self-controllability and security protection of the national network infrastructure.

[0003] Although the existing PKI system plays a key role in the issuance and verification of digital certificates, it still has shortcomings in the face of actual situations such as diverse certificate sources, complex link structures, and missing field information. The traditional verification method usually relies on signature legality, certificate revocation status, and link integrity check, lacks the ability to quantify multi-dimensional trust factors in the certificate field, and fails to reflect the weight differences between nodes in the link. Especially in the field of abnormal or incomplete link scenarios, there is a lack of flexible fault tolerance mechanism and dynamic adjustment means, resulting in insufficient accuracy of overall digital signature credibility evaluation. SUMMARY

[0004] In view of the above existing problems, the present application is proposed.

[0005] Therefore, the present application provides a method for measuring the credibility of digital certificate and digital signature based on feature vector algorithm, which solves the problem of difficult accurate quantification of multi-dimensional trust factors and effective reflection of weight differences between certificates in the certificate chain in the prior art.

[0006] To solve the above technical problems, the present application provides the following technical solutions:

[0007] In a first aspect, the present application provides a method for measuring the credibility of digital certificates and digital signatures based on a feature vector algorithm, which comprises: parsing the format field of a digital certificate, extracting field information, and mapping the field information into a plurality of credibility factors of multiple dimensions according to a mapping rule to generate a credibility feature vector; calculating the comprehensive feature strength of the credibility feature vector using the Euclidean norm to obtain a quantitative credibility value; calculating the credibility of each digital certificate in a certificate chain formed by digital signature verification according to the quantitative credibility value to generate a digital certificate credibility sequence; assigning each digital certificate a weight value that decreases in turn according to the sequence position of the digital certificate in the chain based on the digital certificate credibility sequence and the sequence position of the digital certificate in the chain to generate a set of weight values corresponding to the digital certificates that pass verification; and performing weighted accumulation of the weight values and the quantitative credibility values of the digital certificates one by one based on the set of weight values corresponding to the digital certificates that pass verification, and adding a normalization compensation value to generate a certificate chain credibility score; and performing credibility optimization on a set of digital signatures to be checked using the certificate chain credibility score to generate a digital signature credibility ranking result.

[0008] As a preferred scheme of the method for measuring the credibility of digital certificates and digital signatures based on a feature vector algorithm, the method comprises the following steps:

[0009] The issuing authority, the country or region, the certificate purpose, the algorithm type, the key length, and the key hash value are extracted from the digital certificate to form a field information data set.

[0010] The field information data set is converted into a plurality of feature dimension values required for credibility evaluation based on a mapping rule, and combined into a multi-dimensional vector form to generate a credibility feature vector.

[0011] As a preferred scheme of the method for measuring the credibility of digital certificates and digital signatures based on a feature vector algorithm, the method comprises the following steps:

[0012] Each dimension credibility factor in the credibility feature vector is squared to obtain a square value sequence.

[0013] The square value sequence is summed to obtain a dimension contribution value sum, and the dimension contribution value sum is square-rooted to generate a comprehensive feature strength, which is used as the quantitative credibility value of the digital certificate.

[0014] As a preferred scheme of the method for measuring the credibility of digital certificates and digital signatures based on the feature vector algorithm, wherein: the credibility of each digital certificate in the certificate chain formed by the digital signature verification is calculated according to the quantified credibility value, and a digital certificate credibility sequence is generated, and the specific steps are as follows,

[0015] The structure of the digital signature is parsed, and the certificate chain is extracted according to the verification dependence order;

[0016] The quantified credibility value of each digital certificate in the certificate chain is combined with the link order position of the digital certificate to form a structured scoring node;

[0017] Based on the structured scoring node, the credibility value of the digital certificate with missing fields is adjusted to the corresponding reduced interval and marked as low credibility by using a fault-tolerant mechanism, and an updated structured scoring node is output;

[0018] According to the updated structured scoring node, all quantified credibility values are sequentially arranged according to the order of the digital certificate in the link, and output as a digital certificate credibility sequence.

[0019] As a preferred scheme of the method for measuring the credibility of digital certificates and digital signatures based on the feature vector algorithm, wherein: the credibility of each digital certificate in the certificate chain formed by the digital signature verification is calculated according to the quantified credibility value, and a digital certificate credibility sequence is generated, and the specific steps are as follows,

[0020] The sequence length of the digital certificate credibility sequence is read, and a weight value corresponding to the length of the digital certificate credibility sequence and decreasing is generated, and a weight value list is output;

[0021] The weight value list is sequentially assigned to each digital certificate in the digital certificate credibility sequence according to the link order, and a weight corresponding set of verification qualified is generated by using strict decreasing.

[0022] As a preferred scheme of the method for measuring the credibility of digital certificates and digital signatures based on the feature vector algorithm, wherein: based on the weight corresponding set of verification qualified, the weight value is weighted and accumulated with the quantified credibility value of the digital certificate one by one, and a normalization compensation value is added, and a certificate chain credibility score is generated, and the specific steps are as follows,

[0023] Based on the weight corresponding set of verification qualified, the weight value of each digital certificate and the corresponding quantified credibility value are extracted, and a weight and credibility pair list is output;

[0024] The weight value and the corresponding quantified credibility value of each pair of digital certificates in the weight and credibility pair list are sequentially read, the weighted contribution value is calculated, and a weighted contribution value sequence is output;

[0025] The weighted contribution value sequence is accumulated and combined with the normalized compensation value to generate a certificate chain credibility score.

[0026] As a preferred scheme of the method for measuring the credibility of digital certificates and digital signatures based on the feature vector algorithm, the weight value and the corresponding quantized credibility value of each pair of digital certificates in the weight and credibility pair list are read in sequence, the weighted contribution value is calculated, and the weighted contribution value sequence is output.

[0027] The weight value and the corresponding quantized credibility value of each pair of digital certificates in the weight and credibility pair list are read, calculated, and the weighted contribution value is obtained.

[0028] Each pair of weighted contribution values is sequentially stored in an ordered set, and the weighted contribution value sequence is output.

[0029] As a preferred scheme of the method for measuring the credibility of digital certificates and digital signatures based on the feature vector algorithm, the weight value and the corresponding quantized credibility value of each pair of digital certificates in the weight and credibility pair list are read in sequence, the weighted contribution value is calculated, and the weighted contribution value sequence is output.

[0030] The digital signature information is extracted from the signature file and communication data uploaded by the user to obtain a set of digital signatures to be verified.

[0031] The set of digital signatures to be verified is sorted in descending order according to the certificate chain credibility score, and a preliminary sorting result is output.

[0032] The digital signatures with the same score in the preliminary sorting result are sorted again in combination with the timestamp verification feature to generate a digital signature credibility sorting result.

[0033] In a second aspect, the present application provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and wherein the computer program is executed by the processor to implement any step of the method for measuring the credibility of digital certificates and digital signatures based on the feature vector algorithm according to the first aspect of the present application.

[0034] In a third aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement any step of the method for measuring the credibility of digital certificates and digital signatures based on the feature vector algorithm according to the first aspect of the present application.

[0035] The present application has the beneficial effects that: through multi-dimensional feature extraction and mapping on the digital certificate format field, combined with the Euclidean norm to realize comprehensive calculation, the credibility of the digital certificate is accurately quantified, and the objectivity and scientificity of the credibility evaluation are effectively improved; the uniform measurement of different length certificate chains is realized by using the decreasing weight distribution and tail filling technology based on the certificate chain position, and the trust transmission process and the certificate weight difference are accurately reflected; the weight verification and correction mechanism is introduced to ensure the rationality and stability of the credibility measurement result; the separation of measurement and use operation simplifies the design, improves the flexibility and expandability, and enhances the security protection capability of the digital signature verification as a whole, and meets the application requirements in the complex and changeable digital security environment. BRIEF DESCRIPTION OF DRAWINGS

[0036] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0037] Fig. 1 The flow chart of the method for measuring the credibility of digital certificate and digital signature based on the feature vector algorithm in the present application.

[0038] Fig. 2 The flow chart of the certificate chain credibility sequence generation in the present application.

[0039] Fig. 3 The flow chart of the fault-tolerant mechanism processing in the present application.

[0040] Fig. 4 The flow chart of the credibility threshold and digital signature verification in the present application. DETAILED DESCRIPTION

[0041] In order to make the above-mentioned purposes, features and advantages of the present application more apparent and easy to understand, the specific embodiments of the present application will be described in detail below with reference to the drawings of the specification.

[0042] In the following description, many specific details are set forth in order to provide a thorough understanding of the present application, but the present application can also be implemented in other ways different from those described herein, and those skilled in the art can make similar generalizations without departing from the connotation of the present application, therefore the present application is not limited to the specific embodiments disclosed below.

[0043] Second, the "one embodiment" or "an embodiment" referred to herein can include a particular feature, structure, or characteristic. The various embodiments appearing at different places in this specification can not all refer to the same embodiment or to the same implementations or alternatives of the same implementation.

[0044] With reference to Figs. 1-4 For one embodiment of the present application, the embodiment provides a method for measuring the credibility of digital certificates and digital signatures based on a feature vector algorithm, including the following steps:

[0045] S1, parse the format field of the digital certificate, extract field information, and map it to multiple dimensions of credibility factors according to the mapping rule to generate a credibility feature vector.

[0046] S1.1, extract the issuing authority, country / region, certificate purpose, algorithm type, key length, and key hash value from the digital certificate to form a field information dataset.

[0047] Specifically, when processing the digital certificate, the format structure of the digital certificate is parsed, and the identification information corresponding to the "issuing authority" field in the digital certificate is located and extracted; the "country / region" field in the digital certificate is read, and the country or region code information marked in the field is extracted; the "certificate purpose" field content is continuously extracted, and the function purpose type declared by the digital certificate is obtained, such as "for digital signature", "for key exchange", or "for identity authentication"; then the "algorithm type" field is extracted, and the encryption algorithm type used in the digital certificate is identified, such as "RSA", "ECC", or "SM2"; the "key length" field is read, and the length value of the key used for encryption operation is obtained, such as 2048 bits or 256 bits; finally, the "key hash value" field is extracted, and the digest value used to verify the integrity of the public key content is obtained. The six extraction results are respectively taken as the field information of "issuing authority", "country / region", "certificate purpose", "algorithm type", "key length", and "key hash value", combined in order, and constitute a field information dataset.

[0048] S1.2, based on the mapping rule, convert the field information dataset into multiple feature dimension values required for credibility evaluation, and combine it into a multi-dimensional vector form to generate a credibility feature vector.

[0049] Specifically, based on the mapping rule, the "issuing authority" field information in the field information dataset is matched with the issuing authority credibility score table, and is converted into the corresponding feature dimension value, for example, the corresponding value of "authentication authority" is 0.9, and the corresponding value of "commercial authority" is 0.6; the "country / region" field information is matched with the country / region trust level table, and is converted into a numerical feature dimension value, for example, the corresponding value of "CN" is 0.95, and the corresponding value of "US" is 0.85; the "certificate purpose" field information is mapped with the purpose weight table, and is converted into the corresponding credibility factor value, for example, the corresponding value of "for digital signature" is 1.0, and the corresponding value of "for encrypted transmission" is 0.8; the "algorithm type" field information is mapped with the algorithm security level table, for example, the corresponding value of "RSA" is 0.85, and the corresponding value of "ECC" is 0.95; the "key length" field information is mapped into a hierarchical feature dimension value according to the numerical interval, for example, the corresponding value of 2048 bits is 0.8, and the corresponding value of 4096 bits is 0.95; the "key hash value" field information is calculated for the number of hash bits, and is mapped according to the bit interval, for example, the corresponding value of 256 bits is 0.9, and the corresponding value of 512 bits is 0.95. The above six feature dimension values are arranged in the fixed order of "issuing authority", "country / region", "certificate purpose", "algorithm type", "key length" and "key hash value", and are combined to form a credibility feature vector.

[0050] It should also be noted that the mapping rule is set, and the specific steps include collecting the credibility score or weight table corresponding to each field, such as the reputation rating table of the issuing authority, the trust level list of the country / region, the weight standard of the certificate purpose, the security level of the encryption algorithm, and the security classification of the key length; matching the field information with the corresponding score table, and determining the corresponding feature dimension value according to the field value; for numerical fields such as key length and key hash value, interval mapping is used to map the actual numerical value to a feature value interval; all mapping results are standardized to ensure that the feature dimension values are within a comparable range, and finally a multi-dimensional vector for credibility calculation is formed.

[0051] The data sources and basis of the pre-set issuing authority credibility score table include: based on the historical certificate usage of the certificate authority, the long-term validity, the revocation frequency and the incorrect issuance of the issued certificate are counted; the actual credibility score performance of the certificate authority in different certificate chains is collected, and the average score level corresponding to different issuing authorities is summarized; the influence degree of the issuing authority on the credibility in the actual environment is determined by numerical analysis on the corresponding relationship between the issuing authority and the overall link credibility in multiple digital certificate chains, and the issuing authority credibility score table is generated.

[0052] S2, using the Euclidean norm, the comprehensive feature strength of the credibility feature vector is calculated to obtain a quantitative credibility value.

[0053] S2.1, square each dimension credibility factor in the credibility feature vector to obtain a square value sequence.

[0054] Specifically, each dimension credibility factor in the credibility feature vector is read in turn, each credibility factor is squared to calculate the corresponding square value, and the square processing of all dimensions is repeated until the square processing of all dimensions is completed. The square values calculated are arranged in the original dimension order to form a square value sequence.

[0055] It should be noted that each dimension credibility factor is derived from the format field of the digital certificate. By parsing the issuing authority, country area, certificate purpose, algorithm type, key length and key hash value fields in the digital certificate, the field information is converted into the corresponding credibility factor value according to the mapping rule. The specific steps include: extracting each field information in the digital certificate to construct a field information dataset; mapping each field in the field information dataset to the corresponding credibility factor according to the mapping rule; arranging each credibility factor in a fixed order to correspond to the six dimensions of "issuing authority", "country area", "certificate purpose", "algorithm type", "key length" and "key hash value" in turn, and combining to form the dimensions of the credibility feature vector.

[0056] S2.2, sum the square value sequence to obtain the dimension contribution value sum, and perform square root operation on the dimension contribution value sum to generate the comprehensive feature strength, which is used as the quantitative credibility value of the digital certificate.

[0057] Specifically, all square values in the square value sequence are added in turn to obtain the dimension contribution value sum; the dimension contribution value sum is processed by square root operation to generate the comprehensive feature strength as the quantitative credibility value of the digital certificate, and the expression is:

[0058]

[0059] Where t represents the quantitative credibility value of the digital certificate, n represents the dimension characteristic value quantity of the credibility feature vector, v j represents the jth dimension characteristic value in the credibility feature vector, and j represents the index of the dimension characteristic value of the credibility feature vector.

[0060] S3, according to the quantitative credibility value, the credibility of each digital certificate in the certificate chain constituted by the digital signature verification is calculated to generate a digital certificate credibility sequence.

[0061] S3.1, parse the digital signature structure and extract the certificate chain in the verification dependency order.

[0062] Specifically, when analyzing the digital signature structure, the signature path information in the digital signature is read, and each digital certificate in the signature path is extracted in turn; for each digital certificate, the unique identifier and related fields are obtained, and arranged in turn according to the order of the signature path; all the extracted digital certificates are connected in turn according to the link order to generate a complete certificate chain.

[0063] S3.2, the quantified trust value of each digital certificate in the certificate chain is combined with the link order position of the digital certificate to form a structured scoring node.

[0064] Specifically, the quantified trust value of each digital certificate in the certificate chain is read in turn, and the link order position of the corresponding digital certificate in the certificate chain is obtained; the quantified trust value and the corresponding link order position are combined according to a unified data structure to form a structured scoring node containing the unique identifier of the digital certificate, the quantified trust value and the link order position; repeat the operation until all digital certificates in the certificate chain form corresponding structured scoring nodes.

[0065] S3.3, based on the structured scoring node, using a fault-tolerant mechanism, adjusting the trust value of the digital certificate with missing fields to the corresponding reduced interval and marking it as low trust, outputting the updated structured scoring node.

[0066] Specifically, the digital certificate field information contained in the structured scoring node is read in turn, and the integrity of the field content of each digital certificate is detected to determine whether there is a missing field; if a missing field is detected, the corresponding rollback factor value is retrieved according to the pre-defined fault tolerance rule table, for example, the rollback factor is 0.15 when the "algorithm type" field is missing, and the rollback factor is 0.20 when the "certificate purpose" field is missing; the quantified trust value in the current structured scoring node is reduced by the corresponding rollback factor value, and the adjusted result is the corrected trust value; the corrected trust value is updated to the original trust value position in the structured scoring node, and a low trust state is marked in the structured scoring node, completing the field missing correction processing; repeat the operation until all structured scoring nodes are processed, and finally output the updated structured scoring node containing the corrected trust value and the low trust mark.

[0067] It should be noted that the specific steps of the pre-defined fault-tolerant rule table: collect a plurality of format specification complete digital certificate samples, sort out the common field list, including "issuing agency", "country area", "certificate purpose", "algorithm type", "key length" and "key hash value"; Conduct credibility impact analysis on each field respectively, and count the credibility score variation range corresponding to each type of field missing in the historical digital certificate, for example, by comparing the credibility difference between the complete field sample and the missing field sample, the actual impact of field missing on credibility is quantified; According to the influence of the field on the overall credibility score, sort the importance level of the field, for example, the influence level of "issuing agency" is high, and the influence level of "key hash value" is medium; According to the importance level of the field, allocate the numerical type rollback factor, for example, the rollback factor corresponding to the field with high importance level is 0.25, the rollback factor corresponding to the field with medium importance level is 0.15, and the rollback factor corresponding to the field with low importance level is 0.05. A table of one-to-one correspondence between fields and corresponding rollback factors is sorted and saved as a fault-tolerant rule table for subsequent field missing correction operations.

[0068] S3.4, according to the updated structured scoring node, all quantified credibility values are sequentially arranged in order according to the order of digital certificates in the link, and the output is a digital certificate credibility sequence.

[0069] Specifically, based on the updated structured scoring node, the quantified credibility value corresponding to each digital certificate is read in order according to the order of digital certificates in the link; The read quantified credibility value is sequentially arranged according to the link order to form an ordered digital certificate credibility value list; As a digital certificate credibility sequence output, the generation of the digital certificate credibility sequence is completed.

[0070] S4, according to the digital certificate credibility sequence and the sequence position of the digital certificate in the link, each digital certificate is assigned a weight value that decreases in turn, and a set of verification qualified weights is generated.

[0071] S4.1, read the sequence length of the digital certificate credibility sequence, generate a weight value corresponding to the length of the digital certificate credibility sequence and decreasing, and output the weight value list.

[0072] Specifically, the digital certificate credibility sequence is read, the number of digital certificates in the digital certificate credibility sequence is counted, and the sequence length of the digital certificate credibility sequence is obtained; According to the sequence length of the digital certificate credibility sequence, the weight value is calculated, and the expression is:

[0073] w i =2 (K-i)r ;

[0074] wherein, w iWi represents the weight value of the i th digital certificate, K represents the maximum supported certificate chain length, r represents the weight scaling coefficient, and i represents the index variable of the digital certificate;

[0075] It should also be noted that K is used to determine the range of weight distribution and the change span of the exponential benchmark from the trust anchor to the terminal entity; r is used to control the attenuation slope of the exponential weight, where r = 1 represents standard attenuation, 0 < r < 1 represents gentle attenuation, and r > 1 represents steep attenuation; i takes a value in the range of 1 ≤ i ≤ K;

[0076] Through the exponential attenuation mechanism, it is ensured that the weight value is strictly decreasing as the certificate chain position moves down, without the need for external verification; all weight values are calculated in ascending order of i, and the final weight value list is output.

[0077] S4.2, the weight value list is sequentially assigned to each digital certificate in the digital certificate credibility sequence according to the link order, and the strictly decreasing property is used to generate a set of verified weight correspondences.

[0078] Specifically, all digital certificates in the digital certificate credibility sequence are read and sequentially numbered according to their order in the certificate chain; according to the total number of digital certificates, a decreasing weight value is assigned to each digital certificate in order from the highest bit, for example, the first certificate is assigned the largest weight value, the second certificate is assigned the second largest weight value, and so on, until the last certificate is assigned the smallest weight value; then the quantified credibility value of each digital certificate is combined with the corresponding weight value to form a one-to-one correspondence, and the structured data set containing the unique identifier of the digital certificate, the quantified credibility value and the weight value is combined in the order of the certificate chain; finally, the structured data set is output as the verified weight correspondence set.

[0079] S5, based on the verified weight correspondence set, the weight value is weighted and added to the quantified credibility value of the digital certificate one by one, and a normalization compensation value is added to generate a certificate chain credibility score.

[0080] S5.1, based on the verified weight correspondence set, the weight value and the corresponding quantified credibility value of each digital certificate are extracted, and a weight and credibility pair list is output.

[0081] Specifically, based on the verified weight correspondence set, the weight value and the quantified credibility value corresponding to each digital certificate are read in order according to the order of the digital certificate in the digital certificate credibility sequence, and each set of corresponding weight value and quantified credibility value is combined into a weight and credibility pair in a one-to-one matching manner of digital certificates, and is sequentially appended to the weight and credibility pair list until all digital certificates are extracted and paired. Finally, the complete weight and credibility pair list is output.

[0082] For example, if the set of verified weights is [0.5, 0.4, 0.3] and the sequence of digital certificate credibility is [0.8, 0.6, 0.7], the generated weight and credibility pair list is [(0.5, 0.8), (0.4, 0.6), (0.3, 0.7)].

[0083] S5.2. Read the weight value and the corresponding quantized credibility value of each pair of digital certificates in the weight and credibility pair list in turn, calculate the weighted contribution value, and output the sequence of weighted contribution values.

[0084] S5.2.1. Read the weight and credibility pair list, extract the weight value and the corresponding quantized credibility value of each pair of digital certificates, and calculate the weighted contribution value.

[0085] Specifically, the weight value and the corresponding quantized credibility value of each pair of digital certificates in the weight and credibility pair list are read in turn, and the weighted contribution value is calculated according to the expression:

[0086] a i = w i × c i

[0087] where a i represents the weighted contribution value of the i-th digital certificate, w i represents the weight value corresponding to the i-th digital certificate in the weight and credibility pair list, c i represents the quantized credibility value corresponding to the i-th digital certificate in the weight and credibility pair list, and i represents the sequence index of the digital certificate in the weight and credibility pair list.

[0088] S5.2.2. Store each pair of weighted contribution values in order in the ordered set, and output the sequence of weighted contribution values.

[0089] Specifically, an empty weighted contribution value list is initialized; for each weighted contribution value, it is appended to the end of the weighted contribution value list in turn; the steps are repeated until all weighted contribution values are stored in the weighted contribution value list; and the sequence of weighted contribution values containing all weighted contribution values and maintaining the same order is output.

[0090] S5.3. Accumulate the sequence of weighted contribution values and combine the normalized compensation value to generate the certificate chain credibility score.

[0091] Specifically, each weighted contribution value in the weighted contribution value sequence is read in turn, and all weighted contribution values are summed in an accumulation manner to obtain an accumulated total value; the accumulated total value is adjusted according to the certificate chain length and the weight position, in combination with the corresponding value read from the pre-set normalized compensation value, to generate an adjusted total score; the normalized compensation value is dynamically set according to the certificate chain length, ensuring that the scores of certificate chains of different lengths are mapped to a unified value domain; and the final output total score is taken as the certificate chain credibility score, which satisfies the following characteristics: reflecting the influence of the position of each certificate in the link, ensuring that chains of different lengths or different certificates are mapped to unique values, achieving a one-to-one mapping; and ensuring that the credibility of the certificate chain strictly monotonically decreases when the link is extended, maintaining the monotonicity of the score, and the expression is:

[0092]

[0093] Wherein, L represents the certificate chain credibility score, m represents the length of the weighted contribution value sequence, and padding represents the compensation value used for normalizing the credibility of the certificate chain of different lengths.

[0094] It should also be noted that the pre-set normalized compensation value is determined according to the problem of uneven weight distribution or insufficient influence of specific nodes that may exist in digital certificate credibility evaluation, through statistical analysis of historical data and security demand evaluation, to determine a reasonable compensation range; the specific steps include collecting credibility score samples of multiple certificate chains, calculating the mean, variance and frequency distribution of the scores using statistical analysis methods, identifying the concentration trend and dispersion degree of the scores, determining a reasonable range of compensation values based on the statistical results and actual security level requirements, selecting appropriate compensation values to adjust the final score, ensuring that the score result is smoother and reflects the overall link credibility change, and the compensation value is fixed and stored for subsequent score calculation.

[0095] S6, using the certificate chain credibility score to perform credibility optimization on the set of digital signatures to be verified, and generating a digital signature credibility ranking result.

[0096] S6.1, extracting digital signature information from the signature file and communication data uploaded by the user to obtain a set of digital signatures to be verified.

[0097] Specifically, read the user uploaded signature file and communication data file, identify the file format type, such as PEM format, DER format or encapsulated format containing PKCS#7 structure; perform structure parsing operation on the read file, locate the field position containing digital signature content, such as "Signature", "SignedData" or "PKCS7-Signature" field; identify and extract the original signature value, signature algorithm identification, signature timestamp and signer identification information in the digital signature field in the structured data; if the communication data is multi-segment structure, extract the data segments containing the signature in turn according to the segmentation order in the communication session; perform structure matching operation on each data segment to check whether it contains a standard format digital signature structure; encapsulate all extracted digital signature values and associated fields into a to-be-verified digital signature data item, and arrange them into a to-be-verified digital signature set.

[0098] S6.2, according to the certificate chain credibility score, the to-be-verified digital signature set is sorted in descending order, and the preliminary sorting result is output.

[0099] Specifically, read the certificate chain credibility score corresponding to each to-be-verified digital signature in the to-be-verified digital signature set; establish a data structure for each to-be-verified digital signature, which contains the unique identification information of the digital signature and the corresponding certificate chain credibility score; store all data structures containing the certificate chain credibility score in the list structure; sort the list structure according to the certificate chain credibility score field, and arrange it in descending order, so that the to-be-verified digital signature with higher certificate chain credibility score is arranged in the front row; if there are to-be-verified digital signatures with the same certificate chain credibility score in the sorting process, the original input order is kept unchanged; finally, the to-be-verified digital signature set after sorting is output as the preliminary sorting result.

[0100] S6.3, for the digital signatures with the same score in the preliminary sorting result, secondary sorting is performed combined with the timestamp verification feature to generate the digital signature credibility sorting result.

[0101] Specifically, read all digital signatures with the same certificate chain credibility score in the preliminary sorting result; for each digital signature, extract the timestamp verification feature value recorded in the digital signature, including the timestamp generation time field; store all digital signatures with the same score and the corresponding timestamp generation time in the temporary sorting structure in the form of key-value pair; sort the timestamp generation time field in ascending order according to the numerical value, so that the digital signature with earlier timestamp generation time is arranged in the front row; cover the part with the same score in the original preliminary sorting result with the sorted result, and combine it with the remaining sorting result to form a complete sorting list; finally, output the sorting list as the digital signature credibility sorting result.

[0102] The embodiment also provides a computer device suitable for the method for measuring the credibility of digital certificates and digital signatures based on a feature vector algorithm, comprising a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions to realize the method for measuring the credibility of digital certificates and digital signatures based on a feature vector algorithm proposed in the above embodiment.

[0103] The computer device can be a terminal, and the computer device comprises a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device comprises a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The communication interface of the computer device is used to communicate with external terminals in a wired or wireless manner. The wireless manner can be achieved through WIFI, an operator network, NFC (Near Field Communication) or other technologies. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer overlaid on the display screen, or can be a key, a trackball or a touchpad arranged on the shell of the computer device, or can be an external keyboard, a touchpad or a mouse and the like.

[0104] The embodiment also provides a storage medium having a computer program stored thereon, the program being executed by a processor to realize the method for measuring the credibility of digital certificates and digital signatures based on a feature vector algorithm proposed in the above embodiment. The storage medium can be realized by any type of volatile or non-volatile storage device or a combination thereof, such as a static random access memory (SRAM), an electrically erasable programmable read-only memory (EEPROM), an erasable programmable read-only memory (EPROM), a programmable read-only memory (PROM), a read-only memory (ROM), a magnetic memory, a flash memory, a magnetic disk or an optical disk.

[0105] To sum up, the application realizes comprehensive calculation by multi-dimensional feature extraction and mapping of the digital certificate format field and combination of Euclidean norm, accurately quantifies the credibility of the digital certificate, and effectively improves the objectivity and scientificity of the credibility evaluation; adopts the decreasing weight distribution and tail filling technology based on the certificate chain position, realizes unified measurement of different length certificate chains, accurately reflects the trust transmission process and certificate weight difference; introduces the weight verification and correction mechanism, guarantees the rationality and stability of the credibility measurement result; separates the measurement and use operation, simplifies the design, improves the flexibility and expansibility, and overall enhances the security guarantee capability of the digital signature verification, meets the application requirements in the complex and changeable digital security environment.

[0106] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present application but not limit the present application. Although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or replaced equivalently without departing from the spirit and scope of the present application, and all should be covered in the scope of the claims of the present application.

Claims

1. A method for measuring the trustworthiness of digital certificates and digital signatures based on a feature vector algorithm, characterized in that: Comprising, The format field of the digital certificate is parsed, the field information is extracted, and the mapping rule is mapped to multiple dimensions of the credibility factor to generate a credibility feature vector; The comprehensive feature strength of the credibility feature vector is calculated using the Euclidean norm to obtain a quantitative credibility value; According to the quantitative credibility value, the credibility of each digital certificate in the certificate chain formed by the digital signature verification is calculated to generate a digital certificate credibility sequence; According to the digital certificate credibility sequence and the order position of the digital certificate in the link, each digital certificate is assigned a weight value that decreases in turn to generate a weight corresponding set of qualified verification; Based on the weight corresponding set of qualified verification, the weight value is weighted and accumulated with the quantitative credibility value of the digital certificate one by one, and a normalization compensation value is added to generate a certificate chain credibility score; The digital signature credibility sorting result is generated by using the certificate chain credibility score to perform credibility optimization on the digital signature set to be checked.

2. The method for measuring the credibility of digital certificates and digital signatures based on the eigenvector algorithm as claimed in claim 1, characterized in that: The format field of the digital certificate is parsed, the field information is extracted, and the mapping rule is mapped to multiple dimensions of the credibility factor to generate a credibility feature vector, and the specific steps are as follows, The issuing authority, the country and region, the certificate purpose, the algorithm type, the key length and the key hash value are extracted from the digital certificate to form a field information data set; Based on the mapping rule, the field information data set is converted into multiple feature dimension values required for credibility evaluation, and combined into a multi-dimensional vector form to generate a credibility feature vector.

3. The method for measuring the credibility of digital certificates and digital signatures based on the eigenvector algorithm as claimed in claim 2, characterized in that: The comprehensive feature strength of the credibility feature vector is calculated using the Euclidean norm to obtain a quantitative credibility value, and the specific steps are as follows, The dimension credibility factors in the credibility feature vector are squared to obtain a square value sequence; The sum of the dimension contribution values is obtained by summing the square value sequence, and the dimension contribution value sum is square rooted to generate the comprehensive feature strength, which is used as the quantitative credibility value of the digital certificate.

4. The method for measuring the credibility of digital certificates and digital signatures based on the eigenvector algorithm as claimed in claim 3, wherein: The credibility of each digital certificate in the certificate chain formed by the digital signature verification is calculated according to the quantitative credibility value to generate a digital certificate credibility sequence, and the specific steps are as follows, The digital signature structure is parsed, and the certificate chain is extracted according to the verification dependency order; The quantitative credibility value of each digital certificate in the certificate chain is combined with the link order position of the digital certificate to form a structured scoring node; Based on the structured scoring node, the credibility value of the digital certificate with missing fields is adjusted to the corresponding reduced interval and marked as low credibility using a fault tolerance mechanism, and the updated structured scoring node is output; According to the updated structured scoring node, all quantitative credibility values are sequentially arranged according to the order of the digital certificate in the link, and output as a digital certificate credibility sequence.

5. The method for measuring the credibility of digital certificates and digital signatures based on the eigenvector algorithm as claimed in claim 4, wherein: The sequence length of the digital certificate credibility sequence is read to generate a weight value corresponding to the length of the digital certificate credibility sequence and decreasing in turn, and a weight value list is output. ​ The weight value list is sequentially assigned to each digital certificate in the digital certificate credibility sequence in link order, and a set of qualified weight verification values is generated by using strict monotonicity.

6. The method for measuring the credibility of digital certificates and digital signatures based on the eigenvector algorithm as claimed in claim 5, wherein: Based on the set of qualified weight verification values, the weight value and the quantified credibility value of each digital certificate are added one by one to generate a certificate chain credibility score, and a normalization compensation value is added, and the specific steps are as follows, Based on the set of qualified weight verification values, the weight value and the quantified credibility value of each digital certificate are added one by one to generate a certificate chain credibility score, and a normalization compensation value is added, and the specific steps are as follows, The weight value and the quantified credibility value of each pair of digital certificates in the weight and credibility pair list are sequentially read, the weighted contribution value is calculated, and the weighted contribution value sequence is output. The weight value and the quantified credibility value of each pair of digital certificates in the weight and credibility pair list are sequentially read, the weighted contribution value is calculated, and the weighted contribution value sequence is output, and the specific steps are as follows, 7. The method for measuring the credibility of digital certificates and digital signatures based on the eigenvector algorithm as claimed in claim 6, wherein: The weight value and the quantified credibility value of each pair of digital certificates in the weight and credibility pair list are sequentially read, the weighted contribution value is calculated, and the weighted contribution value sequence is output. The weight value and the quantified credibility value of each pair of digital certificates in the weight and credibility pair list are sequentially read, the weighted contribution value is calculated, and the weighted contribution value sequence is output. The processor executes the computer program to realize the steps of the method for measuring the credibility of digital certificates and digital signatures based on the feature vector algorithm in any one of claims 1-8.

8. The method for measuring the credibility of digital certificates and digital signatures based on the eigenvector algorithm as claimed in claim 6, wherein: The computer program is executed by the processor to realize the steps of the method for measuring the credibility of digital certificates and digital signatures based on the feature vector algorithm in any one of claims 1-8. ​ ​ ​ 9.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is characterized in that: ​ 10. A computer readable storage medium having stored thereon a computer program, characterized in that: ​

Images