High-speed mobile scene certificate management method and system based on three-level cache

Abstract

The invention discloses a high-speed mobile scene certificate management method and system based on three-level cache. The method comprises the following steps: storing certificate information based on a three-level cache structure; on the basis of the three-level cache structure, certificate query and effective management of update events are carried out by carrying out first-level cache hit check, score-based monitoring queue processing and data strategy selection with score ranking meeting requirements on certificates. By implementing the method provided by the invention, the security of certificate state verification can be ensured, the requirements of high concurrency and low delay of a mobile environment can be met, a multi-level cache coordination mechanism can be effectively utilized, and an intelligent priority scoring and risk-driven updating strategy can be realized, so that the overall performance and security of a system are greatly improved.

Description

Technical Field

[0001] This invention relates to certificate management and network security, and more specifically to a certificate management method and system for high-speed mobile scenarios based on a three-level cache. Background Technology

[0002] With the development of vehicle-to-everything (V2X) technology, the demand for communication between vehicles and between vehicles and infrastructure is increasing. To ensure the security of these communications—namely, authenticity, confidentiality, and integrity—an efficient and secure certificate management system is crucial. However, existing certificate management solutions have shown significant shortcomings in addressing the challenges of high-speed mobile scenarios.

[0003] Traditional systems typically employ a single-layer caching design, an architecture that struggles to meet the high-frequency certificate access demands of in-vehicle devices in high-speed mobile environments such as highways and high-speed trains. Especially in dynamic network environments, the lack of multi-level caching coordination mechanisms at edge nodes leads to underutilization of terminal L1 / L2 cache resources. As a result, the system repeatedly needs to fetch certificates and status information from remote servers, significantly increasing communication latency and severely impacting real-time communication efficiency. Current certificate update mechanisms primarily rely on fixed-period polling, which cannot dynamically respond to urgent update requests for certificates nearing expiration. For example, in the event of a key breach, traditional systems typically require over 30 minutes to trigger a global update, creating a significant security vacuum. Furthermore, the delayed update shortens the actual validity of some certificates, further increasing the risk of man-in-the-middle attacks.

[0004] Existing certificate validity verification schemes typically rely on Certificate Revocation Lists (CRLs) generated and published periodically by Certificate Authorities (CAs), which clients download and compare locally. Because CRLs cannot be updated in real time, and CAs usually publish CRLs at fixed intervals, system updates to certificate status are delayed, posing significant security risks. As the number of revoked certificates increases, CRL files rapidly expand, consuming substantial bandwidth and storage resources. During peak periods, a large number of clients simultaneously downloading and parsing CRLs can lead to network congestion and server overload. Particularly in large-scale vehicular networks, revocation status confirmation delays can reach several minutes; for example, when vehicle density exceeds 200 vehicles / square kilometer, the broadcast collision rate rises to 37%, resulting in a revocation information synchronization failure rate as high as 15%. Considering that system devices can receive thousands of signed messages per second, relying solely on CRL verification requires traversing a massive blacklist for each message, resulting in extremely high computational and storage costs. While incremental CRLs and segmented CRLs can alleviate the burden to some extent, they still struggle to meet the real-time requirements of rapidly changing scenarios.

[0005] In summary, existing certificate management solutions suffer from bottlenecks such as high response latency, delayed updates, and high network overhead in high-speed mobile 5G-V2X scenarios, especially in high-density communication environments. For example, on city buses or high-speed vehicles, frequent base station switching leads to unstable connections and stringent latency requirements. In such situations, if each communication requires waiting for a remote response or periodically downloading large amounts of CRLs, communication congestion or authentication failures are inevitable.

[0006] Therefore, it is necessary to design a new method that enables certificate status verification to ensure security while adapting to the high concurrency and low latency requirements of mobile environments. This method should effectively utilize a multi-level caching collaboration mechanism to achieve intelligent priority scoring and risk-driven update strategies, thereby significantly improving the overall performance and security of the system. Summary of the Invention

[0007] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method and system for certificate management in high-speed mobile scenarios based on a three-level cache.

[0008] To achieve the above objectives, the present invention adopts the following technical solution: a certificate management method for high-speed mobile scenarios based on a three-level cache, comprising:

[0009] Certificate information is stored using a three-level cache structure;

[0010] Based on the aforementioned three-level caching structure, certificate query and update events are effectively managed by performing a first-level cache hit check on the certificate, processing the monitoring queue based on a score, and selecting a data strategy that meets the score ranking requirements.

[0011] The further technical solution is as follows: Based on the aforementioned three-level cache structure, after effectively managing certificate query and update events by performing a first-level cache hit check on the certificate, processing the monitoring queue based on a score, and selecting a data strategy that meets the score ranking requirements, the solution further includes:

[0012] By collecting certificate metrics in real time and calculating risk values, and combining them with dynamic thresholds to determine the status of monitored certificates, an update request is asynchronously initiated when the risk value exceeds the threshold, and further actions are taken based on the backend response.

[0013] The further technical solution is as follows: the three-level cache structure includes a high-speed cache layer, a local persistent cache layer, and a remote storage layer; the high-speed cache layer is deployed in the local high-speed memory of the vehicle or terminal device and is used to store recently frequently used certificates and their status information; the local persistent cache layer is located in the persistent storage space on the device side and is used to store all commonly used certificate data of users in the region; the remote storage layer relies on network communication to connect to the certificate status service or CA server and is used to obtain the latest certificate status information.

[0014] The further technical solution is as follows: when both the high-speed cache layer and the local persistent cache layer fail to load, the remote storage layer requests data from the backend through a secure channel.

[0015] The further technical solution is as follows: the certificate query follows the order of searching from the high-speed cache layer to the local persistent cache layer and then to the remote storage layer. The certificate update first obtains the latest data from the remote storage layer and persists it to the local persistent cache layer, and then updates the high-speed cache layer in batches asynchronously.

[0016] The further technical solution is as follows: Based on the three-level cache structure, effective management of certificate query and update events is achieved by performing a first-level cache hit check on the certificate, processing the monitoring queue based on a score, and selecting a data strategy that meets the score ranking requirements. This includes:

[0017] Check if the cache layer cache is hit;

[0018] If the cache layer misses, further check the local persistent cache layer and the remote storage layer, and update the access count and timestamp as appropriate;

[0019] If the cache layer hits, update the access counter and record the current timestamp and certificate validity period;

[0020] Add certificate information to the monitoring queue;

[0021] Regularly check whether the data in the monitoring queue meets specific trigger conditions;

[0022] When the data meets specific triggering conditions, the score of each certificate is calculated according to a preset algorithm, and a priority queue is constructed;

[0023] The system evaluates the scores and rankings of certificates. Certificates that meet the ranking requirements are either actively written back to the local persistent cache layer or passively removed from the cache layer to optimize system performance.

[0024] The further technical solution is as follows: The method involves real-time collection of certificate metrics and calculation of risk values, combined with dynamic thresholds to determine the status of monitored certificates, and asynchronously initiating an update request when the risk value exceeds the threshold. Further operations are then performed based on the backend response, including:

[0025] Collect relevant metrics for certificates, including validity period, usage frequency, and access patterns, to obtain the collected data;

[0026] Based on the collected data, the risk of each certificate is assessed, and a specific risk value is calculated;

[0027] Based on the current network load, an automatic adjustment and determination of a threshold is made to obtain a dynamic threshold;

[0028] The risk value of each certificate is compared with a dynamic threshold to identify high-risk certificates.

[0029] The high-risk certificates are marked as high-risk, and a priority queue is established based on the risk value and other factors to determine the update order;

[0030] For certificates that need to be updated, an update request is initiated asynchronously to perform the update.

[0031] Check the backend's response status to the update request to confirm whether the update was successful;

[0032] Upon successful update, the latest certificate information is written to the local persistent cache layer and then loaded into the high-speed cache layer memory cache.

[0033] This invention also provides a high-speed mobile scenario certificate management system based on a three-level cache, including:

[0034] Storage unit, used to store certificate information based on a three-level cache structure;

[0035] The query unit is used to effectively manage certificate query and update events based on the three-level cache structure by performing a cache hit check on the certificate at one level, processing the monitoring queue based on the score, and selecting a data strategy that meets the score ranking requirements.

[0036] The present invention also provides a computer device, the computer device including a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the above-described method.

[0037] The present invention also provides a storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0038] The advantages of this invention compared to existing technologies are as follows: By employing a three-level caching structure to store certificate information, and implementing score-based monitoring queue processing and intelligent data strategy selection, the system can efficiently handle high concurrency and low latency requirements in mobile environments while ensuring the security of certificate status verification. Specifically, utilizing a multi-level caching collaboration mechanism, the system achieves refined management of certificate query and update events: First, by performing hit checks on each level of cache, it quickly responds to certificate verification requests, reducing unnecessary remote access; second, a score ranking mechanism is introduced to prioritize high-risk or important certificate update tasks, ensuring timeliness and accuracy; finally, combined with a risk-driven pre-update strategy, the time from certificate revocation to detection is significantly shortened, further enhancing the system's resilience. This comprehensive strategy not only significantly improves the overall performance of the system but also strengthens security.

[0039] The present invention will be further described below with reference to the accompanying drawings and specific embodiments. Attached Figure Description

[0040] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 A schematic diagram illustrating an application scenario of the high-speed mobile scenario certificate management method based on a three-level cache provided in this embodiment of the invention;

[0042] Figure 2 A flowchart illustrating the high-speed mobile scenario certificate management method based on a three-level cache provided in an embodiment of the present invention;

[0043] Figure 3 A schematic diagram of a sub-process of a high-speed mobile scenario certificate management method based on a three-level cache provided in an embodiment of the present invention;

[0044] Figure 4 A flowchart illustrating the certificate update and revocation logic provided in this embodiment of the invention;

[0045] Figure 5 A schematic diagram of the three-level cache access process provided in an embodiment of the present invention;

[0046] Figure 6 A schematic diagram illustrating the security isolation strategy provided in an embodiment of the present invention;

[0047] Figure 7A flowchart illustrating a high-speed mobile scenario certificate management method based on a three-level cache, provided as another embodiment of the present invention;

[0048] Figure 8 A schematic diagram of a sub-process of a high-speed mobile scenario certificate management method based on a three-level cache, provided in another embodiment of the present invention;

[0049] Figure 9 A schematic block diagram of a high-speed mobile scene certificate management system based on a three-level cache provided in an embodiment of the present invention;

[0050] Figure 10 A schematic block diagram of a high-speed mobile scene certificate management system based on a three-level cache, provided for another embodiment of the present invention;

[0051] Figure 11 A schematic block diagram of a computer device provided for an embodiment of the present invention. Detailed Implementation

[0052] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0053] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0054] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0055] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0056] Please see Figure 1 and Figure 2 , Figure 1 This is a schematic diagram illustrating an application scenario of the high-speed mobile scenario certificate management method based on a three-level cache, as provided in an embodiment of the present invention. Figure 2This is a schematic flowchart illustrating a high-speed mobile scenario certificate management method based on a three-level cache, as provided in an embodiment of the present invention. This method is applied to a server. By constructing a three-level cache structure comprising a high-speed cache layer, a local persistent cache layer, and a remote storage layer, efficient storage and management of certificate information is achieved, making it particularly suitable for the high concurrency and low latency requirements of high-speed mobile scenarios. First, it utilizes a multi-level cache collaboration mechanism to query certificates in the order from the high-speed cache to the local persistent cache and then to the remote storage, prioritizing the retrieval of the latest data from the remote storage during updates to ensure data freshness and security. Second, a score-based monitoring queue processing and intelligent priority scoring mechanism ensure that critical certificates are processed and optimized in a timely manner. Simultaneously, real-time risk assessment and dynamic threshold adjustment are combined to identify high-risk certificates and asynchronously initiate update requests, further improving the system's response speed and reliability. Ultimately, this strategy not only significantly improves the overall system performance but also enhances the security of certificate status verification, making the entire certificate management system both flexible and secure.

[0057] Figure 2 This is a flowchart illustrating the high-speed mobile scenario certificate management method based on a three-level cache provided in an embodiment of the present invention. Figure 2 As shown, the method includes the following steps S110 to S120.

[0058] S110 stores certificate information based on a three-level cache structure.

[0059] In this embodiment, the three-level cache structure includes a high-speed cache layer, a local persistent cache layer, and a remote storage layer. The high-speed cache layer is deployed in the local high-speed memory of the vehicle or terminal device and is used to store recently frequently used certificates and their status information. The local persistent cache layer is located in the persistent storage space on the device side and is used to store all commonly used certificate data of users in the region. The remote storage layer relies on network communication to connect to the certificate status service or CA server and is used to obtain the latest certificate status information.

[0060] When both the high-speed cache layer and the local persistent cache layer fail to load, the remote storage layer requests data from the backend through a secure channel.

[0061] Certificate lookups follow a search order from the cache layer to the local persistent cache layer and then to the remote storage layer. When updating certificates, the latest data is retrieved from the remote storage layer and persisted to the local persistent cache layer first, and then the cache layer is updated asynchronously in batches.

[0062] Please see Figure 4By introducing multi-level caching and intelligent update strategies between vehicles or terminal devices and backend services, this approach improves query response speed and network utilization while simultaneously achieving the triple goals of low latency, high security, and strong scalability. This design enables in-vehicle terminals to maintain stable and compliant PKI services even in high-speed motion or weak network environments.

[0063] The system adopts a three-tier deployment of "central cloud + edge cloud + terminal":

[0064] On the terminal side: a lightweight L1 / L2 cache and a priority scheduler are embedded. The priority scheduler is used to handle the priorities of different tasks, ensuring that critical tasks can be executed first.

[0065] Regional edge cloud: Deploy L3 caching, Certificate Revocation List (CRL) differential service, and bulk issuance agent. The L3 cache, as a higher-level cache, stores more frequently used data to reduce access to the central cloud. The CRL differential service handles real-time updates and differential distribution for certificate management, while the bulk issuance agent processes a large number of certificate issuance requests, improving efficiency.

[0066] Central CA Cloud: Responsible for core functions such as trust anchors, key generation, and CRL publication for the entire network.

[0067] Specifically, a three-level caching system (L1, L2, L3) is used to store certificate information and status:

[0068] L1 Cache (High-Speed ​​Cache): Located in high-speed local memory of the vehicle / terminal device, it stores recently used certificates and their status information (such as signature, validity period, revocation status, etc.). L1 caching offers advantages such as fast read / write speeds and low access latency. It can be implemented using the device's RAM or fast flash memory such as SRAM or DRAM, achieving an 85% hit rate and controlling certificate verification latency to the nanosecond level. L1 caching ensures data freshness through event listening or timed refresh mechanisms; for example, it updates the corresponding cached entries immediately when an update event occurs.

[0069] L2 cache (local persistent cache): Located in persistent storage on the device side (such as embedded flash memory or local file system), it stores frequently used certificate information and serves as a backup for the L1 cache. The L2 cache has a larger capacity than L1 and can store all certificate data used by the device's region or resident users. Its access speed is between L1 and L3, and it can be implemented using lightweight databases such as SQLite or local file indexes, with access latency controllable between 10-100μs and a hit rate of approximately 12%. The L2 cache supports read and write operations, and for fast retrieval, metadata such as certificate expiration time and issuing authority can be stored along with the certificate. The L2 storage size can be adjusted according to the device's storage capacity, and local backup and file verification are enabled to prevent data corruption.

[0070] L3 cache (remote storage): This refers to a remote certificate status service or CA server, primarily retrieving certificate status information, such as CRL fragments or new certificates, over the network. When L1 and L2 misses occur, the device requests the latest certificate status from the backend via a secure channel. L3 implementation relies on 5G / LTE network communication and backend services. To optimize performance, edge nodes or cloud caching CDNs can be deployed nearby to reduce latency, with an access latency of approximately 1-10ms and a hit rate of 3%. The L3 cache also handles asynchronous update tasks; when L1 / L2 alerts or expire, the latest data is retrieved from L3 and distributed to the local cache.

[0071] Under this three-level caching system, such as Figure 5 As shown, the data flow path for certificate lookup is as follows: First, the certificate is searched in the L1 memory cache. If no match is found, the search proceeds to the L2 local persistent cache. Finally, if still no match is found, the backend L3 remote service is accessed via the network. For data updates, new data can be retrieved from L3, persisted to L2, and then asynchronously updated to L1 in batches, thereby reducing the impact of network jitter on service availability. This architecture balances read speed and system capacity, effectively ensuring timely data delivery and processing in high-speed mobile scenarios. It utilizes high-speed storage to improve the certificate read hit rate and reduces dependence on the backend and certificate verification latency.

[0072] To ensure system performance and deployability, the capacity and expiration time of each cache layer can be reasonably set according to the application scenario and the number of certificates. It is generally recommended that the L1 cache size be set to 2-3 times the number of active certificates, and its update frequency be set to tens of seconds to several minutes. The L2 cache should be synchronized with L3 data periodically, such as daily or on demand. Network access policies can prioritize the use of the L2 cache to reduce reliance on the L3 cache. After configuration, policy parameters can be adjusted according to the system's target hit rate and latency requirements.

[0073] S120. Based on the three-level cache structure, certificate query and update events are effectively managed by performing a level-one cache hit check on the certificate, processing the monitoring queue based on the score, and selecting a data strategy that meets the score ranking requirements.

[0074] In one embodiment, please refer to Figure 3 The above-mentioned step S120 may include steps S121 to S127.

[0075] S121. Check if the cache layer cache is hit.

[0076] In this embodiment, this step primarily involves checking whether the certificate currently requested already exists in the system's cache layer (L1 cache). If the certificate exists in the cache, it is considered a "hit"; otherwise, it is considered a "miss". The cache exists to accelerate certificate access and reduce the need to retrieve data from the slower storage layer.

[0077] S122. If the cache layer misses, further check the local persistent cache layer and the remote storage layer, and update the access count and timestamp as appropriate.

[0078] In this embodiment, when a cache miss occurs, the system will attempt to locate the required certificate in a local persistent cache layer (such as L2 cache) or a remote storage layer. Once found, in addition to providing it to the requesting party, the system also needs to update the certificate's relevant information, including access counters and timestamps. This step helps maintain the up-to-date certificate status and provides accurate data support for subsequent scoring and ranking.

[0079] S123. If the cache layer hits, update the access counter and record the current timestamp and certificate validity period.

[0080] In this embodiment, if the required certificate is found in the cache layer, the system will not only immediately return the certificate, but also update its access counter and record the current timestamp and the certificate's validity period. These operations are crucial for dynamically adjusting certificate priority scores, as they directly affect the two key scoring factors: the certificate's historical access frequency and remaining validity period.

[0081] S124. Add the certificate information to the monitoring queue.

[0082] In this embodiment, regardless of the level from which a certificate is retrieved, its relevant information is added to a monitoring queue. This queue is used to track the status changes of all certificates in order to periodically evaluate and recalculate the score of each certificate, thereby maintaining the freshness and relevance of the data in the cache.

[0083] S125. Periodically check whether the data in the monitoring queue meets specific triggering conditions.

[0084] In this embodiment, the system periodically checks each certificate entry in the monitoring queue to determine whether it meets preset trigger conditions. These conditions may be based on time intervals, access counts, or other business logic-related standards. In this way, it ensures that only certificates that meet the conditions will proceed to the next stage of the scoring calculation process.

[0085] S126. When the data meets specific triggering conditions, the score of each certificate is calculated according to a preset algorithm, and a priority queue is constructed.

[0086] In this embodiment, once a certificate meets a specific triggering condition, its score is calculated using a previously defined scoring algorithm. The score considers factors such as the certificate's historical access frequency, remaining validity period, and security weight. Based on the calculated scores, all certificates are reordered to form a new priority queue reflecting their importance relative to each other.

[0087] S127. Evaluate the score ranking of certificates. Certificates that meet the ranking requirements are actively written back to the local persistent cache layer or passively removed from the high-speed cache layer to optimize system performance.

[0088] In this embodiment, the final step is to analyze the newly constructed priority queue to determine which certificates should be promoted to a higher cache level (e.g., moved from L2 cache to L1 cache) and which certificates with low scores should be removed to make room for more important certificates. This strategy helps improve the overall system efficiency, reduce unnecessary resource consumption, and ensure that critical certificates are always available.

[0089] In summary, these seven steps together constitute a complete certificate caching management process, which achieves effective management and efficient utilization of certificate data through intelligent caching mechanisms and dynamic adjustment strategies.

[0090] In step S120 above, to prioritize the retention of critical or soon-to-be-used certificates in the certificate cache, this scheme introduces a priority scoring mechanism to sort certificate entries. The score for each certificate is calculated using the following comprehensive metrics:

[0091] Where: freq is the historical access frequency of the certificate;

[0092] The remaining validity period of the offset certificate (i.e., the length of time from the expiration date);

[0093] SecurityWeight pre-defined security weights (such as the certificate level or the credibility of the issuing organization).

[0094] This formula normalizes and weights different indicators based on multi-objective decision theory. The weight of access frequency reflects the urgency of certificate access needs; the remaining validity period reflects the importance of the risk of certificate expiration; and the security weight is set according to the certificate type, for example, the root certificate has the highest security level.

[0095] The securityWeight value is 1.0 for primary certificates and 0.5 for secondary certificates. Therefore, certificates with high frequency of use, nearing expiration, or high security levels will receive higher scores. The weighting coefficients (0.6, 0.3, 0.1) in this scheme can be adjusted according to specific scenario requirements: for example, the security weight value can be increased in a high-security environment; when a certificate is about to expire, the impact of the offset item can be enhanced.

[0096] According to this scoring mechanism, certificates with higher access frequency are considered more valuable (0.6 weight), while certificates with higher expiration risk (smaller offset) should be refreshed more quickly (the inverse of the 0.3 weight). Simultaneously, certificates with higher security levels are given greater importance (0.1 weight). Normalization ensures that all certificate scores fall within the [0, 1] range, facilitating comparison and ranking. For example, if a certificate has reached its highest access frequency in history and has only one hour of validity remaining, its normalized score is close to 1, allowing it to rank higher in the cache. When L1 cache space is insufficient, the certificate with the lowest score is evicted; while L2 cache uses a sliding window mechanism to gradually evict certificates. Dynamically updating scores significantly improves cache hit rate, reduces verification inconsistencies and overall overhead, and effectively prevents the risk of expired certificates not being refreshed in time. Furthermore, continuous iterative optimization of weight values ​​can reduce the verification latency and error rate of important certificates to extremely low levels.

[0097] In terms of implementation, after a certificate is first queried or updated, the system records its access count and remaining validity period, and periodically (e.g., hourly) recalculates and sorts the scores of all cached certificates. Certificates with low scores can be written back to the L2 cache early or awaited for eviction, freeing up space in the L1 cache for new entries. This approach not only improves cache management efficiency but also ensures system stability and reliability.

[0098] This priority scoring mechanism allows for a quantitative assessment of the value of each certificate and ensures that the most suitable certificate is selected each time the cache is promoted, thus achieving a hit rate as close as possible to the global optimum.

[0099] Ultimately, a risk-driven update strategy calculates risk values ​​in real time using multiple parameters such as certificate validity period, access frequency, and business security weight, triggering certificate update and revocation mechanisms. This approach not only optimizes the overall performance and security of the certificate management system but also ensures efficient operation and responsiveness in dynamic environments. Specifically, this strategy can more accurately identify potential security threats and expiration risks, promptly updating or revoking certificates to guarantee system stability and security. The result is improved resource utilization and enhanced robustness and adaptability of the entire certificate management system.

[0100] Specifically, because the management of revocation information and private keys needs to be conducted in a highly trusted environment, security isolation strategies must be incorporated into the system design. Please refer to... Figure 6 This document details the system's security isolation strategy. To ensure key security and the reliability of signing operations, it recommends using a Hardware Security Module (HSM) or Trusted Execution Environment (TEE) to store the Certificate Authority's (CA) private key and perform related signing tasks, thereby preventing the risk of key leakage or tampering. Furthermore, separating certificate management logic from regular application logic to form an independent security module interface further enhances security.

[0101] In practice, independent processes can be established on both the vehicle / device side and the backend server side, or virtualization technology can be used to create boundaries specifically for isolating certificate query services, thereby avoiding the impact of potential system vulnerabilities on the certificate verification process. Communication between different modules should be achieved by establishing secure channels (such as TLS protocol combined with a two-way authentication mechanism) and strictly adhering to the principle of least privilege to reduce the potential attack surface.

[0102] The method in this embodiment significantly improves certificate management performance in complex scenarios such as high-speed movement of in-vehicle devices through multi-layer caching and intelligent update strategies. Its core advantages include, but are not limited to, improved cache hit rate, reduced network overhead, and reduced response latency, while enhancing the system's security, consistency, and reliability.

[0103] Especially suitable for high-speed mobile scenarios, it can significantly improve certificate lookup hit rate while greatly reducing the need to access remote servers. Compared to traditional methods, system response time is reduced by 30% to 50%, greatly improving the user experience.

[0104] These strategies significantly reduce the number of network certificate verification requests and network bandwidth consumption. Most certificate checks can be completed in the local first or second level cache, reducing the average response latency from hundreds of milliseconds to less than 10 milliseconds. Even with rapid network switching, a stable certificate verification process can be maintained, avoiding verification blocking issues caused by network switching.

[0105] In this way, the time interval between certificate revocation and system detection is reduced from several minutes to just a few seconds, effectively lowering the risk of certificate misuse. The dynamic management and update strategy also significantly reduces cache inconsistency issues, improves the consistency of certificate status across all network terminals, and thus reduces the verification failure rate.

[0106] By leveraging the HSM isolation strategy, critical keys and authentication modules are effectively protected, significantly enhancing the system's resistance to attacks. This not only ensures data security but also improves the overall stability and reliability of the service.

[0107] The aforementioned high-speed mobile scenario certificate management method based on a three-level cache stores certificate information using a three-level cache structure. Based on this, it implements score-based monitoring queue processing and intelligent data strategy selection. The system can efficiently handle high concurrency and low latency requirements in mobile environments while ensuring the security of certificate status verification. Specifically, utilizing a multi-level cache collaboration mechanism, the system achieves fine-grained management of certificate query and update events: First, it quickly responds to certificate verification requests by performing hit checks on each level of cache, reducing unnecessary remote access; second, it introduces a score ranking mechanism to prioritize high-risk or important certificate update tasks, ensuring timeliness and accuracy; finally, combined with a risk-driven pre-update strategy, it significantly shortens the time from certificate revocation to detection, further enhancing the system's resilience. This comprehensive strategy not only significantly improves the overall performance of the system but also strengthens security.

[0108] Figure 7 This is a flowchart illustrating a high-speed mobile scenario certificate management method based on a three-level cache, provided by another embodiment of the present invention. Figure 7 As shown, the high-speed mobile scene certificate management method based on three-level caching in this embodiment includes steps S210-S230. Steps S210-S220 are similar to steps S110-S120 in the above embodiment and will not be described again here. The following details the additional step S230 in this embodiment.

[0109] S230: By collecting certificate metrics in real time and calculating risk values, and combining them with dynamic thresholds to determine the status of monitored certificates, an update request is asynchronously initiated when the risk value exceeds the threshold, and further operations are performed based on the backend response.

[0110] In one embodiment, such as Figure 8 As shown, step S230 above may include steps S231 to S238.

[0111] S231. Collect relevant indicators of the certificate, including validity period, usage frequency and access mode, to obtain the collected data.

[0112] First, the system needs to continuously collect relevant data about each certificate, including but not limited to information such as validity period, usage frequency, and access patterns. This data will serve as the basis for subsequent risk assessments.

[0113] S232. Based on the collected data, assess the risk of each certificate and calculate the specific risk value.

[0114] Based on the data collected in step S231, the system calculates the risk value for each certificate. This typically involves some form of formula or algorithm, such as the risk value mentioned above, which is the ratio of certificate access frequency to remaining validity period: Risk = freq / offset. The goal of this stage is to quantify the security status of each certificate.

[0115] S233. Based on the current network load, automatically adjust and determine a threshold to obtain a dynamic threshold.

[0116] In this embodiment, to adapt to different network environments and load conditions, the system automatically adjusts and determines a threshold α based on the current network load. This threshold is used to determine whether a certificate is in a high-risk state. The purpose is to ensure that certificates requiring priority processing can be effectively identified under different operating environments.

[0117] S234. Compare the risk value of each certificate with a dynamic threshold to identify high-risk certificates.

[0118] In this embodiment, the system compares the risk value of each certificate with a dynamically adjusted threshold α. If the risk value of a certificate exceeds this threshold, it is considered to be in a high-risk state, and immediate action may be required.

[0119] S235. Mark the high-risk certificate as high-risk and establish a priority queue based on the risk value and other factors to determine the update order.

[0120] In this embodiment, certificates marked as high-risk are classified as high-risk certificates by the system, and a priority queue is constructed based on the risk value and other relevant factors (such as the importance of the certificate). The purpose of this is to ensure that the most important certificates receive the fastest update processing.

[0121] S236. For certificates that need to be updated, initiate an update request asynchronously to perform the update.

[0122] In this embodiment, for certificates marked as needing updating, the system initiates an update request asynchronously. This approach avoids blocking other operations, smooths system load, and improves overall efficiency.

[0123] S237. Check the backend's response status to the update request to confirm whether the update was successful.

[0124] Once an update request is sent, the system will continuously monitor the backend's response status. This is to confirm whether the update was completed successfully. If the update is successful, the system will proceed to the next step; if it fails, appropriate remedial measures will be taken.

[0125] S238. Upon successful update, the latest certificate information is written to the local persistent cache layer and loaded into the high-speed cache layer memory cache first.

[0126] When the update is successful, the latest certificate information is first written to a local persistent cache layer (such as an L2 cache) to ensure data security and persistence. Subsequently, this information is also loaded into a high-speed cache layer (such as an L1 memory cache) for fast access and improved efficiency of subsequent operations.

[0127] Through the steps described above, the system can not only effectively monitor the status of certificates and react promptly, but also ensure that the highest security standards are maintained throughout the certificate's lifecycle, while also considering performance and resource utilization efficiency. This strategy is particularly suitable for scenarios with extremely high security requirements, such as connected vehicles or other mobile device network environments.

[0128] Specifically, the method in this embodiment aims to improve the timeliness and stability of the system when processing certificate status verification, especially for the high concurrency and low latency requirements in mobile environments. Its core lies in employing a risk-driven update mechanism and a certificate revocation handling mechanism to ensure efficient and secure management of the certificate lifecycle.

[0129] First, to monitor certificate status in real time and dynamically adjust response strategies, the system continuously collects certificate-related metrics, including validity period and usage frequency. Based on this data, it calculates the risk value for each certificate, which is the ratio of access frequency to remaining validity period. Using this quantitative method, frequently used, soon-to-expire certificates are marked as high-risk and require priority renewal; while less frequently used, long-term valid certificates can have their renewals postponed. Simultaneously, the system dynamically adjusts the threshold α based on network load to adapt to different operating environments.

[0130] When the risk value of a certificate exceeds a set threshold α, the system will automatically trigger an asynchronous update process. This process not only smooths system load and avoids resource contention during peak hours, but also improves overall throughput. Especially when network conditions permit, performing updates in advance further reduces unnecessary network consumption. For situations where the latest certificate status cannot be obtained immediately, the local three-level caching structure effectively mitigates the impact of network latency, ensuring continuous system operation.

[0131] Furthermore, to quickly notify terminal devices of certificate revocation status, the system combines message push and proactive polling. In LAN or near-field communication environments, the base station can rapidly send new revocation information via a dedicated channel; while in wide-area networks, it primarily relies on L3 query updates and synchronizing the results to L1 / L2 caches. Once a high-risk certificate is identified as about to be used, the system immediately retrieves the latest CRL (Certificate Revocation List) from L3 and updates the local cache, significantly shortening the time interval between certificate revocation and terminal notification, thus improving system security.

[0132] In this embodiment, certificate status monitoring is the initial stage of the entire certificate management process, aiming to ensure system security and effectiveness by monitoring certificate status in real time. This process first requires the system to continuously collect various certificate-related metrics, which may include, but are not limited to, certificate validity period, usage frequency, and access patterns. Based on the collected data, the system performs a detailed risk assessment and calculates the specific risk value for each certificate. To adapt to different network environments and load conditions, the system dynamically adjusts and determines a threshold α based on the current network load. This threshold is used to determine whether a certificate poses a high risk. Specifically, this threshold is automatically adjusted by considering network load conditions to ensure that certificates requiring priority processing can be effectively identified under different operating environments.

[0133] The update strategy is a crucial step implemented after certificate status monitoring. Its core lies in determining whether a certificate needs updating based on a calculated risk value and a dynamic threshold. The system first compares the risk value (Risk) of each certificate with a dynamically calculated threshold α. If the risk value is less than or equal to the threshold (Risk ≤ α), the certificate is considered to be within an acceptable risk range, requiring no update. Conversely, if the risk value exceeds the threshold (Risk > α), the certificate is considered high-risk and requires further processing. For certificates marked as high-risk, the system generates a priority queue based on their risk value and other relevant factors to determine which certificates should be updated first. For certificates requiring updates, the system initiates update requests asynchronously. This approach not only avoids blocking other operations but also optimizes system performance and improves overall efficiency.

[0134] After the system asynchronously initiates an update request, the next crucial step is processing the backend response status. The system waits for and checks the backend's response status to confirm the success of the update operation. If the update operation is successful, meaning a valid update response is received, the system writes the latest certificate information to the L2 persistent cache to ensure data security and durability. Simultaneously, to improve the speed and efficiency of subsequent accesses, the system also prioritizes loading the updated certificate information into the L1 memory cache. However, if an invalid response is encountered, indicating that the update operation has failed, the system will issue an alert to relevant personnel and attempt to re-initiate the update request until the update succeeds or the preset maximum number of retries is reached. Through this carefully designed process, the system can not only effectively monitor the certificate status and update it promptly when necessary, but also ensure the security and validity of the certificate throughout its entire lifecycle.

[0135] By introducing a multi-level caching architecture, priority scoring algorithm, risk-driven update mechanism, and security isolation measures, low latency, high hit rate, and high reliability of the certificate verification process can be achieved, which makes it show significant advantages in application scenarios such as vehicle-to-everything (V2X) communication security, mobile internet security, and intelligent transportation systems.

[0136] First, the multi-layered caching architecture aims to optimize the speed and efficiency of certificate verification. This architecture comprises two layers: an L1 memory cache and an L2 persistent cache. The L1 memory cache provides fast data access, ensuring that frequently used certificate information can be retrieved quickly, thus significantly reducing latency. The L2 persistent cache, on the other hand, guarantees data security and durability; even in the event of system failure or restart, certificate information will not be lost, further enhancing system reliability.

[0137] Secondly, the priority scoring algorithm is a mechanism that scores certificates to be verified based on multiple factors, such as the certificate's validity period, usage frequency, and historical records. By calculating the priority score for each certificate, the system can identify which certificates need to be processed first, thereby improving the overall hit rate and ensuring that critical certificates can be verified in the shortest possible time, thus enhancing the user experience.

[0138] Furthermore, the risk-driven update mechanism is a dynamic process that adjusts certificate status based on real-time monitored risk values ​​to determine whether a certificate update is necessary. This mechanism not only promptly identifies and resolves potential security threats but also avoids unnecessary update operations, reduces system overhead, and enhances system responsiveness and security.

[0139] Finally, the security isolation mechanism provides physical or logical isolation protection for different levels of certificate verification, preventing a problem with a single certificate from affecting the security of the entire system or other certificates. This isolation measure is particularly important for ensuring the security of vehicle-to-everything (V2X) communications, mobile internet security, and the exchange of sensitive information in intelligent transportation systems, helping to build a more robust and reliable security protection system.

[0140] In summary, by combining the four key technologies mentioned above—multi-level caching architecture, priority scoring algorithm, risk-driven update mechanism, and security isolation measures—performance metrics in the certificate verification process can be effectively improved, such as reducing latency, increasing hit rate, and enhancing reliability. This provides strong support for applications in areas such as vehicle-to-everything (V2X) communication security, mobile internet security, and intelligent transportation systems.

[0141] Figure 9 This is a schematic block diagram of a high-speed mobile scene certificate management system 300 based on a three-level cache, provided in an embodiment of the present invention. Figure 9 As shown, corresponding to the above-described high-speed mobile scene certificate management method based on a three-level cache, the present invention also provides a high-speed mobile scene certificate management system 300 based on a three-level cache. This high-speed mobile scene certificate management system 300 based on a three-level cache includes a unit for executing the above-described high-speed mobile scene certificate management method based on a three-level cache, and the system can be configured in a server. Specifically, please refer to... Figure 7 The high-speed mobile scene certificate management system 300 based on three-level caching includes a storage unit 301 and a query unit 302.

[0142] Storage unit 301 is used to store certificate information based on a three-level cache structure; query unit 302 is used to effectively manage certificate query and update events based on the three-level cache structure by performing a first-level cache hit check on the certificate, processing the monitoring queue based on the score, and selecting a data strategy that meets the score ranking requirements.

[0143] In one embodiment, the query unit 302 includes:

[0144] The system comprises the following sub-units: a checking sub-unit to check for cache hits; a further checking sub-unit to check the local persistent cache and remote storage if a cache miss occurs, and update the access count and timestamp as needed; an updating sub-unit to update the access counter and record the current timestamp and certificate expiration if a cache hit occurs; an adding sub-unit to add certificate information to the monitoring queue; a periodic checking sub-unit to periodically check whether the data in the monitoring queue meets specific trigger conditions; a calculation sub-unit to calculate the score of each certificate according to a preset algorithm and build a priority queue when the data meets specific trigger conditions; and a ranking sub-unit to evaluate the ranking of certificates, with certificates that meet the ranking requirements being actively written back to the local persistent cache or passively evicted from the cache to optimize system performance.

[0145] In one embodiment, the monitoring unit includes:

[0146] The system comprises the following sub-units: a collection sub-unit, which collects relevant certificate metrics, including validity period, usage frequency, and access patterns, to obtain collected data; a risk value calculation sub-unit, which assesses the risk of each certificate based on the collected data and calculates a specific risk value; a threshold adjustment sub-unit, which automatically adjusts and determines a threshold based on the current network load to obtain a dynamic threshold; a comparison sub-unit, which compares the risk value of each certificate with the dynamic threshold to identify high-risk certificates; a marking sub-unit, which marks the high-risk certificates as high-risk and establishes a priority queue based on risk value and other factors to determine the update order; an update sub-unit, which initiates an update request asynchronously for certificates that need updating; a status check sub-unit, which checks the backend's response status to the update request to confirm whether the update was successful; and a write sub-unit, which, upon successful update, writes the latest certificate information to the local persistent cache layer's persistent cache and prioritizes loading it into the high-speed cache layer's memory cache.

[0147] Figure 10 This is a schematic block diagram of a high-speed mobile scene certificate management system 300 based on a three-level cache, provided in another embodiment of the present invention. Figure 10 As shown, the high-speed mobile scene certificate management system 300 based on three-level caching in this embodiment is based on the above embodiment with the addition of a monitoring unit 303.

[0148] Monitoring unit 303 collects certificate metrics in real time and calculates risk values. It then uses dynamic thresholds to determine the status of monitored certificates and asynchronously initiates update requests when the risk value exceeds the threshold, taking further action based on the backend response.

[0149] It should be noted that those skilled in the art can clearly understand that the specific implementation process of the above-mentioned high-speed mobile scene certificate management system 300 based on three-level caching and each unit can be referred to the corresponding description in the foregoing method embodiments. For the sake of convenience and brevity, it will not be repeated here.

[0150] The aforementioned high-speed mobile scene certificate management system 300 based on a three-level cache can be implemented as a computer program, which can be used in, for example... Figure 11 It runs on the computer device shown.

[0151] Please see Figure 11 , Figure 11 This is a schematic block diagram of a computer device provided in an embodiment of this application. The computer device 500 can be a server, wherein the server can be a standalone server or a server cluster composed of multiple servers.

[0152] See Figure 9 The computer device 500 includes a processor 502, a memory, and a network interface 505 connected via a system bus 501. The memory may include a non-volatile storage medium 503 and internal memory 504.

[0153] The non-volatile storage medium 503 can store an operating system 5031 and a computer program 5032. The computer program 5032 includes program instructions that, when executed, cause the processor 502 to perform a high-speed mobile scene certificate management method based on a three-level cache.

[0154] The processor 502 provides computing and control capabilities to support the operation of the entire computer device 500.

[0155] The internal memory 504 provides an environment for the execution of the computer program 5032 in the non-volatile storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute a high-speed mobile scene certificate management method based on a three-level cache.

[0156] This network interface 505 is used for network communication with other devices. Those skilled in the art will understand that... Figure 11 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device 500 to which the present application is applied. The specific computer device 500 may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0157] The processor 502 is used to run a computer program 5032 stored in the memory to perform the following steps:

[0158] Certificate information is stored using a three-level cache structure. Based on this three-level cache structure, certificate query and update events are effectively managed by performing a cache hit check on one level of the certificate, processing a monitoring queue based on a score, and selecting a data strategy that meets the score ranking requirements.

[0159] The three-level cache structure includes a high-speed cache layer, a local persistent cache layer, and a remote storage layer. The high-speed cache layer is deployed in the local high-speed memory of the vehicle or terminal device and is used to store recently frequently used certificates and their status information. The local persistent cache layer is located in the persistent storage space on the device side and is used to store all commonly used certificate data of users in the region. The remote storage layer relies on network communication to connect to the certificate status service or CA server to obtain the latest certificate status information.

[0160] When both the high-speed cache layer and the local persistent cache layer fail to load, the remote storage layer requests data from the backend through a secure channel.

[0161] Certificate lookups follow a search order from the cache layer to the local persistent cache layer and then to the remote storage layer. When updating certificates, the latest data is retrieved from the remote storage layer and persisted to the local persistent cache layer first, and then the cache layer is updated asynchronously in batches.

[0162] In one embodiment, after implementing the three-level cache structure, the processor 502 performs the following steps to effectively manage certificate query and update events: performing a level-one cache hit check on the certificate, processing the monitoring queue based on a score, and selecting a data strategy that meets the score ranking requirements.

[0163] By collecting certificate metrics in real time and calculating risk values, and combining them with dynamic thresholds to determine the status of monitored certificates, an update request is asynchronously initiated when the risk value exceeds the threshold, and further actions are taken based on the backend response.

[0164] In one embodiment, when processor 502 implements the above-described three-level cache structure, and performs the following steps to effectively manage certificate query and update events by performing a level-one cache hit check on the certificate, processing the monitoring queue based on a score, and selecting a data strategy that meets the score ranking requirements:

[0165] The system checks for cache hits in the cache layer. If a cache miss occurs, it further checks the local persistent cache layer and the remote storage layer, updating the access count and timestamp as needed. If a cache hit occurs, it updates the access counter and records the current timestamp and certificate expiration date. Certificate information is added to a monitoring queue. The system periodically checks whether the data in the monitoring queue meets specific trigger conditions. When the data meets these conditions, it calculates the score for each certificate using a preset algorithm and builds a priority queue. The system evaluates the certificate rankings, and certificates that meet the ranking requirements are either actively written back to the local persistent cache layer or passively evicted from the cache layer to optimize system performance.

[0166] In one embodiment, when the processor 502 implements the steps of collecting certificate indicators in real time and calculating risk values, combining dynamic thresholds to determine the status of monitored certificates, and asynchronously initiating an update request when the risk value exceeds the threshold, and further operating steps based on the backend response, the processor 502 specifically implements the following steps:

[0167] Collect relevant certificate metrics, including validity period, usage frequency, and access patterns, to obtain data. Based on the collected data, assess the risk of each certificate and calculate a specific risk value. Automatically adjust and determine a threshold based on the current network load to obtain a dynamic threshold. Compare the risk value of each certificate with the dynamic threshold to identify high-risk certificates. Mark the high-risk certificates as high-risk and establish a priority queue based on risk value and other factors to determine the update order. For certificates requiring updates, initiate update requests asynchronously. Check the backend's response status to the update request to confirm successful updates. Upon successful update, write the latest certificate information to the local persistent cache layer's persistent cache and prioritize loading it into the high-speed cache layer's memory cache.

[0168] It should be understood that in the embodiments of this application, the processor 502 may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0169] It will be understood by those skilled in the art that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program includes program instructions and can be stored in a storage medium, which is a computer-readable storage medium. The program instructions are executed by at least one processor in the computer system to implement the process steps of the embodiments of the above methods.

[0170] Therefore, the present invention also provides a storage medium. This storage medium can be a computer-readable storage medium. The storage medium stores a computer program, wherein when executed by a processor, the computer program causes the processor to perform the following steps:

[0171] Certificate information is stored using a three-level cache structure. Based on this three-level cache structure, certificate query and update events are effectively managed by performing a cache hit check on one level of the certificate, processing a monitoring queue based on a score, and selecting a data strategy that meets the score ranking requirements.

[0172] The three-level cache structure includes a high-speed cache layer, a local persistent cache layer, and a remote storage layer. The high-speed cache layer is deployed in the local high-speed memory of the vehicle or terminal device and is used to store recently frequently used certificates and their status information. The local persistent cache layer is located in the persistent storage space on the device side and is used to store all commonly used certificate data of users in the region. The remote storage layer relies on network communication to connect to the certificate status service or CA server to obtain the latest certificate status information.

[0173] When both the high-speed cache layer and the local persistent cache layer fail to load, the remote storage layer requests data from the backend through a secure channel.

[0174] Certificate lookups follow a search order from the cache layer to the local persistent cache layer and then to the remote storage layer. When updating certificates, the latest data is retrieved from the remote storage layer and persisted to the local persistent cache layer first, and then the cache layer is updated asynchronously in batches.

[0175] In one embodiment, after the processor executes the computer program to implement the steps of effectively managing certificate query and update events based on the three-level cache structure, including checking the certificate for a cache hit in one level, processing the monitoring queue based on a score, and selecting a data strategy that meets the score ranking requirements, the processor further implements the following steps:

[0176] By collecting certificate metrics in real time and calculating risk values, and combining them with dynamic thresholds to determine the status of monitored certificates, an update request is asynchronously initiated when the risk value exceeds the threshold, and further actions are taken based on the backend response.

[0177] In one embodiment, when the processor executes the computer program to implement the steps of effectively managing certificate query and update events based on the three-level cache structure, including checking the certificate for a cache hit in one level, processing the monitoring queue based on a score, and selecting a data strategy that meets the score ranking requirements, the processor specifically implements the following steps:

[0178] The system checks for cache hits in the cache layer. If a cache miss occurs, it further checks the local persistent cache layer and the remote storage layer, updating the access count and timestamp as needed. If a cache hit occurs, it updates the access counter and records the current timestamp and certificate expiration date. Certificate information is added to a monitoring queue. The system periodically checks whether the data in the monitoring queue meets specific trigger conditions. When the data meets these conditions, it calculates the score for each certificate using a preset algorithm and builds a priority queue. The system evaluates the certificate rankings, and certificates that meet the ranking requirements are either actively written back to the local persistent cache layer or passively evicted from the cache layer to optimize system performance.

[0179] In one embodiment, when the processor executes the computer program to implement the steps of collecting certificate indicators in real time and calculating risk values, determining the status of monitored certificates in combination with dynamic thresholds, and asynchronously initiating an update request when the risk value exceeds the threshold, and further operating steps based on the backend response, the specific implementation is as follows:

[0180] Collect relevant certificate metrics, including validity period, usage frequency, and access patterns, to obtain data. Based on the collected data, assess the risk of each certificate and calculate a specific risk value. Automatically adjust and determine a threshold based on the current network load to obtain a dynamic threshold. Compare the risk value of each certificate with the dynamic threshold to identify high-risk certificates. Mark the high-risk certificates as high-risk and establish a priority queue based on risk value and other factors to determine the update order. For certificates requiring updates, initiate update requests asynchronously. Check the backend's response status to the update request to confirm successful updates. Upon successful update, write the latest certificate information to the local persistent cache layer's persistent cache and prioritize loading it into the high-speed cache layer's memory cache.

[0181] The storage medium can be any computer-readable storage medium capable of storing program code, such as a USB flash drive, portable hard drive, read-only memory (ROM), magnetic disk, or optical disk.

[0182] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0183] In the embodiments provided by this invention, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For example, the division of each unit is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0184] The steps in the method of this invention can be adjusted, merged, or reduced in order according to actual needs. The units in the system of this invention can be merged, divided, or reduced according to actual needs. Furthermore, the functional units in the various embodiments of this invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0185] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a terminal, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention.

[0186] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A certificate management method for high-speed mobile scenarios based on a three-level cache, characterized in that, include: Certificate information is stored using a three-level cache structure; Based on the aforementioned three-level caching structure, certificate query and update events are effectively managed by performing a first-level cache hit check on the certificate, processing the monitoring queue based on a score, and selecting a data strategy that meets the score ranking requirements.

2. The high-speed mobile scenario certificate management method based on three-level caching according to claim 1, characterized in that, Based on the aforementioned three-level caching structure, after effectively managing certificate query and update events by performing a first-level cache hit check on the certificate, processing the monitoring queue based on a score, and selecting a data strategy that meets the score ranking requirements, the system further includes: By collecting certificate metrics in real time and calculating risk values, and combining them with dynamic thresholds to determine the status of monitored certificates, an update request is asynchronously initiated when the risk value exceeds the threshold, and further actions are taken based on the backend response.

3. The high-speed mobile scenario certificate management method based on three-level caching according to claim 2, characterized in that, The three-level cache structure includes a high-speed cache layer, a local persistent cache layer, and a remote storage layer. The high-speed cache layer is deployed in the local high-speed memory of the vehicle or terminal device and is used to store recently frequently used certificates and their status information. The local persistent cache layer is located in the persistent storage space on the device side and is used to store the commonly used certificate data of all users in the region. The remote storage layer relies on network communication to connect to the certificate status service or CA server to obtain the latest certificate status information.

4. The high-speed mobile scenario certificate management method based on three-level caching according to claim 3, characterized in that, When both the high-speed cache layer and the local persistent cache layer fail to load, the remote storage layer requests data from the backend through a secure channel.

5. The high-speed mobile scenario certificate management method based on a three-level cache according to claim 4, characterized in that, Certificate lookups follow a search order from the cache layer to the local persistent cache layer and then to the remote storage layer. When updating certificates, the latest data is retrieved from the remote storage layer and persisted to the local persistent cache layer first, and then the cache layer is updated asynchronously in batches.

6. The high-speed mobile scenario certificate management method based on three-level caching according to claim 5, characterized in that, Based on the aforementioned three-level caching structure, effective management of certificate query and update events is achieved through methods including: performing a first-level cache hit check on the certificate, processing a score-based monitoring queue, and selecting a data strategy based on score ranking requirements. Check if the cache layer cache is hit; If the cache layer misses, further check the local persistent cache layer and the remote storage layer, and update the access count and timestamp as appropriate; If the cache layer hits, update the access counter and record the current timestamp and certificate validity period; Add certificate information to the monitoring queue; Regularly check whether the data in the monitoring queue meets specific trigger conditions; When the data meets specific triggering conditions, the score of each certificate is calculated according to a preset algorithm, and a priority queue is constructed; The system evaluates the scores and rankings of certificates. Certificates that meet the ranking requirements are either actively written back to the local persistent cache layer or passively removed from the cache layer to optimize system performance.

7. The high-speed mobile scenario certificate management method based on three-level caching according to claim 5, characterized in that, The process involves real-time collection of certificate metrics and calculation of risk values, combined with dynamic thresholds to determine the status of monitored certificates, and asynchronously initiating an update request when the risk value exceeds the threshold. Further operations are then performed based on the backend response, including: Collect relevant metrics for certificates, including validity period, usage frequency, and access patterns, to obtain the collected data; Based on the collected data, the risk of each certificate is assessed, and a specific risk value is calculated; Based on the current network load, an automatic adjustment and determination of a threshold is made to obtain a dynamic threshold; The risk value of each certificate is compared with a dynamic threshold to identify high-risk certificates. The high-risk certificates are marked as high-risk, and a priority queue is established based on the risk value and other factors to determine the update order; For certificates that need to be updated, an update request is initiated asynchronously to perform the update. Check the backend's response status to the update request to confirm whether the update was successful; Upon successful update, the latest certificate information is written to the local persistent cache layer and then loaded into the high-speed cache layer memory cache.

8. A high-speed mobile scenario certificate management system based on a three-level cache, characterized in that, include: Storage unit, used to store certificate information based on a three-level cache structure; The query unit is used to effectively manage certificate query and update events based on the three-level cache structure by performing a cache hit check on the certificate at one level, processing the monitoring queue based on the score, and selecting a data strategy that meets the score ranking requirements.

9. A computer device, characterized in that, The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium stores a computer program that, when executed by a processor, implements the method as described in any one of claims 1 to 7.

Images