Digital certificate acquisition method and device, electronic equipment and readable storage medium

Abstract

The invention provides a digital certificate acquisition method and device, electronic equipment and a readable storage medium, and the method comprises the steps: monitoring a network communication behavior of a target process, and obtaining network connection information established by the target process; wherein the network connection information comprises network tetrad information; when it is detected that the target process executes the data reading operation, protocol analysis is performed on the network data flow in the receiving buffer area, and a server certificate is extracted based on a protocol format corresponding to the target secure transmission protocol; if the protocol analysis is not successfully completed, directly obtaining the analyzed server certificate from the memory; and reporting the server certificate and the network tetrad information to a certificate monitoring platform. According to the invention, completely unknown server certificates in an enterprise can be monitored, and the problems of abnormal service interruption and the like caused by expiration of the server certificates are fundamentally avoided.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically, to a digital certificate acquisition method, apparatus, electronic device, and readable storage medium. Background Technology

[0002] With the continuous development of network communication technology, TLS (Transport Layer Security) plays a crucial role in ensuring data transmission security. TLS server certificates are key digital certificates used to verify the identity of the server in TLS communication, and their effective management and monitoring are of great significance for ensuring communication security and business continuity.

[0003] However, the industry still faces several pressing issues in the management and monitoring of TLS server certificates. On one hand, some enterprises establish unified certificate management platforms to issue and record certificates used by servers. This centralized management approach has significant drawbacks in practice. If a server certificate is privately issued in the background, it will not be included in the unified management platform's tracking scope. This leads to risks such as certificate expiration and business interruption. On the other hand, besides the aforementioned method of actively recording certificate information, another method involves periodically scanning files or specified paths on the server to obtain certificates and reporting the certificate information to the management platform for tracking and management. This method relies on the user's comprehensive knowledge of certificate information, and periodic scanning wastes server resources. Furthermore, for completely unknown server certificates, even periodic scanning makes it difficult to obtain relevant information.

[0004] Therefore, how to effectively monitor server certificates whose system content is completely unknown, and avoid business interruptions caused by expired server certificates, is a technical problem that needs to be solved. Summary of the Invention

[0005] In view of this, the purpose of the present invention is to provide a digital certificate acquisition method, device, electronic device and readable storage medium, which can monitor server certificates that are completely unknown within an enterprise, fill the gap in the field of passive certificate monitoring, and solve problems such as abnormal business interruption caused by expired server certificates.

[0006] To achieve the above objectives, the technical solutions adopted in the embodiments of the present invention are as follows: In a first aspect, the present invention provides a method for obtaining a digital certificate, the method comprising: monitoring the network communication behavior of a target process and obtaining network connection information established by the target process; wherein the network connection information includes network quadruple information; when the target process is detected to be performing a data reading operation, performing protocol parsing on the network data stream in the receiving buffer and extracting the server certificate based on the protocol format corresponding to the target secure transmission protocol; if the protocol parsing fails, directly obtaining the parsed server certificate from memory; and reporting the server certificate and the network quadruple information to a certificate monitoring platform.

[0007] Secondly, the present invention provides a digital certificate acquisition device, comprising: a monitoring module, configured to monitor the network communication behavior of a target process and acquire network connection information established by the target process; wherein the network connection information includes network quadruple information; an acquisition module, configured to, when the target process is detected to perform a data reading operation, perform protocol parsing on the network data stream in the receiving buffer and extract the server certificate based on the protocol format corresponding to the target secure transmission protocol; the acquisition module is further configured to, if protocol parsing fails, directly acquire the parsed server certificate from memory; and a reporting module, configured to report the server certificate and the network quadruple information to a certificate monitoring platform.

[0008] Thirdly, the present invention provides an electronic device including a processor and a memory, wherein the memory stores machine-executable instructions that can be executed by the processor, and the processor can execute the machine-executable instructions to implement the digital certificate acquisition method described in any of the foregoing embodiments.

[0009] Fourthly, the present invention provides a readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the digital certificate acquisition method as described in any of the foregoing embodiments.

[0010] The digital certificate acquisition method, apparatus, electronic device, and readable storage medium provided by this invention first acquire the network connection information (including network quadruple information) established by the target process by monitoring its network communication behavior, providing a location basis for subsequent certificate extraction. Based on this, when the target process is detected performing a data reading operation, the network data stream in the receiving buffer is parsed according to the protocol format corresponding to the target secure transmission protocol, and the server certificate is extracted. This achieves passive monitoring and certificate extraction of encrypted handshake messages without intrusion. If protocol parsing fails, the parsed server certificate is directly retrieved from memory, ensuring a high success rate for certificate capture. Finally, the obtained server certificate, along with the corresponding network quadruple information, is reported to the certificate monitoring platform, enabling the platform to achieve centralized tracking and management of the certificate lifecycle. This effectively fills the blind spots of traditional passive monitoring methods on hidden or unknown service nodes within enterprises, fundamentally avoiding problems such as abnormal business interruptions caused by expired server certificates.

[0011] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0012] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 A schematic flowchart of a digital certificate acquisition method provided in an embodiment of the present invention is shown; Figure 2 A schematic diagram of the architecture of the eBPF kernel-mode program provided in an embodiment of the present invention is shown. Figure 3 This diagram illustrates the architecture of a user-state agent provided in an embodiment of the present invention. Figure 4 This diagram illustrates the process by which a user-space agent and an eBPF kernel-space program collaboratively obtain a digital certificate. Figure 5 This diagram illustrates the functional block diagram of the digital certificate acquisition device provided in an embodiment of the present invention. Figure 6 A structural block diagram of an electronic device provided in an embodiment of the present invention is shown. Detailed Implementation

[0014] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0015] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0016] It should be noted that relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0017] Given that existing technologies cannot obtain completely unknown server certificates, problems such as business interruptions due to expired server certificates can easily occur. Therefore, this invention provides a digital certificate acquisition method to solve this technical problem.

[0018] Please see Figure 1 , Figure 1 A schematic flowchart of a digital certificate acquisition method provided by an embodiment of the present invention is shown. The method includes steps S101 to S104, as described below: S101: Monitor the network communication behavior of the target process and obtain the network connection information established by the target process; the network connection information includes network quadruple information; S102: When the target process is detected to be performing a data reading operation, the network data stream in the receive buffer is parsed according to the protocol, and the server certificate is extracted based on the protocol format corresponding to the target secure transmission protocol. S103: If protocol parsing fails, the parsed server certificate is retrieved directly from memory; S104: Report the server certificate and network quadruple information to the certificate monitoring platform.

[0019] The difference from existing technologies lies in the following: This invention first acquires the network connection information (including network quadruple information) established by monitoring the network communication behavior of the target process, providing a location basis for subsequent certificate extraction. Based on this, when the target process is detected performing a data reading operation, the network data stream in the receiving buffer is parsed according to the protocol format corresponding to the target secure transmission protocol, and the server certificate is extracted. If the protocol parsing fails, the parsed server certificate is directly retrieved from memory, ensuring a high success rate for certificate capture. Finally, the obtained server certificate, along with the corresponding network quadruple information, is reported to the certificate monitoring platform, enabling the platform to achieve centralized tracking and management of the certificate lifecycle. This effectively fills the blind spots of traditional passive monitoring methods on hidden or unknown service nodes within enterprises, fundamentally avoiding problems such as abnormal business interruptions caused by expired server certificates.

[0020] Next, the embodiments of the present invention will describe in detail the above-described digital certificate acquisition process with reference to the accompanying drawings.

[0021] In step S101, the system first needs to locate the target process to be monitored, and then listen to its network call process, so as to capture complete network connection information during the connection establishment phase. Specifically, this can be done in the following way, as explained below: Step a1: Detect the startup event of the target process and obtain the process identifier; This process involves monitoring the target process in the system. When the target process starts, the system can detect the event and obtain the corresponding process ID (PID). In this way, the system can accurately identify the target process that needs to be monitored for network communication activities.

[0022] Step a2: In response to the target process initiating a network connection operation, record the correspondence between the process identifier and the file descriptor corresponding to this connection; Understandably, when a target process initiates a network connection request, the system captures this operation and records the current process ID and the file descriptor associated with the connection. A file descriptor is an abstract mechanism used by the operating system to identify open files or network connections. By recording the correspondence between process IDs and file descriptors, the system can accurately track and manage the connection in subsequent operations.

[0023] Step a3: Obtain the network quadruple information for this connection upon confirmation that the connection has been established; In this embodiment of the invention, after a network connection is successfully established between the target process and the remote server, the system captures and extracts the network quadruple information of the connection, including the source IP address, source port, destination IP address, and destination port. This information is a key parameter uniquely identifying a network connection and is crucial for subsequent analysis of the server certificate.

[0024] Step a4: Store the network quadruple information and its corresponding relationships in an associated manner.

[0025] Specifically, the system associates the network quadruple information obtained above with the previously recorded correspondence between process identifiers and file descriptors, and stores this association in an appropriate data structure, such as a mapping table called connmap. This associative storage method ensures that each connection can be accurately identified and tracked during network communication, thus providing the necessary basic data support for subsequent data reading operations and certificate data extraction.

[0026] In one embodiment of the present invention, in order to monitor the network communication behavior of the target process and obtain the network connection information established by the target process, some preparatory work can be completed in advance before executing step S101, as shown in steps b1 to b3, as explained below: Step b1: Deploy the programmable observation program corresponding to the target secure transmission protocol; wherein, the programmable observation module runs in the operating system kernel space; In this embodiment of the invention, the target secure transport protocol is not limited to TLS (Transport Layer Security) or SSL (Secure Sockets Layer). It should be understood that TLS is merely a typical application scenario of this invention, and its technical solution can be applied to any security protocol that has a structured handshake process and transmits digital certificates in plaintext during the communication initialization phase. During the process of establishing a secure communication connection between the client and the server, the server typically sends its digital certificate (i.e., the "server certificate") to the client during the handshake phase. This certificate is used for authentication and participates in the key negotiation process.

[0027] For different secure transmission protocols, embodiments of the present invention can predefine corresponding protocol identification rules and data extraction logic according to their protocol characteristics, and write corresponding programmable observation programs (such as kernel-mode programs based on eBPF). These programs can be mounted to key kernel observation points (such as system call entry points, network protocol stack processing paths, or user-mode function entry points) to achieve dynamic monitoring of the communication behavior of the target process.

[0028] Step b2: Attach the programmable observation program to one or more preset kernel event probe points; In this embodiment of the invention, probe points are predefined critical locations in the system kernel. These probe points are triggered when specific types of network events occur. For example, probe points can be set at the entry points of critical operations such as network connection establishment and data reading. By attaching programmable observers to these probe points, the system can automatically call the programmable observers when these critical events occur, thereby achieving real-time monitoring of the network communication behavior of the target process.

[0029] Step b3: When the target process triggers any of the mounted probe points, execute the programmable observation program to monitor the target process's network communication behavior and capture network connection information.

[0030] During the execution of the above steps, when the target process performs a network operation and triggers a programmable observer mounted on a kernel event probe, the programmable observer immediately starts, begins monitoring the target process's network communication behavior, captures network connection requests initiated by the target process, and records relevant network connection information, including but not limited to network quadruple information (source IP address, source port, destination IP address, and destination port). This information is then passed to the user-space application for further processing and analysis.

[0031] Through the above preparations, the system can efficiently monitor the network communication behavior of the target process at the kernel level, providing a solid foundation for subsequent data reading operations and server certificate extraction.

[0032] Corresponding to the programmable observation program in kernel mode, this embodiment of the invention can also simultaneously deploy a user-mode application. The main responsibility of this user-mode application is to perform detailed attribute parsing on the certificate data extracted from kernel mode, thereby obtaining relevant certificate attribute information, including but not limited to key details such as the certificate issuer, validity period, and public key algorithm type. Furthermore, the user-mode application will combine this with network four-tuple information (source IP address, destination IP address, source port number, and destination port number) and report this comprehensive data to the certificate monitoring platform. This design of kernel-mode and user-mode collaborative operation enables the system to more effectively monitor and manage certificates, promptly detect potential security issues, and take corresponding measures.

[0033] Next, to facilitate a clear understanding of the certificate acquisition process provided in the embodiments of the present invention, the following description will use examples of the collaborative working method of user-mode applications and kernel-mode applications. This example approach is intended to provide a clear explanatory framework, but does not constitute a limitation on the embodiments of the present invention.

[0034] In step S102, when the target process is detected to be performing a data reading operation, the network data stream in the receive buffer is parsed according to the protocol, and the server certificate is extracted based on the protocol format corresponding to the target secure transmission protocol.

[0035] Regarding the method of extracting server certificates based on protocol parsing, the embodiments of the present invention provide the following implementation methods for steps c1 to c3, which are explained below: Step c1: When a data packet with protocol characteristics corresponding to the TLS protocol is detected for the first time in the network data stream, it is determined that the current connection has entered the TLS protocol handshake phase; Step c2: When the next data read operation is detected and a data packet with the same preset protocol characteristics is received again, parse out the first message type field inside the data packet; Step c3: If the value of the message type field is equal to the preset type value used to identify the server certificate message in the TLS protocol, then parse the server certificate from the data following the message type field.

[0036] For ease of understanding, taking the TLS protocol as an example, the network data stream in the receive buffer can be processed as follows: First, read the first 5 bytes of the received data and determine its content: If the first byte is 0x16 and the second and third bytes are both 0x03, then it is determined that the data packet belongs to the TLS handshake message and corresponds to TLS 1.2 version (the TLS 1.2 protocol version identifier is 0x0303, but it is recorded after the record layer header; here, we take the common implementation mode as the standard). Therefore, it is determined that a TLS 1.2 handshake process is currently underway, and the event of receiving this TLS handshake message is recorded. Since in the standard TLS 1.2 handshake process, the server certificate message usually appears in the second handshake message returned by the server after the client completes its response, the system continues to monitor the next data reception operation of this connection after the above characteristics are detected for the first time.

[0037] Upon entering the data receive path again, the first 5 bytes of the receive buffer are read once more. If the condition that the first byte is 0x16 and the second and third bytes are 0x03 is still met, then this data is confirmed to be a subsequent TLS record layer message. The first byte of this record layer payload (i.e., the handshake protocol message type field) is then further examined: if this byte is 0x0b, it indicates that the current message is a certificate-type message. At this point, the complete server certificate can be extracted from the subsequent data.

[0038] It should be understood that different client programs may use different programming languages ​​and their corresponding runtime environments. For example, for a client program written in Go, its specific runtime environment is the Go runtime environment, while for a client program written in Java, its specific runtime environment is the Java Virtual Machine (JVM) and its related libraries. In practical scenarios, most types of client programs can perform protocol parsing through programmable observers (such as kernel-mode programs based on eBPF). However, some types of client programs (such as Go clients) cannot correctly parse the handshake protocol through the kernel's eBPF. Therefore, these types of clients cannot directly obtain certificates through protocol parsing and must first retrieve the parsed server certificate from memory.

[0039] Therefore, in step S103, if protocol parsing fails, the parsed server certificate is directly retrieved from memory. To successfully extract the server certificate, this embodiment of the invention can use a probe to retrieve the server certificate from memory.

[0040] For example, taking the TLS protocol as an example, when its network communication and TLS protocol processing are implemented independently in user space by the Go runtime, encrypted handshake data is not transmitted through the standard system call interface, and the parsing process of the TLS handshake message is completely encapsulated within the crypto / tls package. The ebpfuprobehook function symbol of crypto / tls.(*Conn).unmarshalHandshakeMessage in its TLS library can be used directly. Therefore, by setting up the uprobe probe, the raw certificate bytes can be directly obtained from the memory parameters when the unmarshalHandshakeMessage function is executed.

[0041] Furthermore, for Go clients, they can only "attempt to retrieve" the parsed server certificate from memory. This is because this type of client has its symbol table stripped during compilation; without the symbol table, it cannot be retrieved from memory, resulting in the inability to successfully retrieve the certificate from memory. To address this, the embodiments of this invention provide a solution by reporting network four-tuple information to instruct the user to find the server's service based on this information, thereby searching for the certificate it uses.

[0042] In one embodiment of the present invention, for the server certificate obtained through step S102 or S103, a corresponding association relationship is established with the network four-tuple information obtained in step S101. That is, the certificate data is bound to the network four-tuple information of its connection (i.e., source IP address, source port number, destination IP address, and destination port number) to form a "certificate-connection" mapping record, which is stored in a shared data structure between user space and kernel space, such as a certificate mapping table certmap. This helps the user-space agent to read the certificate from certmap and accurately trace and manage the certificate usage. For example, it can identify which specific service instance (uniquely identified by the four-tuple) is using a certain certificate, thereby realizing certificate monitoring, alarm and asset management based on network session granularity.

[0043] In step S104, this embodiment of the invention can further report the associated server certificate and the corresponding network four-tuple information to the certificate monitoring platform. Specifically, in this embodiment, the user-space agent can periodically read certificate records from certmap through polling or event-driven methods, and then perform certificate resolution, validity period checks, domain name matching, and other processes, and report the results to the centralized certificate monitoring platform or security management system to achieve globally visualized certificate lifecycle management. Specifically, step S104 can be implemented as follows, as explained below: Step c1: Periodically read certificate records; where each certificate record includes server certificate data and its associated network quadruple information; Step c2: Parse the read server certificate for format and extract its attributes to generate structured certificate data; the structured certificate data includes the validity period, domain name, and issuing authority; Step c3: Report the certificate structured data and its associated network quadruple information to the monitoring platform.

[0044] Furthermore, in order to release resources in a timely manner, after completing the associated storage of certificate information and network quadruple information, the connmap described above can also be destroyed, that is, the network quadruple information, file descriptor (fd) and process identifier (pid) of this connection can be deleted to release memory resources and prevent the accumulation of dirty data.

[0045] Therefore, the embodiments of the present invention enable the dynamic and transparent collection of server certificates actually used by any target process during communication without prior knowledge of the certificate storage location or configuration information, and realize certificate attribution and location through four-tuple information, providing a complete and accurate data foundation for subsequent certificate validity verification, expiration warning and centralized monitoring.

[0046] To facilitate a comprehensive understanding of the digital certificate acquisition process provided in this embodiment of the invention, we will take the TLS protocol as an example and illustrate the process by deploying a user-space agent and an eBPF kernel-space program on the device where the client program written in Go is located.

[0047] Please see Figure 2 , Figure 2 This diagram illustrates the architecture block diagram of the eBPF kernel-mode program provided in an embodiment of the present invention. Figure 3 An architecture block diagram of the user-state agent provided in an embodiment of the present invention is shown. Figure 4 This diagram illustrates the process by which a user-space agent and an eBPF kernel-space program collaboratively obtain a digital certificate.

[0048] exist Figure 2 In the process, the work done by each hook point is as follows: sched_process_exec: When a process starts, it reports its PID.

[0049] sys_enter_connect: Records the thread identifier (tgid), pid, and associated file descriptor (fd) for this connection.

[0050] inet_sock_set_state: Get the association between the record's tgid, pid and the current connection's file descriptor, and get the four-tuple information of this connection (original destination IP and port number), and store it along with the pid and file descriptor into connmap.

[0051] `trace_enter / exit_read`: Retrieves the PID, file descriptor (fd), and four-tuple information of the record. It then checks the fields in the receive buffer. If it retrieves 5 bytes at a time, and the first byte is 0x16, and the second and third bytes are 0x03, it determines that it is a TLS 1.2 protocol and records that a TLS 1.2 handshake protocol has been received. Since the server certificate is sent during the second message reception of the handshake protocol, it still retrieves 5 bytes upon re-entry, with the first byte being 0x16 and the second and third bytes being 0x03. Upon the next re-entry, it first checks if the first byte is 0x0b. If it is 0x0b, it determines that the subsequent information is certificate information, and thus obtains the certificate information and writes the four-tuple information and the incoming certificate information into the certmap.

[0052] sys_enter_close: Destroys the corresponding connmap data.

[0053] sched_process_exit: The process exits and reports its PID.

[0054] exist Figure 3In the Go client, the kernel EBPF program loading module is responsible for loading kernel-level eBPF kernel-mode programs to perform specific packet processing tasks. The Go client uprobeattach module uses uprobe technology to attach probes to the Go client. Uprobe is a kernel tracing tool that can be triggered at specific function entry and exit points of user-mode programs for monitoring and analyzing program behavior. The Go client uprobedetach module removes previously attached uprobe probes from the Go client, typically when monitoring or analyzing program behavior is no longer needed. The certmap information acquisition module is responsible for acquiring certificate mapping (certmap) information. The certmap information processing module receives the certificate mapping information from the certmap information acquisition module, then parses, verifies, or transforms the certificate information so that other modules or systems can use it. The certmap information reporting module reports the processed certificate mapping information to the monitoring platform for updating system status, triggering security policies, or other management tasks.

[0055] Through the above implementation methods, the embodiments of the present invention can realize a non-intrusive and efficient method for obtaining server certificates, which can monitor server certificates that are completely unknown within an enterprise, fill the gap in the field of passive certificate monitoring, and solve problems such as abnormal business interruption caused by expired server certificates.

[0056] To perform the corresponding steps in the above embodiments and various possible methods, an implementation of the digital certificate acquisition device 50 is given below. Please refer to... Figure 5 , Figure 5 A functional block diagram of a digital certificate acquisition device provided in an embodiment of the present invention is shown. The digital certificate acquisition device 50 includes: a monitoring module 501, an acquisition module 502, and a reporting module 503.

[0057] The monitoring module 501 is used to monitor the network communication behavior of the target process and obtain the network connection information established by the target process; wherein, the network connection information includes network quadruple information; The acquisition module 502 is used to perform protocol parsing on the network data stream in the receiving buffer and extract the server certificate based on the protocol format corresponding to the target secure transmission protocol when the target process is detected to be performing a data reading operation. The acquisition module 502 is also used to directly retrieve the parsed server certificate from memory if the protocol parsing fails. The reporting module 503 is used to report server certificate and network quadruple information to the certificate monitoring platform.

[0058] It is understandable that the monitoring module 501, the acquisition module 502, and the reporting module 503 can execute in a coordinated manner. Figure 1 Each step in the process is used to achieve the corresponding technical effect.

[0059] It should be noted that the digital certificate acquisition device 50 provided in this embodiment of the invention can be specific hardware on the device or software or firmware installed on the device. The implementation principle and technical effects of the device provided in this embodiment of the invention are the same as those in the foregoing method embodiments. For the sake of brevity, any parts not mentioned in the device embodiments can be referred to the corresponding content in the foregoing method embodiments. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can all be referred to the corresponding processes in the above method embodiments, and will not be repeated here.

[0060] Optionally, the above modules can be stored in the form of software or firmware. Figure 6 The memory shown is either stored in or embedded in the operating system (OS) of the electronic device 60, and can be used by... Figure 6 The processor executes the commands. Meanwhile, the data and program code required to execute these modules can be stored in memory.

[0061] Please see Figure 6 , Figure 6 The diagram illustrates the structure of an electronic device according to an embodiment of the present invention, including a memory 601, a processor 602, and a communication interface 603. The memory 601, processor 602, and communication interface 603 are electrically connected to each other directly or indirectly to achieve data transmission or interaction. For example, these components can be electrically connected to each other through one or more communication buses or signal lines.

[0062] Optionally, the bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 6 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0063] In this embodiment of the invention, the processor 602 may be a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in this embodiment of the invention. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in this embodiment of the invention can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor. The software modules may be located in the memory 601, and the processor 602 reads the program instructions from the memory 601 and, in conjunction with its hardware, completes the steps of the aforementioned methods.

[0064] In this embodiment of the invention, the memory 601 can be a non-volatile memory, such as a hard disk drive (HDD) or a solid-state drive (SSD), or it can be volatile memory, such as RAM. The memory can also be any other medium capable of carrying or storing desired executable program code having an instruction or data structure form and accessible by a computer, but is not limited thereto. The memory in this embodiment of the invention can also be a circuit or any other device capable of implementing a storage function for storing instructions and / or data.

[0065] The memory 601 can be used to store software programs and modules, such as the instructions / modules of the digital certificate acquisition device 50 provided in this embodiment of the invention. These can be stored in the memory 601 in the form of software or firmware, or embedded in the operating system (OS) of the electronic device 60. The processor 602 executes various functional applications and data processing by executing the software programs and modules stored in the memory 601. The communication interface 603 can be used to communicate with other node devices for signaling or data.

[0066] Understandable. Figure 6 The structure shown is for illustrative purposes only; the electronic device 60 may also include components that are more advanced than those shown. Figure 6 The more or fewer components shown, or having the same Figure 6 The different configurations shown. Figure 6 The components shown can be implemented using hardware, software, or a combination thereof.

[0067] Based on the above embodiments, the present invention also provides a readable storage medium storing a computer program. When the computer program is executed by a computer, it causes the computer to execute the digital certificate acquisition method provided in the above embodiments. For specific implementation details, please refer to the method embodiments, which will not be repeated here.

[0068] Based on the above embodiments, the present invention also provides a program product, which includes a computer program. The processor can execute the computer program to implement the digital certificate acquisition method provided in the embodiments of the present invention. For specific implementation, please refer to the method embodiments, which will not be repeated here.

[0069] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and there may be other division methods in actual implementation. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the coupling or direct coupling or communication connection shown or discussed may be through some communication interface; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0070] Furthermore, the units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the objectives of the embodiments of the present invention, depending on actual needs.

[0071] Furthermore, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0072] It should be noted that if the function is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes: USB flash drive, mobile hard drive, read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk, and other media capable of storing program code.

[0073] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for obtaining a digital certificate, characterized in that, The method includes: Monitor the network communication behavior of the target process and obtain the network connection information established by the target process; wherein, the network connection information includes network quadruple information; When the target process is detected to be performing a data reading operation, the network data stream in the receive buffer is parsed according to the protocol, and the server certificate is extracted based on the protocol format corresponding to the target secure transmission protocol. If protocol parsing fails, the parsed server certificate is retrieved directly from memory. The server certificate and the network quadruple information are reported to the certificate monitoring platform.

2. The digital certificate acquisition method according to claim 1, characterized in that, When the target process is detected to be performing a data read operation, the network data stream in the receive buffer is parsed according to the protocol, and the server certificate is extracted based on the protocol format corresponding to the target secure transmission protocol, including: When a data packet with protocol characteristics corresponding to the target secure transmission protocol is detected for the first time in the network data stream, it is determined that the current connection has entered the handshake phase of the target secure transmission protocol. When the next data read operation is detected and a data packet with the same preset protocol characteristics is received again, the first message type field inside the data packet is parsed out; If the value of the message type field is equal to the preset type value used to identify the server certificate message in the target secure transmission protocol, then the server certificate is parsed from the data following the message type field.

3. The digital certificate acquisition method according to claim 1, characterized in that, The method further includes: For clients written in a preset programming language, the server certificate is retrieved from memory by setting a probe; If the server certificate cannot be obtained successfully, the network quadruple information is reported to instruct the user to search for the server certificate based on the network quadruple information.

4. The digital certificate acquisition method according to claim 1, characterized in that, Monitor the network communication behavior of the target process and obtain the network connection information established by the target process, including: Detect the startup event of the target process and obtain the process identifier; In response to the target process initiating a network connection operation, the correspondence between the process identifier and the file descriptor corresponding to this connection is recorded; Obtain the network quadruple information for this connection upon confirmation that the connection has been established; The network quadruple information and the corresponding relationship are associated and stored.

5. The digital certificate acquisition method according to claim 1, characterized in that, The method further includes: The server certificate is associated with the network quadtuple information and then written into the shared data structure. Delete the network connection information and exit the target process.

6. The digital certificate acquisition method according to claim 1, characterized in that, Reporting the server certificate and the network four-tuple information to the certificate monitoring platform includes: Periodically read certificate records; each certificate record includes server certificate data and its associated network four-tuple information; The read server certificate is parsed and its attributes are extracted to generate structured certificate data; wherein, the structured certificate data includes the validity period, domain name, and issuing authority; The structured certificate data and its associated network quadruple information are reported to the monitoring platform.

7. The digital certificate acquisition method according to any one of claims 1-6, characterized in that, Before monitoring the network communication behavior of the target process and obtaining the network connection information established by the target process, the method further includes: Deploy the programmable observation program corresponding to the target secure transmission protocol; wherein, the programmable observation module runs in the operating system kernel space; The programmable observation program is attached to one or more preset kernel event probe points; When the target process triggers any of the attached probe points, the programmable observation program is executed to monitor the network communication behavior of the target process and capture the network connection information.

8. A digital certificate acquisition device, characterized in that, include: The monitoring module is used to listen to the network communication behavior of the target process and obtain the network connection information established by the target process; wherein, the network connection information includes network quadruple information; The acquisition module is used to perform protocol parsing on the network data stream in the receiving buffer and extract the server certificate based on the protocol format corresponding to the target secure transmission protocol when the target process is detected to be performing a data reading operation. The acquisition module is also used to directly retrieve the parsed server certificate from memory if the protocol parsing fails. The reporting module is used to report the server certificate and the network quadruple information to the certificate monitoring platform.

9. An electronic device, characterized in that, It includes a processor and a memory, the memory storing machine-executable instructions that can be executed by the processor, the processor executing the machine-executable instructions to implement the digital certificate acquisition method according to any one of claims 1-7.

10. A readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the digital certificate acquisition method as described in any one of claims 1-7.

Images