Certificate chain monitoring method and device, electronic equipment and storage medium

Abstract

The invention provides a certificate chain monitoring method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining a to-be-monitored first certificate chain, and carrying out the analysis of each first certificate in the first certificate chain, and obtaining a first certificate field; determining a target red-black tree structure corresponding to the first certificate chain; wherein the target red-black tree structure is constructed by taking second certificates in a second certificate chain as nodes, and second certificate fields of the second certificates are stored in the target red-black tree structure; and performing multi-dimensional monitoring on the first certificate chain based on the target red-black tree structure and the first certificate field. According to the invention, the complete structure of each certificate chain, especially the information state of the intermediate certificate, can be verified through the red-black tree structure, the monitoring index of each link of the certificate chain is comprehensively quantified, and the multi-dimensional real-time and accurate monitoring of the certificate chain is realized.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a certificate chain monitoring method, apparatus, electronic device, and storage medium. Background Technology

[0002] With the rapid development of the digital economy, electronic certificates have been widely used in financial transactions, e-government, e-commerce, and bidding. They rely on a CA (Certificate Authority) certificate chain to achieve identity authentication and data encryption, ensuring the security and trustworthiness of network communications. The CA certificate chain consists of a root certificate, intermediate certificates, and terminal certificates, forming a trust transmission path through a hierarchical signature mechanism. However, the current industry's monitoring level of website interface certificates is still in its initial stage. Traditional CA systems rely on static certificate chain verification and cannot monitor the revocation of intermediate certificates or changes in the trust policy of root certificates in real time, leading to the risk of identity authentication failure. Therefore, accurate monitoring of the certificate chain is not possible. Summary of the Invention

[0003] This invention provides a certificate chain monitoring method, device, electronic device, and storage medium to address the deficiencies in the prior art.

[0004] This invention provides a certificate chain monitoring method, comprising: Obtain the first certificate chain to be monitored, and parse each first certificate in the first certificate chain to obtain the first certificate field; Determine the target red-black tree structure corresponding to the first certificate chain; wherein the target red-black tree structure is constructed with the second certificate in the second certificate chain as nodes, and stores the second certificate field of each second certificate; Based on the target red-black tree structure and the first certificate field, the first certificate chain is monitored in multiple dimensions.

[0005] According to a certificate chain monitoring method provided by the present invention, before determining the target red-black tree structure corresponding to the first certificate chain, the method further includes: The second certificate chain is obtained from various network service interfaces through the deployed certificate chain acquisition module; Parse the second certificate in each of the second certificate chains to obtain the second certificate fields; In the second certificate chain with the same root certificate, a red-black tree structure is constructed with each second certificate as a node. The second certificate fields are stored in the red-black tree structure, and a status flag bit is added to each second certificate. In the red-black tree structure, a corresponding time-to-live (TTL) is set for the second certificate at different levels.

[0006] According to a certificate chain monitoring method provided by the present invention, the step of performing multi-dimensional monitoring of the first certificate chain based on the target red-black tree structure and the first certificate field includes: Based on the target red-black tree structure and the first certificate field, the integrity, compliance, and validity of the first certificate chain are monitored.

[0007] According to a certificate chain monitoring method provided by the present invention, the first certificate field includes a certificate serial number, certificate validity period, website name, common name, alternative subject name, and certificate algorithm; the step of monitoring the integrity, compliance, and validity of the first certificate chain based on the target red-black tree structure and the first certificate field includes: Detect whether the certificate serial number exists in the target red-black tree structure; If present, the integrity, compliance, and validity of the first certificate chain are monitored based on the certificate validity period, website name, common name, alternative subject name, and certificate algorithm.

[0008] According to a certificate chain monitoring method provided by the present invention, the method monitors the integrity, compliance, and validity of the first certificate chain based on the certificate validity period, website name, common name, alternative subject name, and certificate algorithm, including: Based on the target red-black tree structure, verify whether the validity period of each of the first certificates is normal; If normal, verify whether the common name, the alternative theme name, the website name, and the corresponding second certificate field in the target red-black tree structure are consistent; If they match, determine whether the status flag bit of the first certificate chain is valid; If valid, verify whether the certificate algorithm is risky; If there is no risk, the first certificate chain is confirmed to be normal.

[0009] According to a certificate chain monitoring method provided by the present invention, after detecting whether the certificate serial number exists in the target red-black tree structure, the method further includes: If it does not exist, update the target red-black tree structure based on the first certificate chain, store the first certificate field in the target red-black tree structure, and add a status flag bit to each first certificate; Verify whether the certificate algorithm has any risks; If there is no risk, the first certificate chain is confirmed to be normal.

[0010] According to a certificate chain monitoring method provided by the present invention, after performing multi-dimensional monitoring of the first certificate chain based on the target red-black tree structure and the first certificate field, the method further includes: If the results of multi-dimensional monitoring indicate that the first certificate chain is abnormal, the abnormal information in the first certificate chain is determined. Based on the abnormal information, a warning message is determined, and the warning message is fed back to the network service interface corresponding to the first certificate chain.

[0011] The present invention also provides a certificate chain monitoring device, comprising: The first parsing module is configured to obtain the first certificate chain to be monitored, and parse each first certificate in the first certificate chain to obtain the first certificate field; The first determining module is configured to determine the target red-black tree structure corresponding to the first certificate chain; wherein the target red-black tree structure is constructed with the second certificate in the second certificate chain as nodes, and stores the second certificate field of each second certificate; The multi-dimensional monitoring module is configured to perform multi-dimensional monitoring of the first certificate chain based on the target red-black tree structure and the first certificate field.

[0012] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the certificate chain monitoring method as described above.

[0013] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the certificate chain monitoring method as described above.

[0014] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the certificate chain monitoring method as described above.

[0015] The certificate chain monitoring method, apparatus, electronic device, and storage medium provided by this invention parse each first certificate in the acquired first certificate chain to be monitored, obtaining the first certificate fields corresponding to each first certificate. A red-black tree structure is pre-constructed using the second certificates in the second certificate chain as nodes, storing the second certificate fields of each second certificate, thus determining the target red-black tree structure corresponding to the first certificate chain. Based on the target red-black tree structure and the first certificate fields, the first certificate chain is monitored in multiple dimensions. This invention improves the monitoring efficiency of certificate chains by constructing a red-black tree structure covering multiple types of information in the second certificate chain. The red-black tree structure can verify the complete structure of each certificate chain, especially the information status of intermediate certificates, comprehensively quantifying the monitoring indicators of each link in the certificate chain, and achieving multi-dimensional, real-time, and accurate monitoring of the certificate chain. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0017] Figure 1 This is one of the flowcharts of the certificate chain monitoring method provided by the present invention.

[0018] Figure 2 This is a schematic diagram of the red-black tree structure provided by the present invention.

[0019] Figure 3 This is the second flowchart of the certificate chain monitoring method provided by the present invention.

[0020] Figure 4 This is a schematic diagram of the certificate chain monitoring device provided by the present invention.

[0021] Figure 5 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0023] Figure 1 This is a flowchart illustrating a certificate chain monitoring method according to an exemplary embodiment. Figure 1 As shown in an exemplary embodiment, the certificate chain monitoring method includes steps 110 to 130, which are described in detail below.

[0024] Step 110: Obtain the first certificate chain to be monitored, and parse each first certificate in the first certificate chain to obtain the first certificate field.

[0025] In this embodiment of the invention, the system comprises multiple distributed collection nodes, each deploying a certificate chain collection module for a website service interface. The certificate chain collection module obtains complete data of the first certificate chain to be monitored via HTTPS and LDAP protocols. The collected data includes all certificate information in the first certificate chain. The certificate chain consists of a root certificate, intermediate certificates, and terminal certificates. Each first certificate in the first certificate chain is parsed to obtain the corresponding first certificate fields.

[0026] Step 120: Determine the target red-black tree structure corresponding to the first certificate chain; wherein the target red-black tree structure is constructed with the second certificate in the second certificate chain as nodes, and stores the second certificate field of each second certificate.

[0027] In this embodiment of the invention, a red-black tree structure is pre-constructed using the second certificates in the second certificate chain as nodes. The red-black tree structure stores the second certificate fields of each second certificate, including certificate serial number, common name, alternative subject name, certificate validity period, certificate algorithm, and certificate status. The target red-black tree structure corresponding to the first certificate chain is determined based on the root certificate in the first certificate chain.

[0028] Step 130: Based on the target red-black tree structure and the first certificate field, perform multi-dimensional monitoring of the first certificate chain.

[0029] In this embodiment of the invention, the first certificate chain is monitored in multiple dimensions based on the target red-black tree structure and the first certificate field, including monitoring of certificate status validity, certificate chain integrity, time validity, name consistency, algorithm security, and other dimensions.

[0030] In this embodiment of the invention, a red-black tree structure is constructed, encompassing multiple types of information in the second certificate chain and starting with the root certificate. This improves the efficiency of certificate chain monitoring. The red-black tree structure allows verification of the complete structure of each certificate chain, especially the information status of intermediate certificates. It enables precise analysis of the expiration time of each certificate, the security of encryption / decryption algorithms, and the strength of key security, comprehensively quantifying the monitoring indicators of each link in the certificate chain. This achieves multi-dimensional real-time monitoring of the integrity, compliance, and validity of the certificate chain, accurately identifying risks such as broken certificate chains, insecure algorithms, and abnormal certificate revocation status. The technical solution provided by this embodiment of the invention is applicable to the full-link security monitoring and risk warning of certificate server websites or interfaces in key industries such as finance and e-commerce, further enhancing the monitoring capabilities for internet communication security and effectively supporting the safe and stable development of the digital economy.

[0031] In an exemplary embodiment of the present invention, before determining the target red-black tree structure corresponding to the first certificate chain, the method further includes: The second certificate chain is obtained from various network service interfaces through the deployed certificate chain acquisition module; Parse the second certificate in each of the second certificate chains to obtain the second certificate fields; In the second certificate chain with the same root certificate, a red-black tree structure is constructed with each second certificate as a node. The second certificate fields are stored in the red-black tree structure, and a status flag bit is added to each second certificate. In the red-black tree structure, a corresponding time-to-live (TTL) is set for the second certificate at different levels.

[0032] In this embodiment of the invention, a multi-node detection cluster targeting website service interfaces is deployed. Each node deploys a certificate chain detection module, and the list of industry websites is distributed across its respective servers according to the number of nodes. The certificate chain collection module obtains complete data of the second certificate chain from the certificate server via HTTPS and LDAP protocols. The collected data includes all certificate information in the complete certificate chain of each website service interface.

[0033] The second certificate in the second certificate chain of each website service interface is parsed one by one, from the root certificate to the intermediate certificate and then to the terminal certificate. The second certificate fields of each second certificate are extracted, including at least several key information such as certificate serial number certSerial, certificate expiration date expireDate, website name webUrlName, common name, subject alternative name subAltName, and certificate algorithm. This information is then structured into certStructure, as shown in List 1 below. At the same time, a certificate caching service is deployed to store the field information of certificates at all levels in a structured manner.

[0034] Table 1

[0035] In the second certificate chain with the same root certificate, a tree-structured cache of bufCertInfo is constructed, using each second certificate as a node. Figure 2 The diagram shows a red-black tree structure, with a status flag (flagCredible) added to each secondary certificate. The default value is 1, where 1 indicates normal (valid) and 0 indicates abnormal (invalid). This flag will be periodically synchronized with the OCSP server, and its value will be reassigned to flagCredible based on status such as revocation. The extracted secondary certificate fields are stored using the certificate serial number as the primary key in a red-black tree structure.

[0036] In the red-black tree structure, different Time To Live (TTL) values ​​are set for second certificates at different levels. The root certificate has the longest TTL, which decreases sequentially for intermediate certificates, with the terminal certificate having the shortest TTL. When the TTL expires, the certificate is automatically synchronized with the OCSP server. After the red-black tree structure is built, the certificate chain information of each website service interface is monitored concurrently. This embodiment of the invention reduces the number of frequent interactions with the OCSP service and improves verification efficiency by caching the certificate chain tree structure with status flags.

[0037] In this embodiment of the invention, the status flag bit flagCredible will periodically interact with the OCSP service and update the status value according to the TTL value interval.

[0038] In this embodiment of the invention, a distributed multi-node terminal acquisition method is used to detect the certificate server, and edge computing is used for concurrent information processing to realize a distributed acquisition and terminal computing architecture. Combined with background certificate information caching technology, a single node can support thousands of certificate chain verifications and interface data processing per second, with a monitoring latency of ≤100ms, which meets the real-time monitoring needs of large-scale certificate servers.

[0039] In an exemplary embodiment of the present invention, the step of performing multi-dimensional monitoring of the first certificate chain based on the target red-black tree structure and the first certificate field includes: Based on the target red-black tree structure and the first certificate field, the integrity, compliance, and validity of the first certificate chain are monitored.

[0040] In this embodiment of the invention, based on the target red-black tree structure and the extracted first certificate field, a three-in-one monitoring of certificate chain integrity, compliance and validity is achieved, covering the entire process and all field information of the certificate chain, thus solving the problem of blind spots in traditional technology monitoring.

[0041] In an exemplary embodiment of the present invention, the first certificate field includes a certificate serial number, certificate validity period, website name, generic name, alternative subject name, and certificate algorithm; the step of monitoring the integrity, compliance, and validity of the first certificate chain based on the target red-black tree structure and the first certificate field includes: Detect whether the certificate serial number exists in the target red-black tree structure; If present, the integrity, compliance, and validity of the first certificate chain are monitored based on the certificate validity period, website name, common name, alternative subject name, and certificate algorithm.

[0042] In this embodiment of the invention, based on the certificate serial number of each first certificate extracted from the first certificate chain, it is detected whether each first certificate exists in the target red-black tree structure. If it exists, the integrity, compliance and validity of the first certificate chain are monitored based on the extracted certificate validity period, website name, common name, alternative subject name and certificate algorithm.

[0043] In an exemplary embodiment of the present invention, the step of monitoring the integrity, compliance, and validity of the first certificate chain based on the certificate validity period, website name, generic name, alternative subject name, and certificate algorithm includes: Based on the target red-black tree structure, verify whether the validity period of each of the first certificates is normal; If normal, verify whether the common name, the alternative theme name, the website name, and the corresponding second certificate field in the target red-black tree structure are consistent; If they match, determine whether the status flag bit of the first certificate chain is valid; If valid, verify whether the certificate algorithm is risky; If there is no risk, the first certificate chain is confirmed to be normal.

[0044] In embodiments of the present invention, such as Figure 3 As shown, the certificate validity period expireDate is checked to see if it is within the normal validity period. If the first certificate has expired, the first certificate and its corresponding network service interface are marked as abnormal, and the abnormal verification result is returned. The next first certificate is then checked in a loop. If the certificate validity period is normal, the next first certificate field is checked.

[0045] Verify whether the common name (commonName) is consistent with the three key information: the alternative name (subAltName) and the website name (webUrlName). If the information is inconsistent, mark the first certificate and its corresponding network service interface as abnormal and return the abnormal verification result. Then, loop through and verify the next first certificate. Otherwise, continue to verify the fields of the next first certificate.

[0046] Continue verifying whether the status flag bit (flagCredible) is abnormal. If the status flag bit (flagCredible) is 0, mark the first certificate and its network service interface as abnormal and return the abnormal verification result, then loop to verify the next first certificate; if the status flag bit (flagCredible) is 1, it indicates that it is normal, and continue to verify the certificate algorithm.

[0047] Verify the security of the certificate algorithm. If the certificate algorithm is a Chinese national cryptographic standard (SM series), it is a secure algorithm. If it is an RSA or DSA algorithm with a key length ≥ 2048 bits, or an SHA or ChaCha20 algorithm with a key length ≥ 256 bits, or an AES algorithm with a key length ≥ 128 bits, or an ECC elliptic curve algorithm, all of these are secure algorithms. Other short key lengths or algorithms with vulnerabilities are considered risky encryption algorithms. Based on the algorithm verification results, define whether the certificate and service interface are risky and return the corresponding results.

[0048] In this embodiment of the invention, as described above, the monitoring of the certificate chain is mainly completed by combining the above four steps. Only when the results of all four steps are true is the result R of the entire process true. Assuming the results of the four steps are R1, R2, R3, and R4, the following formula is derived: R = R1 & R2 & R3 & R4 R1=t∈[tstart,tend]: The certificate is valid for a certain period of time; R2 = VerifySignature(cert): The certificate and website name must match; R3=NotRevoked(cert): The certificate is valid and has not been revoked; R4 = TrustedAlgorithm(cert): The certificate algorithm is reliable.

[0049] In this embodiment of the invention, selectable extended parameter configurations are used for monitoring items such as certificate chain integrity, algorithm strength, and time validity, without modifying the core logic, facilitating subsequent function upgrades. It also supports full-process certificate chain parsing technology based on the X.509 standard and Chinese cryptographic algorithm standards, and sets different TTL values ​​according to certificate level to facilitate accurate monitoring of each certificate. Furthermore, it supports commercial cryptographic SM (Shang Mi) series algorithms as well as international algorithms such as RSA (Rivest–Shamir–Adleman), SHA (Secure Hash Algorithm), and AES (Advanced Encryption Standard), adapting to diverse scenarios such as finance and e-commerce.

[0050] In an exemplary embodiment of the present invention, after detecting whether the certificate serial number exists in the target red-black tree structure, the method further includes: If it does not exist, update the target red-black tree structure based on the first certificate chain, store the first certificate field in the target red-black tree structure, and add a status flag bit to each first certificate; Verify whether the certificate algorithm has any risks; If there is no risk, the first certificate chain is confirmed to be normal.

[0051] In this embodiment of the invention, if it is determined based on the certificate serial number that a first certificate in the first certificate chain does not exist in the target red-black tree structure, then the first certificate is written into the target red-black tree structure. The initial status flag added to the first certificate is set to 1 by default. Simultaneously, the first certificate field of the first certificate is stored using its certificate serial number as the primary key. The certificate algorithm of each first certificate in the first certificate chain is then checked for potential risks. If the certificate algorithms of all first certificates are risk-free, the first certificate chain is determined to be normal; otherwise, the first certificate chain is determined to be abnormal.

[0052] In an exemplary embodiment of the present invention, after performing multi-dimensional monitoring of the first certificate chain based on the target red-black tree structure and the first certificate field, the method further includes: If the results of multi-dimensional monitoring indicate that the first certificate chain is abnormal, the abnormal information in the first certificate chain is determined. Based on the abnormal information, a warning message is determined, and the warning message is fed back to the network service interface corresponding to the first certificate chain.

[0053] In this embodiment of the invention, the first certificate chain of the network service interface is traversed sequentially, and the aforementioned monitoring steps are executed repeatedly until the monitoring of all first certificate chains is completed. If a single first certificate is found to be risky or abnormal, its corresponding network service interface is marked as risky or abnormal. For the first certificate that is risky or abnormal, abnormal information is generated according to the error content, and warning information is determined based on the abnormal information. The warning information is then actively fed back to the corresponding network service interface.

[0054] In this embodiment of the invention, based on a red-black tree structure, a three-in-one monitoring of certificate chain integrity, compliance, and validity is achieved, covering the entire process and all field information of the certificate chain. This solves the problem of blind spots in traditional technology monitoring. It adopts a distributed collection and terminal computing architecture, combined with backend certificate information caching technology. A single node can support thousands of certificate chain verifications and interface data processing per second, with a monitoring latency of ≤100ms, meeting the real-time monitoring needs of large-scale certificate servers.

[0055] In this embodiment of the invention, optional extended parameter configurations can be used for monitoring items such as certificate chain integrity, algorithm strength, and time validity, without modifying the core logic, which facilitates subsequent function upgrades.

[0056] The certificate chain monitoring device provided by the present invention will be described below. The certificate chain monitoring device described below can be referred to in correspondence with the certificate chain monitoring method described above. It should be noted that the device provided in the following embodiments and the method provided in the above embodiments belong to the same concept, and the specific way in which each module and unit performs its operation has been described in detail in the method embodiments, and will not be repeated here.

[0057] In one exemplary embodiment of the present invention, please refer to Figure 4 , Figure 4 This is a certificate chain monitoring device according to an exemplary embodiment, comprising the following modules.

[0058] The first parsing module 410 is configured to obtain the first certificate chain to be monitored, and to parse each first certificate in the first certificate chain to obtain the first certificate field. The first determining module 420 is configured to determine the target red-black tree structure corresponding to the first certificate chain; wherein the target red-black tree structure is constructed with the second certificate in the second certificate chain as nodes and stores the second certificate field of each second certificate; The multi-dimensional monitoring module 430 is configured to perform multi-dimensional monitoring of the first certificate chain based on the target red-black tree structure and the first certificate field.

[0059] In an exemplary embodiment of the present invention, the certificate chain monitoring device further includes: The acquisition module is configured to acquire the second certificate chain from each network service interface through the deployed certificate chain acquisition module; The second parsing module is configured to parse the second certificate in each of the second certificate chains to obtain the second certificate field; The construction module is configured to build a red-black tree structure in the second certificate chain with the same root certificate, using each second certificate as a node, store the second certificate fields through the red-black tree structure, and add status flag bits to each second certificate; The configuration module is configured to set corresponding time-to-live (TTL) values ​​for the second certificate at different levels within the red-black tree structure.

[0060] In an exemplary embodiment of the present invention, the multi-dimensional monitoring module 430 includes: The monitoring submodule is configured to monitor the integrity, compliance, and validity of the first certificate chain based on the target red-black tree structure and the first certificate field.

[0061] In an exemplary embodiment of the present invention, the first certificate field includes a certificate serial number, certificate validity period, website name, generic name, alternative subject name, and certificate algorithm; the monitoring submodule includes: The detection unit is configured to detect whether the certificate serial number exists in the target red-black tree structure; The monitoring unit is configured to, if present, monitor the integrity, compliance, and validity of the first certificate chain based on the certificate validity period, website name, common name, alternative subject name, and certificate algorithm.

[0062] In one exemplary embodiment of the present invention, the monitoring unit includes: The first determining subunit is configured to determine, based on the target red-black tree structure, whether the validity period of each of the first certificates is normal; The first verification subunit is configured to, if normal, verify whether the common name, the alternative theme name, the website name, and the corresponding second certificate field in the target red-black tree structure are consistent; The second determining subunit is configured to determine whether the status flag bit of the first certificate chain is valid if the two are consistent. The second verification subunit is configured to verify whether the certificate algorithm has any risks if it is valid. The third determining subunit is configured to determine that the first certificate chain is normal if there is no risk.

[0063] In one exemplary embodiment of the present invention, the monitoring submodule further includes: The update unit is configured to update the target red-black tree structure based on the first certificate chain if the certificate does not exist, store the first certificate field in the target red-black tree structure, and add a status flag bit to each first certificate. The verification unit is configured to verify whether the certificate algorithm is at risk. The determination unit is configured to determine that the first certificate chain is normal if there is no risk.

[0064] In an exemplary embodiment of the present invention, the certificate chain monitoring device further includes: The second determining module is configured to determine the abnormal information in the first certificate chain if the results of multi-dimensional monitoring indicate that the first certificate chain is abnormal. The feedback module is configured to determine early warning information based on the abnormal information and feed the early warning information back to the network service interface corresponding to the first certificate chain.

[0065] Figure 5 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 5 As shown, the electronic device may include a processor 510, a communications interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communications interface 520, and the memory 530 communicate with each other via the communication bus 540. The processor 510 can call logical instructions in the memory 530 to execute a certificate chain monitoring method, which includes: acquiring a first certificate chain to be monitored, and parsing each first certificate in the first certificate chain to obtain first certificate fields; Determine the target red-black tree structure corresponding to the first certificate chain; wherein the target red-black tree structure is constructed with the second certificate in the second certificate chain as nodes, and stores the second certificate field of each second certificate; Based on the target red-black tree structure and the first certificate field, the first certificate chain is monitored in multiple dimensions.

[0066] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0067] On the other hand, the present invention also provides a computer program product, the computer program product including a computer program, the computer program being able to be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer is able to execute the certificate chain monitoring method provided by the above methods, the method including: obtaining a first certificate chain to be monitored, and parsing each first certificate in the first certificate chain to obtain a first certificate field; Determine the target red-black tree structure corresponding to the first certificate chain; wherein the target red-black tree structure is constructed with the second certificate in the second certificate chain as nodes, and stores the second certificate field of each second certificate; Based on the target red-black tree structure and the first certificate field, the first certificate chain is monitored in multiple dimensions.

[0068] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the certificate chain monitoring method provided by the above methods, the method comprising: acquiring a first certificate chain to be monitored, and parsing each first certificate in the first certificate chain to obtain a first certificate field; Determine the target red-black tree structure corresponding to the first certificate chain; wherein the target red-black tree structure is constructed with the second certificate in the second certificate chain as nodes, and stores the second certificate field of each second certificate; Based on the target red-black tree structure and the first certificate field, the first certificate chain is monitored in multiple dimensions.

[0069] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0070] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0071] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A certificate chain monitoring method, characterized in that, include: Obtain the first certificate chain to be monitored, and parse each first certificate in the first certificate chain to obtain the first certificate field; Determine the target red-black tree structure corresponding to the first certificate chain; wherein the target red-black tree structure is constructed with the second certificate in the second certificate chain as nodes, and stores the second certificate field of each second certificate; Based on the target red-black tree structure and the first certificate field, the first certificate chain is monitored in multiple dimensions.

2. The certificate chain monitoring method according to claim 1, characterized in that, Before determining the target red-black tree structure corresponding to the first certificate chain, the method further includes: The second certificate chain is obtained from various network service interfaces through the deployed certificate chain acquisition module; Parse the second certificate in each of the second certificate chains to obtain the second certificate fields; In the second certificate chain with the same root certificate, a red-black tree structure is constructed with each second certificate as a node. The second certificate fields are stored in the red-black tree structure, and a status flag bit is added to each second certificate. In the red-black tree structure, a corresponding time-to-live (TTL) is set for the second certificate at different levels.

3. The certificate chain monitoring method according to claim 1, characterized in that, The multi-dimensional monitoring of the first certificate chain based on the target red-black tree structure and the first certificate field includes: Based on the target red-black tree structure and the first certificate field, the integrity, compliance, and validity of the first certificate chain are monitored.

4. The certificate chain monitoring method according to claim 3, characterized in that, The first certificate fields include certificate serial number, certificate validity period, website name, common name, alternative subject name, and certificate algorithm; the step of monitoring the integrity, compliance, and validity of the first certificate chain based on the target red-black tree structure and the first certificate fields includes: Detect whether the certificate serial number exists in the target red-black tree structure; If present, the integrity, compliance, and validity of the first certificate chain are monitored based on the certificate validity period, website name, common name, alternative subject name, and certificate algorithm.

5. The certificate chain monitoring method according to claim 4, characterized in that, The monitoring of the integrity, compliance, and validity of the first certificate chain based on the certificate validity period, website name, common name, alternative subject name, and certificate algorithm includes: Based on the target red-black tree structure, verify whether the validity period of each of the first certificates is normal; If normal, verify whether the common name, the alternative theme name, the website name, and the corresponding second certificate field in the target red-black tree structure are consistent; If they match, determine whether the status flag bit of the first certificate chain is valid; If valid, verify whether the certificate algorithm is risky; If there is no risk, the first certificate chain is confirmed to be normal.

6. The certificate chain monitoring method according to claim 4, characterized in that, After detecting whether the certificate serial number exists in the target red-black tree structure, the method further includes: If it does not exist, update the target red-black tree structure based on the first certificate chain, store the first certificate field in the target red-black tree structure, and add a status flag bit to each first certificate; Verify whether the certificate algorithm has any risks; If there is no risk, the first certificate chain is confirmed to be normal.

7. The certificate chain monitoring method according to any one of claims 1 to 6, characterized in that, After performing multi-dimensional monitoring of the first certificate chain based on the target red-black tree structure and the first certificate field, the method further includes: If the results of multi-dimensional monitoring indicate that the first certificate chain is abnormal, the abnormal information in the first certificate chain is determined. Based on the abnormal information, a warning message is determined, and the warning message is fed back to the network service interface corresponding to the first certificate chain.

8. A certificate chain monitoring device, characterized in that, include: The first parsing module is configured to obtain the first certificate chain to be monitored, and parse each first certificate in the first certificate chain to obtain the first certificate field; The first determining module is configured to determine the target red-black tree structure corresponding to the first certificate chain; wherein the target red-black tree structure is constructed with the second certificate in the second certificate chain as nodes, and stores the second certificate field of each second certificate; The multi-dimensional monitoring module is configured to perform multi-dimensional monitoring of the first certificate chain based on the target red-black tree structure and the first certificate field.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the certificate chain monitoring method as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the certificate chain monitoring method as described in any one of claims 1 to 7.

Images