A CRL file management method, device and equipment and storage medium
By combining preset mapping calls and hash-based hierarchical storage with MMAP technology, the problems of mixed storage, low parsing efficiency, and slow query response in CRL file management are solved, achieving efficient and low-cost CRL file management.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CETC CYBERSPACE SECURITY TECH CO LTD
- Filing Date
- 2026-03-11
- Publication Date
- 2026-06-09
AI Technical Summary
Existing CRL file management solutions suffer from problems such as redundant storage due to mixed storage, high IO overhead due to multiple copies during parsing, low sorting efficiency, and inability to handle high concurrency due to linear growth in query response with data volume, making them unsuitable for the efficient management needs of large-capacity CRLs.
The system parses CRL files using a pre-defined mapping call method, creates a hierarchical storage structure using hash values, performs memory mapping and batch storage using MMAP technology, achieves persistent replacement of parsed files through file renaming, and optimizes queries using a binary search algorithm.
It achieves efficient and structured management of CRL files, reduces writing, reading, and copying, lowers the overhead of massive data exchange, improves file parsing speed and query efficiency, and reduces management costs.
Smart Images
Figure CN122173449A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of information management technology, and in particular to a CRL file management method, apparatus, device and storage medium. Background Technology
[0002] A CRL (Certificate Revocation List) is a list published by a Certificate Authority (CA) to record information about issued but no longer valid certificates, including the serial number of the revoked certificate and the reason for revocation (such as key leakage or decreased CA trust). The lifespan of a CRL is typically shorter than the validity period of a certificate, and CAs periodically update CRLs to ensure security and timeliness. However, existing CRL processing solutions have several shortcomings: The lack of a clear isolation mechanism in storage leads to the co-existence of large-capacity CRL files from multiple issuers, causing data redundancy and search difficulties; the parsing process relies on traditional I / O interfaces such as `read()`, resulting in multiple data copies and huge I / O overhead when processing GB-level files; the sorting process requires copying complete serial number data, leading to low sorting efficiency due to massive data exchange; queries use linear traversal or simple indexes, and response time increases linearly with CRL size, failing to meet high concurrency demands; the overall solution does not adapt to the core characteristics of large-capacity CRLs, resulting in insufficient processing performance and reliability.
[0003] Therefore, how to achieve efficient and structured management of CRL files is a problem that needs to be solved. Summary of the Invention
[0004] In view of this, the purpose of this invention is to provide a CRL file management method, apparatus, device, and storage medium, capable of achieving efficient and structured CRL management. The specific solution is as follows: Firstly, this application discloses a CRL file management method, including: The target CRL file is invoked using a preset mapping invocation method, and the target CRL file is parsed based on a preset standard document to obtain the target file identifier; the preset standard document contains the trust chain data corresponding to the target CRL file; the target file identifier is the revocation certificate serial number of the target CRL file; The target format file to be filled is mapped using a preset mapping call method, and the target file identifier and the data information corresponding to the target file identifier are stored in the file to be filled based on a preset information storage method to obtain the target parsing file; The target parsing file is persisted to the target hard disk, and the target parsing file is used to replace the current CRL query file of the query business program to complete the parsing of the target CRL file.
[0005] Optionally, before invoking the target CRL file using a preset mapping invocation method and parsing the target CRL file based on a preset standard document to obtain the target file identifier, the method further includes: The issuer information in the target CRL file is parsed using the preset standard document, and the first hash value corresponding to the issuer information is calculated. A subdirectory is created using the string corresponding to the first hash value, and the target CRL file is stored in the subdirectory.
[0006] Optionally, the step of invoking the target CRL file using a preset mapping invocation method and parsing the target CRL file based on a preset standard document to obtain the target file identifier includes: The target CRL file is invoked using MMAP technology, and the target CRL file is parsed based on a preset standard document to obtain the target file identifier; The target file identifier is stored in an array to obtain the corresponding memory offset and length, and the target array and the target file identifier are then stored in batches in the serial number database corresponding to the subdirectory.
[0007] Optionally, the step of mapping the target format file to be filled using a preset mapping call method, and storing the target file identifier and the data information corresponding to the target file identifier into the file to be filled based on a preset information storage method to obtain the target parsing file includes: Query all target file identifiers in the serial number database to obtain a target serial number list, and determine the number of serial numbers and the total number of bytes in the target serial number list; Map the target format file to be filled using a preset mapping call method; The number of serial numbers and the total number of bytes of the serial numbers are filled into the beginning of the file to be filled, the memory offset and length of the target file identifier are filled into the middle of the file to be filled, and the original data corresponding to the target file identifier is filled into the end of the file to be filled, so as to obtain the target parsing file.
[0008] Optionally, replacing the current CRL query file of the query business program with the target parsing file includes: Request a process / thread mutex lock; After replacing the current CRL query file of the query business program with the target parsing file by renaming the file, the process / thread mutex lock is released.
[0009] Optionally, after replacing the current CRL query file of the query business program with the target parsing file, the method further includes: Obtain the Issuer information and certificate serial number of the CRL file to be queried, and calculate the second hash value corresponding to the Issuer information; Based on the second hash value, query the subdirectory to see if the CRL file to be queried exists; If the CRL file to be queried does not exist in the subdirectory, then the CRL file to be queried is a revoked certificate, and the query ends.
[0010] Optionally, after querying the subdirectory for the existence of the CRL file to be queried based on the second hash value, the method further includes: Determine whether the timestamp of the CRL file to be queried has changed; If the timestamp of the CRL file to be queried changes, then request a process / thread mutex lock; The preset mapping call method is used to map the CRL file to be queried, and the binary search algorithm, as well as the file mid address and length array corresponding to the CRL file to be queried, are used to determine whether the target sequence number corresponding to the CRL file to be queried exists in the subdirectory; If a target serial number corresponding to the CRL file to be queried exists, then the CRL file to be queried is a revoked certificate.
[0011] Secondly, this application discloses a CRL file management device, comprising: The identifier resolution module is used to invoke the target CRL file using a preset mapping invocation method, and parse the target CRL file based on a preset standard document to obtain the target file identifier; the preset standard document contains the trust chain data corresponding to the target CRL file; the target file identifier is the revocation certificate serial number of the target CRL file; The file generation module is used to map the target format file to be filled using a preset mapping call method, and to store the target file identifier and the data information corresponding to the target file identifier into the file to be filled based on a preset information storage method, so as to obtain the target parsing file; The file replacement module is used to persist the target parsing file to the target hard disk and replace the current CRL query file of the query business program with the target parsing file to complete the parsing of the target CRL file.
[0012] Thirdly, this application discloses an electronic device, comprising: Memory, used to store computer programs; A processor is used to execute the computer program to implement the aforementioned CRL file management method.
[0013] Fourthly, this application discloses a computer-readable storage medium for storing a computer program, which, when executed by a processor, implements the aforementioned CRL file management method.
[0014] As can be seen, in this application, a preset mapping invocation method is used to invoke the target CRL file, and the target CRL file is parsed based on a preset standard document to obtain the target file identifier; the preset standard document contains the trust chain data corresponding to the target CRL file; the target file identifier is the revocation certificate serial number of the target CRL file; the preset mapping invocation method is used to map the target format to be filled file, and the target file identifier and the data information corresponding to the target file identifier are stored in the to-be-filled file based on a preset information storage method to obtain the target parsing file; the target parsing file is persisted to the target hard disk, and the target parsing file is used to replace the current CRL query file of the query business program to complete the parsing of the target CRL file. That is, by using a mapping method to invoke the target CRL file, the write, read, and copy operations during program execution can be reduced, the overhead of massive data exchange can be reduced, the file parsing speed can be improved, and the cost of CRL file management can be reduced. Attached Figure Description
[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.
[0016] Figure 1 This application discloses a flowchart of a CRL file management method. Figure 2 This is a flowchart of a specific CRL file storage method disclosed in this application; Figure 3 This application discloses a specific flowchart of a CRL file parsing method; Figure 4 This application discloses a specific flowchart of a CRL file query method; Figure 5 This is a schematic diagram of the structure of a CRL file management device disclosed in this application; Figure 6 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation
[0017] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0018] Existing CRL solutions suffer from drawbacks such as redundant storage leading to difficulty in searching, multiple copying during parsing resulting in high IO overhead, low sorting efficiency, and query response time increasing linearly with data volume, hindering high concurrency. Overall, they are not suitable for large-capacity requirements and suffer from insufficient performance and reliability. Therefore, this application will specifically introduce a CRL file management method that can solve the above problems.
[0019] See Figure 1 As shown in the figure, this application discloses a CRL file management method, including: Step S11: Invoke the target CRL file using a preset mapping invocation method, and parse the target CRL file based on a preset standard document to obtain the target file identifier; the preset standard document contains the trust chain data corresponding to the target CRL file; the target file identifier is the revocation certificate serial number of the target CRL file.
[0020] In this embodiment, before invoking the target CRL file using a preset mapping method and parsing the target CRL file based on a preset standard document to obtain the target file identifier, the method further includes: parsing the Issuer information in the target CRL file using the preset standard document and calculating a first hash value corresponding to the Issuer information; creating a subdirectory using the string corresponding to the first hash value and storing the target CRL file in the subdirectory. Figure 2As shown, to achieve hierarchical and isolated storage of Certificate Revocation List (CRL) files from different Certificate Authorities (Issuers), thereby improving the efficiency and standardization of maintenance and management, the entire operation process is based on the RFC 5280 standard. First, the Issuer field information in the CRL file is parsed to accurately extract identifying details such as the issuing authority's name, country, and organization, ensuring the reliability of the data source. Next, the parsed Issuer information is hashed using SHA-256 to generate a fixed-length and unique hash value string. It should be noted that this hash value is irreversible, effectively avoiding naming conflicts and enhancing security. Then, this hash value string is used as the subdirectory name to create a corresponding subdirectory in the root directory of the storage system, establishing a hierarchical and isolated storage structure. Finally, the original CRL file is stored in this subdirectory, enabling independent archiving of CRL files for each Issuer, preventing file mixing and simplifying path management. This hierarchical storage method not only facilitates daily maintenance, such as quickly locating, updating, or deleting the CRL of a specific Issuer, but also supports scalability and can be easily integrated into automated management processes. Ultimately, by completing the storage operations, the system achieved an organic organization of CRL files, enhancing overall security and maintainability, and laying the foundation for the stable operation of the public key infrastructure. In this way, hash-based directory organization avoids data chaos and reduces CRL file management costs.
[0021] In this embodiment, the step of calling the target CRL file using a preset mapping call method and parsing the target CRL file based on a preset standard document to obtain the target file identifier includes: calling the target CRL file using MMAP technology and parsing the target CRL file based on a preset standard document to obtain the target file identifier; storing the memory offset and length of the target file identifier in an array to obtain a target array, and batch storing the target array and the target file identifier into the serial number database corresponding to the subdirectory. Specifically, MMAP (MemoryMap, i.e., mapping a file or other object into memory) is used to map the CRL file to avoid I / O (Input / Output) copying. Low-overhead sorting is achieved by recording the offset and length of the serial number in the mapped memory. After batch writing to the SQLite database (a lightweight database), an ordered index file is generated. First, the MMAP system call is used to map the CRL file into memory in read-only mode to achieve direct memory access, avoiding frequent disk I / O, thereby improving processing efficiency. Next, strictly following the RFC 5280 specification, the revocation certificate serial number tags in the CRL are parsed item by item, accurately extracting the binary data of each serial number to ensure the parsing process conforms to international standards. During parsing, the offset and data length of each serial number in the memory-mapped area are recorded and stored in a dynamic array for easy indexing and retrieval by subsequent programs. After parsing, a corresponding subdirectory (which can be a subdirectory corresponding to the hash value string) is created or located based on the Issuer's unique identifier (e.g., its hash value), achieving hierarchical data isolation. Finally, all serial number information stored in the array is batch-inserted into the serial number database under that subdirectory, optimizing storage efficiency through batch operations. This process ensures that the CRL data for each Issuer is stored independently and managed in isolation, making maintenance, update, and query operations more orderly and efficient, thereby enhancing the maintainability and organization of the overall system. It should be noted that if multiple CRL files exist, each CRL file needs to independently complete the above analysis steps until all CRL files are analyzed. Alternatively, multi-threading can be used to parse the files in parallel, as long as the analysis of each CRL file is relatively independent.
[0022] Step S12: Map the target format file to be filled using a preset mapping call method, and store the target file identifier and the data information corresponding to the target file identifier into the file to be filled based on a preset information storage method to obtain the target parsing file.
[0023] In this embodiment, the step of mapping the target format file to be filled using a preset mapping call method, and storing the target file identifier and the corresponding data information of the target file identifier into the file to be filled based on a preset information storage method to obtain a target parsing file, includes: querying all target file identifiers in the serial number database to obtain a target serial number list, and determining the number of serial numbers and the total number of bytes in the target serial number list; mapping the target format file to be filled using the preset mapping call method; filling the number of serial numbers and the total number of bytes in the serial numbers into the beginning of the file to be filled, filling the memory offset and length corresponding to the target file identifier into the middle of the file to be filled, and filling the original data corresponding to the target file identifier into the end of the file to be filled, to obtain a target parsing file. Specifically, as shown below... Figure 3 As shown, the process first queries the database for all revocation certificate serial numbers and sorts them to obtain an ordered list of serial numbers. Next, the number of serial numbers (n) and the total number of bytes (N) are counted to provide a basis for file allocation. Then, MMAP is used to map a file of size 1024 + 5n + N in read-write mode, creating a memory mapping to improve read / write efficiency. In the 1024 bytes reserved at the beginning of the file, key information such as the file identifier, the number of serial numbers (n), and the total number of bytes (N) are written to identify the file structure and metadata. Then, the address offset and length of each serial number in the file are recorded sequentially in the middle of the file to build an index mechanism for fast retrieval. At the end of the file, the original data of each serial number is stored sequentially to ensure data integrity. Finally, msync is used to flush the MMAP-mapped memory data to disk, persisting all changes to the hard drive, thus completing the generation and storage of the CRL file and achieving efficient and isolated maintenance management.
[0024] Step S13: Persist the target parsing file to the target hard disk, and replace the current CRL query file of the query business program with the target parsing file to complete the parsing of the target CRL file.
[0025] In this embodiment, replacing the current CRL query file of the query business program with the target parsing file includes: requesting a process / thread mutex lock; and releasing the process / thread mutex lock after replacing the current CRL query file of the query business program with the target parsing file using file renaming. Specifically, to achieve hierarchical isolation storage and convenient maintenance of CRL files from different issuers, a process or thread mutex lock is first requested to ensure the exclusivity and consistency of the operation sequence during subsequent file updates, avoiding concurrent read / write conflicts. Then, the ordered revocation certificate sequence number file used by the query business program is atomically replaced using file renaming. This method can safely complete the switching and updating of data files without affecting the continuity of the query service. Next, the requested process / thread mutex lock is released, allowing other operations to continue execution. Finally, the parsing and loading of the new CRL file is completed, enabling the system to promptly apply the latest certificate revocation status information, thereby ensuring accurate and efficient access to the revocation certificate list by the business program while achieving hierarchical storage management of CRL files.
[0026] In this embodiment, after replacing the current CRL query file of the query business program with the target parsing file, the method further includes: obtaining the Issuer information and certificate serial number of the CRL file to be queried, and calculating the second hash value corresponding to the Issuer information; querying the subdirectory for the existence of the CRL file to be queried based on the second hash value; if the CRL file to be queried does not exist in the subdirectory, then the CRL file to be queried is a revoked certificate, and the query ends. After querying the subdirectory for the existence of the CRL file to be queried based on the second hash value, the method further includes: determining whether the timestamp of the CRL file to be queried has changed; if the timestamp of the CRL file to be queried has changed, then requesting a process / thread mutex lock; mapping the CRL file to be queried using the preset mapping call method, and using a binary search algorithm, as well as the file's central address and length array corresponding to the CRL file to be queried, determining whether the target serial number corresponding to the CRL file to be queried exists in the subdirectory; if the target serial number corresponding to the CRL file to be queried exists, then the CRL file to be queried is a revoked certificate. That is, as shown below. Figure 4As shown, an ordered index file is mapped using MMAP in read-only mode, combined with a binary search algorithm, to quickly retrieve whether the target sequence number exists. Specifically, first, the input certificate issuer and sequence number are obtained as parameters to start the query process. Then, the SHA256 hash value of the issuer is calculated and used as the index key to query the ordered sequence number file corresponding to the hash value (this file stores a list of revoked certificate sequence numbers). If the file does not exist, it means the certificate has not been revoked, and the query ends directly. If the file exists, its timestamp is checked to ensure data timeliness, and a process or thread mutex lock is requested to prevent concurrent access conflicts. If the timestamp has changed, the file needs to be remapped via MMAP to obtain the latest content. Next, using the address and length array in the file, a binary search algorithm is used to efficiently search for the certificate sequence number. After the search is completed, the mutex lock is released. If the sequence number exists in the file, the certificate has been revoked; otherwise, the certificate has not been revoked. Finally, the entire CRL query process is completed, and the result is returned. This design improves query efficiency and management convenience through hash isolation and ordered storage.
[0027] As can be seen, in this embodiment, a preset mapping invocation method is used to invoke the target CRL file, and the target CRL file is parsed based on a preset standard document to obtain the target file identifier; the preset standard document contains the trust chain data corresponding to the target CRL file; the target file identifier is the revocation certificate serial number of the target CRL file; the preset mapping invocation method is used to map the target format to be filled file, and the target file identifier and the data information corresponding to the target file identifier are stored in the to-be-filled file based on a preset information storage method to obtain the target parsing file; the target parsing file is persisted to the target hard disk, and the target parsing file is used to replace the current CRL query file of the query business program to complete the parsing of the target CRL file. That is, by using a mapping method to invoke the target CRL file, the write, read, and copy operations during program execution can be reduced, the overhead of massive data exchange can be reduced, the file parsing speed can be improved, and the cost of CRL file management can be reduced.
[0028] refer to Figure 5 The present application also discloses a CRL file management device, comprising: The identifier resolution module 11 is used to invoke the target CRL file using a preset mapping invocation method, and parse the target CRL file based on a preset standard document to obtain the target file identifier; the preset standard document contains the trust chain data corresponding to the target CRL file; the target file identifier is the revocation certificate serial number of the target CRL file; The file generation module 12 is used to map the target format file to be filled using a preset mapping call method, and to store the target file identifier and the data information corresponding to the target file identifier into the file to be filled based on a preset information storage method, so as to obtain the target parsing file; The file replacement module 13 is used to persist the target parsing file to the target hard disk and replace the current CRL query file of the query business program with the target parsing file to complete the parsing of the target CRL file.
[0029] As can be seen, in this embodiment, by using a mapping method to call the target CRL file, the write, read, and copy operations during program execution can be reduced, the overhead of massive data exchange can be reduced, the file parsing speed can be improved, and the cost of CRL file management can be reduced.
[0030] In some specific embodiments, the CRL file management device may further include: The hash value calculation module is used to parse the Issuer information in the target CRL file using the preset standard document and calculate the first hash value corresponding to the Issuer information. The directory creation module is used to create a subdirectory using the string corresponding to the first hash value and store the target CRL file in the subdirectory.
[0031] In some specific embodiments, the identifier resolution module 11 may specifically include: The file parsing unit is used to call the target CRL file using MMAP technology and parse the target CRL file based on a preset standard document to obtain the target file identifier; An identifier storage unit is used to store the memory offset and length of the target file identifier in an array to obtain a target array, and to batch store the target array and the target file identifier into the serial number database corresponding to the subdirectory.
[0032] In some specific embodiments, the file generation module 12 may specifically include: The identifier query unit is used to query all target file identifiers in the serial number database to obtain a target serial number list, and to determine the number of serial numbers and the total number of bytes in the target serial number list; The file mapping unit is used to map the target format of the file to be filled using a preset mapping call method; The number of serial numbers and the total number of bytes of the serial numbers are filled into the beginning of the file to be filled, the memory offset and length of the target file identifier are filled into the middle of the file to be filled, and the original data corresponding to the target file identifier is filled into the end of the file to be filled, so as to obtain the target parsing file.
[0033] In some specific embodiments, the file replacement module 13 may specifically include: The lock request unit is used to request process / thread mutex locks; The lock release unit is used to release the process / thread mutex lock after replacing the current CRL query file of the query business program with the target parsing file based on file renaming.
[0034] In some specific embodiments, the CRL file management device may further include: The information acquisition module is used to acquire the Issuer information and certificate serial number of the CRL file to be queried, and to calculate the second hash value corresponding to the Issuer information; The first file query module is used to query whether the CRL file to be queried exists in the subdirectory based on the second hash value; The first operation stop module is used to terminate the query if the CRL file to be queried does not exist in the subdirectory, in which case the CRL file to be queried is a revoked certificate.
[0035] In some specific embodiments, the CRL file management device may further include: The timestamp change module is used to determine whether the timestamp of the CRL file to be queried has changed; The lock request module is used to request a process / thread mutex lock if the timestamp of the CRL file to be queried changes. The serial number query module is used to map the CRL file to be queried using the preset mapping call method, and to determine whether the target serial number corresponding to the CRL file to be queried exists in the subdirectory using the binary search algorithm and the file mid address and length array corresponding to the CRL file to be queried. The certificate determination module is used to determine if the target serial number corresponding to the CRL file to be queried exists, and therefore the CRL file to be queried is a revoked certificate.
[0036] Furthermore, embodiments of this application also disclose an electronic device, Figure 6 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.
[0037] Figure 6 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the CRL file management method disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be an electronic computer.
[0038] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.
[0039] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.
[0040] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the CRL file management method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.
[0041] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned disclosed CRL file management method. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.
[0042] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.
[0043] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.
[0044] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.
[0045] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0046] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.
Claims
1. A CRL file management method, characterized in that, include: The target CRL file is invoked using a preset mapping invocation method, and the target CRL file is parsed based on a preset standard document to obtain the target file identifier; the preset standard document contains the trust chain data corresponding to the target CRL file; the target file identifier is the revocation certificate serial number of the target CRL file; The target format file to be filled is mapped using a preset mapping call method, and the target file identifier and the data information corresponding to the target file identifier are stored in the file to be filled based on a preset information storage method to obtain the target parsing file; The target parsing file is persisted to the target hard disk, and the target parsing file is used to replace the current CRL query file of the query business program to complete the parsing of the target CRL file.
2. The CRL file management method according to claim 1, characterized in that, Before invoking the target CRL file using a preset mapping invocation method and parsing the target CRL file based on a preset standard document to obtain the target file identifier, the method further includes: The issuer information in the target CRL file is parsed using the preset standard document, and the first hash value corresponding to the issuer information is calculated. A subdirectory is created using the string corresponding to the first hash value, and the target CRL file is stored in the subdirectory.
3. The CRL file management method according to claim 2, characterized in that, The step of invoking the target CRL file using a preset mapping invocation method and parsing the target CRL file based on a preset standard document to obtain the target file identifier includes: The target CRL file is invoked using MMAP technology, and the target CRL file is parsed based on a preset standard document to obtain the target file identifier; The target file identifier is stored in an array to obtain the corresponding memory offset and length, and the target array and the target file identifier are then stored in batches in the serial number database corresponding to the subdirectory.
4. The CRL file management method according to claim 3, characterized in that, The process of mapping the target format file to be filled using a preset mapping call method, and storing the target file identifier and the corresponding data information into the file to be filled based on a preset information storage method to obtain the target parsing file includes: Query all target file identifiers in the serial number database to obtain a target serial number list, and determine the number of serial numbers and the total number of bytes in the target serial number list; Map the target format file to be filled using a preset mapping call method; The number of serial numbers and the total number of bytes of the serial numbers are filled into the beginning of the file to be filled, the memory offset and length of the target file identifier are filled into the middle of the file to be filled, and the original data corresponding to the target file identifier is filled into the end of the file to be filled, so as to obtain the target parsing file.
5. The CRL file management method according to claim 1, characterized in that, The step of replacing the current CRL query file of the query business program with the target parsing file includes: Request a process / thread mutex lock; After replacing the current CRL query file of the query business program with the target parsing file by renaming the file, the process / thread mutex lock is released.
6. The CRL file management method according to claim 2, characterized in that, After replacing the current CRL query file of the query business program with the target parsing file, the process further includes: Obtain the Issuer information and certificate serial number of the CRL file to be queried, and calculate the second hash value corresponding to the Issuer information; Based on the second hash value, query the subdirectory to see if the CRL file to be queried exists; If the CRL file to be queried does not exist in the subdirectory, then the CRL file to be queried is a revoked certificate, and the query ends.
7. The CRL file management method according to claim 6, characterized in that, After querying the subdirectory for the existence of the CRL file to be queried based on the second hash value, the method further includes: Determine whether the timestamp of the CRL file to be queried has changed; If the timestamp of the CRL file to be queried changes, then request a process / thread mutex lock; The preset mapping call method is used to map the CRL file to be queried, and the binary search algorithm, as well as the file mid address and length array corresponding to the CRL file to be queried, are used to determine whether the target sequence number corresponding to the CRL file to be queried exists in the subdirectory; If a target serial number corresponding to the CRL file to be queried exists, then the CRL file to be queried is a revoked certificate.
8. A CRL file management device, characterized in that, include: The identifier resolution module is used to invoke the target CRL file using a preset mapping invocation method, and parse the target CRL file based on a preset standard document to obtain the target file identifier; the preset standard document contains the trust chain data corresponding to the target CRL file; the target file identifier is the revocation certificate serial number of the target CRL file; The file generation module is used to map the target format file to be filled using a preset mapping call method, and to store the target file identifier and the data information corresponding to the target file identifier into the file to be filled based on a preset information storage method, so as to obtain the target parsing file; The file replacement module is used to persist the target parsing file to the target hard disk and replace the current CRL query file of the query business program with the target parsing file to complete the parsing of the target CRL file.
9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the CRL file management method as described in any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that, Used to store computer programs, which, when executed by a processor, implement the CRL file management method as described in any one of claims 1 to 7.