CN111917554B - Method and device for verifying digital certificate - Google Patents
Method and device for verifying digital certificate Download PDFInfo
- Publication number
- CN111917554B CN111917554B CN202010668685.2A CN202010668685A CN111917554B CN 111917554 B CN111917554 B CN 111917554B CN 202010668685 A CN202010668685 A CN 202010668685A CN 111917554 B CN111917554 B CN 111917554B
- Authority
- CN
- China
- Prior art keywords
- certificate
- original
- trusted
- target
- local
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 55
- 238000012795 verification Methods 0.000 claims description 85
- 238000004590 computer program Methods 0.000 claims description 10
- 239000000758 substrate Substances 0.000 claims 5
- 239000000523 sample Substances 0.000 claims 2
- 230000006870 function Effects 0.000 description 9
- 230000008569 process Effects 0.000 description 9
- 238000010586 diagram Methods 0.000 description 8
- 230000005540 biological transmission Effects 0.000 description 6
- 238000004891 communication Methods 0.000 description 6
- 230000003287 optical effect Effects 0.000 description 4
- 238000012545 processing Methods 0.000 description 4
- 238000012986 modification Methods 0.000 description 3
- 230000004048 modification Effects 0.000 description 3
- 230000008901 benefit Effects 0.000 description 2
- 238000001514 detection method Methods 0.000 description 2
- 239000000835 fiber Substances 0.000 description 2
- 230000007246 mechanism Effects 0.000 description 2
- 230000000644 propagated effect Effects 0.000 description 2
- 239000004065 semiconductor Substances 0.000 description 2
- 241000700605 Viruses Species 0.000 description 1
- 230000009471 action Effects 0.000 description 1
- 238000010276 construction Methods 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000008676 import Effects 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 239000004973 liquid crystal related substance Substances 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 239000013307 optical fiber Substances 0.000 description 1
- 230000008520 organization Effects 0.000 description 1
- 230000004044 response Effects 0.000 description 1
- 230000007480 spreading Effects 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
- H04L9/3265—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate chains, trees or paths; Hierarchical trust model
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The invention discloses a method and a device for verifying a digital certificate, and relates to the technical field of computers. One embodiment of the method comprises the following steps: the proxy server can select to re-issue the original certificate of the server by using different types of certificates according to the authentication condition of the original certificate of the server, so that the client can learn the access risk of the server, the problem that the client accesses a malicious website due to the certificates issued by the trust proxy server is solved, and the security of the client accessing the network is improved.
Description
Technical Field
The present invention relates to the field of computer technologies, and in particular, to a method and apparatus for verifying a digital certificate.
Background
In order to solve the security problem in the network transmission process in the internet, a secure connection protocol is generally used for data transmission, and since the data transmitted by using the secure connection protocol is encrypted, proxy service or network supervision department of an enterprise cannot supervise illegal data in the network, a proxy server uses its own certificate to re-issue a certificate of a server, and then sends the issued certificate to a client, before that, the certificate of the proxy server needs to be set as a trusted digital certificate at the client, so that the data can be decrypted;
In the process of implementing the present invention, the inventor finds that at least the following problems exist in the prior art:
the method isolates the original certificate verification mechanism between the client and the server, if the website server is a malicious website or the certificate itself has problems, the client prompts the wrong certificate and then selects whether to continue by a user when accessing the server according to the existing flow, but the client unconditionally trusts the certificate re-issued by the proxy server after receiving the certificate re-issued by the proxy server, and under the condition, the data security problem caused by the client accessing the malicious website can be generated.
Disclosure of Invention
In view of this, the embodiments of the present invention provide a method and an apparatus for verifying a digital certificate, which can avoid the risk that a client accesses a malicious website due to a certificate issued by a trust proxy server, thereby improving the security of accessing a network by the client.
To achieve the above object, according to one aspect of the embodiments of the present invention, there is provided a method for verifying a digital certificate, including:
acquiring a network address contained in a client access request, and establishing a secure connection of a website server corresponding to the network address; when the secure connection indication is successful, acquiring an original certificate of the website server; generating a certificate chain for the original certificate, and verifying the original certificate; when the verification result is that the original certificate is trusted, the original certificate is issued by using a local trusted certificate, and a trusted target certificate is generated; when the verification result is that the original certificate is not trusted, or when the network address is determined to correspond to a malicious website, the original certificate is issued by using the local untrusted certificate, and an untrusted target certificate is generated; when the verification result is that whether the original certificate is credible or not cannot be determined, the original certificate is signed by using the local unknown certificate, and an unknown target certificate is generated; and sending any one of the trusted target certificate, the untrusted target certificate and the unknown target certificate to a client.
Optionally, the method for verifying the digital certificate is characterized in that,
the local trusted certificate, the local untrusted certificate, and the local unknown target certificate are installed on the client.
Optionally, the method for verifying the digital certificate is characterized in that,
and under the condition that the generation of the certificate chain for the original certificate fails, the original certificate is signed by using the unknown local certificate, and an unknown target certificate is generated.
Optionally, the method for verifying the digital certificate is characterized in that,
when the original certificate is a self-signed certificate, the original certificate is issued by using the local unknown certificate, and an unknown target certificate is generated.
Optionally, the method for verifying the digital certificate is characterized in that,
verifying the original certificate by using a certificate revocation list, wherein when the original certificate is not included in the certificate revocation list, the verification result is that the original certificate is trusted; when the original certificate is included in the certificate revocation list, the verification result is that the original certificate is not trusted.
Optionally, the method for verifying the digital certificate is characterized in that,
the original certificate is verified using an online certificate status protocol,
When the certificate state obtained according to the online certificate state protocol is valid, the verification result is that the original certificate is trusted;
when the certificate state obtained according to the online certificate state protocol is certificate failure, the verification result is that the original certificate is not trusted; when the certificate status is not obtained according to the online certificate status protocol, the verification result is that whether the original certificate is trusted cannot be determined.
Optionally, the method for verifying the digital certificate is characterized in that,
the client uses the local trusted certificate to authenticate the received trusted target certificate; authenticating the received untrusted target credential using the local untrusted credential; the received unknown target certificate is authenticated using the unknown target certificate.
Optionally, the method for verifying the digital certificate is characterized in that,
and the client establishes secure connection with a website server corresponding to the trusted target certificate according to the received trusted target certificate.
Optionally, the method for verifying the digital certificate is characterized in that,
and the client generates the security access prompt information of the website server corresponding to the unreliable target certificate or the unknown certificate according to the received unreliable target certificate or the unknown certificate.
To achieve the above object, according to a second aspect of the embodiments of the present invention, there is provided an apparatus for digital certificate verification, including: a website certificate acquisition module and a certificate verification and issuing module; wherein,,
the website certificate acquisition module is used for acquiring a network address contained in the client access request and establishing a secure connection of a website server corresponding to the network address; when the secure connection indication is successful, acquiring an original certificate of the website server;
the certificate verification and issuance module is used for generating a certificate chain for the original certificate and verifying the original certificate; when the verification result is that the original certificate is trusted, the original certificate is issued by using a local trusted certificate, and a trusted target certificate is generated; when the verification result is that the original certificate is not trusted, the original certificate is issued by using the local untrusted certificate, and an untrusted target certificate is generated; when the verification result is that whether the original certificate is credible or not cannot be determined, the original certificate is signed by using the local unknown certificate, and an unknown target certificate is generated; and sending any one of the trusted target certificate, the untrusted target certificate and the unknown target certificate to a client.
Optionally, the device for verifying the digital certificate is characterized in that,
the local trusted certificate, the local untrusted certificate, and the local unknown target certificate are installed on the client.
Optionally, the device for verifying the digital certificate is characterized in that,
and under the condition that the generation of the certificate chain for the original certificate fails, the original certificate is signed by using the unknown local certificate, and an unknown target certificate is generated.
Optionally, the device for verifying the digital certificate is characterized in that,
when the original certificate is a self-signed certificate, the original certificate is issued by using the local unknown certificate, and an unknown target certificate is generated.
Optionally, the device for verifying the digital certificate is characterized in that,
validating the original certificate using a certificate revocation list: when the original certificate is not included in the certificate revocation list, the verification result is that the original certificate is trusted; when the original certificate is included in the certificate revocation list, the verification result is that the original certificate is not trusted.
Optionally, the device for verifying the digital certificate is characterized in that,
verifying the original certificate using an online certificate status protocol: when the certificate state obtained according to the online certificate state protocol is valid, the verification result is that the original certificate is trusted; when the certificate state obtained according to the online certificate state protocol is certificate failure, the verification result is that the original certificate is not trusted; when the certificate status is not obtained according to the online certificate status protocol, the verification result is that whether the original certificate is trusted cannot be determined.
Optionally, the device for verifying the digital certificate is characterized in that,
the client uses the local trusted certificate to authenticate the received trusted target certificate; authenticating the received untrusted target credential using the local untrusted credential; the received unknown target certificate is authenticated using the unknown target certificate.
Optionally, the device for verifying the digital certificate is characterized in that,
and the client establishes secure connection with a website server corresponding to the trusted target certificate according to the received trusted target certificate.
Optionally, the device for verifying the digital certificate is characterized in that,
and the client generates the security access prompt information of the website server corresponding to the unreliable target certificate or the unknown certificate according to the received unreliable target certificate or the unknown certificate.
To achieve the above object, according to a third aspect of an embodiment of the present invention, there is provided an electronic device for digital certificate verification, including: one or more processors; and a storage means for storing one or more programs that, when executed by the one or more processors, cause the one or more processors to implement the method as described in any of the methods of digital certificate verification described above.
To achieve the above object, according to a fourth aspect of embodiments of the present invention, there is provided a computer-readable medium having stored thereon a computer program, characterized in that the program, when executed by a processor, implements a method as described in any one of the above methods of digital certificate verification.
One embodiment of the above invention has the following advantages or benefits: the proxy server can select to re-issue the original certificate of the server by using different types of certificates according to the authentication condition of the original certificate of the server, so that the client can learn the access risk of the server, the problem that the client accesses a malicious website due to the certificates issued by the trust proxy server is solved, and the security of the client accessing the network is improved.
Further effects of the above-described non-conventional alternatives are described below in connection with the embodiments.
Drawings
The drawings are included to provide a better understanding of the invention and are not to be construed as unduly limiting the invention. Wherein:
FIG. 1 is a flow chart of a method for digital certificate verification according to one embodiment of the present invention;
FIG. 2 is a schematic flow chart of verifying a digital certificate according to an embodiment of the present invention;
FIG. 3 is a schematic flow chart of verifying a trusted certificate according to one embodiment of the present invention;
FIG. 4 is a schematic flow chart of verifying an untrusted credential according to one embodiment of the present invention;
FIG. 5 is a schematic diagram of a digital certificate verification apparatus according to an embodiment of the present invention;
FIG. 6 is an exemplary system architecture diagram in which embodiments of the present invention may be applied;
fig. 7 is a schematic diagram of a computer system suitable for use in implementing an embodiment of the invention.
Detailed Description
Exemplary embodiments of the present invention will now be described with reference to the accompanying drawings, in which various details of the embodiments of the present invention are included to facilitate understanding, and are to be considered merely exemplary. Accordingly, those of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the invention. Also, descriptions of well-known functions and constructions are omitted in the following description for clarity and conciseness.
As shown in fig. 1, an embodiment of the present invention provides a method for verifying a digital certificate, which may include the following steps:
Step S101: acquiring a network address contained in a client access request, and establishing a secure connection of a website server corresponding to the network address; and when the secure connection indicates success, acquiring an original certificate of the website server.
Specifically, the proxy server is used for a security gateway or proxy service equipment of a network supervision organization, in order to supervise network traffic, a request for a network address of a website server, for example, https:// www.abc.111, sent by a client, needs to be acquired, and based on the access request, a secure connection with the website server requested by the client is established; namely, acquiring a network address contained in a client access request, and establishing a secure connection of a website server corresponding to the network address; further, when the secure connection indicates success, acquiring an original certificate of the website server; and if the safe connection indication is failure, disconnecting the connection with the client.
The original certificate of the website server is a security certificate of the website server, such as an SSL ((Secure Sockets Layer, SSL, secure socket protocol) certificate, the SSL certificate is one of digital certificates, the website establishes an SSL security channel of data between a browser of a client and the website server by installing the SSL certificate, so that encrypted transmission of data information between the client and the website server is realized, the encrypted transmission of the data information is used for preventing leakage of the data information, the security of information transmission of both parties is ensured, a user can verify whether an accessed website is truly and reliably through the certificate of the website server, and the SSL certificate of the website server contains information related to certificates such as validity period, an issuer, a user, a public key, a private key and the like.
Step S102: and generating a certificate chain for the original certificate, and verifying the original certificate.
When the verification result is that the original certificate is trusted, the original certificate is issued by using a local trusted certificate, and a trusted target certificate is generated; when the verification result is that the original certificate is not trusted, or when the network address is determined to correspond to a malicious website, the original certificate is issued by using the local untrusted certificate, and an untrusted target certificate is generated; and when the verification result is that whether the original certificate is credible or not cannot be determined, the original certificate is issued by using the local unknown certificate, and an unknown target certificate is generated.
Specifically, a certificate chain is generated for the original certificate, and the original certificate is verified; wherein the certificate chain comprises an owner of an original certificate of the website server, one or more intermediate certificate issuers for authenticating the original certificate owner, the highest level issuer, and the intermediate issuers; it can be appreciated that certificate chain-based authentication mechanisms improve the security of certificates; therefore, when the proxy server performs certificate issue, a certificate chain can be established, and the method for generating the certificate chain can adopt related functions contained in the OpenSSL software package.
Further, when the original certificate generates a certificate chain successfully, verifying the original certificate; specifically, the proxy server generates a local certificate, namely a local trusted certificate, a local untrusted certificate and a local unknown certificate, and the method for generating the local certificate can utilize the function of generating the certificate contained in the OpenSS L software package; it can be appreciated that the local trusted certificate, the local untrusted certificate and the local unknown certificate are respectively used for re-issuing the acquired original certificate of the website server; when the original certificate is re-issued, a corresponding private key is selected to issue the certificate according to the length of the asymmetric key in the original certificate of the server, for example: the proxy server may contain 1024 bits, 2048 bits, 4096 bits of private key; further, in the case of failure in generating a certificate chain for the original certificate, the original certificate is issued by using the unknown local certificate, and an unknown target certificate is generated.
Further, when the verification result is that the original certificate is trusted, the original certificate is signed by using a local trusted certificate, and a trusted target certificate is generated; when the verification result is that the original certificate is not trusted, or when the network address is determined to correspond to a malicious website, the original certificate is issued by using the local untrusted certificate, and an untrusted target certificate is generated; when the verification result is that whether the original certificate is credible or not cannot be determined, the original certificate is signed by using the local unknown certificate, and an unknown target certificate is generated; the method of generating the trusted object certificate, the untrusted object certificate, and the unknown object certificate may use corresponding functions included in the OpenSSL package. The description of verifying the original certificate is consistent with step S201 to step S210, and will not be repeated here.
Step S103: and sending any one of the trusted target certificate, the untrusted target certificate and the unknown target certificate to a client.
Specifically, as can be seen from the description of step S102, the proxy server obtains the original certificate of the website server, and re-issues the certificate according to the verification result, and the certificate may be any one of a trusted target certificate, an untrusted target certificate or an unknown target certificate; further, sending the certificate to the client; it can be understood that the secure connection and data transmission between the proxy server and the client require that the client and the proxy server have consistent digital certificates for the secure authentication process of the data, so that the client installs the local certificate generated by the proxy server, which is a local trusted certificate, a local untrusted certificate and a local unknown certificate; for example: the client may import a local trusted certificate into the browser's "trusted root certificate authority" setting option contained, and a local untrusted certificate into the browser's "untrusted publisher" setting option; the local unknown certificate is imported into the "others" setting option contained in the browser. That is, the local trusted certificate, the local untrusted certificate, and the local unknown target certificate are installed on the client.
Further, the client authenticates the received trusted target certificate using the local trusted certificate; authenticating the received untrusted target credential using the local untrusted credential; authenticating the received unknown target certificate using the unknown target certificate. And the client establishes secure connection with a website server corresponding to the trusted target certificate according to the received trusted target certificate. For example: and the client further establishes connection between the website servers according to the received trusted target certificate and uses the local trusted target certificate to authenticate the received trusted target certificate, and obtains data returned by the website servers according to the data request.
And the client generates the security access prompt information of the website server corresponding to the unreliable target certificate or the unknown certificate according to the received unreliable target certificate or the unknown certificate. For example: the security access prompt information can generate security access prompt information for the website server in a browser of the client, such as prompt information of 'certificate is not trusted', 'risk of unknown certificate', and the like; after the secure access prompt is obtained, the user using the browser automatically judges whether to continue to access the target website.
As shown in fig. 2, an embodiment of the present invention provides a method for verifying a digital certificate, which may include the steps of:
step S201: the proxy server obtains the website address information accessed by the client.
Step S202: and establishing a secure connection with the website server corresponding to the network address.
Specifically, the description of step S201-step S202 is that the proxy server obtains the website address information accessed by the client and establishes a secure connection with the website server corresponding to the network address, and if the secure connection is established successfully, the original certificate of the website server corresponding to the network address identifier is obtained; if the secure connection is not established successfully, the connection with the server is disconnected.
The description of obtaining the original certificate of the website server is consistent with step S101, and will not be described herein.
Step S203: a certificate chain is generated based on the original certificate of the web server.
Specifically, if the certificate chain generation is successful, step S204, or step S206, or step S207, or step S208 is performed; if the certificate chain generation fails, step S205 is performed. The description about the generation of the certificate chain is consistent with step S102, and will not be repeated here.
Step S204: and judging whether the certificate is a self-signed certificate.
Specifically, a certificate chain is generated based on an original certificate of the web server according to step S203, and when the generation of the certificate chain is successful, further, it is determined whether the original certificate is a self-signed certificate; if yes, executing step S205; otherwise, step S210 is performed. In general, a self-signed certificate is easy to forge by hackers to attack or hijack site traffic, and is also easy to be utilized by phishing websites so that security risks which are easy to attack exist, and therefore when the self-signed certificate is judged, the client security risks are prompted through an unknown target certificate; that is, when the original certificate is a self-signed certificate, the original certificate is issued using the local unknown certificate, and an unknown target certificate is generated.
Step S205: and issuing the original certificate by using the local unknown certificate to generate an unknown target certificate.
Specifically, the original certificate is issued by using the local unknown certificate, and the description of generating the unknown target certificate is consistent with step S102, which is not described herein.
Step S206: the certificate status of the original certificate is obtained using an online certificate status protocol.
When the certificate status is not obtained according to the online certificate status protocol, step S205 is performed; when the obtained certificate status is certificate expiration (e.g., expired or revoked, etc.), step S209 is performed; when the obtained certificate status is that the certificate is valid, step S210 is performed.
Specifically, the online certificate status protocol may be utilized to query the original certificate for its certificate status, and when a user attempts to access the web site server, a request for certificate status information may be sent to the online certificate status protocol, and the web site server replies with response information indicating "valid", "invalid" (e.g., expired, etc.), or "unknown" (i.e., when the certificate status is not obtained) to indicate the certificate status of the website original certificate; that is, the original certificate is verified by using an online certificate status protocol, and when the certificate status obtained according to the online certificate status protocol is that the certificate is valid, the verification result is that the original certificate is trusted; when the certificate state obtained according to the online certificate state protocol is certificate failure, the verification result is that the original certificate is not trusted; when the certificate status is not obtained according to the online certificate status protocol, the verification result is that whether the original certificate is trusted cannot be determined.
Step S207: judging whether the certificate revocation list contains the revocation information related to the original certificate or not; if so, executing step S209; otherwise, step S210 is performed.
Specifically, the digital certificate may become invalid before expiring, because the key medium is lost or the identity of the user is changed, etc., the certificate authority needs to make a process of revocation on such a certificate, and put the revoked certificate into a certificate revocation list, and the original certificate may be verified by querying whether the revocation information related to the original certificate is contained in the certificate revocation list, and if the original certificate is contained in the certificate revocation list, the original certificate is considered to be an untrusted certificate; that is, the original certificate is verified using a certificate revocation list. When the original certificate is not included in the certificate revocation list, the verification result is that the original certificate is trusted; when the original certificate is included in the certificate revocation list, the verification result is that the original certificate is not trusted.
Step S208: it is determined whether the visited site is a malicious site.
After detection, determining whether the accessed website is a malicious website, if so, executing step S209; otherwise, step S210 is performed.
Specifically, some malicious websites comprise components for malicious phishing or spreading network viruses, and have security risks, especially websites related to transactions, so that whether the websites are malicious websites or not is detected, and the method for detecting the malicious websites can adopt a website security detection model, website monitoring software, monitoring script scanning network addresses and other methods; that is, when the verification result is that the original certificate is not trusted, or when the network address is determined to correspond to a malicious website, the original certificate is issued by using the local untrusted certificate, and an untrusted target certificate is generated.
Step S209: the original certificate is issued with a local untrusted certificate, generating an untrusted target certificate.
Specifically, the above steps S206, S207, S208 specifically describe the judgment conditions and procedures for verifying the untrusted attribute of the original certificate; further, the original certificate is issued by using the local untrusted certificate, and an untrusted target certificate is generated.
Step S210: and issuing the original certificate by using the local trusted certificate to generate a trusted target certificate. That is, when the verification result is that the original certificate is trusted, the original certificate is issued by using a local trusted certificate, and a trusted target certificate is generated.
Specifically, the above-described step S201 to step S210 specifically describe the steps of verifying the judgment condition of the original certificate and generating the corresponding target certificate.
As shown in fig. 3, an embodiment of the present invention provides a process for verifying a trusted certificate, which may include the following steps:
step S301: the client requests access to web site address a.
Step S302: the proxy server acquires the website address A to establish connection with the website server A.
Specifically, the descriptions of step S301 to step S302 are to acquire the network address included in the client access request, and establish a secure connection with the web server corresponding to the network address.
Step S303: the proxy server is successfully connected with the website server A, and the original certificate of the website server is obtained. That is, when the secure connection indicates success, the original certificate of the website server is obtained.
Step S304: and generating a certificate chain for the original certificate, and verifying the original certificate.
Specifically, when the verification result is that the original certificate is trusted, the original certificate is issued by using a local trusted certificate, and a trusted target certificate is generated; when the verification result is that the original certificate is not trusted, or when the network address is determined to correspond to a malicious website, the original certificate is issued by using the local untrusted certificate, and an untrusted target certificate is generated; and when the verification result is that whether the original certificate is credible or not cannot be determined, the original certificate is issued by using the local unknown certificate, and an unknown target certificate is generated.
Assuming that the steps are carried out, verifying that the website server A is trusted by the original certificate; further, the original certificate is issued by using a local trusted certificate, and a trusted target certificate is generated; specifically, the process of verifying the original certificate of the website server is consistent with the steps from step S201 to step S210, and will not be described herein.
Step S305: the proxy server sends the trusted target certificate to the client.
Specifically, according to the verification result of step S304, a trusted target certificate is generated, and the trusted target certificate is sent to the client; that is, any one of the trusted target certificate, the untrusted target certificate, and the unknown target certificate is transmitted to the client.
Step S306: the client uses the local trusted certificate to authenticate the received trusted target certificate; and establishing a secure connection of the website server A corresponding to the trusted target certificate.
Specifically, the client establishes a secure connection with a website server corresponding to the trusted target certificate according to the received trusted target certificate.
As shown in fig. 4, an embodiment of the present invention provides a process for verifying an untrusted credential, which may include the steps of:
step S401: the client requests access to web site address B.
Step S402: the proxy server acquires the website address B and establishes connection with the website server B; the description of step S401 to step S402 is that the network address included in the client access request is obtained, and the secure connection of the website server corresponding to the network address is established.
Step S403: the proxy server is successfully connected with the website server B, and an original certificate of the website server is obtained; that is, when the secure connection indicates success, the original certificate of the website server is obtained.
Step S404: and generating a certificate chain for the original certificate, and verifying the original certificate.
Specifically, when the verification result is that the original certificate is trusted, the original certificate is issued by using a local trusted certificate, and a trusted target certificate is generated; when the verification result is that the original certificate is not trusted, or when the network address is determined to correspond to a malicious website, the original certificate is issued by using the local untrusted certificate, and an untrusted target certificate is generated; and when the verification result is that whether the original certificate is credible or not cannot be determined, the original certificate is issued by using the local unknown certificate, and an unknown target certificate is generated.
Assuming that the steps are performed, verifying that the website server B is not trusted as the original certificate; then issuing the original certificate using the local untrusted certificate to generate an untrusted target certificate; specifically, the process of verifying the original certificate of the website server is consistent with the steps from step S201 to step S210, and will not be described herein.
Step S405: the proxy server sends the untrusted target credential to the client.
Specifically, according to the verification result of step S404, generating an untrusted target certificate, and sending the untrusted target certificate to the client; that is, any one of the trusted target certificate, the untrusted target certificate, and the unknown target certificate is transmitted to the client.
Step S406: the client generates a security prompt to web server B, such as "untrusted web site, whether to continue access.
Specifically, the client authenticates the received untrusted target credential using the local untrusted credential. Further, the client generates a secure access prompt of the website server corresponding to the untrusted target certificate or the unknown certificate according to the received untrusted target certificate or the unknown certificate. It will be appreciated that the description of the client receiving and processing the unknown target certificate is similar to the untrusted certificate and will not be repeated here.
Step S407: when the user selects to continue access, a connection is established with the web server B.
Specifically, when the user selects to continue access, a connection with the website server B is established, and the connection may be a non-secure connection; when the user chooses to exit, no connection is established with web server B.
As shown in fig. 5, an embodiment of the present invention provides an apparatus 500 for verifying a digital certificate, including: a website certificate acquisition module 501 and a certificate verification and issuance module 502; wherein,,
the website certificate obtaining module 501 is configured to obtain a network address included in a client access request, and establish a secure connection with a website server corresponding to the network address; when the secure connection indication is successful, acquiring an original certificate of the website server;
the certificate verification and issue module 502 is configured to generate a certificate chain for the original certificate, and verify the original certificate; when the verification result is that the original certificate is trusted, the original certificate is issued by using a local trusted certificate, and a trusted target certificate is generated; when the verification result is that the original certificate is not trusted, the original certificate is issued by using the local untrusted certificate, and an untrusted target certificate is generated; when the verification result is that whether the original certificate is credible or not cannot be determined, the original certificate is signed by using the local unknown certificate, and an unknown target certificate is generated; and sending any one of the trusted target certificate, the untrusted target certificate and the unknown target certificate to a client.
Optionally, the certificate verification and issue module 502 includes the local trusted certificate, the local untrusted certificate, and the local unknown target certificate installed on the client.
Optionally, the certificate verification and issue module 502 includes issuing the original certificate using the unknown local certificate to generate an unknown target certificate in the event that generation of a certificate chain for the original certificate fails.
Optionally, the certificate verification and issue module 502 includes issuing the original certificate using the local unknown certificate to generate an unknown target certificate when the original certificate is a self-signed certificate.
Optionally, the certificate verification and issue module 502 is configured to verify the original certificate using a certificate revocation list, where the original certificate is trusted as a result of the verification when the original certificate is not included in the certificate revocation list; when the original certificate is included in the certificate revocation list, the verification result is that the original certificate is not trusted.
Optionally, the certificate verification and issue module 502 is configured to verify the original certificate using an online certificate status protocol, and when a certificate status obtained according to the online certificate status protocol is valid, the verification result is that the original certificate is trusted; when the certificate state obtained according to the online certificate state protocol is certificate failure, the verification result is that the original certificate is not trusted; when the certificate status is not obtained according to the online certificate status protocol, the verification result is that whether the original certificate is trusted cannot be determined.
Optionally, the certificate verification and issuance module 502 includes a client that uses a local trusted certificate to authenticate the received trusted target certificate; authenticating the received untrusted target credential using the local untrusted credential; the received unknown target certificate is authenticated using the unknown target certificate.
Optionally, the certificate verification and issue module 502 includes the client establishing a secure connection with a website server corresponding to the trusted target certificate according to the received trusted target certificate.
Optionally, the certificate verification and issue module 502 includes the client generating, according to the received untrusted target certificate or the unknown certificate, a secure access prompt of a website server corresponding to the untrusted target certificate or the unknown certificate.
The embodiment of the invention also provides electronic equipment for verifying the digital certificate, which comprises: one or more processors; and a storage device for storing one or more programs which, when executed by the one or more processors, cause the one or more processors to implement the method provided by any of the embodiments described above.
The embodiment of the invention also provides a computer readable medium, on which a computer program is stored, which when executed by a processor implements the method provided by any of the above embodiments.
Fig. 6 illustrates an exemplary system architecture 600 of a digital certificate verification method or apparatus to which embodiments of the present invention may be applied.
As shown in fig. 6, the system architecture 600 may include terminal devices 601, 602, 603, a network 604, and a server 605. The network 604 is used as a medium to provide communication links between the terminal devices 601, 602, 603 and the server 605. The network 604 may include various connection types, such as wired, wireless communication links, or fiber optic cables, among others.
A user may interact with the server 605 via the network 604 using the terminal devices 601, 602, 603 to receive or send messages, etc. Various client applications such as a web browser application, a search class application, an instant messaging tool, a mailbox client, and the like may be installed on the terminal devices 601, 602, 603.
The terminal devices 601, 602, 603 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smartphones, tablets, laptop and desktop computers, and the like.
The server 605 may be a server providing various services, for example, a proxy server providing support for a website access application transmitted by the user using the terminal devices 601, 602, 603. The proxy server can establish a secure connection with the target website according to the received website access request, verify the original certificate of the website and re-sign the local certificate to feed back to the terminal equipment.
It should be noted that, the method for verifying the digital certificate provided in the embodiment of the present invention is generally executed by the server 605, and accordingly, the device for verifying the digital certificate is generally disposed in the server 605.
It should be understood that the number of terminal devices, networks and servers in fig. 6 is merely illustrative. There may be any number of terminal devices, networks, and servers, as desired for implementation.
Referring now to FIG. 7, there is illustrated a schematic diagram of a computer system 700 suitable for use in implementing an embodiment of the present invention. The terminal device shown in fig. 7 is only an example, and should not impose any limitation on the functions and the scope of use of the embodiment of the present invention.
As shown in fig. 7, the computer system 700 includes a Central Processing Unit (CPU) 701, which can perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM) 702 or a program loaded from a storage section 708 into a Random Access Memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the system 700 are also stored. The CPU 701, ROM 702, and RAM 703 are connected to each other through a bus 704. An input/output (I/O) interface 705 is also connected to bus 704.
The following components are connected to the I/O interface 705: an input section 706 including a keyboard, a mouse, and the like; an output portion 707 including a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and the like, a speaker, and the like; a storage section 708 including a hard disk or the like; and a communication section 709 including a network interface card such as a LAN card, a modem, or the like. The communication section 709 performs communication processing via a network such as the internet. The drive 710 is also connected to the I/O interface 705 as needed. A removable medium 711 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 710 as necessary, so that a computer program read therefrom is mounted into the storage section 708 as necessary.
In particular, according to embodiments of the present disclosure, the processes described above with reference to flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method shown in the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network via the communication portion 709, and/or installed from the removable medium 711. The above-described functions defined in the system of the present invention are performed when the computer program is executed by a Central Processing Unit (CPU) 701.
The computer readable medium shown in the present invention may be a computer readable signal medium or a computer readable storage medium, or any combination of the two. The computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples of the computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In the present invention, however, the computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, with the computer-readable program code embodied therein. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, fiber optic cable, RF, etc., or any suitable combination of the foregoing.
The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowchart illustration, and combinations of blocks in the block diagrams or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
The modules and/or units involved in the embodiments of the present invention may be implemented in software, or may be implemented in hardware. The described modules and/or units may also be provided in a processor, e.g., may be described as: a processor includes a website certificate acquisition module and a certificate verification and issuance module. The names of these modules do not limit the module itself in some cases, and for example, the website certificate acquisition module may also be described as "a module that establishes a secure connection with a website and acquires an original certificate of the website according to a website address requested by a client".
As another aspect, the present invention also provides a computer-readable medium that may be contained in the apparatus described in the above embodiments; or may be present alone without being fitted into the device. The computer readable medium carries one or more programs which, when executed by a device, cause the device to include: acquiring a network address contained in a client access request, and establishing a secure connection of a website server corresponding to the network address; when the secure connection indication is successful, acquiring an original certificate of the website server; generating a certificate chain for the original certificate, and verifying the original certificate; when the verification result is that the original certificate is trusted, the original certificate is issued by using a local trusted certificate, and a trusted target certificate is generated; when the verification result is that the original certificate is not trusted, or when the network address is determined to correspond to a malicious website, the original certificate is issued by using the local untrusted certificate, and an untrusted target certificate is generated; when the verification result is that whether the original certificate is credible or not cannot be determined, the original certificate is signed by using the local unknown certificate, and an unknown target certificate is generated; and sending any one of the trusted target certificate, the untrusted target certificate and the unknown target certificate to a client.
According to the technical scheme of the embodiment of the invention, the proxy server can select to re-issue the original certificate of the server by using different types of certificates according to the authentication condition of the original certificate of the server, so that the client can learn about the access risk of the server, the problem that the client accesses a malicious website due to the certificate issued by the trust proxy server is solved, and the security of the client accessing the network is improved.
The above embodiments do not limit the scope of the present invention. It will be apparent to those skilled in the art that various modifications, combinations, sub-combinations and alternatives can occur depending upon design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of the present invention.
Claims (12)
1. A method of digital certificate verification, comprising:
acquiring a network address contained in a client access request, and establishing a secure connection of a website server corresponding to the network address;
when the secure connection indication is successful, acquiring an original certificate of the website server;
Generating a certificate chain for the original certificate, and verifying the original certificate;
when the verification result is that the original certificate is trusted, the original certificate is issued by using a local trusted certificate, and a trusted target certificate is generated;
when the verification result is that the original certificate is not trusted, or when the network address is determined to correspond to a malicious website, the original certificate is issued by using a local untrusted certificate, and an untrusted target certificate is generated;
when the verification result is that whether the original certificate is credible or not cannot be determined, the original certificate is issued by using a local unknown certificate, and an unknown target certificate is generated;
and sending any one of the trusted target certificate, the untrusted target certificate and the unknown target certificate to a client.
2. The method of claim 1, wherein the step of determining the position of the substrate comprises,
the local trusted certificate, the local untrusted certificate, and the local unknown certificate are installed on the client.
3. The method of claim 1, wherein the step of determining the position of the substrate comprises,
and under the condition that the generation of the certificate chain for the original certificate fails, the original certificate is signed by using the local unknown certificate, and an unknown target certificate is generated.
4. The method of claim 1, wherein the step of determining the position of the substrate comprises,
when the original certificate is a self-signed certificate, the original certificate is issued by using the local unknown certificate, and an unknown target certificate is generated.
5. The method of claim 1, wherein the step of determining the position of the substrate comprises,
validating the original certificate using a certificate revocation list:
when the original certificate is not included in the certificate revocation list, the verification result is that the original certificate is trusted;
when the original certificate is included in the certificate revocation list, the verification result is that the original certificate is not trusted.
6. The method of claim 1, wherein the step of determining the position of the substrate comprises,
verifying the original certificate using an online certificate status protocol:
when the certificate state obtained according to the online certificate state protocol is valid, the verification result is that the original certificate is trusted;
when the certificate state obtained according to the online certificate state protocol is certificate failure, the verification result is that the original certificate is not trusted;
when the certificate status is not obtained according to the online certificate status protocol, the verification result is that whether the original certificate is trusted cannot be determined.
7. The method according to claim 2, characterized by comprising:
The client authenticates the received trusted target certificate using the local trusted certificate; authenticating the received untrusted target credential using the local untrusted credential; authenticating the received unknown target certificate using the unknown certificate.
8. The method of claim 7, wherein the step of determining the position of the probe is performed,
and the client establishes secure connection with a website server corresponding to the trusted target certificate according to the received trusted target certificate.
9. The method of claim 7, wherein the step of determining the position of the probe is performed,
and the client generates the security access prompt information of the website server corresponding to the unreliable target certificate or the unknown target certificate according to the received unreliable target certificate or the unknown target certificate.
10. An apparatus for digital certificate verification, comprising: a website certificate acquisition module and a certificate verification and issuing module; wherein,,
the website certificate acquisition module is used for acquiring a network address contained in the client access request and establishing a secure connection of a website server corresponding to the network address; when the secure connection indication is successful, acquiring an original certificate of the website server;
The certificate verification and issuance module is used for generating a certificate chain for the original certificate and verifying the original certificate; when the verification result is that the original certificate is trusted, the original certificate is issued by using a local trusted certificate, and a trusted target certificate is generated; when the verification result is that the original certificate is not trusted, the original certificate is issued by using a local untrusted certificate, and an untrusted target certificate is generated; when the verification result is that whether the original certificate is credible or not cannot be determined, the original certificate is issued by using a local unknown certificate, and an unknown target certificate is generated; and sending any one of the trusted target certificate, the untrusted target certificate and the unknown target certificate to a client.
11. An electronic device, comprising:
one or more processors;
storage means for storing one or more programs,
when executed by the one or more processors, causes the one or more processors to implement the method of any of claims 1-9.
12. A computer readable medium, on which a computer program is stored, characterized in that the program, when being executed by a processor, implements the method according to any of claims 1-9.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010668685.2A CN111917554B (en) | 2020-07-13 | 2020-07-13 | Method and device for verifying digital certificate |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010668685.2A CN111917554B (en) | 2020-07-13 | 2020-07-13 | Method and device for verifying digital certificate |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111917554A CN111917554A (en) | 2020-11-10 |
| CN111917554B true CN111917554B (en) | 2023-06-30 |
Family
ID=73226460
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010668685.2A Active CN111917554B (en) | 2020-07-13 | 2020-07-13 | Method and device for verifying digital certificate |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111917554B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114157432B (en) * | 2021-11-25 | 2024-08-23 | 上海派拉软件股份有限公司 | Digital certificate acquisition method, device, electronic equipment, system and storage medium |
| CN116743394A (en) * | 2023-08-01 | 2023-09-12 | 北京华顺信安科技有限公司 | A method, device, electronic equipment and medium for certificate validity verification |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103856478A (en) * | 2012-12-06 | 2014-06-11 | 阿里巴巴集团控股有限公司 | Certificate signing and issuing method of trusted network, attestation method of trusted network and corresponding devices |
| CN104753881A (en) * | 2013-12-30 | 2015-07-01 | 上海格尔软件股份有限公司 | WebService security certification access control method based on software digital certificate and timestamp |
| WO2019096489A1 (en) * | 2017-11-16 | 2019-05-23 | Siemens Aktiengesellschaft | Method and device for processing authenticity certificates for entities, particularly people-related, service-related and/or object-related digital certificates |
| CN110677240A (en) * | 2019-08-29 | 2020-01-10 | 阿里巴巴集团控股有限公司 | Method and device for providing high-availability computing services through certificate issuance |
| CN111314085A (en) * | 2020-01-22 | 2020-06-19 | 维沃移动通信有限公司 | Digital certificate verification method and device |
-
2020
- 2020-07-13 CN CN202010668685.2A patent/CN111917554B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103856478A (en) * | 2012-12-06 | 2014-06-11 | 阿里巴巴集团控股有限公司 | Certificate signing and issuing method of trusted network, attestation method of trusted network and corresponding devices |
| CN104753881A (en) * | 2013-12-30 | 2015-07-01 | 上海格尔软件股份有限公司 | WebService security certification access control method based on software digital certificate and timestamp |
| WO2019096489A1 (en) * | 2017-11-16 | 2019-05-23 | Siemens Aktiengesellschaft | Method and device for processing authenticity certificates for entities, particularly people-related, service-related and/or object-related digital certificates |
| CN110677240A (en) * | 2019-08-29 | 2020-01-10 | 阿里巴巴集团控股有限公司 | Method and device for providing high-availability computing services through certificate issuance |
| CN111314085A (en) * | 2020-01-22 | 2020-06-19 | 维沃移动通信有限公司 | Digital certificate verification method and device |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111917554A (en) | 2020-11-10 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN115333792B (en) | Identity authentication method, device and related equipment | |
| US11095635B2 (en) | Server authentication using multiple authentication chains | |
| CN101997685B (en) | Single sign-on method, single sign-on system and associated equipment | |
| CN101534196B (en) | Method and apparatus for securely invoking a REST API | |
| CN102201915B (en) | A terminal authentication method and device based on single sign-on | |
| EP2842258B1 (en) | Multi-factor certificate authority | |
| US8532620B2 (en) | Trusted mobile device based security | |
| US20170244676A1 (en) | Method and system for authentication | |
| US20100043065A1 (en) | Single sign-on for web applications | |
| US10470040B2 (en) | Secure single sign-on to software applications | |
| CN111355726A (en) | Identity authorization login method and device, electronic equipment and storage medium | |
| US11316846B2 (en) | Security update processing | |
| CN110149354A (en) | An encryption authentication method and device based on https protocol | |
| CN111049789B (en) | Domain name access method and device | |
| CN113169953B (en) | Method and apparatus for authenticating a device or user | |
| CN111917554B (en) | Method and device for verifying digital certificate | |
| KR20170111809A (en) | Bidirectional authentication method using security token based on symmetric key | |
| KR101637155B1 (en) | A system providing trusted identity management service using trust service device and its methods of operation | |
| CN112905990A (en) | Access method, client, server and access system | |
| CN114697137B (en) | Application program login method, device, equipment and storage medium | |
| CN111787044A (en) | IoT terminal platform | |
| CN112383542A (en) | User login method and system, authentication end and user end | |
| US20240241992A1 (en) | Registration application support system and registration application support method | |
| HK40074983A (en) | Identity authentication method and apparatus, and related device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |