WO2022257931A1

WO2022257931A1 - Deployment method and apparatus for secure acceleration service, and medium and device

Info

Publication number: WO2022257931A1
Application number: PCT/CN2022/097417
Authority: WO
Inventors: 卢江滨
Original assignee: 贵州白山云科技股份有限公司
Priority date: 2021-06-09
Filing date: 2022-06-07
Publication date: 2022-12-15
Also published as: CN115460084A; CN115460084B

Abstract

The present disclosure relates to a deployment method and apparatus for a secure acceleration service, and a medium and a device. The deployment method for a secure acceleration service is applied to a certificate management platform, and comprises: when domain name information or operation information of a target domain name meets a secure acceleration policy, or when a detection result of a secure acceleration service being started for a target domain name is received, determining to start the secure acceleration service for the target domain name (S11); and applying for a certificate of the target domain name from a CA, and deploying the certificate of the target domain name on an edge node (S12).

Description

Security Acceleration Service Deployment Method, Device, Medium and Equipment

This disclosure is based on the Chinese patent application submitted to the China Patent Office on June 9, 2021, with the application number 202110645788.1, and the title of the invention is "Security Acceleration Service Deployment Method, Device, Medium, and Equipment", and claims the priority of the Chinese patent application , the entire content of this Chinese patent application is hereby incorporated by reference into this disclosure.

technical field

Embodiments of the present disclosure relate to but are not limited to a security acceleration service deployment method, device, medium and equipment.

Background technique

Security protocols such as HTTPS (Hyper Text Transfer Protocol over SecureSocket Layer, Hypertext Transfer Security Protocol) are widely used. If the website content uses a security protocol to provide a secure connection and encrypt and protect access data, it is necessary to apply for an SSL (Secure Sockets Layer) domain name first. , Secure Socket Protocol) certificate, and then deploy the SSL certificate. During the use process, the SSL certificate also needs to be managed, resulting in an increase in the workload of the content provider. If the content provider's website does not provide a secure connection service, because there is no domain name certificate, when the CDN (Content Delivery Network, Content Distribution Network) manufacturer provides acceleration services for the website, the CDN manufacturer cannot provide security acceleration services. When the client browser enables mandatory HTTPS access for the domain name and forcibly converts HTTP (Hyper Text Transfer Protocol, Hypertext Transfer Protocol) protocol format requests to HTTPS protocol format requests, the client will not be able to obtain the requested content from the CDN network.

Existing technical solutions cannot automatically implement security acceleration services for domain names of content providers that only provide HTTP services according to actual network environments or actual needs.

Contents of the invention

The following is an overview of the topics described in detail in this article. This summary is not intended to limit the scope of the claims.

In order to overcome the problems existing in related technologies, the present disclosure provides a method, device, medium and equipment for secure accelerated service deployment.

According to the first aspect of the present disclosure, a security acceleration service deployment method is provided, which is applied to a certificate management platform, including:

When the domain name information or operation information of the target domain name satisfies the security acceleration policy, or receives the detection result of enabling the security acceleration service for the target domain name, determine to enable the security acceleration service for the target domain name;

Apply for the certificate of the target domain name from the CA institution, and deploy the certificate of the target domain name to the edge node;

Wherein, the domain name information includes at least one of the top-level domain type and business type; the operation information includes at least one of the historical times of accessing the security acceleration service of the target domain name and the access trend of the security acceleration service of the target domain name.

In some exemplary embodiments, the security acceleration service deployment method further includes:

Obtain security acceleration policy;

Judging whether the domain name information or operation information of the target domain name satisfies the security acceleration policy; or, after receiving the certificate acquisition request of the target domain name sent by the edge node, determining whether the domain name information or operation information of the target domain name satisfies the security acceleration policy.

In some exemplary embodiments, the security acceleration policy includes:

Provide security acceleration services for domain names of preset top-level domain types and/or preset business types; or,

The security acceleration service is enabled for domain names whose access times to the security acceleration service are greater than or equal to a preset threshold and/or domain names whose access trend to the security acceleration service of the target domain name becomes larger.

In some exemplary embodiments, after the determination that the security acceleration service is enabled for the target domain name, the security acceleration service deployment method further includes:

Send request information to obtain the configuration information of the target domain name to the configuration center, and receive the configuration information of the target domain name.

In some exemplary embodiments, the applying to the CA for the certificate of the target domain name, and deploying the certificate of the target domain name to the edge node includes:

Generate public and private keys for the target domain name;

Send the public key and configuration information to the CA;

Receive the certificate of the target domain name issued by the CA institution;

Send the certificate and private key of the target domain name to the edge node, so that the edge node can provide the security acceleration service of the target domain name.

In some exemplary embodiments, after obtaining the certificate of the target domain name issued by the CA institution, the method for deploying the security acceleration service further includes:

Apply for a new certificate of the target domain name from the CA within the preset time period before the certificate expiration time of the target domain name.

In some exemplary embodiments, the applying to the CA institution for a new certificate of the target domain name includes:

Regenerate a new public key and a new private key for the target domain name;

Send the new public key and the configuration information of the target domain name to the CA organization, and apply for the certificate of the target domain name from the CA organization.

If the certificate of the target domain name has a security risk, send a revocation request to the CA.

In some exemplary embodiments, the security acceleration service includes HTTPS acceleration service or QUIC acceleration service.

According to the second aspect of the present disclosure, a security acceleration service deployment method is provided, which is applied to a configuration center, including:

Receive the instruction information of enabling the security acceleration service of the target domain name, and send the detection result of enabling the security acceleration service of the target domain name to the certificate management platform;

Receive the request information for acquiring the configuration information of the target domain name from the certificate management platform, and send the configuration information of the target domain name to the certificate management platform.

In some exemplary embodiments, the configuration information of the target domain name is used to configure the security acceleration service for the target domain name, including: domain name, domain name owner or administrator related information.

According to a third aspect of the present disclosure, a security acceleration service deployment device is provided, which is applied to a certificate management platform, including:

The security acceleration service opening module is configured to enable the security acceleration service for the target domain name when the domain name information or operation information of the target domain name meets the security acceleration policy, or receives the detection result that the security acceleration service is enabled for the target domain name;

The certificate management module is configured to apply for the certificate of the target domain name from the CA institution, and deploy the certificate of the target domain name to the edge node.

In some exemplary embodiments, the security acceleration service deployment device further includes:

The configuration information request module is configured to send request information for obtaining configuration information of the target domain name to the configuration center, and receive configuration information of the target domain name.

According to a fourth aspect of the present disclosure, there is provided an apparatus for deploying a security acceleration service, which is applied to a configuration center, including:

The information management module is configured to receive instruction information for enabling the security acceleration service for the target domain name, and send the detection result of enabling the security acceleration service for the target domain name to the certificate management platform;

The configuration information sending module is configured to send the configuration information to the certificate management platform.

According to a fifth aspect of the present disclosure, there is provided a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed, the steps of the security acceleration service deployment method are realized.

According to a sixth aspect of the present disclosure, there is provided a computer device, including a processor, a memory, and a computer program stored on the memory. When the processor executes the computer program, the steps of the security acceleration service deployment method are implemented.

Through the security acceleration service deployment method, this disclosure can automatically implement the HTTPS or QUIC security acceleration function for the content provider’s website that only provides HTTP services for its users, and does not require the content provider to apply for a domain name certificate, nor does it require the content provider to Operations such as certificate management and renewal speed up the deployment of content provider domain name security acceleration services.

After the content provider deploys the HTTP service on the certificate management platform, the certificate management platform decides whether to provide security acceleration service according to the security acceleration policy. If necessary, the certificate management platform independently applies for the certificate to the CA institution, and this process does not require content provision Supplier participation, fully transparent to content providers.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. Other aspects will be apparent to others upon reading and understanding the drawings and detailed description.

Description of drawings

The accompanying drawings constituting a part of the present disclosure are used to provide a further understanding of the present disclosure, and the schematic embodiments and descriptions of the present disclosure are used to explain the present disclosure, and do not constitute improper limitations to the present disclosure. In the attached picture:

Fig. 1 is a flow chart of a security acceleration service deployment method according to an exemplary embodiment.

Fig. 2 is a flowchart showing a method for deploying a security acceleration service according to an exemplary embodiment.

Fig. 3 is a block diagram of an apparatus for deploying a security acceleration service according to an exemplary embodiment.

Fig. 4 is a block diagram of an apparatus for deploying a security acceleration service according to an exemplary embodiment.

Fig. 5 is a block diagram of an apparatus for deploying a security acceleration service according to an exemplary embodiment.

Fig. 6 is a block diagram of a computer device according to an exemplary embodiment.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments It is a part of the embodiments of the present disclosure, but not all of them. Based on the embodiments in the present disclosure, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present disclosure. It should be noted that, in the case of no conflict, the embodiments in the present disclosure and the features in the embodiments can be combined arbitrarily with each other.

With the development of the network, a variety of security-oriented transmission protocols have emerged, such as:

HTTPS, also known as HTTP over TLS, uses HTTP to communicate, but uses TLS/SSL to encrypt data packets during communication, SSL (Secure Sockets Layer) and Transport Layer Security (TLS) It is a security protocol that provides security and data integrity for network communications. TLS and SSL encrypt network connections between the transport layer and the application layer. HTTPS is an important way to ensure the authenticity of websites, protect user privacy and information security in the Internet field today.

When using a security protocol to provide security services, the server needs to deploy the certificate of the target domain name for the client to authenticate.

However, in reality, there are still a large number of websites using common protocols (such as HTTP) to provide services, and the reason is that content providers are not sensitive to the security of website resources. When a CDN manufacturer provides acceleration services for a content provider's website, because the content provider does not provide the certificate related to the domain name of the website to the CDN manufacturer, the CDN edge node of the CDN manufacturer cannot provide the client with the certificate of the website domain name, and the CDN cannot To provide acceleration services using security protocols, this disclosure defines the acceleration services provided to users by the CDN system using security protocols as security acceleration services. In addition, when the client browser enables domain name mandatory HTTPS access, the client browser will convert the HTTP protocol format request entered by the user into an HTTPS protocol format request. For the edge node, when the edge node receives the HTTPS protocol format request from the client Protocol format request, if the HTTPS protocol format request is for the content of a website that only provides HTTP services for its users, since the edge node does not have the certificate of the website domain name, it cannot establish an encrypted connection with the client, and cannot send information to the client. The HTTPS protocol format request at the end responds with the correct content.

On the other hand, if the content provider hopes that the CDN manufacturer can use HTTPS or QUIC to provide secure acceleration services when the CDN manufacturer provides CDN acceleration services, the content provider needs to provide the SSL certificate of the website domain name to the CDN manufacturer. The process is roughly as follows : Take the security acceleration service as an HTTPS service as an example. The content provider creates the server public key and private key related to the domain name, and then submits the public key and personal or organizational information to the CA (certificate authority) institution for certification application ; After the CA organization passes the audit information, it generates a digital certificate, which includes the applicant's public key, applicant information, CA signature and other information; after receiving the digital certificate, the content provider sends the certificate to the CDN manufacturer. The CDN vendor is responsible for deploying the certificate to the edge nodes. When the client sends a request in the HTTPS protocol format to the CDN edge node, the edge node will send the certificate to the client. After the client authenticates the certificate, it will conduct key negotiation, and then continue to process the request in the HTTPS protocol format. It can be seen that in order to provide the HTTPS service function, the content provider needs to go through tedious procedures.

In order to solve the problems existing in the traditional technology, the present disclosure provides a method for safely accelerating service deployment.

Fig. 1 shows a flowchart of a security acceleration service deployment method according to an exemplary embodiment of the present disclosure. Referring to Figure 1, the security acceleration service deployment method is applied to the certificate management platform. The security acceleration service deployment method includes at least step S11 to step S12, which are described in detail as follows:

Step S11 may be step S11a, when the domain name information or operation information of the target domain name satisfies the security acceleration policy, it is determined to enable the security acceleration service for the target domain name.

The certificate management platform is set up by the CDN manufacturer, and it is set as a device for managing the certificate of the service domain name. It can be a dedicated device or a general server, on which software or codes for certificate management are installed.

The certificate management platform can determine whether the domain name information or operation information of the target domain name meets the security acceleration policy preset on the certificate management platform. If the domain name information or operation information meets the security acceleration policy, it is determined to enable the security acceleration service for the target domain name.

Domain name information includes at least one of top-level domain type and business type.

In an exemplary embodiment, security acceleration policies include but are not limited to:

Provide security acceleration services for domain names of preset top-level domain types and/or preset business types.

For example, if the target domain name is WWW.ABC.GOV, the security acceleration policy is: provide acceleration services for domain names whose top-level domain type is GOV. Then the top-level domain type in the target domain name information satisfies the security acceleration policy, and the certificate management platform determines to enable the security acceleration service for the target domain name WWW.ABC.GOV. Or, determine the business type corresponding to the domain name according to the second-level domain name ABC in the target domain name. For example, if the business type corresponding to the domain name is a financial business, the security acceleration strategy is: to provide acceleration services for domain names whose business type is financial, then: Enable the security acceleration service for the target domain name. In practical applications, it can also be determined based on whether the type of the top-level domain name and the business type corresponding to the second-level domain name satisfy the acceleration policy. Domain name information includes but is not limited to top-level domain type and business type.

The operation information includes at least one of historical times of accessing the security acceleration service of the target domain name and an access trend of accessing the security acceleration service of the target domain name.

In an exemplary embodiment, the security acceleration policy includes: enabling the security acceleration service for domain names whose access times to the security acceleration service are greater than or equal to a preset threshold and/or domain names whose access tendency to the security acceleration service of the target domain name becomes larger.

For example, the security acceleration policy is to enable the security acceleration service for domain names that access the security acceleration service more than or equal to 100 times. For the target domain name WWW.B.COM, the certificate management platform queries the management equipment of the CDN system and obtains the operation log of the target domain name. The edge nodes in the CDN system receive HTTPS://WWW.B.COM requests more than 100 times. Enable the security acceleration service for the target domain name. Another example is to enable the security acceleration service for a domain name whose access tendency to access the security acceleration service becomes larger. By querying the operation log of the target domain name, the edge node in the CDN system receives 80 HTTPS://WWW.B.COM requests. times, but the number of requests within 3 consecutive days were 10, 13, and 17 respectively, indicating that the access trend of the HTTPS security acceleration service for the target domain name became larger, and the security acceleration service was enabled for the domain name WWW.B.COM. The access trend may also be determined according to the ratio of the number of times of accessing the security acceleration service to the total number of times of access in a continuous period of time. For example, in 3 consecutive days, the total number of visits to WWW.B.COM on the first day is 1000, of which HTTPS visits account for 1%, and the total number of visits to WWW.B.COM on the first day is 1580 times, of which HTTPS visits accounted for 1.5%, and the total number of visits to WWW.B.COM on the third day was 1050, of which HTTPS visits accounted for 2%, indicating that access to the HTTPS security acceleration service of the target domain name The access trend of the domain name becomes larger, and the security acceleration service is enabled for the domain name WWW.B.COM.

In an exemplary embodiment, the security acceleration service deployment method further includes:

Get security acceleration policies. The certificate management center can obtain the security acceleration policy set by the management personnel from the CDN management device, and can also obtain the safe driving policy set directly in the certificate management center by the management personnel.

Judging whether the domain name information or operation information of the target domain name satisfies the security acceleration policy.

When the certificate management platform obtains the security acceleration policy and confirms that the security acceleration policy is configured, the certificate management platform will start the judgment mechanism of whether the domain name information or operation information of the target domain name meets the security acceleration policy, so as to judge whether it is enabled for the target domain name in a timely manner. Security acceleration service.

Obtain security acceleration policy;

After receiving the certificate acquisition request of the target domain name sent by the edge node, it is determined whether the domain name information or operation information of the target domain name satisfies the security acceleration policy.

When the certificate management platform obtains the security acceleration policy and determines that the security acceleration policy of the target domain name has been configured, the certificate management platform does not start the judging mechanism for whether the domain name information or operation information meets the security acceleration policy, but waits for the edge node to receive the user After sending a secure connection request to the certificate management platform and sending the certificate acquisition request of the target domain name to the certificate management platform, the judgment mechanism of whether the domain name information or operation information of the target domain name meets the security acceleration policy is started to reduce redundancy without actual access requirements operation to avoid waste of certificate application resources.

In an exemplary embodiment, when the domain name information of the target domain name satisfies the security acceleration policy and it is determined to enable the security acceleration service for the target domain name, the security acceleration service deployment method further includes:

The configuration information includes the domain name, domain name owner or manager related information, the configuration information is the information required to apply for the certificate of the target domain name, and is used to apply for the certificate of the target domain name and enable the security acceleration service for the target domain name.

Content providers provide network content and have their own website domain names for Internet users to visit. The content provider can use the CDN network of the CDN manufacturer to accelerate the website. CDN manufacturers can pre-obtain relevant information such as the content provider's domain name, domain name owner or manager information, etc., in order to configure the CDN network, such as setting the corresponding edge server to provide HTTP acceleration services for the content provider's domain name. For another example, if the content provider decides to use HTTPS service in advance and has applied for a domain name certificate, before the CDN network provides acceleration services, it needs to provide the domain name and domain name certificate to the CDN manufacturer, and the CDN manufacturer deploys the domain name certificate to the edge Among the nodes, the edge node that deploys the certificate of the target domain name can provide the client with the certificate of the target domain name when receiving the HTTPS protocol format request for the target domain name, and communicate with the client after the certificate of the target domain name is verified. Establish an HTTPS connection. If the content provider itself does not provide HTTPS service, or the content provider does not apply for a domain name certificate to provide to the CDN manufacturer, the CDN manufacturer can according to the actual network environment or receive the content provider instructing the CDN manufacturer to provide HTTPS service for the target domain name In this case, the CDN manufacturer can obtain the configuration information of the content provider in advance or on demand when configuring the HTTP acceleration service for the target domain name, so that when the acceleration service for the target domain name needs to be provided, the certificate management platform can independently apply for the target domain name for the content provider. certificate, and provide security acceleration services for the target domain name.

The CDN manufacturer may store the acquired configuration information of the target domain name in the configuration center.

After the certificate management platform determines to enable the security acceleration service for the target domain name, in order to apply for the certificate of the target domain name from the CA institution, it can request the configuration information of the target domain name from the configuration center. Agency sends application information.

In an exemplary embodiment, the security acceleration service includes but is not limited to HTTPS acceleration service or QUIC acceleration service.

The security acceleration service can be an HTTPS acceleration service or a QUIC service. QUIC (Quick UDP Internet Connection) is a UDP-based low-latency Internet transport layer protocol developed by Google, where the transport layer protocol includes TCP and UDP protocols. QUIC combines the features of protocols including TCP, TLS, HTTP/2, etc., but based on UDP transmission, it is a fast and secure transmission protocol.

In addition to the acceleration services of the above-mentioned security protocols, the security acceleration service can also be in the form of other protocols. The security acceleration service provided by this disclosure can be applied to the scenarios where the server needs to provide a certificate during authentication. The CDN manufacturer determines to provide security for the target domain name. When accelerating the service, the certificate management platform applies for a certificate for the target domain name, and deploys the certificate of the target domain name to the edge node to realize the secure acceleration service for the target domain name.

In step S12, apply for the certificate of the target domain name from the CA institution, and deploy the certificate of the target domain name to the edge node.

After the certificate management platform determines to enable the security acceleration service for the target domain name, it actively applies for the certificate of the target domain name from the CA institution, and deploys the certificate of the target domain name to the edge node. The edge node that has deployed the certificate of the target domain name can feed back the certificate of the target domain name to the client when receiving the client’s secure connection request for the target domain name for client authentication, and establish encryption with the client after the authentication is passed. secure connection to improve the security of data content. For website domain names that do not support security protocols, for example, a website only provides HTTP services for its users, the CDN system can judge according to the preset security acceleration policy, and only provide HTTP services for its users if the conditions of the security acceleration policy are met. Serving website content, providing security acceleration services. The process of applying for the certificate of the target domain name by the certificate management center does not require the participation of the content provider at all, reducing the workload of the content provider.

In this exemplary embodiment, the certificate management platform actively acquires the domain name information or operation information of the target domain name, and determines to enable the security acceleration service for the target domain name when the domain name information or operation information meets the security acceleration policy.

In an exemplary embodiment, step S11 may be step S11b. In step S11b, the certificate management platform receives the detection result that the security acceleration service is enabled for the target domain name, and determines to enable the security acceleration service for the target domain name.

In this exemplary embodiment, in addition to storing the configuration information of the target domain name used to apply for the certificate, the configuration center is also configured to store related data. For example, the customer of the CDN service platform (the content provider or the representative of the content provider) checks the option of enabling the security acceleration service for the target domain name through the configuration page, and the configuration data will be stored in the database of the configuration center. Alternatively, the CDN manufacturer determines to enable the security acceleration service for the target domain name according to the network environment, and configures it through the management page, and the configured data will be stored in the database of the configuration center. By detecting the data in the database, the configuration center can obtain the configuration data input by the customer of the above-mentioned CDN service platform, or the data set by the CDN manufacturer, and generate a detection result. The detection result is used to instruct the security acceleration service to be enabled for the target domain name. If the certificate management center receives the detection result that the security acceleration service is enabled for the target domain name from the configuration center, it can directly determine that the security acceleration service is enabled for the target domain name, and execute step S12 to apply for the certificate of the target domain name from the CA institution, and send the certificate of the target domain name Deploy to edge nodes.

The security acceleration policy is formulated by the CDN manufacturer, and can be formulated according to the specific network environment, or according to the instruction information of the customer of the service platform (the content provider or the representative of the content provider). There can be one or more security acceleration policies. When there are multiple security acceleration policies, if any of the security acceleration policies meets the conditions, it can be determined to enable the security acceleration service for the target domain name.

When a CDN manufacturer formulates multiple security acceleration policies, it can also specify a priority for each security acceleration policy. For example, a sequence number can be programmed for each security acceleration policy, and the sequence of the sequence numbers is used as the priority sequence, and the priority of the security acceleration policy with a small sequence number is higher than that of the security acceleration policy with a large sequence number.

For example, a CDN vendor has formulated two security acceleration policies and assigned priorities.

Strategy 1: Enable the security acceleration service for domain names that access the security acceleration service more than or equal to 100 times.

Strategy 2: Enable the security acceleration service for the domain name whose top-level domain name is GOV.

Assume that the target domain name is WWW.ABC.GOV, and the number of accesses to the security acceleration service of HTTPS://WWW.ABC.GOV at the current moment is 55 times.

Because the priority of policy 1 is higher than that of policy 2, when judging whether to enable the security acceleration service for the target domain name, firstly, according to policy 1, the number of query access security acceleration services is 55 times, less than 100 times, and the conditions of policy 1 Not satisfied. Then according to strategy 2, the top-level domain name of the query target domain name is GOV, and the conditions of strategy 2 are met. Make sure to enable the security acceleration service for the target domain name.

For another example, a CDN vendor has formulated two security acceleration policies and assigned priorities.

Strategy 1: Enable the security acceleration service for the domain name whose top-level domain name is GOV.

Strategy 2: Enable the security acceleration service for domain names whose access times to the security acceleration service are greater than or equal to the preset threshold.

Assume that the target domain name is WWW.ABC.GOV, and the number of accesses to the HTTPS://WWW.ABC.GOV security acceleration service at the current moment is 55 times.

Since the priority of policy 1 is higher than that of policy 2, when judging whether to enable the security acceleration service for the target domain name, first, according to policy 1, the top-level domain name of the query target domain name is GOV, and the conditions of policy 1 are met. Make sure to enable the security acceleration service for the target domain name. It is no longer necessary to query the number of accesses to the security acceleration service according to policy 2.

It can be seen that different priorities are specified for multiple security acceleration policies. When judging whether to enable the security acceleration service for the target domain name, you can query whether the corresponding conditions are met according to each security policy in order of priority from high to low, until The conditions of a security policy are met or the conditions corresponding to each security policy are queried. In addition, under the same conditions, the priorities of multiple security acceleration policies are different, the query process is different, and the query time consumed may also be different. Therefore, in practical applications, a reasonable priority order can be formulated for multiple security acceleration policies according to different application environments, so as to shorten the query process and reduce the time-consuming query.

CDN manufacturers can formulate relevant security acceleration policies at the initial stage of providing services for target domain names, or formulate new security acceleration policies according to actual network environments or management decisions during the process of providing services for target domain names, or, for Adjust or delete the established security acceleration policies. Those skilled in the art should understand that, in addition to the above security acceleration policies, other security acceleration policies can also be formulated.

In an exemplary embodiment, applying for the certificate of the target domain name from a CA institution, and deploying the certificate of the target domain name to the edge node includes:

Generate public and private keys for the target domain name;

Send the public key and configuration information to the CA;

Receive the certificate of the target domain name issued by the CA institution;

Before applying for a certificate for the target domain name, the certificate management platform generates the public key and private key of the target domain name.

The certificate management platform generates the corresponding public key and private key for the target domain name in order to apply for a domain name certificate for the target domain name.

Send the public key and the configuration information of the target domain name to the CA organization, and apply for the certificate of the target domain name from the CA organization. After the certificate management platform generates the public key and private key of the target domain name, it sends the public key and related information of the target domain name to the CA, and then it can apply for the certificate of the target domain name from the CA.

Receive the certificate of the target domain name issued by the CA institution.

The certificate management platform can directly receive the certificate of the target domain name from the CA institution, or can receive the certificate of the target domain name from the CDN management device after the CA institution provides the certificate of the target domain name to the CDN manufacturer.

After receiving the certificate of the target domain name issued by the CA institution, the certificate management platform stores the certificate of the target domain name locally, and sends the certificate and private key of the target domain name to the edge node, so that the edge node starts the security acceleration service of the target domain name.

In an exemplary embodiment, the certificate management platform can send the certificate and private key of the target domain name to all edge nodes in the system. Realize the deployment of security acceleration services on all edge nodes in the system, and any edge node can provide security acceleration services for the target domain name. In another exemplary embodiment, according to the deployment strategy, edge nodes in a specified range can also be implemented as The target domain name provides security acceleration services.

In an exemplary embodiment, the certificate management platform receives the certificate acquisition request of the domain name sent by the edge node, and sends the certificate and private key of the target domain name to the edge node. In this exemplary embodiment, only the certificate of the target domain name is fed back to the edge node that sends the certificate acquisition request segment, and there is no need to deploy the certificate of the target domain name to all edge nodes, reducing the workload and cost of security acceleration service deployment.

After the edge node obtains the certificate and private key of the target domain name from the certificate management platform, it stores the certificate and private key of the target domain name in this node. After receiving the secure connection request from the client for the target domain name, the edge node sends the certificate of the target domain name to the client. The certificate of the target domain name includes the public key of the target domain name, applicant information, CA signature and other information. Thus, the client has the public key of the target domain name, and the edge node has the private key of the target domain name. Afterwards, the two parties can conduct key negotiation and encrypt a secure connection, and the edge node responds to the client's request through a secure connection.

In this exemplary embodiment, the certificate management platform obtains the configuration information of the target domain name, and uses the public key of the target domain name and related information to apply for a domain name certificate for the target domain name. The content provider only needs to provide the configuration information of the target domain name to the CDN manufacturer, and when the target domain name needs to provide security acceleration services, the certificate management platform of the CDN manufacturer can apply for a domain name certificate for the target domain name, avoiding the need for the content provider to apply for a domain name The cumbersome process of certificates.

The CDN manufacturer's certificate management platform can automatically deploy the certificate of the target domain name to the edge node, and the edge node provides security acceleration services for the content provider's target domain name, even if the content provider's website domain name If the provider has not applied for a certificate for the domain name of the website, when the CDN manufacturer provides CDN acceleration services for it, it can still provide security acceleration services for content providers and improve website security. For clients using mandatory HTTPS or QUIC browsers, normal services can also be provided, further improving the service quality of content providers and improving the experience of visiting users.

In an exemplary embodiment, after obtaining the certificate of the target domain name issued by the CA institution, the security acceleration service deployment method further includes:

The certificate of the domain name is set to have a valid period, and the certificate of the domain name within the valid period can be trusted by the client browser, verified as a valid certificate by the browser, and then establish a secure connection with the server that owns the certificate of the domain name. Once the domain name's certificate expires, the client browser will not be able to establish a connection with the server that has the domain name's certificate. Therefore, the certificate management platform needs to manage the domain name certificate obtained from the CA organization, monitor the validity period of the domain name certificate, and apply for a new certificate for the target domain name within the preset period before the target domain name certificate expires. In this exemplary embodiment, the preset time period may be 1 day, 2 days, or other lengths, which may be determined according to the period of applying for a domain name certificate.

In an exemplary embodiment, applying to a CA institution for a new certificate of the target domain name includes:

Regenerate a new public key and a new private key for the target domain name;

The certificate management platform can generate a new public key and a new private key for the target domain name within the preset period before the target certificate expires, send the new public key and the relevant information of the target domain name to the CA organization, and apply to the CA organization Certificate for the new domain name.

The certificate of the domain name is managed by the certificate management platform of the CDN manufacturer, and the renewal of the certificate is completed by the CDN manufacturer independently, reducing the workload of the content provider.

When the certificate of the target domain name has security risks, a revocation request is sent to the CA institution, so that the CA institution revokes the certificate of the target domain name.

In the process of using the certificate of the target domain name, there may be various risks, for example: the private key of the target domain name is lost, and the server with the certificate will not be able to negotiate the key with the client and establish an HTTPS connection; or, the private key of the target domain name Key leakage, when the private key generated by the CDN manufacturer for the target domain name is leaked, it will threaten the security of the website or CDN system. Alternatively, if the CA or CDN considers that the private key of the target domain name may be cracked, the certificate management platform can send a certificate revocation request to the CA at any time. After the CA revokes the certificate of the target domain name, the certificate of the domain name will no longer be trusted , even if the domain name's certificate is within the validity period, it is still unavailable. In this way, the security risks caused to the website after the private key of the target domain name is leaked are avoided.

After the certificate management platform applies for the certificate of the target domain name, it is responsible for managing the certificate of the target domain name, further reducing the work of the content provider.

Fig. 2 is a flowchart of a method for deploying a security acceleration service according to an exemplary embodiment. Referring to FIG. 2, the security acceleration service deployment method is applied to the configuration center, and the security acceleration service deployment method includes at least steps S21-step S22, which are described in detail as follows:

In step S21, receiving the instruction information of enabling the security acceleration service of the target domain name, and sending the detection result of enabling the security acceleration service of the target domain name to the certificate management platform.

If the content provider itself does not provide a secure connection service, or the content provider does not apply for a domain name certificate, the certificate management center can obtain the content provider's configuration information for the target domain name from the configuration center, such as the content provider's company name, Manager information, etc. of the content provider.

In an exemplary embodiment, the acquired configuration information of the target domain name may be used to configure security acceleration services for the target domain name, including: domain name, domain name owner or manager related information.

By obtaining the configuration information of the target domain name stored locally, so that the CDN manufacturer can provide acceleration services for the target domain name, according to the actual network environment, or receive the situation that the content provider instructs the CDN manufacturer to provide security acceleration services for the target domain name Under the following circumstances, when it is necessary to provide security acceleration services for the target domain name, you can use the relevant configuration information of the target domain name to apply for a certificate from the CA organization to provide security acceleration services for the target domain name. Involvement of Content Providers.

In order to receive the instruction information from the content provider in time, the CDN manufacturer can provide the customer with a configuration page, and set it so that the customer can send the instruction information to the CDN manufacturer at any time. The configuration page is connected to the configuration center, and the information entered by the customer through the configuration page can be stored in the database of the configuration center. The CDN manufacturer can also set the management page to issue instructions to the configuration center.

If the configuration center receives an instruction message to enable the security acceleration service of the target domain name, for example, the customer of the CDN system (the content provider or the representative of the content provider) checks the corresponding option on the platform provided by the configuration center to send a request to the configuration center. command information; it can also send command information to the management personnel of the CDN manufacturer through other means, and then the management personnel enter the command information into the configuration center; it can also be that the CDN management personnel conduct a security assessment on the target domain name and find that there may be network attacks Risk, determine to enable the security acceleration service for the target domain name, and send instruction information to the configuration center through the management device. The configuration center can obtain data related to the instruction information through the detection database, and generate corresponding detection results, which are used to instruct the target domain name to enable the security acceleration service.

The configuration center sends the detection result of enabling the security acceleration service for the target domain name to the certificate management platform, so as to notify the certificate management platform to enable the security acceleration service for the target domain name.

In step S22, the request information for acquiring the configuration information of the target domain name is received from the certificate management platform, and the configuration information of the target domain name is sent to the certificate management platform.

When the certificate management platform determines to enable the security acceleration service for the target domain name according to the security acceleration policy, or the certificate management platform receives the detection result of the target domain name’s security acceleration service from the configuration center, it will send the configuration information to the configuration center to obtain the target domain name so that the configuration information of the target domain name can be used to apply for a certificate from the CA. When the configuration center receives the request information from the certificate management platform to obtain the target domain name, it sends the configuration information to the certificate management platform.

After the configuration center determines that the security acceleration service needs to be enabled for the target domain name, it sends the configuration information of the target domain name to the certificate management platform, so that the certificate management platform applies for a domain name certificate from the CA institution.

In this exemplary embodiment, the configuration center is configured to manage the configuration information of the target domain name, and provide the configuration information to the certificate management platform when the certificate management platform needs to apply for a certificate for the target domain name, so as to prevent configuration information leakage. The configuration center is also set to receive instruction information from the customer or the CDN management platform, and provide detection results related to the instruction information to the certificate management platform, so that the certificate management platform determines to enable the security acceleration service for the target domain name, and applies for a certificate of the target domain name. The certificate management platform does not receive external information to ensure the security of the certificate.

Based on the technical solutions of the above exemplary embodiments, a specific application scenario of the embodiments of the present disclosure is introduced as follows:

Companies A and B are content providers, and their website domain names are domain name A and domain name B respectively. The companies are not sensitive to the security of website content and only provide HTTP services for their users. The user can only get the content of the response by sending an HTTP request to the website. If a request in the HTTPS protocol format is sent, the website will disconnect from the client. For example: the user accesses the file 1.jpg on the website of company A, and the user accesses HTTP://A/1.jpg through the browser, and the user can obtain the 1.jpg file; if the user enters HTTPS://A/1.jpg , the user cannot get the requested content.

Companies A and B accelerate website content through the CDN network, and will provide domain name configuration information to the CDN manufacturer in advance, such as the domain name of the website, company name of the content provider, administrator information, etc. This allows CDN vendors to independently apply for domain name certificates when they determine to provide secure acceleration services for domain names.

The CDN manufacturer stores the configuration information of domain name A and domain name B in the configuration center.

CDN vendors formulate security acceleration strategies:

Strategy 2: Provide security acceleration services for financial business domain names.

Policy 2 has a higher priority than Policy 1.

The certificate management platform first judges whether domain names A and B are financial business types. If the domain name information of domain name A and domain name B does not meet the preset security acceleration policy, the security acceleration service will not be enabled for domain name A and domain name B.

The certificate management platform obtains the operation data of domain name A and domain name B. In the operation data of domain name A, the number of visits to the security acceleration service HTTPS://A is greater than 100 times, the conditions of policy 1 are met, and the certificate management platform determines that domain name A Enable the security acceleration service. The certificate management platform sends a request to obtain the configuration information of the domain name A to the configuration center, and receives the configuration information of the domain name A fed back by the configuration center. Then the certificate management platform starts to apply for the certificate of domain name A from the CA institution. The certificate management platform generates a public key and a private key for domain name A, and sends the public key of domain name A and the configuration information of domain name A to the CA organization to apply for a domain name certificate for domain name A.

In the operational data of domain name B, the number of accesses to the security acceleration service HTTPS://B is less than 100 times, and for domain name B, the conditions of policy 1 are not met. The certificate management platform determines not to enable the security acceleration service for domain name B.

During the operation process, Company B believes that it is necessary to enable the security acceleration service for domain name B based on the operation of the website. After logging in to the configuration page provided by the CDN manufacturer, and checking the option of enabling security acceleration service for domain name B on the configuration page, it submits the command information. After the configuration center detects the corresponding data, it sends the detection result to the certificate management platform, and the detection result indicates that the security acceleration service is enabled for the domain name B. The certificate management platform determines to enable the security acceleration service for domain name B after receiving the detection result that domain name B has enabled the security acceleration service. The certificate management platform sends a request to obtain the configuration information of the domain name B to the configuration center, and receives the configuration information of the domain name B fed back by the configuration center. Then the certificate management platform starts to apply for the certificate of domain name B from the CA institution.

In an exemplary embodiment, after obtaining the configuration information of the domain name B, the configuration center synchronizes the domain name, domain name owner or manager related information therein to the certificate management platform.

The certificate management platform generates a public key and a private key for domain name B, and sends the public key of domain name B and the configuration information of domain name B to the CA organization to apply for a domain name certificate for domain name B.

According to the above exemplary embodiments, the security acceleration service deployment method provided by the present disclosure can automatically provide security acceleration services for the domain name of the content provider by the certificate management platform of the CDN manufacturer according to the security acceleration policy, without requiring the content provider to carry out cumbersome Certificate application.

Fig. 3 is a block diagram of an apparatus for deploying a security acceleration service according to an exemplary embodiment. Referring to FIG. 3 , the security acceleration service deployment device is applied to a certificate management platform, and includes a security acceleration service opening module 301 and a certificate management module 302 .

The security acceleration service activation module 301 is configured to determine that the security acceleration service is enabled for the target domain name when the domain name information or operation information of the target domain name meets the security acceleration policy, or receives the detection result that the security acceleration service is enabled for the target domain name.

The certificate management module 302 is configured to apply for a certificate of the target domain name from a CA institution, and deploy the certificate of the target domain name to the edge node.

Fig. 4 is a block diagram of an apparatus for deploying a security acceleration service according to an exemplary embodiment. Referring to FIG. 4 , the security acceleration service deployment device further includes a configuration information request module 401 .

The configuration information request module 401 is configured to send request information for obtaining configuration information of the target domain name to the configuration center, and receive configuration information of the target domain name.

Fig. 5 is a block diagram of an apparatus for deploying a security acceleration service according to an exemplary embodiment. Referring to FIG. 5 , the security acceleration service deployment device is applied to a configuration center, and includes: an information management module 501 and a configuration information sending module 502 .

The information management module 501 is configured to receive the instruction information of enabling the security acceleration service of the target domain name, and send the detection result of enabling the security acceleration service of the target domain name to the certificate management platform.

The configuration information sending module 502 is configured to send the configuration information to the certificate management platform.

Fig. 6 is a block diagram of a computer device 600 for deploying a security acceleration service according to an exemplary embodiment. For example, computer device 600 may be provided as a server. Referring to FIG. 6 , a computer device 600 includes a processor 601 , and the number of processors can be set to one or more as required. The computer device 600 also includes a memory 602 configured to store instructions executable by the processor 601 , such as application programs. The number of memories can be set to one or more as required. It can store one or more applications. The processor 601 is configured to execute instructions, so as to execute the above security acceleration service deployment method.

Those skilled in the art should understand that the embodiments of the present disclosure may be provided as a method, an apparatus (device), or a computer program product. Accordingly, the present disclosure can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present disclosure may take the form of a computer program product embodied on one or more computer-usable storage media having computer-usable program code embodied therein. Computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology arranged to store information, such as computer readable instructions, data structures, program modules, or other data, including but not limited to RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cartridges, tape, magnetic disk storage or other magnetic Desired information and any other media that can be accessed by a computer, etc. In addition, as is well known to those of ordinary skill in the art, communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media .

The present disclosure is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (devices) and computer program products according to embodiments of the present disclosure. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

In this disclosure, the terms "comprises", "comprises" or any other variation thereof are intended to cover a non-exclusive inclusion such that an article or device comprising a series of elements includes not only those elements but also items not expressly listed. Other elements, or also include elements inherent in the article or equipment. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the article or device comprising said element.

Having described exemplary embodiments of the present disclosure, additional changes and modifications may be made to these embodiments by those skilled in the art once the basic inventive concept is appreciated. Therefore, it is intended that the appended claims be interpreted to cover the exemplary embodiments and all changes and modifications that fall within the scope of the present disclosure.

Obviously, those skilled in the art can make various changes and modifications to the present disclosure without departing from the spirit and scope of the present disclosure. In this way, if these modifications and variations of the present disclosure fall within the scope of the claims of the present disclosure and equivalent technologies thereof, the intent of the present disclosure is to also include these modifications and variations.

Industrial Applicability

In the security acceleration service deployment method, device, medium and equipment provided by the present disclosure, HTTPS or QUIC security acceleration functions can be automatically implemented for the content provider’s website that only provides HTTP services for its users, without requiring the content provider to apply for a domain name The certificate does not require the content provider to manage and update the certificate, so as to speed up the deployment of security acceleration services for the domain name of the content provider; after the content provider deploys HTTP services on the certificate management platform, the certificate management platform will use the security acceleration policy It is decided whether to provide security acceleration services, and if necessary, the certificate management platform will independently apply for a certificate from the CA institution, and this process does not require the participation of the content provider and is completely transparent to the content provider.

Claims

A security accelerated service deployment method applied to a certificate management platform, including:

When the domain name information or operation information of the target domain name satisfies the security acceleration policy, or, upon receiving the detection result of enabling the security acceleration service for the target domain name, determine to enable the security acceleration service for the target domain name;

Apply for the certificate of the target domain name from the CA institution, and deploy the certificate of the target domain name to the edge node;

Wherein, the domain name information includes at least one of the top-level domain type and business type; the operation information includes the historical number of accesses to the security acceleration service of the target domain name, the access trend of the security acceleration service of the target domain name at least one of .
The security acceleration service deployment method according to claim 1, further comprising:

Obtain the security acceleration policy;

Judging whether the domain name information or operation information of the target domain name satisfies the security acceleration policy; or, after receiving the certificate acquisition request of the target domain name sent by the edge node, judging whether the domain name information or operation information of the target domain name satisfies The security acceleration strategy.
The security acceleration service deployment method according to claim 1, wherein the security acceleration policy comprises:

Provide security acceleration services for domain names of preset top-level domain types and/or preset business types; or,

The security acceleration service is enabled for domain names whose access times to the security acceleration service are greater than or equal to a preset threshold and/or domain names whose access trend to the security acceleration service of the target domain name becomes larger.
The security acceleration service deployment method according to claim 1, wherein after said determining to enable the security acceleration service for the target domain name, further comprising:

Sending request information for acquiring configuration information of the target domain name to the configuration center, and receiving configuration information of the target domain name.
The security acceleration service deployment method according to claim 1, wherein said applying for the certificate of the target domain name from a CA institution, and deploying the certificate of the target domain name to the edge node comprises:

generating a public key and a private key for the target domain name;

Send the public key and the configuration information to the CA institution;

receiving the certificate of the target domain name issued by the CA;

Sending the certificate of the target domain name and the private key to the edge node, so that the edge node provides the security acceleration service of the target domain name.
The security acceleration service deployment method according to claim 1, wherein, after obtaining the certificate of the target domain name issued by the CA institution, further comprising:

Applying to the CA institution for a new certificate of the target domain name within a preset period before the expiration time of the certificate of the target domain name.
The security acceleration service deployment method according to claim 6, wherein said applying to said CA institution for a new certificate of said target domain name comprises:

regenerate a new public key and a new private key for said target domain name;

Send the new public key and configuration information of the target domain name to a CA institution, and apply for a certificate of the target domain name from the CA institution.
The security acceleration service deployment method according to claim 1, wherein, after obtaining the certificate of the target domain name issued by the CA institution, further comprising:

If the certificate of the target domain name has security risks, send a revocation request to the CA institution.
The security acceleration service deployment method according to any one of claims 1-8, wherein the security acceleration service includes HTTPS acceleration service or QUIC acceleration service.
A method for safely accelerating service deployment, applied to a configuration center, including:

receiving the instruction information of enabling the security acceleration service for the target domain name, and sending the detection result of enabling the security acceleration service for the target domain name to the certificate management platform;

Receive request information for acquiring configuration information of the target domain name from the certificate management platform, and send configuration information of the target domain name to the certificate management platform.
The security acceleration service deployment method according to claim 10, wherein the configuration information of the target domain name is used to configure the security acceleration service for the target domain name, including: domain name, domain name owner or manager related information.
A security acceleration service deployment device, applied to a certificate management platform, comprising:

The security acceleration service opening module is configured to enable the security acceleration service for the target domain name when the domain name information or operation information of the target domain name satisfies the security acceleration policy, or receives the detection result that the target domain name opens the security acceleration service;

The certificate management module is configured to apply for the certificate of the target domain name from the CA institution, and deploy the certificate of the target domain name to the edge node.
The security acceleration service deployment device according to claim 12, further comprising:

The configuration information requesting module is configured to send request information for obtaining configuration information of the target domain name to the configuration center, and receive configuration information of the target domain name.
A security acceleration service deployment device, applied to a configuration center, comprising:

The information management module is configured to receive instruction information for enabling the security acceleration service of the target domain name, and send the detection result of enabling the security acceleration service for the target domain name to the certificate management platform;

The configuration information sending module is configured to send the configuration information to the certificate management platform.
A computer-readable storage medium, on which a computer program is stored, wherein when the computer program is executed, the steps of the method according to any one of claims 1-11 are realized.
A computer device, comprising a processor, a memory and a computer program stored on the memory, wherein the steps of the method according to any one of claims 1-11 are implemented when the processor executes the computer program.