WO2017000676A1 - Method for verifying the validity of digital certificate and authentication server therefor - Google Patents

Abstract

Provided is a method for verifying the validity of a digital certificate, which falls within the technical field of network security and solves the technical problem that the current method for verifying a digital certificate does not facilitate extension. The method relates to an authentication server comprising a message receiving module and a digital certificate verification module, wherein a verification scheme configuration unit is provided in the digital certificate verification module and sets a configuration so as to configure a verification scheme for verifying the validity of a digital certificate; the message receiving module receives a digital certificate authentication request message containing a digital certificate content, and submits the received digital certificate content to the digital certificate verification module for verification; if the verification of the validity of the digital certificate according to the selected verification scheme cannot be passed, it is determined that the verification of the validity of the digital certificate has failed; otherwise, it is determined that the verification of the validity of the digital certificate has succeeded. The method realizes the extension of a digital certificate verification scheme. Correspondingly, also provided is an authentication server.

Description

Method for verifying validity of digital certificate and authentication server thereof

This application claims priority to Chinese Patent Application No. 201510381509.X, filed on July 2, 2015, entitled "A Method for Verifying the Validity of Digital Certificates and Its Authentication Server", all of which The content is incorporated herein by reference.

Technical field

The present invention relates to the field of network security technologies, and in particular, to a method for verifying the validity of a digital certificate and an authentication server thereof.

Background technique

Currently, in a WLAN based on the WLAN Authentication and Privacy Infrastructure (WAPI) protocol, an authentication server entity (Authentication Service Entity, ASE for short) receives only a digital certificate after receiving a certificate authentication request. The format is correct and verified if it is revoked. The verification process involves the use of complex cryptography techniques such as digital signature verification in digital certificates. It requires a lot of computing resources. If a hacker randomly collects an invalid digital certificate and sends it to ASE continuously, it will successfully occupy a large amount of ASE computing resources and Time, forming a valid Denial of Service (DOS), causing other legitimate users to communicate with ASE. At the same time, because the verification content does not verify whether the digital certificate is used within the scope of the business defined by the digital certificate issuer when the digital certificate is issued, the hacker may use a digital certificate legally authorized in one field for other non-authorized areas, resulting in an information security incident. .

In short, the current digital certificate verification method is usually relatively fixed and single, and does not consider how to expand subsequently, and there is a certain security risk.

Summary of the invention

In order to solve the above technical problem, the present invention provides the following technical solutions:

A method for verifying the validity of a digital certificate, the method comprising an authentication server, the authentication server comprising a message receiving module and a digital certificate verification module, wherein the digital certificate verification module is provided with an authentication scheme configuration unit, and the verification scheme configuration unit performs Configuration settings for configuring a verification scheme to verify the validity of a digital certificate;

The message receiving module receives a digital certificate authentication request message, where the digital certificate authentication request message includes digital certificate content; the message receiving module submits the received digital certificate content to the digital certificate verification module for verification; The digital certificate verification module selects a corresponding verification scheme from the verification schemes configured in the verification scheme configuration unit to perform a specific verification process according to the verification requirement;

If the validity verification of the digital certificate fails according to the selected verification scheme, it is determined that the digital certificate validity verification fails; otherwise, the digital certificate validity verification is determined to be successful.

In addition, the present invention also provides an authentication server for verifying the validity of a digital certificate, which includes a message receiving module and a digital certificate verification module, wherein the digital certificate verification module includes a verification scheme configuration unit;

The message receiving module is configured to receive a digital certificate authentication request packet;

The verification scheme configuration unit is configured to configure a verification scheme for verifying the validity of the digital certificate.

The technical solution provided by the invention greatly reduces the complexity of the authentication server adding and deleting the verification scheme, and the verification scheme configuration unit realizes the effective configuration and control of the authentication server when multiple verification schemes are involved, which is helpful for the verification scheme. The expansion, modification and deletion operations; in addition, by verifying the validity of the digital certificate by using the configured verification scheme, the efficiency of digital certificate verification is also improved.

DRAWINGS

1 is a schematic flow chart of a method provided by the present invention;

2 is a schematic flow chart of a first embodiment of the present invention;

3 is a schematic flowchart of Embodiment 2 of the present invention;

4 is a schematic flowchart of a third embodiment of the present invention;

FIG. 5 is a schematic diagram of a network topology according to an embodiment of the present invention;

FIG. 6 is a schematic structural diagram of an authentication server according to an embodiment of the present invention.

detailed description

The method for verifying the validity of a digital certificate provided by the present invention and its authentication server will be described in more detail below with reference to the accompanying drawings and embodiments.

As shown in FIG. 1 and FIG. 6 , the method for verifying the validity of a digital certificate provided by the present invention relates to an authentication server, where the authentication server includes a message receiving module and a digital certificate verification module, and the method specifically includes:

S100. The digital certificate verification module is configured with an authentication scheme configuration unit, where the verification scheme configuration unit performs configuration setting for configuring an authentication scheme for verifying validity of the digital certificate.

S200, the message receiving module receives a digital certificate authentication request message, where the digital certificate authentication request message includes digital certificate content; and the message receiving module submits the received digital certificate content to the digital certificate verification module for verification. The digital certificate verification module selects a corresponding verification scheme from the verification schemes configured in the verification scheme configuration unit to perform a specific verification process according to the verification requirement;

S300. If the validity verification of the digital certificate fails according to the selected verification scheme, determining that the digital certificate validity verification fails; otherwise, determining that the digital certificate validity verification is successful.

Preferably, the authentication server may further include a digital certificate parsing module configured to parse the digital certificate authentication request packet to obtain the digital certificate content.

Preferably, the configuration is set to create a verification scheme database table, the verification scheme database table includes a verification item field and a switch value field, the verification item field is used to identify a verification scheme; and the verification scheme is enabled by setting a switch value To achieve, when the switch value is on, the corresponding verification scheme is enabled; when the switch value is set to off, the corresponding verification scheme is not enabled.

Preferably, the verification scheme in S100 may be a combination of at least any two of the verification schemes such as whitelist list verification, blacklist list verification, digital certificate format and revocation status verification, and digital certificate use range verification. The verification scheme is configured by the verification scheme configuration unit using the verification scheme configuration database table, and the verification scheme configuration unit configured with the foregoing verification scheme further includes a whitelist list verification subunit, a blacklist list verification subunit, and a digital certificate format. And the revocation status verification subunit, the digital certificate usage range verification subunit, and the digital certificate usage range verification subunit. The scope of use of the digital certificate refers to whether the issuer of the digital certificate has the authority to issue a digital certificate in a certain scope of use or the credibility of the issuer of the digital certificate within a certain scope of use or whether the digital certificate itself is qualified at the time of issuance. Permissions used within a scope of use. At the same time, the verification scheme configuration unit is provided with a switch value to determine whether the corresponding verification sub-unit is turned on. Generally, when the switch value is set to 1, it means to be on, and when the switch value is set to 0, it means to be off. The verification scheme configuration unit has a function of establishing a verification scheme configuration database table, adding and deleting an authentication scheme, and configuring a verification scheme.

Specifically, as shown in Table 1, the verification scheme configuration unit creates a verification scheme configuration database table, where the verification scheme configuration database table includes a sequence number field, a verification item field, and a switch value field. The sequence number field is a primary key, and the sequence number value is automatically incremented. The sequence number field can be used to identify the execution order of the corresponding verification scheme (eg, 1 indicates the first verification content, 2 indicates the second verification content, etc.); the verification item field is used for The digital certificate verification scheme supported by the verification scheme configuration unit is configured, and the verification scheme identified by the verification item field may be adjusted to the location identified by the corresponding serial number field according to the verification sequence required by the local verification policy.

Serial number	Verification project	Switch value
1	Whitelist verification	0 or 1
2	Blacklist verification	0 or 1

3	Digital certificate format and revocation status verification	0 or 1
4	Digital certificate use scope verification	0 or 1
...	...	...

Table I

Preferably, the database table may further include a verification order field (in this case, the sequence number field is only a sequence number identifier), as shown in Table 2, by configuring a priority order such as 1, 2 in the verification order field, 3, etc., to identify the execution order of the corresponding verification scheme.

Table II

The digital certificate verification scheme may specifically include a combination of at least any two of a whitelist list verification, a blacklist list verification, a digital certificate format and a revocation status verification, and a digital certificate application range verification, that is, the verification scheme configuration unit further Includes whitelisted list verification subunit, black The list list verification subunit, the digital certificate format and the revocation status verification subunit, and the digital certificate application range verification subunit. The switch value field indicates whether the verification scheme of the verification item field identification is enabled. The specific verification scheme of the verification item field identifier in the verification scheme configuration database table can be flexibly added, modified, and deleted; wherein the value of each corresponding switch value field is used to indicate whether the corresponding verification scheme is enabled, usually, When the value of the switch value field is 0, it means that the corresponding verification item is turned on. When the value of the switch value field is 1, it means that the corresponding verification item is closed. Of course, the value of the switch value field may be set to 1 to indicate that the corresponding verification item is enabled, and when the value of the switch value field is 0, the corresponding verification item is closed, and the present invention does not limit the setting of the value of the switch value field. .

Preferably, the configuration setting may also configure the verification scheme by means of XML. That is, the verification scheme configuration unit exists in an XML format configuration file, which includes a sequence number element, a verification item element, a verification order element, and a switch value element. The switch value element is used to determine whether the corresponding verification subunit is turned on. Generally, when the switch value element is set to 1, it means to be turned on, and when the switch value element is set to 0, it means to be turned off, and the verification scheme configuration unit can modify the XML configuration file. The way the element is used to add, modify, and delete the verification scheme. An example of the configuration file for configuring the authentication scheme by XML is as follows:

<item>

<Serial number>1<No.

<Verification Item> Whitelist List Verification</ verification item>

<Verification order> 2</ verification order>

<switch value>0 or 1</switch value>

</item>

<item>

<Serial number>2<No.

<Verification Item> Blacklist List Verification</ verification item>

<Verification sequence>3</ verification order>

<switch value>0 or 1</switch value>

</item>

<item>

<Serial number>3<No.

<Verification Project> Digital Certificate Format and Revocation Status Verification</ verification item>

<Verification sequence> 4</ verification order>

<switch value>0 or 1</switch value>

</item>

<item>

<Serial number>4<No.

<Verification Project> Digital Certificate Use Scope Verification</ verification project>

<Verification sequence>1</ verification order>

<switch value>0 or 1</switch value>

</item>

The invention realizes the multiple verification parties in the authentication server by using the configuration setting of the verification scheme. Effective configuration and control of the case, the configuration of the verification scheme using the verification scheme configuration unit helps to identify the flexible addition, modification and deletion of the server verification scheme.

The specific implementation process of the present invention will be described in detail below with reference to FIG. 2, FIG. 3, FIG. 4, and FIG.

Embodiment 1

As shown in FIG. 2 and FIG. 5, the digital certificate use range verification subunit and the digital certificate format and the revocation status verification subunit are turned on in the verification scheme configuration unit. The specific verification process is described in detail below. Taking the WAPI network architecture as an example, after the message receiving module receives the digital certificate authentication request packet sent by the access point AP, the digital certificate analysis module parses the digital certificate authentication request packet to obtain a digital certificate content. And submitting the parsed digital certificate content to the digital certificate verification module, first performing verification by the digital certificate use range verification subunit in the digital certificate verification module. Specifically, the digital certificate use scope verification sub-unit creates a digital certificate use range table, as shown in Table 3, the digital certificate use scope table includes a sequence number field, a digital certificate identifier field, and a use range field, where the sequence number field It is the primary key, and the serial number value is automatically incremented; the digital certificate identification field indicates the digital certificate identification content, and the digital certificate identifier may be a combination of the certificate serial number and the issuer name in the digital certificate, or only the certificate serial number.

Serial number	Digital certificate identification	Scope of use
1	Certificate Serial Number 1 + Issuer Name	Range 1 / Range 2 / Range 1 / Range 4...
2	Certificate Serial Number 2+ Issuer Name	Range 1 / Range 2 / Range 1 / Range 4...
3	Certificate Serial Number 3+ Issuer Name	Range 1 / Range 2 / Range 1 / Range 4...
4	Certificate Serial Number 4+ Issuer Name	Range 1 / Range 2 / Range 1 / Range 4...
...	...	...

Table 3

The digital certificate use scope verification subunit executable SQL query statement whether the use scope of the digital certificate is queried in the use range field, and is judged according to the return value of the SQL query statement;

If the digital certificate included in the digital certificate authentication request packet can be queried in the use scope field to meet the scope of use specified in the digital certificate issuance, the digital certificate use scope verification sub-unit verifies that the digital certificate use range is successful, otherwise, The digital certificate uses the range verification sub-unit to verify that the digital certificate usage range fails. Among them, the digital certificate use range record can be added or deleted. The information that the authentication server adds or deletes the digital certificate usage range record may be from a digital certificate issuing entity or a network administrator, and the present invention does not limit this.

In other words, if the digital certificate use scope verification subunit determines that the digital certificate included in the digital certificate authentication request packet does not meet the scope of use specified in the digital certificate issuance, the digital certificate verification result obtained by the digital certificate verification module is a failure, and then passes The message sending module constructs a certificate authentication response packet sent to the AP to notify the digital certificate verification result or the use range of the digital certificate; if the digital certificate use range verification subunit determines that the digital certificate included in the digital certificate authentication request packet meets the requirements specified in the digital certificate issuance Use the scope, continue to the next verification.

It is then verified by the digital certificate format and the revocation status verification sub-unit, specifically:

The digital certificate parsing module parses the digital certificate authentication request packet to acquire related information of a digital certificate, and the digital certificate format and the revocation status verification subunit verify whether the information format of the digital certificate is related to a format known by the authentication server Consistently, if the inconsistency, the digital certificate format and the revocation status verification fail. If they are consistent, the digital certificate format and the revocation status are successfully verified; the information format of the digital certificate in the present invention is based on the digital certificate standard of X.509;

Or the authentication server calculates, by using a public key of the digital certificate, a signature value of the digital certificate in the digital certificate authentication request packet parsed by the parsing module, where the digital certificate format and the revocation status verification subunit calculate Whether the signature value and the signature value of the digital certificate are the same. If they are not the same, the digital certificate format and the revocation status verification fail. If they are the same, the digital certificate format and the revocation status verification are successful.

Alternatively, the digital certificate format and the revocation status verification subunit verify the current time of the authentication server and the valid time range of the received digital certificate, if the current time of the authentication server is not within the valid range of the received digital certificate, Digital certificate format and revocation status verification failed; otherwise, digital certificate format and revocation status verification succeeded;

Alternatively, the digital certificate format and the revocation status verification subunit verify whether the status of the received digital certificate stored by the authentication server is marked as revoked, and if marked as revoked, the digital certificate format and the revocation status verification fail. Otherwise, the digital certificate format and revocation status are verified successfully.

In other embodiments, the above-mentioned digital certificate format and the four verification methods performed by the revocation status verification subunit may be used in any combination. In this case, if any of the combinations fails, the digital certificate format and the revocation are considered to be revoked. The status verification subunit determines that the digital certificate included in the certificate authentication request packet is in an incorrect format or the usage status is invalid, that is, the digital certificate verification fails; otherwise, the digital certificate verification is successful.

After the verification result of the digital certificate obtained by the verification digital certificate verification module is successful, the certificate transmission response packet is sent to the AP through the message sending module to notify the digital certificate verification result.

The verification process described in this embodiment is applicable to the case of transmitting a digital certificate in a completely open network environment, and the verification scheme can well improve the verification efficiency of the digital certificate in such a network environment.

Embodiment 2

As shown in FIG. 3 and FIG. 5, the digital certificate format and the revocation status verification subunit, the blacklist list verification subunit, and the whitelist list verification subunit are enabled in the verification scheme configuration module. The specific verification process is described in detail below.

Taking the WAPI network architecture as an example, the digital certificate format and the revocation status verification sub-unit start to perform the verification. The specific verification process is the same as that of the first embodiment, and details are not described herein again. After the digital certificate format and the revocation status are verified, the blacklist verification subunit and the whitelist verification subunit are opened. Start verification, including:

The whitelist list verification sub-unit creates a whitelist database table. As shown in Table 4, the whitelist database table includes a sequence number field and a whitelist value field, wherein the sequence number field is a primary key, and the sequence number value is automatically incremented; the whitelist value field is Indicates the digital certificate identifier. The digital certificate identifier can be a combination of the certificate serial number and the issuer name in the digital certificate, or it can be just the certificate serial number.

Serial number	Whitelist value
1	Certificate Serial Number 1 + Issuer Name
2	Certificate Serial Number 2+ Issuer Name
3	Certificate Serial Number 3+ Issuer Name
4	Certificate Serial Number 4+ Issuer Name
...	...

Table 4

The whitelist verification sub-unit executes the SQL query statement to query whether the digital certificate identifier is in the whitelist value field, and judges according to the return value of the SQL query statement, if the return value includes the digital certificate identifier of the query, The identifier of the digital certificate included in the digital certificate authentication request packet can be queried in the whitelist value field of the whitelist database table. Otherwise, the digital certificate authentication request cannot be queried in the whitelist value field of the whitelist database table. The identifier of the digital certificate contained in the packet;

If the identifier of the digital certificate included in the digital certificate authentication request packet can be queried in the whitelist value field of the whitelist database table, the whitelist verification sub-unit performs whitelist verification, indicating that the whitelist verification subunit Determining that the digital certificate included in the certificate authentication request packet is in the white list, thereby determining that the digital certificate validity verification is successful; otherwise, the whitelist list verification subunit fails to perform whitelist verification, indicating that the whitelist list verification subunit determines the certificate authentication. Request grouping

In other words, if the whitelist verification sub-unit determines that the digital certificate authentication request packet is included If the digital certificate is not in the white list, the digital certificate verification result obtained by the digital certificate verification unit is a failure, and the message is sent by the message sending module to send a certificate authentication response packet to the AP to notify the digital certificate verification result; if the whitelist list verification subunit determines the number If the digital certificate contained in the certificate authentication request packet is in the white list, the validity verification of the digital certificate is successful.

The whitelist value in the above execution process can be added or deleted. The information that the authentication server adds or deletes the whitelist record may be from a digital certificate issuing entity or a network administrator, and the present invention does not limit this.

The verification process of the blacklist verification subunit is detailed below.

The blacklist list verification sub-unit creates a blacklist database table. As shown in Table 5, the blacklist database table includes a sequence number field and a blacklist value field, wherein the sequence number field is a primary key, and the sequence number value is automatically incremented; The value field indicates a digital certificate identifier, and the digital certificate identifier can be a combination of the certificate serial number and the issuer name in the digital certificate, or just the certificate serial number.

Serial number	Blacklist value
1	Certificate Serial Number 1 + Issuer Name
2	Certificate Serial Number 2+ Issuer Name
3	Certificate Serial Number 3+ Issuer Name
4	Certificate Serial Number 4+ Issuer Name
...	...

Table 5

The blacklist verification sub-unit executes the SQL query statement to query whether the digital certificate identifier is in the blacklist value field, and judges according to the return value of the SQL query statement, if the return value includes the digital certificate identifier of the query, The identifier of the digital certificate included in the digital certificate authentication request packet can be queried in the blacklist value field of the blacklist database table. Otherwise, the digital certificate authentication request cannot be queried in the blacklist value field of the blacklist database table. Included in the group Identification of the digital certificate;

If the identifier of the digital certificate included in the digital certificate authentication request packet is queried in the blacklist value field of the blacklist database table, the blacklist verification sub-unit performs the blacklist verification failure, indicating that the blacklist is verified. The unit determines that the digital certificate included in the certificate authentication request packet is in the blacklist to determine that the digital certificate validity verification fails; otherwise, the blacklist verification sub-unit performs the blacklist verification successfully, indicating that the blacklist verification sub-unit determines the certificate authentication. The digital certificate contained in the request packet is not in the blacklist, thereby determining that the digital certificate validity verification is successful.

In other words, if the blacklist verification sub-unit determines that the digital certificate included in the certificate authentication request packet is in the blacklist, the digital certificate verification result obtained by the digital certificate verification module is a failure, and then the certificate authentication response packet is constructed by the message sending module. Sending to the AP to inform the digital certificate verification result; if the blacklist verification sub-unit determines that the digital certificate included in the certificate authentication request packet is not blacklisted, the digital certificate validity verification is successful.

The blacklist value in the above execution process can be added or deleted. The information that the authentication server adds or deletes the blacklist record may be from a digital certificate issuing entity or a network administrator, and the present invention does not limit this.

After the verification result of the digital certificate obtained by the verification digital certificate verification module is successful, the certificate transmission response packet is sent to the AP through the message sending module to notify the digital certificate verification result.

The verification process described in this embodiment is applicable to a specific network environment, such as a local area network, and the digital certificate transmitted is likely to be issued by an internal digital certificate issuer, and is used in each enterprise internal network. The number of digital certificates included in the device is limited, and only the certificate of a specific application is included according to the application of the device itself. In this closed specific application environment, the source of the digital certificate and the scope of application are single. The verification scheme provided by this embodiment can well improve the verification efficiency of digital certificates in such a network environment.

Embodiment 3

As shown in FIG. 4 and FIG. 5, the blacklist list verification subunit and or the whitelist list verification subunit, the digital certificate use range verification subunit, and the digital certificate format and the revocation status verification subunit are enabled in the verification scheme configuration module. The specific verification process is described in detail below.

Taking the WAPI network architecture as an example, after the message receiving module receives the digital certificate authentication request packet sent by the access point AP, the digital certificate analysis module parses the digital certificate authentication request packet to obtain a digital certificate content. And submitting the parsed digital certificate content to the digital certificate verification module, first performing verification by the blacklist list verification subunit and or the whitelist list verification subunit, and the detailed verification process is the same as the description of the second embodiment, where No longer.

When the result of performing the verification by the blacklist list verification subunit and or the whitelist list verification subunit is a pass, the verification is further performed by the digital certificate use scope verification subunit, which is the same as the description of the first embodiment, and is not here. Let me repeat.

When the result of the digital certificate use scope verification subunit performing the verification is within a specific range, the verification is further performed by the digital certificate format and the revocation status verification subunit, and if the verification execution is passed, the digital certificate validity verification is successful. Otherwise, the digital certificate validity verification fails.

After the verification result of the digital certificate obtained by the verification digital certificate verification module is successful, the certificate transmission response packet is sent to the AP through the message sending module to notify the digital certificate verification result.

The verification process described in this embodiment is applicable to a network communication system. If a certain network is limited to use by some users and other network owners can use it, it is necessary to limit the network devices used by some users. You need to first verify the whitelist and blacklist in your device. If the received digital certificate content is a whitelist or a member of the blacklist, you can perform subsequent verification. If the received digital certificate content is not in the device's whitelist. Internal or blacklist, no further verification work is done, saving time. The verification scheme can improve the verification efficiency of digital certificates in such a network environment.

In addition to the above embodiments, the verification scheme identified by the verification item field in the verification scheme configuration unit may also be that the issuer of the digital certificate included in the certificate authentication request packet satisfies the verification of the security level used, etc., and the authentication server The digital certificate included in the digital certificate authentication request packet may be further verified according to the verification scheme preset by the verification scheme configuration unit, and then the certificate transmission response packet is constructed by the message sending module to be sent to the AP to notify the digital certificate verification result or related to the verification. The content of the information is not described in detail in the specific implementation of the present invention.

Furthermore, the method for verifying the validity of a digital certificate provided by the present invention is not limited to the WAPI architecture described in the above embodiments. Based on the same idea of the method for verifying the validity of a digital certificate provided by the present invention, the present invention also provides an authentication server corresponding thereto, see FIG. specifically is:

An authentication server for verifying the validity of the digital certificate, comprising a message receiving module and a digital certificate verification module, wherein the digital certificate verification module comprises a verification scheme configuration unit;

The message receiving module is configured to receive a digital certificate authentication request packet;

The verification scheme configuration unit is configured to configure a verification scheme for verifying the validity of the digital certificate.

Preferably, the authentication server may further comprise a digital certificate parsing module for parsing the digital certificate content in the digital certificate authentication request packet.

Preferably, the verification scheme configuration unit further includes a whitelist list verification subunit, and the whitelist list verification subunit is configured to verify whether the digital certificate in the digital certificate authentication request packet is included in the whitelist;

The verification scheme configuration unit further includes a blacklist list verification subunit, and the blacklist list verification subunit is configured to verify whether the digital certificate in the digital certificate authentication request packet is included in the blacklist;

The verification scheme configuration unit further includes a digital certificate format and a revocation status verification subunit, wherein the digital certificate format and the revocation status verification subunit are configured to verify whether the information format of the digital certificate is consistent with a format known by the authentication server ;

The verification scheme configuration unit further includes a digital certificate use scope verification subunit, and the digital certificate use scope verification subunit is configured to verify whether the digital certificate included in the digital certificate authentication request packet meets the use range specified in the digital certificate issuance .

The functions and working modes of the structures described in the authentication server correspond to the working processes described in the foregoing methods, and are not described herein again.

It is apparent that those skilled in the art can make various modifications and variations to the invention without departing from the spirit and scope of the invention. Thus, it is intended that the present invention cover the modifications and modifications of the invention

Claims (13)

1. A method for verifying the validity of a digital certificate, the method comprising an authentication server, the authentication server comprising a message receiving module and a digital certificate verification module, wherein

   The digital certificate verification module is provided with an authentication scheme configuration unit, and the verification scheme configuration unit performs configuration setting for configuring a verification scheme for verifying validity of the digital certificate;

   The message receiving module receives a digital certificate authentication request message, where the digital certificate authentication request message includes digital certificate content; the message receiving module submits the received digital certificate content to the digital certificate verification module for verification; The digital certificate verification module selects a corresponding verification scheme from the verification schemes configured in the verification scheme configuration unit to perform a specific verification process according to the verification requirement;

   If the validity verification of the digital certificate fails according to the selected verification scheme, it is determined that the digital certificate validity verification fails; otherwise, the digital certificate validity verification is determined to be successful.
2. The method according to claim 1, wherein the configuration is configured to create a verification scheme database table, the verification scheme database table including a verification item field and a switch value field, the verification item field being used to identify a verification scheme; The activation of the verification scheme is achieved by setting a switch value. When the switch value is on, the corresponding verification scheme is enabled; when the switch value is set to off, the corresponding verification scheme is not enabled.
3. The method of claim 2, wherein the verification scheme database table further comprises a sequence number field and or a verification order field, the verification sequence field being used to control an execution order of the verification scheme.
4. The method according to claim 1 or 2 or 3, wherein the verification scheme is a whitelist list verification scheme, a blacklist list verification scheme, a digital certificate format and a revocation status verification scheme, and a digital certificate use scope verification scheme. At least any combination of two;

   Correspondingly, the verification scheme configuration unit further includes: a whitelist list verification subunit, a blacklist list verification subunit, a digital certificate format and a revocation status verification subunit, and a digital certificate use. A combination of at least any two of the range verification subunits.
5. The method according to claim 4, wherein the method for enabling the digital certificate use range verification sub-unit and the digital certificate format and the revocation status verification sub-unit in the verification scheme configuration unit to verify the validity of the digital certificate comprises:

   1) First perform digital certificate use scope verification:

   The digital certificate uses a range verification sub-unit to create a digital certificate usage range table, where the digital certificate usage range table includes a sequence number field, a digital certificate identification field, and a usage range field;

   The digital certificate uses the range verification sub-unit to execute the SQL query statement to query whether the use scope of the digital certificate is in the use range field, and judge according to the return value of the SQL query statement;

   If the digital certificate included in the digital certificate authentication request packet can be queried in the use scope field to meet the scope of use specified in the digital certificate issuance, the digital certificate uses the range verification sub-unit to verify that the digital certificate is successfully used, thereby further Perform digital certificate format and revocation status verification;

   Otherwise, the digital certificate uses the range verification sub-unit to verify that the digital certificate usage range fails, thereby determining that the digital certificate validity verification fails;

   2) Perform digital certificate format and revocation status verification:

   The digital certificate format and the revocation status verification subunit verify whether the information format of the digital certificate content is consistent with the format known by the authentication server, and if not, the digital certificate format and the revocation status verification fail, and if they are consistent, the digital certificate format And the revocation status verification is successful;

   Alternatively, the authentication server calculates a signature value of the digital certificate in the digital certificate authentication request packet by using a public key of the digital certificate, the digital certificate format and the signature value calculated by the revocation status verification subunit and the digital certificate Whether the signature values are the same. If they are not the same, the digital certificate format and the revocation status verification fail. If they are the same, the digital certificate format and the revocation status verification are successful.

   Alternatively, the digital certificate format and the revocation status verification subunit verify the current time of the authentication server and the valid time range of the received digital certificate, if the current time of the authentication server is not Within the valid range of the received digital certificate, the digital certificate format and the revocation status verification fail; otherwise, the digital certificate format and the revocation status are verified successfully;

   Alternatively, the digital certificate format and the revocation status verification subunit verify whether the status of the received digital certificate stored by the authentication server is marked as revoked, and if marked as revoked, the digital certificate format and the revocation status verification fail. Otherwise, the digital certificate format and revocation status are verified successfully.
6. The method according to claim 4, wherein the digital certificate format and the revocation status verification subunit, the blacklist list verification subunit, and the whitelist list verification subunit are enabled in the verification scheme configuration unit to verify that the digital certificate is valid. Sexual methods, including:

   1) First perform digital certificate format and revocation status verification:

   The digital certificate format and the revocation status verification subunit verify whether the information format of the digital certificate content is consistent with the format known by the authentication server, and if not, the digital certificate format and the revocation status verification fail, and if they are consistent, the digital certificate format And the revocation status verification is successful;

   Alternatively, the authentication server calculates a signature value of the digital certificate in the digital certificate authentication request packet by using a public key of the digital certificate, the digital certificate format and the signature value calculated by the revocation status verification subunit and the digital certificate Whether the signature values are the same. If they are not the same, the digital certificate format and the revocation status verification fail. If they are the same, the digital certificate format and the revocation status are verified successfully.

   Alternatively, the digital certificate format and the revocation status verification subunit verify the current time of the authentication server and the valid time range of the received digital certificate, if the current time of the authentication server is not within the valid range of the received digital certificate, Digital certificate format and revocation status verification failed; otherwise, digital certificate format and revocation status verification succeeded;

   Alternatively, the digital certificate format and the revocation status verification subunit verify whether the status of the received digital certificate stored by the authentication server is marked as revoked, and if marked as revoked, the digital certificate format and the revocation status verification fail. Otherwise, the digital certificate format and the revocation status are verified successfully;

   2) After the digital certificate format and the revocation status verification are successfully executed, the blacklist list verification and the whitelist list verification are further performed, including:

   The blacklist list verification sub-unit creates a blacklist database table, where the blacklist database table includes a sequence number field and a blacklist value field, and the blacklist value field is a digital certificate identifier;

   The blacklist list verification sub-unit executes the SQL query statement to query whether the digital certificate identifier is in the whitelist value field, and is determined according to the return value of the SQL query statement;

   If the identifier of the digital certificate included in the digital certificate authentication request packet can be queried in the blacklist value field of the blacklist database table, the blacklist verification sub-unit fails to perform the blacklist verification; otherwise, the blacklist is determined. The list verification subunit performs blacklist verification pass; and or,

   The whitelist list verification sub-unit creates a whitelist database table, where the whitelist database table includes a sequence number field and a whitelist value field, and the whitelist value field is a digital certificate identifier;

   The whitelist verification sub-unit executes the SQL query statement to query whether the digital certificate identifier is in the whitelist value field, and is determined according to the return value of the SQL query statement;

   If the identifier of the digital certificate included in the digital certificate authentication request packet can be queried in the whitelist value field of the whitelist database table, the whitelist verification sub-unit performs whitelist verification; otherwise, the whitelist is determined. The list verification subunit failed to perform whitelist verification.
7. The method according to claim 4, wherein the blacklist list verification subunit and or the whitelist list verification subunit, the digital certificate use range verification subunit, and the digital certificate format and revocation status are enabled in the verification scheme configuration unit. A method of verifying a subunit to verify the validity of a digital certificate, specifically comprising:

   1) First perform blacklist verification and whitelist verification, including:

   The blacklist list verification sub-unit creates a blacklist database table, where the blacklist database table includes a sequence number field and a blacklist value field, and the blacklist value field is a digital certificate identifier;

   The blacklist list verification sub-unit executes the SQL query statement to query whether the digital certificate identifier is in the whitelist value field, and is determined according to the return value of the SQL query statement;

   If the identifier of the digital certificate included in the digital certificate authentication request packet can be queried in the blacklist value field of the blacklist database table, the blacklist verification sub-unit performs blacklist verification. Failing; otherwise, determining that the blacklist verification sub-unit performs blacklist verification; and or

   The whitelist list verification sub-unit creates a whitelist database table, where the whitelist database table includes a sequence number field and a whitelist value field, and the whitelist value field is a digital certificate identifier;

   The whitelist verification sub-unit executes the SQL query statement to query whether the digital certificate identifier is in the whitelist value field, and is determined according to the return value of the SQL query statement;

   If the identifier of the digital certificate included in the digital certificate authentication request packet can be queried in the whitelist value field of the whitelist database table, the whitelist verification sub-unit performs whitelist verification; otherwise, the whitelist is determined. The list verification subunit failed to perform whitelist verification;

   2) After the blacklist list verification or the whitelist list verification is successful, the digital certificate use scope verification is performed, specifically:

   The digital certificate uses a range verification sub-unit to create a digital certificate usage range table, where the digital certificate usage range table includes a sequence number field, a digital certificate identification field, and a usage range field;

   The digital certificate uses the range verification sub-unit to execute the SQL query statement to query whether the use scope of the digital certificate is in the use range field, and judge according to the return value of the SQL query statement;

   If the digital certificate included in the digital certificate authentication request packet can be queried in the use scope field to meet the scope of use specified in the digital certificate issuance, the digital certificate use scope verification subunit verifies that the digital certificate use range is successful;

   Otherwise, the digital certificate uses the range verification sub-unit to verify that the digital certificate usage range fails, thereby determining that the digital certificate validity verification fails;

   3) Further verify the digital certificate format and revocation status verification after successful verification of the digital certificate usage scope, specifically:

   The digital certificate format and the revocation status verification subunit verify whether the information format of the digital certificate content is consistent with the format known by the authentication server, and if not, the digital certificate format and the revocation status verification fail, and if they are consistent, the digital certificate format And the revocation status verification is successful;

   Alternatively, the authentication server calculates the digital certificate authentication request using the public key of its digital certificate a signature value of the digital certificate in the group, the digital certificate format and the signature value calculated by the revocation status verification subunit and the signature value of the digital certificate are the same. If not, the digital certificate format and the revocation status verification fail. If the same, the digital certificate format and revocation status are verified successfully;

   Alternatively, the digital certificate format and the revocation status verification subunit verify the current time of the authentication server and the valid time range of the received digital certificate, if the current time of the authentication server is not within the valid range of the received digital certificate, Digital certificate format and revocation status verification failed; otherwise, digital certificate format and revocation status verification succeeded;

   Alternatively, the digital certificate format and the revocation status verification subunit verify whether the status of the received digital certificate stored by the authentication server is marked as revoked, and if marked as revoked, the digital certificate format and the revocation status verification fail. Otherwise, the digital certificate format and revocation status are verified successfully.
8. The method according to claim 1, wherein the configuration setting is further a configuration file in an XML format, including a serial number element, a verification item element, a verification order element, and a switch value element;

   The verification sequence element is used to control the execution order of the verification scheme;

   The switch value element is used to determine if the corresponding verification scheme is turned on.
9. An authentication server for verifying the validity of a digital certificate, comprising a message receiving module and a digital certificate verification module, wherein the digital certificate verification module comprises a verification scheme configuration unit;

   The message receiving module is configured to receive a digital certificate authentication request packet;

   The verification scheme configuration unit is configured to configure a verification scheme for verifying the validity of the digital certificate.
10. An authentication server according to claim 9, wherein said verification scheme configuration unit further comprises a whitelist list verification subunit, said whitelist list verification subunit being configured to verify said digital certificate authentication request packet Whether the digital certificate is included in the whitelist.
11. An authentication server according to claim 9, wherein said verification scheme configuration unit further comprises a blacklist list verification subunit, said blacklist list verification subunit being used for verification Whether the digital certificate in the digital certificate authentication request packet is included in the blacklist.
12. An authentication server according to claim 9, wherein said verification scheme configuration unit further comprises a digital certificate format and a revocation status verification subunit, said digital certificate format and revocation status verification subunit being for verifying said Whether the information format of the digital certificate is consistent with the format known by the authentication server.
13. An authentication server according to claim 9, wherein said verification scheme configuration unit further comprises a digital certificate use range verification subunit, said digital certificate use range verification subunit for verifying said digital certificate authentication request Whether the digital certificate contained in the group meets the scope of use specified in the digital certificate issuance.

Images