WO2020155022A1 - Tls证书认证方法、装置、设备及存储介质 - Google Patents

Tls证书认证方法、装置、设备及存储介质 Download PDF

Info

Publication number
WO2020155022A1
WO2020155022A1 PCT/CN2019/074193 CN2019074193W WO2020155022A1 WO 2020155022 A1 WO2020155022 A1 WO 2020155022A1 CN 2019074193 W CN2019074193 W CN 2019074193W WO 2020155022 A1 WO2020155022 A1 WO 2020155022A1
Authority
WO
WIPO (PCT)
Prior art keywords
certificate
level
tls
hash value
tls certificate
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2019/074193
Other languages
English (en)
French (fr)
Inventor
朱明�
周伟
银国超
胡丽华
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shenzhen Goodix Technology Co Ltd
Original Assignee
Shenzhen Goodix Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shenzhen Goodix Technology Co Ltd filed Critical Shenzhen Goodix Technology Co Ltd
Priority to CN201980000282.6A priority Critical patent/CN111771357B/zh
Priority to PCT/CN2019/074193 priority patent/WO2020155022A1/zh
Publication of WO2020155022A1 publication Critical patent/WO2020155022A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/166—Implementing security features at a particular protocol layer at the transport layer

Definitions

  • This application relates to the technical field of communication security, and in particular to a TLS certificate authentication method, device, equipment and storage medium.
  • Transport Layer Security is used to provide confidentiality and data integrity between two communication applications.
  • the protocol is composed of two layers: the TLS record protocol and the TLS handshake protocol.
  • TLS handshake protocol Before the two communication applications can communicate securely, they must use the TLS handshake protocol to authenticate the two communicating parties through asymmetric encryption calculations, and then exchange the symmetric key as the meeting key for subsequent data exchanges.
  • the meeting key is used Encrypt the data exchanged by both parties to ensure the confidentiality and reliability of the communication between the two applications.
  • TLS certificate authentication is a very important and critical link. The client analyzes the validity of the certificate sent by the server to verify the security of communication.
  • the TLS standard verification process In the prior art, in the process of verifying the certificate sent by the server through the client, the TLS standard verification process is usually adopted.
  • the server sends a multi-level certificate (from the parent certificate to the leaf certificate) to the client, and the client uses the local root certificate to verify from the leaf certificate level by level. Each level of verification is resolved. Level certificate until the parent certificate is verified to complete the TLS certificate authentication.
  • This application provides a TLS certificate authentication method, device, equipment and storage medium.
  • this application provides a TLS certificate authentication method, including:
  • N is an integer greater than 1
  • hash the N-1 level TLS certificate to obtain N-1 first hash values
  • the N-1 level TLS certificate Including the second level TLS certificate to the Nth level TLS certificate
  • obtaining a second hash value database the second hash value database includes at least one second hash value, the second hash value is passed to the TLS certificate that is successfully authenticated
  • the hash value obtained by the hash operation for any first hash value, compare the first hash value with the second hash value corresponding to the first hash value; if each first hash value exists If the second hash value is equal to the first hash value, it is determined that the N-1 level TLS certificate authentication is successful.
  • the client receives the N-1 level TLS certificate sent by the first server, and obtains N-1 first hash values through hash operation, and uses the second TLS certificate that has been successfully authenticated through calculation.
  • Hash value respectively compare the first hash value and the second hash value of the corresponding series, if each first hash value has a second hash value equal to the first hash value, TLS certificate authentication success. Since each first hash value is compared with the second hash value corresponding to the first hash value to authenticate the TLS certificate, the efficiency of TLS certificate authentication is improved.
  • the method before receiving the N-1 level TLS certificate sent by the first server, the method further includes:
  • M is an integer greater than 1
  • the M-1 level TLS certificate includes the second level TLS certificate to the M level TLS certificate; according to the public key of the local root certificate, pair M- Level 1 TLS certificate is authenticated level by level; if the certification of the M-1 level TLS certificate is successful, the M-1 level TLS certificate is hashed to obtain the M-1 second hash value; according to the M-1 first
  • the second hash value establishes a second hash value database.
  • the M-1 level TLS certificate is authenticated step by step according to the public key of the local root certificate, and the M-1 second hash value of the successful authentication is stored in the second hash value database.
  • the establishment of the second hash value database is realized.
  • step-by-step authentication of the M-1 level TLS certificate including:
  • the M-1 TLS certificate is authenticated step by step from the M-level TLS certificate to the second-level TLS certificate.
  • step-by-step authentication of the M-1 level TLS certificate including:
  • the M-1 TLS certificate is authenticated step by step from the second TLS certificate to the M-1 TLS certificate.
  • the TLS certificate authentication method provided in this embodiment of the application further includes:
  • the TLS standard verification process is executed.
  • the TLS standard verification process is based on the public key of the local root certificate, starting from the Nth level of TLS
  • the certificate verifies the N-1 level TLS certificate level by level until the second level TLS certificate is completed.
  • the TLS certificate is authenticated by first comparing the first hash value and the second hash value of the corresponding level. If the authentication is unsuccessful, the TLS certificate is authenticated by the TLS standard verification process, and the authentication of the TLS certificate is realized , Thereby improving the reliability of TLS certificate authentication.
  • the TLS certificate authentication method provided in this embodiment of the application further includes:
  • the N-1 level TLS certificate is authenticated step by step from the second level TLS certificate according to the public key of the local root certificate , Until the certification is completed with the Nth level TLS certificate.
  • the certificate authentication efficiency is improved.
  • the level N-1 TLS certificate is authenticated step by step from the second level TLS certificate to the level N TLS certificate, including:
  • S1 Parse the local root certificate and the second level TLS certificate sent by the first server into the memory, and use the public key of the local root certificate to authenticate the second level TLS certificate, where the local root certificate is used as the verification certificate, and the second level TLS The certificate is to be verified;
  • step S3 Repeat step S2 until the certification of the Nth level certificate is completed.
  • the verification certificate is released during the TLS certificate authentication process, saving the client A lot of memory resources.
  • the TLS certificate authentication method provided in this embodiment of the application includes:
  • the N-1 first hash value will be used as the second hash value, and the N-1 second hash value will be stored in the second hash value database. After that, the N-1 level TLS certificate is certified.
  • this application provides a TLS certificate authentication device, which is characterized in that it includes:
  • the first receiving module is used to receive the N-1 level TLS certificate sent by the first server, where N is an integer greater than 1, and obtain N-1 first hash values through the hash operation on the N-1 level TLS certificate respectively ,
  • Level N-1 TLS certificate includes Level 2 TLS certificate to Level N TLS certificate;
  • the obtaining module is configured to obtain a second hash value database, the second hash value database includes at least one second hash value, and the second hash value is a hash value obtained through a hash operation on a TLS certificate that is successfully authenticated .
  • the comparison module is configured to compare the first hash value with a second hash value corresponding to the first hash value for any one of the first hash values.
  • the judging module is used for judging that the N-1 level TLS certificate is successfully authenticated if each first hash value has a second hash value equal to the first hash value.
  • the TLS certificate authentication device provided in this application also includes:
  • the second receiving module is configured to receive the M-1 level TLS certificate sent by the second server, where M is an integer greater than 1, and the M-1 level TLS certificate includes the second level TLS certificate to the Mth level TLS certificate.
  • the authentication module is used to authenticate the M-1 level TLS certificate level by level according to the public key of the local root certificate.
  • the first processing module is configured to, if the authentication of the M-1 level TLS certificate is successful, the M-1 level TLS certificate is respectively hashed to obtain M-1 second hash values.
  • the establishment module is used to establish a second hash value database according to the M-1 second hash values.
  • the authentication module is specifically used for:
  • the M-1 TLS certificate is authenticated step by step from the M-level TLS certificate to the second-level TLS certificate.
  • the authentication module is specifically used for:
  • the M-1 TLS certificate is authenticated step by step from the second TLS certificate to the M-1 TLS certificate.
  • the TLS certificate authentication device provided in this application also includes:
  • the second processing module is configured to execute the TLS standard verification process if there is no second hash value equal to the first hash value in any one of the first hash values.
  • the TLS standard verification process is based on the public root certificate The key starts from the Nth level TLS certificate and verifies the N-1 level TLS certificate level by level until the second level TLS certificate is completed.
  • the TLS certificate authentication device provided in this application also includes:
  • the third processing module is configured to, if there is no second hash value equal to the first hash value in any one of the first hash values, according to the public key of the local root certificate, step by step from the second level TLS certificate to Validate the N-1 level TLS certificate until the N level TLS certificate is completed.
  • the third processing module is specifically used for:
  • S1 Parse the local root certificate and the second level TLS certificate sent by the first server into the memory, and use the public key of the local root certificate to authenticate the second level TLS certificate, where the local root certificate is used as the verification certificate, and the second level TLS The certificate is to be verified;
  • step S3 Repeat step S2 until the certification of the Nth level certificate is completed.
  • the TLS certificate authentication device includes:
  • the storage module is used to, if the authentication of the N-1 level certificate is successful, the N-1 first hash values are used as the N-1 second hash values, and the N-1 second hash values are saved to the first
  • the second hash value database is used to authenticate the N-1 level TLS certificate later. .
  • this application provides a terminal device, including a processor and a memory,
  • the memory is used to store computer-executable instructions so that the processor executes the instructions to implement the TLS certificate authentication method as in the first aspect and an optional manner in the first aspect.
  • this application provides a computer-readable storage medium.
  • the storage medium includes computer instructions. When the instructions are executed by a computer, the computer realizes the TLS certificate authentication method as in the first aspect and the optional methods of the first aspect.
  • this application provides a computer program product, including computer instructions, which when executed by a computer, cause the computer to implement the first aspect or the method of the first aspect.
  • This application provides a TLS certificate authentication method, device, device, and storage medium.
  • the N-1 level TLS certificate sent by the server is received, where N is an integer greater than 1, and the N-1 level TLS certificate is obtained by hashing.
  • N-1 first hash values the N-1 level TLS certificate includes the second level TLS certificate to the Nth level TLS certificate; the second hash value database is obtained, and the second hash value database includes at least one second hash value Hope value, the second hash value is the hash value obtained through the hash operation on the TLS certificate that is successfully authenticated; for any first hash value, compare the first hash value with the corresponding level of the first hash value The second hash value; if each first hash value has a second hash value equal to the first hash value, it is determined that the N-1 level TLS certificate authentication is successful. Since each first hash value is compared with the second hash value corresponding to the first hash value, the TLS certificate is authenticated, which improves the efficiency of TLS certificate authentication.
  • FIG. 1 is a schematic diagram of an optional application scenario shown in an embodiment of the present application
  • FIG. 2 is a schematic flowchart of a TLS certificate authentication method provided by an embodiment of the present application
  • FIG. 3 is a schematic diagram of a process for establishing a second hash value database according to an embodiment of the present application
  • FIG. 4 is a schematic flowchart of a TLS certificate authentication method provided by another embodiment of the present application.
  • FIG. 5 is a schematic flowchart of a TLS certificate authentication method provided by still another embodiment of this application.
  • FIG. 6 is a schematic flowchart of the TLS certificate authentication process provided by still another embodiment of this application.
  • FIG. 7 is a schematic structural diagram of a TLS certificate authentication device provided by an embodiment of the present invention.
  • FIG. 8 is a schematic structural diagram of a TLS certificate authentication device provided by another embodiment of the present invention.
  • FIG. 9 is a schematic structural diagram of a TLS certificate authentication device provided by another embodiment of the present invention.
  • FIG. 10 is a schematic structural diagram of a TLS certificate authentication device provided by still another embodiment of the present invention.
  • FIG. 11 is a schematic structural diagram of a TLS certificate authentication device provided by still another embodiment of the present invention.
  • Fig. 12 is a schematic diagram of a terminal device provided by an embodiment of the present invention.
  • the TLS handshake protocol Before the client and the server communicate securely, the TLS handshake protocol must be used to authenticate the two parties using asymmetric encryption calculations. After that, the symmetric key is exchanged as the meeting key for subsequent data exchanges. The meeting key is used Encrypt the data exchanged by both parties to ensure the confidentiality and reliability of the communication between the two applications.
  • TLS certificate authentication is a very important and critical link. The client analyzes the validity of the certificate sent by the server to verify the security of communication.
  • the process of TLS certificate authentication is relatively complicated. In order to improve the efficiency of TLS certificate authentication, this application provides a TLS certificate authentication method, device, equipment and storage medium.
  • Fig. 1 is a schematic diagram of an optional application scenario shown in an embodiment of the present application.
  • the communication parties are the client 11 and the server 12.
  • the client 11 connects to the server 12 that supports the TLS protocol, it sends a message requesting the creation of a secure connection and a list of supported cipher combinations to the server. 12.
  • the server 12 receives the password combination list sent by the client 11, and selects a set of password combinations from the password combination list as the encryption password algorithm and encryption hash function used in this handshake, and notifies the client 11, Then the TLS certificate is sent to the client 11, and the client 11 obtains a set of cipher combinations sent by the server 12, and receives the TLS certificate sent by the server 12 to prepare for TLS certificate authentication. If the TLS certificate authentication is successful, the server 12 is allowed to communicate with the client 11, and if the TLS certificate authentication is unsuccessful, the server 12 is not allowed to communicate with the client 11.
  • the password combination may be, for example, an encryption password algorithm and an encryption hash function.
  • the client 11 may be a Microcontroller Unit (MCU), a personal computer (Personal Computer, PC for short), or a mobile terminal, etc.
  • the mobile terminal may also be called User Equipment (UE), Access terminal, user unit, user station, mobile station, mobile station, user terminal, terminal, wireless communication device, user agent or user device.
  • the mobile terminal can be a smart phone, a cellular phone, a cordless phone, a tablet computer, a personal digital assistant (PDA) device, a handheld device with wireless communication function or other processing devices connected to a wireless modem, a vehicle-mounted device, Wearable devices, etc.
  • the server can be a server, a PC, etc. The embodiment of the present invention does not limit the type of the server.
  • Fig. 2 is a schematic flow chart of a TLS certificate authentication method provided by an embodiment of the present application.
  • the method can be executed by a TLS certificate authentication device, which can be implemented by software and/or hardware.
  • the device can be a client or the aforementioned terminal device.
  • the following describes the TLS certificate authentication method with the terminal device as the executive body.
  • the TLS certificate authentication method provided in this embodiment of the application may include:
  • Step S101 Receive the N-1 level TLS certificate sent by the first server, where N is an integer greater than 1, and obtain N-1 first hash values through the hash operation on the N-1 level TLS certificate, N-1
  • the level TLS certificate includes the second level TLS certificate to the Nth level TLS certificate.
  • the first server may be any of the foregoing servers, and the embodiment of the present invention does not limit the type of the first server.
  • the second-level TLS certificate is issued by the local root certificate, and the local root certificate can verify the second-level TLS certificate, the third-level TLS certificate is signed by the second-level TLS certificate, and the second-level TLS certificate can be verified against the third-level TLS certificate.
  • Both the next level TLS certificate can be issued, and the next level TLS certificate can be verified.
  • the client it only needs to disclose the local root certificate in the public information and verify the N-1 level TLS certificate of the communication server. Verify that the identity with which it is communicating can be trusted.
  • the terminal device receives the N-1 level TLS certificate sent by the first server, and sends to the first server according to the encryption password algorithm and encryption hash function in the set of password combinations sent by the first server during the handshake process.
  • the N-1 level TLS certificate obtains the first hash value of the TLS certificate at all levels according to the hash operation, where different TLS certificates can obtain different first hash values through the hash operation. Due to the unique certainty of the hash calculation algorithm, as long as the hash values of two TLS certificates are equal, it can be determined that the two TLS certificates are the same.
  • Step S102 Obtain a second hash value database.
  • the second hash value database includes at least one second hash value, and the second hash value is a hash value obtained through a hash operation on a TLS certificate that is successfully authenticated.
  • the second hash value database includes at least one second hash value, wherein the second hash values of different levels can be separately identified in the database, for example, the hash value obtained by the second-level TLS certificate according to the hash operation
  • the identifier is the second-level hash value
  • the third-level TLS certificate is identified as the third-level hash value according to the hash value obtained by the hash operation, etc., this embodiment of the application does not limit this, as long as the second-level hash can be distinguished The desired number of stages is sufficient.
  • Step S103 For any one of the first hash values, compare the first hash value with a second hash value corresponding to the first hash value.
  • the terminal device may have successfully handshaked and communicated with the first server or other servers before authenticating the N-1 level TLS certificate sent by the first server, then the terminal device has successfully authenticated multiple TLS certificates. Due to the uniqueness of the hash calculation algorithm, as long as the hash values of two TLS certificates are equal, it can be determined that the two TLS certificates are the same.
  • the second hash value is compared with the first hash value obtained by the hash operation of the TLS certificate that needs to be authenticated this time, and the relationship between the first hash value and the second hash value is used to determine the need for authentication this time Whether the N-1 level TLS certificate has been successfully authenticated, if it is judged that the N-1 level TLS certificate that needs to be authenticated this time has been successfully authenticated, there is no need to parse the N-1 level TLS certificate and verify by level. If it is judged that the authentication of the N-1 level TLS certificate that needs to be authenticated this time is unsuccessful, the N-1 level TLS certificate needs to be parsed and verified by levels.
  • the embodiment of the present invention does not limit the order of comparing the first hash value and the second hash value of any series.
  • Step S104 If each first hash value has a second hash value equal to the first hash value, it is determined that the N-1 level TLS certificate is successfully authenticated.
  • each first hash value is equal to the second hash value corresponding to each first hash value, it means that the N-1 level TLS certificate has been successfully authenticated, and the N-1 level TLS certificate If the authentication is successful, the terminal device can communicate with the first server. If after comparison, there is a situation where the first hash value and the second hash value corresponding to the first hash value are not equal, it means that the N-1 level TLS certificate has not been successfully authenticated, and the initial judgment is N-1 level TLS certificate authentication failed. If the N-1 level TLS certificate is successfully authenticated, the terminal device and the first server can communicate securely.
  • N is an integer greater than 1
  • the N-1 level TLS certificate is hashed to obtain N-1 first hash values, and then For any first hash value, compare the first hash value with the second hash value corresponding to the first hash value, and the second hash value is obtained by hashing the authenticated TLS certificate. Hence, finally, if each first hash value is equal to the second hash value corresponding to each first hash value, the N-1 level TLS certificate authentication is successful. Since each first hash value is compared with the second hash value corresponding to the first hash value, the TLS certificate is authenticated, which improves the efficiency of TLS certificate authentication.
  • FIG. 3 is a schematic diagram of a process for establishing a second hash value database provided by an embodiment of the present application, where the The method can be executed by a TLS certificate authentication device, which can be implemented by software and/or hardware.
  • the device can be a client or the aforementioned terminal device.
  • the terminal device before receiving the N-1 level TLS certificate sent by the server, it can also include:
  • Step S201 Receive an M-1 level TLS certificate sent by a second server, where M is an integer greater than 1, and the M-1 level TLS certificate includes the second level TLS certificate to the Mth level TLS certificate.
  • the second server and the first server may be the same server or different servers, and the second server may be any one of the above-mentioned servers, and the embodiment of the present invention does not limit the type of the second server.
  • the terminal device receives the M-1 level TLS certificate sent by the second server, where M is an integer greater than 1, and the embodiment of the present application does not limit the specific value of M.
  • Step S202 Perform step-by-step authentication on the M-1 level TLS certificate according to the public key of the local root certificate.
  • the terminal device authenticates the M-1 level TLS certificate level by level according to the public key of the local root certificate. In a possible implementation manner, this may include:
  • the M-1 TLS certificate is authenticated step by step from the M-level TLS certificate to the second-level TLS certificate.
  • the M-1 level TLS certificate is authenticated level by level until the second level TLS certificate is authenticated.
  • the TLS standard verification in step S301 please refer to the TLS standard verification in step S301 The specific introduction of the process will not be described here.
  • the M-1 level TLS certificate is authenticated step by step.
  • it may include:
  • the M-1 TLS certificate is authenticated step by step from the second TLS certificate to the M-1 TLS certificate.
  • step S401 for authenticating the M-1 level TLS certificate from the second level TLS certificate to the M-1 level TLS certificate according to the public key of the local root certificate. , No specific description here.
  • Step S203 If the authentication of the M-1 level TLS certificate is successful, the M-1 level TLS certificate is hashed to obtain M-1 second hash values.
  • the terminal device and the second server are successfully handshaking.
  • the second hash value obtained by hashing the successfully authenticated TLS certificate.
  • Step S204 Establish a second hash value database according to the M-1 second hash values.
  • a second hash value database is established.
  • the terminal device communicates with the second server again, the TLS certificate sent by the second server can be authenticated by comparing the hash value. Improve the efficiency of TLS certificate authentication.
  • the corresponding TLS certificate can also be hashed to obtain multiple second hash values, and then stored in the second hash value database to continuously update the second hash value database.
  • the M-1 level TLS certificate is authenticated step by step according to the public key of the local root certificate, and the M-1 second hash value of the successful authentication is stored in the second hash value database.
  • the establishment of the second hash value database is realized.
  • FIG. 4 is a schematic flowchart of a TLS certificate authentication method provided by another embodiment of the present application.
  • the method can be executed by a TLS certificate authentication device, which can be implemented by software and/or hardware. achieve.
  • the device can be a client or the aforementioned terminal device.
  • the following describes the TLS certificate authentication method with the terminal device as the executive body.
  • the TLS certificate authentication method provided by the embodiment of the present application may further include:
  • Step S301 If there is no second hash value equal to the first hash value in any one of the first hash values, execute the TLS standard verification process.
  • the TLS standard verification process is based on the public key of the local root certificate.
  • Level TLS certificate verifies the N-1 level TLS certificate level by level until the second level TLS certificate is completed.
  • the N-1 TLS certificates can be authenticated by executing the TLS standard verification process.
  • the following takes the N-1 level TLS certificate sent by the server including the level two TLS certificate, the level three TLS certificate and the level four TLS certificate as examples to introduce.
  • the level two TLS certificate is the certificate of the R&D department.
  • Level TLS certificate is a PC factory certificate
  • Level 4 TLS certificate is a PC certificate.
  • the N-1 level TLS certificate is verified step by step from the Nth level TLS certificate until the second level TLS certificate is completed, including:
  • Step 1 The server sends the certificate chain, namely the R&D department certificate, PC factory certificate and PC certificate to the terminal device, and the terminal device parses the certificate in the certificate chain and stores it in the memory for later use.
  • the certificate chain namely the R&D department certificate, PC factory certificate and PC certificate
  • Step 2 The terminal device passes the PC certificate sent by the local root certificate authentication server. Since the local root certificate cannot authenticate the PC certificate, the authentication fails and goes to step 3.
  • Step 3 The PC certificate is authenticated by the PC factory certificate in the certificate chain sent by the server. Since the PC factory certificate is the upper-level certificate of the PC certificate, the PC factory certificate can authenticate the PC certificate. If the authentication fails, the TLS certificate authentication Failure, if the PC certificate authentication is successful, go to step 4.
  • Step 4 The terminal device passes the PC factory certificate sent by the local root certificate authentication server. Since the local root certificate cannot authenticate the PC factory certificate, the authentication fails and goes to step 5.
  • Step 5 The PC factory certificate is authenticated by the R&D department certificate in the certificate chain sent by the server. Since the R&D department certificate is the upper-level certificate of the PC factory certificate, the R&D department certificate can authenticate the PC factory certificate. If the authentication fails, then The TLS certificate authentication fails. If the PC factory certificate authentication succeeds, go to step 6.
  • Step 6 The terminal device passes the R&D department certificate sent by the local root certificate authentication server. If the authentication fails, the TLS certificate authentication fails, and if the authentication succeeds, the TLS certificate authentication succeeds.
  • the N-1 level TLS certificate is authenticated by first comparing the first hash value and the second hash value of the corresponding levels respectively. If the authentication is not successful, the TLS standard verification process is used to verify the TLS certificate. Carry out authentication, realize the authentication of TLS certificate, and improve the reliability of TLS certificate authentication.
  • FIG. 5 is a schematic flowchart of a TLS certificate authentication method provided by another embodiment of the present application.
  • the method can be executed by a TLS certificate authentication device, which can be implemented by software and/or hardware. Way to achieve.
  • the device can be a client or the aforementioned terminal device.
  • the following describes the TLS certificate authentication method with the terminal device as the executive body. The following takes the certificate chain sent by the server in the above embodiment as an example for introduction.
  • the TLS certificate authentication method provided by this application may also include:
  • Step S401 If there is no second hash value equal to the first hash value in any of the first hash values, the second-level TLS certificate is authenticated step by step from the second-level TLS certificate to N-1 according to the public key of the local root certificate Level TLS certificate until the completion of the Nth level TLS certificate.
  • Level TLS certificate avoids the process of authenticating the TLS certificate whose level cannot be authenticated according to the local root certificate, which improves the efficiency of certificate authentication.
  • the server sends the certificate chain, namely the R&D department certificate, the PC factory certificate, and the PC certificate to the terminal device, the terminal device parses the local root certificate and stores it in the memory for later use, and then the terminal device parses the R&D department certificate in the server certificate chain to the memory ,According to the local root certificate to authenticate the R&D department certificate, if the R&D department certificate authentication fails, the authentication process is ended, and the TLS certificate authentication fails. If the R&D department certificate authentication succeeds, the PC factory certificate sent by the server is parsed into the memory, and the R&D department certificate is used for authentication PC factory certificate, if the PC factory certificate authentication fails, the authentication process ends, and the TLS certificate authentication fails.
  • the server's PC certificate is parsed into the memory, and the PC certificate is authenticated with the PC factory certificate. If the authentication fails, it ends Authentication process, TLS certificate authentication fails, if authentication succeeds, TLS certificate authentication succeeds.
  • the second-level TLS certificate is authenticated through the local root certificate, and then the third-level TLS certificate is authenticated through the second-level TLS certificate, and so on, until the certification is completed for the Nth-level TLS certificate, because it avoids According to the local root certificate to authenticate the TLS certificate which cannot be authenticated, the efficiency of certificate authentication is improved.
  • FIG. 6 is a schematic diagram of the flow of TLS certificate authentication provided by another embodiment of the present application.
  • the method can be executed by a TLS certificate authentication device, which can be implemented by software and/or hardware. achieve.
  • the device can be a client or the aforementioned terminal device.
  • the following describes the TLS certificate authentication method with the terminal device as the executive body.
  • the N-1 level TLS certificate is authenticated step by step from the second level TLS certificate to the level N TLS certificate, including:
  • S1 Parse the local root certificate and the second level TLS certificate sent by the first server into the memory, and use the public key of the local root certificate to authenticate the second level TLS certificate, where the local root certificate is used as the verification certificate, and the second level TLS The certificate serves as the certificate to be verified.
  • the terminal device After the terminal device receives the N-1 level TLS certificate sent by the first server, the terminal device parses the local root certificate and the second level TLS certificate sent by the first server into the memory, and then uses the local root certificate to authenticate the second level TLS certificate . If the local root certificate is used to authenticate the second-level TLS certificate, the local root certificate is used as the verification certificate, and the second-level TLS certificate is used as the certificate to be verified. If the authentication of the certificate to be verified is successful, step S2 is executed, and if the authentication of the certificate to be verified is unsuccessful, the authentication of the N-1 level TLS certificate fails.
  • step S3 If the authentication of the second-level TLS certificate is successful, the local root certificate is released, the second-level TLS certificate is used as the verification certificate, the next-level certificate of the second-level TLS certificate, namely the third-level TLS certificate, is parsed into the memory, and the The third-level TLS certificate is used as the certificate to be verified, so that the second-level TLS certificate verifies the third-level TLS certificate. If the third-level TLS certificate verification fails, the N-1 level TLS certificate verification fails, and if the third-level TLS certificate verification succeeds , Then step S3 is executed.
  • step S3 Repeat step S2 until the certification of the Nth level certificate is completed.
  • step S3 step S2 is repeated until the certification of the Nth level certificate is completed. Specifically, if the third level TLS certificate is successfully authenticated, the memory of the second level TLS certificate is released, and the third level TLS certificate is used as the verification certificate , Parse the next level certificate of the third level TLS certificate, that is, the fourth level TLS certificate into the memory, and use it as the certificate to be verified, so that the third level TLS certificate verifies the fourth level TLS certificate. If the fourth level TLS certificate is successfully authenticated, Then release the memory of the third-level TLS certificate, and use the fourth-level TLS certificate as the verification certificate to verify the next-level certificate of the fourth-level TLS certificate, and so on, until the verification of the N-1 level TLS certificate is completed.
  • the level N-1 TLS certificate is authenticated step by step from the second level TLS certificate according to the local root certificate until the N-1 level TLS certificate is authenticated, and the verification is released during the TLS certificate authentication process.
  • the certificate saves a lot of memory resources of the client.
  • N-1 level TLS certificate is successfully authenticated, in order to improve the authentication efficiency of the TLS certificate sent by the first server during the subsequent handshake between the terminal device and the first server, in a possible implementation manner, if N- If the level 1 TLS certificate is successfully authenticated, the N-1 first hash values will be used as N-1 second hash values, and the N-1 second hash values will be stored in the second hash value database. Used to authenticate N-1 level TLS certificates later. .
  • the second hash value database can be stored in a readable memory in the terminal device.
  • the embodiment of the present invention does not limit the location where the N-1 first hash values are stored, as long as the terminal device can authenticate the TLS certificate In the process, you can read it out.
  • the level corresponding to each first hash value can also be saved at the same time.
  • the first hash values of different levels can be stored in different storage units for easy use .
  • FIG. 7 is a schematic structural diagram of a TLS certificate authentication device provided by an embodiment of the present invention.
  • the device can be implemented in software and/or hardware.
  • the device can be a client or the aforementioned terminal device.
  • the TLS certificate authentication apparatus provided by the embodiment of the present invention may include:
  • the first receiving module 61 is configured to receive the N-1 level TLS certificate sent by the first server, where N is an integer greater than 1, and obtain N-1 first hashes through the hash operation on the N-1 level TLS certificates respectively Value, the N-1 level TLS certificate includes the second level TLS certificate to the Nth level TLS certificate;
  • the obtaining module 62 is configured to obtain a second hash value database.
  • the second hash value database includes at least one second hash value, and the second hash value is a hash obtained through a hash operation on a TLS certificate that is successfully authenticated value.
  • the comparison module 63 is configured to compare the first hash value with a second hash value corresponding to the first hash value for any one of the first hash values.
  • the judging module 64 is used for judging that the N-1 level TLS certificate is successfully authenticated if each first hash value has a second hash value equal to the first hash value.
  • FIG. 8 is a schematic structural diagram of a TLS certificate authentication device provided by another embodiment of the present invention, and the device can be implemented in software and/or hardware.
  • the device can be a client or the aforementioned terminal device.
  • the TLS certificate authentication device provided by the embodiment of the present invention may further include:
  • the second receiving module 65 is configured to receive the M-1 level TLS certificate sent by the second server, where M is an integer greater than 1, and the M-1 level TLS certificate includes the second level TLS certificate to the Mth level TLS certificate.
  • the authentication module 66 is configured to authenticate the M-1 level TLS certificate level by level according to the public key of the local root certificate.
  • the authentication module 66 is specifically used for:
  • the M-1 TLS certificate is authenticated step by step from the M-level TLS certificate to the second-level TLS certificate.
  • the authentication module 66 is specifically used for:
  • the M-1 TLS certificate is authenticated step by step from the second TLS certificate to the M-1 TLS certificate.
  • the first processing module 67 is configured to, if the authentication of the M-1 level TLS certificate is successful, obtain M-1 second hash values through the hash operation on the M-1 level TLS certificate.
  • the establishment module 68 is used to establish a second hash value database according to the M-1 second hash values.
  • FIG. 9 is a schematic structural diagram of a TLS certificate authentication apparatus provided by another embodiment of the present invention, and the apparatus may be implemented by software and/or hardware.
  • the device can be a client or the aforementioned terminal device.
  • the TLS certificate authentication apparatus provided by the embodiment of the present invention may further include:
  • the second processing module 71 is configured to perform a TLS standard verification process if there is no second hash value equal to the first hash value in any of the first hash values, and the TLS standard verification process is based on the local root certificate Public key, from the Nth level TLS certificate to the level N-1 level TLS certificate, until the second level TLS certificate is verified.
  • FIG. 10 is a schematic structural diagram of a TLS certificate authentication device provided by still another embodiment of the present invention, and the device can be implemented by software and/or hardware.
  • the device can be a client or the aforementioned terminal device.
  • the TLS certificate authentication device provided by the embodiment of the present invention may further include:
  • the third processing module 72 is configured to, if there is no second hash value equal to the first hash value in any of the first hash values, step by step from the second level TLS certificate according to the public key of the local root certificate Validate the N-1 level TLS certificate downwards until the Nth level TLS certificate is completed.
  • the third processing module 72 is specifically configured to:
  • S1 Parse the local root certificate and the second level TLS certificate sent by the first server into the memory, and use the public key of the local root certificate to authenticate the second level TLS certificate, where the local root certificate is used as the verification certificate, and the second level TLS The certificate is to be verified;
  • step S3 Repeat step S2 until the certification of the Nth level certificate is completed.
  • FIG. 11 is a schematic structural diagram of a TLS certificate authentication apparatus provided by still another embodiment of the present invention.
  • the device can be implemented in software and/or hardware.
  • the device can be a client or the aforementioned terminal device.
  • the following describes the TLS certificate authentication method with the terminal device as the executive body.
  • the TLS certificate authentication apparatus provided by the embodiment of the present invention may further include:
  • the storage module 73 is configured to store N-1 first hash values as N-1 second hash values if the N-1 level certificate is successfully authenticated, and set N-1 first hash values as N-1 second hash values.
  • the -1 second hash value is stored in the second hash value database for later authentication of the N-1 level TLS certificate.
  • FIG. 12 is a schematic diagram of a terminal device provided by an embodiment of the present invention. As shown in FIG. 12, the terminal device provided by this application includes:
  • the computer program is stored in the memory 82 and is configured to be executed by the processor 81,
  • the computer program includes instructions for executing the above TLS certificate authentication method. For the content and effect, please refer to the method embodiment.
  • An embodiment of the present application also provides a computer-readable storage medium.
  • the storage medium includes computer instructions.
  • the instructions When the instructions are executed by a computer, the computer can implement the TLS certificate authentication method in the above-mentioned embodiment.
  • the method section. I won’t repeat it here.
  • An embodiment of the present application also provides a computer program product, including computer instructions.
  • the instructions When the instructions are executed by a computer, the computer realizes the TLS certificate authentication method provided in the above-mentioned embodiments.
  • the content and effect please refer to the method section. Repeat.
  • a person of ordinary skill in the art can understand that all or part of the steps in the foregoing method embodiments can be implemented by a program instructing relevant hardware.
  • the aforementioned program can be stored in a computer readable storage medium. When the program is executed, it executes the steps including the foregoing method embodiments; and the foregoing storage medium includes: ROM, RAM, magnetic disk, or optical disk and other media that can store program codes.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

本申请提供一种TLS证书认证方法、装置、设备及存储介质，包括：接收服务器发送的N-1级TLS证书，N为大于1的整数，并分别对N-1级TLS证书通过哈希运算得到N-1个第一哈希值，N-1级TLS证书包括第二级TLS证书至第N级TLS证书；获取第二哈希值数据库，第二哈希值数据库中包括至少一个第二哈希值，第二哈希值为对认证成功的TLS证书通过哈希运算得到的哈希值；针对任一个第一哈希值，比较第一哈希值与第一哈希值对应级数的第二哈希值；若每个第一哈希值均存在与该第一哈希值相等的第二哈希值，则判定N-1级TLS证书认证成功。实现了对TLS证书的认证，提高了TLS证书的认证效率。

Description

TLS证书认证方法、装置、设备及存储介质 技术领域
本申请涉及通信安全技术领域，尤其涉及一种TLS证书认证方法、装置、设备及存储介质。
背景技术
安全传输层协议(Transport Layer Security，TLS)用于在两个通信应用程序之间提供保密性和数据完整性，该协议由TLS记录协议和TLS握手协议两层组成。两个通信应用程序在进行安全通信前，必须通过TLS握手协议，利用非对称加密演算来对通信双方做身份认证，然后交互对称密钥作为后续数据交互的会谈密钥，该会谈密钥用来将通信双方交换的数据做加密，保证了两个应用程序之间通信的保密性和可靠性。在握手过程中，TLS证书认证是非常重要和关键的一个环节，通过客户端解析服务端发送的证书的有效性，验证通信的安全性。
现有技术中，在通过客户端对服务端发送的证书的验证过程中，通常采用TLS标准验证流程。在TLS标准验证流程中，服务端将多级证书(从父证书到叶子证书)发送给客户端，客户端利用本地根证书从叶子证书开始逐级往上进行验证，每验证一级，解析一级证书，直到验证到父证书，完成TLS证书认证。
然而，现有技术中，通过TLS标准验证流程认证TLS证书的过程中，由于从叶子证书开始逐级往上进行验证，TLS证书认证效率较低。
发明内容
本申请提供一种TLS证书认证方法、装置、设备及存储介质。
第一方面，本申请提供一种TLS证书认证方法，包括：
接收第一服务器发送的N-1级TLS证书，N为大于1的整数，并分别对N-1级TLS证书通过哈希运算得到N-1个第一哈希值，N-1级TLS证书包括第二级TLS证书至第N级TLS证书；获取第二哈希值数据库，第二哈希值 数据库中包括至少一个第二哈希值，第二哈希值为对认证成功的TLS证书通过哈希运算得到的哈希值；针对任一个第一哈希值，比较第一哈希值与第一哈希值对应级数的第二哈希值；若每个第一哈希值均存在与该第一哈希值相等的第二哈希值，则判定N-1级TLS证书认证成功。
本方案中，客户端通过接收第一服务器发送的N-1级TLS证书，并通过哈希运算得到N-1个第一哈希值，利用已经认证成功过的TLS证书通过计算得到的第二哈希值，分别比较对应级数的第一哈希值与第二哈希值，若每个第一哈希值均存在与该第一哈希值相等的第二哈希值，TLS证书认证成功。由于通过比较每个第一哈希值与第一哈希值对应级数的第二哈希值，对TLS证书认证，提高了TLS证书认证的效率。
可选的，在接收第一服务器发送的N-1级TLS证书之前，还包括：
接收第二服务器发送的M-1级TLS证书，M为大于1的整数，M-1级TLS证书包括第二级TLS证书至第M级TLS证书；根据本地根证书的公钥，对M-1级TLS证书进行逐级认证；若对M-1级TLS证书认证成功，则分别对M-1级TLS证书通过哈希运算得到M-1个第二哈希值；根据M-1个第二哈希值建立第二哈希值数据库。
本方案中，通过根据本地根证书的公钥，对M-1级TLS证书进行逐级认证，并通过将认证成功的M-1个第二哈希值保存至第二哈希值数据库中，实现了对第二哈希值数据库的建立。
可选的，根据本地根证书的公钥，对M-1级TLS证书进行逐级认证，包括：
根据本地根证书的公钥，自第M级TLS证书逐级向上认证M-1级TLS证书，直至认证完成第二级TLS证书。
可选的，根据本地根证书的公钥，对M-1级TLS证书进行逐级认证，包括：
根据本地根证书的公钥，自第二级TLS证书逐级向下认证M-1级TLS证书，直至认证完成第M级TLS证书。可选的，本申请实施例提供的TLS证书认证方法，还包括：
若任一第一哈希值不存在与该第一哈希值相等的第二哈希值，则执行TLS标准验证流程，TLS标准验证流程为根据本地根证书的公钥，自第N级 TLS证书逐级向上认证N-1级TLS证书，直至认证完成第二级TLS证书。
通过首先分别比较对应级数的第一哈希值与第二哈希值，对TLS证书进行认证，若认证不成功，则采用TLS标准验证流程对TLS证书进行认证，实现了对TLS证书的认证，从而提高了TLS证书认证的可靠性。
可选的，本申请实施例提供的TLS证书认证方法，还包括：
若任一第一哈希值不存在与该第一哈希值相等的第二哈希值，则根据本地根证书的公钥自第二级TLS证书逐级向下认证N-1级TLS证书，直至认证完成第N级TLS证书。
通过对根据本地根证书自第二级TLS证书逐级向下认证N-1级TLS证书，直至认证完成第N级TLS证书，提高了证书认证效率。
可选的，根据本地根证书的公钥自第二级TLS证书逐级向下认证N-1级TLS证书，直至认证完成第N级TLS证书，包括：
S1：解析本地根证书与第一服务器发送的第二级TLS证书到内存中，使用本地根证书的公钥认证第二级TLS证书，其中，将本地根证书作为验证证书，将第二级TLS证书作为待验证证书；
S2：若对待验证证书认证成功，则释放验证证书，将待验证证书作为验证证书，解析第一服务器发送的验证证书的下一级TLS证书到内存中，并将下一级证书作为待验证证书，使用验证证书认证待验证证书；
S3：循环步骤S2，直到完成认证第N级证书为止。
通过对根据本地根证书自第二级TLS证书逐级向下认证N-1级TLS证书，直至认证完成第N级TLS证书，并且在TLS证书认证过程中，释放掉验证证书，节省了客户端大量的内存资源。
可选的，本申请实施例提供的TLS证书认证方法，包括：
若N-1级TLS证书认证成功，则将N-1个第一哈希值作为第二哈希值，并将N-1个第二哈希值保存至第二哈希值数据库中，用于之后认证N-1级TLS证书。
通过保存认证成功的N-1级TLS证书的第一哈希值，可以有效的提高之后对N-1级TLS证书进行认证的认证效率。
下面将介绍装置、设备、存储介质及计算机程序产品，其效果可参考方法部分的效果，下面对此不再赘述。
第二方面，本申请提供一种TLS证书认证装置，其特征在于，包括：
第一接收模块，用于接收第一服务器发送的N-1级TLS证书，N为大于1的整数，并分别对N-1级TLS证书通过哈希运算得到N-1个第一哈希值，N-1级TLS证书包括第二级TLS证书至第N级TLS证书；
获取模块，用于获取第二哈希值数据库，第二哈希值数据库中包括至少一个第二哈希值，第二哈希值为对认证成功的TLS证书通过哈希运算得到的哈希值。
比较模块，用于针对任一个第一哈希值，比较第一哈希值与第一哈希值对应级数的第二哈希值。
判断模块，用于若每个第一哈希值均存在与该第一哈希值相等的第二哈希值，则判定N-1级TLS证书认证成功。
可选的，本申请提供的TLS证书认证装置，还包括：
第二接收模块，用于接收第二服务器发送的M-1级TLS证书，M为大于1的整数，M-1级TLS证书包括第二级TLS证书至第M级TLS证书。
认证模块，用于根据本地根证书的公钥，对M-1级TLS证书进行逐级认证。
第一处理模块，用于若对M-1级TLS证书认证成功，则分别对M-1级TLS证书通过哈希运算得到M-1个第二哈希值。
建立模块用于，根据M-1个第二哈希值建立第二哈希值数据库。
可选的，认证模块具体用于：
根据本地根证书的公钥，自第M级TLS证书逐级向上认证M-1级TLS证书，直至认证完成第二级TLS证书。
可选的，认证模块具体用于：
根据本地根证书的公钥，自第二级TLS证书逐级向下认证M-1级TLS证书，直至认证完成第M级TLS证书。
可选的，本申请提供的TLS证书认证装置，还包括：
第二处理模块，用于若任一第一哈希值不存在与该第一哈希值相等的第二哈希值，则执行TLS标准验证流程，TLS标准验证流程为根据本地根证书的公钥自第N级TLS证书逐级向上认证N-1级TLS证书，直至认证完成第二级TLS证书。
可选的，本申请提供的TLS证书认证装置，还包括：
第三处理模块，用于若任一第一哈希值不存在与该第一哈希值相等的第二哈希值，则根据本地根证书的公钥，自第二级TLS证书逐级向下认证N-1级TLS证书，直至认证完成第N级TLS证书。
可选的，第三处理模块具体用于：
S1：解析本地根证书与第一服务器发送的第二级TLS证书到内存中，使用本地根证书的公钥认证第二级TLS证书，其中，将本地根证书作为验证证书，将第二级TLS证书作为待验证证书；
S2：若对待验证证书认证成功，则释放验证证书，将待验证证书作为验证证书，解析第一服务器发送的验证证书的下一级TLS证书到内存中，并将下一级证书作为待验证证书，使用验证证书认证待验证证书；
S3：循环步骤S2，直到完成认证第N级证书为止。
可选的，本申请提供的TLS证书认证装置，包括：
存储模块，用于若认证N-1级证书成功，则将N-1个第一哈希值作为N-1个第二哈希值，并将N-1个第二哈希值保存至第二哈希值数据库中，用于之后认证N-1级TLS证书。。
第三方面，本申请提供一种终端设备，包括：处理器和存储器，
存储器用于存储计算机可执行指令，以使处理器执行指令实现如第一方面及第一方面可选方式的TLS证书认证方法。
第四方面，本申请提供一种计算机可读存储介质，存储介质包括计算机指令，当指令被计算机执行时，使得计算机实现如第一方面及第一方面可选方式的TLS证书认证方法。
第五方面，本申请提供一种计算机程序产品，包括计算机指令，当指令被计算机执行时，使得计算机实现第一方面或第一方面的方法。
本申请提供一种TLS证书认证方法、装置、设备及存储介质，通过接收服务器发送的N-1级TLS证书，N为大于1的整数，并分别对N-1级TLS证书通过哈希运算得到N-1个第一哈希值，N-1级TLS证书包括第二级TLS证书至第N级TLS证书；获取第二哈希值数据库，第二哈希值数据库中包括至少一个第二哈希值，第二哈希值为对认证成功的TLS证书通过哈希运算得到的哈希值；针对任一个第一哈希值，比较第一哈希值与第一哈希值对应级 数的第二哈希值；若每个第一哈希值均存在与该第一哈希值相等的第二哈希值，则判定N-1级TLS证书认证成功。由于通过比较每个第一哈希值与第一哈希值对应级数的第二哈希值，对TLS证书进行认证，提高了TLS证书认证的效率。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作一简单地介绍，显而易见地，下面描述中的附图是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1是本申请实施例示出的一种可选的应用场景示意图；
图2是本申请一实施例提供的TLS证书认证方法的流程示意图；
图3是本申请一实施例提供的建立第二哈希值数据库的流程示意图；
图4是本申请另一实施例提供的TLS证书认证方法的流程示意图；
图5是本申请再一实施例提供的TLS证书认证方法的流程示意图；
图6是本申请再一实施例提供的TLS证书认证的流程示意流程图；
图7是本发明一实施例提供的TLS证书认证装置的结构示意图；
图8是本发明另一实施例提供的TLS证书认证装置的结构示意图；
图9是本发明又一实施例提供的TLS证书认证装置的结构示意图；
图10是本发明再一实施例提供的TLS证书认证装置的结构示意图；
图11是本发明又另一实施例提供的TLS证书认证装置的结构示意图；
图12是本发明实施例提供的终端设备的示意图。
具体实施方式
为使本申请实施例的目的、技术方案和优点更加清楚，下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”、 “第三”、“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本申请的实施例，例如能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
在客户端与服务端进行安全通信前，必须通过TLS握手协议，利用非对称加密演算来对通信双方做身份认证，之后交互对称密钥作为后续数据交互的会谈密钥，该会谈密钥用来将通信双方交换的数据做加密，保证了两个应用程序之间通信的保密性和可靠性。在握手过程中，TLS证书认证是非常重要和关键的一个环节，通过客户端解析服务端发送的证书的有效性，验证通信的安全性。然而，现有技术中对对TLS证书认证的过程比较繁琐，为了提高TLS证书认证效率，本申请提供一种TLS证书认证方法、装置、设备及存储介质。
以下，对本申请实施例的示例性应用场景进行介绍。
图1是本申请实施例示出的一种可选的应用场景示意图。如图1所示，通信双方分别为客户端11和服务器端12，当客户端11连接到支持TLS协议的服务器端12，将要求创建安全连接的消息以及受支持的密码组合列表发送至服务器端12，服务器端12接收到客户端11发送过来的密码组合列表，并从该密码组合列表中选择一组密码组合作为本次握手使用的加密密码算法以及加密哈希函数，并通知客户端11，然后发送TLS证书到客户端11，客户端11获取到服务器端12发送过来的一组密码组合，并接收服务器端12发送的TLS证书准备进行TLS证书认证。若TLS证书认证成功，则允许该服务器端12与该客户端11通信，若TLS证书认证不成功，则不允许该服务器端12与该客户端11通信。密码组合例如可以是加密密码算法和加密哈希函数。
其中，客户端11可以是微控制单元(Microcontroller Unit，MCU)、个人电脑(Personal Computer，简称：PC)或者移动终端等，该移动终端也可以称为用户设备(User Equipment，简称：UE)、接入终端、用户单元、用户站、移动站、移动台、用户终端、终端、无线通信设备、用户代理或用户装 置。移动终端可以是智能手机、蜂窝电话、无绳电话、平板电脑、个人数字处理(Personal Digital Assistant，简称：PDA)设备、具有无线通信功能的手持设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备等。服务器端可以是服务器、PC等，本发明实施例对服务器的类型不做限制。
基于上述应用场景，下面对本申请技术方案进行详细介绍：
图2是本申请一实施例提供的TLS证书认证方法的流程示意图，其中该方法可以由TLS证书认证装置执行，该装置可以通过软件和/或硬件的方式实现。例如：该装置可以是客户端或上述终端设备。下面以终端设备为执行主体对TLS证书认证方法进行说明。如图2所示，本申请实施例提供的TLS证书认证方法可以包括：
步骤S101：接收第一服务器发送的N-1级TLS证书，N为大于1的整数，并分别对N-1级TLS证书通过哈希运算得到N-1个第一哈希值，N-1级TLS证书包括第二级TLS证书至第N级TLS证书。
第一服务器可以是上述服务器中的任意一种，本发明实施例对第一服务器的类型不做限制。第一服务器向客户端发送的N-1级TLS证书，其中，N-1级TLS证书包括第二级TLS证书、第三级TLS证书……直到第N级TLS证书，其中，第二级证书可以简称为二级证书，第三级证书可以简称为三级证书，依次类推，本发明实施例对此不做限制。二级TLS证书由本地根证书签发，并且本地根证书可以对二级TLS证书验证，三级TLS证书由二级TLS证书签发，并且二级TLS证书可以对三级TLS证书验证，各级TLS证书既可以签发下一级TLS证书，也可以对下一级TLS证书进行验证，对于客户端而言，只需要公开信息中的本地根证书，验证与其通信服务器端的N-1级TLS证书，即可验证与其通信的身份是否可信任。
终端设备接收第一服务器发送的N-1级TLS证书，并根据在握手过程中，接收的第一服务器发送的一组密码组合中的加密密码算法和加密哈希函数，对第一服务器发送的N-1级TLS证书根据哈希运算得到各级TLS证书的第一哈希值，其中，不同的TLS证书经过哈希运算可以得到不同的第一哈希值。由于哈希运算算法的唯一确定性，只要两个TLS证书的哈希值相等，则可以确定该两个TLS证书是相同的。
步骤S102：获取第二哈希值数据库，第二哈希值数据库中包括至少一个 第二哈希值，第二哈希值为对认证成功的TLS证书通过哈希运算得到的哈希值。
第二哈希值数据库中包括至少一个第二哈希值，其中，不同级数的第二哈希值可以在数据库中分开标识，例如，第二级TLS证书根据哈希运算得到的哈希值标识为第二级哈希值，第三级TLS证书根据哈希运算得到的哈希值标识为第三级哈希值，等等，本申请实施例此不做限制，只要能够区分第二哈希值的级数即可。步骤S103：针对任一个第一哈希值，比较第一哈希值与第一哈希值对应级数的第二哈希值。
终端设备在认证该第一服务器端发送的N-1级TLS证书之前，可能曾经与该第一服务器或其他服务器握手成功并进行通信过，则终端设备曾认证成功过多个TLS证书。由于哈希运算算法的唯一确定性，只要两个TLS证书的哈希值相等，则可以确定该两个TLS证书是相同的，因此，可以通过将已认证成功的TLS证书通过哈希运算得到的第二哈希值，与本次需要认证的TLS证书通过哈希运算得到的第一哈希值进行比较，并通过第一哈希值与第二哈希值的关系，进而判断本次需要认证的N-1级TLS证书是否认证成功过，若判断本次需要认证的N-1级TLS证书认证成功过，则不需要对N-1级TLS证书进行解析并分级验证。若判断本次需要认证的N-1级TLS证书认证不成功，则需要对N-1级TLS证书进行解析并分级验证。
由于不同级的TLS证书的哈希运算方法可能不同，在比较第一哈希值与第二哈希值的过程中，需要对每个第一哈希值与每个第一哈希值对应级数的第二哈希值进行比较，另外，本发明实施例对比较任意级数的第一哈希值与第二哈希值的顺序不做限制。
步骤S104：若每个第一哈希值均存在与该第一哈希值相等的第二哈希值，则判定N-1级TLS证书认证成功。
经过比较，若每个第一哈希值与每个第一哈希值对应级数的第二哈希值均相等，则说明N-1级TLS证书曾经认证成功过，N-1级TLS证书认证成功，终端设备可以与第一服务器进行通信。若经过比较，存在第一哈希值与第一哈希值对应级数的第二哈希值不相等的情况，则说明N-1级TLS证书未曾认证成功过，则初步判断N-1级TLS证书认证不成功。若N-1级TLS证书认证成功，则终端设备与第一服务器可以安全通信。
本实施例中，通过接收第一服务器发送的N-1级TLS证书，N为大于1的整数，并对N-1级TLS证书通过哈希运算得到N-1个第一哈希值，然后针对任一个第一哈希值，比较第一哈希值与第一哈希值对应级数的第二哈希值，第二哈希值为对认证成功的TLS证书通过哈希运算得到的哈希值，最后若每个第一哈希值与每个第一哈希值对应级数的第二哈希值均相等，则N-1级TLS证书认证成功。由于通过比较每个第一哈希值与第一哈希值对应级数的第二哈希值，对TLS证书进行认证，提高了TLS证书认证的效率。
在通过比较TLS证书的哈希值认证TLS证书之前，为了建立第二哈希值数据库，可选的，图3是本申请一实施例提供的建立第二哈希值数据库的流程示意图，其中该方法可以由TLS证书认证装置执行，该装置可以通过软件和/或硬件的方式实现。例如：该装置可以是客户端或上述终端设备。下面以终端设备为执行主体对TLS证书认证方法进行说明。如图3所示，在接收服务器发送的N-1级TLS证书之前，还可以包括：
步骤S201：接收第二服务器发送的M-1级TLS证书，M为大于1的整数，M-1级TLS证书包括第二级TLS证书至第M级TLS证书。
其中，第二服务器与第一服务器可以为同一个服务器，也可以为不同的服务器，第二服务器可以为上述服务器中的任意一种，本发明实施例对第二服务器的类型不做限制。终端设备接收第二服务器发送的M-1级TLS证书，其中，M为大于1的整数，本申请实施例对M的具体数值不做限制。
步骤S202：根据本地根证书的公钥，对M-1级TLS证书进行逐级认证。
终端设备通过根据本地根证书的公钥，对M-1级TLS证书进行逐级认证，在一种可能的实施方式中，可以包括：
根据本地根证书的公钥，自第M级TLS证书逐级向上认证M-1级TLS证书，直至认证完成第二级TLS证书。
具体的，根据本地根证书的公钥，以及M级TLS证书的公钥，逐级认证M-1级TLS证书，直到认证完成第二级TLS证书，详细步骤可参考步骤S301中对TLS标准验证流程的具体介绍，此处不做具体描述。
根据本地根证书的公钥，对M-1级TLS证书进行逐级认证，在另一种可能的实施方式中，可以包括：
根据本地根证书的公钥，自第二级TLS证书逐级向下认证M-1级TLS证书，直至认证完成第M级TLS证书。
具体的，可以参考下述实施例中步骤S401中对根据本地根证书的公钥，自第二级TLS证书逐级向下认证M-1级TLS证书，直至认证完成第M级TLS证书的介绍，此处不做具体描述。
步骤S203：若对M-1级TLS证书认证成功，则分别对M-1级TLS证书通过哈希运算得到M-1个第二哈希值。
若对M-1级TLS证书认证成功，则表示终端设备与第二服务器握手成功。通过将已认证成功的TLS证书通过哈希运算得到的第二哈希值。
步骤S204：根据M-1个第二哈希值建立第二哈希值数据库。
根据M-1个第二哈希值，建立第二哈希值数据库，当终端设备再次与第二服务器进行通信时，可以通过比较哈希值的方式对第二服务器发送的TLS证书进行认证，提高了TLS证书的认证效率。
在终端设备与其他服务器通信成功之后，也可以将其对应的TLS证书通过哈希计算得到多个第二哈希值，然后保存至第二哈希值数据库中，以不断更新第二哈希值数据库。
本方案中，通过根据本地根证书的公钥，对M-1级TLS证书进行逐级认证，并通过将认证成功的M-1个第二哈希值保存至第二哈希值数据库中，实现了对第二哈希值数据库的建立。
在上述实施例的基础上，在步骤S103的比较第一哈希值与第一哈希值对应级数的第二哈希值的过程中，还可能存在第一哈希值与第一哈希值对应级数的第二哈希值不相等的情况，下面针对这种情况进行示例性介绍。在一种可能的实施方式中，图4是本申请另一实施例提供的TLS证书认证方法的流程示意图，其中该方法可以由TLS证书认证装置执行，该装置可以通过软件和/或硬件的方式实现。例如：该装置可以是客户端或上述终端设备。下面以终端设备为执行主体对TLS证书认证方法进行说明。如图4所示，本申请实施例提供的TLS证书认证方法还可以包括：
步骤S301：若任一第一哈希值不存在与该第一哈希值相等的第二哈希值，则执行TLS标准验证流程，TLS标准验证流程为根据本地根证书的公钥自第 N级TLS证书逐级向上认证N-1级TLS证书，直至认证完成第二级TLS证书。
若任一第一哈希值与第一哈希值对应级数的第二哈希值不相等，则无法通过比较第一哈希值与第一哈希值对应级数的第二哈希值的方式来判断N-1级TLS证书是否认证成功，但可以通过执行TLS标准验证流程，对N-1个TLS证书进行认证。下面以服务器发送的N-1级TLS证书包括二级TLS证书、三级TLS证书以及四级TLS证书为例进行介绍，在一种可能的实施方式中，二级TLS证书为研发部证书，三级TLS证书为PC厂证书，四级TLS证书为PC证书。TLS标准验证流程中根据本地根证书自第N级TLS证书逐级向上认证N-1级TLS证书，直至认证完成第二级TLS证书，包括：
步骤1、服务器发送证书链即研发部证书、PC厂证书和PC证书至终端设备，终端设备将证书链中的证书解析出来存放到内存中备用。
步骤2、终端设备通过本地根证书认证服务器发送的PC证书，由于本地根证书无法对PC证书进行认证，因此认证失败并转入步骤3。
步骤3、通过服务器发送的证书链中的PC厂证书认证PC证书，由于PC厂证书为PC证书的上一级证书，因此PC厂证书可以对PC证书进行认证，如果认证失败，则TLS证书认证失败，若PC证书认证成功则转入步骤4。
步骤4、终端设备通过本地根证书认证服务器发送的PC厂证书，由于本地根证书无法对PC厂证书进行认证，因此认证失败并转入步骤5。
步骤5、通过服务器发送的证书链中的研发部证书认证PC厂证书，由于研发部证书为PC厂证书的上一级证书，因此研发部证书可以对PC厂证书进行认证，如果认证失败，则TLS证书认证失败，若PC厂证书认证成功则转入步骤6。
步骤6、终端设备通过本地根证书认证服务器发送的研发部证书，如果认证失败，则TLS证书认证失败，如果认证成功，TLS证书认证成功。
本申请实施例中，通过首先分别比较对应级数的第一哈希值与第二哈希值，对N-1级TLS证书进行认证，若认证不成功，则采用TLS标准验证流程对TLS证书进行认证，实现了对TLS证书的认证，并提高了TLS证书认证的可靠性。
为了在无法通过比较第一哈希值与第一哈希值对应级数的第二哈希值的方式来判断N-1级TLS证书是否认证成功时，进一步对N-1个TLS证书进行认证。在另一种可能的实施方式中，图5是本申请再一实施例提供的TLS证书认证方法的流程示意图，其中该方法可以由TLS证书认证装置执行，该装置可以通过软件和/或硬件的方式实现。例如：该装置可以是客户端或上述终端设备。下面以终端设备为执行主体对TLS证书认证方法进行说明。下面以上述实施例中服务器发送的证书链为例进行介绍。如图5所示，本申请提供的TLS证书认证方法还可以包括：
步骤S401：若任一第一哈希值不存在与该第一哈希值相等的第二哈希值，则根据本地根证书的公钥自第二级TLS证书逐级向下认证N-1级TLS证书，直至认证完成第N级TLS证书。
由于本地根证书为第二级TLS证书的上一级证书，可以对第二级TLS证书进行认证，然后通过第二级TLS证书对第三级TLS证书进行认证，依次类推，直至认证完成第N级TLS证书，由于避免了根据本地根证书去认证其无法认证级数的TLS证书的过程，提高了证书认证效率。
示例性的，服务器发送证书链即研发部证书、PC厂证书、PC证书至终端设备，终端设备解析本地根证书存放到内存中备用，然后终端设备解析服务器证书链中的研发部证书到内存中，根据本地根证书认证研发部证书，若研发部证书认证失败则结束认证流程，TLS证书认证失败，若研发部证书认证成功，则解析服务器发送的PC厂证书到内存中，用研发部证书认证PC厂证书，若PC厂证书认证失败则结束认证流程，TLS证书认证失败，若PC厂证书认证成功，则解析服务器的PC证书到内存中，用PC厂证书认证PC证书，若认证失败则结束认证流程，TLS证书认证失败，若认证成功则TLS证书认证成功。
本申请实施例中，通过本地根证书对第二级TLS证书进行认证，然后通过第二级TLS证书对第三级TLS证书进行认证，依次类推，直至认证完成第N级TLS证书，由于避免了根据本地根证书去认证其无法认证级数的TLS证书的过程，提高了证书认证效率。
在TLS标准验证流程中本地根证书以及服务器发送的证书链均存与内存 中，服务器包括多少级证书就要消耗多少级证书的内存空间。为了节省了内存资源，可选的，图6是本申请再一实施例提供的TLS证书认证的流程示意图，其中该方法可以由TLS证书认证装置执行，该装置可以通过软件和/或硬件的方式实现。例如：该装置可以是客户端或上述终端设备。下面以终端设备为执行主体对TLS证书认证方法进行说明。如图6所示，根据本地根证书自第二级TLS证书逐级向下认证N-1级TLS证书，直至认证完成第N级TLS证书，包括：
S1：解析本地根证书与第一服务器发送的第二级TLS证书到内存中，使用本地根证书的公钥认证第二级TLS证书，其中，将本地根证书作为验证证书，将第二级TLS证书作为待验证证书。
在终端设备接收到第一服务器发送的N-1级TLS证书之后，终端设备解析本地根证书与第一服务器发送的第二级TLS证书到内存中，然后使用本地根证书认证第二级TLS证书。以本地根证书去认证第二级TLS证书，则将本地根证书作为验证证书，将第二级TLS证书作为待验证证书。若待验证证书认证成功，则执行步骤S2，若待验证证书认证不成功，则对N-1级TLS证书认证失败。
S2：若对待验证证书认证成功，则释放验证证书，将待验证证书作为验证证书，解析第一服务器发送的验证证书的下一级TLS证书到内存中，并将下一级证书作为待验证证书，使用验证证书认证待验证证书。
若对第二级TLS证书认证成功，则释放本地根证书，并将第二级TLS证书作为验证证书，解析第二级TLS证书的下一级证书即第三级TLS证书至内存中，并将第三级TLS证书作为待验证证书，使第二级TLS证书验证第三级TLS证书，若第三级TLS证书验证失败，则N-1级TLS证书认证失败，若第三级TLS证书认证成功，则执行步骤S3。
S3：循环步骤S2，直到完成认证第N级证书为止。
在步骤S3中，循环步骤S2，直到完成认证第N级证书为止，具体的，若第三级TLS证书认证成功，则释放第二级TLS证书的内存，并将第三级TLS证书作为验证证书，解析第三级TLS证书的下一级证书即第四级TLS证书至内存中，并作为待验证证书，使第三级TLS证书验证第四级TLS证书，若第四级TLS证书认证成功，则释放第三级TLS证书的内存，并将第四级 TLS证书作为验证证书，去验证第四级TLS证书的下一级证书，依次类推，直到验证完成第N-1级TLS证书。
本申请实施例中，通过对根据本地根证书自第二级TLS证书逐级向下认证N-1级TLS证书，直至认证完成第N级TLS证书，并且在TLS证书认证过程中，释放掉验证证书，节省了客户端大量的内存资源。
若N-1级TLS证书认证成功，为了在之后终端设备与该第一服务器握手的过程中，提高该第一服务器发送的TLS证书的认证效率，在一种可能的实施方式中，若N-1级TLS证书认证成功，则将N-1个第一哈希值作为N-1个第二哈希值，并将N-1个第二哈希值保存至第二哈希值数据库中，用于之后认证N-1级TLS证书。。
第二哈希值数据库可以保存在终端设备中的可读取的内存中，本发明实施例对保存N-1个第一哈希值的位置不做限制，只要能够为终端设备的TLS证书认证的过程中，能够读取出来即可。在保存N-1个第一哈希值时，还可以同时保存每个第一哈希值对应的级数，不同级数的第一哈希值可以保存在不同的存储单元中，以便于使用。通过保存认证成功的N-1级TLS证书的第一哈希值，可以有效的提高之后对N-1级TLS证书的认证效率。
下面将介绍装置、设备、存储介质及计算机程序产品，其效果可参考方法部分的效果，下面对此不再赘述。
图7是本发明一实施例提供的TLS证书认证装置的结构示意图，该装置可以通过软件和/或硬件的方式实现。例如：该装置可以是客户端或上述终端设备。如图7所示，本发明实施例提供的TLS证书认证装置可以包括：
第一接收模块61，用于接收第一服务器发送的N-1级TLS证书，N为大于1的整数，并分别对N-1级TLS证书通过哈希运算得到N-1个第一哈希值，N-1级TLS证书包括第二级TLS证书至第N级TLS证书；
获取模块62，用于获取第二哈希值数据库，第二哈希值数据库中包括至少一个第二哈希值，第二哈希值为对认证成功的TLS证书通过哈希运算得到的哈希值。
比较模块63，用于针对任一个第一哈希值，比较第一哈希值与第一哈希值对应级数的第二哈希值。
判断模块64，用于若每个第一哈希值均存在与该第一哈希值相等的第二哈希值，则判定N-1级TLS证书认证成功。
可选的，图8是本发明另一实施例提供的TLS证书认证装置的结构示意图，该装置可以通过软件和/或硬件的方式实现。例如：该装置可以是客户端或上述终端设备。如图8所示，本发明实施例提供的TLS证书认证装置还可以包括：
第二接收模块65，用于接收第二服务器发送的M-1级TLS证书，M为大于1的整数，M-1级TLS证书包括第二级TLS证书至第M级TLS证书。
认证模块66，用于根据本地根证书的公钥，对M-1级TLS证书进行逐级认证。
可选的，认证模块66具体用于：
根据本地根证书的公钥，自第M级TLS证书逐级向上认证M-1级TLS证书，直至认证完成第二级TLS证书。
可选的，认证模块66具体用于：
根据本地根证书的公钥，自第二级TLS证书逐级向下认证M-1级TLS证书，直至认证完成第M级TLS证书。
第一处理模块67，用于若对M-1级TLS证书认证成功，则分别对M-1级TLS证书通过哈希运算得到M-1个第二哈希值。
建立模块68，用于根据M-1个第二哈希值建立第二哈希值数据库。
可选的，图9是本发明又一实施例提供的TLS证书认证装置的结构示意图，该装置可以通过软件和/或硬件的方式实现。例如：该装置可以是客户端或上述终端设备。如图9所示，本发明实施例提供的TLS证书认证装置还可以包括：
第二处理模块71，用于若任一第一哈希值不存在与该第一哈希值相等的第二哈希值，则执行TLS标准验证流程，TLS标准验证流程为根据本地根证书的公钥，自第N级TLS证书逐级向上认证N-1级TLS证书，直至认证完成第二级TLS证书。
可选的，图10是本发明再一实施例提供的TLS证书认证装置的结构示意图，该装置可以通过软件和/或硬件的方式实现。例如：该装置可以是客户端或上述终端设备。如图10所示，本发明实施例提供的TLS证书认证装置还可以包括：
第三处理模块72，用于若任一第一哈希值不存在与该第一哈希值相等的第二哈希值，则根据本地根证书的公钥，自第二级TLS证书逐级向下认证N-1级TLS证书，直至认证完成第N级TLS证书。
可选的，第三处理模块72具体用于：
S1：解析本地根证书与第一服务器发送的第二级TLS证书到内存中，使用本地根证书的公钥认证第二级TLS证书，其中，将本地根证书作为验证证书，将第二级TLS证书作为待验证证书；
S2：若对待验证证书认证成功，则释放验证证书，将待验证证书作为验证证书，解析第一服务器发送的验证证书的下一级TLS证书到内存中，并将下一级证书作为待验证证书，使用验证证书认证待验证证书；
S3：循环步骤S2，直到完成认证第N级证书为止。
可选的，在第二处理模块71或第三处理模块72之后，图11是本发明又另一实施例提供的TLS证书认证装置的结构示意图，以在第三处理模块72之后为例，该装置可以通过软件和/或硬件的方式实现。例如：该装置可以是客户端或上述终端设备。下面以终端设备为执行主体对TLS证书认证方法进行说明。如图11所示，本发明实施例提供的TLS证书认证装置还可以包括：
存储模块73，用于若认证N-1级证书成功，则保存N-1个第一哈希值将N-1个第一哈希值作为N-1个第二哈希值，并将N-1个第二哈希值保存至第二哈希值数据库中，用于之后认证N-1级TLS证书。
本申请提供一种终端设备，图12是本发明实施例提供的终端设备的示意图，如图12所示，本申请提供的终端设备包括：
处理器81、存储器82、收发器83以及计算机程序；其中，收发器83实现终端设备与服务器端之间的数据传输，计算机程序被存储在存储器82中，并且被配置为由处理器81执行，计算机程序包括用于执行上述TLS证书认 证方法的指令，其内容及效果请参考方法实施例。
本申请一实施例还提供一种计算机可读存储介质，存储介质包括计算机指令，当指令被计算机执行时，使得计算机实现上述实施例中的TLS证书认证方法，其具体内容和效果可参考方法部分，此处不再赘述。
本申请一实施例还提供一种计算机程序产品，包括计算机指令，当指令被计算机执行时，使得计算机实现上述实施例提供的TLS证书认证方法，其内容和效果可参考方法部分，此处不再赘述。
本领域普通技术人员可以理解：实现上述各方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成。前述的程序可以存储于一计算机可读取存储介质中。该程序在执行时，执行包括上述各方法实施例的步骤；而前述的存储介质包括：ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。
最后应说明的是：以上各实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述各实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分或者全部技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的范围。

Claims (18)

  1. 一种TLS证书认证方法，其特征在于，包括：
    接收第一服务器发送的N-1级TLS证书，N为大于1的整数，并分别对所述N-1级TLS证书通过哈希运算得到N-1个第一哈希值，所述N-1级TLS证书包括第二级TLS证书至第N级TLS证书；
    获取第二哈希值数据库，所述第二哈希值数据库中包括至少一个第二哈希值，所述第二哈希值为对认证成功的TLS证书通过哈希运算得到的哈希值；
    针对任一个第一哈希值，比较第一哈希值与所述第一哈希值对应级数的第二哈希值；
    若每个所述第一哈希值均存在与该第一哈希值相等的第二哈希值，则判定所述N-1级TLS证书认证成功。
  2. 根据权利要求1所述的方法，其特征在于，在所述接收服务器发送的N-1级TLS证书之前，还包括：
    接收第二服务器发送的M-1级TLS证书，M为大于1的整数，所述M-1级TLS证书包括第二级TLS证书至第M级TLS证书；
    根据本地根证书的公钥，对所述M-1级TLS证书进行逐级认证；
    若对所述M-1级TLS证书认证成功，则分别对所述M-1级TLS证书通过哈希运算得到M-1个第二哈希值；
    根据所述M-1个第二哈希值建立所述第二哈希值数据库。
  3. 根据权利要求2所述的方法，其特征在于，所述根据本地根证书的公钥，对所述M-1级TLS证书进行逐级认证，包括：
    根据本地根证书的公钥，自第M级TLS证书逐级向上认证所述M-1级TLS证书，直至认证完成第二级TLS证书。
  4. 根据权利要求2所述的方法，其特征在于，所述根据本地根证书的公钥，对所述M-1级TLS证书进行逐级认证，包括：
    根据本地根证书的公钥，自第二级TLS证书逐级向下认证所述M-1级TLS证书，直至认证完成第M级TLS证书。
  5. 根据权利要求1所述的方法，其特征在于，还包括：
    若任一所述第一哈希值不存在与该第一哈希值相等的第二哈希值，则执行TLS标准验证流程，所述TLS标准验证流程为根据本地根证书的公钥，自 第N级TLS证书逐级向上认证所述N-1级TLS证书，直至认证完成第二级TLS证书。
  6. 根据权利要求1所述的方法，其特征在于，还包括：
    若任一所述第一哈希值不存在与该第一哈希值相等的第二哈希值，则根据本地根证书的公钥自第二级TLS证书逐级向下认证所述N-1级TLS证书，直至认证完成第N级TLS证书。
  7. 根据权利要求6所述的方法，其特征在于，所述根据本地根证书的公钥自第二级TLS证书逐级向下认证所述N-1级TLS证书，直至认证完成第N级TLS证书包括：
    S1：解析本地根证书与所述第一服务器发送的第二级TLS证书到内存中，使用所述本地根证书的公钥认证所述第二级TLS证书，其中，将所述本地根证书作为验证证书，将所述第二级TLS证书作为待验证证书；
    S2：若对待验证证书认证成功，则释放验证证书，将待验证证书作为验证证书，解析所述第一服务器发送的验证证书的下一级TLS证书到内存中，并将下一级证书作为待验证证书，使用验证证书认证待验证证书；
    S3：循环步骤S2，直到完成认证第N级证书为止。
  8. 根据权利要求5-7任一项所述的方法，其特征在于，包括：
    若所述N-1级TLS证书认证成功，则将所述N-1个第一哈希值作为N-1个第二哈希值，并将所述N-1个第二哈希值保存至所述第二哈希值数据库中，用于之后认证所述N-1级TLS证书。
  9. 一种TLS证书认证装置，其特征在于，包括：
    第一接收模块，用于接收第一服务器发送的N-1级TLS证书，N为大于1的整数，并分别对所述N-1级TLS证书通过哈希运算得到N-1个第一哈希值，所述N-1级TLS证书包括第二级TLS证书至第N级TLS证书；
    获取模块，用于获取第二哈希值数据库，所述第二哈希值数据库中包括至少一个第二哈希值，所述第二哈希值为对认证成功的TLS证书通过哈希运算得到的哈希值；
    比较模块，用于针对任一个第一哈希值，比较第一哈希值与所述第一哈希值对应级数的第二哈希值；
    判断模块，用于若每个所述第一哈希值均存在与该第一哈希值相等的第 二哈希值，则判定所述N-1级TLS证书认证成功。
  10. 根据权利要求9所述的装置，其特征在于，还包括：
    第二接收模块，用于接收第二服务器发送的M-1级TLS证书，M为大于1的整数，所述M-1级TLS证书包括第二级TLS证书至第M级TLS证书；
    认证模块，用于根据本地根证书的公钥，对所述M-1级TLS证书进行逐级认证；
    第一处理模块，用于若对所述M-1级TLS证书认证成功，则分别对所述M-1级TLS证书通过哈希运算得到M-1个第二哈希值；
    建立模块用于，根据所述M-1个第二哈希值建立所述第二哈希值数据库。
  11. 根据权利要求10所述的装置，其特征在于，所述认证模块具体用于：
    根据本地根证书的公钥，自第M级TLS证书逐级向上认证所述M-1级TLS证书，直至认证完成第二级TLS证书。
  12. 根据权利要求10所述的装置，其特征在于，所述认证模块具体用于：
    根据本地根证书的公钥，自第二级TLS证书逐级向下认证所述M-1级TLS证书，直至认证完成第M级TLS证书。
  13. 根据权利要求9所述的装置，其特征在于，还包括：
    第二处理模块，用于若任一所述第一哈希值不存在与该第一哈希值相等的第二哈希值，则执行TLS标准验证流程，所述TLS标准验证流程为根据本地根证书的公钥，自第N级TLS证书逐级向上认证所述N级TLS证书，直至认证完成第二级TLS证书。
  14. 根据权利要求9所述的装置，其特征在于，还包括：
    第三处理模块，用于若任一所述第一哈希值不存在与该第一哈希值相等的第二哈希值，则根据本地根证书的公钥，自第二级TLS证书逐级向下认证所述N-1级TLS证书，直至认证完成第N级TLS证书。
  15. 根据权利要求14所述的装置，其特征在于，所述第三处理模块具体用于：
    S1：解析本地根证书与所述第一服务器发送的第二级TLS证书到内存中，使用所述本地根证书的公钥认证所述第二级TLS证书，其中，将所述本地根证书作为验证证书，将所述第二级TLS证书作为待验证证书；
    S2：若对待验证证书认证成功，则释放验证证书，将待验证证书作为验 证证书，解析所述第一服务器发送的验证证书的下一级TLS证书到内存中，并将下一级证书作为待验证证书，使用验证证书认证待验证证书；
    S3：循环步骤S2，直到完成认证第N级证书为止。
  16. 根据权利要求13-15任一项所述的装置，其特征在于，包括：
    存储模块，用于若所述N-1级TLS证书认证成功，则将所述N-1个第一哈希值作为N-1个第二哈希值，并将所述N-1个第二哈希值保存至所述第二哈希值数据库中，用于之后认证所述N-1级TLS证书。
  17. 一种终端设备，其特征在于，包括：处理器和存储器，
    所述存储器用于存储计算机可执行指令，以使所述处理器执行所述指令实现如权利要求1至8中任一项权利要求所述的TLS证书认证方法。
  18. 一种计算机可读存储介质，其特征在于，所述存储介质包括计算机指令，当所述指令被计算机执行时，使得所述计算机实现如权利要求1至8中任一项权利要求所述的TLS证书认证方法。
PCT/CN2019/074193 2019-01-31 2019-01-31 Tls证书认证方法、装置、设备及存储介质 Ceased WO2020155022A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN201980000282.6A CN111771357B (zh) 2019-01-31 2019-01-31 Tls证书认证方法、装置、设备及存储介质
PCT/CN2019/074193 WO2020155022A1 (zh) 2019-01-31 2019-01-31 Tls证书认证方法、装置、设备及存储介质

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2019/074193 WO2020155022A1 (zh) 2019-01-31 2019-01-31 Tls证书认证方法、装置、设备及存储介质

Publications (1)

Publication Number Publication Date
WO2020155022A1 true WO2020155022A1 (zh) 2020-08-06

Family

ID=71841722

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/074193 Ceased WO2020155022A1 (zh) 2019-01-31 2019-01-31 Tls证书认证方法、装置、设备及存储介质

Country Status (2)

Country Link
CN (1) CN111771357B (zh)
WO (1) WO2020155022A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112511550B (zh) * 2020-12-02 2022-02-22 迈普通信技术股份有限公司 通信方法、装置、电子设备及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101534262A (zh) * 2009-03-30 2009-09-16 成都市华为赛门铁克科技有限公司 消息传输方法、网络装置及网络系统
US20150188704A1 (en) * 2013-12-27 2015-07-02 Fujitsu Limited Data communication method and data communication apparatus
CN108880821A (zh) * 2018-06-28 2018-11-23 中国联合网络通信集团有限公司 一种数字证书的认证方法及设备
CN108989277A (zh) * 2017-05-31 2018-12-11 三星Sds株式会社 令牌管理方法及用于执行该方法的服务器

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3323232B1 (en) * 2015-07-15 2023-02-22 Telefonaktiebolaget LM Ericsson (publ) Enabling setting up a secure peer-to-peer connection
CN106533689B (zh) * 2015-09-15 2019-07-30 阿里巴巴集团控股有限公司 一种在ssl/tls通信中加载数字证书的方法和装置
US10700853B2 (en) * 2016-07-12 2020-06-30 International Business Machines Corporation Token identity and attribute management

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101534262A (zh) * 2009-03-30 2009-09-16 成都市华为赛门铁克科技有限公司 消息传输方法、网络装置及网络系统
US20150188704A1 (en) * 2013-12-27 2015-07-02 Fujitsu Limited Data communication method and data communication apparatus
CN108989277A (zh) * 2017-05-31 2018-12-11 三星Sds株式会社 令牌管理方法及用于执行该方法的服务器
CN108880821A (zh) * 2018-06-28 2018-11-23 中国联合网络通信集团有限公司 一种数字证书的认证方法及设备

Also Published As

Publication number Publication date
CN111771357A (zh) 2020-10-13
CN111771357B (zh) 2022-05-24

Similar Documents

Publication Publication Date Title
US10638321B2 (en) Wireless network connection method and apparatus, and storage medium
JP6406681B2 (ja) プレアソシエーションサービスディスカバリのためのシステムおよび方法
CN105188055B (zh) 无线网络接入方法、无线接入点以及服务器
CN112566119B (zh) 终端认证方法、装置、计算机设备及存储介质
US20210314293A1 (en) Method and system for using tunnel extensible authentication protocol (teap) for self-sovereign identity based authentication
US9722984B2 (en) Proximity-based authentication
CN104579694A (zh) 一种身份认证方法及系统
CN107547573B (zh) 应用于eSIM的认证方法、RSP终端及管理平台
CN101867929A (zh) 认证方法、系统、认证服务器和终端设备
US10142323B2 (en) Activation of mobile devices in enterprise mobile management
US20170118022A1 (en) Mainstream connection establishment method and device based on multipath transmission control protocol (mptcp)
US20120102319A1 (en) System and Method for Reliably Authenticating an Appliance
US11223954B2 (en) Network authentication method, device, and system
CN105898743A (zh) 一种网络连接方法、装置及系统
CN105141629B (zh) 一种基于WPA/WPA2 PSK多密码提升公用Wi‑Fi网络安全性的方法
CN112235799B (zh) 终端设备入网鉴权方法及系统
CN112235290B (zh) 基于区块链的物联网设备管理方法及第一物联网设备
WO2018099407A1 (zh) 账户认证登录方法及装置
CN110830985A (zh) 一种基于信任机制的5g轻量级终端接入认证方法
US10057252B1 (en) System for secure communications
CN111771357B (zh) Tls证书认证方法、装置、设备及存储介质
CN102026184B (zh) 一种鉴权方法及鉴权系统以及相关设备
US11463433B1 (en) Secure bearer-sensitive authentication and digital object transmission system and method for spoof prevention
JP2017135599A (ja) 無線基地局装置、無線通信システム、及び、無線基地局装置の制御方法
US12556920B2 (en) Random MAC configuring

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19912936

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19912936

Country of ref document: EP

Kind code of ref document: A1