WO2022105590A1

WO2022105590A1 - Domain name certificate detection method and apparatus, electronic device and computer-readable medium

Info

Publication number: WO2022105590A1
Application number: PCT/CN2021/128052
Authority: WO
Inventors: 陆圣超; 钱广杰; 林飞
Original assignee: 上海连尚网络科技有限公司
Priority date: 2020-11-20
Filing date: 2021-11-02
Publication date: 2022-05-27
Also published as: CN112491859B; CN112491859A

Abstract

Disclosed in the embodiments of the present disclosure are a domain name certificate detection method and apparatus, an electronic device and a computer-readable medium. A specific embodiment of the method comprises: acquiring domain name certificates stored in a certificate monitoring client; parsing each of the domain name certificates to generate parsed domain name certificate information, and obtaining a parsed domain name certificate information set; and determining, on the basis of a target domain name certificate information set and the parsed domain name certificate information set, whether there is abnormal domain name certificate information. This embodiment can improve the detection rate of domain name certificates and reduce the frequency of domain name abnormalities. Thereby, the security of network communication is improved.

Description

Domain name certificate detection method, apparatus, electronic device and computer readable medium

technical field

Embodiments of the present disclosure relate to the field of computer technologies, and in particular, to a method, apparatus, electronic device, and computer-readable medium for detecting a domain name certificate.

Background technique

With the rapid development of Internet technology, network security has become particularly important. Domain name certificate (SSL certificate) can realize encrypted transmission of data information between client and server. At present, a third-party certificate monitoring server is usually used to detect the domain name certificate, so as to improve the security of the domain name certificate.

However, when a third-party certificate monitoring server is used to detect domain name certificates, there are often the following technical problems:

First, the third-party certificate monitoring server is used to detect the domain name certificate, which usually misses the detection of the certificate, resulting in a low detection rate of the domain name certificate, resulting in a high frequency of domain name anomalies, and reducing the stability of network communication. This reduces the security of network communication;

Second, the abnormal domain name certificate information was not aggregated into readability alarm information, which made it difficult for the content distribution network user to parse the received abnormal domain name certificate information, resulting in the content distribution network user not updating the abnormal domain name certificate in time, which in turn caused The service request from the content delivery network consumer failed.

SUMMARY OF THE INVENTION

This summary of the disclosure serves to introduce concepts in a simplified form that are described in detail in the detailed description that follows. The content section of this disclosure is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to be used to limit the scope of the claimed technical solution.

Some embodiments of the present disclosure propose a domain name certificate detection method, apparatus, electronic device, and computer-readable medium to solve one or more of the technical problems mentioned in the above background art section.

In a first aspect, some embodiments of the present disclosure provide a domain name certificate detection method, the method includes: acquiring each domain name certificate stored in a certificate monitoring client; parsing each of the above domain name certificates to generate Analyzing the domain name certificate information to obtain a parsed domain name certificate information set; and determining whether there is abnormal domain name certificate information based on the target domain name certificate information set and the above-mentioned parsed domain name certificate information set.

In a second aspect, some embodiments of the present disclosure provide a domain name certificate detection device, the device includes: an obtaining unit configured to obtain each domain name certificate stored in the certificate monitoring client; a parsing unit configured to Each domain name certificate in the domain name certificate is parsed to generate parsed domain name certificate information, and a set of parsed domain name certificate information is obtained; the determining unit is configured to determine whether there is an abnormal domain name certificate based on the target domain name certificate information set and the above-mentioned parsed domain name certificate information set information.

In a third aspect, some embodiments of the present disclosure provide an electronic device, comprising: one or more processors; a storage device on which one or more programs are stored, when one or more programs are stored by one or more The processor executes, causing one or more processors to implement the method described in any implementation manner of the above first aspect.

In a fourth aspect, some embodiments of the present disclosure provide a computer-readable medium on which a computer program is stored, wherein, when the program is executed by a processor, the method described in any implementation manner of the above-mentioned first aspect is implemented.

The above-mentioned embodiments of the present disclosure have the following beneficial effects: the detection rate of domain name certificates in network communication is improved, the frequency of domain name exceptions is reduced, and the detection rate of network communication is improved through the domain name certificate detection methods of some embodiments of the present disclosure. stability, thereby improving the security of network communication. Specifically, the inventor found that the reason for the low detection rate of domain name anomalies in network communication is that the third-party certificate monitoring server is used to detect domain name certificates, which usually misses the detection of certificates, resulting in the detection of domain name certificates. The detection rate is not high, resulting in a high frequency of domain name anomalies. Based on this, first of all, the domain name certificate detection method of some embodiments of the present disclosure can obtain a preliminary understanding of the status of each domain name certificate of each content distribution network user by acquiring each domain name certificate stored in the certificate monitoring client. Then, each of the above domain name certificates is parsed to generate parsed domain name certificate information, and a set of parsed domain name certificate information is obtained. In this way, the domain name certificate information of each domain name certificate can be parsed out, which facilitates subsequent detection of the resolved domain name certificate information. Finally, the parsed domain name certificate information of each domain name certificate is compared with each target domain name certificate information stored in the server and updated in real time. Therefore, it can be determined whether there is abnormal domain name certificate information in the above target domain name certificate information set according to the comparison result. Therefore, the detection of the domain name certificate can be realized from the two aspects of the server and the client, so as to prevent omission of detection of the certificate. This further improves the detection rate of domain name certificates, reduces the frequency of domain name anomalies, and improves the stability of network communication. Further, the security of network communication is improved.

Description of drawings

The above and other features, advantages and aspects of various embodiments of the present disclosure will become more apparent when taken in conjunction with the accompanying drawings and with reference to the following detailed description. Throughout the drawings, the same or similar reference numbers refer to the same or similar elements. It should be understood that the drawings are schematic and that elements and elements are not necessarily drawn to scale.

1 is a schematic diagram of an application scenario of a domain name certificate detection method according to some embodiments of the present disclosure;

2 is a flowchart of some embodiments of a domain name certificate detection method according to the present disclosure;

3 is a flowchart of other embodiments of the domain name certificate detection method according to the present disclosure;

FIG. 4 is a flowchart of further embodiments of the domain name certificate detection method according to the present disclosure;

5 is a schematic structural diagram of some embodiments of a domain name certificate detection apparatus according to the present disclosure;

6 is a schematic structural diagram of an electronic device suitable for implementing some embodiments of the present disclosure.

Detailed ways

Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While certain embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided for a thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes, and are not intended to limit the protection scope of the present disclosure.

In addition, it should be noted that, for the convenience of description, only the parts related to the related invention are shown in the drawings. The embodiments of this disclosure and features of the embodiments may be combined with each other without conflict.

It should be noted that concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or interdependence.

It should be noted that the modifications of "a" and "a plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless the context clearly indicates otherwise, they should be understood as "one or a plurality of". multiple".

The names of messages or information exchanged between multiple devices in the embodiments of the present disclosure are only for illustrative purposes, and are not intended to limit the scope of these messages or information.

The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

FIG. 1 is a schematic diagram of an application scenario of a domain name certificate detection method according to some embodiments of the present disclosure.

In the application scenario of FIG. 1 , first, the computing device 101 may acquire each domain name certificate 102 stored in the certificate monitoring client. Then, the computing device 102 may parse each domain name certificate in each domain name certificate 102 to generate parsed domain name certificate information, and obtain the parsed domain name certificate information set 103 . Finally, the computing device 101 may determine whether there is abnormal domain name certificate information 105 based on the target domain name certificate information set 104 and the resolved domain name certificate information set 103 .

It should be noted that the above computing device 101 may be hardware or software. When the computing device is hardware, it can be implemented as a distributed cluster composed of multiple servers or terminal devices, or can be implemented as a single server or a single terminal device. When a computing device is embodied as software, it may be installed in the hardware devices listed above. It can be implemented, for example, as multiple software or software modules for providing distributed services, or as a single software or software module. There is no specific limitation here.

It should be understood that the number of computing devices in FIG. 1 is merely illustrative. There may be any number of computing devices depending on implementation needs.

Continuing to refer to FIG. 2 , a process 200 of some embodiments of a domain name certificate detection method according to the present disclosure is shown. The domain name certificate detection method includes the following steps:

Step 201: Obtain each domain name certificate stored in the certificate monitoring client.

In some embodiments, the executing subject of the domain name certificate detection method (eg, the computing device 101 shown in FIG. 1 ) may obtain each domain name certificate stored in the certificate monitoring client through a wired connection or a wireless connection. Here, the domain name certificate may be a digital certificate. For example, SSL server certificates. The domain name certificate includes but is not limited to: domain name, user information, content distribution network service provider information (eg, CDN service provider information), node information, domain name registration time, and domain name expiration time.

As an example, each domain name certificate could be:

{[Domain name: www.52.com];[User information: Tian Telecom];[Content distribution network service provider: Yinshan];[Node information: 58.214.159.208];[Domain name registration time: 2019-12- 01];[Domain name expiration time: 2020-12-01]};

{[Domain name: www.54.com]; [User information: China Unicom]; [Content distribution network service provider information: Liu Niu]; [Node information: 58.215.159.208]; [Domain name registration time: 2019-12- 05];[Domain name expiration time: 2020-12-05]};

{[Domain name: www.51.com]; [User information: Water Mobile]; [Content distribution network service provider information: Dali]; [Node information: 58.216.159.208]; [Domain name registration time: 2019-12-07 ]; [Domain Expiration Time: 2020-12-07]}.

In some optional implementations of some embodiments, the above-mentioned execution subject may also traverse the file system of the certificate monitoring client, and obtain each domain name certificate stored in the above-mentioned file system through a handshake protocol. Thereby, the detection of the certificate can be prevented from being missed.

Step 202: Perform analysis on each of the above domain name certificates to generate resolution domain name certificate information, and obtain a resolution domain name certificate information set.

In some embodiments, the above-mentioned execution subject may parse each domain name certificate in the above-mentioned various domain name certificates to generate resolved domain name certificate information, and obtain a resolved domain name certificate information set. Here, parsing can be to extract key fields in the domain name certificate. For example, key fields such as domain name, user information, content distribution network server information, node information, and domain name expiration time in the domain name certificate can be extracted. Here, the extraction method may be text keyword extraction.

As an example, each domain name certificate in each domain name certificate exemplified in step 201 is parsed to generate parsed domain name certificate information, and a set of parsed domain name certificate information is obtained:

{[Domain name: www.52.com];[User information: Tian Telecom];[Content distribution network service provider: Yinshan];[Node information: 58.214.159.208];[Domain name expiration time: 2020-12 -01]};

{[Domain name: www.54.com]; [User information: China Unicom]; [Content distribution network service provider information: Liu Niu]; [Node information: 58.215.159.208]; [Domain name expiration time: 2020-12 -05]};

{[Domain name: www.51.com]; [User information: Water Mobile]; [Content distribution network service provider information: Dali]; [Node information: 58.216.159.208]; [Domain name expiration time: 2020-12- 07]}.

Step 203: Determine whether there is abnormal domain name certificate information based on the target domain name certificate information set and the above-mentioned resolved domain name certificate information set.

In some embodiments, first. The above-mentioned execution subject may obtain the stored and real-time updated certificate information of each target domain name from the certificate monitoring server as the target domain name certificate information set. Then, each resolved domain name certificate information in the resolved domain name certificate information set may be compared with each target domain name certificate information in the above target domain name certificate information set to determine whether there is abnormal domain name certificate information. Here, the target domain name certificate information may include, but is not limited to, the domain name in the domain name certificate, user information, content distribution network service party information, node information, domain name expiration time and distance to expiration.

As an example, the target domain name certificate information set can be:

{[Domain name: www.52.com];[User information: Tian Telecom];[Content distribution network service provider: Yinshan];[Node information: 58.214.159.208];[Domain name expiration time: 2020-12 -01]; [distance to expiration: 10]};

{[Domain name: www.54.com]; [User information: China Unicom]; [Content distribution network service provider information: Liu Niu]; [Node information: 58.215.159.208]; [Domain name expiration time: 2020-12 -05]; [distance to expiration: 15]};

{[Domain name: www.51.com]; [User information: Water Mobile]; [Content distribution network service provider information: Dali]; [Node information: 58.216.159.208]; [Domain name expiration time: 2020-12- 07]; [Time to Expiry: 17]};

{[Domain name: www.53.com];[User information: Shanghai Telecom];[Content distribution network service provider: Yinshan];[Node information: 58.214.259.208];[Domain name expiration time: 2020-12 -01]; [distance to expiration: 10]}.

The above-mentioned resolution domain name certificate information set can be:

Comparing each target domain name certificate information in the above target domain name certificate information set with each resolution domain name certificate information in the above resolution domain name certificate information set, it is determined that the target domain name certificate information {[domain name: www.53. com];[user information: Shanghai Telecom];[content distribution network service provider information: Yinshan];[node information:58.214.259.208];[domain name expiration time:2020-12-01];[distance to expiration Time: 10]} The corresponding resolution domain name certificate information. The target domain name certificate information {[domain name: www.53.com]; [user information: Shanghai Telecom]; [content distribution network service provider information: Yinshan]; [node information: 58.214.259.208]; [domain name expiration Time: 2020-12-01]; [distance to expiration: 10]} is determined to be abnormal certificate information.

The above-mentioned embodiments of the present disclosure have the following beneficial effects: the detection rate of domain name certificates in network communication is improved, the frequency of domain name exceptions is reduced, and the detection rate of network communication is improved through the domain name certificate detection methods of some embodiments of the present disclosure. stability, thereby improving the security of network communication. Specifically, the inventor found that the reason for the low detection rate of domain name anomalies in network communication is that the third-party certificate monitoring server is used to detect domain name certificates, which usually misses the detection of certificates, resulting in the detection of domain name certificates. The detection rate is not high, resulting in a high frequency of domain name anomalies. Based on this, first of all, the domain name certificate detection method of some embodiments of the present disclosure can obtain a preliminary understanding of the status of each domain name certificate of each content distribution network user by acquiring each domain name certificate stored in the certificate monitoring client. Then, each of the above domain name certificates is parsed to generate parsed domain name certificate information, and a set of parsed domain name certificate information is obtained. Thus, the domain name certificate information of each domain name certificate can be parsed out, which facilitates subsequent detection of the domain name certificate information. Finally, the parsed domain name certificate information of each domain name certificate is compared with each target domain name certificate information stored in the server and updated in real time. Therefore, it can be determined whether there is abnormal domain name certificate information in the above-mentioned resolved domain name certificate information set according to the comparison result. Therefore, the detection of the domain name certificate can be realized from the two aspects of the server and the client, so as to prevent omission of detection of the certificate. This further improves the detection rate of domain name certificates, reduces the frequency of domain name anomalies, and improves the stability of network communication. Further, the security of network communication is improved.

With further reference to FIG. 3 , a flow chart of other embodiments of the domain name certificate detection method according to the present disclosure is shown. The domain name certificate detection method includes the following steps:

In step 301, each imported domain name certificate is obtained and stored in the certificate monitoring client.

In some embodiments, the above-mentioned execution subject may obtain each imported domain name certificate from the terminal through a wired connection or a wireless connection to store it in the certificate monitoring client. Here, each imported domain name certificate may be a domain name certificate manually supplemented by a user or a staff member. Thereby, the detection of the certificate can be further prevented from being missed.

As an example, an imported domain name certificate could be:

{[Domain name: www.53.com];[User information: Shanghai Telecom];[Content distribution network service provider: Yinshan];[Node information: 58.214.259.208];[Domain name expiration time: 2020-12 -01]}.

Step 302: Obtain each domain name certificate stored in the certificate monitoring client.

In some embodiments, for the specific implementation of step 302 and the technical effect brought about, reference may be made to step 201 in those embodiments corresponding to FIG. 2 , which will not be repeated here.

Step 303: Perform analysis on each of the above domain name certificates to generate resolution domain name certificate information, and obtain a resolution domain name certificate information set.

In some embodiments, for the specific implementation of step 303 and the technical effect brought about, reference may be made to step 202 in those embodiments corresponding to FIG. 2 , and details are not repeated here.

Step 304: Obtain each domain name of each content distribution network user stored in the cloud service information platform.

In some embodiments, the above-mentioned execution body may be each domain name of each content distribution network user stored in the cloud service information platform. Here, the cloud service information platform may be a certificate detection server. In practice, the acquired domain names of each content distribution network user stored in the cloud service information platform may be: [domain name: www.52.com]; [domain name: www.54.com]; [domain name: www. 51.com]; [domain name: www.53.com].

Step 305: Perform domain name resolution on each of the above domain names to generate a list of resolved domain names.

In some embodiments, the above-mentioned execution body may perform domain name resolution on each of the above-mentioned domain names to generate a list of resolved domain names. Here, the domain name resolution can be that the domain name points to the web space IP. Here, an empty table may be established, and each domain name after domain name resolution is input into the empty table to generate a list of resolved domain names.

As an example, you can perform domain name resolution on each of the above domain names to generate a list of resolved domain names:

域名domain name	网站空间IPweb space IP
www.52.comwww.52.com	58.214.159.20858.214.159.208
www.54.comwww.54.com	58.215.159.20858.215.159.208
www.51.comwww.51.com	58.216.159.20858.216.159.208
www.53.comwww.53.com	58.214.259.20858.214.259.208

Step 306: Based on each resolved domain name in the above-mentioned resolved domain name list, obtain the configuration information of the content distribution network user corresponding to the above-mentioned resolved domain name, and obtain a configuration information set as a target domain name certificate information set.

In some embodiments, the above-mentioned execution body may obtain the content distribution network user's website corresponding to the resolved domain name by accessing the website of the content distribution network user pointed to by each web space IP of each resolved domain name in the resolved domain name list. The configuration information is obtained, and the configuration information set is obtained as the target domain name certificate information set.

As an example, the configuration information of the content distribution network user corresponding to the resolved domain name can be obtained by visiting the website of the content distribution network user pointed to by the web space IP "58.214.159.208" "{[domain name: www.52.com] ;[User information: Tian Telecom];[Content distribution network service provider information: Yinshan];[Node information: 58.214.159.208];[Domain name expiration time: 2020-12-01];[Distance to expiration time: 10]}".

As another example, the obtained set of configuration information can be:

{[Domain name: www.53.com];[User information: Shanghai Telecom];[Content distribution network service provider: Yinshan];[Node information: 58.214.259.208];[Domain name expiration time: 2020-12 -01]; [distance to expiration: 10]}. The above configuration information set is determined as the target domain name certificate information set.

Step 307: Determine whether there is abnormal domain name certificate information based on the target domain name certificate information set and the above-mentioned resolved domain name certificate information set.

In some embodiments, for the specific implementation of step 307 and the technical effect brought about, reference may be made to step 203 in those embodiments corresponding to FIG. 2 , and details are not repeated here.

As can be seen from FIG. 3, compared with the description of some embodiments corresponding to FIG. 2, the flow 300 of the domain name certificate detection method in some embodiments corresponding to FIG. Missing detection of certificates can be further prevented. Then, the configuration information set can be obtained to provide a reference basis for determining whether there is abnormal domain name certificate information.

With further reference to FIG. 4 , further embodiments of the domain name certificate detection method according to the present disclosure are shown. The domain name certificate detection method includes the following steps:

Step 401: Obtain each domain name certificate stored in the certificate monitoring client.

Step 402: Perform analysis on each of the above domain name certificates to generate resolution domain name certificate information, and obtain a resolution domain name certificate information set.

In some embodiments, for the specific implementation of steps 401-402 and the technical effects brought about, reference may be made to steps 201-202 in those embodiments corresponding to FIG. 2, and details are not repeated here.

Step 403: Compare each resolved domain name certificate information in the above-mentioned resolved domain name certificate information set with each target domain name certificate information in the above-mentioned target domain name certificate information set, and generate a comparison result information set.

In some embodiments, the execution subject may compare each resolved domain name certificate information in the above resolved domain name certificate information set with each target domain name certificate information in the above target domain name certificate information set to generate a comparison result information set. Here, the comparison refers to the difference comparison between the certificate information of the resolved domain name and the certificate information of the target domain name.

As an example, the respective resolution domain name certificate information in the above-mentioned resolution domain name certificate information set may be:

{[Domain name: www.51.com]; [User information: Water Mobile]; [Content distribution network service provider information: Dali]; [Node information: 58.216.159.208]; [Domain name expiration time: 2020-12- 07]};

Each target domain name certificate information in the above target domain name certificate information set may be:

Comparing each resolution domain name certificate information in the above resolution domain name certificate information set with each target domain name certificate information in the above target domain name certificate information set, a comparison result information set is obtained: [distance to expiration: 10]; [distance to expiration: 15]; [distance to expiration: 17]; [distance to expiration: 10].

Step 404: In response to the comparison result information that meets the preset condition in the comparison result information set, the comparison result information that meets the preset condition in the comparison result information set is determined as abnormal comparison result information, and an abnormal comparison result information group is obtained.

In some embodiments, in response to the comparison result information that meets the preset condition in the comparison result information set, the execution entity may determine the comparison result information that meets the preset condition in the comparison result information set as abnormal comparison result information, and obtain Anomaly comparison result information group. Here, the preset condition may be a condition set by the content distribution network provider, for example, the preset condition may be "expiration time is less than or equal to 10 days".

As an example, the above comparison result information set may be: [distance to expiration: 10]; [distance to expiration: 15]; [distance to expiration: 17]; [distance to expiration: 10]. Determine the comparison result information that meets the preset condition "expiration time is less than or equal to 10 days" in the above comparison result information set as abnormal comparison result information, and obtain the abnormal comparison result information group: [distance to expiration time: 10]; [distance to expiration Time: 10].

Step 405: Determine the target domain name certificate information corresponding to each abnormal comparison result information in the above abnormal comparison result information group as abnormal domain name certificate information, and obtain an abnormal domain name certificate information set.

In some embodiments, the above-mentioned execution body may determine the target domain name certificate information corresponding to each abnormal comparison result information in the above-mentioned abnormal comparison result information group as abnormal domain name certificate information, and obtain the abnormal domain name certificate information set.

As an example, the above abnormal comparison result information group may be: [distance to expiration: 10]; [distance to expiration: 10]. Set the target domain name certificate information corresponding to the first [expiration time: 10] {[domain name: www.52.com]; [user information: Sky Telecom]; [content distribution network service provider information: Yinshan]; [Node information: 58.214.159.208]; [Domain name expiration time: 2020-12-01]; [Distance expiry time: 10]} It is determined as abnormal domain name certificate information. Set the target domain name certificate information corresponding to the second [time to expiration: 10] {[domain name: www.53.com]; [user information: Shanghai Telecom]; [content distribution network service provider information: Yinshan]; [Node information: 58.214.259.208]; [Domain name expiration time: 2020-12-01]; [Distance expiry time: 10]} It is determined as abnormal domain name certificate information. Thus, the abnormal domain name certificate information set is obtained.

Step 406: Aggregate each abnormal domain name certificate information in the abnormal domain name certificate information set to generate the aggregated abnormal domain name certificate information as readability alarm information, and obtain a readability alarm information group.

In some embodiments, the execution body may perform aggregation processing on each abnormal domain name certificate information in the abnormal domain name certificate information set to generate aggregated abnormal domain name certificate information as readability alarm information, and obtain a readability alarm information group. Here, the aggregation process may refer to inputting each field in the abnormal domain name certificate information into a preset template. Here, the template is the corpus template for filling in the abnormal domain name certificate information.

As an example, the abnormal domain name certificate information {[domain name: www.52.com]; [user information: Sky Telecom]; [content distribution network service party information: Yinshan]; [node information: 58.214.159.208]; [Domain name expiry time: 2020-12-01]; [Distance expiry time: 10]} Perform aggregation processing to generate aggregated abnormal domain name certificate information "The user of the domain name [www.52.com] [Tian Telecom] is in the content The domain name certificate in the distribution network service party [Silver Mountain] is 10 days away from the expiration time" as the readability warning message. Abnormal domain name certificate information {[domain name: www.53.com]; [user information: Shanghai Telecom]; [content distribution network service provider information: Yinshan]; [node information: 58.214.259.208]; [domain name to Expiry time: 2020-12-01]; [Distance to expiry time: 10]} Aggregation processing is performed to generate aggregated abnormal domain name certificate information "The user of the domain name [www.53.com] [Shanghai Telecom] is serving in the content distribution network The expiry time of the domain name certificate in Fang [Silver Mountain] is 10 days" as the readability warning message.

Step 406, as an inventive point of the present disclosure, solves the second technical problem mentioned in the background art: “The abnormal domain name certificate information is not aggregated into readability alarm information, which makes it difficult for the content distribution network user to parse the received abnormal domain name certificate information. As a result, the content distribution network user fails to update the abnormal domain name certificate in time, which in turn causes the content distribution network user's business request to fail." The influencing factors that cause the service request failure of the content distribution network user are often as follows: The abnormal domain name certificate information is not aggregated into readability alarm information, which makes it difficult for the content distribution network user to parse the received abnormal domain name certificate information, causing the content distribution network to use the information. The party failed to update the abnormal domain name certificate in time. If the above factors are solved, the effect of reducing the failure of the service request of the user of the content distribution network can be achieved. In order to achieve this effect, the present disclosure performs aggregation processing on each abnormal domain name certificate information in the above abnormal domain name certificate information set to generate aggregated abnormal domain name certificate information as readability alarm information. In this way, the abnormal domain name certificate information can be aggregated into readability alarm information, so as to improve the understanding of the received readability alarm information by the content distribution network user. Furthermore, the content distribution network user can update the abnormal domain name certificate in time. Thus, the effect of reducing service request failures of the content distribution network user is achieved.

Step 407: Send each readability alarm information in the readability alarm information group to the corresponding service platform of each content distribution network user for the user to browse.

In some embodiments, the execution body may send each readability alarm information in the readability alarm information group to the corresponding service platform of each content distribution network user for the user to browse.

As an example, the readability warning message "The domain name certificate of the user [Tian Telecom] of the domain name [www.52.com] in the content distribution network service party [Yinshan] is 10 days away from expiration" may be sent. To the service platform "001" of the content distribution network user [Tian Telecom] for users to browse. The readability warning message "The domain name certificate of the user [Shanghai Telecom] of the domain name [www.53.com] in the content distribution network service provider [Yinshan] is 10 days away from expiration" can be sent to the content distribution The service platform "001" of the network user [Shanghai Telecom] for users to browse.

As can be seen from FIG. 4 , compared with the description of some embodiments corresponding to FIG. 2 , the flow 400 of the domain name certificate detection method in some embodiments corresponding to FIG. 4 can enable the content distribution network user to timely detect abnormal domain name certificates to update. Thus, the effect of reducing service request failures of the content distribution network user is achieved.

Further referring to FIG. 5 , as an implementation of the methods shown in the above figures, the present disclosure provides some embodiments of an apparatus for detecting a domain name certificate. These apparatus embodiments correspond to those method embodiments shown in FIG. 2 . The apparatus Specifically, it can be applied to various electronic devices.

As shown in FIG. 5 , an apparatus 500 for detecting a domain name certificate in some embodiments includes: an acquiring unit 501 , a parsing unit 502 and a determining unit 503 . Wherein, the obtaining unit 501 is configured to obtain each domain name certificate stored in the certificate monitoring client; the parsing unit 502 is configured to parse each domain name certificate in the above-mentioned various domain name certificates to generate the resolved domain name certificate information, and obtain the resolved domain name Certificate information set; the determining unit 503 is configured to determine whether there is abnormal domain name certificate information based on the target domain name certificate information set and the above-mentioned resolved domain name certificate information set.

In some optional implementations of some embodiments, the obtaining unit 501 of the domain name certificate detection apparatus 500 is further configured to: traverse the file system of the certificate monitoring client, and obtain each domain name certificate stored in the file system through a handshake protocol.

In some optional implementations of some embodiments, the domain name certificate detection apparatus 500 further includes: acquiring each imported domain name certificate.

In some optional implementations of some embodiments, the domain name certificate detection apparatus 500 further includes: a domain name acquisition unit, configured to acquire each domain name of each content distribution network user stored in the cloud service information platform; a domain name resolution unit, is configured to perform domain name resolution on each of the above-mentioned domain names to generate a list of resolved domain names; the configuration information acquisition unit is configured to obtain the configuration of the content distribution network user corresponding to the above-mentioned resolved domain name based on each resolved domain name in the above-mentioned resolved domain name list information, and obtain the configuration information set as the target domain name certificate information set.

In some optional implementations of some embodiments, the determining unit 503 of the domain name certificate detection apparatus 500 is further configured to: compare each resolved domain name certificate information in the above-mentioned resolved domain name certificate information set with each target in the above-mentioned target domain name certificate information set The domain name certificate information is compared, and a comparison result information set is generated; in response to the comparison result information that meets the preset conditions in the comparison result information set, the comparison result information that meets the preset conditions in the comparison result information set is determined as abnormal comparison result information , get the abnormal comparison result information group.

In some optional implementations of some embodiments, the determining unit 503 of the domain name certificate detection apparatus 500 is further configured to: determine the target domain name certificate information corresponding to each abnormal comparison result information in the above abnormal comparison result information group For the abnormal domain name certificate information, the abnormal domain name certificate information set is obtained.

In some optional implementations of some embodiments, the determination unit 503 of the domain name certificate detection apparatus 500 further includes: an aggregation unit, configured to perform aggregation processing on each abnormal domain name certificate information in the above abnormal domain name certificate information set to generate Aggregate the abnormal domain name certificate information as readability alarm information to obtain a readability alarm information group; the sending unit is configured to send each readability alarm information in the readability alarm information group to the corresponding content distribution respectively. The service platform of the network user for users to browse.

It can be understood that the units recorded in the apparatus 500 correspond to the respective steps in the method described with reference to FIG. 2 . Therefore, the operations, features and beneficial effects described above with respect to the method are also applicable to the apparatus 500 and the units included therein, and details are not described herein again.

Referring now to FIG. 6 , a schematic structural diagram of an electronic device (eg, computing device 101 in FIG. 1 ) 600 suitable for implementing some embodiments of the present disclosure is shown. Electronic devices in some embodiments of the present disclosure may include, but are not limited to, such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablets), PMPs (portable multimedia players), vehicle-mounted terminals Mobile terminals such as in-vehicle navigation terminals, etc., and stationary terminals such as digital TVs, desktop computers, and the like. The electronic device shown in FIG. 6 is only an example, and should not impose any limitation on the function and scope of use of the embodiments of the present disclosure.

As shown in FIG. 6, an electronic device 600 may include a processing device (eg, a central processing unit, a graphics processor, etc.) 601 that may be loaded into random access according to a program stored in a read only memory (ROM) 602 or from a storage device 608 Various appropriate actions and processes are executed by the programs in the memory (RAM) 603 . In the RAM 603, various programs and data required for the operation of the electronic device 600 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other through a bus 604. An input/output (I/O) interface 605 is also connected to bus 604.

Typically, the following devices can be connected to the I/O interface 605: input devices 606 including, for example, a touch screen, touchpad, keyboard, mouse, camera, microphone, accelerometer, gyroscope, etc.; including, for example, a liquid crystal display (LCD), speakers, vibration An output device 607 of a computer, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. Communication means 609 may allow electronic device 600 to communicate wirelessly or by wire with other devices to exchange data. While FIG. 6 shows electronic device 600 having various means, it should be understood that not all of the illustrated means are required to be implemented or provided. More or fewer devices may alternatively be implemented or provided. Each block shown in FIG. 6 may represent one device, or may represent multiple devices as required.

In particular, according to some embodiments of the present disclosure, the processes described above with reference to the flowcharts may be implemented as computer software programs. For example, some embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the method illustrated in the flowchart. In some such embodiments, the computer program may be downloaded and installed from the network via the communication device 609, or from the storage device 608, or from the ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the methods of some embodiments of the present disclosure are performed.

It should be noted that the computer-readable medium described in some embodiments of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or a combination of any of the above. More specific examples of computer readable storage media may include, but are not limited to, electrical connections with one or more wires, portable computer disks, hard disks, random access memory (RAM), read only memory (ROM), erasable Programmable read only memory (EPROM or flash memory), fiber optics, portable compact disk read only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing. In some embodiments of the present disclosure, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. Rather, in some embodiments of the present disclosure, a computer-readable signal medium may include a data signal in baseband or propagated as part of a carrier wave, carrying computer-readable program code therein. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device . Program code embodied on a computer readable medium may be transmitted using any suitable medium including, but not limited to, electrical wire, optical fiber cable, RF (radio frequency), etc., or any suitable combination of the foregoing.

In some embodiments, the client and server can use any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol) to communicate, and can communicate with digital data in any form or medium Communication (eg, a communication network) interconnects. Examples of communication networks include local area networks ("LAN"), wide area networks ("WAN"), the Internet (eg, the Internet), and peer-to-peer networks (eg, ad hoc peer-to-peer networks), as well as any currently known or future development network of.

The above-mentioned computer-readable medium may be included in the above-mentioned electronic device; or may exist alone without being assembled into the electronic device. The above-mentioned computer-readable medium carries one or more programs, and when the above-mentioned one or more programs are executed by the electronic device, the electronic device: performs offline feature extraction processing on the published housing information, and generates the above-mentioned housing information. corpus; obtain each domain name certificate stored in the certificate monitoring client; parse each domain name certificate in the above domain name certificates to generate parsed domain name certificate information, and obtain a parsed domain name certificate information set; based on the target domain name certificate information set and the above Parse the domain name certificate information set to determine whether there is abnormal domain name certificate information.

Computer program code for carrying out operations of some embodiments of the present disclosure may be written in one or more programming languages, including object-oriented programming languages - such as Java, Smalltalk, C++, or a combination thereof, Also included are conventional procedural programming languages - such as the "C" language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer, or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any kind of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (eg, using an Internet service provider) via Internet connection).

The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code that contains one or more logical functions for implementing the specified functions executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It is also noted that each block of the block diagrams and/or flowchart illustrations, and combinations of blocks in the block diagrams and/or flowchart illustrations, can be implemented in dedicated hardware-based systems that perform the specified functions or operations , or can be implemented in a combination of dedicated hardware and computer instructions.

The units described in some embodiments of the present disclosure may be implemented by means of software, and may also be implemented by means of hardware. The described unit may also be provided in the processor, for example, it may be described as: a processor includes an obtaining unit, a parsing unit and a determining unit. Wherein, the names of these units do not constitute a limitation on the unit itself under certain circumstances. For example, the obtaining unit may also be described as "a unit for obtaining each domain name certificate stored in the certificate monitoring client".

The functions described herein above may be performed, at least in part, by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: Field Programmable Gate Arrays (FPGAs), Application Specific Integrated Circuits (ASICs), Application Specific Standard Products (ASSPs), Systems on Chips (SOCs), complex programmable Logical Devices (CPLDs) and more.

The above descriptions are merely some preferred embodiments of the present disclosure and illustrations of the applied technical principles. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solution formed by the specific combination of the above-mentioned technical features, and should also cover, without departing from the above-mentioned inventive concept, the above-mentioned Other technical solutions formed by any combination of technical features or their equivalent features. For example, a technical solution is formed by replacing the above-mentioned features with the technical features disclosed in the embodiments of the present disclosure (but not limited to) with similar functions.

Claims

A method for detecting a domain name certificate, comprising:

Obtain each domain name certificate stored in the certificate monitoring client;

Performing parsing on each domain name certificate in the respective domain name certificates to generate parsing domain name certificate information, and obtaining a parsing domain name certificate information set;

Based on the target domain name certificate information set and the resolved domain name certificate information set, it is determined whether there is abnormal domain name certificate information.
The method according to claim 1, wherein the obtaining of each domain name certificate stored in the certificate monitoring client comprises:

Obtain each domain name certificate stored in the certificate monitoring client through a handshake protocol.
The method according to claim 1, wherein, before obtaining each domain name certificate stored in the certificate monitoring client, the method further comprises:

Obtain the imported domain name certificates and store them in the certificate monitoring client.
The method according to claim 1, wherein before determining whether there is abnormal domain name certificate information based on the target domain name certificate information set and the resolved domain name certificate information set, the method further comprises:

Obtain each domain name of each content distribution network user stored in the cloud service information platform;

Perform domain name resolution on each of the domain names to generate a list of resolved domain names;

Based on each resolved domain name in the resolved domain name list, the configuration information of the content distribution network user corresponding to the resolved domain name is obtained, and a configuration information set is obtained as a target domain name certificate information set.
The method according to claim 1, wherein the determining whether there is abnormal domain name certificate information based on the target domain name certificate information set and the resolved domain name certificate information set comprises:

Comparing each resolution domain name certificate information in the resolution domain name certificate information set with each target domain name certificate information in the target domain name certificate information set, and generating a comparison result information set;

In response to the comparison result information that meets the preset condition in the comparison result information set, the comparison result information that meets the preset condition in the comparison result information set is determined as abnormal comparison result information, and an abnormal comparison result information group is obtained.
The method according to claim 5, wherein the determining whether there is abnormal domain name certificate information based on the target domain name certificate information set and the resolved domain name certificate information set, further comprising:

The target domain name certificate information corresponding to each abnormal comparison result information in the abnormal comparison result information group is determined as abnormal domain name certificate information, and an abnormal domain name certificate information set is obtained.
The method of claim 6, wherein the method further comprises:

Perform aggregation processing on each abnormal domain name certificate information in the abnormal domain name certificate information set to generate aggregated abnormal domain name certificate information as readability alarm information, and obtain a readability alarm information group;

Each readability warning information in the readability warning information group is respectively sent to the service platform of each corresponding content distribution network user for the user to browse.
A domain name certificate detection device, comprising:

an obtaining unit, configured to obtain each domain name certificate stored in the certificate monitoring client;

a parsing unit, configured to parse each domain name certificate in the respective domain name certificates to generate parsed domain name certificate information, and obtain a parsed domain name certificate information set;

The determining unit is configured to determine whether there is abnormal domain name certificate information based on the target domain name certificate information set and the resolved domain name certificate information set.
An electronic device comprising:

one or more processors;

a storage device on which one or more programs are stored;

The one or more programs, when executed by the one or more processors, cause the one or more processors to implement the method of any of claims 1-7.
A computer-readable medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the method according to any one of claims 1-7.