WO2022257928A1 - 安全加速服务部署方法、装置、介质及设备 - Google Patents

安全加速服务部署方法、装置、介质及设备 Download PDF

Info

Publication number
WO2022257928A1
WO2022257928A1 PCT/CN2022/097407 CN2022097407W WO2022257928A1 WO 2022257928 A1 WO2022257928 A1 WO 2022257928A1 CN 2022097407 W CN2022097407 W CN 2022097407W WO 2022257928 A1 WO2022257928 A1 WO 2022257928A1
Authority
WO
WIPO (PCT)
Prior art keywords
domain name
certificate
target domain
security
acceleration service
Prior art date
Application number
PCT/CN2022/097407
Other languages
English (en)
French (fr)
Inventor
卢江滨
Original Assignee
贵州白山云科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 贵州白山云科技股份有限公司 filed Critical 贵州白山云科技股份有限公司
Publication of WO2022257928A1 publication Critical patent/WO2022257928A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/02—Standardisation; Integration
    • H04L41/0213—Standardised network management protocols, e.g. simple network management protocol [SNMP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H04L41/0823—Configuration setting characterised by the purposes of a change of settings, e.g. optimising configuration for enhancing reliability
    • H04L41/083—Configuration setting characterised by the purposes of a change of settings, e.g. optimising configuration for enhancing reliability for increasing network speed
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4505—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
    • H04L61/4511—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using domain name system [DNS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/08—Protocols for interworking; Protocol conversion
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • Embodiments of the present disclosure relate to but are not limited to a security acceleration service deployment method, device, medium and equipment.
  • HTTPS Hyper Text Transfer Protocol over SecureSocket Layer, Hypertext Transfer Security Protocol
  • HTTPS Hyper Text Transfer Protocol over SecureSocket Layer
  • HTTPS Hypertext Transfer Protocol
  • the content provider's website does not provide secure access services, such as the website only provides HTTP services for its users
  • the CDN manufacturer provides acceleration services for the website
  • the CDN manufacturer cannot Provide secure acceleration services such as HTTPS for websites. If the client browser enables domain name mandatory HTTPS access, the client will not be able to obtain the requested content from the CDN network.
  • the present disclosure provides a method, device, medium and equipment for secure accelerated service deployment.
  • a security acceleration service deployment method is provided, which is applied to a certificate management platform, including:
  • the determining to enable the security acceleration service for the target domain name includes:
  • the domain name information of the target domain name satisfies the security acceleration policy, it is determined to enable the security acceleration service for the target domain name, and the domain name information includes at least one of the top-level domain type and business type; or,
  • the operation information of the target domain name satisfies the security acceleration policy, it is determined to enable the security acceleration service for the target domain name, and the operation information includes at least one of the historical number of accesses to the security acceleration service of the target domain name and the access trend of the security acceleration service of the target domain name ;or,
  • the target domain name is the specified domain name and the current time is within the specified time period, it is determined to enable the security acceleration service for the target domain name.
  • the security acceleration strategy includes one or more of the following strategies:
  • the security acceleration service deployment method before applying to the CA for the certificate of the target domain name, the security acceleration service deployment method further includes: acquiring configuration information of the target domain name, the configuration information including the domain name , domain name owner or administrator related information.
  • the security acceleration service includes HTTPS acceleration service or QUIC acceleration service.
  • a security acceleration service deployment method is provided, which is applied to an edge node, including:
  • a certificate acquisition request for the target domain name is sent to the certificate management platform.
  • the security acceleration service deployment method further includes:
  • the connection with the client is disconnected.
  • a security acceleration service deployment device which is applied to a certificate management platform, including:
  • the certificate acquisition request receiving module is configured to receive the certificate acquisition request of the target domain name sent by the edge node;
  • the certificate application module is configured to apply to the CA institution for the certificate of the target domain name when it is determined that the security acceleration service is enabled for the target domain name;
  • the certificate management module is configured to return the certificate of the target domain name to the edge node.
  • the security acceleration service deployment device further includes:
  • the configuration information receiving module is configured to receive the configuration information of the target domain name, and the configuration information includes the name of the domain name, information about the owner or manager of the domain name.
  • an apparatus for deploying a security acceleration service is provided, which is applied to an edge node, including:
  • the request receiving module is configured to receive a secure connection establishment request from the client, and the secure connection establishment request includes target domain name information;
  • the certificate acquisition request sending module is configured to send the certificate acquisition request of the target domain name to the certificate management platform if the certificate of the target domain name does not exist locally.
  • the security acceleration service deployment device further includes:
  • the certificate receiving module is configured to receive the certificate of the target domain name sent by the certificate management platform.
  • a computer-readable storage medium on which a computer program is stored, and when the computer program is executed, the steps of the security acceleration service deployment method are realized.
  • a computer device including a processor, a memory, and a computer program stored on the memory, where the processor implements the steps of the security acceleration service deployment method when executing the computer program.
  • This disclosure provides a security acceleration service deployment method. After receiving the certificate acquisition request of the target domain name sent by the edge node, the certificate management platform will automatically apply for the target domain name certificate from the CA institution if it is determined to enable the security acceleration service for the target domain name.
  • Security acceleration services can be implemented for content provider websites that only provide HTTP services for their users, without requiring content providers to apply for domain name certificates or consider whether to enable security services.
  • Fig. 1 is a flow chart of a security acceleration service deployment method according to an exemplary embodiment.
  • Fig. 2 is a flowchart showing a method for deploying a security acceleration service according to an exemplary embodiment.
  • Fig. 3 is a block diagram of an apparatus for deploying a security acceleration service according to an exemplary embodiment.
  • Fig. 4 is a block diagram of an apparatus for deploying a security acceleration service according to an exemplary embodiment.
  • Fig. 5 is a block diagram of an apparatus for deploying a security acceleration service according to an exemplary embodiment.
  • Fig. 6 is a block diagram of an apparatus for deploying a security acceleration service according to an exemplary embodiment.
  • Fig. 7 is a block diagram of a computer device according to an exemplary embodiment.
  • HTTPS also known as HTTP over TLS
  • HTTPS uses HTTP to communicate, but uses TLS/SSL to encrypt data packets during communication
  • SSL Secure Sockets Layer
  • TLS Transport Layer Security
  • SSL Secure Sockets Layer
  • TLS Transport Layer Security
  • the server needs to deploy the certificate of the target domain name for the client to authenticate.
  • the edge node when the edge node receives the HTTPS protocol format request from the client Protocol format request, if the HTTPS protocol format request is for the content of a website that only provides HTTP services for its users, since the edge node does not have the certificate of the website domain name, it cannot establish an encrypted connection with the client, and cannot send information to the client.
  • the HTTPS protocol format request at the end responds with the correct content.
  • the content provider hopes that the CDN manufacturer can use HTTPS or QUIC to provide secure acceleration services when the CDN manufacturer provides CDN acceleration services
  • the content provider needs to provide the certificate of the website domain name to the CDN manufacturer.
  • the process is roughly as follows: Taking the security acceleration service as an HTTPS service, the content provider creates the server public key and private key related to the domain name, and then submits the public key and personal or organizational information to the CA (authoritative certificate issuing) institution for certification application; CA institution After the audit information is passed, a digital certificate is generated, which includes the applicant's public key, applicant information, CA signature and other information; after the content provider receives the digital certificate, it sends the certificate to the CDN manufacturer, which is responsible for the CDN manufacturer Deploy the certificate to edge nodes.
  • the edge node When the client sends a request in the HTTPS protocol format to the CDN edge node, the edge node will send the certificate to the client. After the client authenticates the certificate, it will conduct key negotiation, and then continue to process the request in the HTTPS protocol format. It can be seen that in order to provide the HTTPS service function, the content provider needs to go through tedious procedures.
  • the present disclosure provides a method for safely accelerating service deployment.
  • Fig. 1 shows a flowchart of a security acceleration service deployment method according to an exemplary embodiment of the present disclosure.
  • the security acceleration service deployment method is applied to the certificate management platform, and the security acceleration service deployment method includes at least steps S11 to S13, which are described in detail as follows:
  • step S11 the certificate acquisition request of the target domain name sent by the edge node is received.
  • the certificate management platform is set up by the CDN service provider to manage the certificates of the service domain names. It can be a dedicated device or a general server, on which software or codes for certificate management are installed.
  • Content providers provide network content and have their own website domain names for Internet users to visit.
  • Content providers can use the CDN network of CDN service providers to accelerate website content.
  • the CDN service provider can obtain relevant information of the content provider's domain name in advance, so as to configure the CDN network, for example, set a corresponding edge server to provide accelerated services for the content provider's domain name.
  • the content provider uses HTTPS service and has applied for a domain name certificate, before the CDN network provides acceleration services, it needs to provide the domain name and domain name certificate to the CDN service provider, and the CDN service provider deploys the domain name certificate to the edge in the node.
  • an edge node deployed with a certificate of the target domain name can provide the client with the certificate of the domain name when receiving a request in the HTTPS protocol format for the target domain name, and establish a secure connection with the client after the certificate of the domain name is verified. .
  • the CDN manufacturer can obtain the certificate of the target domain name from the content provider and deploy the certificate of the target domain name in the edge node , so that when the edge node receives a secure connection request for the target domain name, it sends the certificate of the domain name to the client, and after negotiating the session key with the client, an encrypted secure connection is established; if the website only supports the HTTP protocol, the content provided If the CDN provider does not apply for the certificate of the target domain name, the CDN manufacturer cannot obtain the certificate of the target domain name from the content provider and deploy the certificate of the target domain name to the edge node.
  • edge nodes when the edge node receives a secure connection request for the target domain name , cannot provide the client with the certificate of the target domain name, and cannot effectively negotiate with the client, and cannot establish an encrypted secure connection.
  • edge nodes disconnect from clients. In this case, the secure connection request for the target domain name sent by the client cannot be correctly responded. When the number of such clients is large, it will seriously affect the service quality of the content provider and reduce the user experience.
  • the edge node after the edge node receives the secure connection request from the client, it obtains the target domain name in the request, and when there is no certificate for the target domain name in the local storage, the edge node will not immediately disconnect from the client. connection, but sends a certificate acquisition request for the target domain name to the certificate management platform. After the certificate management platform receives the certificate acquisition request of the target domain name sent by the edge node, it can query whether the certificate of the target domain name exists in the local storage.
  • step S12 when it is determined that the security acceleration service is enabled for the target domain name, apply for a certificate of the target domain name from a CA institution.
  • the certificate management platform After receiving the certificate acquisition request of the edge node, the certificate management platform will query the local storage. If there is a certificate for the target domain name, it can send the certificate of the target domain name to the edge node; if the official book management platform does not query in the local storage To the certificate of the target domain name, it can be determined that the certificate of the target domain name has not been deployed in the system of the CDN manufacturer.
  • the certificate management platform can determine whether to enable the security acceleration service for the target domain name by querying the security acceleration policy.
  • the security acceleration policy is a policy formulated for the target domain name by the CDN service provider when providing domain name acceleration services for the target domain name.
  • the security acceleration policy includes one or more of the following policies:
  • the security acceleration service is enabled for domain names whose number of accesses to the security acceleration service is greater than or equal to a preset threshold and/or the access trend of accessing the security acceleration service becomes larger within a plurality of preset time periods.
  • the security acceleration policy is formulated by the CDN manufacturer, and can be formulated according to the specific network environment, or according to the instruction information of the customer of the service platform (the content provider or the representative of the content provider). There can be one or more security acceleration policies. When there are multiple security acceleration policies, if any of the security acceleration policies meets the conditions, it can be determined to enable the security acceleration service for the target domain name. CDN manufacturers can formulate relevant security acceleration policies at the initial stage of providing services for target domain names, or formulate new security acceleration policies according to actual network environment or management decisions during the process of providing services for target domain names, or, Adjust or delete the established security acceleration policies. Those skilled in the art should understand that, in addition to the above security acceleration policies, other security acceleration policies can also be formulated.
  • the certificate management platform judges whether all kinds of information related to the target domain name meet the conditions of the security acceleration policy.
  • the CA organization applies for a certificate for the target domain name.
  • the certificate management platform can directly apply for a certificate for the target domain name from the CA institution without obtaining it from the content provider.
  • determining to enable the security acceleration service for the target domain name includes:
  • the domain name information of the target domain name satisfies the security acceleration policy, it is determined to enable the security acceleration service for the target domain name; the domain name information includes at least one of the top-level domain type and the business type.
  • the security acceleration policy is: provide acceleration services for domain names whose top-level domain type is GOV
  • the top-level domain type in the target domain name information satisfies the security acceleration policy
  • the certificate management platform determines it as the target domain name WWW.ABC.GOV starts security acceleration service.
  • the business type corresponding to the domain name is a financial business
  • the security acceleration strategy is: provide acceleration services for domain names whose business type is financial, then Enable the security acceleration service for the target domain name. It can also be determined based on whether the type of the top-level domain and the business type corresponding to the second-level domain name satisfy the acceleration policy.
  • Domain name information includes but is not limited to top-level domain type and business type.
  • the operation information of the target domain name satisfies the security acceleration policy, it is determined to enable the security acceleration service for the target domain name, and the operation information includes the historical number of accesses to the security acceleration service of the target domain name, At least one of the access trends for .
  • the certificate management platform queries the management equipment of the CDN system and obtains the operation log of the target domain name.
  • the edge nodes in the CDN system receive HTTPS://WWW.B.COM requests more than 100 times.
  • Enable the security acceleration service for the target domain name is to enable the security acceleration service for a domain name whose access tendency to access the security acceleration service becomes larger. By querying the operation log of the target domain name, the edge node in the CDN system receives 80 HTTPS://WWW.B.COM requests.
  • the access trend may also be determined according to the ratio of the number of times of accessing the security acceleration service to the total number of times of access in a continuous period of time.
  • the total number of visits to WWW.B.COM on the first day is 1000, of which HTTPS visits account for 1%, and the total number of visits to WWW.B.COM on the first day is 1580 times, of which HTTPS visits accounted for 1.5%, and the total number of visits to WWW.B.COM on the third day was 1050, of which HTTPS visits accounted for 2%, indicating that access to the HTTPS security acceleration service of the target domain name The access trend of the domain name becomes larger, and the security acceleration service is enabled for the domain name WWW.B.COM.
  • the security acceleration policy includes enabling the security acceleration service for the domain name that receives the instruction information for enabling the security acceleration service.
  • the certificate management platform obtains the instruction information for enabling the security acceleration service for the target domain name WWW.B.COM from itself or an external platform (such as a configuration center).
  • the instruction information can be the customer (content provider or content provider’s representative) ) Instruction information sent to the CDN system by checking the corresponding option on the certificate management platform or configuration platform; it can also be sent to the CDN management platform or management personnel in other ways, such as the content provided by WWW.B.COM
  • the security acceleration service when the target domain name is a specified domain name and the current time is within a specified time period, it is determined that the security acceleration service is enabled for the target domain name.
  • the business of some websites will have a strong correlation with certain specific time periods. For example, results query websites will have a large number of query requests during the time period when the results are announced, while in other time periods, there may not be any. A query request will be received.
  • security acceleration policies related to specific time periods can be preset.
  • the security acceleration policy includes enabling the security acceleration service for the domain name WWW.B.COM within a specified time period from a certain day of the month to a certain day of the month.
  • the certificate management platform judges that the current time is within the specified time period, it will enable the security acceleration service for the domain name WWW.B.COM.
  • the CDN system can provide security acceleration services for specified domain names within the time period specified by the security acceleration policy to ensure the security of specified domain names and improve service quality.
  • the certificate management platform When it is determined to enable the security acceleration service for the target domain name, the certificate management platform applies to the CA institution for the certificate of the target domain name.
  • the CDN manufacturer applies for a certificate for the target domain name, avoiding the cumbersome process of content providers applying for a certificate from a CA institution.
  • the CA for the certificate of the target domain name before applying to the CA for the certificate of the target domain name, it further includes: obtaining configuration information of the target domain name, where the configuration information includes domain name, domain name owner or manager related information.
  • the configuration information is the information required to apply for the certificate of the target domain name.
  • the CDN service provider can obtain the configuration information of the domain name from the content provider in advance, such as the company name of the content provider, the content provider’s Administrator information, etc., so that CDN manufacturers need to provide security acceleration services for target domain names according to the actual network environment or when content providers instruct CDN manufacturers to provide security acceleration services for target domain names in the process of providing acceleration services , you can use the configuration information of the target domain name to apply for a certificate from the CA.
  • the configuration information of different domain names can be stored in the configuration center or management device. After the certificate management platform determines that the security acceleration service is enabled for the target domain name, it can be obtained from the configuration center or management device before sending an application to the CA institution.
  • the certificate management platform After the certificate management platform obtains the configuration information of the target domain name, it also needs to generate the public key and private key of the target domain name. In order to apply for the certificate of the target domain name instead of the content provider, the certificate management platform generates the public key and private key of the target domain name by the certificate management platform.
  • the certificate management platform sends the configuration information and public key of the target domain name to the CA organization. After the CA organization verifies the applicant information on the relevant information of the target domain name, it generates a corresponding certificate for the target domain name.
  • the certificate includes the public key, applicant information, CA signature and other information.
  • the content provider only needs to provide relevant information to the CDN manufacturer, and when the target domain name needs to provide a secure connection server, the certificate management platform of the CDN manufacturer can apply for a domain name certificate for the target domain name, avoiding the need for the content provider to apply for a domain name certificate. cumbersome process.
  • the security acceleration service includes HTTPS acceleration service or QUIC acceleration service.
  • the security acceleration service can be an HTTPS acceleration service or a QUIC service.
  • QUIC Quick UDP Internet Connection
  • the security acceleration service can be an HTTPS acceleration service or a QUIC service.
  • QUIC Quick UDP Internet Connection
  • the transport layer protocol includes TCP and UDP protocols.
  • QUIC combines the features of protocols including TCP, TLS, HTTP/2, etc., but based on UDP transmission, it is a fast and secure transmission protocol.
  • the security acceleration service can also be in the form of other protocols.
  • the security acceleration service provided by this disclosure can be applied to the scenarios where the server needs to provide a certificate during authentication.
  • the CDN manufacturer determines to provide security for the target domain name.
  • the certificate management platform applies for a certificate for the target domain name, and deploys the certificate of the target domain name to the edge node to realize the secure acceleration service for the target domain name.
  • step S13 return the certificate of the target domain name to the edge node.
  • the certificate management platform receives the certificate of the target domain name issued by the CA institution, stores the certificate of the target domain name in the local storage, and then sends the certificate of the target domain name to the edge node, so that the edge node starts the secure connection service of the target domain name.
  • the certificate management platform After receiving the certificate of the target domain name issued by the CA institution, the certificate management platform sends the certificate and private key of the target domain name to the edge node that sends the certificate acquisition request. After the edge node receives the certificate of the target domain name, it will The certificate of the target domain name is stored locally. When the edge node receives a secure connection request for the target domain name again, the edge node sends the certificate of the target domain name to the client.
  • the certificate of the target domain name contains the public key of the target domain name, applicant information, CA signature and other information.
  • the client can have the public key of the target domain name
  • the edge node can have the private key of the target domain name. Then, the two parties can negotiate the key and establish an encrypted secure connection.
  • the client browser if within the coverage of certain edge nodes, the client browser does not enable the domain name mandatory HTTPS access function, when these edge nodes provide accelerated services for target domain names that only provide HTTP services for their users, No HTTPS access request for the target domain name will be received.
  • the certificate management platform can only issue the certificate of the target domain name to the edge node that sends the certificate acquisition request, which can ensure that the edge node that receives the domain name certificate can provide content services for more clients, and will not cause large-scale distribution
  • the certificate of the target domain name occupies network resources.
  • the certificate management platform can deliver the certificate of the target domain name to all edge nodes in the CDN system, and when any edge node receives an HTTPS access request for the target domain name, it can send the request to the The client issues a certificate of the target domain name and establishes an HTTPS connection to provide content services to the client in a timely manner.
  • the certificate management platform receives the certificate acquisition request of the target domain name sent by the edge node, if all kinds of information of the target domain name do not satisfy the security acceleration policy, That is, when the secure connection service does not need to be enabled for the target domain name, an instruction message indicating that the certificate of the target domain name does not exist is sent to the edge node, so that the edge node disconnects from the client.
  • the certificate management platform After the certificate management platform receives the certificate acquisition request of the target domain name sent by the edge node, if it is determined to enable the security acceleration service for the target domain name, it will automatically apply to the CA institution for the certificate of the target domain name.
  • the security acceleration service can be implemented for the content provider's website that only provides HTTP services for its users, and the content provider does not need to apply for a domain name certificate.
  • Fig. 2 shows a flowchart of a security acceleration service deployment method according to an exemplary embodiment of the present disclosure.
  • the security acceleration service deployment method is applied to edge nodes, and the security acceleration service deployment method includes at least step S21 to step S22, which are described in detail as follows:
  • step S21 a secure connection establishment request from the client is received, and the secure connection establishment request includes target domain name information.
  • the edge node receives the request from the client. If the request is in HTTP protocol format, the edge node can directly establish an HTTP connection with the client, and respond to the client with the content of the request through the HTTP connection.
  • the request is a secure connection request
  • get the target domain name from the requested URL and check whether there is a certificate corresponding to the target domain name in the local storage. If there is a certificate for the target domain name locally, you can send the certificate of the target domain name and Information such as the random number of the server of the edge node is used to negotiate the session key with the client, and establish an encrypted secure connection with the client after the session key is generated, and respond to the client with the content of the request through the encrypted secure connection.
  • step S22 if the certificate of the target domain name does not exist locally, a certificate acquisition request of the target domain name is sent to the certificate management platform.
  • a certificate acquisition request for the target domain name is sent to the certificate management platform.
  • the certificate of the target domain name does not exist locally. It is possible that the certificate management platform has obtained the certificate of the target domain name from the CA, but the certificate of the target domain name has not been sent to the edge node. For example, the certificate management platform fails to send the certificate of the target domain name in the process of sending it; or, the certificate management platform has not yet sent the certificate of the target domain name to the edge node. At this time, the edge node can send a certificate acquisition request of the target domain name to the certificate management platform, and obtain the certificate of the target domain name from the certificate management platform, and then establish a secure connection with the client.
  • the certificate of the target domain name does not exist locally, and it may be the first time that the CDN system receives a secure connection request for the target domain name.
  • the website of the target domain name only provides HTTP services for its users.
  • the client sends the HTTP protocol to the edge node Format request to get data.
  • the browser used by the client enables domain name mandatory HTTPS access
  • the browser converts the request in the HTTP protocol format to the request in the HTTPS protocol format.
  • the CDN manufacturer has not enabled the security acceleration service for the target domain name.
  • the edge node sends a certificate acquisition request for the target domain name to the certificate management platform.
  • the certificate management platform queries the security acceleration policy and determines whether to enable the HTTPS service for the target domain name.
  • the edge node of the CDN manufacturer may send a request for obtaining the target domain name certificate to the certificate management platform if the certificate of the target domain name is not stored locally.
  • the certificate management platform has already applied for the certificate of the target domain name, it only needs to send the certificate of the target domain name to the edge node requesting the certificate of the target domain name, and it is not necessary to deploy the certificate of the target domain name to all edge nodes, reducing the HTTPS service Deployment workload and cost.
  • the edge node when the edge node receives the secure connection request, if the certificate of the target domain name is not stored locally, the edge node will not disconnect the connection with the client at the first time, but maintain the connection with the client, And send a request to obtain the target domain name certificate to the certificate management platform. If the certificate of the target domain name is obtained from the certificate management platform during the surviving period of the connection, it will further establish a secure connection with the client and respond correctly to the client's request. This enables edge nodes to respond to requests using the HTTP protocol as well as requests using security protocols such as HTTPS, improving the service quality of the CDN system. If the certificate of the target domain name cannot be obtained from the certificate management platform during the connection surviving period, the connection with the client will be disconnected. This enables edge nodes to access connection requests from other clients and provide services for more clients.
  • the security acceleration service deployment method further includes step S23.
  • step S23 the certificate of the target domain name sent by the certificate management platform is received. If the certificate management platform has applied for a certificate for the target domain name, the edge node can obtain the certificate of the target domain name from the certificate management platform, and then send the certificate of the target domain name to the requesting client, and further establish a secure connection with the client. Responds to the client with the requested content over a secure connection. If the certificate management platform has not applied for a certificate for the target domain name, or the certificate management platform has sent a request for the certificate of the target domain name to the CA organization, but has not received the certificate of the target domain name from the CA organization, the edge node will receive the certificate sent by the certificate management platform. There is no indication of the certificate of the target domain name, and the edge node disconnects from the client.
  • the edge node obtains the certificate of the target domain name from the certificate management platform, it also receives the private key generated by the certificate management platform for the target domain name.
  • the certificate management platform After the certificate management platform enables the security acceleration service for the target domain name, and the certificate management platform has obtained the certificate of the target domain name from the CA organization, when the edge node sends a certificate request for the target domain name to the certificate management platform, it can obtain the target domain name from the certificate management platform.
  • the domain name's certificate and private key After the certificate management platform enables the security acceleration service for the target domain name, and the certificate management platform has obtained the certificate of the target domain name from the CA organization, when the edge node sends a certificate request for the target domain name to the certificate management platform, it can obtain the target domain name from the certificate management platform.
  • the domain name's certificate and private key After the certificate management platform enables the security acceleration service for the target domain name, and the certificate management platform has obtained the certificate of the target domain name from the CA organization, when the edge node sends a certificate request for the target domain name to the certificate management platform, it can obtain the target domain name from the certificate management platform.
  • the domain name's certificate and private key After the certificate management
  • the certificate management platform may issue the certificate and private key of the target domain name to all edge nodes in the CDN system.
  • the current edge node that receives the client's request to establish a secure connection can be an edge node that has sent a certificate acquisition request for the target domain name to the certificate management platform, or an edge node that has not sent a certificate acquisition request for the target domain name to the certificate management platform.
  • the current edge node is an edge node that has sent a certificate acquisition request of the target domain name to the certificate management platform, when it receives the client’s secure connection request for the target domain name again, it will send the certificate of the target domain name to the client, so that the client Receive the certificate of the target domain name, and obtain the public key of the target domain name in the certificate.
  • the edge node can also send information such as the server random number to the client.
  • the client After receiving the certificate of the target domain name and the random number of the server sent by the edge node, the client can obtain the public key of the target domain name from the certificate of the target domain name, encrypt the negotiation information such as the random number of the client with the public key, and send it to Edge node, the edge node uses the private key to decrypt the negotiation information of the client, and establishes the dialogue key, encrypts the dialogue key with the private key and sends it to the client, and the client decrypts it with the public key to obtain the dialogue key, and the edge node An encrypted secure connection is established with the client using the session key.
  • the certificate management platform deploys the certificate of the target domain name to the edge node.
  • the whole process does not require the participation of the content provider, reduces the workload of the content provider, and implements the domain name that only provides HTTP services for its users. Securely accelerate services, improve client access success rate, and improve service quality.
  • the edge node if the edge node fails to obtain the certificate of the target domain name from the certificate management platform, the edge node creates a record of not obtaining the certificate of the target domain name, and sets the record
  • the validity period can be set according to the actual network environment. For example, it can be set to 30 minutes or 60 minutes.
  • the edge node After the edge node receives a secure connection request for the target domain name, it will no longer send the target domain name to the certificate management platform. Certificate acquisition request. Reduce the pressure on the certificate management platform and improve the service performance of the certificate management platform.
  • the edge node when the edge node receives a request for accessing the security acceleration service, and the request for the security acceleration service is for domain name content that only provides HTTP services for its users, the edge node can feed back the correct information to the client. response content.
  • a company is a content provider, and its website domain name is A, but the company is not sensitive to the security of the website content, and only provides HTTP services for its users. Users can only obtain content data from the website by sending HTTP requests to the website. If a request in HTTPS protocol format is sent, the website will disconnect from the client. For example: when the user accesses the file 1.jpg in the website, the user enters HTTP://A/1.jpg through the browser, and the user can obtain the 1.jpg file; if the user enters HTTPS://A/1.jpg, the user cannot Get the content of the request.
  • the company accelerates the content of the website through the CDN network, and provides the configuration information of the domain name to the CDN manufacturer, for example, the domain name "A" of the website, the company name of the content provider, and the information of the administrator are provided to the CDN manufacturer for storage by the CDN manufacturer. in the configuration center.
  • the CDN manufacturer starts to provide acceleration services for domain name A, and formulates a security acceleration strategy for domain name A:
  • Strategy 1 Enable the security acceleration service for domain names that access HTTPS services more than or equal to 100 times.
  • the edge node When a client sends an HTTP://A/1.jpg request to the edge node, the edge node sends the 1.jpg file in the cache as a response to the client.
  • the browser forces HTTPS access to domain name A, and the browser sends a HTTPS://A/1.jpg request to the edge node.
  • the edge node receives the request in the HTTPS protocol format, and the edge node first queries whether there is a certificate of the target domain name A in the local storage.
  • the edge node will request the certificate of the domain name A from the certificate management platform. If the certificate of domain name A has been deployed in the certificate management platform, the certificate management platform will send the certificate of domain name A to the edge node, and the edge node can negotiate the key with the client. If the certificate management platform does not deploy the certificate of the domain name A, the certificate management platform queries the security acceleration policy.
  • the CDN vendor deployed strategy 1 to further query log data. If the number of HTTPS visits to domain name A is 20, which is less than the preset 100 times, the condition of policy 1 is not met, and the certificate management platform determines that domain name A does not need to enable HTTPS service.
  • the certificate management platform sends instruction information to the edge node, informing the edge node that domain name A does not enable the HTTPS service.
  • the edge node disconnects from the client. And the edge node creates a record that the certificate of the domain name A has not been obtained, and sets the validity period of the record to 30 minutes. Within 30 minutes, when the edge node receives the HTTPS protocol format request for domain name A again, it will no longer send a certificate acquisition request for domain name A to the certificate management platform.
  • the certificate management platform After a period of time, the certificate management platform received a request from the edge node to obtain the target domain name certificate again. After querying the log data, the certificate management platform found that the number of HTTPS accesses to domain name A was 105 times, which was greater than the preset 100 times. Policy 1 conditions are met, the certificate management platform determines to enable the security acceleration service for the target domain name A.
  • the certificate management platform generates a public key and a private key for domain name A.
  • the certificate management platform sends the public key and related information of the domain name A to the CA institution, and applies for the certificate of the domain name A from the CA institution.
  • the CA organization reviews the information submitted by the certificate management platform, generates a certificate for the domain name A after passing the review, and sends the certificate for the domain name A to the certificate management platform in an encrypted manner.
  • the certificate management platform sends the certificate and private key of domain name A to the edge node.
  • the edge node When the edge node receives the HTTPS://A/1.jpg request again, the edge node sends the certificate of the domain name A and the random number of the edge node to the client.
  • the client verifies the security of the certificate. After the verification is passed, use the public key obtained from the domain name A certificate to encrypt the random number and other information of the client, and send the encrypted information to the edge node; the edge node uses the private key of the domain name A to encrypt the client's
  • the encrypted information is decrypted, and a session key is generated based on the client’s random number and other information, and the session key is encrypted with the private key and sent to the client.
  • the client uses the public key of domain name A to decrypt the session key, and uses The key establishes an encrypted HTTPS connection with the edge node, and the edge node feeds back 1.jpg to the client through the encrypted connection.
  • the CDN manufacturer can pre-establish security acceleration policies, and when it is necessary to provide security acceleration services for the target domain name, the certificate management platform applies to the CA institution for the certificate of the target domain name , and deploy the certificate to the edge node to automatically provide security acceleration services for the target domain name of the content provider, without requiring the content provider to apply for a cumbersome certificate.
  • Fig. 3 is a block diagram of an apparatus for deploying a security acceleration service according to an exemplary embodiment.
  • the security acceleration service deployment device is applied to a certificate management platform, and includes: a certificate acquisition request receiving module 301 , a certificate application module 302 , and a certificate management module 303 .
  • the certificate acquisition request receiving module 301 is configured to receive the certificate acquisition request of the target domain name sent by the edge node.
  • the certificate application module 302 is configured to apply to a CA for a certificate of the target domain name when it is determined that the security acceleration service is enabled for the target domain name.
  • the certificate management module 303 is configured to return the certificate of the target domain name to the edge node.
  • Fig. 4 is a block diagram of an apparatus for deploying a security acceleration service according to an exemplary embodiment.
  • the security acceleration service deployment device further includes: a configuration information receiving module 401 .
  • the configuration information receiving module 401 is configured to receive the configuration information of the target domain name, and the configuration information includes the name of the domain name, information about the owner or manager of the domain name.
  • Fig. 5 is a block diagram of an apparatus for deploying a security acceleration service according to an exemplary embodiment.
  • the security acceleration service deployment device is applied to edge nodes, and includes: a request receiving module 501 and a certificate acquisition request sending module 502 .
  • the request receiving module 501 is configured to receive a secure connection establishment request from a client, and the secure connection establishment request includes target domain name information.
  • the certificate acquisition request sending module 502 is configured to send the certificate acquisition request of the target domain name to the certificate management platform if the certificate of the target domain name does not exist locally.
  • Fig. 6 is a block diagram of an apparatus for deploying a security acceleration service according to an exemplary embodiment.
  • the security acceleration service deployment device further includes: a certificate receiving module 601 .
  • the certificate receiving module 601 is configured to receive the certificate of the target domain name sent by the certificate management platform.
  • Fig. 7 is a block diagram of a computer device 700 for security acceleration service deployment according to an exemplary embodiment.
  • computer device 700 may be provided as a server.
  • a computer device 700 includes a processor 701 , and the number of processors can be set to one or more as required.
  • the computer device 700 also includes a memory 702 configured to store instructions executable by the processor 701 , such as application programs. The number of memories can be set to one or more as required. It can store one or more applications.
  • the processor 701 is configured to execute instructions, so as to execute the above security acceleration service deployment method.
  • the embodiments of the present disclosure may be provided as a method, an apparatus (device), or a computer program product. Accordingly, the present disclosure can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present disclosure may take the form of a computer program product embodied on one or more computer-usable storage media having computer-usable program code embodied therein.
  • Computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology arranged to store information, such as computer readable instructions, data structures, program modules, or other data, including but not limited to RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cartridges, tape, magnetic disk storage or other magnetic Desired information and any other media that can be accessed by a computer, etc.
  • communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media .
  • These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions
  • the device realizes the function specified in one or more processes of the flowchart and/or one or more blocks of the block diagram
  • the certificate management platform After the certificate management platform receives the certificate acquisition request of the target domain name sent by the edge node, if it is determined to enable the security acceleration service for the target domain name, it will automatically report to the CA institution Apply for a certificate for the target domain name.
  • Security acceleration services can be implemented for content provider websites that only provide HTTP services for their users, without requiring content providers to apply for domain name certificates or consider whether to enable security services.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种安全服务部署方法、装置、介质及设备。安全服务部署方法应用于证书管理平台，包括：接收边缘节点发送的目标域名的证书获取请求；当确定为目标域名开启安全加速服务时，向CA机构申请目标域名的证书；向边缘节点返回目标域名的证书。

Description

安全加速服务部署方法、装置、介质及设备
本公开基于2021年6月9日提交中国专利局、申请号为202110644548.X，发明名称为“安全加速服务部署方法、装置、介质及设备”的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本公开作为参考。
技术领域
本公开实施例涉及但不限于一种安全加速服务部署方法、装置、介质及设备。
背景技术
安全协议如HTTPS(Hyper Text Transfer Protocol over SecureSocket Layer，超文本传输安全协议)被广泛应用，能够提高在网络中传输的数据的安全性，传统技术中，部分浏览器会开启域名强制安全访问，例如，客户端浏览器开启强制HTTPS访问，将用户输入的HTTP(Hyper Text Transfer Protocol,超文本传输协议)格式的请求修改为HTTPS格式的请求。
如果内容提供商的网站未提供安全访问服务，如网站仅为其用户提供HTTP服务，当CDN(Content Delivery Network,内容分发网络)厂商为网站提供加速服务时，由于没有域名的证书，CDN厂商无法为网站提供如HTTPS的安全加速服务。如果客户端浏览器开启域名强制HTTPS访问时，客户端将无法从CDN网络获取请求的内容。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
为克服相关技术中存在的问题，本公开提供一种安全加速服务部署方法、装置、介质及设备。
根据本公开的第一方面，提供一种安全加速服务部署方法，应用于证书管理平台，包括：
接收边缘节点发送的目标域名的证书获取请求；
当确定为目标域名开启安全加速服务时，向CA机构申请目标域名的证书；
向边缘节点返回目标域名的证书。
在一些示例性的实施例中，所述确定为目标域名开启安全加速服务包括：
当目标域名的域名信息满足安全加速策略时，确定为目标域名开启安全加速服务，域名 信息包括顶级域类型、业务类型中的至少一种；或者，
当目标域名的运营信息满足安全加速策略时，确定为目标域名开启安全加速服务，运营信息包括访问目标域名的安全加速服务的历史次数、访问目标域名的安全加速服务的访问趋势中的至少一种；或者，
接收到为目标域名开启安全加速服务的指令信息时，确定为目标域名开启安全加速服务；或者，
当目标域名为指定域名，且当前时间为指定的时间段内，确定为目标域名开启安全加速服务。
在一些示例性的实施例中，所述安全加速策略包括以下策略中的一种或多种：
为预设顶级域类型和/或预设业务类型的域名开启安全加速服务；
为访问安全加速服务的次数大于等于预设阈值的域名和/或访问目标域名的安全加速服务的访问趋势变大的域名开启安全加速服务；
为接收到开启安全加速服务的指令信息的域名开启安全加速服务；
在指定时间段内为指定的域名开启安全加速服务。
在一些示例性的实施例中，在所述向CA机构申请所述目标域名的证书之前，所述安全加速服务部署方法还包括：获取所述目标域名的配置信息，所述配置信息包括域名名称、域名所有人或管理人相关信息。
在一些示例性的实施例中，所述安全加速服务包括HTTPS加速服务或QUIC加速服务。
根据本公开的第二方面，提供一种安全加速服务部署方法，应用于边缘节点，包括：
接收客户端的安全连接建立请求，安全连接建立请求包括目标域名信息；
若本地不存在目标域名的证书，向证书管理平台发送目标域名的证书获取请求。
在一些示例性的实施例中，所述安全加速服务部署方法还包括：
接收所述证书管理平台发送的所述目标域名的证书。
在一些示例性的实施例中，如果未能从所述证书管理平台获取所述目标域名的证书，则断开与客户端的连接。
根据本公开的第三方面，提供一种安全加速服务部署装置，应用于证书管理平台，包括：
证书获取请求接收模块，设置为接收边缘节点发送的目标域名的证书获取请求；
证书申请模块，设置为当确定为所述目标域名开启安全加速服务时，向CA机构申请所述目标域名的证书；
证书管理模块，设置为向所述边缘节点返回所述目标域名的证书。
在一些示例性的实施例中，所述安全加速服务部署装置还包括：
配置信息接收模块，设置为接收目标域名的配置信息，配置信息包括域名名称、域名所有人或管理人相关信息。
根据本公开的第四方面，提供一种安全加速服务部署装置，应用于边缘节点，包括：
请求接收模块，设置为接收客户端的安全连接建立请求，所述安全连接建立请求包括目标域名信息；
证书获取请求发送模块，设置为若本地不存在所述目标域名的证书，向证书管理平台发送所述目标域名的证书获取请求。
在一些示例性的实施例中，所述安全加速服务部署装置还包括：
证书接收模块，设置为接收所述证书管理平台发送的所述目标域名的证书。
根据本公开的第五方面，提供一种计算机可读存储介质，其上存储有计算机程序，计算机程序被执行时实现安全加速服务部署方法的步骤。
根据本公开的第六方面，提供一种计算机设备，包括处理器、存储器和存储于所述存储器上的计算机程序，所述处理器执行所述计算机程序时实现安全加速服务部署方法的步骤。
本公开提供一种安全加速服务部署方法，证书管理平台接收到边缘节点发送的目标域名的证书获取请求后，如确定为目标域名开启安全加速服务，自动向CA机构申请目标域名的证书。可以为仅为其用户提供HTTP服务的内容提供商的网站实现安全加速服务，不需要内容提供商申请域名的证书或者考虑是否开启安全服务。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性和解释性的，并不能限制本公开。在阅读并理解了附图和详细描述后，可以明白其他方面。
附图说明
构成本公开的一部分的附图用来提供对本公开的进一步理解，本公开的示意性实施例及其说明用于解释本公开，并不构成对本公开的不当限定。在附图中：
图1是根据一示例性实施例示出的一种安全加速服务部署方法的流程图。
图2是根据一示例性实施例示出的一种安全加速服务部署方法的流程图。
图3是根据一示例性实施例示出的一种安全加速服务部署装置的框图。
图4是根据一示例性实施例示出的一种安全加速服务部署装置的框图。
图5是根据一示例性实施例示出的一种安全加速服务部署装置的框图。
图6是根据一示例性实施例示出的一种安全加速服务部署装置的框图。
图7是根据一示例性实施例示出的一种计算机设备的框图。
具体实施方式
为使本公开实施例的目的、技术方案和优点更加清楚，下面将结合本公开实施例中的附图，对本公开实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本公开一部分实施例，而不是全部的实施例。基于本公开中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本公开保护的范围。需要说明的是，在不冲突的情况下，本公开中的实施例及实施例中的特征可以相互任意组合。
随着网络发展，出现了多种以安全为目的传输协议，例如：
HTTPS又称HTTP over TLS，即采用HTTP方式通讯，但利用TLS/SSL来加密通讯过程中的数据包，SSL(Secure Sockets Layer安全套接字协议),及传输层安全(Transport Layer Security，TLS)是为网络通信提供安全及数据完整性的安全协议。TLS与SSL在传输层与应用层之间对网络连接进行加密。HTTPS是如今互联网领域中，确保网站真实、保护用户隐私以及信息安全的重要方式。
使用上述安全协议提供安全服务时，服务端需要部署目标域名的证书，供客户端进行认证。
然而，现实中仍有大量网站采用普通协议(例如HTTP)提供服务，其原因为内容提供商对网站资源的安全性不敏感。在CDN厂商为内容提供商的网站提供加速服务时，由于内容提供商未提供网站的域名相关的证书给CDN厂商，CDN厂商的CDN边缘节点也不能向客户端提供网站域名的证书，进而CDN不能提供使用安全协议的加速服务，本公开将CDN系统使用安全协议向用户提供的加速服务定义为安全加速服务。另外，在客户端浏览器开启域名强制HTTPS访问时，客户端浏览器会将用户输入的HTTP协议格式的请求转换为HTTPS协议格式的请求，对于边缘节点来说，当边缘节点接收到客户端的HTTPS协议格式的请求，该HTTPS协议格式的请求如果是针对仅为其用户提供HTTP服务的网站的内容的请求时，由于边缘节点没有该网站域名的证书，不能与客户端建立加密连接，不能对客户端的HTTPS协议格式的请求响应正确的内容。
另外一个方面，如果内容提供商希望在CDN厂商提供CDN加速服务时，CDN厂商能够采用HTTPS或者QUIC提供安全的加速服务，内容提供商需要将网站域名的证书提供给CDN厂商，其过程大致如下：以安全加速服务为HTTPS服务进行说明，内容提供商创建域名相关的服务端公钥以及私钥，然后提交该公钥以及个人或组织信息等至CA(权威证书颁发)机构进行认 证申请；CA机构审核信息通过后，生成数字证书，该数字证书包申请者的公钥、申请者信息、CA签名等信息；内容提供商收到该数字证书后，将该证书发送给CDN厂商，由CDN厂商负责部署该证书至边缘节点。当客户端的HTTPS协议格式的请求至CDN边缘节点时，边缘节点便会将证书发送给客户端，客户端认证该证书通过后，进行密钥协商，后续便可继续HTTPS协议格式的请求处理。可见，为了提供HTTPS服务功能，内容提供商需要经历繁琐的过程。
为解决传统技术中存在的问题，本公开提供一种安全加速服务部署方法。
图1示出了根据本公开一示例性实施例的安全加速服务部署方法的流程图。参考图1，安全加速服务部署方法应用于证书管理平台，安全加速服务部署方法至少包括步骤S11至步骤S13,详细介绍如下：
在步骤S11中，接收边缘节点发送的目标域名的证书获取请求。
证书管理平台是CDN服务商设置的，设置为对服务的域名的证书进行管理的设备，可以为专用设备，也可以为一般服务器，其上安装用于证书管理的软件或代码。
内容提供商提供网络内容，拥有自己的网站域名，供网民访问。内容提供商可以使用CDN服务商的CDN网络，对网站内容进行加速。CDN服务商可以预先获取内容提供商的域名的相关信息，以便对CDN网络进行配置，例如设置相应的边缘服务器对内容提供商的域名进行加速服务。再如，如果内容提供商采用HTTPS服务，且已申请了域名的证书，在CDN网络提供加速服务前，需要将域名及域名的证书提供给CDN服务商，CDN服务商将域名的证书部署至边缘节点中。例如，部署了目标域名的证书的边缘节点，可以在接收到针对目标域名的HTTPS协议格式的请求时，向客户端提供域名的证书，并在域名的证书验证通过后，与客户端建立安全连接。
一般情况下，CDN厂商为内容提供商的网站内容提供加速服务时，如果网站支持安全协议，CDN厂商能够从内容提供商处获取到目标域名的证书，并将目标域名的证书部署在边缘节点中，以使边缘节点在接收到针对目标域名的安全连接请求时，向客户端发送域名的证书，并与客户端协商对话密钥后，建立加密的安全连接；如果网站只支持HTTP协议，内容提供商并未申请目标域名的证书，CDN厂商也就不能从内容提供商处获取到目标域名的证书，并部署目标域名的证书到边缘节点中，因此边缘节点接收到针对目标域名的安全连接请求时，不能向客户端提供目标域名的证书，也不能与客户端进行有效协商，无法建立加密的安全连接。通常情况下，边缘节点断开与客户端的连接。在此情况下，客户端发出的针对目标域名的安全连接请求，都不能得到正确响应，在此类客户端数量较大时，会严重影响内容提供商的服务质量，降低用户体验。
本示例性实施例中，边缘节点接收到客户端的安全连接请求后，获取请求中的目标域名，在查询本地存储中，没有目标域名的证书时，边缘节点不会第一时间断开与客户端的连接，而是向证书管理平台发送目标域名的证书获取请求。证书管理平台接收边缘节点发送的目标域名的证书获取请求后，可以查询本地存储中是否存在目标域名的证书。
在步骤S12中，当确定为目标域名开启安全加速服务时，向CA机构申请所述目标域名的证书。
证书管理平台接收到边缘节点的证书获取请求后，会查询本地的存储，如果有目标域名的证书，可以将目标域名的证书下发至该边缘节点；如果正书管理平台未在本地存储中查询到目标域名的证书，可以确定目标域名的证书未在CDN厂商的系统中部署过。证书管理平台可以通过查询安全加速策略，确定是否为目标域名开启安全加速服务。安全加速策略是CDN服务商在为目标域名提供域名加速服务时，为目标域名制定的策略。
在一示例性实施例中，安全加速策略包括以下策略中的一种或多种：
为预设顶级域类型和/或预设业务类型的域名开启安全加速服务。
为访问安全加速服务的次数大于等于预设阈值和/或多个预设时段内访问安全加速服务的访问趋势变大的域名开启安全加速服务。
为接收到开启安全加速服务的指令信息的域名开启安全加速服务。
在指定时间段内为指定的域名开启安全加速服务。
安全加速策略由CDN厂商制定，可以根据具体的网络环境制定，或者根据服务平台的客户(内容提供商或内容提供商的代表)的指示信息进行制定。安全加速策略可以有一条，也可以为多条，当有多条安全加速策略时，其中任一安全加速策略条件满足时，都可以确定为目标域名开启安全加速服务。CDN厂商可以在为目标域名提供服务的初始阶段制定相关的安全加速策略，也可以在为目标域名提供服务的过程的中，根据实际的网络环境或管理决策，制定新的安全加速策略，或者，对已经制定的安全加速策略进行调整或删除。本领域技术人员应该明白，除以上安全加速策略外，还可以制订其他安全加速策略。
证书管理平台查询安全加速策略后，判断与目标域名的相关的各类信息是否满足安全加速策略的条件，如果满足安全加速策略的条件，则确定为目标域名开启安全加速服务，由证书管理平台向CA机构申请目标域名的证书。本示例性实施例中，证书管理平台可以直接向CA机构为目标域名申请证书，而不必向内容提供商获取。
在一示例性实施例中，确定为目标域名开启安全加速服务包括：
当目标域名的域名信息满足安全加速策略时，确定为目标域名开启安全加速服务；域名 信息包括顶级域类型、业务类型中的至少一种。
例如，目标域名为WWW.ABC.GOV,而安全加速策略为：为顶级域类型为GOV的域名提供加速服务，则目标域名信息中的顶级域类型满足安全加速策略，证书管理平台确定为目标域名WWW.ABC.GOV开启安全加速服务。或者，根据目标域名中的二级域名ABC确定该域名对应的业务类型，例如域名对应的业务类型为财经类型的业务，而安全加速策略为：为业务类型为财经类的域名提供加速服务，则为目标域名开启安全加速服务。也可以综合顶级域的类型和二级域名对应的业务类型是否满足加速策略来确定。域名信息包括但不限于顶级域类型、业务类型。
在一示例性实施例中，当目标域名的运营信息满足安全加速策略时，确定为目标域名开启安全加速服务，运营信息包括访问目标域名的安全加速服务的历史次数、访问目标域名的安全加速服务的访问趋势中的至少一种。
例如，为访问安全加速服务的次数大于等于100次的域名开启安全加速服务。针对目标域名WWW.B.COM，证书管理平台查询CDN系统的管理设备，获得目标域名的运行日志，CDN系统中的边缘节点接收到HTTPS://WWW.B.COM的请求次数超过100次，为目标域名开启安全加速服务。再如，为访问安全加速服务的访问趋势变大的域名开启安全加速服务，通过查询目标域名的运行日志，CDN系统中的边缘节点接收到HTTPS://WWW.B.COM的请求次数为80次，但连续3天内的请求次数分别为10次，13次，17次，说明访问目标域名的HTTPS安全加速服务的访问趋势变大，为域名WWW.B.COM开启安全加速服务。访问趋势还可以根据连续时间段内的访问安全加速服务的次数与总访问次数多占比确定。例如，连续3天中，第一天针对WWW.B.COM的总访问次数为1000次，其中HTTPS的访问次数占比为1％，第一天针对WWW.B.COM的总访问次数为1580次，其中HTTPS的访问次数占比为1.5％，第三天针对WWW.B.COM的总访问次数为1050次，其中HTTPS的访问次数占比为2％，说明访问目标域名的HTTPS安全加速服务的访问趋势变大，为域名WWW.B.COM开启安全加速服务。
在一示例性实施例中，接收到为目标域名开启安全加速服务的指令信息时，确定为目标域名开启安全加速服务。例如安全加速策略中包括，为接收到开启安全加速服务的指令信息的域名开启安全加速服务。证书管理平台从自身或外部平台(如配置中心)获取到为目标域名WWW.B.COM开启安全加速服务的指令信息，该指令信息可以是CDN系统的客户(内容提供商或内容提供商的代表)在证书管理平台或配置平台上通过勾选相应的选项，向CDN系统发出的指令信息；也可以通过其他方式向CDN管理平台或管理人员发出的指令信息，例如WWW.B.COM的内容提供商通过通讯工具向CDN管理人员发出的通知，指示为域名WWW.B.COM 开启安全加速服务；还可以是CDN管理人员通过对域名WWW.B.COM进行安全评估，可能存在网络攻击的风险，确定为域名WWW.B.COM开启安全加速服务，并通过管理设备向证书管理平台发出指令。
在一示例性实施例中，当目标域名为指定域名，且当前时间为指定的时间段内，确定为目标域名开启安全加速服务。某些网站的业务会和某些特定的时间段有比较强的相关性，例如成绩查询类网站，在公布成绩的时间段内，会有大量的查询请求，而在其他时段内，可能都不会接收到查询请求。对于请求数量与具体时间段存在较强关联性的网站域名，可以预设与具体时间段相关的安全加速策略。例如安全加速策略中包括，在某月某日至某月某日的指定时间段为域名WWW.B.COM开启安全加速服务。如果证书管理平台判断当前时刻在指定的时段内，则为域名WWW.B.COM开启安全加速服务。CDN系统可以在安全加速策略指定的时间段内，为指定的域名提供安全加速服务，保证指定域名的安全，并提升服务质量。
当确定为目标域名开启安全加速服务时，证书管理平台向CA机构申请目标域名的证书。由CDN厂商为目标域名申请证书，避免了内容提供商向CA机构申请证书的繁琐过程。
在一示例性实施例中，向CA机构申请目标域名的证书之前还包括：获取目标域名的配置信息，配置信息包括域名名称、域名所有人或管理人相关信息。配置信息为申请目标域名的证书所需要的信息。
如果内容提供商本身不提供安全连接服务，或者，内容提供商未申请域名的证书，CDN服务商可以预先从内容提供商处获取域名的配置信息，例如内容提供商的公司名称、内容提供商的管理人信息等，以便CDN厂商在提供加速服务的过程中，根据实际的网络环境，或接收到内容提供商指示CDN厂商为目标域名提供安全加速服务的情况下，需要对目标域名提供安全加速服务时，可以使用目标域名的配置信息向CA机构申请证书。
不同域名的配置信息可以存储在配置中心或管理设备中，在证书管理平台确定为目标域名开启安全加速服务后，向CA机构发送申请前，向配置中心或管理设备获取。
证书管理平台获取到目标域名的配置信息后，还需生成目标域名的公钥和私钥。证书管理平台为了代替内容提供商申请目标域名的证书，由证书管理平台生成目标域名的公钥和私钥。
证书管理平台将目标域名的配置信息和公钥发送至CA机构，CA机构对目标域名的相关信息进行申请者信息验证后，为目标域名生成相应的证书，该证书包括公钥、申请者信息、CA签名等信息。
内容提供商只需将相关信息提供给CDN厂商，即可在目标域名需要提供安全连接服务器 时，由CDN厂商的证书管理平台为目标域名申请域名的证书，避免了内容提供商申请域名的证书的繁琐过程。
在一示例性实施例中，安全加速服务包括HTTPS加速服务或QUIC加速服务。
安全加速服务可以是HTTPS加速服务，也可以是QUIC服务。QUIC(Quick UDP Internet Connection)是谷歌制定的一种基于UDP的低时延的互联网传输层协议，其中传输层协议包括TCP和UDP协议。QUIC融合了包括TCP，TLS，HTTP/2等协议的特性，但基于UDP传输，是一种快速安全的传输协议。
除上述安全协议的加速服务外，安全加速服务也可以是其他的协议形式，认证时需要服务端提供证书的场景都可以应用本公开提供的安全加速服务，由CDN厂商在确定为目标域名提供安全加速服务时，由证书管理平台为目标域名申请证书，并将目标域名的证书部署到边缘节点中，实现对目标域名的安全加速服务。
在步骤S13中，向边缘节点返回目标域名的证书。
证书管理平台接收CA机构签发的目标域名的证书，将目标域名的证书存储在本地存储中，然后将目标域名的证书下发至边缘节点，以使边缘节点开启所述目标域名的安全连接服务。
实际应用中，证书管理平台接收CA机构签发的目标域名的证书后，将目标域名的证书和私钥下发至发送证书获取请求的边缘节点中，边缘节点在接收到目标域名的证书后，将目标域名的证书存储在本地，当边缘节点再次接收到针对目标域名的安全连接请求时，边缘节点将目标域名的证书发送给客户端，目标域名的证书包含目标域名的公钥，申请者信息，CA签名等信息。由此，客户端可以拥有目标域名的公钥，边缘节点拥有目标域名的私钥，随后，双方可以进行密钥协商，并建立加密的安全连接。
在一示例性实施例中，如果某些边缘节点的覆盖范围内，客户端浏览器未开启域名强制HTTPS访问功能，这些边缘节点在为仅为其用户提供HTTP服务的目标域名进行加速服务时，不会接收到针对目标域名的HTTPS访问请求。证书管理平台可以将目标域名的证书只下发至发送证书获取请求的边缘节点，既可以保证接收到域名证书的边缘节点可以为更多的客户端提供内容服务，也不会导致大范围下发目标域名的证书对网络资源的占用。
在一示例性实施例中，证书管理平台可以将目标域名的证书下发至CDN系统中的全部边缘节点，任一边缘节点在接收到针对目标域名的HTTPS访问请求时，可以及时向发出请求的客户端发放目标域名的证书，并建立HTTPS连接，及时为客户端提供内容服务。
基于图1所示的实施例，在本公开一示例性实施例中，证书管理平台接收边缘节点发送 的目标域名的证书获取请求后，若目标域名的各类信息都不满足安全加速策略时，即不需要为目标域名开启安全连接服务时，向边缘节点发送不存在目标域名的证书的指示信息，以使边缘节点断开与客户端的连接。
基于图1所示的实施例,证书管理平台接收到边缘节点发送的目标域名的证书获取请求后，如确定为目标域名开启安全加速服务，自动向CA机构申请目标域名的证书。可以为仅为其用户提供HTTP服务的内容提供商的网站实现安全加速服务，不需要内容提供商申请域名的证书。
图2示出了根据本公开一示例性实施例的安全加速服务部署方法的流程图。参考图2，安全加速服务部署方法应用于边缘节点，安全加速服务部署方法至少包括步骤S21至步骤S22,详细介绍如下：
在步骤S21中，接收客户端的安全连接建立请求，安全连接建立请求包括目标域名信息。
边缘节点接收客户端的请求，如果请求为HTTP协议格式的请求，边缘节点可以直接与客户端建立HTTP连接，通过HTTP连接向客户端响应请求的内容。
如果请求为安全连接请求，则从请求的URL中获取目标域名，并在本地存储中查询是否存在目标域名对应的证书，如果本地存在目标域名的证书，则可以向客户端发送目标域名的证书及边缘节点的服务器随机数等信息，用以和客户端协商对话密钥，并在生成对话密钥后与客户端建立加密的安全连接，通过加密的安全连接向客户端响应请求的内容。
在步骤S22中，若本地不存在目标域名的证书，向证书管理平台发送目标域名的证书获取请求。
如果本地不存在目标域名的证书，则向证书管理平台发送目标域名的证书获取请求。本地不存在目标域名的证书，有可能是证书管理平台已经从CA机构获取了目标域名的证书，但目标域名的证书并未发送到该边缘节点。例如，证书管理平台在发送目标域名的证书的过程中，未发送成功；或者，证书管理平台还未向边缘节点发送目标域名的证书。此时，边缘节点可以向证书管理平台发送目标域名的证书获取请求，并从证书管理平台获取目标域名的证书，进而与客户端建立安全连接。本地不存在目标域名的证书，还有可能是CDN系统首次接收到针对目标域名的安全连接请求，例如目标域名的网站仅为其用户提供HTTP服务，正常情况下客户端通过向边缘节点发送HTTP协议格式的请求获取数据。当有客户端使用的浏览器开启了域名强制HTTPS访问后，浏览器将HTTP协议格式的请求转换为HTTPS协议格式的请求。此时CDN厂商还没有对目标域名开启安全加速服务，边缘节点向证书管理平台发送目标域名的证书获取请求，由证书管理平台查询安全加速策略并确定是否为目标域名开启HTTPS服务。
在一示例性实施例中，CDN厂商的边缘节点可以在接收到针对目标域名的安全连接请求后，在本地没有存储目标域名的证书的情况下，向证书管理平台发送目标域名证书的获取请求，在证书管理平台已经申请到目标域名的证书的情况下，只需将目标域名的证书发送至请求获取目标域名证书的边缘节点，不需要将目标域名的证书部署到全部边缘节点中，降低HTTPS服务部署的工作量及成本。
在一示例性实施例中，边缘节点在接收到安全连接请求时，如果本地没有存储目标域名的证书，边缘节点并不会第一时间断开与客户端的连接，而是维持与客户端的连接，并向证书管理平台发送获取目标域名证书的请求。如果在连接存活期间，从证书管理平台获取到目标域名的证书，则进一步与客户端建立安全连接，对客户端的请求进行正确响应。使得边缘节点既可以对使用HTTP协议的请求进行响应，也可以对使用HTTPS等安全协议的请求进行响应，提高CDN系统的服务质量。如果在连接存活期间，未能从证书管理平台获取到目标域名的证书，则断开与客户端的连接。以使边缘节点能够接入其他客户端的连接请求，为更多客户端提供服务。
基于图2所示的实施例，在本公开一示例性实施例中，安全加速服务部署方法还包括步骤S23。
在步骤S23中，接收证书管理平台发送的目标域名的证书。如果证书管理平台已经为目标域名申请了证书，则边缘节点能够从证书管理平台获取到目标域名的证书，然后可以将目标域名的证书发送至请求的客户端，并进一步与客户端建立安全连接，通过安全连接向客户端响应请求的内容。如果证书管理平台没有为目标域名申请证书，或者证书管理平台已经向CA机构发送了申请目标域名的证书的请求，还未从CA机构接收到目标域名的证书，边缘节点会接收到证书管理平台发送的不存在目标域名的证书的指示信息，此时边缘节点断开与客户端的连接。
在实际应用中，边缘节点从证书管理平台获取目标域名的证书的同时，还会接收到证书管理平台为目标域名生成的私钥。
当证书管理平台为目标域名开启安全加速服务后，并且证书管理平台已经从CA机构获取了目标域名的证书，当边缘节点向证书管理平台发送目标域名的证书请求后，可以从证书管理平台获取目标域名的证书和私钥。
在一示例性实施例中，证书管理平台获取到目标域名的证书后，可以将目标域名的证书和私钥向CDN系统中的全部边缘节点下发。
接收到客户端建立安全连接请求的当前边缘节点可以为向证书管理平台发送过目标域名 的证书获取请求的边缘节点，也可以是未向证书管理平台发送过目标域名的证书获取请求的边缘节点。
如果当前边缘节点为向证书管理平台发送过目标域名的证书获取请求的边缘节点，当再次接收到客户端针对目标域名的安全连接请求时，将目标域名的证书发送至客户端，以使客户端接收目标域名的证书，并在证书中获取目标域名的公钥。同时，边缘节点还可以将服务器随机数等信息一同发送至客户端。
客户端接收到边缘节点发送的目标域名的证书及服务器随机数等信息，可以从目标域名的证书中获取目标域名的公钥，并对客户端随机数等协商信息使用公钥进行加密后发送至边缘节点，边缘节点使用私钥解密客户端的协商信息，并建立对话密钥，将对话密钥使用私钥加密后发送至客户端，客户端再使用公钥解密，从而获取对话密钥，边缘节点和客户端使用对话密钥建立加密的安全连接。
本示例性实施例中，证书管理平台将目标域名的证书部署到边缘节点，整个过程不需要内容提供商的参与，降低内容提供商的工作量，并为仅为其用户提供HTTP服务的域名实现安全加速服务，提高客户端的访问成功率，提高服务质量。
基于图2所示的实施例，在一示例性实施例中，如果边缘节点未能从证书管理平台获取目标域名的证书，边缘节点建立未获取到目标域名的证书的记录，并设置所述记录的有效期，有效期可以根据实际的网络环境设置，比如可以设置为30分钟，或60分钟，在有效期内，边缘节点接收到针对目标域名的安全连接请求后，不再向证书管理平台发送目标域名的证书获取请求。减轻证书管理平台的压力，提高证书管理平台的服务性能。
基于图2所示的实施例,边缘节点在接收到访问安全加速服务的请求时，该安全加速服务的请求为针对仅为其用户提供HTTP服务的域名内容时，边缘节点能够向客户端反馈正确的响应内容。
基于上述示例性实施例的技术方案，以下介绍本公开实施例的一个具体应用场景：
某公司为内容提供商，其网站域名为A，但该公司对网站内容的安全性不敏感，仅为其用户提供HTTP服务。用户只能向网站发送HTTP的请求才能从网站获取内容数据，如果发送HTTPS协议格式的请求，网站将断开与客户端的连接。例如：用户访问网站中的文件1.jpg，用户通过浏览器输入HTTP://A/1.jpg，用户能够获取1.jpg文件；如果用户输入HTTPS://A/1.jpg，用户无法获取请求的内容。
该公司通过CDN网络对网站内容进行加速，将域名的配置信息提供给CDN厂商，例如将网站的域名“A”，内容提供商的公司名称、管理人信息等提供给CDN厂商，由CDN厂商保存 在配置中心。CDN厂商开始为域名A提供加速服务，并制定域名A的安全加速策略：
策略1：为访问HTTPS服务的次数大于等于100次的域名开启安全加速服务。
当有客户端向边缘节点发送HTTP://A/1.jpg请求时，边缘节点将缓存中的1.jpg文件作为响应发送至客户端。当有客户端通过浏览器输入HTTP://A/1.jpg，浏览器对域名A强制HTTPS访问,浏览器向边缘节点发出HTTPS://A/1.jpg请求。边缘节点接收到HTTPS协议格式的请求，边缘节点首先查询本地存储中是否有目标域名A的证书。
如果边缘节点中未存储目标域名A的证书，边缘节点会向证书管理平台请求域名A的证书。如果证书管理平台中已经部署了域名A的证书，证书管理平台将域名A的证书发送至边缘节点，边缘节点即可和客户端进行密钥协商。如果证书管理平台未部署域名A的证书，则证书管理平台查询安全加速策略。
经查询，CDN厂商部署了策略1，进一步查询日志数据。假如针对域名A的HTTPS访问次数为20次，小于预设的100次，策略1的条件不满足，证书管理平台确定域名A不需要开启HTTPS服务。证书管理平台向边缘节点发送指示信息，告知边缘节点域名A未开启HTTPS服务。边缘节点断开与客户端的连接。并且边缘节点建立未获取到域名A的证书的记录，设置记录的有效期为30分钟。在30分钟内，边缘节点再次接收到针对域名A的HTTPS协议格式的请求时，不再向证书管理平台发送域名A的证书获取请求。
经过一段时间后，证书管理平台再次接收到边缘节点发送的获取目标域名证书的请求，证书管理平台经过查询日志数据，针对域名A的HTTPS访问次数为105次，大于预设的100次，策略1的条件满足，证书管理平台确定为目标域名A开启安全加速服务。
证书管理平台为域名A生成公钥和私钥。
证书管理平台将域名A的公钥和相关信息发送至CA机构，向CA机构申请域名A的证书。
CA机构对证书管理平台提交的信息进行审核，审核通过后生成域名A的证书，并通过加密的方式将域名A的证书发送至证书管理平台。
证书管理平台将域名A的证书和私钥发送至边缘节点。
当边缘节点再次接收到HTTPS://A/1.jpg请求,边缘节点将域名A的证书及边缘节点随机数等信息发送至该客户端。客户端验证证书安全性，验证通过后，使用域名A的证书中获取的公钥对客户端随机数等信息进行加密，将加密信息发送至边缘节点；边缘节点使用域名A的私钥对客户端的加密信息解密，并根据客户端随机数等信息生成对话密钥，将对话密钥使用私钥加密后发送至该客户端，该客户端使用域名A的公钥解密后获得对话密钥，使用对话密钥与边缘节点建立加密的HTTPS连接，边缘节点将1.jpg通过加密连接反馈给该客户端。
根据以上示例性实施例，本公开提供的安全加速服务部署方法，可以由CDN厂商预先制定安全加速策略，在需要为目标域名提供安全加速服务时，由证书管理平台向CA机构申请目标域名的证书，并将证书部署到边缘节点中，自动为内容提供商的目标域名提供安全加速服务，不需要内容提供商进行繁琐的证书申请。
图3是根据一示例性实施例示出的安全加速服务部署装置的框图。参考图3，安全加速服务部署装置，应用于证书管理平台，包括：证书获取请求接收模块301，证书申请模块302，证书管理模块303。
该证书获取请求接收模块301设置为接收边缘节点发送的目标域名的证书获取请求。
该证书申请模块302设置为当确定为目标域名开启安全加速服务时，向CA机构申请目标域名的证书。
该证书管理模块303设置为向边缘节点返回目标域名的证书。
图4是根据一示例性实施例示出的安全加速服务部署装置的框图。参考图4，安全加速服务部署装置还包括：配置信息接收模块401。
该配置信息接收模块401设置为接收目标域名的配置信息，所述配置信息包括域名名称、域名所有人或管理人相关信息。
图5是根据一示例性实施例示出的安全加速服务部署装置的框图。参考图5，安全加速服务部署装置，应用于边缘节点，包括：请求接收模块501，证书获取请求发送模块502。
该请求接收模块501设置为接收客户端的安全连接建立请求，安全连接建立请求包括目标域名信息。
该证书获取请求发送模块502设置为若本地不存在所述目标域名的证书，向证书管理平台发送所述目标域名的证书获取请求。
图6是根据一示例性实施例示出的安全加速服务部署装置的框图。参考图6，安全加速服务部署装置还包括：证书接收模块601。
该证书接收模块601设置为接收证书管理平台发送的目标域名的证书。
图7是根据一示例性实施例示出的一种用于安全加速服务部署的计算机设备700的框图。例如，计算机设备700可以被提供为一服务器。参照图7，计算机设备700包括处理器701，处理器的个数可以根据需要设置为一个或者多个。计算机设备700还包括存储器702，设置为存储可由处理器701的执行的指令，例如应用程序。存储器的个数可以根据需要设置一个或者多个。其存储的应用程序可以为一个或者多个。处理器701被配置为执行指令，以执行上述安全加速服务部署方法。
本领域技术人员应明白，本公开的实施例可提供为方法、装置(设备)、或计算机程序产品。因此，本公开可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本公开可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质上实施的计算机程序产品的形式。计算机存储介质包括设置为存储信息(诸如计算机可读指令、数据结构、程序模块或其他数据)的任何方法或技术中实施的易失性和非易失性、可移除和不可移除介质,包括但不限于RAM、ROM、EEPROM、闪存或其他存储器技术、CD-ROM、数字多功能盘(DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以设置为存储期望的信息并且可以被计算机访问的任何其他的介质等。此外，本领域普通技术人员公知的是，通信介质通常包含计算机可读指令、数据结构、程序模块或者诸如载波或其他传输机制之类的调制数据信号中的其他数据，并且可包括任何信息递送介质。
本公开是参照根据本公开实施例的方法、装置(设备)和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
在本公开中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括……”限定的要素，并不排除在包括所述要素的物品或者设备中还存在另外的相同要素。
尽管已描述了本公开的示例性实施例，但本领域内的技术人员一旦得知了基本创造性概 念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括示例性实施例以及落入本公开范围的所有变更和修改。
显然，本领域的技术人员可以对本公开进行各种改动和变型而不脱离本公开的精神和范围。这样，倘若本公开的这些修改和变型属于本公开权利要求及其等同技术的范围之内，则本公开的意图也包含这些改动和变型在内。
工业实用性
本公开提供的一种安全加速服务部署方法、装置、介质及设备中，证书管理平台接收到边缘节点发送的目标域名的证书获取请求后，如确定为目标域名开启安全加速服务，自动向CA机构申请目标域名的证书。可以为仅为其用户提供HTTP服务的内容提供商的网站实现安全加速服务，不需要内容提供商申请域名的证书或者考虑是否开启安全服务。

Claims (14)

  1. 一种安全加速服务部署方法，应用于证书管理平台，包括：
    接收边缘节点发送的目标域名的证书获取请求；
    当确定为所述目标域名开启安全加速服务时，向CA机构申请所述目标域名的证书；
    向所述边缘节点返回所述目标域名的证书。
  2. 如权利要求1所述的安全加速服务部署方法，其中，所述确定为所述目标域名开启安全加速服务包括：
    当所述目标域名的域名信息满足安全加速策略时，确定为所述目标域名开启安全加速服务，所述域名信息包括顶级域类型、业务类型中的至少一种；或者，
    当所述目标域名的运营信息满足安全加速策略时，确定为所述目标域名开启安全加速服务，所述运营信息包括访问所述目标域名的安全加速服务的历史次数、访问所述目标域名的安全加速服务的访问趋势中的至少一种；或者，
    接收到为所述目标域名开启安全加速服务的指令信息时，确定为所述目标域名开启安全加速服务；或者，
    当所述目标域名为指定域名，且当前时间为指定的时间段内，确定为所述目标域名开启安全加速服务。
  3. 如权利要求2所述的安全加速服务部署方法，其中，所述安全加速策略包括以下策略中的一种或多种：
    为预设顶级域类型和/或预设业务类型的域名开启安全加速服务；
    为访问安全加速服务的次数大于等于预设阈值的域名和/或访问目标域名的安全加速服务的访问趋势变大的域名开启安全加速服务；
    为接收到开启安全加速服务的指令信息的域名开启安全加速服务；
    在指定时间段内为指定的域名开启安全加速服务。
  4. 如权利要求1所述的安全加速服务部署方法，其中，所述向CA机构申请所述目标域名的证书之前，还包括：获取所述目标域名的配置信息，所述配置信息包括域名名称、域名所有人或管理人相关信息。
  5. 如权利要求1-4任意一项所述的安全加速服务部署方法，其中，所述安全加速服务包括HTTPS加速服务或QUIC加速服务。
  6. 一种安全加速服务部署方法，应用于边缘节点，包括：
    接收客户端的安全连接建立请求，所述安全连接建立请求包括目标域名信息；
    若本地不存在所述目标域名的证书，向证书管理平台发送所述目标域名的证书获取请求。
  7. 如权利要求6所述的安全加速服务部署方法，还包括：
    接收所述证书管理平台发送的所述目标域名的证书。
  8. 如权利要求6所述的安全加速服务部署方法，其中，如果未能从所述证书管理平台获取所述目标域名的证书，则断开与所述客户端的连接。
  9. 一种安全加速服务部署装置，应用于证书管理平台，包括：
    证书获取请求接收模块，设置为接收边缘节点发送的目标域名的证书获取请求；
    证书申请模块，设置为当确定为所述目标域名开启安全加速服务时，向CA机构申请所述目标域名的证书；
    证书管理模块，设置为向所述边缘节点返回所述目标域名的证书。
  10. 如权利要求9所述的安全加速服务部署装置，还包括：
    配置信息接收模块，设置为接收所述目标域名的配置信息，所述配置信息包括域名名称、域名所有人或管理人相关信息。
  11. 一种安全加速服务部署装置，应用于边缘节点，包括：
    请求接收模块，设置为接收客户端的安全连接建立请求，所述安全连接建立请求包括目标域名信息；
    证书获取请求发送模块，设置为若本地不存在所述目标域名的证书，向证书管理平台发送所述目标域名的证书获取请求。
  12. 如权利要求11所述的安全加速服务部署装置，还包括：
    证书接收模块，设置为接收所述证书管理平台发送的所述目标域名的证书。
  13. 一种计算机可读存储介质，其上存储有计算机程序，其中，所述计算机程序被执行时实现如权利要求1－8中任意一项所述方法的步骤。
  14. 一种计算机设备，包括处理器、存储器和存储于所述存储器上的计算机程序，其中，所述处理器执行所述计算机程序时实现如权利要求1－8中任意一项所述方法的步骤。
PCT/CN2022/097407 2021-06-09 2022-06-07 安全加速服务部署方法、装置、介质及设备 WO2022257928A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110644548.X 2021-06-09
CN202110644548.XA CN115460083B (zh) 2021-06-09 2021-06-09 安全加速服务部署方法、装置、介质及设备

Publications (1)

Publication Number Publication Date
WO2022257928A1 true WO2022257928A1 (zh) 2022-12-15

Family

ID=84294404

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/097407 WO2022257928A1 (zh) 2021-06-09 2022-06-07 安全加速服务部署方法、装置、介质及设备

Country Status (2)

Country Link
CN (1) CN115460083B (zh)
WO (1) WO2022257928A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106230782A (zh) * 2016-07-20 2016-12-14 腾讯科技（深圳）有限公司 一种基于内容分发网络的信息处理方法及装置
CN107493174A (zh) * 2017-09-05 2017-12-19 成都知道创宇信息技术有限公司 基于cdn网络的ssl证书智能绑定与管理方法
CN109417536A (zh) * 2016-04-15 2019-03-01 高通股份有限公司 用于管理内容递送网络中的安全内容传输的技术
CN111404668A (zh) * 2019-01-02 2020-07-10 中国移动通信有限公司研究院 一种信息处理方法、设备及存储介质
CN113037888A (zh) * 2021-03-12 2021-06-25 北京金山云网络技术有限公司 加速域名的配置方法及装置、存储介质、电子设备

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103227801B (zh) * 2013-05-14 2017-02-08 网宿科技股份有限公司 基于内容分发网络的https证书部署方法及系统
US10110592B2 (en) * 2013-10-09 2018-10-23 Digicert, Inc. Reducing latency for certificate validity messages using private content delivery networks
CN110808989B (zh) * 2016-09-30 2022-01-21 贵州白山云科技股份有限公司 一种基于内容分发网络的https加速方法和系统
CN108418678B (zh) * 2017-02-10 2019-05-07 贵州白山云科技股份有限公司 一种私钥安全存储和分发的方法及装置
CN111066284B (zh) * 2017-10-09 2021-06-29 华为技术有限公司 一种业务证书管理方法、终端及服务器
CN108401011B (zh) * 2018-01-30 2021-09-24 网宿科技股份有限公司 内容分发网络中握手请求的加速方法、设备及边缘节点
CN108768664B (zh) * 2018-06-06 2020-11-03 腾讯科技（深圳）有限公司 密钥管理方法、装置、系统、存储介质和计算机设备
CN109040318B (zh) * 2018-09-25 2021-05-04 网宿科技股份有限公司 Cdn网络的https连接方法及cdn节点服务器
CN109818946B (zh) * 2019-01-11 2022-07-26 网宿科技股份有限公司 Ca证书申请和部署的方法和系统
CN111224952B (zh) * 2019-12-24 2022-06-03 中移（杭州）信息技术有限公司 用于定向流量的网络资源获取方法、装置及存储介质
CN112564912B (zh) * 2020-11-24 2023-03-24 北京金山云网络技术有限公司 建立安全连接的方法、系统、装置和电子设备

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109417536A (zh) * 2016-04-15 2019-03-01 高通股份有限公司 用于管理内容递送网络中的安全内容传输的技术
CN106230782A (zh) * 2016-07-20 2016-12-14 腾讯科技（深圳）有限公司 一种基于内容分发网络的信息处理方法及装置
CN107493174A (zh) * 2017-09-05 2017-12-19 成都知道创宇信息技术有限公司 基于cdn网络的ssl证书智能绑定与管理方法
CN111404668A (zh) * 2019-01-02 2020-07-10 中国移动通信有限公司研究院 一种信息处理方法、设备及存储介质
CN113037888A (zh) * 2021-03-12 2021-06-25 北京金山云网络技术有限公司 加速域名的配置方法及装置、存储介质、电子设备

Also Published As

Publication number Publication date
CN115460083A (zh) 2022-12-09
CN115460083B (zh) 2024-04-19

Similar Documents

Publication Publication Date Title
US9276926B2 (en) Secure and automated credential information transfer mechanism
US8549157B2 (en) Transparent secure socket layer
US9917770B1 (en) Traffic on-boarding for acceleration through out-of-band security authenticators
US8799639B2 (en) Method and apparatus for converting authentication-tokens to facilitate interactions between applications
US7752443B2 (en) Method and system for a single-sign-on operation providing grid access and network access
US8296828B2 (en) Transforming claim based identities to credential based identities
US11303431B2 (en) Method and system for performing SSL handshake
EP3017582B1 (en) Method to enroll a certificate to a device using scep and respective management application
US10257171B2 (en) Server public key pinning by URL
US8261080B2 (en) System and method for managing digital certificates on a remote device
JP6572750B2 (ja) 認証制御プログラム、認証制御装置、及び認証制御方法
JP5992535B2 (ja) 無線ｉｄプロビジョニングを実行するための装置及び方法
US20170317836A1 (en) Service Processing Method and Apparatus
TWI416923B (zh) 網路服務中之安全資料通信
CN111786996B (zh) 一种跨域同步登录态的方法、装置及跨域同步登录系统
WO2008095382A1 (fr) Procédé, système et appareil pour établir une connexion de sécurité de couche de transport
US9894057B2 (en) Method and system for managing secure custom domains
WO2022257931A1 (zh) 安全加速服务部署方法、装置、介质及设备
CN102714653B (zh) 用于访问私人数字内容的系统和方法
US11683301B2 (en) Automatically obtaining a signed digital certificate from a trusted certificate authority
WO2023093772A1 (zh) 一种请求调度的方法、装置、电子设备及存储介质
WO2022257928A1 (zh) 安全加速服务部署方法、装置、介质及设备
CN114861144A (zh) 基于区块链的数据权限处理方法
US20200053059A1 (en) Secure Method to Replicate On-Premise Secrets in a Cloud Environment
WO2017024588A1 (zh) 业务处理方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22819526

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE