[go: up one dir, main page]

CN106230602B - The integrity detection system and method for the certificate chain of digital certificate - Google Patents

The integrity detection system and method for the certificate chain of digital certificate Download PDF

Info

Publication number
CN106230602B
CN106230602B CN201610817389.8A CN201610817389A CN106230602B CN 106230602 B CN106230602 B CN 106230602B CN 201610817389 A CN201610817389 A CN 201610817389A CN 106230602 B CN106230602 B CN 106230602B
Authority
CN
China
Prior art keywords
digital certificate
information
certificate
certification authentication
detection
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201610817389.8A
Other languages
Chinese (zh)
Other versions
CN106230602A (en
Inventor
吴善鹏
朱志博
张浩峥
雷兵
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shanghai Ctrip Business Co Ltd
Original Assignee
Shanghai Ctrip Business Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shanghai Ctrip Business Co Ltd filed Critical Shanghai Ctrip Business Co Ltd
Priority to CN201610817389.8A priority Critical patent/CN106230602B/en
Publication of CN106230602A publication Critical patent/CN106230602A/en
Application granted granted Critical
Publication of CN106230602B publication Critical patent/CN106230602B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3265Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate chains, trees or paths; Hierarchical trust model
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00Network arrangements, protocols or services for addressing or naming
    • H04L61/45Network directories; Name-to-address mapping
    • H04L61/4505Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
    • H04L61/4511Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using domain name system [DNS]
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/08Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823Network architectures or network communication protocols for network security for authentication of entities using certificates

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

The invention discloses a kind of integrity detection system of the certificate chain of digital certificate and method, integrity detection system includes: the first collection module, collects IP address to be detected and corresponding domain name;Second collection module collects digital certificate information and certification authentication information to each IP address to be detected and corresponding domain name;Parsing module parses digital certificate information to obtain the remarks list of file names of digital certificate;Judgment module judges whether recorded domain name in remarks list of file names, if so, detection module is called, if it is not, then returning to error message;Detection module, which detects, whether there is the incomplete information of certificate chain in the certification authentication information, if so, returning to error message, if it is not, then confirming that the certificate chain of digital certificate is complete, return to detection successful information.The present invention realizes the certificate chain for automatically detecting digital certificate, improves the efficiency and accuracy rate of the integrity detection of certificate chain, improves and services online efficiency.

Description

The integrity detection system and method for the certificate chain of digital certificate
Technical field
The present invention relates to technical field of network security, more particularly to a kind of integrity detection of the certificate chain of digital certificate System and method.
Background technique
With the continuous development of Internet technology, digital certificate is more and more applied to enterprise web site.Digital certificate Be widely used, to eavesdropping and man-in-the-middle attack provide effective protection, enhance the safety of network communication.Digital certificate While promoting safety, some problems are also brought, need to complete verifying work in certificate deployment.Wherein certificate chain is complete Whole property detection has to do, if certificate chain is imperfect, website will appear certificate error when accessed, or even can not The case where access.It is whether complete in order to detect certificate chain, it is common practice to verify book chain manually after certificate is installed and be examined It surveys.Manually certificate chain verifying can not quickly find certificate deployment problem, reduce and service online speed, if there is people For carelessness, and detect that certificate chain is imperfect, cause to service unavailable after service publication, and then influence the available of website Property, or even will cause traffic lost.
Summary of the invention
The technical problem to be solved by the present invention is to detect manually to certificate chain in the prior art to overcome, lead to nothing Method quickly finds the defect that certificate deployment problem and testing result may be inaccurate, provides a kind of certificate chain of digital certificate Integrity detection system and method.
The present invention is to solve above-mentioned technical problem by following technical proposals:
The present invention provides a kind of integrity detection systems of the certificate chain of digital certificate, it is characterized in that, comprising:
First collection module, for collecting (agreement interconnected between the network) address IP to be detected and corresponding domain name;
Second collection module, for collecting digital certificate information and card to each IP address to be detected and corresponding domain name Book verification information;
Parsing module obtains the remarks list of file names of digital certificate for being parsed to digital certificate information;
Judgment module, for judging whether recorded domain name in remarks list of file names, if so, calling a detection mould Block, if it is not, then returning to error message;
The detection module whether there is the incomplete information of certificate chain for detecting in the certification authentication information, if It is then to return to error message, if it is not, then confirming that the certificate chain of digital certificate is complete, returns to detection successful information.
Preferably, the integrity detection system further include:
Demand database is detected, for storing multiple detection demand datas, each detection demand data includes an institute State the IP address to be detected and corresponding domain name of the collection of the first collection module.
Preferably, the integrity detection system further include:
Digital certificate files database, for storing multiple digital certificate files, each digital certificate files include one The digital certificate information that a second collection module is collected;
The parsing module is also used to parse the digital certificate files to obtain the remarks list of file names.
Preferably, the integrity detection system further include:
Certification authentication document data bank, for storing multiple certification authentication files, each certification authentication file includes one The certification authentication information that a second collection module is collected;
The detection module is also used to read the certification authentication file to obtain certification authentication information.
Preferably, the integrity detection system further include:
Detected rule database is used for the imperfect detected rule of Store Credentials chain;
The detection module is used to carry out rule to the certification authentication information and the imperfect detected rule of the certificate chain Matching, to detect in the certification authentication information with the presence or absence of the incomplete information of certificate chain.
It is an object of the invention to additionally provide a kind of integrality detection method of the certificate chain of digital certificate, feature exists In, comprising the following steps:
S1, collect IP address to be detected and corresponding domain name;
S2, digital certificate information and certification authentication information are collected to each IP address to be detected and corresponding domain name;
S3, digital certificate information is parsed to obtain the remarks list of file names of digital certificate;
S4, judge whether recorded domain name in remarks list of file names, if so, thening follow the steps S5, if it is not, then returning to mistake False information;
S5, whether there is the incomplete information of certificate chain in the detection certification authentication information, if so, returning to mistake letter Breath returns to detection successful information if it is not, then confirming that the certificate chain of digital certificate is complete.
Preferably, step S1And S2Between further include:
S11, the multiple detection demand datas of storage, each detection demand data includes an IP address to be detected and right The domain name answered.
Preferably, step S2And S3Between further include:
S21, the multiple digital certificate files of storage, each digital certificate files include a digital certificate information;
Step S3In the digital certificate files are parsed to obtain the remarks list of file names.
Preferably, step S21In further include: multiple certification authentication files are stored, each certification authentication file includes one Certification authentication information;
Step S5In further include: the certification authentication file is read to obtain certification authentication information.
Preferably, step S1Before further include:
S01, the imperfect detected rule of Store Credentials chain;
Step S5In further include: rule is carried out to the certification authentication information and the imperfect detected rule of the certificate chain Match, to detect in the certification authentication information with the presence or absence of the incomplete information of certificate chain.
The positive effect of the present invention is that: the present invention realizes the certificate chain for automatically detecting digital certificate, mentions The high efficiency and accuracy rate of the integrity detection of certificate chain, saves manual operation, reduces the workload of safety engineer, The correctness that ensure that the digital certificate of service binding improves and services online efficiency, reduces because of digital certificate problem A possibility that leading to service fault, enhances the availability of website.
Detailed description of the invention
Fig. 1 is the module signal of the integrity detection system of the certificate chain of the digital certificate of presently preferred embodiments of the present invention Figure.
Fig. 2 is the flow chart of the integrality detection method of the certificate chain of the digital certificate of presently preferred embodiments of the present invention.
Specific embodiment
The present invention is further illustrated below by the mode of embodiment, but does not therefore limit the present invention to the reality It applies among a range.
As shown in Figure 1, the integrity detection system of the certificate chain of digital certificate of the invention include the first collection module 1, Second collection module 2, parsing module 3, judgment module 4, detection module 5, detection demand database 6, digital certificate files data Library 7, certification authentication document data bank 8 and detected rule database 9;
Wherein, the detected rule database 9 can be pre-stored the imperfect detected rule of certificate chain, and specific detected rule can It is formulated by security expert;
First collection module 1 is used to collect the IP address of (integrity detection for needing to carry out certificate chain) to be detected With corresponding domain name, the detection demand database 6 is then for storing multiple detection demand datas, wherein each detection demand number According to the IP address to be detected and corresponding domain name for including a collection of the first collection module 1;
Second collection module 2 then to each IP address to be detected and corresponding domain name collect digital certificate information and OpenSSL (Open Secure Sockets Layer, Open Security socket layer association specifically can be used in certification authentication information View) tool is collected, and the digital certificate files database 7 can then store multiple digital certificate files, wherein every number Word certificate file includes the digital certificate information that second collection module 2 is collected;And the certification authentication number of files The multiple certification authentication files of storage can be corresponded to according to library 8, each certification authentication file includes that second collection module 2 is received The certification authentication information of collection;Specifically, the digital certificate files and the certificate stored in the digital certificate files database 7 Both the certification authentication files stored in verifying document data bank 8 have corresponding relationship;
The parsing module 3 can parse the digital certificate information in the digital certificate files, to obtain number The remarks list of file names (Alternative_list) of certificate, can specifically be parsed, the judgment module by OpenSSL tool 4 judge whether recorded domain name in the remarks list of file names, if so, the detection module 5 is called, if it is not, then returning Return error message, specific error message can characterize: digital certificate binds mistake, and domain name is not ranked in the certificate remarks of current bindings In table, and specific error message can be returned in result information database and be saved;
The detection module 5 can read the certification authentication file stored in the certification authentication document data bank 8 to obtain Certification authentication information, and detect with the presence or absence of the incomplete information of certificate chain in the certification authentication information, it specifically can be to institute It states certification authentication information and the imperfect detected rule of the certificate chain carries out rule match, to detect in the certification authentication information With the presence or absence of the incomplete information of certificate chain, if so, returning to error message, specific error message can characterize: certificate chain is endless It is whole, and specific error message can be returned in result information database and be saved;If it is not, then confirming digital certificate Certificate chain is complete, returns to detection successful information, specific to detect successful information section characterization: certificate chain is complete;And it can will be specific Detection successful information, which returns in result information database, to be saved.
Above-mentioned detection process can be detected as unit of each detection demand data, if detection demand data All detection demands in library have been detected, then can returning to final testing result, (specific testing result is all in result It is saved in information database).
The present invention also provides a kind of integrality detection methods of the certificate chain of digital certificate, utilize above-mentioned number card The integrity detection system of the certificate chain of book realizes, as shown in Fig. 2, the integrality detection method the following steps are included:
Step 100, the imperfect detected rule of Store Credentials chain;
Step 101 collects IP address to be detected and corresponding domain name;
Step 102, the multiple detection demand datas of storage, each detection demand data includes an IP address to be detected With corresponding domain name;
Step 103 collects digital certificate information and certification authentication letter to each IP address to be detected and corresponding domain name Breath;
Step 104, the multiple digital certificate files of storage, each digital certificate files include a digital certificate information; Multiple certification authentication files are stored, each certification authentication file includes a certification authentication information;
Step 105 parses digital certificate files to obtain the remarks list of file names;
Step 106 judges whether recorded domain name in remarks list of file names, if so, 107 are thened follow the steps, if it is not, then Return to error message;
Step 107 reads certification authentication file to obtain certification authentication information, detect in the certification authentication information whether There are the incomplete information of certificate chain, return if so, returning to error message if it is not, then confirming that the certificate chain of digital certificate is complete Return detection successful information.
Wherein, in step 107 specifically can to the certification authentication information and the imperfect detected rule of the certificate chain into Line discipline matching, to detect in the certification authentication information with the presence or absence of the incomplete information of certificate chain.
The present invention improves the efficiency of the integrity detection of the certificate chain of digital certificate, accelerates and services online speed, While detecting the integrality of certificate chain, whether also detection domain name matches with certificate remark names, avoids certificate binding mistake The case where;The imperfect detected rule of certificate chain of the invention increases the accuracy of certificate chain integrity detection;The present invention realizes It automatically detects, reduces the workload of relevant staff;The present invention is detected by the integrality to certificate chain, Certificate chain imperfect a possibility that leading to service fault is reduced, the availability of website is enhanced.
Although specific embodiments of the present invention have been described above, it will be appreciated by those of skill in the art that these It is merely illustrative of, protection scope of the present invention is defined by the appended claims.Those skilled in the art is not carrying on the back Under the premise of from the principle and substance of the present invention, many changes and modifications may be made, but these are changed Protection scope of the present invention is each fallen with modification.

Claims (10)

1. a kind of integrity detection system of the certificate chain of digital certificate characterized by comprising
First collection module, for collecting IP address to be detected and corresponding domain name;
Second collection module, for testing each IP address to be detected and corresponding domain name collection digital certificate information and certificate Demonstrate,prove information;
Parsing module obtains the remarks list of file names of digital certificate for being parsed to digital certificate information;
Judgment module, for judging whether recorded domain name in remarks list of file names, if so, a detection module is called, if It is no, then return to error message;
The detection module whether there is the incomplete information of certificate chain for detecting in the certification authentication information, if so, Error message is returned, if it is not, then confirming that the certificate chain of digital certificate is complete, returns to detection successful information.
2. integrity detection system as described in claim 1, which is characterized in that the integrity detection system further include:
Demand database is detected, for storing multiple detection demand datas, each detection demand data includes one described the The IP address to be detected and corresponding domain name that one collection module is collected.
3. integrity detection system as described in claim 1, which is characterized in that the integrity detection system further include:
Digital certificate files database, for storing multiple digital certificate files, each digital certificate files include an institute State the digital certificate information of the second collection module collection;
The parsing module is also used to parse the digital certificate files to obtain the remarks list of file names.
4. integrity detection system as claimed in claim 3, which is characterized in that the integrity detection system further include:
Certification authentication document data bank, for storing multiple certification authentication files, each certification authentication file includes an institute State the certification authentication information of the second collection module collection;
The detection module is also used to read the certification authentication file to obtain certification authentication information.
5. the integrity detection system as described in any one of claim 1-4, which is characterized in that the integrity detection system System further include:
Detected rule database is used for the imperfect detected rule of Store Credentials chain;
The detection module is used to carry out rule match to the certification authentication information and the imperfect detected rule of the certificate chain, To detect in the certification authentication information with the presence or absence of the incomplete information of certificate chain.
6. a kind of integrality detection method of the certificate chain of digital certificate, which comprises the following steps:
S1, collect IP address to be detected and corresponding domain name;
S2, digital certificate information and certification authentication information are collected to each IP address to be detected and corresponding domain name;
S3, digital certificate information is parsed to obtain the remarks list of file names of digital certificate;
S4, judge whether recorded domain name in remarks list of file names, if so, thening follow the steps S5, if it is not, then returning to wrong letter Breath;
S5, whether there is the incomplete information of certificate chain in the detection certification authentication information, if so, return to error message, if It is no, then confirm that the certificate chain of digital certificate is complete, returns to detection successful information.
7. integrality detection method as claimed in claim 6, which is characterized in that step S1And S2Between further include:
S11, the multiple detection demand datas of storage, each detection demand data includes an IP address to be detected and corresponding Domain name.
8. integrality detection method as claimed in claim 6, which is characterized in that step S2And S3Between further include:
S21, the multiple digital certificate files of storage, each digital certificate files include a digital certificate information;
Step S3In the digital certificate files are parsed to obtain the remarks list of file names.
9. integrality detection method as claimed in claim 8, which is characterized in that step S21In further include: store multiple certificates File is verified, each certification authentication file includes a certification authentication information;
Step S5In further include: the certification authentication file is read to obtain certification authentication information.
10. the integrality detection method as described in any one of claim 6-9, which is characterized in that step S1It also wraps before It includes:
S01, the imperfect detected rule of Store Credentials chain;
Step S5In further include: rule match is carried out to the certification authentication information and the imperfect detected rule of the certificate chain, with It detects in the certification authentication information with the presence or absence of the incomplete information of certificate chain.
CN201610817389.8A 2016-09-09 2016-09-09 The integrity detection system and method for the certificate chain of digital certificate Active CN106230602B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201610817389.8A CN106230602B (en) 2016-09-09 2016-09-09 The integrity detection system and method for the certificate chain of digital certificate

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201610817389.8A CN106230602B (en) 2016-09-09 2016-09-09 The integrity detection system and method for the certificate chain of digital certificate

Publications (2)

Publication Number Publication Date
CN106230602A CN106230602A (en) 2016-12-14
CN106230602B true CN106230602B (en) 2019-05-17

Family

ID=58074990

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201610817389.8A Active CN106230602B (en) 2016-09-09 2016-09-09 The integrity detection system and method for the certificate chain of digital certificate

Country Status (1)

Country Link
CN (1) CN106230602B (en)

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108989046B (en) * 2018-07-18 2021-05-04 成都知道创宇信息技术有限公司 Automatic completion method for SSL certificate chain
CN109413196A (en) * 2018-11-13 2019-03-01 四川长虹电器股份有限公司 A kind of method of intelligent Matching HTTPS access certificate
CN109451094B (en) * 2018-12-20 2022-02-22 奇安信科技集团股份有限公司 A method, system, electronic device and medium for obtaining IP address of source station
CN110766409A (en) * 2019-10-24 2020-02-07 深圳前海微众银行股份有限公司 SSL certificate verification method, device, equipment and computer storage medium
CN111314085B (en) * 2020-01-22 2023-05-23 维沃移动通信有限公司 Digital certificate verification method and device
CN112491859B (en) * 2020-11-20 2023-06-20 上海连尚网络科技有限公司 Domain name certificate detection method, device, electronic device and computer-readable medium

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101236677A (en) * 2008-02-15 2008-08-06 黄欣阳 Commodity anti-counterfeiting and anti-counterfeiting tax control comprehensive system
CN102571770A (en) * 2011-12-27 2012-07-11 北京神州绿盟信息安全科技股份有限公司 Man-in-the-middle attack detection method, device, server and system
CN103152182A (en) * 2013-03-08 2013-06-12 新疆君盾信息技术有限公司 Method for authenticating and validating electronic data
CN103220303A (en) * 2013-05-06 2013-07-24 华为软件技术有限公司 Server login method, server and authentication equipment

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7860755B2 (en) * 2008-02-19 2010-12-28 The Go Daddy Group, Inc. Rating e-commerce transactions

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101236677A (en) * 2008-02-15 2008-08-06 黄欣阳 Commodity anti-counterfeiting and anti-counterfeiting tax control comprehensive system
CN102571770A (en) * 2011-12-27 2012-07-11 北京神州绿盟信息安全科技股份有限公司 Man-in-the-middle attack detection method, device, server and system
CN103152182A (en) * 2013-03-08 2013-06-12 新疆君盾信息技术有限公司 Method for authenticating and validating electronic data
CN103220303A (en) * 2013-05-06 2013-07-24 华为软件技术有限公司 Server login method, server and authentication equipment

Also Published As

Publication number Publication date
CN106230602A (en) 2016-12-14

Similar Documents

Publication Publication Date Title
CN106230602B (en) The integrity detection system and method for the certificate chain of digital certificate
CN105701876B (en) Apparatus and method for processing multiple recording strategies
KR101684016B1 (en) Apparatus for processing a plurality of logging policy and method thereof
CN110088744A (en) A database maintenance method and system thereof
CN107579874B (en) Method and device for detecting data collection missing report of flow collection equipment
CN106789911A (en) A kind of network identity validation method and system based on block chain
CN108965294A (en) A kind of user name and cipher protection system
CN103138988A (en) Positioning treatment method and positioning treatment device of network faults
CN111445209A (en) Block chain-based electronic contract signing method and device and storage medium
CN104936157A (en) Mobile phone number bound account acquisition method and system
CN109144801A (en) It is a kind of to be directed to the test method of MOC card, device and equipment in server
CN108040090A (en) A kind of system combination method of more Web
CN104348815B (en) Method and device for verifying verification code
CN107769957A (en) A kind of domain name system failure cause analysis method and device
CN111914147A (en) Suspected actual control person credit investigation method and system for enterprise
CN104809238B (en) Data processing method and device for data collecting system
CN106933888A (en) Database configuration management system
CN115460171A (en) Data processing method and device, electronic equipment and storage medium
CN114389981A (en) A detection method, device and storage medium for edge server 5G module
CN106411657A (en) System for version completeness detection of network phone
CN110943759A (en) A Data Checking Method for Power Communication Links Based on Depth First Search Algorithm
CN115795475A (en) Method and device for determining software system risk and electronic equipment
CN107391551B (en) Web service data analysis method and system based on data mining
CN116991724A (en) Interface testing method and device based on monitoring log, electronic equipment and storage medium
CN108416569A (en) A kind of verification method and system of surveying and mapping result

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant