Security certificate acquisition method, system, computer equipment and storage medium

Abstract

The present application relates to a method, system, computer equipment and storage medium for obtaining a security certificate, the method comprising: the device supply terminal applies for and downloads a first certificate with a preset validity period from a remote service provider platform through a web page, and pre-buries the first certificate in a networked product; the device application end verifies the first certificate in the networked product according to a preset verification rule, and if the verification passes, applies for a second certificate from the remote service provider platform according to the first certificate; the first certificate is replaced by the second certificate, and the exchanged second certificate is pre-buried in the networked product at the device application end. This method can solve the problem of pre-buried transmission of formal certificates, and the formally used security certificates are always controlled in the internal network of the device application end during their life cycle, avoiding scenarios of manual intervention, thereby fundamentally solving the problem of certificate leakage due to human negligence during the transmission of security certificates, and improving the security of certificate transmission.

Description

Technical Field

[0001] The present application relates to the technical field of secure data transmission, and in particular to a method, system, computer device and storage medium for obtaining a security certificate. Background Art

[0002] At present, smart car network products need to be pre-embedded with security certificates to establish secure communication and legal authentication between the car and the cloud. The traditional solution is that the car company sends the security certificate to the network product supplier via network email or USB storage, and the supplier embeds it during development. This link has security risks, that is, the security certificate is transmitted through network email or USB flash drive, and there is a manual participation scenario. At the same time, the certificate is leaked outside the car company's internal network, which may cause serious security risks if it is used by hackers.

[0003] Therefore, there is an urgent need to propose a method, system, computer device and storage medium for obtaining a secure certificate that reduces the risk of certificate leakage and the resulting security risks. Summary of the invention

[0004] Based on this, it is necessary to provide a method, system, computer device and storage medium for obtaining a secure certificate that can reduce the risk of certificate leakage in response to the above technical problems.

[0005] In one aspect, a method for obtaining a security certificate is provided, the method comprising:

[0006] Step A: The equipment supply terminal applies for and downloads a first certificate with a preset validity period from the remote service provision platform through a web page, and pre-embeds the first certificate in the network-connected product;

[0007] Step B: the device application verifies the first certificate in the network-connected product according to a preset verification rule, and if the verification passes, applies for a second certificate from the remote service provider platform according to the first certificate;

[0008] Step C: Use the second certificate to replace the first certificate, and pre-embed the exchanged second certificate in the networked product component of the device application end.

[0009] In one of the embodiments, the method further includes: generating a third certificate applied to the remote service providing platform based on the public key infrastructure, and the third certificate is a security certificate.

[0010] In one of the embodiments, it also includes: the device supply terminal applies for and downloads a first certificate with a preset validity period from a remote service provider platform through a web page, including: the device supply terminal uses a source code base library to randomly generate a first public-private key pair, and generates a first p10 file through the public key in the first public-private key pair, the batch number of the PDID and the number of PDIDs in this batch, wherein the PDID is a traceability code for the networked device; submits an application request for the first p10 file and the first certificate to the remote service provider platform; the remote service provider platform submits the first p10 file to the public key infrastructure based on the application request; the public key infrastructure generates the first certificate with a preset validity period based on the first p10 file, and transmits it to the web page; the device supply terminal downloads the first certificate with a preset validity period through the web page.

[0011] In one of the embodiments, it also includes: the first certificate is a temporary certificate, the temporary certificate includes a certificate purpose mark, and the certificate purpose mark is: it can only be used to apply for a formal certificate and cannot be used for business operations; the preset validity period of the temporary certificate is three months.

[0012] In one of the embodiments, it also includes: the device application end verifies the first certificate in the networked product according to a preset verification rule, including: writing a public key infrastructure root certificate, PDID, the first certificate and the private key of the first certificate on the device application end; using the public key infrastructure root certificate to verify the legitimacy of the first certificate: using the RSA signature algorithm and the public key of the public key infrastructure root certificate to verify the private key signature of the first certificate.

[0013] In one of the embodiments, it also includes: applying for a second certificate from the remote service provider platform based on the first certificate includes: when the first certificate is legal, generating a second public-private key pair and a second p10 file based on the software development kit in the public key infrastructure system and the PDID; performing HTTP two-way authentication communication based on the international standard secure transmission protocol for the first certificate and the third certificate of the remote service provider platform; after the authentication is passed, submitting the second p10 file and the PDID to the remote service provider platform to trigger an application request for the second certificate; the remote service provider platform verifies the legality and purpose of the first certificate, the legality of the PDID, whether the batch number of the first certificate is accurate, and whether there is a surplus of the first certificates; when the legality and purpose of the first certificate and the legality of the PDID meet the standards, and the batch number of the first certificate is accurate and there is a surplus of the first certificates, submitting the third p10 file generated internally by the device application end to the public key infrastructure, and using the public key infrastructure to generate the second certificate.

[0014] In one of the embodiments, it also includes: replacing the first certificate with the second certificate, and pre-embedding the exchanged second certificate in the networked product part of the device application end, including: after accumulating the number of the second certificates generated by the public key infrastructure, transmitting the second certificate to the device application end; the device application end writes the second certificate to replace the first certificate; the second certificate and the third certificate perform message queue telemetry transmission two-way authentication communication, and after the authentication is passed, pre-embedding the second certificate in the networked product part of the device application end to facilitate subsequent business processes.

[0015] In another aspect, a security certificate acquisition system is provided, the system comprising:

[0016] A first certificate application and download module, which is used by the device provision terminal to apply for and download a first certificate with a preset validity period from the remote service provision platform through a web page, and to pre-embed the first certificate in the network connection product;

[0017] A second certificate generation module is used for the device application end to verify the first certificate in the network-connected product according to a preset verification rule, and if the verification is successful, apply for a second certificate from the remote service providing platform according to the first certificate;

[0018] The certificate replacement and pre-embedding module is used to replace the first certificate with the second certificate, and pre-embed the exchanged second certificate in the networked product part of the device application end.

[0019] In another aspect, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the following steps are implemented:

[0020] Step A: The equipment supply terminal applies for and downloads a first certificate with a preset validity period from the remote service provision platform through a web page, and pre-embeds the first certificate in the network-connected product;

[0021] Step B: the device application verifies the first certificate in the network-connected product according to a preset verification rule, and if the verification passes, applies for a second certificate from the remote service provider platform according to the first certificate;

[0022] Step C: Use the second certificate to replace the first certificate, and pre-embed the exchanged second certificate in the networked product component of the device application end.

[0023] In another aspect, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0024] Step A: The equipment supply terminal applies for and downloads a first certificate with a preset validity period from the remote service provision platform through a web page, and pre-embeds the first certificate in the network-connected product;

[0025] Step B: the device application verifies the first certificate in the network-connected product according to a preset verification rule, and if the verification passes, applies for a second certificate from the remote service provider platform according to the first certificate;

[0026] Step C: Use the second certificate to replace the first certificate, and pre-embed the exchanged second certificate in the networked product component of the device application end.

[0027] The beneficial effects achieved by the present application are: the above-mentioned security certificate acquisition method, system, computer device and storage medium, the method includes: the device supply terminal applies for and downloads a first certificate with a preset validity period from the remote service provider platform through a web page, and pre-buries the first certificate in the networked product part; the device application end verifies the first certificate in the networked product part according to a preset verification rule, and if the verification passes, applies for a second certificate from the remote service provider platform according to the first certificate; replaces the first certificate with the second certificate, and pre-buries the exchanged second certificate in the networked product part of the device application end. This application Please actively apply for a temporary certificate from the device application end through the device supply terminal, and pre-embed the temporary certificate in the networked product. Then, on the production line of the device application end, trigger the temporary certificate of the networked product through the production line electrical inspection to exchange for the formal certificate, so as to solve the problem of pre-embedded transmission of the formal certificate. The formally used security certificate is always controlled in the internal network of the device application end during its life cycle, and there is no transmission problem. Once the temporary certificate is found to be leaked, the application for the formal certificate can be prohibited through management and control measures, avoiding the scenario of manual intervention, thereby fundamentally solving the problem of certificate leakage due to human negligence during the transmission process of the security certificate, and improving the security of the certificate. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 A diagram of an application environment of a method for obtaining a security certificate in an embodiment;

[0029] Figure 2 A schematic diagram of a process for obtaining a security certificate in an embodiment;

[0030] Figure 3 Another schematic diagram of a process for obtaining a security certificate in an embodiment;

[0031] Figure 4 A structural block diagram of a security certificate acquisition system in an embodiment;

[0032] Figure 5 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0034] The security certificate acquisition method provided in this application can be applied to Figure 1 In the application environment shown, the terminal 102 communicates with the server 104 through the network, and the device supply terminal and the device application terminal communicate with the remote service provision platform set on the server 104 through the network. The terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers and portable wearable devices, and the server 104 can be implemented by an independent server or a server cluster composed of multiple servers.

[0035] In one embodiment, Figure 2 As shown, a security certificate method is provided, which is applied to Figure 1 The terminal in is used as an example to illustrate, including the following steps:

[0036] S1: The equipment supply terminal applies for and downloads a first certificate with a preset validity period from the remote service provision platform through a web page, and pre-embeds the first certificate in the networked product.

[0037] It should be noted that before executing this step, a third certificate applied to the telematics service provider platform (TSP) needs to be pre-generated based on the public key infrastructure (PKI) and sent to the telematics service provider platform offline, wherein the third certificate is a security certificate, that is, a formal certificate applied to the telematics service provider platform, and the third certificate is used for subsequent two-way authentication with the equipment supply terminal to improve the security of the certificate transmission process.

[0038] Further, exemplarily, the equipment supply terminal may be a TBOX (Telematics-BOX, vehicle-mounted communication terminal) supplier, which is equivalent to a supplier of equipment parts, and the equipment application end described below may be a car company's production line, which is equivalent to a production line for assembling the equipment parts. In addition, the remote service provision platform is a cloud platform for business verification.

[0039] Furthermore, the device provision terminal applies for and downloads a first certificate with a preset validity period from the remote service provision platform through a web page, including:

[0040] The device supply terminal randomly generates a first public-private key pair using a source code base library (Open SSL base library), and generates a first p10 file using the public key in the first public-private key pair, the batch number of the PDID, and the number of PDIDs in this batch. The PDID is the traceability code of the networked device, wherein the private key is not public, and the private key is used for subsequent two-way authentication communication. P10 refers to the PKCS#10 specification, wherein the p10 file is composed of a public key and a custom subject, and the key subject of this application is generated by combining the PDID of the TBOX, the batch number of the certificate, and the batch number of the certificate;

[0041] Submitting an application request for the first p10 file and the first certificate to the remote service providing platform;

[0042] The remote service providing platform submits the first p10 file to the public key infrastructure based on the application request, wherein the PDID has a maintenance entrance in the remote service providing platform, and has settings for the certificate application batch number and batch quantity of the equipment supply terminal. The setting rule is set according to the equipment supply terminal capacity ratio, and the recommended value is no more than 1000 per batch, and the duration is no more than 3 months from the time of application. The first certificate is applied from the PKI system in batches, and the first certificates of the same batch are the same. Only the first certificates of the same batch can be exchanged for the corresponding formal certificate. The formal certificate, that is, the second certificate, is unique. If the first certificate is leaked, the first certificate number of the batch can be cancelled, and the impact range is controllable;

[0043] The public key infrastructure generates the first certificate with a preset validity period according to the first p10 file, and transmits the first certificate to the web page;

[0044] The equipment provisioning terminal downloads the first certificate with a preset validity period through the web page.

[0045] Among them, the first certificate is a temporary certificate, and the temporary certificate includes a certificate purpose mark, and the certificate purpose mark is: it can only be used to apply for a formal certificate and cannot be used for business operations; the preset validity period of the temporary certificate is three months.

[0046] The first certificate is pre-embedded in a networked product, wherein the networked product refers to various forms of components that can access the Internet provided by a device supply terminal. Exemplarily, the device may be a TBOX.

[0047] The equipment supply terminal applies for a temporary certificate through a web page and pre-embeds the temporary certificate on the supplier side, avoiding manual intervention scenarios.

[0048] S2: The device application verifies the first certificate in the network-connected product according to a preset verification rule, and if the verification passes, applies for a second certificate from the remote service provider platform according to the first certificate;

[0049] It should be noted that the device application verifies the first certificate in the networked product according to a preset verification rule, including:

[0050] Writing a public key infrastructure root certificate (PKI root certificate), the PDID, the first certificate, and a private key of the first certificate into the device application end;

[0051] Verify the legitimacy of the first certificate using the public key infrastructure root certificate:

[0052] The private key signature of the first certificate is verified using an RSA signature algorithm and the public key of the public key infrastructure root certificate.

[0053] Specifically, the RSA signature algorithm is an asymmetric encryption, which can complete decryption without directly transferring the key, ensuring the security of information and avoiding the risk of being cracked by directly transferring the key. It is a process of encryption and decryption using a pair of keys, which are called public key and private key respectively. If encryption is performed with a public key, it can only be decrypted by the corresponding private key. If encryption is performed with a private key, it can only be decrypted by the corresponding public key. The digital signature process is briefly described as follows: the sender processes (hash) the content msg1 through an irreversible algorithm to obtain the result value hash1, and then encrypts hash1 with the private key to obtain the result encry1. The other party receives encry1 and msg1, decrypts encry1 with the public key to obtain hash1, and then performs the same irreversible processing on msg1 to obtain hash2. The sender can be authenticated by comparing hash1 and hash2.

[0054] Further, applying for a second certificate from the remote service providing platform according to the first certificate includes:

[0055] When the first certificate is legitimate, a second public-private key pair and a second p10 file are generated based on the software development kit in the public key infrastructure system and the PDID, that is, the second public-private key pair and the second p10 file are generated by integrating PKI-SDK (Software Development Kit), wherein the SDK package is a C language library, which can be packaged into the TBOX software when it is compiled, and is provided by the PKI system. The content is a series of underlying encryption, decryption and signature verification functions, including the generation of public-private key pairs;

[0056] Perform HTTP two-way authentication communication based on the international standard secure transmission protocol for the first certificate and the third certificate of the remote service provider platform, exemplarily, the car enterprise cloud platform authenticates TBOX, and TBOX authenticates the car enterprise cloud platform;

[0057] After the authentication is passed, submitting the second p10 file and the PDID to the remote service providing platform to trigger the application request for the second certificate;

[0058] The remote service provider platform verifies the legitimacy and purpose of the first certificate, the legitimacy of the PDID, whether the batch number of the first certificate is accurate, and whether there is a surplus of the first certificate, wherein the third certificate and the first certificate are both signed by the root private key of the PKI system, so the legitimacy is guaranteed; the first certificate can only be used to apply for a formal certificate, and if it is used for business certificate communication, the cloud platform will report an error and cannot continue; the batch number and quantity of the certificate applied for by the device provisioning terminal through the web page (WEB) are applied for through the cloud platform and then to the PKI system, so they can be verified on the cloud platform;

[0059] When the legitimacy and purpose of the first certificate and the legitimacy of the PDID meet the standards, the batch number of the first certificate is accurate, and there is a surplus of the first certificates, the third p10 file generated internally by the device application end is submitted to the public key infrastructure, and the second certificate is generated using the public key infrastructure.

[0060] Specifically, the second p10 file is generated outside the production line, that is, through PKI-SDK, and the third p10 file is generated inside the production line. Therefore, the official certificate is always controlled in the internal network of the automobile enterprise and is not embedded or transmitted through manual participation, avoiding the risk of leakage.

[0061] S3: Replace the first certificate with the second certificate, and pre-embed the exchanged second certificate in the networked product component at the device application end.

[0062] Specifically, after accumulating the number of the second certificates generated by the public key infrastructure, the second certificate is transmitted to the device application end;

[0063] The device application end writes the second certificate to replace the first certificate;

[0064] The second certificate and the third certificate are used for message queue telemetry transmission two-way authentication communication. After the authentication is passed, the second certificate is pre-embedded in the networked product part of the device application end to facilitate subsequent business processes.

[0065] In the above-mentioned security certificate acquisition method, the device supply terminal applies for and downloads a first certificate with a preset validity period from the remote service provision platform through a web page, and pre-buries the first certificate in the networked product part; the device application end verifies the first certificate in the networked product part according to a preset verification rule, and if the verification is successful, applies for a second certificate from the remote service provision platform according to the first certificate; the first certificate is replaced by the second certificate, and the exchanged second certificate is pre-buried in the networked product part of the device application end, and the temporary certificate is pre-buried in the networked product part by the method that the device supply terminal actively applies for a temporary certificate from the device application end, and then on the production line of the device application end, the temporary certificate of the networked product part is triggered by the production line electrical inspection to exchange for the formal certificate, thereby solving the problem of pre-buried transmission of the formal certificate. The formally used security certificate is always controlled in the internal network of the device application end during its life cycle, and there is no transmission problem. Once the temporary certificate is found to be leaked, the application for the formal certificate can be prohibited through management and control measures, avoiding the scenario of manual intervention, thereby fundamentally solving the problem of certificate leakage due to human negligence during the transmission process of the security certificate, and improving the security of the certificate.

[0066] It should be understood that although Figure 2-3 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 2-3 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0067] Embodiment 2

[0068] In one embodiment, Figure 4 As shown, a security certificate acquisition system is provided, including: a first certificate application and download module, a second certificate generation module and a certificate replacement and pre-embedded module, wherein:

[0069] A first certificate application and download module, which is used by the device provision terminal to apply for and download a first certificate with a preset validity period from the remote service provision platform through a web page, and to pre-embed the first certificate in the network connection product;

[0070] A second certificate generation module is used for the device application end to verify the first certificate in the network-connected product according to a preset verification rule, and if the verification is successful, apply for a second certificate from the remote service providing platform according to the first certificate;

[0071] The certificate replacement and pre-embedding module is used to replace the first certificate with the second certificate, and pre-embed the exchanged second certificate in the networked product part of the device application end.

[0072] The system further comprises:

[0073] The third certificate generation module is used to generate a third certificate applied to the remote service providing platform based on the public key infrastructure, and the third certificate is a security certificate.

[0074] As a preferred implementation, in an embodiment of the present invention, the first certificate application and download module is specifically used for:

[0075] The device supply terminal randomly generates a first public-private key pair using the source code base library, and generates a first p10 file using the public key in the first public-private key pair, the batch number of the PDID, and the number of PDIDs in this batch, wherein the PDID is a traceability code for the networked device;

[0076] Submitting an application request for the first p10 file and the first certificate to the remote service providing platform;

[0077] The remote service providing platform submits the first p10 file to the public key infrastructure based on the application request;

[0078] The public key infrastructure generates the first certificate with a preset validity period according to the first p10 file, and transmits the first certificate to the web page;

[0079] The equipment provision terminal downloads the first certificate with a preset validity period through the web page;

[0080] Among them, the first certificate is a temporary certificate, and the temporary certificate includes a certificate purpose mark, and the certificate purpose mark is: it can only be used to apply for a formal certificate and cannot be used for business operations; the preset validity period of the temporary certificate is three months.

[0081] As a preferred implementation, in the embodiment of the present invention, the second certificate generation module is specifically used for:

[0082] Writing the public key infrastructure root certificate, the PDID, the first certificate, and the private key of the first certificate into the device application end;

[0083] Verify the legitimacy of the first certificate using the public key infrastructure root certificate:

[0084] The private key signature of the first certificate is verified using an RSA signature algorithm and the public key of the public key infrastructure root certificate.

[0085] When the first certificate is legitimate, generating a second public-private key pair and a second p10 file based on a software development kit in a public key infrastructure system and the PDID;

[0086] Performing HTTP bidirectional authentication communication based on the international standard secure transmission protocol on the first certificate and the third certificate of the remote service providing platform;

[0087] After the authentication is passed, submitting the second p10 file and the PDID to the remote service providing platform to trigger the application request for the second certificate;

[0088] The remote service providing platform verifies the legitimacy and purpose of the first certificate, the legitimacy of the PDID, whether the batch number of the first certificate is accurate, and whether there is a surplus of the first certificates;

[0089] When the legitimacy and purpose of the first certificate and the legitimacy of the PDID meet the standards, the batch number of the first certificate is accurate, and there is a surplus of the first certificates, the third p10 file generated internally by the device application end is submitted to the public key infrastructure, and the second certificate is generated using the public key infrastructure.

[0090] As a preferred implementation, in an embodiment of the present invention, the certificate replacement and pre-embedded module is specifically used to: replace the first certificate with the second certificate, and pre-embed the exchanged second certificate in the networked product part of the device application end, including:

[0091] After accumulating the number of the second certificates generated by the public key infrastructure, transmitting the second certificate to the device application end;

[0092] The device application end writes the second certificate to replace the first certificate;

[0093] The second certificate and the third certificate are used for message queue telemetry transmission two-way authentication communication. After the authentication is passed, the second certificate is pre-embedded in the networked product part of the device application end to facilitate subsequent business processes.

[0094] For the specific definition of the security certificate acquisition system, please refer to the definition of the security certificate acquisition method above, which will not be repeated here. Each module in the above security certificate acquisition system can be implemented in whole or in part by software, hardware and their combination. The above modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0095] Embodiment 3

[0096] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 5 As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for obtaining a security certificate is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0097] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0098] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program:

[0099] S1: The equipment supply terminal applies to and downloads a first certificate with a preset validity period from the remote service provision platform through a web page, and pre-embeds the first certificate in the network connection product;

[0100] S2: The device application verifies the first certificate in the network-connected product according to a preset verification rule, and if the verification passes, applies for a second certificate from the remote service provider platform according to the first certificate;

[0101] S3: Replace the first certificate with the second certificate, and pre-embed the exchanged second certificate in the networked product component at the device application end.

[0102] S4: Generate a third certificate applied to the remote service providing platform based on the public key infrastructure, where the third certificate is a security certificate.

[0103] As a preferred implementation, in the embodiment of the present invention, the processor further implements the following steps when executing the computer program:

[0104] The device supply terminal randomly generates a first public-private key pair using the source code base library, and generates a first p10 file using the public key in the first public-private key pair, the batch number of the PDID, and the number of PDIDs in this batch, wherein the PDID is a traceability code for the networked device;

[0105] Submitting an application request for the first p10 file and the first certificate to the remote service providing platform;

[0106] The remote service providing platform submits the first p10 file to the public key infrastructure based on the application request;

[0107] The public key infrastructure generates the first certificate with a preset validity period according to the first p10 file, and transmits the first certificate to the web page;

[0108] The equipment provision terminal downloads the first certificate with a preset validity period through the web page;

[0109] Among them, the first certificate is a temporary certificate, and the temporary certificate includes a certificate purpose mark, and the certificate purpose mark is: it can only be used to apply for a formal certificate and cannot be used for business operations; the preset validity period of the temporary certificate is three months.

[0110] As a preferred implementation, in the embodiment of the present invention, the processor further implements the following steps when executing the computer program:

[0111] Writing the public key infrastructure root certificate, the PDID, the first certificate, and the private key of the first certificate into the device application end;

[0112] Verify the legitimacy of the first certificate using the public key infrastructure root certificate:

[0113] The private key signature of the first certificate is verified using an RSA signature algorithm and the public key of the public key infrastructure root certificate.

[0114] As a preferred implementation, in the embodiment of the present invention, the processor further implements the following steps when executing the computer program:

[0115] When the first certificate is legitimate, generating a second public-private key pair and a second p10 file based on a software development kit in a public key infrastructure system and the PDID;

[0116] Performing HTTP bidirectional authentication communication based on the international standard secure transmission protocol on the first certificate and the third certificate of the remote service providing platform;

[0117] After the authentication is passed, submitting the second p10 file and the PDID to the remote service providing platform to trigger the application request for the second certificate;

[0118] The remote service providing platform verifies the legitimacy and purpose of the first certificate, the legitimacy of the PDID, whether the batch number of the first certificate is accurate, and whether there is a surplus of the first certificates;

[0119] When the legitimacy and purpose of the first certificate and the legitimacy of the PDID meet the standards, the batch number of the first certificate is accurate, and there is a surplus of the first certificates, the third p10 file generated internally by the device application end is submitted to the public key infrastructure, and the second certificate is generated using the public key infrastructure.

[0120] As a preferred implementation, in the embodiment of the present invention, the processor further implements the following steps when executing the computer program:

[0121] After accumulating the number of the second certificates generated by the public key infrastructure, transmitting the second certificate to the device application end;

[0122] The device application end writes the second certificate to replace the first certificate;

[0123] The second certificate and the third certificate are used for message queue telemetry transmission two-way authentication communication. After the authentication is passed, the second certificate is pre-embedded in the networked product part of the device application end to facilitate subsequent business processes.

[0124] Embodiment 4

[0125] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0126] S1: The equipment supply terminal applies to and downloads a first certificate with a preset validity period from the remote service provision platform through a web page, and pre-embeds the first certificate in the network connection product;

[0127] S2: The device application verifies the first certificate in the network-connected product according to a preset verification rule, and if the verification passes, applies for a second certificate from the remote service provider platform according to the first certificate;

[0128] S3: Replace the first certificate with the second certificate, and pre-embed the exchanged second certificate in the networked product component at the device application end.

[0129] S4: Generate a third certificate applied to the remote service providing platform based on the public key infrastructure, where the third certificate is a security certificate.

[0130] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0131] The device supply terminal randomly generates a first public-private key pair using the source code base library, and generates a first p10 file using the public key in the first public-private key pair, the batch number of the PDID, and the number of PDIDs in this batch, wherein the PDID is a traceability code for the networked device;

[0132] Submitting an application request for the first p10 file and the first certificate to the remote service providing platform;

[0133] The remote service providing platform submits the first p10 file to the public key infrastructure based on the application request;

[0134] The public key infrastructure generates the first certificate with a preset validity period according to the first p10 file, and transmits the first certificate to the web page;

[0135] The equipment provisioning terminal downloads the first certificate with a preset validity period through the web page.

[0136] Among them, the first certificate is a temporary certificate, and the temporary certificate includes a certificate purpose mark, and the certificate purpose mark is: it can only be used to apply for a formal certificate and cannot be used for business operations; the preset validity period of the temporary certificate is three months.

[0137] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0138] Writing the public key infrastructure root certificate, the PDID, the first certificate, and the private key of the first certificate into the device application end;

[0139] Verify the legitimacy of the first certificate using the public key infrastructure root certificate:

[0140] The private key signature of the first certificate is verified using an RSA signature algorithm and the public key of the public key infrastructure root certificate.

[0141] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0142] When the first certificate is legitimate, generating a second public-private key pair and a second p10 file based on a software development kit in a public key infrastructure system and the PDID;

[0143] Performing HTTP bidirectional authentication communication based on the international standard secure transmission protocol on the first certificate and the third certificate of the remote service providing platform;

[0144] After the authentication is passed, submitting the second p10 file and the PDID to the remote service providing platform to trigger the application request for the second certificate;

[0145] The remote service providing platform verifies the legitimacy and purpose of the first certificate, the legitimacy of the PDID, whether the batch number of the first certificate is accurate, and whether there is a surplus of the first certificates;

[0146] When the legitimacy and purpose of the first certificate and the legitimacy of the PDID meet the standards, the batch number of the first certificate is accurate, and there is a surplus of the first certificates, the third p10 file generated internally by the device application end is submitted to the public key infrastructure, and the second certificate is generated using the public key infrastructure.

[0147] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0148] After accumulating the number of the second certificates generated by the public key infrastructure, transmitting the second certificate to the device application end;

[0149] The device application end writes the second certificate to replace the first certificate;

[0150] The second certificate and the third certificate are used for message queue telemetry transmission two-way authentication communication. After the authentication is passed, the second certificate is pre-embedded in the networked product part of the device application end to facilitate subsequent business processes.

[0151] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0152] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0153] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A method for obtaining a security certificate, characterized in that: The method comprises: The equipment supply terminal applies for and downloads a first certificate with a preset validity period from the remote service provision platform through a web page, and pre-embeds the first certificate in the network-connected product; The device application verifies the first certificate in the networked product according to a preset verification rule, and if the verification passes, applies for a second certificate from the remote service provider platform according to the first certificate, including: When the first certificate is legitimate, a second public-private key pair and a second p10 file are generated based on the software development kit and PD ID in the public key infrastructure system, wherein the PD ID is the traceability code of the networked device, and the p10 file consists of a public key and a custom subject; Performing HTTP bidirectional authentication communication based on the international standard secure transmission protocol on the first certificate and the third certificate of the remote service providing platform; After the authentication is passed, submitting the second p10 file and the PD ID to the remote service providing platform to trigger the application request for the second certificate; The remote service providing platform verifies the legitimacy and purpose of the first certificate, the legitimacy of the PD ID, whether the batch number of the first certificate is accurate, and whether there is a surplus of the number of the first certificates; When the legitimacy and purpose of the first certificate and the legitimacy of the PD ID meet the standards, the batch number of the first certificate is accurate, and the quantity of the first certificates is in surplus, submitting the third p10 file generated internally by the device application end to the public key infrastructure, and using the public key infrastructure to generate the second certificate; The first certificate is replaced by the second certificate, and the exchanged second certificate is pre-embedded in the networked product component at the device application end.

2. The method for obtaining a security certificate according to claim 1, characterized in that: The method further includes: generating a third certificate applied to the remote service providing platform based on the public key infrastructure, wherein the third certificate is a security certificate.

3. The method for obtaining a security certificate according to claim 1, characterized in that: The device provision terminal applies for and downloads a first certificate with a preset validity period from the remote service provision platform through a web page, including: The device supply terminal randomly generates a first public-private key pair using the source code base library, and generates a first p10 file using the public key in the first public-private key pair, the batch number of the PD ID, and the number of PD IDs in this batch, wherein the PD ID is a traceability code for the networked device; Submitting an application request for the first p10 file and the first certificate to the remote service providing platform; The remote service providing platform submits the first p10 file to the public key infrastructure based on the application request; The public key infrastructure generates the first certificate with a preset validity period according to the first p10 file, and transmits the first certificate to the web page; The equipment provisioning terminal downloads the first certificate with a preset validity period through the web page.

4. The method for obtaining a security certificate according to claim 3, characterized in that: The first certificate is a temporary certificate, and the temporary certificate includes a certificate usage mark, and the certificate usage mark is: it can only be used to apply for a formal certificate and cannot be used for business operations; The preset validity period of the temporary certificate is three months.

5. The method for obtaining a security certificate according to any one of claims 1, 3 to 4, characterized in that: The device application verifies the first certificate in the networked product according to a preset verification rule, including: Writing the public key infrastructure root certificate, the PD ID, the first certificate, and the private key of the first certificate into the device application end; Verify the legitimacy of the first certificate using the public key infrastructure root certificate: The private key signature of the first certificate is verified using an RSA signature algorithm and the public key of the public key infrastructure root certificate.

6. The method for obtaining a security certificate according to claim 1 or 2, characterized in that: Replacing the first certificate with the second certificate, and pre-embedding the exchanged second certificate in the networked product component of the device application end, includes: After accumulating the number of the second certificates generated by the public key infrastructure, transmitting the second certificate to the device application end; The device application end writes the second certificate to replace the first certificate; The second certificate and the third certificate are used for message queue telemetry transmission two-way authentication communication. After the authentication is passed, the second certificate is pre-embedded in the networked product part of the device application end to facilitate subsequent business processes.

7. A security certificate acquisition system implementing the security certificate acquisition method according to any one of claims 1 to 6, characterized in that: include: A first certificate application and download module, which is used by the device provision terminal to apply for and download a first certificate with a preset validity period from the remote service provision platform through a web page, and to pre-embed the first certificate in the network connection product; A second certificate generation module is used for the device application end to verify the first certificate in the network-connected product according to a preset verification rule, and if the verification is successful, apply for a second certificate from the remote service providing platform according to the first certificate; The certificate replacement and pre-embedding module is used to replace the first certificate with the second certificate, and pre-embed the exchanged second certificate in the networked product part of the device application end.

8. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images