WAPI certificate application method, device, equipment and storage medium

Abstract

The present invention relates to the field of information security technology, and in particular to an application method, device, equipment and storage medium for a WAPI certificate. The present invention encrypts a local physical address on a mobile terminal side to obtain target encrypted data, and sends the target encrypted data and a public key in an asymmetric key pair to a security authentication server, so that the local physical address of the mobile terminal is encrypted and transmitted during the transmission process, thereby avoiding information leakage of the physical address. After the security authentication server assembles a WAPI certificate request, a hash value is fed back to the mobile terminal. The mobile terminal signs the hash value based on a private key in the asymmetric key pair to obtain signature data, thereby realizing encrypted transmission of a terminal key, improving the security of the transmission of the physical address and the terminal key of the mobile terminal, and avoiding the technical problem in the prior art that there is a risk of information leakage when the WAPI certificate is authenticated and installed.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a WAPI certificate application method, device, equipment and storage medium. Background Art

[0002] When a mobile device accesses the network, it needs to pre-install the CA certificate and the public key certificate issued by the AS (Authentication Server) before it can access the network for other business operations. In the traditional certificate installation process, for example, the AS's own certificate file and the PFX file distributed to the terminal need to be copied to the mobile phone storage offline before installation. However, some mobile phones do not support SD external storage, so certificate installation authentication needs to be performed through wireless transmission, for example, certificate installation via WLAN.

[0003] However, WLAN data transmission inherently carries the risk of information leakage, and the public key certificates and keys of current mobile devices are generated by security authentication servers. By packaging the key pair and public key certificate of the mobile terminal, distributing and installing the packaged files on the mobile terminal, there is a risk of the terminal private key being copied and leaked.

[0004] In summary, there is a risk of information leakage in the process of applying for and installing WAPI certificates on traditional mobile devices.

[0005] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0006] The main purpose of the present invention is to provide a WAPI certificate application method, device, equipment and storage medium, aiming to solve the technical problem in the prior art that there is a risk of information leakage when applying for authentication and installation of WAPI certificates.

[0007] To achieve the above object, the present invention provides a method for applying for a WAPI certificate, the method comprising the following steps:

[0008] Get the local physical address and asymmetric key pair;

[0009] Encrypting the local physical address by a preset encryption method to obtain target encrypted data;

[0010] Sending the target encrypted data and the public key in the asymmetric key pair to a security authentication server, and receiving a hash value fed back by the security authentication server;

[0011] Signing the hash value based on the private key in the asymmetric key pair to obtain signature data;

[0012] The signature data is sent to the security authentication server so that the security authentication server feeds back a WAPI certificate, wherein the WAPI certificate is generated by assembling the signature data and a WAPI request file, and the WAPI request file is assembled by the security authentication server according to the public key in the asymmetric key pair and the local physical address.

[0013] Optionally, obtaining the local physical address and the asymmetric key pair includes:

[0014] Check whether the current device meets the preset trust conditions;

[0015] If yes, obtain the shared password provided by the security authentication server;

[0016] The target application programming interface is called based on the shared password to generate an asymmetric key pair and obtain a local physical address.

[0017] Optionally, the detecting whether the current device meets a preset trust condition includes:

[0018] Detect whether the network environment in which the current device is located is a trusted network environment; and / or

[0019] Check whether the security certificate management software in the current device is the latest version; and / or

[0020] Check whether the current device has the highest operation authority.

[0021] Optionally, obtaining a shared password provided by a security authentication server includes:

[0022] Accessing a security authentication server so that the security authentication server generates a QR code;

[0023] Scan the QR code provided by the security authentication server to obtain the valid request time;

[0024] Send a shared password request to the security authentication server within the valid request time, and receive the shared password and response result fed back by the security authentication server.

[0025] Optionally, after receiving the shared password and the response result fed back by the security authentication server, the method further includes:

[0026] Parse the response result to obtain the signature value and signature certificate;

[0027] Performing validity testing on the signature value and the signature certificate;

[0028] The validity check of the signature certificate includes at least one of the following:

[0029] Detecting whether the domain name of the subject alternative name of the signing certificate is the same as the unique identifier of the security authentication server;

[0030] Detecting whether the global object identifier of the extended key usage of the signing certificate is the same as the preset identifier;

[0031] Verify the validity of the signing certificate's intermediate certificate chain against the preset root certificate.

[0032] Optionally, the target encrypted data includes physical address encrypted data and a physical address hash string;

[0033] The local physical address is encrypted by a preset encryption method to obtain target encrypted data, including:

[0034] Generate symmetric keys and hash keys through a preset key derivation function;

[0035] Encrypting the local physical address by using the symmetric key to obtain physical address encrypted data;

[0036] The local physical address is hashed using the hash key to obtain a physical address hash string.

[0037] Optionally, the WAPI certificate application method further includes:

[0038] Performing validity check on the WAPI certificate;

[0039] After the validity test is passed, the application programming interface of the operating system is called to install the CA certificate of the security authentication system and the WAPI certificate;

[0040] The validity check of the WAPI certificate includes at least one of the following:

[0041] Verify whether the certificate chain of the WAPI certificate is valid;

[0042] Determine whether the public key of the WAPI certificate is the same as the public key of the asymmetric key pair;

[0043] Check whether the value of the certificate subject item is the same as the value of the local physical address.

[0044] In addition, to achieve the above-mentioned purpose, the present invention also proposes a WAPI certificate application device, the WAPI certificate application device comprising:

[0045] An acquisition module, used to obtain a local physical address and an asymmetric key pair;

[0046] An encryption module, used to encrypt the local physical address by a preset encryption method to obtain target encrypted data;

[0047] An interactive module, used to send the target encrypted data and the public key in the asymmetric key pair to a security authentication server, and receive a hash value fed back by the security authentication server;

[0048] A signature module, used to sign the hash value based on the private key in the asymmetric key pair to obtain signature data;

[0049] A sending module is used to send the signature data to the security authentication server so that the security authentication server feeds back a WAPI certificate, wherein the WAPI certificate is generated by assembling the signature data and a WAPI request file, and the WAPI request file is assembled by the security authentication server according to the public key in the asymmetric key pair and the local physical address.

[0050] In addition, to achieve the above-mentioned purpose, the present invention also proposes a WAPI certificate application device, the WAPI certificate application device comprising: a memory, a processor, and a WAPI certificate application program stored in the memory and executable on the processor, the WAPI certificate application program being configured to implement the steps of the WAPI certificate application method as described above.

[0051] In addition, to achieve the above object, the present invention also proposes a storage medium, on which a WAPI certificate application program is stored, and when the WAPI certificate application program is executed by a processor, the steps of the WAPI certificate application method described above are implemented.

[0052] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps of the WAPI certificate application method as described above are implemented.

[0053] One or more technical solutions proposed in the present invention have at least the following technical effects: the present invention discloses a method for applying for a WAPI certificate, the method for applying for a WAPI certificate comprising: obtaining a local physical address and an asymmetric key pair; encrypting the local physical address by a preset encryption method to obtain target encrypted data; sending the target encrypted data and the public key in the asymmetric key pair to a security authentication server, and receiving a hash value fed back by the security authentication server; signing the hash value based on the private key in the asymmetric key pair to obtain signature data; sending the signature data to the security authentication server so that the security authentication server feeds back a WAPI certificate, the WAPI certificate being generated by assembling the signature data and a WAPI request file, the WAPI request file being generated by the security authentication server The server assembles the data according to the public key in the asymmetric key pair and the local physical address. Compared with the prior art, the present invention encrypts the local physical address on the mobile terminal side to obtain the target encrypted data, and sends the target encrypted data and the public key in the asymmetric key pair to the security authentication server, so that the local physical address of the mobile terminal is encrypted during transmission to avoid information leakage of the physical address. After the security authentication server assembles the WAPI certificate request, it feeds back the hash value to the mobile terminal. The mobile terminal signs the hash value based on the private key in the asymmetric key pair to obtain the signature data, thereby realizing encrypted transmission of the terminal key, improving the security of the transmission of the physical address and terminal key of the mobile terminal, and avoiding the technical problem in the prior art that there is a risk of information leakage when the WAPI certificate is installed for authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0055] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0056] Figure 1 This is a flow chart of a first embodiment of a method for applying for a WAPI certificate of the present invention;

[0057] Figure 2 A schematic diagram of the timing interaction between a mobile smart terminal and a security authentication system according to an embodiment of a method for applying for a WAPI certificate of the present invention;

[0058] Figure 3A schematic diagram of the network topology of a terminal device and a security authentication server in an embodiment of a method for applying for a WAPI certificate of the present invention;

[0059] Figure 4 This is a flow chart of a second embodiment of a method for applying for a WAPI certificate according to the present invention;

[0060] Figure 5 A functional logic diagram of a mobile smart terminal and a security authentication system according to an embodiment of a WAPI certificate application method of the present invention;

[0061] Figure 6 This is a structural block diagram of a first embodiment of a WAPI certificate application device according to the present invention.

[0062] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0063] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0064] Based on this, the embodiment of the present invention provides a WAPI certificate application method, referring to Figure 1 , Figure 1 The figure is a flow chart of a first embodiment of a method for applying for a WAPI certificate according to the present invention.

[0065] In this embodiment, the WAPI certificate application method includes:

[0066] Step S10: Obtain a local physical address and an asymmetric key pair.

[0067] It should be noted that the executor of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device, a terminal device, etc. that can realize the above functions. The following takes the terminal device as an example to illustrate this embodiment and the following embodiments.

[0068] It is understandable that according to the WAPI technical specification GB 15629.11-2003 "Specific requirements for local area networks and metropolitan area networks for remote communications and information exchange between information technology systems", wireless workstations (STA) and wireless access points (AP) need to pre-install public key certificates issued by a security authentication server (AS). The public key certificates are used to authenticate the identities of both parties, and the STA can access the network through the AP to perform other business operations.

[0069] As a type of STA, mobile smart terminals such as mobile phones and pads are universal and huge in number. At present, most of them are installed in the mobile smart terminal operating system setting menu, security setting submenu, encryption and credentials submenu, and certificate installation submenu. CA certificates and user certificates are installed separately. However, traditional certificate authentication has many problems, such as usability issues, that is, the AS's own certificate files and PFX files distributed to the terminal need to be copied to the mobile phone storage offline before they can be installed. Some mobile phones do not support SD external storage and need to be transferred via Bluetooth or USB cables, which is very troublesome. In addition, the menu operation steps of the certificate installation are many and quite complex, making it difficult for the general public to master.

[0070] Key storage security issues: Currently, the public key certificates and key pairs of mobile smart terminals are generated by AS. AS encapsulates the STA's key pair and public key certificate into a PFX file, distributes it, and then installs it on the STA side. There is a risk that the terminal private key will be copied and leaked, causing the terminal identity to be impersonated, reducing the security of the wireless network.

[0071] Data transmission security: Currently, most mobile smart terminals choose to use WLAN as a wireless signal network for online data transmission and resource sharing. However, due to its wireless transmission characteristics, it is vulnerable to various attacks, such as data interception, signal interference, fake hotspots, etc. If there are no proper encryption measures, data transmitted via WLAN may be eavesdropped or intercepted by a third party, resulting in the leakage of sensitive information.

[0072] Compatibility issues: For Android phones, since the hardware interfaces provided by each product are different and the operating system has been customized by each manufacturer, the menu arrangement and operation methods of each phone are different. There is no relatively unified and standard operating procedure, which causes trouble for users.

[0073] Based on this, this embodiment proposes a method for applying for a WAPI certificate, which includes: obtaining a local physical address and an asymmetric key pair; encrypting the local physical address through a preset encryption method to obtain target encrypted data; sending the target encrypted data and the public key in the asymmetric key pair to a security authentication server, and receiving a hash value fed back by the security authentication server; signing the hash value based on the private key in the asymmetric key pair to obtain signature data; sending the signature data to the security authentication server so that the security authentication server feeds back a WAPI certificate, the WAPI certificate is generated by assembling the signature data and a WAPI request file, and the WAPI request file is assembled by the security authentication server according to the public key in the asymmetric key pair and the local physical address, thereby realizing the separate encrypted transmission of the private key and physical address of the mobile terminal and improving the security of information transmission.

[0074] The local physical address refers to a unique identifier used to identify a mobile terminal in the network. The MAC address is usually burned into the hardware of network hardware devices (such as network cards, routers, switches, etc.). In a wireless local area network (WLAN), the MAC address is used for communication between devices, such as wireless access points (APs) and client devices. This embodiment does not impose specific restrictions on this.

[0075] In this embodiment, the asymmetric key pair includes a public key and a private key, wherein the public key can be shared publicly and used to encrypt data or verify digital signatures, and the private key is kept confidential and used to decrypt data or create digital signatures. In this embodiment, the asymmetric key pair can use a WAPI-EC192 key pair, and other asymmetric key pairs can also be used. This embodiment does not impose specific restrictions on this.

[0076] Step S20: Encrypt the local physical address using a preset encryption method to obtain target encrypted data.

[0077] It should be noted that the preset encryption method is related to the shared password generated by the security authentication server. Specifically, when the mobile terminal receives the shared password generated by the security authentication server, the certificate management software in the mobile terminal uses the password-based key derivation function (PBKDF) in accordance with the GM / T0091 technical standard to generate the SM4 symmetric key, i.e., the symmetric key DK1 and the HMAC key, i.e., the hash key DK2. The certificate management APP presets two fixed values ​​K1 and K2 as salt values ​​for encrypting the local physical address.

[0078] Furthermore, the encrypting the local physical address by a preset encryption method to obtain target encrypted data includes:

[0079] Generate symmetric keys and hash keys through a preset key derivation function;

[0080] Encrypting the local physical address by using the symmetric key to obtain physical address encrypted data;

[0081] The local physical address is hashed using the hash key to obtain a physical address hash string.

[0082] In the specific implementation, after obtaining the symmetric key DK1 and the hash key DK2, the symmetric key DK1 uses the SM4-CBC mode to encrypt the local physical address of the mobile smart terminal, and outputs the string EncAcStr after Base64 encoding. The hash key DK2 calculates the HMAC value of the MAC address to ensure the integrity protection of the MAC address, and the HMAC is encoded through Base64 and output as the string HMACStr.

[0083] Among them, DK1=PBKDF-HMAC-SM3(sharePwd,shareInfo||K1,iterCount,klen) is used for encryption, where sharePwd in the parameter is the shared password, shareInfo||K1 is used as the salt value, iterCount is the number of iterations, klen is the output key length, and the pseudo-random number function PRF adopts the HMAC-SM3 algorithm; DK2=PBKDF-HMAC-SM3(sharepwd,shareInfo||K2,iterCount,klen) is used for integrity protection, where sharePwd in the parameter is the shared password, shareInfo||K2 is used as the salt value, iterCount is the number of iterations, klen is the output key length, and the pseudo-random number function PRF adopts the HMAC-SM3 algorithm.

[0084] Step S30: sending the target encrypted data and the public key in the asymmetric key pair to a security authentication server, and receiving a hash value fed back by the security authentication server.

[0085] In order for the security authentication server to generate a WAPI certificate corresponding to the mobile terminal, in this embodiment, after encrypting the local physical address, the mobile terminal can send the public key PA in the asymmetric key pair, the physical address encrypted data string EncAcStr, the physical address hash string HMACStr and the service ID (requestId) to the security authentication server through a network request according to the unique identification identifier (requestUrl) of the security authentication server.

[0086] After receiving the request, the security authentication server generates a symmetric key DK1 and a hash key DK2 using the same method as above. Specifically, the symmetric key DK1 is used to decrypt the physical address encrypted data string EncAcStr to obtain the MAC address of the mobile smart terminal. DK2 is used to calculate HMAC for the MAC address and compare it with the physical address hash string HMACStr sent by the mobile terminal to ensure the integrity of the MAC address, thereby preventing the MAC address from being tampered with and causing information leakage.

[0087] After verifying the integrity of the physical address, the security authentication server assembles a PKCS#10 certificate request file based on the public key and MAC address in the received asymmetric key pair. The specific structure of the PKCS#10 certificate request file follows the PKCS#10v1.7:Certification Request Syntax Standard standard. CertificationRequest is the certificate request file data, which consists of certificationRequestInfo, signatureAlgorithm, and signature. The key parameter descriptions and processes are as follows:

[0088] certificationRequestInfo is composed of version, subject, subjectPKInfo, and attributes, where subject represents the identification information of the requester, such as country, province, city, organization, organizational unit, etc., such as (C=CN; CN=MAC address), subjectPKInfo represents the public key information of the requester, including the public key algorithm and public key, and attributes represents optional attribute fields, which may contain some additional information, extended requests, etc.; with certificationRequestInfo as the original text M, a hash function H (such as SHA256 algorithm) is used to calculate the hash value e of the original text M, e=H(M), and the calculated hash value is sent to the mobile terminal for signature encapsulation, thereby verifying the key integrity of the mobile terminal.

[0089] Step S40: Sign the hash value based on the private key in the asymmetric key pair to obtain signature data.

[0090] After receiving the response, the mobile smart terminal first verifies the response information JWS fed back by the security authentication server. After the verification passes, it uses the private key in the asymmetric key pair to perform PKCS#1 signature on the hash value e to obtain the signature, and then sends the signature value to the self-service so that the security authentication server can assemble and complete the WAPI certificate.

[0091] Step S50: Send the signature data to the security authentication server, so that the security authentication server feeds back a WAPI certificate.

[0092] The WAPI certificate is generated by assembling the signature data and a WAPI request file, and the WAPI request file is assembled by the security authentication server according to the public key in the asymmetric key pair and the local physical address.

[0093] Specifically, since the signature data is obtained by encrypting the hash value with the private key in the asymmetric key pair, when the security authentication server receives the signature data, it can decrypt it according to the public key in the asymmetric key pair previously received, thereby verifying the integrity of the data and avoiding leakage of the private key of the mobile terminal.

[0094] Furthermore, the WAPI certificate application method further includes:

[0095] Performing validity check on the WAPI certificate;

[0096] After the validity test is passed, the application programming interface of the operating system is called to install the CA certificate of the security authentication system and the WAPI certificate;

[0097] The validity check of the WAPI certificate includes at least one of the following:

[0098] Verify whether the certificate chain of the WAPI certificate is valid;

[0099] Determine whether the public key of the WAPI certificate is the same as the public key of the asymmetric key pair;

[0100] Check whether the value of the certificate subject item is the same as the value of the local physical address.

[0101] In the specific implementation, refer to Figure 2 , Figure 2 This is a schematic diagram of the sequential interaction between the mobile smart terminal and the security authentication system in this embodiment. After receiving the request for the certificate application, the security authentication server issues a WAPI certificate according to its PKCS#10; and returns the CA certificate and the WAPI certificate issued above, the Content-Type is "application / x-pkcs7-certificates", the HTTP message body is a Base64-encoded P7B format file, and P7B contains the WAPI certificate issued in the previous step; after receiving the certificate, the certificate management software of the mobile terminal first performs a validity check, and after the check passes, the certificate is installed and configured.

[0102] The validity check of the WAPI certificate includes at least one of the following: verifying whether the certificate chain of the WAPI certificate is valid; determining whether the public key of the WAPI certificate is the same as the public key of the asymmetric key pair; detecting whether the value of the certificate subject item is the same as the value of the local physical address. Other methods of checking the validity of the WAPI certificate may also be included, which are not specifically limited in this embodiment.

[0103] refer to Figure 3 , Figure 3 This is a network topology diagram of the terminal device and the security authentication server in this embodiment. Before the user's mobile smart terminal has installed a digital certificate, it can access the security authentication system (AS) through an open network to apply for and download a certificate. After the user's mobile smart terminal has installed a digital certificate, it can pass the WAPI authentication, access the controlled network, and access the business system to perform important business operations.

[0104] This embodiment encrypts the local physical address on the mobile terminal side to obtain target encrypted data, and sends the target encrypted data and the public key in the asymmetric key pair to the security authentication server, so that the local physical address of the mobile terminal is encrypted during transmission to avoid information leakage of the physical address. After the security authentication server assembles the WAPI certificate request, it feeds back a hash value to the mobile terminal. The mobile terminal signs the hash value based on the private key in the asymmetric key pair to obtain signature data, thereby realizing encrypted transmission of the terminal key, improving the security of the physical address and terminal key transmission of the mobile terminal, and avoiding the technical problem in the prior art that there is a risk of information leakage when the WAPI certificate is installed for authentication.

[0105] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated in the following. Figure 4 , step S10, comprising:

[0106] Step S101: Detect whether the current device meets the preset trust condition.

[0107] It should be noted that the preset trust condition is used to determine whether the current mobile terminal meets the conditions for WAPI certificate authentication installation to avoid information leakage. Specifically, the detection of whether the current device meets the preset trust condition includes:

[0108] Detect whether the network environment in which the current device is located is a trusted network environment; and / or

[0109] Check whether the security certificate management software in the current device is the latest version; and / or

[0110] Check whether the current device has the highest operation authority.

[0111] In the specific implementation, detecting whether the network environment of the current device is in a trusted network environment means checking whether the network environment of the device uses the mobile network supervised and licensed by the Ministry of Industry and Information Technology, avoiding the use of insecure public WI-FI, so as to ensure that the device handles a trusted network environment during the entire process of interacting with the security authentication server; detecting whether the security certificate management software in the current device is the latest version, which can be used to ensure the integrity of the APP function and the security of the software.

[0112] Prior to this, the administrator of the security authentication system needs to pre-enter the mobile phone number or email address of the user who needs to apply for the WAPI certificate as a number that uniquely identifies the user; thereby avoiding the subsequent failure to establish a wireless connection between the mobile terminal and the security authentication server

[0113] Step S102: If yes, obtain the shared password provided by the security authentication server.

[0114] The shared password can be used to help the mobile terminal generate an asymmetric key pair, thereby providing higher security performance when the subsequent security authentication server decrypts the signed data.

[0115] Further, obtaining the shared password provided by the security authentication server includes:

[0116] Accessing a security authentication server so that the security authentication server generates a QR code;

[0117] Scan the QR code provided by the security authentication server to obtain the valid request time;

[0118] Send a shared password request to the security authentication server within the valid request time, and receive the shared password and response result fed back by the security authentication server.

[0119] In the specific implementation, the mobile terminal accesses the security authentication server through the browser, and applies for the certificate system by itself to generate a QR code. The QR code contains the following information: the URL address of the security authentication server (requestUrl), shared variables (shareInfo), business ID (requestId), and valid time Tm; the mobile terminal obtains the shared variables (shareInfo), and business ID (requestId) by scanning the QR code, and requests the security authentication server to obtain the shared password within the valid time Tm. The request content includes UID, mobile phone number or email address, etc., which is used by the security authentication server to identify the source device of the request.

[0120] refer to Figure 5 , Figure 5This is a functional logic diagram of the mobile smart terminal and the security authentication system of this embodiment. The certificate management APP is installed on the user's mobile smart terminal. The certificate management APP relies on the camera interface provided by the mobile phone operating system to realize the QR code recognition function, and realizes the request and installation of certificates through the key and certificate security storage function provided by the mobile phone operating system. The security authentication server (AS) provides functions such as terminal certificate application authorization, generating authorized access QR code, certificate application authentication, and certificate issuance.

[0121] Furthermore, after receiving the shared password and the response result fed back by the security authentication server, the method further includes:

[0122] Parse the response result to obtain the signature value and signature certificate;

[0123] Performing validity testing on the signature value and the signature certificate;

[0124] The validity check of the signature certificate includes at least one of the following:

[0125] Detecting whether the domain name of the subject alternative name of the signing certificate is the same as the unique identifier of the security authentication server;

[0126] Detecting whether the global object identifier of the extended key of the signing certificate is the same as a preset identifier;

[0127] Verify the validity of the signing certificate's intermediate certificate chain against the preset root certificate.

[0128] It should be noted that after receiving the request, the security authentication server checks whether the business ID requestId is invalid. If so, it returns an error; it checks whether the mobile phone number or email address is in the whitelist. If the administrator has not entered it in the whitelist in advance, it returns an error; otherwise, it generates a random shared password sharePwd and sends it to the mobile phone number or email address, and encapsulates the response result and returns it successfully to the APP.

[0129] After receiving the response result, the mobile terminal verifies the response result of the security authentication server. The response result adopts the JWS structure. The specific verification process is as follows: parse JWS to obtain the signature value, signing certificate, etc.; verify whether the signature value is valid; verify whether the DNS of the subject alternative name of the signing certificate is consistent with the requestUrl; verify whether the OID of the extended key usage of the signing certificate is consistent with the preset OID; use the root certificate preset by the certificate management APP to verify the validity of the signing certificate and the intermediate certificate chain it may contain.

[0130] Step S103: calling the target application programming interface based on the shared password, generating an asymmetric key pair, and obtaining a local physical address.

[0131] It is understandable that after the mobile terminal receives the shared password SharePwd, it inputs the shared password SharePwd into the certificate management software, and then the certificate management software calls the target application programming interface API of the mobile phone operating system, generates a WAPI-EC192 asymmetric key pair from the security module and reads the MAC address.

[0132] This embodiment detects whether the current device meets the preset trust conditions; if so, obtains the shared password provided by the security authentication server; calls the target application programming interface based on the shared password, generates an asymmetric key pair, and obtains the local physical address, thereby increasing the exposure of the mobile device and preventing the mobile terminal that is not authorized by the security authentication server from being unable to obtain the unique identifier of the security authentication server, resulting in the inability to implement certificate authentication.

[0133] This application also provides a WAPI certificate application device, please refer to Figure 6 , the WAPI certificate application device includes:

[0134] The acquisition module 10 is used to acquire a local physical address and an asymmetric key pair.

[0135] The encryption module 20 is used to encrypt the local physical address by a preset encryption method to obtain target encrypted data.

[0136] The interaction module 30 is used to send the target encrypted data and the public key in the asymmetric key pair to a security authentication server, and receive a hash value fed back by the security authentication server.

[0137] The signature module 40 is used to sign the hash value based on the private key in the asymmetric key pair to obtain signature data.

[0138] The sending module 50 is used to send the signature data to the security authentication server so that the security authentication server feeds back a WAPI certificate, wherein the WAPI certificate is generated by assembling the signature data and a WAPI request file, and the WAPI request file is assembled by the security authentication server based on the public key in the asymmetric key pair and the local physical address.

[0139] This embodiment encrypts the local physical address on the mobile terminal side to obtain target encrypted data, and sends the target encrypted data and the public key in the asymmetric key pair to the security authentication server, so that the local physical address of the mobile terminal is encrypted during transmission to avoid information leakage of the physical address. After the security authentication server assembles the WAPI certificate request, it feeds back a hash value to the mobile terminal. The mobile terminal signs the hash value based on the private key in the asymmetric key pair to obtain signature data, thereby realizing encrypted transmission of the terminal key, improving the security of the physical address and terminal key transmission of the mobile terminal, and avoiding the technical problem in the prior art that there is a risk of information leakage when the WAPI certificate is installed for authentication.

[0140] In one embodiment, the acquisition module 10 is also used to detect whether the current device meets the preset trust conditions; if so, obtain the shared password provided by the security authentication server; call the target application programming interface based on the shared password, generate an asymmetric key pair, and obtain the local physical address.

[0141] In one embodiment, the acquisition module 10 is also used to detect whether the network environment in which the current device is located is a trusted network environment; and / or detect whether the security certificate management software in the current device is the latest version; and / or detect whether the current device has the highest operating authority.

[0142] In one embodiment, the acquisition module 10 is also used to access the security authentication server so that the security authentication server generates a QR code; scan the QR code provided by the security authentication server to obtain a valid request time; send a shared password request to the security authentication server within the valid request time, and receive the shared password and response result fed back by the security authentication server.

[0143] In one embodiment, the acquisition module 10 is also used to parse the response result to obtain a signature value and a signature certificate; perform validity check on the signature value and the signature certificate; wherein the validity check on the signature certificate includes at least one of the following: detecting whether the domain name of the subject alternative name of the signature certificate is the same as the unique identifier of the security authentication server; detecting whether the global object identifier of the extended key of the signature certificate is the same as a preset identifier; and verifying the validity of the intermediate certificate chain of the signature certificate based on a preset root certificate.

[0144] In one embodiment, the encryption module 20 is also used to encrypt the local physical address through a preset encryption method to obtain target encrypted data, including: generating a symmetric key and a hash key through a preset key derivation function; encrypting the local physical address through the symmetric key to obtain physical address encrypted data; performing a hash operation on the local physical address through the hash key to obtain a hash string.

[0145] In one embodiment, the signature module 40 is also used to perform validity check on the WAPI certificate; after the validity check is passed, call the application programming interface of the operating system to install the CA certificate of the security authentication system and the WAPI certificate; wherein, the validity check on the WAPI certificate includes at least one of the following: verifying whether the certificate chain of the WAPI certificate is valid; determining whether the public key of the WAPI certificate is the same as the public key of the asymmetric key pair; and detecting whether the value of the certificate subject item is the same as the value of the local physical address.

[0146] The present application provides a WAPI certificate application device, the WAPI certificate application device includes: at least one processor; and a memory connected to the at least one processor in communication; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the WAPI certificate application method in the above-mentioned embodiment 1.

[0147] The WAPI certificate application device provided by the present application adopts the WAPI certificate application method in the above embodiment, which can solve the technical problem of WAPI certificate application. Compared with the prior art, the beneficial effects of the WAPI certificate application device provided by the present application are the same as the beneficial effects of the WAPI certificate application method provided by the above embodiment, and other technical features in the WAPI certificate application device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0148] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0149] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0150] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the WAPI certificate application method in the above-mentioned embodiment.

[0151] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0152] The computer-readable storage medium may be included in the WAPI certificate application device; or may exist independently without being assembled into the WAPI certificate application device.

[0153] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the WAPI certificate application device, the WAPI certificate application device applies for a WAPI certificate.

[0154] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0155] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0156] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0157] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned WAPI certificate application method, and can solve the technical problems of WAPI certificate application. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the WAPI certificate application method provided by the above-mentioned embodiment, and will not be repeated here.

[0158] The present application also provides a computer program product, including a computer program, which implements the steps of the WAPI certificate application method as described above when the computer program is executed by a processor.

[0159] The computer program product provided by this application can solve the technical problem of applying for a WAPI certificate. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as the beneficial effects of the WAPI certificate application method provided in the above embodiment, which will not be repeated here.

[0160] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A method for applying for a WAPI certificate, characterized in that: The WAPI certificate application method includes: Get the local physical address and asymmetric key pair; Encrypting the local physical address by a preset encryption method to obtain target encrypted data; Sending the target encrypted data and the public key in the asymmetric key pair to a security authentication server, and receiving a hash value fed back by the security authentication server; Signing the hash value based on the private key in the asymmetric key pair to obtain signature data; The signature data is sent to the security authentication server so that the security authentication server feeds back a WAPI certificate, wherein the WAPI certificate is generated by assembling the signature data and a WAPI request file, and the WAPI request file is assembled by the security authentication server according to the public key in the asymmetric key pair and the local physical address.

2. The method according to claim 1, characterized in that The obtaining of the local physical address and the asymmetric key pair includes: Check whether the current device meets the preset trust conditions; If yes, obtain the shared password provided by the security authentication server; The target application programming interface is called based on the shared password to generate an asymmetric key pair and obtain a local physical address.

3. The method according to claim 2, characterized in that The detecting whether the current device meets the preset trust condition includes: Detect whether the network environment in which the current device is located is a trusted network environment; and / or Check whether the security certificate management software in the current device is the latest version; and / or Check whether the current device has the highest operation authority.

4. The method according to claim 2, characterized in that The step of obtaining a shared password provided by a security authentication server includes: Accessing a security authentication server so that the security authentication server generates a QR code; Scan the QR code provided by the security authentication server to obtain the valid request time; Send a shared password request to the security authentication server within the valid request time, and receive the shared password and response result fed back by the security authentication server.

5. The method according to claim 4, characterized in that After receiving the shared password and the response result fed back by the security authentication server, the method further includes: Parse the response result to obtain the signature value and signature certificate; Performing validity testing on the signature value and the signature certificate; The validity check of the signature certificate includes at least one of the following: Detecting whether the domain name of the subject alternative name of the signing certificate is the same as the unique identifier of the security authentication server; Detecting whether the global object identifier of the extended key of the signing certificate is the same as a preset identifier; Verify the validity of the signing certificate's intermediate certificate chain against the preset root certificate.

6. The method according to any one of claims 1 to 5, characterized in that The target encrypted data includes physical address encrypted data and a physical address hash string; The local physical address is encrypted by a preset encryption method to obtain target encrypted data, including: Generate symmetric keys and hash keys through a preset key derivation function; Encrypting the local physical address by using the symmetric key to obtain physical address encrypted data; The local physical address is hashed using the hash key to obtain a physical address hash string.

7. The method according to any one of claims 1 to 5, characterized in that The WAPI certificate application method further includes: Performing validity check on the WAPI certificate; After the validity test is passed, the application programming interface of the operating system is called to install the CA certificate of the security authentication system and the WAPI certificate; The validity check of the WAPI certificate includes at least one of the following: Verify whether the certificate chain of the WAPI certificate is valid; Determine whether the public key of the WAPI certificate is the same as the public key of the asymmetric key pair; Check whether the value of the certificate subject item is the same as the value of the local physical address.

8. A WAPI certificate application device, characterized in that: The WAPI certificate application device includes: An acquisition module, used to obtain a local physical address and an asymmetric key pair; An encryption module, used to encrypt the local physical address by a preset encryption method to obtain target encrypted data; An interactive module, used to send the target encrypted data and the public key in the asymmetric key pair to a security authentication server, and receive a hash value fed back by the security authentication server; A signature module, used to sign the hash value based on the private key in the asymmetric key pair to obtain signature data; A sending module is used to send the signature data to the security authentication server so that the security authentication server feeds back a WAPI certificate, wherein the WAPI certificate is generated by assembling the signature data and a WAPI request file, and the WAPI request file is assembled by the security authentication server according to the public key in the asymmetric key pair and the local physical address.

9. A WAPI certificate application device, characterized in that: The WAPI certificate application device includes: a memory, a processor, and a WAPI certificate application program stored in the memory and executable on the processor, wherein the WAPI certificate application program is configured to implement the steps of the WAPI certificate application method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores a WAPI certificate application program, and when the WAPI certificate application program is executed by the processor, the steps of the WAPI certificate application method according to any one of claims 1 to 7 are implemented.

Images