Certificate management method, computer program product, device and storage medium

Abstract

The invention relates to a certificate management method, a computer program product, equipment and a storage medium. The method comprises the steps of importing a target certificate into a server based on a preset interface, wherein the preset interface is an interface supported by a substrate management controller; classifying the target certificates based on a preset interaction protocol to obtain classified target certificates; encrypting the classified target certificates to obtain encrypted target certificates, and storing the encrypted target certificates in a preset sharing area; verifying the target certificate stored in the preset shared area based on a data table of the target certificate to obtain a verification result, the data table of the target certificate including a corresponding relationship among a target flag bit type, a target flag bit value and a verification state; and restarting the server in response to the verification result that the verification is successful, so that the target certificate takes effect. By adopting the method, the target certificate management reliability can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a certificate management method, computer program product, device and storage medium. Background Art

[0002] Secure Boot is an important security feature in BIOS (Basic Input Output System). In the prior art, during the server startup process, when entering the setting interface of the basic input output system and performing relevant configurations for secure boot, the certificate is mainly imported by loading the default certificate in the basic input output system and importing the client certificate through a portable storage device. However, the method of importing the client certificate through a portable storage device is cumbersome and inefficient. The manufacturer's default certificate is fixed into the program during the compilation process of the basic input output system program, and the customer cannot modify the default public key in the secure boot system. Moreover, even if the manufacturer's default certificate is updated, it cannot be synchronously updated to the current program, which cannot meet customer needs. Summary of the invention

[0003] Based on this, it is necessary to provide a certificate management method, computer program product, device and storage medium that can effectively manage target certificates in response to the above technical problems.

[0004] In order to solve the above technical problems, in a first aspect, a certificate management method is provided, the method comprising: Importing the target certificate into the server based on a preset interface, where the preset interface is an interface supported by the baseboard management controller; Classifying the target certificates based on a preset interaction protocol to obtain the classified target certificates; Encrypting the classified target certificates to obtain encrypted target certificates, and storing the encrypted target certificates in a preset shared area; Verify the target certificate stored in the preset shared area based on the data table of the target certificate to obtain a verification result, wherein the data table of the target certificate includes a corresponding relationship between a target flag bit type, a target flag bit value, and a verification status; In response to the verification result being successful, the server is restarted to make the target certificate effective.

[0005] In one embodiment, the method further includes: importing the target certificate into the server based on a preset interface, wherein the preset interface is an interface supported by the baseboard management controller; The preset interface receives the server signature certificate information and the target identification code, where the target identification code is the identification code of the import instruction corresponding to importing the target certificate into the server based on the preset interface; Perform authentication based on the server signature certificate information and the target identification code to obtain an authentication result; If the authentication result is authentication passed, the target certificate is imported into the server based on a preset interface, where the preset interface is an interface supported by the baseboard management controller.

[0006] In one embodiment, the target certificates are classified based on a preset interaction protocol, and the classified target certificates include: Acquire a preset interaction protocol, where the preset interaction protocol includes an address of a preset shared area corresponding to a type of a target certificate pre-agreed between the baseboard management controller and the basic input / output system; The target certificates are classified based on the type of the target certificates pre-agreed between the baseboard management controller and the basic input / output system to obtain the classified target certificates.

[0007] In one embodiment, the method further includes: encrypting the classified target certificate to obtain the encrypted target certificate, and storing the encrypted target certificate in a preset shared area includes: Obtain target certificate information of the classified target certificate, and encrypt the target certificate information of the classified target certificate based on a preset algorithm to obtain a first secret key; Selecting a random number of a preset length from the first secret key based on a random function to generate a second secret key; Inserting the second key into the first key based on the first rule to obtain key data, and obfuscating the key data based on the second rule to obtain a target certificate key of the classified target certificate; The classified target certificate is encrypted based on the target certificate secret key of the classified target certificate to obtain the encrypted target certificate, and the encrypted target certificate and the target certificate secret key are stored in a preset shared area.

[0008] In one embodiment, the method further includes: the preset shared area includes a key storage area and a target certificate storage area, and storing the encrypted target certificate and the target certificate key in the preset shared area includes: Obtaining the type of the encrypted target certificate, obtaining a target certificate storage area corresponding to the type of the encrypted target certificate that matches the type of the target certificate pre-agreed between the baseboard management controller and the basic input and output system from a preset interaction protocol, and storing the encrypted certificate in the target certificate storage area; Establish a correspondence between the target certificate storage area and the key storage area, and store the target certificate key in the key storage area.

[0009] In one embodiment, determining a target certificate from a preset shared area, and obtaining a data table of the target certificate includes: Obtaining a target certificate key corresponding to the target certificate from a preset shared area, deobfuscating the target certificate key corresponding to the target certificate based on the second rule to obtain key data, and decrypting the key data based on the first rule to obtain verification data; Obtain the first secret key and the second secret key, and determine whether the first secret key and the second secret key are consistent with the verification data; If they are consistent, the data table of the target certificate is obtained from the preset shared area; If they are inconsistent, an empty target certificate data table is returned.

[0010] In one embodiment, the target certificate is verified based on the data table of the target certificate, and the verification result obtained includes: Parse the data table of the target certificate to determine whether the target flag bit value corresponding to the first target flag bit type of the target certificate is a preset value; If yes, it is considered that there is a certificate imported into the server, and it is determined whether the target flag value corresponding to the second target flag type of the target certificate is a preset value; If yes, the certificate imported into the server is considered to be a default certificate, and it is determined whether the target flag bit value corresponding to the third target flag bit type of the target certificate is a preset value; If yes, the default certificate imported into the server is considered to be effective, and the historical default certificate stored in the storage device is queried and the historical default certificate is deleted; Obtain the default certificate imported into the server, store the default certificate imported into the server in a storage device, further determine whether the default certificate imported into the server is valid, and if valid, consider the verification result to be successful, load the default certificate imported into the server, so that the default certificate imported into the server takes effect.

[0011] In one of the embodiments, determining whether the target flag bit value corresponding to the second target flag bit type of the target certificate is a preset value further includes: If the target flag bit value corresponding to the second target flag bit type of the target certificate is a non-preset value, traverse the client certificates imported into the server to determine whether the client certificates include an advanced key certificate; If included, determine whether the client certificate including the advanced key certificate is valid; If invalid, re-import the certificate. The re-imported certificates include advanced key certificates, exchange key certificates, trusted signature database certificates, and untrusted signature database certificates.

[0012] In one embodiment, the method further comprises: In response to the completion of re-importing the certificate, determining whether a target flag bit value corresponding to a fourth target flag bit type of the target certificate is less than or equal to a preset threshold; If yes, it is considered that the number of client certificates imported into the server meets the requirement, and further determines whether the target flag bit value corresponding to the fifth target flag bit type of the target certificate is a preset value; If so, it is considered that the server has completed importing the certificate. In response to the server completing importing the certificate, the verification result is determined to be successful.

[0013] In one embodiment, the method further comprises: Calculate a first hash value of the target certificate that is not imported into the server and a second hash value of the target certificate that is imported into the server; Determine whether the first hash value and the second hash value are consistent; If they are consistent, the data table of the target certificate is obtained; If they are inconsistent, the target certificate imported into the server is deleted, and the target certificate is re-imported into the server based on the preset interface.

[0014] In one embodiment, the method further includes: obtaining a server signing certificate, wherein obtaining the server signing certificate includes: Generate a key pair based on a random function; Generate a target data set based on the identity encryption algorithm, key pair, server information, and client information; The target dataset is sent to a certificate issuing authority, which builds a server-signed certificate based on the target dataset.

[0015] In one embodiment, the method further includes: obtaining server signature certificate information, and calculating server summary information using a summary algorithm and the server signature certificate information; Encode the server summary information to obtain a server identifier, where the server identifier is a string consisting of the server summary code and preset symbols; The server unique identification code is obtained, the similarity between the server unique identification code and the server identification is calculated to obtain a similarity value, and the server signature certificate information is verified based on the server similarity value.

[0016] In order to solve the above technical problem, in a second aspect, a computer program product is provided, including a computer program, characterized in that when the computer program is executed by a processor, the steps of the method described in the first aspect are implemented.

[0017] In order to solve the above technical problem, in the third aspect, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program: the processor implements the steps of the method described in the first aspect when executing the computer program.

[0018] In order to solve the above technical problem, in a fourth aspect, the present application provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the method described in the first aspect are implemented.

[0019] Different from the prior art, the present application imports the target certificate into the server based on a preset interface, and the preset interface is an interface supported by the baseboard management controller; classifies the target certificate based on a preset interaction protocol to obtain a classified target certificate; encrypts the classified target certificate to obtain an encrypted target certificate, and stores the encrypted target certificate in a preset shared area; verifies the target certificate stored in the preset shared area based on the data table of the target certificate to obtain a verification result, and the data table of the target certificate includes a corresponding relationship between the target flag bit type, the target flag bit value, and the verification status; in response to the verification result being a successful verification, restarts the server to make the target certificate effective. By judging to import the target certificate into the server using the preset interface, the efficiency of importing the target certificate can be improved, and the target certificate can be verified through the data table of the target certificate to make the successfully verified target certificate effective, so that the target certificate management can be performed accurately and efficiently. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 A schematic diagram of a flow chart of a certificate management method in an embodiment; Figure 2 is a flow chart of a certificate management method in another embodiment; Figure 3 is a structural block diagram of a certificate management device in one embodiment; Figure 4 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0022] In view of the above technical problems, in one embodiment, Figure 1 As shown, the present application provides a certificate management method, which specifically includes the following steps: Step 101: importing a target certificate into a server based on a preset interface, where the preset interface is an interface supported by a baseboard management controller.

[0023] Specifically, the target certificate can be a user certificate or a default certificate, and the preset interface can be a redfish interface, which can connect the managed device and the management terminal through the network. The management terminal can be a server management software, a browser, etc. The management terminal sends an HTTP request to the redfish interface of the baseboard management controller. The baseboard management controller performs the corresponding management operation according to the request and returns the result in JSON or XML format. By using the preset interface to import the target certificate, the certificates can be imported in batches to improve the efficiency of certificate import.

[0024] It should be noted that the redfish interface is an interface supported by the baseboard management controller. The baseboard management controller needs to import a new program in redfish to support the import of the target certificate. If you want to use other types of interfaces to implement the import of the target certificate, you need to import other types of interface programs in the baseboard management controller and import the target certificate import program in the new interface program before you can import the target certificate.

[0025] In one embodiment, the target certificate is imported into the server based on a preset interface, and the preset interface is an interface supported by the baseboard management controller, and it also includes: the preset interface receives the server signature certificate information and the target identification code, and the target identification code is the identification code of the import instruction corresponding to the import of the target certificate into the server based on the preset interface; authentication is performed based on the server signature certificate information and the target identification code to obtain an authentication result; if the authentication result is authentication passed, the target certificate is imported into the server based on the preset interface, and the preset interface is an interface supported by the baseboard management controller.

[0026] Specifically, the server signature certificate information can be a certificate sent by a trusted party to the server, which can be used to authenticate the user registry configured on the server. After the server containing the certificate receives the request, the server needs to log in to form a credential. This credential is used for authorization. Signature authentication can be configured on the server.

[0027] In one embodiment, a key pair can be generated based on a random function, and a target data set can be generated from the key pair, server information, and client information using an identification encryption algorithm such as SM9. For example, feature points can be extracted from the key pair, server information, and client information, and then a univariate equation can be constructed using the feature points as coefficients to obtain calculated values ​​of unknowns in the univariate equation with different numerical values. The target data set is then constructed using these values, and the target data set containing the key pair, server information, and client information features is sent to a certificate issuing authority to obtain a server signature certificate. The target identification code can be an identifier for authenticating an import instruction corresponding to an interface that imports a target certificate into a server based on a preset interface, and the preset interface is an interface supported by a baseboard management controller. It can be composed of a certain number of characters, and this application does not specifically limit the form of the identifier.

[0028] The binary server summary information can be calculated based on the server signature certificate information and the summary algorithm, and the server summary information can be encoded using Base32, and the binary server summary information can be encoded into a string to obtain the server identifier. Any calculation symbol can be imported at the end of the server identifier to form a string. The unique identification code of the server is obtained. The unique identification code of the server can be the production number of the server. The similarity between the unique identification code of the server and the server identifier is calculated to obtain a similarity value. The server signature certificate information is verified based on the server similarity value. Generally, the server with a similarity value greater than the preset similarity value is regarded as a trusted server, and the target certificate is imported. The preset similarity value here can be set based on experience, and this application does not limit the specific value of the preset similarity value.

[0029] Based on the target identification code, the target certificate is imported into the server based on the preset interface. The preset interface is an interface supported by the baseboard management controller and the corresponding import instruction is authenticated. The target identification code is compared with the preset trusted identification code, and the credibility of the import instruction is authenticated. When the import instruction and the server are both credible, the authentication result is displayed as authentication passed. The target certificate is then imported into the server based on the preset interface. The preset interface is an interface supported by the baseboard management controller. In this way, the reliability of the certificate import can be improved.

[0030] In one embodiment, the feasible server signature certificate information may be a server of a trusted server. Step 102: classify the target certificates based on a preset interaction protocol to obtain classified target certificates.

[0031] Specifically, a preset interaction protocol is obtained, and the preset interaction protocol includes the address of a preset shared area corresponding to the type of target certificate pre-agreed between the baseboard management controller and the basic input / output system; the target certificate is classified based on the type of target certificate pre-agreed between the baseboard management controller and the basic input / output system to obtain the classified target certificate. The preset shared area here is the address where different types of target certificates specified by the baseboard management controller and the basic input / output system are stored in the preset shared area. Exemplarily, the target certificate may include an advanced key certificate, an exchange key certificate, and the like. The storage location and import order of the advanced key certificate and the exchange key certificate may be specified in the preset interaction protocol to facilitate the subsequent reading and loading of the target certificate.

[0032] Step 103: encrypt the classified target certificate to obtain an encrypted target certificate, and store the encrypted target certificate in a preset shared area.

[0033] Specifically, the target certificate information of the classified target certificate is obtained, and the target certificate information of the classified target certificate is encrypted based on a preset algorithm to obtain a first secret key; a random number of a preset length is selected from the first secret key based on a random function to generate a second secret key; the second secret key is inserted into the first secret key based on the first rule to obtain secret key data, and the secret key data is obfuscated based on the second rule to obtain the target certificate key of the classified target certificate; the classified target certificate is encrypted based on the target certificate key of the classified target certificate to obtain the encrypted target certificate, and the encrypted target certificate and the target certificate key are stored in a preset shared area.

[0034] Exemplarily, after classifying the target certificates according to the types of the target certificates, the preset algorithms may include a first algorithm and a second algorithm. The first algorithm may be to apply an encryption algorithm to encrypt the target certificate information of each type of target certificate after classification, respectively, to obtain multiple sub-keys, and then integrate the multiple sub-keys to obtain a first secret key; the second algorithm may be to apply an encryption algorithm to first integrate the target certificate information of each type of target certificate after classification, to obtain integrated target certificate information, and then encrypt the integrated target certificate information to obtain the first secret key. The encryption algorithm in this implementation may include one or a combination of several of symmetric encryption, asymmetric encryption, hash algorithm, and digital signature.

[0035] After obtaining the first secret key, the characters in the first secret key of a preset length can be selected based on a random function to generate a second secret key. The preset length can be set according to actual conditions, and this application does not limit the specific value of the preset length. The first rule can be to divide the second secret key into multiple sub-second secret keys, and randomly insert the multiple sub-second secret keys into the first secret key to obtain the secret key data, and the arrangement order of the characters in the first secret key and the second secret key is the first rule.

[0036] The second rule is the obfuscation rule. The key data can be divided in advance to obtain multiple sub-key data. Each sub-key data in the multiple sub-key data is byte-flipped so that the first byte and the second byte of each sub-key data are swapped to generate multiple flipped key files. Each character in each flipped key file is subjected to an OR operation to obtain multiple sub-obfuscation files, and the target certificate key corresponding to each classified target certificate is obtained. In this way, the security of target certificate management is improved.

[0037] Each classified target certificate is encrypted based on the target certificate secret key corresponding to each classified target certificate to obtain the encrypted target certificate, and the encrypted target certificate and the target certificate secret key are stored in a preset shared area.

[0038] In one embodiment, encrypting each classified target certificate to obtain the encrypted target certificate may include: obtaining characteristic information of each classified target certificate, constructing target certificate encryption file header information based on the characteristic information of each classified target certificate, and encrypting each classified target certificate according to the encrypted file header information to obtain the encrypted target certificate.

[0039] For example, a feature extraction algorithm can be used to extract features from each classified target certificate to obtain feature information of each classified target certificate, and hash calculations can be performed on the feature information of each classified target certificate to obtain a hash value of each classified target certificate. The hash value of each classified target certificate can be concatenated according to the storage location to form encrypted file header information of the target certificate, and then each classified target certificate can be encrypted based on the encrypted file header information to obtain an encrypted target certificate. In this way, each classified target certificate can be encrypted in combination with the features of the target certificate, which can improve the security of target certificate management.

[0040] The preset shared area includes a key storage area and a target certificate storage area. The type of the encrypted target certificate is obtained, and the target certificate storage area corresponding to the type of the encrypted target certificate that matches the type of the target certificate pre-agreed between the baseboard management controller and the basic input and output system is obtained from the preset interaction protocol, and the encrypted certificate is stored in the target certificate storage area; a corresponding relationship between the target certificate storage area and the key storage area is established, and the target certificate key is stored in the key storage area.

[0041] Step 104, based on the data table of the target certificate, the target certificate stored in the preset shared area is verified to obtain a verification result, wherein the data table of the target certificate includes a correspondence between a target flag bit type, a target flag bit value, and a verification status.

[0042] Specifically, the target certificate can be determined from the preset shared area, and obtaining the data table of the target certificate includes: obtaining the target certificate key corresponding to the target certificate from the preset shared area, deobfuscating the target certificate key corresponding to the target certificate based on the second rule to obtain the key data, and decrypting the key data based on the first rule to obtain the verification data; obtaining the first key and the second key, and determining whether the first key and the second key are consistent with the verification data; if they are consistent, obtaining the data table of the target certificate from the preset shared area; if they are inconsistent, returning an empty target certificate data table.

[0043] This embodiment is a process of decrypting the encrypted target certificate, which is specifically the reverse operation of step 103, and will not be described in detail here. After decryption, verification data is obtained, and then the verification data obtained in the decryption process is compared with the first secret key and the second secret key in the encryption process. If the comparison result is consistent, the data table of the target certificate is directly obtained from the preset shared area. If it is inconsistent, an empty data table of the target certificate is returned, and the empty data table of the target certificate is unusable.

[0044] After obtaining the data table of the target certificate, the target certificate can be verified according to the data table of the target certificate. The data table of the target certificate may include a plurality of target flag bit types, a plurality of target flag bit values, and a correspondence between a plurality of verification states. Specifically: the data table of the target certificate is parsed to determine whether the target flag bit value corresponding to the first target flag bit type of the target certificate is a preset value; the first target flag bit type can be represented as (CerFlag), which is a certificate import flag bit. The target flag bit value of the first target flag bit type can represent the import state of the target certificate. For example, when the target flag bit value of the first target flag bit type is a preset value, it is considered that there is a certificate imported into the server, and the subsequent verification process continues. If the target flag bit value of the first target flag bit type is a non-preset value, it is considered that the certificate has not been imported into the server, and the process directly jumps to the end step.

[0045] If the target flag bit value of the first target flag bit type is a preset value, it is considered that a certificate has been imported into the server, and it is further determined whether the target flag bit value corresponding to the second target flag bit type of the target certificate is a preset value. The second target flag bit type can be represented as (DefaultCerFlag), which is the default certificate import flag bit. The target flag bit value of the second target flag bit type can represent the import status of the default certificate. When the target flag bit value of the second target flag bit type is a preset value, it is considered that the default certificate has been imported into the server. If the target flag bit value of the second target flag bit type is a non-preset value, it is considered that the default certificate has not been imported into the server.

[0046] Specifically, if yes, the certificate imported into the server is considered to be the default certificate, and it is further determined whether the target flag bit value corresponding to the third target flag bit type of the target certificate is a preset value; if the target flag bit value corresponding to the third target flag bit type of the target certificate is not a preset value, the certificate imported into the server is deleted, and the certificate is re-imported. The re-imported certificate includes an advanced key certificate, an exchange key certificate, a trusted signature database certificate, and a non-trusted signature database certificate. The third target flag bit type can be expressed as (DefaultCerEnableFlag), which is a flag bit for enabling the import of the default certificate. The target flag bit value of the third target flag bit type can represent the effective state of the default certificate imported into the server. For example, when the target flag bit value of the third target flag bit type is a preset value, the effective state of the default certificate imported into the server is considered to be effective. If the target flag bit value of the third target flag bit type is a non-preset value, the effective state of the default certificate imported into the server is considered to be ineffective, and the process directly jumps to the end step.

[0047] If the target flag bit value of the third target flag bit type is the preset value, the default certificate imported into the server is considered to be effective, the historical default certificate stored in the storage device is queried, and the historical default certificate is deleted; the default certificate imported into the server is obtained, and the default certificate imported into the server is stored in the storage device; further determine whether the default certificate imported into the server is valid. If valid, the verification result is considered to be successful, and the default certificate imported into the server is loaded to make the default certificate imported into the server effective.

[0048] If the target flag bit value corresponding to the second target flag bit type of the target certificate is not a preset value, the client certificates imported into the server are traversed to determine whether the client certificates include an advanced key certificate; if included, whether the client certificates including the advanced key certificate are valid; if invalid, the certificates are re-imported, and the re-imported certificates include the advanced key certificate, the exchange key certificate, the trusted signature database certificate, and the untrusted signature database certificate.

[0049] In response to the completion of re-importing the certificate, determine whether the target flag bit value corresponding to the fourth target flag bit type of the target certificate is less than or equal to the preset threshold; if so, it is considered that the number of client certificates imported into the server meets the requirements, and further determine whether the target flag bit value corresponding to the fifth target flag bit type of the target certificate is a preset value; the fourth target flag bit type can be expressed as (CerNum), which is the flag bit for the number of imported client certificates. The target flag bit value of the fourth target flag bit type can represent the number of client certificates imported into the server, and the target flag bit value of the fourth target flag bit type can be compared with the preset threshold. When the target flag bit value corresponding to the fourth target flag bit type is less than or equal to the preset threshold, it is considered that the number of client certificates imported into the server meets the requirements. If the target flag bit value of the fourth target flag bit type is a non-preset value, it is considered that the number of client certificates imported into the server does not meet the requirements, and directly jump to the end step.

[0050] If the number of client certificates imported into the server meets the requirement, it is further determined whether the target flag bit value corresponding to the fifth target flag bit type of the target certificate is a preset value; the fifth target flag bit type can be expressed as (SucceedFlag), which is a flag bit for successful certificate import. The target flag bit value of the fifth target flag bit type can represent the completion status of the import of the target certificate. For example, when the target flag bit value of the fifth target flag bit type is a preset value, it is considered that the server has completed importing the certificate. The target certificate addition success flag bit can be set to a preset value to represent that all target certificates have been imported into the server and the process ends. If the target flag bit value of the fifth target flag bit type is a non-preset value, it is considered that the certificate in the server has not been imported, and the imported certificate is deleted, and the process jumps directly to the end step. Exemplarily, before importing the target certificate into the server, the certificate length or certificate volume of the target certificate to be imported into the server can be obtained. By comparing the length or volume of the target certificate before being imported into the server with the length or volume of the target certificate imported into the server, the completion status of the import of the certificate in the server can be obtained. If the target flag bit value of the fifth target flag bit type is not a preset value, it is considered that the server has completed importing the certificate. In response to the server completing importing the certificate, the verification result is determined to be successful.

[0051] In a specific implementation, the target flag type of the target certificate's data table and the verification status corresponding to the target flag value may be pre-set according to demand, and the specific value of the target flag may be obtained by obtaining the target certificate data by the basic input / output system when the target certificate is imported into the server. After the server imports the target certificate, the server obtains the target certificate's data table for verification when it is turned on.

[0052] For example, the data table of the target certificate may be as shown in Table 1 below:

[0053] Table 1 In order to better illustrate the certificate management method provided by the present application, in a specific implementation, combined with Table 1 and Figure 2 Describing the certificate management method, this application Table 1 is described using the preset value as 1 and the non-preset value as 0 as an example. The preset value can be any number or character, and the non-preset value is any number or character other than the preset value. This application does not limit the specific values ​​of the preset value and non-preset value.

[0054] When the server is started, the data table of the target certificate is obtained ( Figure 2 ), as can be seen from Table 1, if the certificate import flag CerFlag is equal to 1, the default certificate import flag is further verified; if CerFlag is equal to 0, the certificate import program is directly exited (i.e., whether a certificate is imported). When DefaultCerFlag is equal to 1, the default certificate verification, deletion and replacement process can be executed. After the replacement is completed, the DefaultCerEnableFlag flag is further checked. If DefaultCerEnableFlag is equal to 1, the parsing and loading operations of the default certificate package are executed, and the relevant options of the interface are modified to display correctly. (That is, by reading the default certificate flag, it is determined whether the imported certificate in the server is the default certificate) The default certificate is usually an OEM certificate. The various types of certificates to be imported will be packaged into an integral certificate in advance, and the overall replacement will be performed when the new default certificate is imported. If DefaultCerFlag is equal to 0, the client certificate import process is executed. Traverse all client certificates and verify whether the number of certificates is equal to CerNum. If they are not equal, exit the import process. If they are equal, check whether there is an advanced key certificate (PK). If there is an advanced key certificate, delete the certificate in use (it may be the default certificate loaded or the certificate previously imported by the customer, which can also be understood as a historical certificate, that is, to determine the effectiveness of the default certificate imported into the server). Then import the advanced key certificate, exchange key certificate (KEK), trusted signature database certificate (DB) and untrusted signature database certificate (DBX) certificates in sequence. (That is, to determine whether the number of client certificates imported into the server meets the requirements) Finally, check whether all certificates are imported (that is, to determine the import completion status of the target certificate). If there is a failure in the certificate import, delete the imported certificate and exit the import program.

[0055] In the present application, the target certificate import and import status are managed by setting up a multi-level data table of the target certificate containing the correspondence between the target flag bit type, the target flag bit value and the verification status, and the information applied to the target certificate management is pre-set in the data table of the target certificate, so that the required data can be quickly obtained for the subsequent management of the target certificate, which can improve the efficiency of target management, and the multi-level judgment can improve the management accuracy.

[0056] Step 105: In response to the verification result being successful, restart the server to make the target certificate effective.

[0057] When the verification result is successful, the server is automatically restarted to make the certificate imported into the server and verified to take effect.

[0058] In one embodiment, a first hash value of a target certificate that has not been imported into the server and a second hash value of a target certificate that has been imported into the server are calculated; a determination is made as to whether the first hash value and the second hash value are consistent; if they are consistent, a data table of the target certificate is obtained; if they are inconsistent, the target certificate that has been imported into the server is deleted, and the target certificate is re-imported into the server based on a preset interface, where the preset interface is an interface supported by a baseboard management controller.

[0059] The first hash value of the target certificate will be calculated before the target certificate is imported into the server. After the target certificate is imported into the server, the second hash value of the target certificate imported into the server will be calculated. The first hash value and the second hash value are used to verify that there is no error data after the certificate is transferred. At the same time, the storage location of the next certificate of the same type is calculated by the certificate length.

[0060] By updating the default certificate through the redfish interface of the baseboard management controller, the certificate can be updated for the customer in time. When the key certificate is leaked, the new default certificate can also be quickly replaced for the customer. By importing the customer certificate through the redfish interface of the baseboard management controller, the tedious and time-consuming work of importing certificates from storage devices such as external storage devices is eliminated. The certificates can be imported in batches with redfish and quickly deployed to all the customer's servers. The present invention can also provide certificate customization services for server customers with higher security requirements, customize certificates for each server, and each device has a unique key certificate, which greatly improves the security of the device.

[0061] It should be understood that although Figure 1-Figure 2 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 1-Figure 2At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0062] In one embodiment, Figure 3 As shown, a certificate management device is provided, including: an acquisition module 30, an encryption module 31 and a verification module 32, wherein: The acquisition module 30 is used to import the target certificate into the server based on a preset interface, where the preset interface is an interface supported by the baseboard management controller; and classify the target certificate based on a preset interaction protocol to obtain the classified target certificate.

[0063] The encryption module 31 is used to encrypt the classified target certificates to obtain the encrypted target certificates, and store the encrypted target certificates in a preset shared area.

[0064] The verification module 32 is used to verify the target certificate stored in the preset shared area based on the data table of the target certificate to obtain a verification result. The data table of the target certificate includes the correspondence between the target flag bit type, the target flag bit value and the verification status; in response to the verification result being a successful verification, the server is restarted to make the target certificate effective.

[0065] In one embodiment, the above device can implement another implementation of the certificate management method, and the specific steps are as follows: Import the target certificate into the server based on the preset interface. The preset interface is the interface supported by the baseboard management controller, which also includes: The preset interface receives the server signature certificate information and the target identification code, where the target identification code is the identification code of the import instruction corresponding to importing the target certificate into the server based on the preset interface; Perform authentication based on the server signature certificate information and the target identification code to obtain an authentication result; If the authentication result is authentication passed, the target certificate is imported into the server based on a preset interface, where the preset interface is an interface supported by the baseboard management controller.

[0066] In one embodiment, the above device can implement another implementation of the certificate management method, and the specific steps are as follows: The target certificates are classified based on the preset interaction protocol, and the classified target certificates include: Acquire a preset interaction protocol, where the preset interaction protocol includes an address of a preset shared area corresponding to a type of a target certificate pre-agreed between the baseboard management controller and the basic input / output system; The target certificates are classified based on the type of the target certificates pre-agreed between the baseboard management controller and the basic input / output system to obtain the classified target certificates.

[0067] In one embodiment, the above device can implement another implementation of the certificate management method, and the specific steps are as follows: Encrypting the classified target certificate to obtain the encrypted target certificate, and storing the encrypted target certificate in the preset shared area includes: Obtain target certificate information of the classified target certificate, and encrypt the target certificate information of the classified target certificate based on a preset algorithm to obtain a first secret key; Selecting a random number of a preset length from the first secret key based on a random function to generate a second secret key; Inserting the second key into the first key based on the first rule to obtain key data, and obfuscating the key data based on the second rule to obtain a target certificate key of the classified target certificate; The classified target certificate is encrypted based on the target certificate secret key of the classified target certificate to obtain the encrypted target certificate, and the encrypted target certificate and the target certificate secret key are stored in a preset shared area.

[0068] In one embodiment, the above device can implement another implementation of the certificate management method, and the specific steps are as follows: The preset shared area includes a key storage area and a target certificate storage area. The encrypted target certificate and the target certificate key are stored in the preset shared area including: Obtaining the type of the encrypted target certificate, obtaining a target certificate storage area corresponding to the type of the encrypted target certificate that matches the type of the target certificate pre-agreed between the baseboard management controller and the basic input and output system from a preset interaction protocol, and storing the encrypted certificate in the target certificate storage area; Establish a correspondence between the target certificate storage area and the key storage area, and store the target certificate key in the key storage area.

[0069] In one embodiment, the above device can implement another implementation of the certificate management method, and the specific steps are as follows: Determine the target certificate from the preset shared area, and obtain the target certificate data table including: Obtaining a target certificate key corresponding to the target certificate from a preset shared area, deobfuscating the target certificate key corresponding to the target certificate based on the second rule to obtain key data, and decrypting the key data based on the first rule to obtain verification data; Obtain the first secret key and the second secret key, and determine whether the first secret key and the second secret key are consistent with the verification data; If they are consistent, the data table of the target certificate is obtained from the preset shared area; If they are inconsistent, an empty target certificate data table is returned.

[0070] In one embodiment, the above device can implement another implementation of the certificate management method, and the specific steps are as follows: The target certificate is verified based on the data table of the target certificate, and the verification results include: Parse the data table of the target certificate to determine whether the target flag bit value corresponding to the first target flag bit type of the target certificate is a preset value; If yes, it is considered that there is a certificate imported into the server, and it is determined whether the target flag value corresponding to the second target flag type of the target certificate is a preset value; If yes, the certificate imported into the server is considered to be a default certificate, and it is determined whether the target flag bit value corresponding to the third target flag bit type of the target certificate is a preset value; If yes, the default certificate imported into the server is considered to be effective, and the historical default certificate stored in the storage device is queried and the historical default certificate is deleted; Obtain the default certificate imported into the server, store the default certificate imported into the server in a storage device, further determine whether the default certificate imported into the server is valid, and if valid, consider the verification result to be successful, load the default certificate imported into the server, so that the default certificate imported into the server takes effect.

[0071] In one embodiment, the above device can implement another implementation of the certificate management method, and the specific steps are as follows: Determining whether the target flag bit value corresponding to the second target flag bit type of the target certificate is a preset value also includes: If the target flag bit value corresponding to the second target flag bit type of the target certificate is a non-preset value, traverse the client certificates imported into the server to determine whether the client certificates include an advanced key certificate; If included, determine whether the client certificate including the advanced key certificate is valid; If invalid, re-import the certificate. The re-imported certificates include advanced key certificates, exchange key certificates, trusted signature database certificates, and untrusted signature database certificates.

[0072] In one embodiment, the above device can implement another implementation of the certificate management method, and the specific steps are as follows: The method also includes: In response to the completion of re-importing the certificate, determining whether a target flag bit value corresponding to a fourth target flag bit type of the target certificate is less than or equal to a preset threshold; If yes, it is considered that the number of client certificates imported into the server meets the requirement, and further determines whether the target flag bit value corresponding to the fifth target flag bit type of the target certificate is a preset value; If so, it is considered that the server has completed importing the certificate. In response to the server completing importing the certificate, the verification result is determined to be successful.

[0073] In one embodiment, the above device can implement another implementation of the certificate management method, and the specific steps are as follows: The method also includes: Calculate a first hash value of the target certificate that is not imported into the server and a second hash value of the target certificate that is imported into the server; Determine whether the first hash value and the second hash value are consistent; If they are consistent, the data table of the target certificate is obtained; If they are inconsistent, the target certificate imported into the server is deleted, and the target certificate is re-imported into the server based on a preset interface, where the preset interface is an interface supported by the baseboard management controller.

[0074] In one embodiment, the above device can implement another implementation of the certificate management method, and the specific steps are as follows: The method further includes obtaining a server signature certificate, and obtaining the server signature certificate includes: Generate a key pair based on a random function; Generate a target data set based on the identity encryption algorithm, key pair, server information, and client information; The target dataset is sent to a certificate issuing authority, which builds a server-signed certificate based on the target dataset.

[0075] In one embodiment, the above device can implement another implementation of the certificate management method, and the specific steps are as follows: The method also includes: Obtain the server signature certificate information, and calculate the server summary information using the summary algorithm and the server signature certificate information; Encode the server summary information to obtain a server identifier, where the server identifier is a string consisting of the server summary code and preset symbols; The server unique identification code is obtained, the similarity between the server unique identification code and the server identification is calculated to obtain a similarity value, and the server signature certificate information is verified based on the server similarity value.

[0076] For the specific definition of the certificate management device, please refer to the definition of the certificate management method above, which will not be repeated here. Each module in the above-mentioned certificate management device can be implemented in whole or in part by software, hardware and their combination. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0077] In one embodiment, the present application also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the certificate management methods provided by the above methods.

[0078] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 4 As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a certificate management method is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a key, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0079] Those skilled in the art will understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0080] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program: Step 101: importing a target certificate into a server based on a preset interface, where the preset interface is an interface supported by a baseboard management controller.

[0081] Step 102: classify the target certificates based on a preset interaction protocol to obtain classified target certificates.

[0082] Step 103: encrypt the classified target certificate to obtain an encrypted target certificate, and store the encrypted target certificate in a preset shared area.

[0083] Step 104, based on the data table of the target certificate, the target certificate stored in the preset shared area is verified to obtain a verification result, wherein the data table of the target certificate includes a correspondence between a target flag bit type, a target flag bit value, and a verification status.

[0084] Step 105: In response to the verification result being successful, restart the server to make the target certificate effective.

[0085] In one embodiment, when the processor executes the computer program, the processor further implements the following steps: Import the target certificate into the server based on the preset interface. The preset interface is the interface supported by the baseboard management controller, which also includes: The preset interface receives the server signature certificate information and the target identification code, where the target identification code is the identification code of the import instruction corresponding to importing the target certificate into the server based on the preset interface; Perform authentication based on the server signature certificate information and the target identification code to obtain an authentication result; If the authentication result is authentication passed, the target certificate is imported into the server based on a preset interface, where the preset interface is an interface supported by the baseboard management controller.

[0086] In one embodiment, when the processor executes the computer program, the processor further implements the following steps: The target certificates are classified based on the preset interaction protocol, and the classified target certificates include: Acquire a preset interaction protocol, where the preset interaction protocol includes an address of a preset shared area corresponding to a type of a target certificate pre-agreed between the baseboard management controller and the basic input / output system; The target certificates are classified based on the type of the target certificates pre-agreed between the baseboard management controller and the basic input / output system to obtain the classified target certificates.

[0087] In one embodiment, when the processor executes the computer program, the processor further implements the following steps: Encrypting the classified target certificate to obtain the encrypted target certificate, and storing the encrypted target certificate in the preset shared area includes: Obtain target certificate information of the classified target certificate, and encrypt the target certificate information of the classified target certificate based on a preset algorithm to obtain a first secret key; Selecting a random number of a preset length from the first secret key based on a random function to generate a second secret key; Inserting the second key into the first key based on the first rule to obtain key data, and obfuscating the key data based on the second rule to obtain a target certificate key of the classified target certificate; The classified target certificate is encrypted based on the target certificate secret key of the classified target certificate to obtain the encrypted target certificate, and the encrypted target certificate and the target certificate secret key are stored in a preset shared area.

[0088] In one embodiment, when the processor executes the computer program, the processor further implements the following steps: The preset shared area includes a key storage area and a target certificate storage area. The encrypted target certificate and the target certificate key are stored in the preset shared area including: Obtaining the type of the encrypted target certificate, obtaining a target certificate storage area corresponding to the type of the encrypted target certificate that matches the type of the target certificate pre-agreed between the baseboard management controller and the basic input and output system from a preset interaction protocol, and storing the encrypted certificate in the target certificate storage area; Establish a correspondence between the target certificate storage area and the key storage area, and store the target certificate key in the key storage area.

[0089] In one embodiment, when the processor executes the computer program, the processor further implements the following steps: Determine the target certificate from the preset shared area, and obtain the target certificate data table including: Obtaining a target certificate key corresponding to the target certificate from a preset shared area, deobfuscating the target certificate key corresponding to the target certificate based on the second rule to obtain key data, and decrypting the key data based on the first rule to obtain verification data; Obtain the first secret key and the second secret key, and determine whether the first secret key and the second secret key are consistent with the verification data; If they are consistent, the data table of the target certificate is obtained from the preset shared area; If they are inconsistent, an empty target certificate data table is returned.

[0090] In one embodiment, when the processor executes the computer program, the processor further implements the following steps: The target certificate is verified based on the data table of the target certificate, and the verification results include: Parse the data table of the target certificate to determine whether the target flag bit value corresponding to the first target flag bit type of the target certificate is a preset value; If yes, it is considered that there is a certificate imported into the server, and it is determined whether the target flag value corresponding to the second target flag type of the target certificate is a preset value; If yes, the certificate imported into the server is considered to be a default certificate, and it is determined whether the target flag bit value corresponding to the third target flag bit type of the target certificate is a preset value; If yes, the default certificate imported into the server is considered to be effective, and the historical default certificate stored in the storage device is queried and the historical default certificate is deleted; Obtain the default certificate imported into the server, store the default certificate imported into the server in a storage device, further determine whether the default certificate imported into the server is valid, and if valid, consider the verification result to be successful, load the default certificate imported into the server, so that the default certificate imported into the server takes effect.

[0091] In one embodiment, when the processor executes the computer program, the processor further implements the following steps: Determining whether the target flag bit value corresponding to the second target flag bit type of the target certificate is a preset value also includes: If the target flag bit value corresponding to the second target flag bit type of the target certificate is a non-preset value, traverse the client certificates imported into the server to determine whether the client certificates include an advanced key certificate; If included, determine whether the client certificate including the advanced key certificate is valid; If invalid, re-import the certificate. The re-imported certificates include advanced key certificates, exchange key certificates, trusted signature database certificates, and untrusted signature database certificates.

[0092] In one embodiment, when the processor executes the computer program, the processor further implements the following steps: The method also includes: In response to the completion of re-importing the certificate, determining whether a target flag bit value corresponding to a fourth target flag bit type of the target certificate is less than or equal to a preset threshold; If yes, it is considered that the number of client certificates imported into the server meets the requirement, and further determines whether the target flag bit value corresponding to the fifth target flag bit type of the target certificate is a preset value; If so, it is considered that the server has completed importing the certificate. In response to the server completing importing the certificate, the verification result is determined to be successful.

[0093] In one embodiment, when the processor executes the computer program, the processor further implements the following steps: The method also includes: Calculate a first hash value of the target certificate that is not imported into the server and a second hash value of the target certificate that is imported into the server; Determine whether the first hash value and the second hash value are consistent; If they are consistent, the data table of the target certificate is obtained; If they are inconsistent, the target certificate imported into the server is deleted, and the target certificate is re-imported into the server based on a preset interface, where the preset interface is an interface supported by the baseboard management controller.

[0094] In one embodiment, when the processor executes the computer program, the processor further implements the following steps: The method further includes obtaining a server signature certificate, and obtaining the server signature certificate includes: Generate a key pair based on a random function; Generate a target data set based on the identity encryption algorithm, key pair, server information, and client information; The target dataset is sent to a certificate issuing authority, which builds a server-signed certificate based on the target dataset.

[0095] In one embodiment, when the processor executes the computer program, the processor further implements the following steps: The method also includes: Obtain the server signature certificate information, and calculate the server summary information using the summary algorithm and the server signature certificate information; Encode the server summary information to obtain a server identifier, where the server identifier is a string consisting of the server summary code and preset symbols; The server unique identification code is obtained, the similarity between the server unique identification code and the server identification is calculated to obtain a similarity value, and the server signature certificate information is verified based on the server similarity value.

[0096] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented: Step 101: importing a target certificate into a server based on a preset interface, where the preset interface is an interface supported by a baseboard management controller.

[0097] Step 102: classify the target certificates based on a preset interaction protocol to obtain classified target certificates.

[0098] Step 103: encrypt the classified target certificate to obtain an encrypted target certificate, and store the encrypted target certificate in a preset shared area.

[0099] Step 104, based on the data table of the target certificate, the target certificate stored in the preset shared area is verified to obtain a verification result, wherein the data table of the target certificate includes a correspondence between a target flag bit type, a target flag bit value, and a verification status.

[0100] Step 105: In response to the verification result being successful, restart the server to make the target certificate effective.

[0101] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented: Import the target certificate into the server based on the preset interface. The preset interface is the interface supported by the baseboard management controller, which also includes: The preset interface receives the server signature certificate information and the target identification code, where the target identification code is the identification code of the import instruction corresponding to importing the target certificate into the server based on the preset interface; Perform authentication based on the server signature certificate information and the target identification code to obtain an authentication result; If the authentication result is authentication passed, the target certificate is imported into the server based on a preset interface, where the preset interface is an interface supported by the baseboard management controller.

[0102] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented: The target certificates are classified based on the preset interaction protocol, and the classified target certificates include: Acquire a preset interaction protocol, where the preset interaction protocol includes an address of a preset shared area corresponding to a type of a target certificate pre-agreed between the baseboard management controller and the basic input / output system; The target certificates are classified based on the type of the target certificates pre-agreed between the baseboard management controller and the basic input / output system to obtain the classified target certificates.

[0103] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented: Encrypting the classified target certificate to obtain the encrypted target certificate, and storing the encrypted target certificate in the preset shared area includes: Obtain target certificate information of the classified target certificate, and encrypt the target certificate information of the classified target certificate based on a preset algorithm to obtain a first secret key; Selecting a random number of a preset length from the first secret key based on a random function to generate a second secret key; Inserting the second key into the first key based on the first rule to obtain key data, and obfuscating the key data based on the second rule to obtain a target certificate key of the classified target certificate; The classified target certificate is encrypted based on the target certificate secret key of the classified target certificate to obtain the encrypted target certificate, and the encrypted target certificate and the target certificate secret key are stored in a preset shared area.

[0104] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented: The preset shared area includes a key storage area and a target certificate storage area. The encrypted target certificate and the target certificate key are stored in the preset shared area including: Obtaining the type of the encrypted target certificate, obtaining a target certificate storage area corresponding to the type of the encrypted target certificate that matches the type of the target certificate pre-agreed between the baseboard management controller and the basic input and output system from a preset interaction protocol, and storing the encrypted certificate in the target certificate storage area; Establish a correspondence between the target certificate storage area and the key storage area, and store the target certificate key in the key storage area.

[0105] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented: Determine the target certificate from the preset shared area, and obtain the target certificate data table including: Obtaining a target certificate key corresponding to the target certificate from a preset shared area, deobfuscating the target certificate key corresponding to the target certificate based on the second rule to obtain key data, and decrypting the key data based on the first rule to obtain verification data; Obtain the first secret key and the second secret key, and determine whether the first secret key and the second secret key are consistent with the verification data; If they are consistent, the data table of the target certificate is obtained from the preset shared area; If they are inconsistent, an empty target certificate data table is returned.

[0106] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented: The target certificate is verified based on the data table of the target certificate, and the verification results include: Parse the data table of the target certificate to determine whether the target flag bit value corresponding to the first target flag bit type of the target certificate is a preset value; If yes, it is considered that there is a certificate imported into the server, and it is determined whether the target flag value corresponding to the second target flag type of the target certificate is a preset value; If yes, the certificate imported into the server is considered to be a default certificate, and it is determined whether the target flag bit value corresponding to the third target flag bit type of the target certificate is a preset value; If yes, the default certificate imported into the server is considered to be effective, and the historical default certificate stored in the storage device is queried and the historical default certificate is deleted; Obtain the default certificate imported into the server, store the default certificate imported into the server in a storage device, further determine whether the default certificate imported into the server is valid, and if valid, consider the verification result to be successful, load the default certificate imported into the server, so that the default certificate imported into the server takes effect.

[0107] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented: Determining whether the target flag bit value corresponding to the second target flag bit type of the target certificate is a preset value also includes: If the target flag bit value corresponding to the second target flag bit type of the target certificate is a non-preset value, traverse the client certificates imported into the server to determine whether the client certificates include an advanced key certificate; If included, determine whether the client certificate including the advanced key certificate is valid; If invalid, re-import the certificate. The re-imported certificates include advanced key certificates, exchange key certificates, trusted signature database certificates, and untrusted signature database certificates.

[0108] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented: The method also includes: In response to completion of re-importing the certificate, determining whether a target flag bit value corresponding to a fourth target flag bit type of the target certificate is less than or equal to a preset threshold; If yes, it is considered that the number of client certificates imported into the server meets the requirement, and further determines whether the target flag bit value corresponding to the fifth target flag bit type of the target certificate is a preset value; If so, it is considered that the server has completed importing the certificate. In response to the server completing importing the certificate, the verification result is determined to be successful.

[0109] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented: The method also includes: Calculate a first hash value of the target certificate that is not imported into the server and a second hash value of the target certificate that is imported into the server; Determine whether the first hash value and the second hash value are consistent; If they are consistent, the data table of the target certificate is obtained; If they are inconsistent, the target certificate imported into the server is deleted, and the target certificate is re-imported into the server based on a preset interface, where the preset interface is an interface supported by the baseboard management controller.

[0110] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented: The method further includes obtaining a server signature certificate, and obtaining the server signature certificate includes: Generate a key pair based on a random function; Generate a target data set based on the identity encryption algorithm, key pair, server information, and client information; The target dataset is sent to a certificate issuing authority, which builds a server-signed certificate based on the target dataset.

[0111] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented: The method also includes: Obtain the server signature certificate information, and calculate the server summary information using the summary algorithm and the server signature certificate information; Encode the server summary information to obtain a server identifier, where the server identifier is a string consisting of the server summary code and preset symbols; The server unique identification code is obtained, the similarity between the server unique identification code and the server identification is calculated to obtain a similarity value, and the server signature certificate information is verified based on the server similarity value.

[0112] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0113] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0114] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application.

Claims

1. A certificate management method, characterized in that: include: Importing the target certificate into the server based on a preset interface, where the preset interface is an interface supported by the baseboard management controller; Classifying the target certificates based on a preset interaction protocol to obtain the classified target certificates; Encrypting the classified target certificate to obtain an encrypted target certificate, and storing the encrypted target certificate in a preset shared area; Verify the target certificate stored in the preset shared area based on the data table of the target certificate to obtain a verification result, wherein the data table of the target certificate includes a corresponding relationship between a target flag bit type, a target flag bit value, and a verification status; In response to the verification result being successful, the server is restarted to make the target certificate effective.

2. The method according to claim 1, characterized in that Before importing the target certificate into the server based on the preset interface, the method further includes: The preset interface receives the server signature certificate information and the target identification code, where the target identification code is an identification code of an import instruction corresponding to importing the target certificate into the server based on the preset interface; Perform authentication based on the server signature certificate information and the target identification code to obtain an authentication result; If the authentication result is authentication passed, the target certificate is imported into the server based on the preset interface.

3. The method according to claim 1, characterized in that The target certificates are classified based on the preset interaction protocol, and the classified target certificates include: Acquire a preset interaction protocol, wherein the preset interaction protocol includes an address of a preset shared area corresponding to a type of a target certificate pre-agreed between a baseboard management controller and a basic input / output system; The target certificates are classified based on the type of the target certificates pre-agreed between the baseboard management controller and the basic input / output system to obtain the classified target certificates.

4. The method according to claim 1, characterized in that: Encrypting the classified target certificate to obtain the encrypted target certificate, and storing the encrypted target certificate in a preset shared area includes: Obtain target certificate information of the classified target certificate, and encrypt the target certificate information of the classified target certificate based on a preset algorithm to obtain a first secret key; Selecting a random number of a preset length from the first secret key based on a random function to generate a second secret key; Inserting the second key into the first key based on the first rule to obtain key data, and obfuscating the key data based on the second rule to obtain a target certificate key of the classified target certificate; The classified target certificate is encrypted based on the target certificate secret key of the classified target certificate to obtain an encrypted target certificate, and the encrypted target certificate and the target certificate secret key are stored in a preset shared area.

5. The method according to claim 4, characterized in that The preset shared area includes a key storage area and a target certificate storage area, and storing the encrypted target certificate and the target certificate key in the preset shared area includes: Obtaining the type of the encrypted target certificate, obtaining a target certificate storage area corresponding to the type of the encrypted target certificate that matches the type of the target certificate pre-agreed between the baseboard management controller and the basic input and output system from a preset interaction protocol, and storing the encrypted certificate in the target certificate storage area; A correspondence between a target certificate storage area and a key storage area is established, and the target certificate key is stored in the key storage area.

6. The method according to claim 1, characterized in that Determining a target certificate from the preset shared area, and obtaining a data table of the target certificate includes: Obtaining a target certificate key corresponding to the target certificate from a preset shared area, deobfuscating the target certificate key corresponding to the target certificate based on the second rule to obtain key data, and decrypting the key data based on the first rule to obtain verification data; Obtaining a first key and a second key, and determining whether the first key and the second key are consistent with the verification data; If they are consistent, the data table of the target certificate is obtained from the preset shared area; If they are inconsistent, an empty target certificate data table is returned.

7. The method according to claim 1, characterized in that The target certificate is verified based on the data table of the target certificate to obtain the verification result, which includes: Parse the data table of the target certificate to determine whether the target flag bit value corresponding to the first target flag bit type of the target certificate is a preset value; If yes, it is considered that there is a certificate imported into the server, and it is determined whether the target flag value corresponding to the second target flag type of the target certificate is a preset value; If yes, the certificate imported into the server is considered to be a default certificate, and it is determined whether the target flag bit value corresponding to the third target flag bit type of the target certificate is a preset value; If yes, the default certificate imported into the server is deemed to be effective, and the historical default certificate stored in the storage device is queried, and the historical default certificate is deleted; Obtain the default certificate imported into the server, store the default certificate imported into the server in a storage device, further determine whether the default certificate imported into the server is valid, and if valid, consider the verification result to be successful, load the default certificate imported into the server, so that the default certificate imported into the server takes effect.

8. The method according to claim 7, characterized in that The step of determining whether the target flag bit value corresponding to the second target flag bit type of the target certificate is a preset value further includes: If the target flag bit value corresponding to the second target flag bit type of the target certificate is a non-preset value, traverse the client certificates imported into the server to determine whether the client certificates include an advanced key certificate; If included, determine whether the client certificate including the advanced key certificate is valid; If invalid, re-import the certificate, which includes the advanced key certificate, the exchange key certificate, the trusted signature database certificate and the untrusted signature database certificate.

9. The method according to claim 8, characterized in that The method further comprises: In response to the completion of re-importing the certificate, determining whether a target flag bit value corresponding to a fourth target flag bit type of the target certificate is less than or equal to a preset threshold; If yes, it is considered that the number of client certificates imported into the server meets the requirement, and further determines whether the target flag bit value corresponding to the fifth target flag bit type of the target certificate is a preset value; If so, it is considered that the server has completed importing the certificate. In response to the server completing importing the certificate, the verification result is determined to be successful.

10. The method according to claim 1, characterized in that The method further comprises: Calculate a first hash value of the target certificate that is not imported into the server and a second hash value of the target certificate that is imported into the server; Determine whether the first Hash value and the second Hash value are consistent; If they are consistent, the data table of the target certificate is obtained; If they are inconsistent, the target certificate imported into the server is deleted, and the target certificate is re-imported into the server based on the preset interface.

11. The method according to claim 2, characterized in that The method further includes obtaining a server signature certificate, wherein obtaining the server signature certificate includes: Generate a key pair based on a random function; Generate a target data set based on the identity encryption algorithm, key pair, server information, and client information; The target data set is sent to a certificate issuing authority, which constructs a server-signed certificate based on the target data set.

12. The method according to claim 11, characterized in that The method further comprises: Obtain the server signature certificate information, and calculate the server summary information using the summary algorithm and the server signature certificate information; Encode the server summary information to obtain a server identifier, where the server identifier is a character string consisting of a server summary code and preset symbols; The server unique identification code is obtained, the similarity between the server unique identification code and the server identification is calculated to obtain a similarity value, and the server signature certificate information is verified based on the server similarity value.

13. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 12 are implemented.

14. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 12 are implemented.

15. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 12 are implemented.

Images