Cross-domain identifier revocation method under wireless narrowband, electronic equipment and storage medium
The cross-domain identification revocation method optimizes bandwidth usage and security in wireless narrowband environments through a universal data structure, identifier classification, and incremental updates, addressing bandwidth and latency issues.
Patent Information
- Application Number
- CN202411313007.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-20
- Publication Date
- 2024-12-27
AI Technical Summary
Existing identification revocation methods in wireless narrowband environments face challenges with bandwidth limitations, device performance, and network latency, leading to increased operating costs, revocation delays, and reduced security due to varying data structures and lack of universal optimization.
A cross-domain identification revocation method is implemented with a universal identification data structure, classification of identifiers, certificate authentication for inter-domain recognition, and incremental list updates to reduce bandwidth consumption and enhance security.
The method reduces bandwidth consumption and latency while improving security by optimizing identification length, update frequency, and cross-domain recognition, ensuring efficient and secure revocation processes.
Smart Images
Figure CN119210731A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of identification revocation, and in particular to a cross-domain identification revocation method, electronic device and storage medium under wireless narrowband. Background Art
[0002] The Identifier Revocation List (IRL) is a list of all revoked identifiers published periodically by the identifier management system. When verifying an identifier, the client downloads the IRL and checks whether the identifier's serial number is in the list. In a wireless bandwidth environment, the design of the identifier revocation scheme needs to consider factors such as bandwidth limitations, device performance, and network latency.
[0003] Currently, the optimization of the identification revocation process is generally carried out from the following aspects:
[0004] 1. Set up your IRL publishing cycle
[0005] The IRL release cycle is set appropriately based on the frequency of identity revocation and the security requirements of the system. A cycle that is too short will increase the operating cost and download burden of the identity management system, while a cycle that is too long may increase the revocation delay and reduce the security of the system. The IRL release cycle is dynamically adjusted based on historical data and system load to balance security and performance.
[0006] 2. Incremental revocation list and segmented revocation list
[0007] The incremental revocation list only contains the identification information that has been revoked since the last baseline revocation list was published. Its size is much smaller than the complete revocation list, reducing the client's download burden and bandwidth consumption. The incremental revocation list can be published more frequently than the baseline revocation list, so as to reflect the latest revocation information in a timely manner and improve the security of the system.
[0008] Segmented revocation lists are used to split revocation lists into multiple smaller segments, each containing identification information within a specific range. Downloading specific revocation list segments on demand, rather than the entire revocation list, improves efficiency. Segmentation strategies can be designed based on factors such as identification common fields, identification types, or revocation reasons.
[0009] 3. Shortening of identification data structure
[0010] Currently, there is no universal data structure for the identification revocation list. The reason may be that the identification revocation list may be constructed in different ways for different requirements. Therefore, for the designed identification data structure, the length of the data structure is shortened according to the requirements.
[0011] For example, for the validity period field, the validity period is generally a time period, that is, from one time to another time, but the issuance time can be used as the start time, and only the end time can be set as the information of the validity period field, which effectively reduces the length of the field, shortens the identification data structure, and reduces bandwidth consumption. Summary of the invention
[0012] In view of factors such as bandwidth limitation, device performance and network delay, in order to reduce bandwidth consumption, update burden and revocation accuracy. The present invention provides a cross-domain identification revocation method, electronic device and storage medium under wireless narrowband, so as to optimize cross-domain identification revocation from aspects such as identification length, update frequency, cross-domain mutual recognition and revocation list update method. Design a universal identification data structure to reduce the length of the identification data structure; classify the identification, and for temporary identification, after each task is completed, it is directly revoked and no longer added to the revocation list, reducing the consumption of updating the revocation list; for the security of cross-domain revocation list update, certificate authentication is introduced, and when the inter-domain authentication is passed, the revocation list of other domains is updated; the incremental update method is adopted, and only the new revocation identification is updated by judging by the last update time, reducing bandwidth consumption. Through the above method, the efficiency and security of cross-domain identification revocation under wireless narrowband are improved.
[0013] The present invention provides a method for revoking a cross-domain identification under a wireless narrowband, comprising:
[0014] Design a universal identification data structure to reduce the length of the identification data structure;
[0015] Classify the identifiers. For temporary identifiers, they will be directly revoked after each task is completed and will not be added to the revocation list.
[0016] To ensure the security of cross-domain revocation list updates, certificate authentication is used to achieve inter-domain mutual recognition.
[0017] Perform identification revocation and update the revocation list, wherein the identification revocation list is updated in an incremental update manner for cross-domain revocation list updates.
[0018] Furthermore, the identification general data structure includes the following four fields:
[0019] The "Length" field indicates the length of the device's "Unique Number" field, which is used to distinguish different types of devices;
[0020] The "Unique Number" field indicates the unique number of the device, which is determined by the device's factory number or serial number;
[0021] The "Issuing Domain" field refers to the organizational domain that issued the ID to the device. The information in this field is determined by the issuing domain number;
[0022] The "Validity Period" field indicates the validity period of the device identification, that is, the usage period of the identification. If it does not exceed the validity period, it can be used; if it exceeds the valid value, it cannot be used.
[0023] Furthermore, the identification classification includes:
[0024] Long-term identification revocation: The identification validity period is used as the basis for revocation. If the identification exceeds the validity period, it will be directly revoked and will not be added to the revocation list. If it is used again after the expiration date, it is necessary to reapply for the identification; if it has not exceeded the validity period, it can continue to be used; if a device identification needs to be actively revoked, the device identification will be added to the revocation list;
[0025] Short-term identification revocation: For each task, an identification is issued to each device participating in the task, and a short validity period is set. At the end of each task, these devices will automatically expire and can no longer be used. They will not be added to the revocation list and will have to reapply for identification before the next task begins.
[0026] Furthermore, the use of certificate authentication to achieve inter-domain mutual recognition includes:
[0027] For mutual recognition between different domains, the PKI certificate authentication method is adopted to create a certificate certification authority CA and a certificate registration authority RA. The certificate certification authority CA, the certificate registration authority RA and the issuing domain are regarded as a PKI system to achieve mutual recognition between domains.
[0028] Furthermore, the inter-domain mutual recognition includes:
[0029] The issuing domain applies for a certificate from the CA. After verifying the true identity, the CA uses the issuing domain's public key and identity as the original message, hashes it to generate a digest, and encrypts it with the CA's private key to sign it. The digital signature, together with the certificate owner's public key and identity, constitutes a digital certificate.
[0030] After the digital certificates of each issuing domain are generated, if issuing domain A and issuing domain B recognize each other, issuing domain A sends the digital certificate to issuing domain B, and issuing domain B uses the CA's public key to decrypt the digital signature in the digital certificate to generate a message digest, hashes the digital certificate content to generate a digest, and proves the integrity and authenticity of the content by comparing the two digests, thereby achieving mutual recognition between domains.
[0031] Furthermore, after the identification is revoked, updating the revocation list includes:
[0032] (1) Update of the domain revocation list: If a device is revoked, the domain revocation list will add a new revocation identifier and update the time;
[0033] (2) Cross-domain revocation list update: When a domain wants to update its revocation list, it sends a revocation list update request to other domains, first performing mutual recognition between domains. Once the mutual recognition between domains is passed, an incremental update method is used to compare the revocation list update time. If the revocation list update time of the requesting domain is earlier than that of the requested domain, the revocation list of the requested domain in the requesting domain is updated; otherwise, the revocation list is not updated.
[0034] The present invention also provides an electronic device, comprising:
[0035] at least one processor; and a memory communicatively coupled to the at least one processor;
[0036] The memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the above method by executing the instructions stored in the memory.
[0037] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store instructions, and when the instructions are executed, the above method is implemented.
[0038] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:
[0039] 1. Low latency consumption. In the method of the present invention, in view of the limited transmission data size and rate in a wireless narrowband environment, the size of the universal data structure of the identifier is reduced, the revocation list is properly processed for different identifier validity periods, and redundant identifiers in the revocation list are removed. When the revocation list is updated, an incremental update is adopted, and only the identifiers revoked since the last release of the benchmark revocation list are updated. The size of the revocation list is much smaller than that of the complete revocation list, which reduces the download burden and bandwidth consumption.
[0040] 2. High security. In the method of the present invention, for cross-domain revocation list updates, in order to prevent attackers from imitating other issuing domains, unsafe identifiers are added to the domain, and the cross-domain security is improved through the domain mutual recognition based on certificate authentication to prevent spoofing attacks. BRIEF DESCRIPTION OF THE DRAWINGS
[0041] Figure 1 The present invention is a flowchart of a method for revoking a cross-domain identifier in a wireless narrowband environment.
[0042] Figure 2 Schematic diagram of the method for revoking long-term and short-term identification in an embodiment of the present invention.
[0043] Figure 3 Schematic diagram of a PKI system in an embodiment of the present invention.
[0044] Figure 4 The figure is a schematic diagram of a method for revoking an identification in an embodiment of the present invention.
[0045] Figure 5 Schematic diagram of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION
[0046] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.
[0047] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0048] Example
[0049] In view of factors such as bandwidth limitation, device performance and network delay, in order to reduce bandwidth consumption, update burden and revocation accuracy. The embodiment of the present invention provides a cross-domain identification revocation method, electronic device and storage medium under wireless narrowband to optimize cross-domain identification revocation from aspects such as identification length, update frequency, cross-domain mutual recognition and revocation list update method. Design a universal identification data structure to reduce the length of the identification data structure; classify the identification, and for temporary identification, after each task is completed, it will be directly revoked and no longer added to the revocation list, reducing the consumption of updating the revocation list; for the security of cross-domain revocation list update, introduce certificate authentication, and when the inter-domain authentication is passed, update the revocation list of other domains; adopt the incremental update method, judge by the last update time, and only update the new revocation identification to reduce bandwidth consumption. Through the above method, the efficiency and security of cross-domain identification revocation under wireless narrowband are improved.
[0050] like Figure 1 As shown, the cross-domain identification revocation method under the wireless narrowband includes:
[0051] 1. Identify common data structures
[0052] An identifier is an infrastructure that follows certain standards and provides security services. Compared with a PKI (Public Key Infrastructure) identifier, it has a smaller data volume and is more convenient to transmit, especially for low-bandwidth data transmission. It is suitable for wireless narrowband data transmission environments.
[0053] There is no universal data structure for identification revocation updates. The reason may be that the identification revocation list may be constructed differently for different requirements. Regardless of the device type, the unique value of the device is found as the unique field of the identification. Thus, a universal data structure for identification is designed as shown in Table 1.
[0054] Table 1, a generic data structure for identification:
[0055] length Unique number Issuing domain Validity 10 SN8742D524 A 1618196882 2 bytes 8-16 bytes 4 bytes 10 bytes
[0056] The identification general data structure contains 4 fields. Among them:
[0057] The "Length" field indicates the length of the device's "Unique Number" field, which is used to distinguish different types of devices. This field is 2 bytes.
[0058] The "Unique Number" field indicates the unique number of the device, which is determined by the device's factory number or serial number. The number lengths of different types of devices are different, so the length of this field is not fixed and is within the range of 8 to 16 bytes.
[0059] The "Issuing Domain" field refers to the organizational domain that issued the device's ID. In other words, it indicates which organizational domain issued the device's ID. The information in this field is determined by the issuing domain number. There is a mapping between the issuing domain name and number in the system. This field is 4 bytes.
[0060] The "Validity Period" field indicates the validity period of the device identification, that is, the usage period of the identification. It can be used within the validity period, and it cannot be used if it exceeds the valid value. This field uses the timestamp format in the JAVA development language, and can directly convert the time into milliseconds. For example, for a certain time, the standard time format is not used directly, but the number of milliseconds since January 1, 1970 00:00:00 GMT is taken. As shown in Table 1, 1618196882 represents the number of milliseconds since 11:08:02 on April 12, 2021 since January 1, 1970 00:00:00 GMT, a total of 10 bytes, which effectively reduces the field length.
[0061] In summary, the universal identification data structure used in the embodiment of the present invention contains 24 to 32 bytes in total. Identification is generated as needed for different devices, thereby reducing the length of the identification field.
[0062] 2. Logo classification
[0063] Due to the diversity of device types, the length of the unique number of different types of devices is different. There are different lengths of identification, which leads to different lengths of use of different identifications. If the same revocation method is used for identifications with different validity periods, it will affect the length of the revocation list, thereby affecting the transmission of the revocation list and increasing the consumption under wireless narrowband. Therefore, according to the device's participation in the task, the identification is divided into long-term identification and short-term identification, and different revocation methods are adopted, such as Figure 2 shown.
[0064] (1) Revocation of long-term identification
[0065] For long-term used identifications, these identifications are stable and not easily destroyed or attacked. Therefore, the identification validity period is used as the basis for revocation, and a timer is set. If the identification exceeds the validity period, it will be directly revoked and not added to the revocation list. If it is used again after the expiration, it is necessary to reapply for the identification; if it has not exceeded the validity period, it can continue to be used.
[0066] In addition, if active revocation is required for some reason (such as some devices being hacked or other reasons causing the device ID to no longer be used), the device ID will be added to the revocation list.
[0067] (2) Short-term label revocation
[0068] For each mission, an identification is issued to each device participating in the mission, and a short validity period is set. At the end of each mission, these devices will automatically expire and can no longer be used. They will not be added to the revocation list. Before the next mission begins, they will reapply for identification, thereby reducing the size of the revocation list and avoiding the revocation list from being too large after multiple operations.
[0069] 3. Mutual recognition between domains
[0070] For identifiers issued by different issuing domains, identifiers and revocation lists must be generated and transmitted by a secure issuing domain. How to confirm the security of the source domain and not the wrong identifiers and revocation lists sent by the attacking issuing domain is a security issue that needs to be solved. When different domains recognize each other, the identifiers and revocation lists of these domains are secure and credible.
[0071] For mutual recognition of different domains, PKI certificate authentication is adopted to create a certificate authority (CA) and a registration authority (RA). The certificate authority CA, the certificate registration authority RA and the issuing domain are regarded as a PKI system, such as Figure 3 As shown, mutual recognition between domains is achieved. The specific method of mutual recognition between domains is as follows:
[0072] The issuing domain applies for a certificate from the CA. After verifying the true identity, the CA uses the issuing domain's public key and identity as the original message, hashes it to generate a digest, and encrypts it with the CA's private key to sign it. The digital signature, together with the certificate owner's public key and identity, constitutes a digital certificate.
[0073] After the digital certificates of each issuing domain are generated, if issuing domain A and issuing domain B recognize each other, issuing domain A sends the digital certificate to issuing domain B, and issuing domain B uses the CA's public key to decrypt the digital signature in the digital certificate to generate a message digest, hashes the digital certificate content to generate a digest, and proves the integrity and authenticity of the content by comparing the two digests, thereby achieving mutual recognition between domains.
[0074] 4. Revocation of logo
[0075] like Figure 4 As shown, according to the characteristics of the identification system, identification revocation includes validity period revocation and revocation list revocation.
[0076] If the identification expires, that is, exceeds the validity period, it will be directly revoked without being written into the revocation list; if the identification is revoked proactively, the identification will be written into the revocation list to complete the revocation.
[0077] (1) Revocation of validity period
[0078] Revocation of validity period applies to all identifications. Each identification has a validity period. If an identification expires, that is, exceeds the validity period, the identification can no longer be used and is directly revoked. When you need to continue to use the device, you need to reapply for the identification in the identification management system, and you can continue to use it after the application.
[0079] (2) Revocation list revocation
[0080] If the identifier is revoked proactively, the identifier is written into the revocation list to complete the revocation.
[0081] The ID revocation list contains IDs that can no longer be used. IDs that are no longer used for some reason will be added to the revocation list. The authentication system will check whether the ID is in the revocation list every time it authenticates. If it is in the revocation list, the authentication fails; otherwise, the authentication succeeds.
[0082] In this embodiment, the revocation list is transmitted in JSON format, and the format is as follows:
[0083]
[0084] Among them, id indicates that the revocation list belongs to a specific domain, irl indicates the identifier revocation list, which contains all revoked identifiers in the domain, and sign indicates the signature value of the domain.
[0085] Revocation list updates include:
[0086] (1) Update of the domain revocation list: If a device is revoked, a new revocation identifier will be added to the domain revocation list and the time will be updated.
[0087] (2) Cross-domain revocation list update: When a domain wants to update its revocation list, it sends a revocation list update request to other domains. To prevent attackers from impersonating other issuing domains, mutual recognition between domains is first performed through certificate authentication. Once the mutual recognition between domains is successful, an incremental update method is used to compare the revocation list update time. If the revocation list update time of the requesting domain is earlier than that of the requested domain, the revocation list of the requested domain in the requesting domain is updated. Otherwise, the revocation list is not updated, thereby reducing latency and consumption under wireless narrowband.
[0088] The above describes a method for revoking a cross-domain identification under a wireless narrowband provided in an embodiment of the present application. As a possible product form of the above method, Figure 5 As shown, an embodiment of the present application further provides an electronic device, including:
[0089] At least one processor; and a communication interface that is communicatively connected to the at least one processor; the at least one processor executes instructions stored in the memory, so that the electronic device executes the method steps executed by any device in the above method embodiments through the communication interface.
[0090] Optionally, the memory is located outside the electronic device.
[0091] Optionally, the electronic device includes the memory, the memory is connected to the at least one processor, and the memory stores instructions that can be executed by the at least one processor. Figure 5 The dashed lines indicate that the memory is optional for the electronic device.
[0092] The processor and the memory may be coupled via an interface circuit or may be integrated together, which is not limited here.
[0093] The specific connection medium between the processor, memory and communication interface is not limited in the embodiments of the present application. Figure 5 The processor, memory and communication interface are connected by a bus. Figure 5 The connections between the other components are shown in bold lines, which are only for illustration and are not intended to be limiting. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5In the example, only one thick line is used to represent the bus, but it does not mean that there is only one bus or one type of bus. It should be understood that the processor mentioned in the embodiment of the present application can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc. When implemented by software, the processor can be a general-purpose processor, which is implemented by reading the software code stored in the memory.
[0094] Exemplarily, the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.
[0095] It should be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DirectRambus RAM, DR RAM).
[0096] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) can be integrated into the processor.
[0097] It should be noted that the memory described herein is intended to include, without being limited to, these and any other suitable types of memory.
[0098] As another possible product form, an embodiment of the present application also provides a computer-readable storage medium, which is used to store instructions. When the instructions are executed, the computer executes the method steps executed by any device in the above method example.
[0099] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.
[0100] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0101] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0102] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0103] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.
Claims
1. A method for revoking a cross-domain identification under wireless narrowband, characterized in that: include: Design a universal identification data structure to reduce the length of the identification data structure; Classify the identifiers. For temporary identifiers, they will be directly revoked after each task is completed and will not be added to the revocation list. To ensure the security of cross-domain revocation list updates, certificate authentication is used to achieve inter-domain mutual recognition. Perform identification revocation and update the revocation list, wherein the identification revocation list is updated in an incremental update manner for cross-domain revocation list updates.
2. The cross-domain identification revocation method under wireless narrowband according to claim 1, characterized in that: The identification general data structure includes the following 4 fields: The "Length" field indicates the length of the device's "Unique Number" field, which is used to distinguish different types of devices; The "Unique Number" field indicates the unique number of the device, which is determined by the device's factory number or serial number; The "Issuing Domain" field refers to the organizational domain that issued the ID to the device. The information in this field is determined by the issuing domain number; The "Validity Period" field indicates the validity period of the device identification, that is, the usage period of the identification. If it does not exceed the validity period, it can be used. If it exceeds the valid value, it cannot be used.
3. The cross-domain identification revocation method under wireless narrowband according to claim 1, characterized in that: The identification categories include: Long-term identification revocation: The identification validity period is used as the basis for revocation. If the identification exceeds the validity period, it will be directly revoked and will not be added to the revocation list. If it is used again after the expiration date, it is necessary to reapply for the identification; if it has not exceeded the validity period, it can continue to be used; if a device identification needs to be actively revoked, the device identification will be added to the revocation list; Short-term identification revocation: For each task, an identification is issued to each device participating in the task, and a short validity period is set. At the end of each task, these devices will automatically expire and can no longer be used. They will not be added to the revocation list and will have to reapply for identification before the next task begins.
4. The cross-domain identification revocation method under wireless narrowband according to claim 1, characterized in that: The use of certificate authentication to achieve inter-domain mutual recognition includes: For mutual recognition between different domains, the PKI certificate authentication method is adopted to create a certificate certification authority CA and a certificate registration authority RA. The certificate certification authority CA, the certificate registration authority RA and the issuing domain are regarded as a PKI system to achieve mutual recognition between domains.
5. The cross-domain identification revocation method under wireless narrowband according to claim 4, characterized in that: The inter-domain mutual recognition includes: The issuing domain applies for a certificate from the CA. After verifying the true identity, the CA uses the issuing domain's public key and identity as the original message, hashes it to generate a digest, and encrypts it with the CA's private key to sign it. The digital signature, together with the certificate owner's public key and identity, constitutes a digital certificate. After the digital certificates of each issuing domain are generated, if issuing domain A and issuing domain B recognize each other, issuing domain A sends the digital certificate to issuing domain B, and issuing domain B uses the CA's public key to decrypt the digital signature in the digital certificate to generate a message digest, hashes the digital certificate content to generate a digest, and proves the integrity and authenticity of the content by comparing the two digests, thereby achieving mutual recognition between domains.
6. The cross-domain identification revocation method under wireless narrowband according to claim 1, characterized in that: After the identification is revoked, the revocation list is updated to include: (1) Update of the domain revocation list: If a device is revoked, the domain revocation list will add a new revocation identifier and update the time; (2) Cross-domain revocation list update: When a domain wants to update its revocation list, it sends a revocation list update request to other domains, first performing mutual recognition between domains. Once the mutual recognition between domains is passed, an incremental update method is used to compare the revocation list update time. If the revocation list update time of the requesting domain is earlier than that of the requested domain, the revocation list of the requested domain in the requesting domain is updated; otherwise, the revocation list is not updated.
7. An electronic device, characterized in that: include: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the method as described in any one of claims 1 to 6 by executing the instructions stored in the memory.
8. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store instructions, and when the instructions are executed, the method according to any one of claims 1 to 6 is implemented.