Certificate presetting method and device and computer readable storage medium

Abstract

The embodiment of the invention discloses a certificate presetting method and device and a computer readable storage medium, and belongs to the technical field of communication. The method comprises the following steps: acquiring a network management version packet and a preset certificate packet matched with the network management version packet; installing a network management system based on the network management version package; and creating a security storage module corresponding to each network management module in the network management system, and storing the preset certificate in the preset certificate packet to the security storage module, so that each network management module associated with the security storage module obtains the required preset certificate. According to the embodiment of the invention, the authority, security and updating convenience of the preset digital certificate are improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communication technology, and in particular to a certificate presetting method, device, and computer-readable storage medium. Background Art

[0002] In the related technology, the network management digital certificate pre-setting generally adopts the method of module pre-setting self-signed certificate. However, there are security and authority issues in pre-setting digital certificates in this way. The obtained certificate is not necessarily reliable, and the certificate is strongly coupled with the network management version. If a vulnerability or security problem is found and the certificate needs to be updated, each module will have to release a network management upgrade package or patch package, and the update process is very complicated. Summary of the invention

[0003] The main purpose of the embodiments of the present application is to provide a certificate pre-setting method, device and computer-readable storage medium, aiming to solve the technical problem of how to improve the authority, security and updating convenience of pre-set digital certificates.

[0004] To achieve the above object, an embodiment of the present application provides a certificate presetting method, the certificate presetting method comprising:

[0005] Obtain a network management version package and a pre-configured certificate package matching the network management version package;

[0006] Installing the network management system based on the network management version package;

[0007] A secure storage module corresponding to each network management module in the network management system is created, and the pre-set certificates in the pre-set certificate package are stored in the secure storage module, so that each network management module associated with the secure storage module obtains the required pre-set certificates.

[0008] Optionally, before the step of obtaining a network management version package and a pre-set certificate package matching the network management version package, the certificate pre-setting method further includes:

[0009] Obtain an authoritative certificate issued by a certificate authority, and generate a certificate package based on the authoritative certificate;

[0010] Applying for a digital signature from the certificate authority based on the certificate package to obtain a signature file;

[0011] A pre-set certificate package is generated based on the certificate package and the signature file.

[0012] Optionally, before the step of installing the network management system based on the network management version package, the certificate presetting method further includes:

[0013] Decrypt the signature file in the pre-set certificate package based on the public key provided by the certificate authority to obtain a decrypted plaintext;

[0014] The decrypted plaintext is compared with the hash code of the certificate package in the pre-set certificate package to implement integrity verification.

[0015] Optionally, the step of installing the network management system based on the network management version package includes:

[0016] Decompressing the network management version package to obtain multiple module installation packages;

[0017] A network management system consisting of a plurality of network management modules is installed on the server to be installed based on each of the module installation packages.

[0018] Optionally, before the step of creating a secure storage module corresponding to each network management module in the network management system, the certificate presetting method further includes:

[0019] Determining a pre-configured certificate to be used in the pre-configured certificate package based on a configuration file of the pre-configured certificate package;

[0020] The pre-set certificate is password-decrypted and the private key is split to obtain the certificate and private key files.

[0021] Optionally, the step of performing password decryption and private key splitting on the pre-set certificate to obtain a certificate and a private key file comprises:

[0022] Decrypting the encrypted password of the pre-set certificate based on a preset password key to obtain a plain text password;

[0023] The pre-set certificate is split into a private key based on the plain text password to obtain a certificate and a private key file.

[0024] Optionally, after the step of installing the network management system based on the network management version package, the certificate presetting method further includes:

[0025] Determining whether a network management module in the network management system needs to update a pre-set certificate;

[0026] In the case that the network management module needs to update the pre-configured certificate, a pre-configured certificate is added to the pre-configured certificate package based on the certificate authority.

[0027] Optionally, the step of determining whether the network management module in the network management system needs to update the pre-configured certificate includes:

[0028] In the case where certificate configuration information is newly added in the network management module, determining that the network management module needs to update a pre-set certificate;

[0029] In the case that there is a security risk in the pre-set certificate of the network management module, it is determined that the network management module needs to update the pre-set certificate.

[0030] In addition, to achieve the above purpose, the embodiment of the present application further provides a certificate pre-setting device, the certificate pre-setting device comprising:

[0031] An acquisition module, the acquisition module is used to acquire a network management version package and a pre-set certificate package matching the network management version package;

[0032] An installation module, the installation module is used to install the network management system based on the network management version package;

[0033] A matching module, the matching module is used to create a security storage module corresponding to each network management module in the network management system, and store the pre-set certificates in the pre-set certificate package to the security storage module, so that each network management module associated with the security storage module obtains the required pre-set certificates.

[0034] In addition, to achieve the above-mentioned purpose, an embodiment of the present application also provides a certificate pre-setting device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, and when the computer program is executed by the processor, the certificate pre-setting method as described above is implemented.

[0035] In addition, to achieve the above-mentioned purpose, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the certificate presetting method as described above is implemented.

[0036] The embodiment of the present application proposes a certificate presetting method, device, equipment and computer-readable storage medium. In the certificate presetting method, first obtain a network management version package and a pre-set certificate package matching the network management version package; then install the network management system based on the network management version package; then create a secure storage module corresponding to each network management module in the network management system, and store the pre-set certificates in the pre-set certificate package to the secure storage module, so that each network management module associated with the secure storage module obtains the required pre-set certificates. The embodiment of the present application introduces a certificate package, which not only solves the problem of the authority of the pre-set certificates, but also ensures the security of these certificates, the convenience and reliability of pre-set updates, without reducing the network security environment of operators or ToB enterprise users, and without requiring operators or ToB enterprise users to build their own certificate servers. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only part of the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0038] Figure 1 A flowchart of a certificate presetting method provided in one embodiment of the present application;

[0039] Figure 2 A schematic diagram of a generation process of a pre-set certificate package involved in a certificate pre-set method provided in an embodiment of the present application;

[0040] Figure 3 A detailed flow chart of installing a network management system involved in a certificate presetting method provided in an embodiment of the present application;

[0041] Figure 4 A schematic diagram of a verification process of a pre-set certificate package involved in a certificate pre-set method provided in an embodiment of the present application;

[0042] Figure 5 A flowchart of password decryption and private key splitting involved in a certificate presetting method provided in one embodiment of the present application;

[0043] Figure 6 A detailed flow chart of password decryption and private key splitting involved in a certificate presetting method provided in one embodiment of the present application;

[0044] Figure 7 A schematic diagram of a certificate update process involved in a certificate presetting method provided in an embodiment of the present application;

[0045] Figure 8 A detailed flow chart of certificate update involved in a certificate presetting method provided in an embodiment of the present application;

[0046] Fig. 9 A schematic diagram of a system architecture involved in a certificate presetting method provided in one embodiment of the present application;

[0047] Fig.10 A schematic diagram of the structure of a certificate presetting device provided in one embodiment of the present application;

[0048] Fig.11 A schematic diagram of the structure of a certificate pre-setting device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0049] In the following description, specific details such as specific system structures, technologies, etc. are proposed for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the embodiments of the present application can also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from hindering the description of the embodiments of the present application.

[0050] It should be noted that although a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than that in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0051] It should also be understood that the references to "one embodiment" or "some embodiments" described in the specification of the embodiments of the present application mean that one or more embodiments of the embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Thus, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0052] A digital certificate is a digital certification that marks the identity information of the parties in Internet communication. People can use it to identify each other online, so a digital certificate is also called a digital ID. A digital certificate ensures the integrity and security of information and data in computer network communication by encrypting or decrypting information and data of network users.

[0053] ToB (To Business, enterprise entrepreneurship is aimed at enterprises and provides services to enterprises, such as equipment manufacturers) enterprise customers face a more stringent and complex security environment than operators. In addition to high requirements for operational convenience and automation, they also put forward higher security requirements such as secure startup, default security, zero trust, and data not leaving the campus. Moreover, ToB enterprise customers are more sensitive to costs, and security infrastructure such as CA (Certificate Authority) servers are generally lacking.

[0054] The network management system involves modules that use TLS (Transport Layer Security) and HTTPS (Hypertext Transfer Protocol Secure) protocols for north-south communication. It is necessary to pre-install digital certificates authorized by the equipment manufacturer before the relevant modules are started. Otherwise, services cannot be provided to the outside world immediately with a secure protocol after startup. If a non-secure protocol is used to obtain a certificate online, there is a security window period before obtaining the certificate. In addition, operators and corporate customers will not allow network managers to connect to the equipment manufacturer's website online to obtain certificates for network security reasons. Therefore, ordinary online distribution or certificate update methods cannot solve the problem of pre-installing certificates required for the secure startup of network managers.

[0055] In the related art, the network management digital certificate pre-setting generally adopts the method of module pre-setting self-signed certificate. There are several problems with this method: 1) The certificate is preset in the module development code, and the security of the certificate private key cannot be guaranteed. If the certificate private key is leaked or abused during the development stage, the digital certificate will no longer function as an identity identification; 2) Based on the security issue in 1), the self-signed certificate is not issued by the authoritative CA of the equipment manufacturer. The communication peer cannot identify the authority of the certificate, and the trust certificate faces great doubts. Distrust of the certificate will make it impossible to use the certificate to establish a security protocol link with the peer; 3) The certificate and network management version are strongly coupled. If a vulnerability or security issue is found and the certificate needs to be updated, each module will have to release a network management upgrade package or patch package, and the process and operation are very complicated.

[0056] Based on this, the embodiments of the present application provide a certificate presetting method, apparatus, device and computer-readable storage medium. By implementing the certificate presetting method proposed in the embodiments of the present application, there is no need to connect to the equipment manufacturer's website online when presetting the equipment manufacturer's certificate, which can meet the strict network security requirements of operators and ToB enterprise users, and can have the ability to provide a secure channel to the outside world as soon as the network management is started. There is no security window period before running online to obtain the certificate with a non-secure protocol. The offline presetting or updating certificate method is more reliable and stable than the online method, and there is no need for operators or ToB enterprise users to build their own certificate server; the security protection of the certificate starts from a non-production environment, and the development and testing of the network management module does not rely on real certificates, and there is no need to distribute real certificates issued by the equipment manufacturer's authoritative CA in the R&D code; the release and update of the certificate are decoupled from the network management version, and there is no need for one-to-one correspondence, which makes management more convenient and updating easier. When security problems occur, updated certificate packages can be quickly released to solve the problems without the need to update the network management code to upgrade or patch the network management version.

[0057] The certificate pre-setting method, apparatus, device and computer-readable storage medium provided in the embodiments of the present application are specifically described through the following embodiments. First, the certificate pre-setting method in the embodiments of the present application is described.

[0058] Reference Figure 1 , Figure 1 A flow chart of a certificate presetting method provided in an embodiment of the present application is provided. The certificate presetting method can be applied to a certificate presetting device, such as Figure 1 As shown, the certificate presetting method provided in this embodiment includes steps S10 to S30.

[0059] Step S10, obtaining a network management version package and a pre-set certificate package matching the network management version package;

[0060] It should be noted that the certificate presetting method proposed in this embodiment is easier to understand after combining with the actual application scenario. Therefore, this embodiment takes the certificate presetting scenario of the network management equipment vendor as an example for the following description. In this scenario, the certificate presetting in the production environment is generally performed with the new installation of the network management version. To install, it is necessary to first obtain the network management version package, installation tools and matching pre-set certificate package from the non-production environment, and upload these packages and tools to the server to be installed, and prepare for the network management version installation and equipment vendor certificate presetting.

[0061] As an example, this embodiment can be regarded as omitting the step of obtaining the network management version package, installation tool and matching pre-set certificate package in a non-production environment before step S10, and is considered to be directly obtaining the network management version package and the pre-set certificate package matching the network management version package through the installation tool.

[0062] As an example, in this embodiment, the directory structure in the pre-set certificate package zip package is as follows:

[0063]

[0064] Among them, [consumer_name] is the name of the network management service module. Each module has a directory. Multiple directories of different modules can be placed under one certificate package at the same time, which corresponds to the definition in cert_description.json later; xxx_xxxx.pfx represents the private key and certificate file; xxx_xxxx_password.txt is the password of the xxx_xxxx.pfx file, which is stored in AES256 encryption; xxx_xxxx_trust.cer (.crt) indicates the peer CA certificate trusted by this module.

[0065] As an example, the structure of the certificate consumer description file (cert_description.json) is as follows: [

[0067] {

[0068] "consumer_name":"", / / Network management module name, naming convention: [app_name]_[usage], all lowercase English. This name is not allowed to be changed at will and must be consistent with the certificate file package structure above.

[0069] "consumer_service_name":["xx","xxx"], / / The network management module service name using the certificate

[0070] "consumer_version":"v1.0" / / Update this version number when the certificate file is updated, v1.0, v1.1

[0071] "pfxSplit":"true" / / Whether the pfx file needs to be split into two files: certificate and private key. Most of them need to be split

[0072] }, .. ]

[0075] Reference Figure 2 In some feasible embodiments, before the above step S10, the certificate presetting method further includes:

[0076] Step S01, obtaining an authoritative certificate issued by a certificate authority, and generating a certificate package based on the authoritative certificate;

[0077] Step S02, applying for a digital signature from the certificate authority based on the certificate package to obtain a signature file;

[0078] Step S03: Generate a preset certificate package based on the certificate package and the signature file.

[0079] It should be noted that, in the present embodiment, the pre-set certificate package is generated in a non-production environment. First, according to the application for the pre-set certificate module as needed, an application for the issuance of module certificates is uniformly submitted to the authoritative CA of the equipment manufacturer; then, the certificate package and its internal directory structure, certificate files, and certificate description files are uniformly maintained, and the command provided by the network management installation and upgrade tool is used to perform AES256 encryption storage of the xxx_xxxx.pfx file password. Different certificate files can use different passwords, and the certificate cannot be used without a password; a trusted peer CA certificate is pre-set in the certificate package, and the default is the authoritative CA of the equipment manufacturer; after the network management configuration administrator generates the certificate package zip, an application is made to the equipment manufacturer CA for a digital signature to generate a signature file such as cert.zip.sign; the network management test and verification in a non-production environment does not rely on the real certificate package, and a test certificate package is sufficient.

[0080] As an example, the certificate package and its signature file are published to a unified version server for download in the production environment. One certificate package can be used in conjunction with multiple network management version packages without the need for a one-to-one correspondence.

[0081] Step S20, installing the network management system based on the network management version package;

[0082] It can be understood that since this embodiment is illustrated using the certificate pre-setting scenario of the network management equipment vendor as an example, after obtaining the network management version package required for installing the network management system, it is necessary to first install the network management system based on the network management version package, and complete the certificate pre-setting for each network management business module in the network management system during the network management system installation process.

[0083] Reference Figure 3 In some feasible embodiments, the above step S20 includes:

[0084] Step S201, decompressing the network management version package to obtain multiple module installation packages;

[0085] Step S202: installing a network management system composed of a plurality of network management modules on a server to be installed based on each module installation package.

[0086] It should be noted that the network management version package includes module installation packages corresponding to different network management business modules. After executing the installation programs of each network management business module on the server to be installed based on these module installation packages, a network management system consisting of multiple network management business modules can be obtained.

[0087] Step S30, creating a secure storage module corresponding to each network management module in the network management system, and storing the pre-set certificates in the pre-set certificate package into the secure storage module, so that each network management module associated with the secure storage module obtains the required pre-set certificates.

[0088] It should be noted that in order to ensure the security of the pre-set certificates, the certificates required by each network management business module in this embodiment will not be directly pre-set in the network management business module. Instead, a one-to-one corresponding security storage module is created for each network management business module in the network management system to store the certificate files required by each network management business module. When the network management business module is started, it can directly read the certificate files it needs to use through the unique corresponding security storage module and provide external services in combination with the security protocol.

[0089] As an example, the secure storage module in this embodiment may be a secure secret persistent volume dedicated to the network management service module.

[0090] This embodiment proposes a certificate pre-setting method, which uses the equipment manufacturer's authoritative CA to issue corresponding certificates to each business module in the network management system, and introduces a certificate package to uniformly store certificates, so that certificate pre-setting and updating do not require online connection to the equipment manufacturer's CA server, the operator or the internal CA server of the ToB enterprise user; in this embodiment, the network management business module has a usable certificate as soon as it is started, which allows these modules to provide services to the outside world with a secure protocol after startup, and there is no security window period; and different modules can use different certificates. The network management modules cannot obtain truly pre-set certificates in a non-production environment. The test environment uses a test certificate package for test verification. The certificate package is not coupled with the network management version and does not need to correspond one-to-one with the network management version.

[0091] Reference Figure 4 In some feasible embodiments, before the above step S20, the certificate presetting method further includes:

[0092] Step S11, decrypting the signature file in the pre-set certificate package based on the public key provided by the certificate authority to obtain a decrypted plaintext;

[0093] Step S12: compare the decrypted plaintext with the hash code of the certificate package in the pre-set certificate package to implement integrity verification.

[0094] It should be noted that, considering the possibility that the pre-set certificate package may be damaged, before the network management system is installed, the pre-set certificate package can be checked for integrity to ensure that the certificate pre-setting process can proceed normally during the installation of the network management system. The integrity check process provided in this embodiment is also performed by the network management installation tool. The network management installation tool is pre-set with a public key provided by the certificate authority. The signature file in the pre-set certificate package is decrypted based on the public key, and then compared with the hash code of the certificate package. If the two are consistent, it means that the pre-set certificate package is complete. If the two are inconsistent, it means that the pre-set certificate package has been modified.

[0095] As an example, the network management system version package may also be verified before installing the network management system to avoid the problem of network management system installation failure or outdated version of the installed network management system.

[0096] Reference Figure 5 In some feasible embodiments, before the above step S30, the certificate presetting method further includes:

[0097] Step S21, determining a pre-configured certificate to be used in the pre-configured certificate package based on a configuration file of the pre-configured certificate package;

[0098] Step S22, decrypting the password of the pre-set certificate and splitting the private key to obtain the certificate and private key files.

[0099] It should be noted that before storing the certificate in the secure storage module, it is necessary to first determine the preset certificates that each network management business module needs to use based on the configuration file of the preset certificate package to avoid storing certificates that the network management business module does not need to use in the corresponding secure storage module; and after determining the preset certificate to be used, the preset certificate will not be directly stored in the secure storage module, because the preset certificate actually exists in the form of an encrypted pfx file. If the pfx file is directly stored in the secure storage module, even if the network management business module obtains the pfx file, it cannot obtain the certificate it needs to use. Therefore, it is also necessary to split the preset certificate into two files, a certificate and a private key, and store the certificate and private key in the secure storage module in subsequent steps. In this way, the network management business module can directly read the certificate and private key files it needs to use from the corresponding secure storage module.

[0100] Reference Figure 6 In some feasible embodiments, the above step S22 includes:

[0101] Step S221, decrypting the encrypted password of the pre-set certificate based on a preset password key to obtain a plain text password;

[0102] Step S222: splitting the private key of the pre-set certificate based on the plain text password to obtain a certificate and a private key file.

[0103] It should be noted that, in combination with the above embodiments, after the pre-set certificate is provided by the authoritative CA, it has been encrypted with an encryption password, and the preset password key is provided together with the authoritative CA when providing the pre-set certificate. It is necessary to first decrypt the password to obtain the plaintext password of the pre-set certificate used for encrypted storage, and then split the pre-set certificate, i.e., the pfx file, into two files, a certificate and a private key, based on the plaintext password.

[0104] It is understood that the private key is a small piece of code that is paired with the public key to trigger the algorithm for text encryption and decryption. It is created during asymmetric key cryptography as a part of public key cryptography and is used to decrypt and convert messages into a readable format.

[0105] Reference Figure 7 In some feasible embodiments, after the above step S20, the certificate presetting method further includes:

[0106] Step S23, determining whether the network management module in the network management system needs to update the pre-set certificate;

[0107] Step S24: When the network management module needs to update the pre-configured certificate, a pre-configured certificate is added to the pre-configured certificate package based on the certificate authority.

[0108] It should be noted that the above-mentioned embodiments correspond to the pre-setting scenarios of the network management equipment vendor certificates, while the present embodiment corresponds to the updating scenarios of the network management equipment vendor certificates. When a network management system already exists, the network management version package in the above-mentioned embodiments can be replaced with a network management patch package. Similarly, the network management system can be upgraded or patched based on the network management patch package by installing an upgrade tool. After completing the upgrade or patch of the network management module, it can be determined whether the certificate required to be used by the updated network management module also needs to be updated. If an update is required, it is also necessary to apply to and sign the authoritative CA organization in a non-production environment, and then obtain a pre-setting certificate package that matches the latest network management system.

[0109] It is understandable that not all module certificates need to be updated or pre-set. Therefore, after upgrading or patching the network management module, by comparing the existing certificate package configuration file in the version with the configuration file of the certificate package to be processed, you can know the network management module that needs to be updated or pre-set certificates.

[0110] Reference Figure 8 In some feasible embodiments, the above step S23 includes:

[0111] Step S231, when new certificate configuration information is added to the network management module, it is determined that the network management module needs to update the pre-set certificate;

[0112] Step S232: when there is a security risk in the pre-set certificate of the network management module, it is determined that the network management module needs to update the pre-set certificate.

[0113] In this embodiment, the two situations in which the pre-set certificates need to be updated are mainly given, namely, the situation in which the network management module adds new certificate configuration information, and the situation in which the pre-set certificates of the network management module have security risks. The security risks may include different situations such as the pre-set certificates have security holes or have been leaked, or the validity period is approaching.

[0114] Reference Fig. 9 ,like Fig. 9 The system architecture shown can be applied to any of the above embodiments. Fig. 9 It can be seen that the whole system includes the following key components:

[0115] 1. Equipment vendor's authoritative CA (i.e., certificate authority): a general authoritative CA that can be trusted by operators or ToB enterprise users to complete the issuance of pre-installed certificates in the certificate package and the digital signature of the certificate package.

[0116] 2. Network management system. The network management system modules related to the embodiments of the present application include:

[0117] 1) Network management installation and upgrade tool: used to load the network management version / patch package and the network management preset certificate package, perform integrity verification and decryption on the certificate package, and load the stored certificate into a secure storage that the module can access independently for use by related modules to load certificates; also used to load the network management version / patch package, install and deploy / upgrade / patch network management business modules, such as the north-south module.

[0118] 2) Network management pre-installed certificate package: used to pre-install certificates issued by the equipment manufacturer's authoritative CA, and pre-installed into the network management system through the network management installation and upgrade tool, so that related modules have usable certificates before startup.

[0119] 3) Network management version / patch package: software installation / upgrade / patch package of the network management business module.

[0120] 4) Secure storage: Storage devices or software that can securely store important files such as private keys. They are used to securely store pre-set module-related certificates and private keys. Different modules use different storage spaces and their permission controls for secure isolation.

[0121] Network management service module: a general service module that needs to use certificates to provide external services using TLS and HTTPS security protocols. It is installed, deployed, upgraded, and patched by the network management version upgrade tool, and loads the required pre-set certificates from the secure storage when the module is started to provide external services using TLS and HTTPS security protocols.

[0122] In addition, the present application embodiment also provides a certificate presetting device, referring to Fig.10 , Fig.10 A schematic diagram of a certificate presetting device provided in an embodiment of the present application is shown in FIG. Fig.10 As shown, in this embodiment, the certificate presetting device includes: an acquisition module 100, an installation module 200 and a matching module 300.

[0123] The acquisition module 100 is used to acquire a network management version package and a pre-set certificate package matching the network management version package;

[0124] The installation module 200 is used to install the network management system based on the network management version package;

[0125] The matching module 300 is used to create a secure storage module corresponding to each network management module in the network management system, and store the pre-set certificates in the pre-set certificate package in the secure storage module, so that each network management module associated with the secure storage module obtains the required pre-set certificates.

[0126] The certificate presetting device provided in this embodiment and the certificate presetting method provided in the above embodiment belong to the same inventive concept. The technical details not fully described in this embodiment can be referred to any of the above embodiments, and this embodiment has the same beneficial effects as executing the certificate presetting method.

[0127] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0128] In addition, the embodiment of the present application also provides a certificate presetting device, and the certificate presetting method applied to the certificate presetting device can be executed by a certificate presetting device, and the certificate presetting device can be implemented by software and / or hardware and integrated in the certificate presetting device. The certificate presetting device can be a terminal device such as a PC (personal computer), a mobile phone, a notebook, a tablet computer, etc. that can communicate with the network side.

[0129] Reference Fig.11 , Fig.11 A schematic diagram of the hardware structure of a certificate presetting device provided in one embodiment of the present application. Fig.11 As shown, the certificate presetting device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (WIreless-FIdelity, WI-FI) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM), or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk storage. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0130] Those skilled in the art will understand that Fig.11 The structure shown in the figure does not constitute a limitation on the certificate provisioning device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. Fig.11As shown, the memory 1005 as a storage medium may include an operating system, a data storage module, a network communication module, a user interface module and a computer program.

[0131] exist Fig.11 In the certificate pre-setting device shown, the network interface 1004 is mainly used for data communication with other devices; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in this embodiment can be set in the certificate pre-setting device, and the certificate pre-setting device calls the computer program stored in the memory 1005 through the processor 1001, and executes the certificate pre-setting method applied to the certificate pre-setting device provided in any of the above embodiments.

[0132] The certificate presetting device proposed in this embodiment and the certificate presetting method applied to the certificate presetting device proposed in the above embodiment belong to the same inventive concept. The technical details not fully described in this embodiment can be referred to any of the above embodiments, and this embodiment has the same beneficial effects as executing the certificate presetting method.

[0133] In addition, an embodiment of the present application also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the certificate presetting method provided in any of the above embodiments is implemented.

[0134] It will be appreciated by those skilled in the art that all or some of the steps and systems in the disclosed method above may be implemented as software, firmware, hardware and appropriate combinations thereof. Some physical components or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or may be implemented as hardware, or may be implemented as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or a non-transitory medium) and a communication medium (or a temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that may be used to store desired information and may be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0135] The above is a specific description of the preferred implementation of the embodiments of the present application, but the embodiments of the present application are not limited to the above-mentioned implementation methods. Technical personnel familiar with the field can also make various equivalent modifications or substitutions without violating the spirit of the embodiments of the present application. These equivalent modifications or substitutions are all included in the scope defined by the claims of the embodiments of the present application.

Claims

1. A certificate presetting method, characterized in that: The certificate presetting method comprises: Obtain a network management version package and a pre-configured certificate package matching the network management version package; Installing the network management system based on the network management version package; A secure storage module corresponding to each network management module in the network management system is created, and the pre-set certificates in the pre-set certificate package are stored in the secure storage module, so that each network management module associated with the secure storage module obtains the required pre-set certificates.

2. The certificate presetting method according to claim 1, characterized in that: Before the step of obtaining a network management version package and a pre-set certificate package matching the network management version package, the certificate pre-setting method further includes: Obtain an authoritative certificate issued by a certificate authority, and generate a certificate package based on the authoritative certificate; Applying for a digital signature from the certificate authority based on the certificate package to obtain a signature file; A pre-set certificate package is generated based on the certificate package and the signature file.

3. The certificate presetting method according to claim 1, characterized in that: Before the step of installing the network management system based on the network management version package, the certificate presetting method further includes: Decrypt the signature file in the pre-set certificate package based on the public key provided by the certificate authority to obtain a decrypted plaintext; The decrypted plaintext is compared with the hash code of the certificate package in the pre-set certificate package to implement integrity verification.

4. The certificate presetting method according to claim 1, characterized in that: The step of installing the network management system based on the network management version package includes: Decompressing the network management version package to obtain multiple module installation packages; A network management system consisting of a plurality of network management modules is installed on the server to be installed based on each of the module installation packages.

5. The certificate presetting method according to claim 1, characterized in that: Before the step of creating a secure storage module corresponding to each network management module in the network management system, the certificate presetting method further includes: Determining a pre-configured certificate to be used in the pre-configured certificate package based on a configuration file of the pre-configured certificate package; The pre-set certificate is password-decrypted and the private key is split to obtain the certificate and private key files.

6. The certificate presetting method according to claim 5, characterized in that: The step of decrypting the password of the pre-set certificate and splitting the private key to obtain the certificate and private key file comprises: Decrypting the encrypted password of the preset certificate based on a preset password key to obtain a plain text password; The private key of the pre-set certificate is split based on the plain text password to obtain a certificate and a private key file.

7. The certificate presetting method according to claim 1, characterized in that: After the step of installing the network management system based on the network management version package, the certificate presetting method further includes: Determining whether a network management module in the network management system needs to update a pre-set certificate; In the case that the network management module needs to update the pre-configured certificate, a pre-configured certificate is added to the pre-configured certificate package based on the certificate authority.

8. The certificate presetting method according to claim 7, characterized in that: The step of determining whether the network management module in the network management system needs to update the pre-set certificate includes: In the case where certificate configuration information is newly added in the network management module, determining that the network management module needs to update a pre-set certificate; In the case that there is a security risk in the pre-set certificate of the network management module, it is determined that the network management module needs to update the pre-set certificate.

9. A certificate presetting device, characterized in that: The certificate pre-setting device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program implements the certificate pre-setting method according to any one of claims 1 to 8 when executed by the processor.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the certificate presetting method according to any one of claims 1 to 8 is implemented.

Images