Certificate distribution method, communication module, device and medium

Abstract

The present disclosure provides a certificate distribution method, a communication module, an apparatus and a medium, and relates to the technical field of communication. The method comprises the following steps: a communication module is connected with a production line certificate distribution MCU to form a temporary terminal, and the temporary terminal is connected with a production line certificate distribution server; the communication module receives a certificate storage address and a certificate from the production line certificate distribution MCU, the certificate storage address is calculated by the production line certificate distribution MCU according to the IMEI of the communication module, and the certificate is obtained by the production line certificate distribution MCU from the production line certificate distribution server according to the IMEI of the communication module; and the communication module saves the certificate according to the certificate storage address through a preset software development kit (SDK). The present disclosure sets the certificate distribution MCU on the production line to form a temporary terminal with the communication module, realizes the certificate distribution of the communication module through the temporary terminal, calculates the certificate storage address through the IMEI, and realizes the efficient and safe distribution of the certificate by presetting the uniform SDK to store the certificate in the corresponding address of the communication module.

Description

Technical Field

[0001] This disclosure relates at least to the field of communication technology, and in particular to a certificate distribution method, a communication module, a production line certificate distribution device, and a computer-readable storage medium. Background Technology

[0002] Currently, the method for embedding certificates into communication modules is mostly based on individual burning, since each communication module requires a different certificate. This method is inefficient and not suitable for large-scale production of communication modules. Summary of the Invention

[0003] The technical problem to be solved by this disclosure is to address the above-mentioned shortcomings by providing a certificate distribution method, a communication module, a production line certificate distribution device, and a computer-readable storage medium, so as to solve the problem of how to efficiently distribute communication module certificates.

[0004] In a first aspect, this disclosure provides a certificate distribution method, the method being applied to a communication module, and comprising:

[0005] The communication module is connected to the production line certificate distribution microcontroller (MCU) to form a temporary terminal, and the temporary terminal is connected to the production line certificate distribution server.

[0006] The communication module receives the certificate storage address and certificate from the production line certificate distribution MCU. The certificate storage address is calculated by the production line certificate distribution MCU based on the communication module's International Mobile Equipment Identity (IMEI), and the certificate is obtained by the production line certificate distribution MCU from the production line certificate distribution server based on the communication module's IMEI.

[0007] The communication module saves the certificate according to the certificate storage address using a pre-installed software development kit (SDK).

[0008] Furthermore, the communication module is connected to the production line certificate distribution microcontroller (MCU) to form a temporary terminal, which is connected to the production line certificate distribution server, specifically including:

[0009] The communication module is connected to the production line certificate distribution MCU via a modem command language AT interface to form a temporary terminal. In the temporary terminal, the production line certificate distribution MCU calls the communication module's SDK through AT interface commands.

[0010] The communication module obtains the Internet Protocol (IP) address and connects the temporary terminal to the production line certificate distribution server via the IP address.

[0011] Furthermore, before the communication module receives the certificate storage address and certificate from the production line certificate distribution MCU, the method further includes:

[0012] The communication module receives an IMEI query command from the production line certificate distribution MCU via the SDK. The SDK queries the communication module to obtain the IMEI of the communication module. The SDK sends the IMEI of the communication module to the production line certificate distribution MCU so that the production line certificate distribution MCU can calculate the certificate storage address based on the received IMEI.

[0013] The communication module receives a public key query command from the production line certificate distribution MCU via the SDK. The SDK sends a pre-stored public key to the production line certificate distribution MCU, so that the production line certificate distribution MCU encrypts the IMEI according to the received public key to form a certificate request ciphertext, and sends the certificate request ciphertext to the production line certificate distribution server, so that the production line certificate distribution server decrypts the certificate request ciphertext using the pre-stored private key, and sends the certificate to the production line certificate distribution MCU according to the decrypted IMEI.

[0014] Furthermore, the communication module receives the certificate storage address and certificate from the production line certificate distribution MCU, specifically including:

[0015] The communication module receives the certificate storage address from the production line certificate distribution MCU via the SDK, which is encapsulated using AT interface commands. The certificate storage address is the flash memory address calculated by the production line certificate distribution MCU based on the IMEI of the communication module.

[0016] The communication module receives a certificate encapsulated using AT interface commands from the production line certificate distribution MCU via the SDK, and the certificate has been verified as valid by the production line certificate distribution MCU.

[0017] Furthermore, the communication module saves the certificate according to the certificate storage address using a pre-installed software development kit (SDK), specifically including:

[0018] The SDK saves the certificate to the FLASH address range corresponding to the certificate storage address;

[0019] The SDK retrieves the saved certificate based on the certificate storage address and connects to the IoT platform via the certificate to test the certificate's availability.

[0020] In response to the test result indicating that the certificate is available, the SDK sends a message to the production line certificate distribution MCU indicating that the certificate has been successfully saved. This prompts the production line certificate distribution MCU to send the received message to the production line certificate distribution server, which then records the certificate distribution time.

[0021] Furthermore, after the SDK saves the certificate to the FLASH address range corresponding to the certificate storage address, the method further includes:

[0022] In response to receiving an AT interface command from the production line certificate distribution MCU via the SDK to modify / delete a certificate, the SDK calls the pre-encapsulated application programming interface (API) for modifying / deleting the certificate to modify / delete the certificate stored in the FLASH address range corresponding to the certificate storage address.

[0023] Secondly, this disclosure provides a certificate distribution method, which is applied to a production line certificate distribution device. The production line certificate distribution device includes a production line certificate distribution microcontroller unit (MCU) and a production line certificate distribution server, and the method includes:

[0024] The production line certificate distribution MCU connects to the communication module to form a temporary terminal, and the temporary terminal connects to the production line certificate distribution server.

[0025] The production line certificate distribution MCU calculates the certificate storage address based on the International Mobile Equipment Identity (IMEI) of the communication module, and retrieves the certificate from the production line certificate distribution server based on the IMEI of the communication module.

[0026] The production line certificate distribution MCU sends the certificate storage address and certificate to the communication module, so that the communication module can save the certificate according to the certificate storage address through the pre-built software development kit (SDK).

[0027] Furthermore, the production line certificate distribution MCU connects to the communication module to form a temporary terminal, which in turn connects to the production line certificate distribution server, specifically including:

[0028] The production line certificate distribution MCU and the communication module are connected via a modem command language (AT) interface to form a temporary terminal. In the temporary terminal, the production line certificate distribution MCU calls the communication module's SDK through the AT interface commands. The communication module obtains the Internet Protocol (IP) address and connects the temporary terminal to the production line certificate distribution server through the IP address.

[0029] Furthermore, the production line certificate distribution MCU calculates the certificate storage address based on the International Mobile Equipment Identity (IMEI) of the communication module, and retrieves the certificate from the production line certificate distribution server based on the IMEI of the communication module, specifically including:

[0030] The production line certificate distribution MCU sends an IMEI query command to the communication module's SDK, so that the SDK queries the communication module to obtain the communication module's IMEI and sends the IMEI to the production line certificate distribution MCU. The production line certificate distribution MCU calculates the certificate storage address based on the received IMEI.

[0031] The production line certificate distribution MCU sends a public key query command to the communication module's SDK, causing the SDK to send a pre-stored public key to the production line certificate distribution MCU. The production line certificate distribution MCU encrypts the IMEI based on the received public key to form a certificate request ciphertext, and sends the certificate request ciphertext to the production line certificate distribution server. The production line certificate distribution server then uses a pre-stored private key to decrypt the certificate request ciphertext and sends the certificate to the production line certificate distribution MCU based on the decrypted IMEI.

[0032] Furthermore, the production line certificate distribution MCU calculates the certificate storage address based on the received IMEI, specifically including:

[0033] The production line certificate distribution MCU uses the IMEI of the communication module to obtain the flash address as the certificate storage address through code conversion, redundancy check, hash processing, and address offset.

[0034] Furthermore, the production line certificate distribution MCU sends the certificate storage address and certificate to the communication module, specifically including:

[0035] The production line certificate distribution MCU sends the certificate storage address, which is encapsulated in AT interface commands, to the communication module's SDK;

[0036] The production line certificate distribution MCU verifies the validity of the certificate from the production line certificate distribution server and sends the verified valid certificate, encapsulated in AT interface commands, to the communication module's SDK.

[0037] Furthermore, after the production line certificate distribution MCU sends the certificate storage address and certificate to the communication module, the method further includes:

[0038] The production line certificate distribution MCU receives a certificate saving success message from the communication module's SDK and sends the received certificate saving success message to the production line certificate distribution server so that the production line certificate distribution server records the certificate distribution time.

[0039] Furthermore, after sending a message confirming successful certificate saving to the production line certificate distribution server, the method further includes:

[0040] In response to receiving a certificate modification / deletion instruction from the production line certificate distribution server, an AT interface command for modifying / deleting the certificate is sent to the SDK of the communication module. This causes the SDK to call the pre-encapsulated application programming interface (API) for modifying / deleting the certificate to modify / delete the certificate stored in the FLASH address range corresponding to the certificate storage address.

[0041] Thirdly, this disclosure provides a communication module, which includes a pre-installed software development kit (SDK) and comprises:

[0042] The first connection module is used to connect with the production line certificate distribution microcontroller MCU to form a temporary terminal, and the temporary terminal is connected to the production line certificate distribution server.

[0043] The first transceiver module, connected to the first connection module, is used to receive the certificate storage address and certificate from the production line certificate distribution MCU. The certificate storage address is calculated by the production line certificate distribution MCU based on the International Mobile Equipment Identity (IMEI) of the communication module, and the certificate is obtained by the production line certificate distribution MCU from the production line certificate distribution server based on the IMEI of the communication module.

[0044] The first storage module, connected to the first transceiver module, is used to save the certificate according to the certificate storage address via the SDK.

[0045] Fourthly, this disclosure provides a production line certificate distribution device, which includes a production line certificate distribution microcontroller unit (MCU) and a production line certificate distribution server, wherein the production line certificate distribution MCU includes:

[0046] The second connection module is used to connect with the communication module to form a temporary terminal, and the temporary terminal is connected to the production line certificate distribution server.

[0047] The second acquisition module, connected to the second connection module, is used to calculate the certificate storage address based on the International Mobile Equipment Identity (IMEI) of the communication module, and to obtain the certificate from the production line certificate distribution server based on the IMEI of the communication module.

[0048] The second transceiver module, connected to the second acquisition module, is used to send the certificate storage address and the certificate to the communication module, so that the communication module can save the certificate according to the certificate storage address through the pre-built software development kit (SDK).

[0049] Fifthly, this disclosure provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the certificate distribution method described above.

[0050] This disclosure provides a certificate distribution method, a communication module, a production line certificate distribution device, and a computer-readable storage medium. By setting up a certificate distribution MCU on the production line to form a temporary terminal with the communication module, the certificate distribution of the communication module is realized through the temporary terminal connecting to the production line certificate distribution server. At the same time, the certificate is calculated by calculating the IMEI and written to the address of the communication module. A pre-built unified SDK is used to write the certificate to the communication module according to the certificate storage address. The unified module SDK can realize the fast and automatic distribution of unique certificates to the module. The certificate storage address associated with the IMEI can prevent the stored certificate from being unintentionally tampered with or cracked, thus realizing efficient and secure certificate distribution. Attached Figure Description

[0051] Figure 1 This is a flowchart of a certificate distribution method according to an embodiment of this disclosure;

[0052] Figure 2 This is a schematic diagram of the structure of a temporary terminal according to an embodiment of this disclosure;

[0053] Figure 3 This is an interactive schematic diagram of a terminal verification process according to an embodiment of this disclosure;

[0054] Figure 4 This is an interactive schematic diagram of a certificate distribution process according to an embodiment of this disclosure;

[0055] Figure 5 This is a flowchart of another certificate distribution method according to an embodiment of this disclosure;

[0056] Figure 6 This is a schematic diagram of the structure of a communication module according to an embodiment of this disclosure;

[0057] Figure 7 This is a schematic diagram of the structure of a production line certificate distribution MCU according to an embodiment of this disclosure. Detailed Implementation

[0058] To enable those skilled in the art to better understand the technical solutions of this disclosure, the embodiments of this disclosure will be further described in detail below with reference to the accompanying drawings.

[0059] It is understood that the specific embodiments and accompanying drawings described herein are for illustrative purposes only and are not intended to limit the scope of this disclosure.

[0060] It is understood that, without conflict, the various embodiments and features in the embodiments of this disclosure can be combined with each other.

[0061] It is understood that, for ease of description, only the parts relevant to this disclosure are shown in the accompanying drawings, while parts unrelated to this disclosure are not shown in the drawings.

[0062] It is understood that each unit or module involved in the embodiments of this disclosure may correspond to only one entity structure, or may be composed of multiple entity structures, or multiple units or modules may be integrated into one entity structure.

[0063] It is understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of this disclosure may occur in a different order than that marked in the accompanying drawings.

[0064] It is understood that the flowcharts and block diagrams of this disclosure illustrate the architecture, functions, and operations of possible implementations of systems, apparatuses, devices, and methods according to various embodiments of this disclosure. Each block in a flowchart or block diagram may represent a unit, module, program segment, or code, containing executable instructions for implementing the specified function. Furthermore, each block or combination of blocks in the block diagrams and flowcharts may be implemented using a hardware-based system to implement the specified function, or using a combination of hardware and computer instructions.

[0065] It is understood that the units and modules involved in the embodiments of this disclosure can be implemented by software or by hardware, for example, the units and modules can be located in a processor.

[0066] To facilitate understanding of this disclosure, the main inventive ideas of this disclosure will first be introduced in conjunction with a specific application of this disclosure.

[0067] The device certificate consists of ProductKey (unique product identifier), ProductSecret (product key), and DeviceKey (unique identifier of the device within the product). After carrying the certificate, the device can obtain the corresponding DeviceSecret (device key issued by the platform to the device) from the IoT platform, thereby realizing device registration.

[0068] China Unicom has independently developed the Yanfei 5G (5th Generation Mobile Communication Technology) module and the DMP (Data Management Platform) IoT platform for expansion in the IoT industry. Registering the Yanfei 5G module with the DMP IoT platform requires the corresponding certificate. Previously, the certificates for the Yanfei 5G module were mainly manually inserted via the SDK (Software Development Kit).

[0069] There are currently two ways to embed a certificate:

[0070] 1) After applying for and obtaining the certificate, the certificate is burned onto the module using a programmer. This method requires deploying a programmer, is only suitable for burning one module at a time, cannot be parallelized, requires manual intervention for switching, and is inefficient.

[0071] 2) Certificates are manually pre-installed in the SDK. Since each module requires a different certificate, each module needs to have a different SDK burned. This process takes a lot of time. In addition, the manual modification of the pre-installation method is only suitable for small-scale production and cannot be applied to large-scale production, lacking flexibility.

[0072] Therefore, this disclosure presents a certificate distribution method that, by pre-installing a unified SDK in the 5G communication module, enables rapid, flexible, and large-scale certificate burning, applicable to mass production and changing the existing inefficient 5G module production model. It should be noted that the above description of the certificate embedding in the Unicom Yanfei 5G module does not imply that the applicant acknowledges it as prior art. The relevant technologies of the original Unicom Yanfei 5G module, provided they have not been disclosed in other ways, still belong to the applicant's innovative technologies.

[0073] Example 1:

[0074] like Figure 1 As shown, this disclosure provides a certificate distribution method, which is applied to a communication module and includes:

[0075] S11. The communication module is connected to the production line certificate distribution microcontroller (MCU) to form a temporary terminal, and the temporary terminal is connected to the production line certificate distribution server.

[0076] S12. The communication module receives the certificate storage address and certificate from the production line certificate distribution MCU. The certificate storage address is calculated by the production line certificate distribution MCU based on the International Mobile Equipment Identity (IMEI) of the communication module. The certificate is obtained by the production line certificate distribution MCU from the production line certificate distribution server based on the IMEI of the communication module.

[0077] S13. The communication module saves the certificate according to the certificate storage address using the pre-installed software development kit (SDK).

[0078] In this embodiment, a certificate distribution MCU is set up on the production line to form a temporary terminal with the communication module. The temporary terminal connects to the production line certificate distribution server to realize the certificate distribution of the communication module. At the same time, the certificate is calculated by IMEI and written to the address of the communication module. A pre-set unified SDK is used to write the certificate to the communication module according to the certificate storage address. The unified module SDK can realize the fast and automatic distribution of unique certificates to the module. The certificate storage address associated with IMEI can prevent the stored certificate from being unintentionally tampered with or cracked, thus realizing efficient and secure certificate distribution.

[0079] Specifically, such as Figure 2-4As shown, this embodiment designs a certificate distribution production line. On the production line, a temporary terminal is composed of an "MCU (Microcontroller Unit) + communication module." The MCU is located on the production line. When distributing certificates, the 5G module is replaced, but the MCU remains unchanged. A certificate distribution server is started on the production line, and corresponding server and terminal programs are developed to implement certificate distribution. By pre-installing a unified SDK in the 5G communication module, a unique certificate can be quickly and automatically distributed to the module using this unified module SDK. To prevent unintentional tampering or cracking of the stored certificate, the certificate storage address is calculated using the module's IMEI. Each module has a different certificate storage address. The MCU's built-in algorithm is responsible for the calculation, and the SDK operates on a specific address range. There are no conflicts in certificate distribution between different modules, no manual intervention is required, and certificate security is guaranteed.

[0080] In one embodiment, S11, the communication module and the production line certificate distribution microcontroller (MCU) are connected to form a temporary terminal, and the temporary terminal is connected to the production line certificate distribution server, specifically including:

[0081] The communication module is connected to the production line certificate distribution MCU via a modem command language AT interface to form a temporary terminal. In the temporary terminal, the production line certificate distribution MCU calls the communication module's SDK through AT interface commands.

[0082] The communication module obtains the Internet Protocol (IP) address and connects the temporary terminal to the production line certificate distribution server via the IP address.

[0083] In this embodiment, as Figure 2-4 As shown, module users can use the AT (Atendencies, a modem command language) interface to call the SDK within the "MCU + communication module" architecture. The 5G communication module can automatically obtain an IP (Internet Protocol) address and connect to the certificate distribution server, and can automatically connect to the China Unicom PaaS (Platform as a Service) platform.

[0084] In one embodiment, before the communication module receives the certificate storage address and certificate from the production line certificate distribution MCU in S12, the method further includes:

[0085] The communication module receives an IMEI query command from the production line certificate distribution MCU via the SDK. The SDK queries the communication module to obtain the IMEI of the communication module. The SDK sends the IMEI of the communication module to the production line certificate distribution MCU so that the production line certificate distribution MCU can calculate the certificate storage address based on the received IMEI.

[0086] The communication module receives a public key query command from the production line certificate distribution MCU via the SDK. The SDK sends a pre-stored public key to the production line certificate distribution MCU, so that the production line certificate distribution MCU encrypts the IMEI according to the received public key to form a certificate request ciphertext, and sends the certificate request ciphertext to the production line certificate distribution server, so that the production line certificate distribution server decrypts the certificate request ciphertext using the pre-stored private key, and sends the certificate to the production line certificate distribution MCU according to the decrypted IMEI.

[0087] In this embodiment, as Figure 2-4 As shown, before starting the certificate distribution process, the program firmware is first pre-installed in the terminal, the production line certificate distribution server is connected to the public network, and then a device information data table is created, with the certificate column left blank. Afterwards, each time the terminal requests a certificate from the certificate distribution server, the certificate distribution server calls the IoT platform API (Application Programming Interface) to register and obtain the certificate, and then saves the certificate to the device information data table. The certificate distribution process can then begin. The designed information data table includes, but is not limited to, the following contents in Table 1:

[0088] Table 1. Examples of Information Data Representation

[0089] Fields illustrate IMEI The unique identifier (IMEI) and primary key of equipment on the production line distributeTime Equipment distribution time ProductKey ProductKey issued by the IoT platform, part of the certificate DeviceKey DeviceKey, part of the certificate issued by the IoT platform DeviceSecret DeviceSecret, part of the certificate issued by the IoT platform

[0090] like Figure 3 As shown, each module has an IMEI, and each unified module SDK contains a public key. The IMEI and public key can be obtained via AT commands and used by the server to verify the module. The public key is used for encryption and decryption calls on the production line. The encryption and decryption algorithms exist simultaneously in the production line MCU and the certificate distribution server. The certificate distribution server has a private key corresponding to the public key. After the terminal is powered on, the 5G communication module is in a state where it can receive external AT commands. The MCU sends two AT commands to query and obtain the module's IMEI (International Mobile Equipment Identity) and public key 1, and uses public key 1 to encrypt the IMEI into ciphertext 1. After connecting the certificate distribution server and the terminal via a network such as WiFi (Wireless Fidelity), the IMEI is sent to the certificate distribution server along with the certificate distribution server. The certificate distribution server uses private key 1 to decrypt ciphertext 1 and compares it with the received IMEI. If they match, the terminal is considered trustworthy; otherwise, the terminal or module is considered to have a problem, and an error code is sent back to the terminal.

[0091] For example, the two AT commands can be:

[0092] 1) AT+UNIYFPUB_KEY?

[0093] Successfully returned +UNIYFKEY:<public_key> OK

[0094] 2) AT + CGSN = 1

[0095] Successfully returned +CGSN: <imei>OK

[0096] In one embodiment, in S12, the communication module receives the certificate storage address and certificate from the production line certificate distribution MCU, specifically including:

[0097] The communication module receives the certificate storage address from the production line certificate distribution MCU via the SDK, which is encapsulated using AT interface commands. The certificate storage address is the flash memory address calculated by the production line certificate distribution MCU based on the IMEI of the communication module.

[0098] The communication module receives a certificate encapsulated using AT interface commands from the production line certificate distribution MCU via the SDK, and the certificate has been verified as valid by the production line certificate distribution MCU.

[0099] In this embodiment, as Figure 2-4 As shown, to prevent unintentional tampering or cracking of the stored certificate, the FLASH certificate storage address is designed to be different for each module. The FLASH address is calculated from the module's IMEI. The calculation method for the FLASH certificate storage address based on the IMEI is as follows: First, the IMEI is converted to an ASCII (American Standard Code for Information Interchange) value, then CRC32 (cyclic redundancy check) is used for hash processing, and the last two bits of the hash value are extracted as the address offset, which is then mapped to the FLASH address range.

[0100] like Figure 4 As shown, the certificate distribution process includes:

[0101] 1) The terminal begins requesting a device certificate from the certificate distribution server;

[0102] 2) When the certificate distribution server receives a certificate request from a device, it queries the device information data table based on the IMEI in the request, and performs the following subsequent operations based on the query results:

[0103] 2-1) If the IMEI identifier passed by the terminal is not found, a device invalid error is returned;

[0104] 2-2) If there is a corresponding IMEI identifier and a device certificate already exists, return the device certificate;

[0105] 2-3) If there is a corresponding IMEI identifier but no device certificate, then call the IoT (China Unicom PAAS) platform API to register the device, obtain the certificate, and then send it to the terminal.

[0106] After the terminal receives the returned valid certificate (such as verification, certificate length meets requirements, etc.), it transmits the certificate to the module via AT command. Since the FLASH address is calculated by the production line MCU through the IMEI of the 5G module, the certificate is saved in the internal FLASH associated with the IMEI.

[0107] In one embodiment, S13, the communication module saves the certificate according to the certificate storage address using a pre-installed software development kit (SDK), specifically including:

[0108] The SDK saves the certificate to the FLASH address range corresponding to the certificate storage address;

[0109] The SDK retrieves the saved certificate based on the certificate storage address and connects to the IoT platform via the certificate to test the certificate's availability.

[0110] In response to the test result indicating that the certificate is available, the SDK sends a message to the production line certificate distribution MCU indicating that the certificate has been successfully saved. This prompts the production line certificate distribution MCU to send the received message to the production line certificate distribution server, which then records the certificate distribution time.

[0111] In this embodiment, the decision to use a certificate to connect to the IoT platform for certificate availability testing can be made based on actual circumstances. This increases the distribution time per unit on the production line. Situations requiring increased testing include: for 5G module customers, confirming connectivity to China Unicom's PaaS is crucial; the delivery time of a certain batch of 5G modules allows the production line to test certificate availability; and the revenue from a certain batch of 5G modules can cover the increased testing costs. If the terminal does not receive a valid certificate, a local alarm notifies the operator to confirm whether information such as the IMEI is normal. After the 5G module obtains a valid certificate, it returns a success message to the distribution server. Upon receiving the success message, the certificate distribution server writes the device distribution time to its database, indicating that the certificate has been successfully distributed. If the certificate distribution server does not receive a message within a certain period, it will notify the terminal to confirm whether the module has obtained a valid certificate. If a failure message is received, the certificate distribution server will not record the device distribution time, and will then decide whether to re-distribute the certificate based on the reason for the failure.

[0112] In one embodiment, after the SDK saves the certificate to the FLASH address range corresponding to the certificate storage address, the method further includes:

[0113] In response to receiving an AT interface command from the production line certificate distribution MCU via the SDK to modify / delete a certificate, the SDK calls the pre-encapsulated application programming interface (API) for modifying / deleting the certificate to modify / delete the certificate stored in the FLASH address range corresponding to the certificate storage address.

[0114] In this embodiment, the AT command for the certificate transmission module is:

[0115] AT+UNIYFKEY=" <productkey> "，" <devicekey> "," <productsecret> "," <devicesecret>[,<cert_name> ,<cert_size> ]

[0116] Successfully returned: +UNIYFKEY:OK

[0117] Failure response: +UNIYFKEY:<err_code>

[0118] in<cert_name> : Reserved, string type, the name of the certificate or private key to be added;

[0119] <cert_size> : Reserved, integer, the length of the certificate or private key to be added.

[0120] The AT command sent by the terminal to query whether the module's FLASH address already has a device certificate is:

[0121] AT+UNIYFFCHKCERT= <address>, <length>

[0122] Successful response: +UNIYFFCHKCERT:OK

[0123] Failure response: +UNIYFFCHKCERT:NOT FOUND

[0124] in <address>This is the start of the FLASH address segment. <length>Decrease the address offset by 1.

[0125] Users can directly add / modify certificates using AT commands. After writing the certificate, the certificate flag bit at the specified address in the module's FLASH memory changes to 1. Users can also set the flag bit to 0 using AT commands, which will simultaneously clear the certificate. The difference between modifying and adding a certificate is that the flag bit is 0 when adding a certificate, and 1 when modifying it. When adding a certificate, if the flag bit is 1, it indicates that the module has completed certificate distribution, and an AT command can be sent to initiate the normal device management platform authentication process, thus exiting the certificate distribution process; if the flag bit is 0, the certificate distribution process will proceed.

[0126] This embodiment 1, through production line modification, designs an offline terminal verification and certificate distribution method for 5G communication modules. Using a unified module SDK, it can quickly and automatically distribute unique certificates to modules. Address calculation ensures that certificate distribution between different modules does not conflict, requiring no manual intervention and guaranteeing certificate security. The entire process includes information data table design, terminal verification, and certificate distribution, modification, and storage. The 5G module can be replaced with a CAT.1 module or a 4G module, etc.

[0127] Example 2:

[0128] like Figure 5 As shown, this disclosure provides a certificate distribution method, which is applied to a production line certificate distribution device. The production line certificate distribution device includes a production line certificate distribution microcontroller unit (MCU) and a production line certificate distribution server, and the method includes:

[0129] S21. The production line certificate distribution MCU is connected to the communication module to form a temporary terminal, and the temporary terminal is connected to the production line certificate distribution server.

[0130] S22. The production line certificate distribution MCU calculates the certificate storage address based on the International Mobile Equipment Identity (IMEI) of the communication module, and obtains the certificate from the production line certificate distribution server based on the IMEI of the communication module.

[0131] S23. The production line certificate distribution MCU sends the certificate storage address and certificate to the communication module, so that the communication module can save the certificate according to the certificate storage address through the pre-built software development kit (SDK).

[0132] In one embodiment, S21, the production line certificate distribution MCU is connected to the communication module to form a temporary terminal, and the temporary terminal is connected to the production line certificate distribution server, specifically including:

[0133] The production line certificate distribution MCU and the communication module are connected via a modem command language (AT) interface to form a temporary terminal. In the temporary terminal, the production line certificate distribution MCU calls the communication module's SDK through the AT interface commands. The communication module obtains the Internet Protocol (IP) address and connects the temporary terminal to the production line certificate distribution server through the IP address.

[0134] In one embodiment, S22, the production line certificate distribution MCU calculates the certificate storage address based on the International Mobile Equipment Identity (IMEI) of the communication module, and obtains the certificate from the production line certificate distribution server based on the IMEI of the communication module, specifically including:

[0135] The production line certificate distribution MCU sends an IMEI query command to the communication module's SDK, so that the SDK queries the communication module to obtain the communication module's IMEI and sends the IMEI to the production line certificate distribution MCU. The production line certificate distribution MCU calculates the certificate storage address based on the received IMEI.

[0136] The production line certificate distribution MCU sends a public key query command to the communication module's SDK, causing the SDK to send a pre-stored public key to the production line certificate distribution MCU. The production line certificate distribution MCU encrypts the IMEI based on the received public key to form a certificate request ciphertext, and sends the certificate request ciphertext to the production line certificate distribution server. The production line certificate distribution server then uses a pre-stored private key to decrypt the certificate request ciphertext and sends the certificate to the production line certificate distribution MCU based on the decrypted IMEI.

[0137] In one implementation, the production line certificate distribution MCU calculates the certificate storage address based on the received IMEI, specifically including:

[0138] The production line certificate distribution MCU uses the IMEI of the communication module to obtain the flash address as the certificate storage address through code conversion, redundancy check, hash processing, and address offset.

[0139] In one implementation, in step S23, the production line certificate distribution MCU sends the certificate storage address and the certificate to the communication module, specifically including:

[0140] The production line certificate distribution MCU sends the certificate storage address, which is encapsulated in AT interface commands, to the communication module's SDK;

[0141] The production line certificate distribution MCU verifies the validity of the certificate from the production line certificate distribution server and sends the verified valid certificate, encapsulated in AT interface commands, to the communication module's SDK.

[0142] In one embodiment, after the production line certificate distribution MCU sends the certificate storage address and certificate to the communication module in S23, the method further includes:

[0143] The production line certificate distribution MCU receives a certificate saving success message from the communication module's SDK and sends the received certificate saving success message to the production line certificate distribution server so that the production line certificate distribution server records the certificate distribution time.

[0144] In one embodiment, after sending a message indicating successful certificate saving to the production line certificate distribution server, the method further includes:

[0145] In response to receiving a certificate modification / deletion instruction from the production line certificate distribution server, an AT interface command for modifying / deleting the certificate is sent to the SDK of the communication module. This causes the SDK to call the pre-encapsulated application programming interface (API) for modifying / deleting the certificate to modify / delete the certificate stored in the FLASH address range corresponding to the certificate storage address.

[0146] Example 3:

[0147] like Figure 2 As shown, this disclosure provides a communication module, which includes a pre-installed software development kit (SDK) and comprises:

[0148] The first connection module 11 is used to connect with the production line certificate distribution microcontroller MCU to form a temporary terminal, and the temporary terminal is connected to the production line certificate distribution server.

[0149] The first transceiver module 12 is connected to the first connection module 11 and is used to receive the certificate storage address and certificate from the production line certificate distribution MCU. The certificate storage address is calculated by the production line certificate distribution MCU based on the International Mobile Equipment Identity (IMEI) of the communication module, and the certificate is obtained by the production line certificate distribution MCU from the production line certificate distribution server based on the IMEI of the communication module.

[0150] The first storage module 13 is connected to the first transceiver module 12 and is used to save the certificate according to the certificate storage address through the SDK.

[0151] In one embodiment, the first connection module 11 specifically includes:

[0152] The first AT connection unit is used to connect with the production line certificate distribution MCU through the modem command language AT interface, so that the communication module and the production line certificate distribution MCU form a temporary terminal. In the temporary terminal, the production line certificate distribution MCU calls the SDK of the communication module through the AT interface command.

[0153] The first IP connection unit, connected to the first AT connection unit, is used to form a temporary terminal. After the communication module obtains the Internet Protocol IP address, it connects the temporary terminal to the production line certificate distribution server through the IP address.

[0154] In one embodiment, the first transceiver module 12 further includes:

[0155] The first IMEI transceiver unit is used for the communication module to receive an IMEI query command from the production line certificate distribution MCU via the SDK. The SDK queries the communication module to obtain the IMEI of the communication module and sends the IMEI of the communication module to the production line certificate distribution MCU so that the production line certificate distribution MCU can calculate the certificate storage address based on the received IMEI.

[0156] The first public key transceiver unit is used by the communication module to receive a public key query instruction from the production line certificate distribution MCU via the SDK. The SDK sends a pre-stored public key to the production line certificate distribution MCU so that the production line certificate distribution MCU can encrypt the IMEI according to the received public key to form a certificate request ciphertext, and send the certificate request ciphertext to the production line certificate distribution server so that the production line certificate distribution server can decrypt the certificate request ciphertext using the pre-stored private key, and send the certificate to the production line certificate distribution MCU according to the decrypted IMEI.

[0157] In one embodiment, the first transceiver module 12 specifically includes:

[0158] The first address receiving unit is used for the communication module to receive the certificate storage address encapsulated by the production line certificate distribution MCU using AT interface commands through the SDK. The certificate storage address is the flash memory address calculated by the production line certificate distribution MCU based on the IMEI of the communication module.

[0159] The first certificate receiving unit is used by the communication module to receive a certificate encapsulated by AT interface commands from the production line certificate distribution MCU via the SDK, and the certificate has been verified as valid by the production line certificate distribution MCU.

[0160] In one embodiment, the first storage module 13 specifically includes:

[0161] The first storage unit is used by the SDK to save the certificate to the FLASH address range corresponding to the certificate storage address;

[0162] The first test unit is used by the SDK to obtain the saved certificate according to the certificate storage address, and connect to the IoT platform through the certificate to test the certificate availability;

[0163] The first success message sending unit is used to respond to the test result indicating that the certificate is available. The SDK sends a certificate saving success message to the production line certificate distribution MCU, so that the production line certificate distribution MCU sends the received certificate saving success message to the production line certificate distribution server, so that the production line certificate distribution server records the certificate distribution time.

[0164] In one embodiment, the first storage module 13 further includes:

[0165] The first modification / deletion unit is used to respond to the AT interface command for modifying / deleting certificates received from the production line certificate distribution MCU via the SDK. The SDK calls the pre-encapsulated application programming interface (API) for modifying / deleting certificates to modify / delete the certificates stored in the FLASH address range corresponding to the certificate storage address.

[0166] Example 4:

[0167] like Figure 7 As shown, this disclosure provides a production line certificate distribution device, which includes a production line certificate distribution microcontroller unit (MCU) and a production line certificate distribution server. The production line certificate distribution MCU includes:

[0168] The second connection module 21 is used to connect with the communication module to form a temporary terminal, and the temporary terminal is connected to the production line certificate distribution server.

[0169] The second acquisition module 22, connected to the second connection module 21, is used to calculate the certificate storage address based on the International Mobile Equipment Identity (IMEI) of the communication module, and to obtain the certificate from the production line certificate distribution server based on the IMEI of the communication module.

[0170] The second transceiver module 23, connected to the second acquisition module 22, is used to send the certificate storage address and the certificate to the communication module so that the communication module can save the certificate according to the certificate storage address through the pre-built software development kit (SDK).

[0171] In one embodiment, the second connection module 21 specifically includes:

[0172] The second AT connection unit is used to connect to the communication module via the modem command language AT interface, so that the production line certificate distribution MCU and the communication module form a temporary terminal. In the temporary terminal, the production line certificate distribution MCU calls the SDK of the communication module through the AT interface command, the communication module obtains the Internet Protocol IP address, and connects the temporary terminal to the production line certificate distribution server through the IP address.

[0173] In one embodiment, the second acquisition module 22 specifically includes:

[0174] The second address acquisition unit is used for the production line certificate distribution MCU to send an IMEI query instruction to the communication module's SDK, so that the SDK queries the communication module to obtain the IMEI of the communication module, and sends the IMEI to the production line certificate distribution MCU. The production line certificate distribution MCU calculates the certificate storage address based on the received IMEI.

[0175] The second certificate acquisition unit is used for the production line certificate distribution MCU to send a public key query instruction to the communication module's SDK, so that the SDK sends a pre-stored public key to the production line certificate distribution MCU. The production line certificate distribution MCU encrypts the IMEI according to the received public key to form a certificate request ciphertext, and sends the certificate request ciphertext to the production line certificate distribution server, so that the production line certificate distribution server decrypts the certificate request ciphertext using the pre-stored private key, and sends the certificate to the production line certificate distribution MCU according to the decrypted IMEI.

[0176] In one embodiment, the second address acquisition unit specifically includes:

[0177] The address calculation unit is used by the production line certificate distribution MCU to obtain the flash address of the communication module through code conversion, redundancy check, hash processing and address offset to serve as the certificate storage address.

[0178] In one embodiment, the second transceiver module 23 specifically includes:

[0179] The second address sending unit is used for the production line certificate distribution MCU to send the certificate storage address encapsulated in AT interface commands to the communication module's SDK;

[0180] The second certificate sending unit is used by the production line certificate distribution MCU to verify the validity of the certificate from the production line certificate distribution server and send the valid certificate, which is encapsulated in AT interface commands, to the communication module's SDK.

[0181] In one embodiment, the second transceiver module 23 further includes:

[0182] The second success message sending and receiving unit is used for the production line certificate distribution MCU to receive a certificate saving success message from the SDK of the communication module, and to send the received certificate saving success message to the production line certificate distribution server so that the production line certificate distribution server records the certificate distribution time.

[0183] In one embodiment, the second transceiver module 23 further includes:

[0184] The second deletion / deletion information transceiver unit is used to respond to the received modification / deletion certificate instruction from the production line certificate distribution server by sending an AT interface command for modifying / deleting the certificate to the SDK of the communication module, so that the SDK calls the pre-encapsulated application programming interface (API) for modifying / deleting the certificate to modify / delete the certificate stored in the FLASH address range corresponding to the certificate storage address.

[0185] Example 5:

[0186] Embodiment 5 of this disclosure provides a computer-readable storage medium storing a computer program. When the computer program is run by a processor, it implements the certificate distribution method as described in Embodiment 1, or the communication module as described in Embodiment 2, or the production line certificate distribution device as described in Embodiment 3.

[0187] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules, or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory or other memory technologies, CD-ROM (Compact Disc Read-Only Memory), DVD or other optical disc storage, cartridges, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer.

[0188] In addition, this disclosure may also provide a computer device including a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor executes the certificate distribution method as described in Embodiment 1. The computer device may be a communication module as described in Embodiment 2 or a production line certificate distribution device as described in Embodiment 3.

[0189] The memory is connected to the processor. The memory can be flash memory, read-only memory or other types of memory. The processor can be a central processing unit or a microcontroller.

[0190] Embodiments 1-5 of this disclosure provide a certificate distribution method, a communication module, a production line certificate distribution device, and a computer-readable storage medium. By setting up a certificate distribution MCU on the production line to form a temporary terminal with the communication module, the certificate distribution of the communication module is realized through the temporary terminal connecting to the production line certificate distribution server. At the same time, the certificate is calculated by IMEI and written to the address of the communication module. A pre-set unified SDK is used to write the certificate to the communication module according to the certificate storage address. The unified module SDK can realize the fast and automatic distribution of unique certificates to the module. The certificate storage address associated with IMEI can prevent the stored certificate from being unintentionally tampered with or cracked, thus realizing efficient and secure certificate distribution.

[0191] It is understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of this disclosure, and this disclosure is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and substance of this disclosure, and these modifications and improvements are also considered to be within the scope of protection of this disclosure.< / length> < / address> < / length> < / address> < / devicesecret> < / productsecret> < / devicekey> < / productkey> < / imei>

Claims

1. A certificate distribution method, characterized in that, The method is applied to a communication module and includes: The communication module is connected to the production line certificate distribution microcontroller (MCU) to form a temporary terminal, and the temporary terminal is connected to the production line certificate distribution server. The communication module receives the certificate storage address and certificate from the production line certificate distribution MCU. The certificate storage address is calculated by the production line certificate distribution MCU based on the communication module's International Mobile Equipment Identity (IMEI), and the certificate is obtained by the production line certificate distribution MCU from the production line certificate distribution server based on the communication module's IMEI. The communication module saves the certificate according to the certificate storage address using a pre-installed software development kit (SDK).

2. The method according to claim 1, characterized in that, The communication module is connected to the production line certificate distribution microcontroller (MCU) to form a temporary terminal. The temporary terminal is connected to the production line certificate distribution server, specifically including: The communication module is connected to the production line certificate distribution MCU via a modem command language AT interface to form a temporary terminal. In the temporary terminal, the production line certificate distribution MCU calls the communication module's SDK through AT interface commands. The communication module obtains the Internet Protocol (IP) address and connects the temporary terminal to the production line certificate distribution server via the IP address.

3. The method according to claim 1 or 2, characterized in that, Before the communication module receives the certificate storage address and certificate from the production line certificate distribution MCU, the method further includes: The communication module receives an IMEI query command from the production line certificate distribution MCU via the SDK. The SDK queries the communication module to obtain the IMEI of the communication module. The SDK sends the IMEI of the communication module to the production line certificate distribution MCU so that the production line certificate distribution MCU can calculate the certificate storage address based on the received IMEI. The communication module receives a public key query command from the production line certificate distribution MCU via the SDK. The SDK sends a pre-stored public key to the production line certificate distribution MCU, so that the production line certificate distribution MCU encrypts the IMEI according to the received public key to form a certificate request ciphertext, and sends the certificate request ciphertext to the production line certificate distribution server, so that the production line certificate distribution server decrypts the certificate request ciphertext using the pre-stored private key, and sends the certificate to the production line certificate distribution MCU according to the decrypted IMEI.

4. The method according to claim 1 or 2, characterized in that, The communication module receives the certificate storage address and certificate from the production line certificate distribution MCU, specifically including: The communication module receives the certificate storage address from the production line certificate distribution MCU via the SDK, which is encapsulated using AT interface commands. The certificate storage address is the flash memory address calculated by the production line certificate distribution MCU based on the IMEI of the communication module. The communication module receives a certificate encapsulated using AT interface commands from the production line certificate distribution MCU via the SDK, and the certificate has been verified as valid by the production line certificate distribution MCU.

5. The method according to claim 4, characterized in that, The communication module saves the certificate according to the certificate storage address using a pre-built software development kit (SDK), specifically including: The SDK saves the certificate to the FLASH address range corresponding to the certificate storage address; The SDK retrieves the saved certificate based on the certificate storage address and connects to the IoT platform via the certificate to test the certificate's availability. In response to the test result indicating that the certificate is available, the SDK sends a message to the production line certificate distribution MCU indicating that the certificate has been successfully saved. This prompts the production line certificate distribution MCU to send the received message to the production line certificate distribution server, which then records the certificate distribution time.

6. The method according to claim 5, characterized in that, After the SDK saves the certificate to the FLASH address range corresponding to the certificate storage address, the method further includes: In response to receiving an AT interface command from the production line certificate distribution MCU via the SDK to modify / delete a certificate, the SDK calls the pre-encapsulated application programming interface (API) for modifying / deleting the certificate to modify / delete the certificate stored in the FLASH address range corresponding to the certificate storage address.

7. A certificate distribution method, characterized in that, The method is applied to a production line certificate distribution device, which includes a production line certificate distribution microcontroller unit (MCU) and a production line certificate distribution server, and the method includes: The production line certificate distribution MCU connects to the communication module to form a temporary terminal, and the temporary terminal connects to the production line certificate distribution server. The production line certificate distribution MCU calculates the certificate storage address based on the International Mobile Equipment Identity (IMEI) of the communication module, and retrieves the certificate from the production line certificate distribution server based on the IMEI of the communication module. The production line certificate distribution MCU sends the certificate storage address and certificate to the communication module, so that the communication module can save the certificate according to the certificate storage address through the pre-built software development kit (SDK).

8. The method according to claim 7, characterized in that, The production line certificate distribution MCU connects to the communication module to form a temporary terminal, which then connects to the production line certificate distribution server. Specifically, this includes: The production line certificate distribution MCU and the communication module are connected via a modem command language (AT) interface to form a temporary terminal. In the temporary terminal, the production line certificate distribution MCU calls the communication module's SDK through the AT interface commands. The communication module obtains the Internet Protocol (IP) address and connects the temporary terminal to the production line certificate distribution server through the IP address.

9. The method according to claim 8 or 7, characterized in that, The production line certificate distribution MCU calculates the certificate storage address based on the International Mobile Equipment Identity (IMEI) of the communication module, and retrieves the certificate from the production line certificate distribution server based on the IMEI of the communication module. Specifically, this includes: The production line certificate distribution MCU sends an IMEI query command to the communication module's SDK, so that the SDK queries the communication module to obtain the communication module's IMEI and sends the IMEI to the production line certificate distribution MCU. The production line certificate distribution MCU calculates the certificate storage address based on the received IMEI. The production line certificate distribution MCU sends a public key query command to the communication module's SDK, causing the SDK to send a pre-stored public key to the production line certificate distribution MCU. The production line certificate distribution MCU encrypts the IMEI based on the received public key to form a certificate request ciphertext, and sends the certificate request ciphertext to the production line certificate distribution server. The production line certificate distribution server then uses a pre-stored private key to decrypt the certificate request ciphertext and sends the certificate to the production line certificate distribution MCU based on the decrypted IMEI.

10. The method according to claim 9, characterized in that, The production line certificate distribution MCU calculates the certificate storage address based on the received IMEI, specifically including: The production line certificate distribution MCU uses the IMEI of the communication module to obtain the flash address as the certificate storage address through code conversion, redundancy check, hash processing, and address offset.

11. The method according to claim 10, characterized in that, The production line certificate distribution MCU sends the certificate storage address and certificate to the communication module, specifically including: The production line certificate distribution MCU sends the certificate storage address, which is encapsulated in AT interface commands, to the communication module's SDK; The production line certificate distribution MCU verifies the validity of the certificate from the production line certificate distribution server and sends the verified valid certificate, encapsulated in AT interface commands, to the communication module's SDK.

12. The method according to claim 11, characterized in that, After the production line certificate distribution MCU sends the certificate storage address and certificate to the communication module, the method further includes: The production line certificate distribution MCU receives a certificate saving success message from the communication module's SDK and sends the received certificate saving success message to the production line certificate distribution server so that the production line certificate distribution server records the certificate distribution time.

13. The method according to claim 12, characterized in that, After sending a message confirming successful certificate saving to the production line certificate distribution server, the method further includes: In response to receiving a certificate modification / deletion instruction from the production line certificate distribution server, an AT interface command for modifying / deleting the certificate is sent to the SDK of the communication module. This causes the SDK to call the pre-encapsulated application programming interface (API) for modifying / deleting the certificate to modify / delete the certificate stored in the FLASH address range corresponding to the certificate storage address.

14. A communication module, characterized in that, The communication module comes pre-installed with a software development kit (SDK), which includes: The first connection module is used to connect with the production line certificate distribution microcontroller MCU to form a temporary terminal, and the temporary terminal is connected to the production line certificate distribution server. The first transceiver module, connected to the first connection module, is used to receive the certificate storage address and certificate from the production line certificate distribution MCU. The certificate storage address is calculated by the production line certificate distribution MCU based on the International Mobile Equipment Identity (IMEI) of the communication module, and the certificate is obtained by the production line certificate distribution MCU from the production line certificate distribution server based on the IMEI of the communication module. The first storage module, connected to the first transceiver module, is used to save the certificate according to the certificate storage address via the SDK.

15. A production line certificate distribution device, characterized in that, The production line certificate distribution device includes a production line certificate distribution microcontroller unit (MCU) and a production line certificate distribution server, and the production line certificate distribution MCU includes: The second connection module is used to connect with the communication module to form a temporary terminal, and the temporary terminal is connected to the production line certificate distribution server. The second acquisition module, connected to the second connection module, is used to calculate the certificate storage address based on the International Mobile Equipment Identity (IMEI) of the communication module, and to obtain the certificate from the production line certificate distribution server based on the IMEI of the communication module. The second transceiver module, connected to the second acquisition module, is used to send the certificate storage address and the certificate to the communication module, so that the communication module can save the certificate according to the certificate storage address through the pre-built software development kit (SDK).

16. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the certificate distribution method as described in any one of claims 1-6 or 7-13.

Images