Certificate management method, device and equipment

Abstract

The invention provides a certificate management method, device and equipment, and relates to the technical field of vehicle network security. The method comprises the following steps: under the condition that a certificate configuration request of a vehicle manufacturing end is received, sending equipment certificate information to the vehicle manufacturing end; the equipment certificate information comprises at least two groups of certificate data; each group of certificate data comprises a first certificate and a first certificate chain corresponding to one business application; activating a first target certificate and a first target certificate chain in the equipment certificate information according to a certificate activation authorization file fed back by the vehicle manufacturing end; the first certificate and the first certificate chain are used for performing communication verification with a cloud platform. According to the scheme of the invention, the problems that the switching operation needs to be manually and frequently carried out among different environments in the test joint debugging stage of the vehicle, the probability of switching failure is high, and the network security in the switching process cannot be ensured can be solved.

Description

Technical Field

[0001] The present invention relates to the field of vehicle network security technology, and in particular to a certificate management method, device and equipment. Background Art

[0002] The network connection between the vehicle and the backend service system usually uses a two-way TLS mechanism to ensure communication security. During the TLS handshake process, the vehicle and the platform will pass their own certificates to each other, and they will use the locally preset CA certificate chain to verify the other party's certificate. Only after the verification is passed will the current process continue until the TLS handshake is completed.

[0003] At present, the business system of the Internet of Vehicles cloud platform deploys at least two environments: the test environment and the production environment, and some also have a pre-production environment. Usually, different environments use different certificates and certificate chains. At the same time, the vehicle supports a large number of Internet of Vehicles business functions and features, such as OTA, remote control, remote diagnosis, etc. The development and testing of each business function are usually independent of each other, and the development progress varies greatly. As a result, the vehicle needs to be frequently switched between the test environment and the production environment manually during the test and joint debugging stage. The probability of switching failure is high, and the security of the network cannot be guaranteed during the switching process. Summary of the invention

[0004] The embodiments of the present invention provide a certificate management method, device and equipment to solve the problem in the prior art that vehicles need to frequently perform manual switching operations between different environments during the test and debugging stage, the probability of switching failure is high, and the security of the network cannot be guaranteed during the switching process.

[0005] In order to solve the above technical problems, the present invention adopts the following technical solutions:

[0006] In a first aspect, an embodiment of the present invention provides a certificate management method, which is applied to a vehicle, and includes:

[0007] Upon receiving a certificate configuration request from a vehicle manufacturing end, sending device certificate information to the vehicle manufacturing end; the device certificate information includes at least two groups of certificate data; each group of certificate data includes a first certificate and a first certificate chain corresponding to a business application;

[0008] According to the certificate activation authorization file fed back by the vehicle manufacturing end, the first target certificate and the first target certificate chain in the device certificate information are activated; the certificate activation authorization file is generated based on the device certificate information, and the first certificate and the first certificate chain are used for communication verification with the cloud platform.

[0009] Further, according to the certificate activation authorization file fed back by the vehicle manufacturing end, activating the first target certificate and the first target certificate chain in the device certificate information includes:

[0010] Performing signature verification on the certificate activation authorization file fed back by the vehicle manufacturing end;

[0011] In a case where the certificate activation authorization file passes the signature verification, determining the first target certificate and the first target certificate chain corresponding to the business application identifier according to the business application identifier fed back by the cloud platform;

[0012] The first target certificate and the first target certificate chain are activated, and the certificate activation authorization file is saved.

[0013] Further, the certificate activation authorization document includes: validity period;

[0014] According to the certificate activation authorization file fed back by the vehicle manufacturing end, activating the first target certificate and the first target certificate chain in the device certificate information includes:

[0015] Performing signature verification on the certificate activation authorization file fed back by the vehicle manufacturing end;

[0016] When the certificate activation authorization document passes the signature verification and is within the validity period, the first target certificate and the first target certificate chain are activated.

[0017] Further, according to the certificate activation authorization file fed back by the vehicle manufacturing end, activating the first target certificate and the first target certificate chain in the device certificate information includes:

[0018] When the certificate activation authorization document passes the signature verification and exceeds the validity period, activating the second target certificate and the second target certificate chain;

[0019] The second target certificate is a preconfigured certificate, and the second target certificate chain is a preconfigured certificate chain.

[0020] Furthermore, the method further comprises:

[0021] Receive a certificate call request sent by the cloud platform, wherein the certificate call request carries a business application identifier;

[0022] The third target certificate in the device certificate information and the target key corresponding to the third target certificate are obtained according to the business application identifier; the third target certificate and the third target certificate chain are used for communication verification with the cloud platform.

[0023] In a second aspect, an embodiment of the present invention provides a certificate management method, which is applied to a vehicle manufacturing end, including:

[0024] Send a certificate configuration request to the vehicle;

[0025] Forwarding the received device certificate information to the cloud platform, the device certificate information including at least two groups of certificate data; each group of certificate data including a first certificate and a first certificate chain corresponding to a business application;

[0026] The certificate activation authorization file received from the cloud platform is forwarded to the vehicle.

[0027] In a third aspect, an embodiment of the present invention provides a certificate management method, which is applied to a cloud platform, including:

[0028] Receiving device certificate information sent by a vehicle manufacturing end; the device certificate information includes at least two groups of certificate data; each group of certificate data includes a first certificate and a first certificate chain corresponding to a business application;

[0029] Generate certificate activation authorization data according to the device certificate information;

[0030] Signing the certificate activation authorization data to obtain a certificate activation authorization file;

[0031] The certificate activation authorization file is sent to the vehicle manufacturing end.

[0032] In a fourth aspect, an embodiment of the present invention provides a certificate management device, applied to a vehicle, comprising:

[0033] A first sending module is used to send device certificate information to the vehicle manufacturing end when receiving a certificate configuration request from the vehicle manufacturing end; the device certificate information includes at least two groups of certificate data; each group of certificate data includes a first certificate and a first certificate chain corresponding to a business application;

[0034] An activation module is used to activate the first target certificate and the first target certificate chain in the device certificate information according to the certificate activation authorization file fed back by the vehicle manufacturing end; the certificate activation authorization file is generated according to the device certificate information, and the first certificate and the first certificate chain are used for communication verification with the cloud platform.

[0035] In a fifth aspect, an embodiment of the present invention provides a certificate management device, which is applied to a vehicle manufacturing end, including:

[0036] A second sending module, used to send a certificate configuration request to the vehicle;

[0037] A third sending module is used to forward the received device certificate information to the cloud platform, wherein the device certificate information includes at least two groups of certificate data; each group of certificate data includes a first certificate and a first certificate chain corresponding to a business application;

[0038] The fourth sending module is used to forward the certificate activation authorization file received from the cloud platform to the vehicle.

[0039] In a sixth aspect, an embodiment of the present invention provides a certificate management device, applied to a cloud platform, including:

[0040] A receiving module, used to receive device certificate information sent by a vehicle manufacturing end; the device certificate information includes at least two groups of certificate data; each group of certificate data includes a first certificate and a first certificate chain corresponding to a business application;

[0041] A generating module, used to generate certificate activation authorization data according to the device certificate information;

[0042] A signature module, used to sign the certificate activation authorization data to obtain a certificate activation authorization file;

[0043] The fifth sending module is used to send the certificate activation authorization file to the vehicle manufacturing end.

[0044] The beneficial effects of the present invention are:

[0045] The certificate management method of the embodiment of the present invention, by presetting at least two groups of certificate data on the vehicle side, can send the device certificate information to the vehicle manufacturing side when the vehicle side receives a certificate configuration request from the vehicle manufacturing side, so that the vehicle manufacturing side can feedback the certificate activation authorization file according to the device certificate information, and determine the first target certificate and the first target certificate chain that need to be activated in the device certificate information, so that the vehicle side determines the activated certificate and certificate chain according to the needs of the cloud platform, thereby ensuring smooth communication verification between the vehicle and the cloud platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 A schematic diagram showing the steps of a certificate management method applied to a vehicle according to an embodiment of the present invention;

[0047] Figure 2 A schematic diagram showing the steps of a certificate management method applied to a vehicle manufacturing end according to an embodiment of the present invention;

[0048] Figure 3 A schematic diagram showing the steps of a certificate management method applied to a cloud platform according to an embodiment of the present invention;

[0049] Figure 4 A logical schematic diagram showing a certificate management method according to an embodiment of the present invention;

[0050] Figure 5 A schematic diagram showing the structure of a certificate management device applied to a vehicle according to an embodiment of the present invention;

[0051] Figure 6 A schematic diagram showing the structure of a certificate management device applied to a vehicle manufacturing end according to an embodiment of the present invention;

[0052] Figure 7 A schematic diagram showing the structure of a certificate management device applied to a cloud platform according to an embodiment of the present invention;

[0053] Figure 8 A schematic diagram showing the structure of a certificate management device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0054] In order to make the technical problems, technical solutions and advantages to be solved by the present invention clearer, the following will be described in detail in conjunction with the accompanying drawings and specific embodiments. In the following description, specific details such as specific configurations and components are provided only to help fully understand the embodiments of the present invention. Therefore, it should be clear to those skilled in the art that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present invention. In addition, for clarity and brevity, the description of known functions and structures is omitted.

[0055] It should be understood that the references to "one embodiment" or "an embodiment" throughout the specification mean that the specific features, structures, or characteristics associated with the embodiment are included in at least one embodiment of the present invention. Therefore, the references to "in one embodiment" or "in an embodiment" appearing throughout the specification do not necessarily refer to the same embodiment. In addition, these specific features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0056] The present invention provides a certificate management method, device and equipment to address the problems that vehicles need to frequently perform manual switching operations between different environments during the test and joint debugging stage, the probability of switching failure is high, and the security of the network cannot be guaranteed during the switching process.

[0057] like Figure 1 As shown, an embodiment of the present invention provides a certificate management method, which is applied to a vehicle and includes the following steps:

[0058] Step 101, upon receiving a certificate configuration request from a vehicle manufacturing end, sending device certificate information to the vehicle manufacturing end; the device certificate information includes at least two groups of certificate data; each group of certificate data includes a first certificate and a first certificate chain corresponding to a business application;

[0059] Step 102, according to the certificate activation authorization file fed back by the vehicle manufacturing end, activate the first target certificate and the first target certificate chain in the device certificate information; the certificate activation authorization file is generated according to the device certificate information, and the first certificate and the first certificate chain are used for communication verification with the cloud platform.

[0060] Optionally, the device certificate information also includes a device identification, that is, a device identification of the vehicle.

[0061] In the embodiment of the present invention, the communication client certificate signature application of the vehicle component equipment has been submitted to the electronic seal system, and the secure transport layer protocol TLS communication client certificate of the component equipment is issued by the electronic seal system to generate the device certificate information, and is deployed in the vehicle, including a first certificate DEV_TLS_CERT_TEST for the test environment, and a second certificate DEV_TLS_CERT_PROD for the production environment;

[0062] The device certificate information includes two sets of certificate data, such as the first certificate, the certificate chain of the first certificate of the test environment, the test public key DEV_TLS_PK_TES, and the test private key DEV_TLS_SK_TEST; and the second certificate, the second certificate chain of the production environment, the production public key DEV_TLS_PK_PROD, and the production private key DEV_TLS_SK_PROD; and the test public key, the test private key, the production public key, and the production private key are pre-generated for the vehicle;

[0063] The test environment and production environment of the cloud platform have generated TLS communication server public and private key pairs, and the electronic seal system issues TLS communication server certificates for the test environment and production environment respectively;

[0064] The certificate authorization management system of the cloud platform can use its private key to sign the certificate activation authorization data;

[0065] The vehicle is pre-installed with a signature verification public key certificate SVR_CT_AUTH_VERIFY_CERT for verifying the signature generated by the certificate authorization management system.

[0066] In the embodiment of the present invention, when a certificate configuration request is received from a vehicle manufacturing end, device certificate information is sent to the vehicle manufacturing end:

[0067] The vehicle certificate activation management module reads the CommonName field of the certificate Subject of all certificates and certificate chains in the vehicle according to the certificate configuration request sent by the vehicle manufacturer (such as the diagnostic instrument of the host factory) to obtain the certificate information list List<CERT_INFO> , and compare the equipment identification of the vehicle with the List<CERT_INFO> Pack and get the device certificate information DEV_CT_AUTH_INFO=DEV_DEV_ID||List<CERT_INFO> ;

[0068] The device certificate information DEV_CT_AUTH_INFO is sent to the vehicle manufacturing end.

[0069] In an embodiment of the present invention, according to the certificate activation authorization file fed back by the vehicle manufacturing end, activating the first target certificate and the first target certificate chain in the device certificate information includes:

[0070] According to the certificate activation authorization file DEV_CT_AUTH_FILE, a first target certificate and a first target certificate chain in the device certificate information are determined.

[0071] The certificate management method of the embodiment of the present invention, by presetting at least two groups of certificate data on the vehicle side, can send the device certificate information to the vehicle manufacturing side when the vehicle side receives a certificate configuration request from the vehicle manufacturing side, so that the vehicle manufacturing side can feedback the certificate activation authorization file according to the device certificate information, and determine the first target certificate and the first target certificate chain that need to be activated in the device certificate information, so that the vehicle side determines the activated certificate and certificate chain according to the needs of the cloud platform, thereby ensuring smooth communication verification between the vehicle and the cloud platform.

[0072] Optionally, according to the certificate activation authorization file fed back by the vehicle manufacturing end, activating the first target certificate and the first target certificate chain in the device certificate information includes:

[0073] Performing signature verification on the certificate activation authorization file fed back by the vehicle manufacturing end;

[0074] In a case where the certificate activation authorization file passes the signature verification, determining the first target certificate and the first target certificate chain corresponding to the business application identifier according to the business application identifier fed back by the cloud platform;

[0075] The first target certificate and the first target certificate chain are activated, and the certificate activation authorization file is saved.

[0076] In the embodiment of the present invention, the certificate activation authorization management module of the vehicle uses the preset certificate CERT_AUTH_VER_CET to perform signature verification on the certificate activation authorization file;

[0077] After the signature verification is passed, query the cloud platform for the business application identifier of the certificate activation authorization data DEV_CT_AUTH_PAYLOAD;

[0078] Determine the first target certificate and the first target certificate chain corresponding to the business application identifier.

[0079] It should be noted that when developing a vehicle model, the vehicle manufacturer will assign a business application identifier to the business application in the vehicle that needs to connect to the cloud platform, and usually the business application identifier will be written into the business application in an encoded manner. When the business application needs to initiate a TLS channel with the cloud platform, it uses the interface that calls the security module and passes its application identifier as a parameter. The security module finds the activated public key certificate corresponding to this application identifier based on the business application identifier, generates a private key handle, and then returns it to the business application.

[0080] The certificate management method of the embodiment of the present invention can ensure the security of the network by performing signature verification on the certificate activation authorization file; by determining the first target certificate and the first target certificate chain that need to be activated through the certificate activation authorization file, different certificates and certificate chains can be activated for different applications, thereby ensuring that certificates can be called safely and smoothly in different scenarios.

[0081] Optionally, the certificate activation authorization document includes: a validity period;

[0082] According to the certificate activation authorization file fed back by the vehicle manufacturing end, activating the first target certificate and the first target certificate chain in the device certificate information includes:

[0083] Performing signature verification on the certificate activation authorization file fed back by the vehicle manufacturing end;

[0084] When the certificate activation authorization document passes the signature verification and is within the validity period, the first target certificate and the first target certificate chain are activated.

[0085] The certificate management method of the embodiment of the present invention can improve the security of the network during the certificate calling process by setting the validity period.

[0086] Optionally, according to the certificate activation authorization file fed back by the vehicle manufacturing end, activating the first target certificate and the first target certificate chain in the device certificate information includes:

[0087] When the certificate activation authorization document passes the signature verification and exceeds the validity period, activating the second target certificate and the second target certificate chain;

[0088] The second target certificate is a preconfigured certificate, and the second target certificate chain is a preconfigured certificate chain.

[0089] The certificate management method of the embodiment of the present invention activates the certificate and certificate chain of preset values ​​for the certificate activation authorization file that has passed signature verification but has expired, so as to facilitate the certificate calling process while ensuring the network security of the certificate calling process.

[0090] Optionally, the method further comprises:

[0091] Receive a certificate call request sent by the cloud platform, wherein the certificate call request carries a business application identifier;

[0092] The third target certificate in the device certificate information and the target key corresponding to the third target certificate are obtained according to the business application identifier; the third target certificate and the third target certificate chain are used for communication verification with the cloud platform.

[0093] The certificate management method of the embodiment of the present invention can activate different certificate information according to the certificate call request sent by the cloud platform after the vehicle's device certificate information and certificate activation authorization file are successfully configured, thereby ensuring a successful TLS connection with the cloud platform.

[0094] like Figure 2 As shown, the embodiment of the present invention also provides a certificate management method, which is applied to a vehicle manufacturing end and includes the following steps:

[0095] Step 201, sending a certificate configuration request to the vehicle;

[0096] Step 202: forward the received device certificate information to the cloud platform, wherein the device certificate information includes at least two groups of certificate data; each group of certificate data includes a first certificate and a first certificate chain corresponding to a business application;

[0097] Step 203: forward the certificate activation authorization file received from the cloud platform to the vehicle.

[0098] In the embodiment of the present invention, the vehicle manufacturing end (e.g., the diagnostic instrument of the OEM) submits the received device certificate information DEV_CT_AUTH_INFO to the certificate authorization management system of the cloud platform;

[0099] The certificate activation authorization file DEV_CT_AUTH_FILE fed back by the certificate authorization management system of the cloud platform is sent to the certificate authorization management module of the vehicle.

[0100] like Figure 3 As shown, an embodiment of the present invention also provides a certificate management method, which is applied to a cloud platform and includes the following steps:

[0101] Step 301, receiving device certificate information sent by a vehicle manufacturing end; the device certificate information includes at least two groups of certificate data; each group of certificate data includes a first certificate and a first certificate chain corresponding to a business application;

[0102] Step 302, generating certificate activation authorization data according to the device certificate information;

[0103] Step 303, signing the certificate activation authorization data to obtain a certificate activation authorization file;

[0104] Step 304: Send the certificate activation authorization file to the vehicle manufacturing end.

[0105] In the embodiment of the present invention, the certificate authorization management system of the cloud platform receives the device certificate information DEV_CT_AUTH_INFO sent by the vehicle manufacturing end (such as the diagnostic instrument of the host factory);

[0106] Generate certificate activation authorization data DEV_CT_AUTH_PAYLOAD based on device certificate information and related rules and policies defined by the OEM;

[0107] The cloud platform's certificate authorization management system uses its private key SVR_CT_AUTH_SIGN_SK to sign the certificate activation authorization data, obtains the signature value DEV_CT_AUTH_SIG, and assembles the certificate activation authorization data and the signature value to obtain the certificate activation authorization file DEV_CT_AUTH_FILE;

[0108] Send the certificate activation authorization data to the vehicle manufacturer.

[0109] like Figure 4 As shown, the process of the certificate management method of the embodiment of the present invention is:

[0110] 1. The vehicle manufacturer (e.g. the OEM's diagnostic instrument) sends a certificate configuration request to the vehicle's certificate activation management module;

[0111] 2. The vehicle's certificate activation management module reads all certificates and certificate chains in the vehicle, packages them with the vehicle's device identification, obtains the device certificate information, and sends the device certificate information to the vehicle manufacturing end;

[0112] 3. The vehicle manufacturing end forwards the received device certificate information to the certificate authorization management system of the vehicle cloud platform;

[0113] 4. After receiving the device certificate information, the cloud platform's certificate authorization management system generates certificate activation authorization data in combination with the relevant rules and policies defined by the OEM;

[0114] 5. The cloud platform's certificate authorization management system uses its private key SVR_CT_AUTH_SIGN_SK to sign the certificate activation authorization data, obtains the signature value DEV_CT_AUTH_SIG, and assembles the certificate activation authorization data and the signature value to obtain the certificate activation authorization file;

[0115] 6. The cloud platform's certificate authorization management system returns the certificate activation authorization file to the vehicle manufacturing end;

[0116] 7. The vehicle manufacturing end sends the certificate activation authorization file to the vehicle's certificate activation management module through a diagnostic instruction;

[0117] 8. The vehicle's certificate activation management module uses the preset CERT_AUTH_VER_CET to verify the signature of the certificate activation authorization file, and saves the certificate activation authorization file after passing the verification;

[0118] 9. When the target service application communicates with the TLS client of the vehicle's onboard electrical component (Telematics BOX, T-BOX), a certificate call indication is sent to the vehicle's certificate management module to obtain a valid certificate and private key handle corresponding to the target service application;

[0119] 10. The certificate management module of the vehicle obtains the valid certificate and valid certificate chain information from the certificate activation authorization management module of the vehicle;

[0120] 11. After the vehicle's certificate activation authorization management module verifies the certificate activation authorization file, it determines the certificate and certificate chain information that need to be activated based on the target business application identifier and sends them to the certificate management module;

[0121] 12. The certificate management module determines the valid certificate, the valid certificate chain information and the private key handle according to the device certificate information;

[0122] 13. Return the valid certificate, valid certificate chain information and private key handle to T-BOX.

[0123] like Figure 5 As shown, the embodiment of the present invention further provides a certificate management device 500, which is applied to a vehicle and includes:

[0124] The first sending module 501 is used to send device certificate information to the vehicle manufacturing end when receiving a certificate configuration request from the vehicle manufacturing end; the device certificate information includes at least two groups of certificate data; each group of certificate data includes a first certificate and a first certificate chain corresponding to a business application;

[0125] The activation module 502 is used to activate the first target certificate and the first target certificate chain in the device certificate information according to the certificate activation authorization file fed back by the vehicle manufacturing end; the certificate activation authorization file is generated according to the device certificate information, and the first certificate and the first certificate chain are used for communication verification with the cloud platform.

[0126] like Figure 6 As shown, the embodiment of the present invention further provides a certificate management device 600, which is applied to a vehicle manufacturing end, and includes:

[0127] The second sending module 601 is used to send a certificate configuration request to the vehicle;

[0128] The third sending module 602 is used to forward the received device certificate information to the cloud platform, wherein the device certificate information includes at least two groups of certificate data; each group of certificate data includes a first certificate and a first certificate chain corresponding to a business application;

[0129] The fourth sending module 603 is used to forward the certificate activation authorization file received from the cloud platform to the vehicle.

[0130] like Figure 7 As shown, the embodiment of the present invention further provides a certificate management device 700, which is applied to a cloud platform and includes:

[0131] The receiving module 701 is used to receive the device certificate information sent by the vehicle manufacturing end; the device certificate information includes at least two groups of certificate data; each group of the certificate data includes a first certificate and a first certificate chain corresponding to a business application;

[0132] A generating module 702, configured to generate certificate activation authorization data according to the device certificate information;

[0133] The signature module 703 is used to sign the certificate activation authorization data to obtain a certificate activation authorization file;

[0134] The fifth sending module 704 is used to send the certificate activation authorization file to the vehicle manufacturing end.

[0135] Please refer to Figure 8The embodiment of the present application also provides a certificate management device 800, including a processor 801, a memory 802, and a computer program stored in the memory 802 and executable on the processor 801. When the computer program is executed by the processor 801, the various processes of the above-mentioned certificate management method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0136] The embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the above-mentioned certificate management method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0137] In addition, a specific embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the steps of the method in the first embodiment described above are implemented. The same technical effect can be achieved, and to avoid repetition, it will not be described here.

[0138] The embodiment of the present application also provides a computer program product, including computer instructions. When the computer instructions are executed by a processor, the various processes of the above-mentioned certificate management method embodiment are implemented and the same technical effect can be achieved. To avoid repetition, they are not repeated here.

[0139] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary personnel in this technical field, several improvements and modifications can be made without departing from the principles described in the present invention. These improvements and modifications are also within the scope of protection of the present invention.

Claims

1. A certificate management method, applied to a vehicle, characterized in that: include: Upon receiving a certificate configuration request from a vehicle manufacturing end, sending device certificate information to the vehicle manufacturing end; The device certificate information includes at least two sets of certificate data; Each group of certificate data includes a first certificate and a first certificate chain corresponding to a business application; Activate the first target certificate and the first target certificate chain in the device certificate information according to the certificate activation authorization file fed back by the vehicle manufacturing end; The certificate activation authorization file is generated according to the device certificate information, and the first certificate and the first certificate chain are used for communication verification with the cloud platform.

2. The certificate management according to claim 1, characterized in that: According to the certificate activation authorization file fed back by the vehicle manufacturing end, activating the first target certificate and the first target certificate chain in the device certificate information includes: Performing signature verification on the certificate activation authorization file fed back by the vehicle manufacturing end; In a case where the certificate activation authorization file passes the signature verification, determining the first target certificate and the first target certificate chain corresponding to the business application identifier according to the business application identifier fed back by the cloud platform; The first target certificate and the first target certificate chain are activated, and the certificate activation authorization file is saved.

3. The certificate management according to claim 1, characterized in that: The certificate activation authorization document includes: validity period; According to the certificate activation authorization file fed back by the vehicle manufacturing end, activating the first target certificate and the first target certificate chain in the device certificate information includes: Performing signature verification on the certificate activation authorization file fed back by the vehicle manufacturing end; When the certificate activation authorization file passes the signature verification and is within the validity period, the first target certificate and the first target certificate chain are activated.

4. The certificate management according to claim 3, characterized in that: According to the certificate activation authorization file fed back by the vehicle manufacturing end, activating the first target certificate and the first target certificate chain in the device certificate information includes: When the certificate activation authorization document passes the signature verification and exceeds the validity period, activating the second target certificate and the second target certificate chain; The second target certificate is a preconfigured certificate, and the second target certificate chain is a preconfigured certificate chain.

5. The certificate management according to claim 1, characterized in that: The method further comprises: Receive a certificate call request sent by the cloud platform, wherein the certificate call request carries a business application identifier; The third target certificate in the device certificate information and the target key corresponding to the third target certificate are obtained according to the business application identifier; the third target certificate and the third target certificate chain are used for communication verification with the cloud platform.

6. A certificate management method, applied to a vehicle manufacturing end, characterized in that: include: Send a certificate configuration request to the vehicle; Forwarding the received device certificate information to the cloud platform, the device certificate information including at least two sets of certificate data; Each group of certificate data includes a first certificate and a first certificate chain corresponding to a business application; The certificate activation authorization file received from the cloud platform is forwarded to the vehicle.

7. A certificate management method, applied to a cloud platform, characterized in that: include: Receiving equipment certificate information sent by a vehicle manufacturing end; the equipment certificate information includes at least two sets of certificate data; Each group of certificate data includes a first certificate and a first certificate chain corresponding to a business application; Generate certificate activation authorization data according to the device certificate information; Signing the certificate activation authorization data to obtain a certificate activation authorization file; The certificate activation authorization file is sent to the vehicle manufacturing end.

8. A certificate management device, applied to a vehicle, characterized in that: include: A first sending module, configured to send device certificate information to the vehicle manufacturing end upon receiving a certificate configuration request from the vehicle manufacturing end; The device certificate information includes at least two sets of certificate data; Each group of certificate data includes a first certificate and a first certificate chain corresponding to a business application; An activation module, configured to activate the first target certificate and the first target certificate chain in the device certificate information according to the certificate activation authorization file fed back by the vehicle manufacturing end; The certificate activation authorization file is generated according to the device certificate information, and the first certificate and the first certificate chain are used for communication verification with the cloud platform.

9. A certificate management device, applied to a vehicle manufacturing end, characterized in that: include: A second sending module, used to send a certificate configuration request to the vehicle; A third sending module is used to forward the received device certificate information to the cloud platform, wherein the device certificate information includes at least two groups of certificate data; each group of certificate data includes a first certificate and a first certificate chain corresponding to a business application; The fourth sending module is used to forward the certificate activation authorization file received from the cloud platform to the vehicle.

10. A certificate management device, applied to a cloud platform, characterized in that: include: A receiving module, used to receive device certificate information sent by a vehicle manufacturing end; the device certificate information includes at least two groups of certificate data; Each group of certificate data includes a first certificate and a first certificate chain corresponding to a business application; A generating module, used to generate certificate activation authorization data according to the device certificate information; A signature module, used to sign the certificate activation authorization data to obtain a certificate activation authorization file; The fifth sending module is used to send the certificate activation authorization file to the vehicle manufacturing end.

Images