Certificate management method for general PKI system and PKI system

Abstract

The invention relates to the technical field of certificate management, in particular to a general PKI (Public Key Infrastructure) system certificate management method. If the user request is a certificate chain management request, certificate chains are configured on the PKI system according to the request, and the certificate chains are independent from one another; when the certificate is generated, the certificate is generated by the PKI system or imported from the outside according to the certificate chain management request; and if the user request is a certificate management request, obtaining specified certificate data and a format template according to the request, performing format conversion on the specified certificate data according to the format template, and sending the specified certificate data after format conversion to the user. It can be understood that the technical scheme shown by the invention can enable the PKI system to be more flexible in certificate management, support management of a plurality of independent certificate chains and certificate generation management, is more flexible, can perform format conversion when obtaining certificate data, and can support use of a user in various scenes.

Description

Technical Field

[0001] The present invention relates to the technical field of certificate management, and in particular to a general PKI system certificate management method and a PKI system. Background Art

[0002] The PKI system is a cryptographic framework for securely managing digital certificates, public keys, and private keys to ensure confidentiality, integrity, and authentication of communications and data. PKI is based on public key cryptography and implements secure communications and authentication through digital certificate authorities (CAs) and related components.

[0003] With the development of the industry, in the PKI system, there will be various needs for the management of certificate chains and certificate formats due to the business needs of various industries. However, the existing PKI system generally manages certificate chains and certificate formats for specific businesses. This method is not flexible enough and can only manage certificate chains and certificates for specific businesses. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a universal PKI system certificate management method and a PKI system to solve the problem that the certificate management method in the prior art is not flexible enough and can only perform certificate chain management and certificate management for specific services.

[0005] According to a first aspect of an embodiment of the present invention, a method for managing certificates in a universal PKI system is provided, comprising:

[0006] Get user request;

[0007] If the user request is a certificate chain management request, a certificate chain is configured from the PKI system according to the certificate chain management request, and the certificate chain is independent of other certificate chains on the PKI system; the certificate chain consists of a root certificate, an intermediate certificate, and a leaf certificate;

[0008] The root certificate, intermediate certificate, or leaf certificate is generated by the PKI system based on the certificate chain management request when it is generated, or,

[0009] When a root certificate, an intermediate certificate or a leaf certificate is generated, external certificate data is obtained according to a certificate chain management request, and the external certificate data is imported into the PKI system;

[0010] If the user request is a certificate management request, the designated certificate data and a format template are obtained according to the certificate management request, the format of the designated certificate data is converted according to the format template, and the designated certificate data after the format conversion is sent to the user.

[0011] Preferably, obtaining the user request includes:

[0012] A user operation interface is constructed using the WEB terminal, and user requests are obtained using the user operation interface.

[0013] Preferably, the obtaining of the user request further includes:

[0014] Construct a calling interface and use the calling interface to obtain user requests.

[0015] Preferably, generated by the PKI system according to the certificate chain management request, including:

[0016] When a root certificate, intermediate certificate or leaf certificate is generated, the PKI system generates the public and private keys and certificate data of the certificate according to the certificate chain management request, and the PKI system manages the public and private keys and certificate data.

[0017] Preferably, obtaining external certificate data according to the certificate chain management request and importing the external certificate data into the PKI system includes:

[0018] If the root certificate of the certificate chain is configured, the certificate data of the root certificate is obtained according to the certificate chain management request, and the certificate data of the root certificate is imported into the PKI system; the public and private keys and certificate data of the root certificate are generated externally;

[0019] If an intermediate certificate or leaf certificate of a certificate chain is configured, and the superior certificate of the certificate is imported externally, the certificate data of the certificate is obtained according to the certificate chain management request, and the certificate data of the certificate is imported into the PKI system; the public and private keys and certificate data of the certificate are generated externally.

[0020] Preferably, the universal PKI system certificate management method further includes:

[0021] If an intermediate certificate or leaf certificate of a certificate chain is configured, and the parent certificate of the certificate is imported from outside, the public and private keys and certificate signing request files are generated using the PKI system according to the certificate chain management request, the certificate data of the certificate issued externally is submitted, and the issued certificate data is imported into the PKI system.

[0022] According to a second aspect of an embodiment of the present invention, a PKI system is provided, wherein the PKI system is used to execute any one of the methods described above.

[0023] Preferably, the PKI system comprises:

[0024] The user operation interface on the WEB side is used to obtain user requests;

[0025] Calling interface to obtain user requests;

[0026] The backend service module is used to perform certificate chain management or certificate management based on user requests.

[0027] The technical solution provided by the embodiments of the present invention may have the following beneficial effects:

[0028] It can be understood that the technical solution shown in the present invention can obtain user requests; if the user request is a certificate chain management request, then according to the request, the certificate chain is configured from the PKI system, and each certificate chain is independent; when the certificate is generated, it is generated by the PKI system according to the certificate chain management request, or imported from the outside; if the user request is a certificate management request, then according to the request, the specified certificate data and format template are obtained, the format of the specified certificate data is converted according to the format template, and the specified certificate data after the format conversion is sent to the user. It can be understood that the technical solution shown in the present invention can make the PKI system more flexible in certificate management, support the management of multiple independent certificate chains, and be more flexible in certificate generation management. When obtaining certificate data, format conversion can be performed, which can support the use of users in various scenarios.

[0029] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0031] Figure 1 It is a schematic diagram of steps of a method for managing certificates in a general PKI system according to an exemplary embodiment;

[0032] Figure 2 is a schematic diagram of managing multiple certificate chains in a PKI system according to an exemplary embodiment;

[0033] Figure 3 is a schematic diagram of a certificate chain according to an exemplary embodiment;

[0034] Figure 4 is a schematic diagram of a certificate generation method according to an exemplary embodiment;

[0035] Figure 5 It is an interaction schematic diagram shown according to an exemplary embodiment. DETAILED DESCRIPTION

[0036] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of devices and methods consistent with some aspects of the present invention as detailed in the appended claims.

[0037] In one embodiment, Figure 1 is a schematic diagram of steps of a method for managing certificates in a general PKI system according to an exemplary embodiment. Figure 1 , providing a general PKI system certificate management method, including:

[0038] Step S11: Obtain user request.

[0039] Step S12: If the user request is a certificate chain management request, a certificate chain is configured from the PKI system according to the certificate chain management request. The certificate chain is independent of other certificate chains on the PKI system. Figure 2 ; The certificate chain consists of a root certificate, an intermediate certificate, and a leaf certificate, see Figure 3 .

[0040] The PKI system can support the management of multiple certificate chains for different business uses. Figure 2 In the example, the chains containing root certificate A, root certificate B, root certificate (N), and root certificate (N+1) are independent certificate chains, which can be used for different services required by users. Figure 2 In order to illustrate that the system can manage multiple certificate chains, a "root certificate (N)" certificate chain is displayed. The (N) here means that there can be N certificate chains managed, depending on user needs.

[0041] The PKI system can support very complex certificate chains, such as Figure 2 The certificate chain (N) in the certificate chain can be customized according to the business needs.

[0042] When a root certificate, an intermediate certificate or a leaf certificate is generated, it is generated by the PKI system according to a certificate chain management request, or when a root certificate, an intermediate certificate or a leaf certificate is generated, it obtains external certificate data according to a certificate chain management request and imports the external certificate data into the PKI system.

[0043] Step S13: If the user request is a certificate management request, then obtaining designated certificate data and a format template according to the certificate management request, performing format conversion on the designated certificate data according to the format template, and sending the designated certificate data after format conversion to the user.

[0044] It can be understood that the technical solution shown in this embodiment can obtain user requests; if the user request is a certificate chain management request, then according to the request, the certificate chain is configured from the PKI system, and each certificate chain is independent; when the certificate is generated, it is generated by the PKI system according to the certificate chain management request, or imported from the outside; if the user request is a certificate management request, then according to the request, the specified certificate data and format template are obtained, the format of the specified certificate data is converted according to the format template, and the specified certificate data after the format conversion is sent to the user. It can be understood that the technical solution shown in this embodiment can make the PKI system more flexible in certificate management, support the management of multiple independent certificate chains, and be more flexible in certificate generation management. When obtaining certificate data, format conversion can be performed, which can support the use of users in various scenarios.

[0045] It should be noted that, in step S11, obtaining the user request includes:

[0046] A user operation interface is constructed using the WEB terminal, and user requests are obtained using the user operation interface.

[0047] It can be understood that the technical solution provided in this embodiment adopts a B / S architecture, where the WEB end provides a user operation interface for certificate chain management and certificate management, and the back-end service provides an interface to implement specific operations of certificate chain management and certificate management. The user can browse the operation interface on the WEB end, send a user request in the operation interface, and the back-end service performs the corresponding operation according to the user request after receiving the user request.

[0048] It should be noted that, in step S11, obtaining the user request further includes:

[0049] Construct a calling interface and use the calling interface to obtain user requests.

[0050] It is understandable that the backend service can also provide a complete interface, and the user can call the interface. By directly calling the interface, the user can directly send the user request, and then the backend service performs the corresponding certificate chain management and certificate management operations.

[0051] The technical solution provided in this embodiment has various ways to obtain user requests, which makes it easy for users to choose an appropriate way to send user requests.

[0052] It should be noted that, in step S12, generated by the PKI system according to the certificate chain management request, includes:

[0053] When a root certificate, intermediate certificate or leaf certificate is generated, the PKI system generates the public and private keys and certificate data of the certificate according to the certificate chain management request, and the PKI system manages the public and private keys and certificate data.

[0054] In practice, see Figure 4 In certificate chain management, the root certificate can be generated by the PKI system. "Generated by the system" means that the public and private keys and certificates of the root certificate are all managed by the system. At the same time, the intermediate certificate and leaf certificate can also be generated by the PKI system. If the intermediate certificate is generated by the system, the public and private keys and certificates of the intermediate certificate are all managed by the system; if the leaf certificate is generated by the system, the public and private keys and certificates of the leaf certificate are all managed by the system.

[0055] It should be noted that, in step S12, obtaining external certificate data according to the certificate chain management request and importing the external certificate data into the PKI system includes:

[0056] If the root certificate of the certificate chain is configured, the certificate data of the root certificate is obtained according to the certificate chain management request, and the certificate data of the root certificate is imported into the PKI system; the public and private keys and certificate data of the root certificate are generated externally.

[0057] In actual practice, the root certificate of the certificate chain can be configured as "externally generated, imported certificate": the public and private keys and certificate data of the root certificate are actually generated and issued externally, and the system only imports and manages the certificate.

[0058] If an intermediate certificate or leaf certificate of a certificate chain is configured, and the superior certificate of the certificate is imported externally, the certificate data of the certificate is obtained according to the certificate chain management request, and the certificate data of the certificate is imported into the PKI system; the public and private keys and certificate data of the certificate are generated externally.

[0059] In actual practice, if the intermediate certificate of the certificate chain is configured, it can be "externally generated, imported certificate": that is, when the superior certificate is imported externally, the public and private keys and certificate data of the intermediate certificate are also externally generated and issued, and the system only imports and manages the certificate. It should be noted that the superior certificate here can be a root certificate or an intermediate certificate.

[0060] If you configure the leaf certificate of the certificate chain, you can select "externally generated, imported certificate": that is, when the parent certificate is imported externally, the public and private keys and certificate data of the leaf certificate are also generated and issued externally. The system only imports and manages the certificate. It should be noted that the parent certificate here can be a root certificate or an intermediate certificate.

[0061] It should be noted that the general PKI system certificate management method further includes:

[0062] If an intermediate certificate or leaf certificate of a certificate chain is configured, and the parent certificate of the certificate is imported from outside, the public and private keys and certificate signing request files are generated using the PKI system according to the certificate chain management request, the certificate data of the certificate issued externally is submitted, and the issued certificate data is imported into the PKI system.

[0063] In actual practice, when configuring the intermediate certificate and / or leaf certificate, you can also execute "CSR (certificate signing request file) generated by the system and externally issued certificate imported".

[0064] If you configure the intermediate certificate of the certificate chain and execute "Generate CSR by system, import certificate issued externally", that is, when the superior certificate is imported externally, the CSR can be generated by the system, issued externally, and then imported. In this way, the public and private keys and certificates of the intermediate certificates are managed by the system.

[0065] If you configure the leaf certificate of the certificate chain and execute "Generate CSR by system, import certificate issued externally", that is, when the parent certificate is imported externally, the CSR can be generated by the system, issued externally and then imported. In this way, the public and private keys and certificates of the leaf certificate are managed by the system.

[0066] It can be understood that the technical solution provided in this embodiment provides users with a variety of solutions for configuring certificates, which greatly increases the flexibility of configuring certificates.

[0067] See also Figure 5 In step S13, when the user is performing certificate management and obtaining certificate data, he can send the specified certificate data and the desired format template he wants to obtain through the operation interface of the WEB end. Then, the WEB end requests the server end. After the server end queries the specified certificate data, it converts the format of the certificate data into the format specified by the user, and then returns it to the user through the WEB end.

[0068] The general certificate format is the X.509 certificate structure, but with the needs of the business, such as the SE chip, there will be a specific certificate format required. Therefore, the PKI system defines a variety of certificate format templates. Users specify the certificate format template to be obtained, and the system performs internal conversion and returns it to the user.

[0069] The PKI system of this embodiment is used as follows: Figure 5 As shown, two user entrances are also provided, one is to use the user operation interface on the WEB side, and the other is to directly call the interface. Users can use them in combination according to actual needs.

[0070] It is understandable that the technical solution provided by the present invention can make the PKI system more flexible in certificate management, so that it has better adaptability when facing different businesses. In terms of usage effect, the PKI system can support the use of users in various scenarios without major changes. In terms of certificate chain management and certificate chain structure, it has scalability and can theoretically support unlimited certificate chains and unlimited levels, making it more flexible for users to use. In certificate generation, it has adaptability and can manage the certificates in its own certificate chain based on user needs, without requiring that they must all be generated by its own system. In terms of certificate format, it has universality and is not limited to the X509 certificate structure. The certificate format template can also be customized according to the needs of the actual business, and the certificate data is returned based on the certificate format template.

[0071] According to a second aspect of an embodiment of the present invention, a PKI system is provided, wherein the PKI system is used to execute any one of the methods described above.

[0072] It should be noted that the PKI system includes:

[0073] The user operation interface on the WEB side is used to obtain user requests;

[0074] Calling interface to obtain user requests;

[0075] The backend service module is used to perform certificate chain management or certificate management based on user requests.

[0076] It can be understood that the same or similar parts of the above embodiments can be referenced to each other, and the contents not described in detail in some embodiments can refer to the same or similar contents in other embodiments.

[0077] It should be noted that, in the description of the present invention, the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. In addition, in the description of the present invention, unless otherwise specified, the meaning of "plurality" refers to at least two.

[0078] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present invention includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present invention belong.

[0079] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0080] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0081] In addition, each functional unit in each embodiment of the present invention may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0082] The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc.

[0083] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0084] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. A method for managing certificates in a universal PKI system, characterized in that: include: Get user request; If the user request is a certificate chain management request, a certificate chain is configured from the PKI system according to the certificate chain management request, and the certificate chain is independent of other certificate chains on the PKI system; the certificate chain consists of a root certificate, an intermediate certificate, and a leaf certificate; The root certificate, intermediate certificate, or leaf certificate is generated by the PKI system based on the certificate chain management request when it is generated, or, When a root certificate, an intermediate certificate or a leaf certificate is generated, external certificate data is obtained according to a certificate chain management request, and the external certificate data is imported into the PKI system; If the user request is a certificate management request, the designated certificate data and a format template are obtained according to the certificate management request, the format of the designated certificate data is converted according to the format template, and the designated certificate data after the format conversion is sent to the user.

2. The method for managing certificates in a universal PKI system according to claim 1, characterized in that: The obtaining of the user request comprises: A user operation interface is constructed using the WEB terminal, and user requests are obtained using the user operation interface.

3. The method for managing certificates in a universal PKI system according to claim 1, characterized in that: The obtaining of the user request comprises: Construct a calling interface and use the calling interface to obtain user requests.

4. The method for managing certificates in a universal PKI system according to claim 1, characterized in that: Generated by the PKI system based on the certificate chain management request, including: When a root certificate, intermediate certificate or leaf certificate is generated, the PKI system generates the public and private keys and certificate data of the certificate according to the certificate chain management request, and the PKI system manages the public and private keys and certificate data.

5. The method for managing certificates in a universal PKI system according to claim 1, characterized in that: Acquiring external certificate data according to the certificate chain management request, and importing the external certificate data into the PKI system, including: If the root certificate of the certificate chain is configured, the certificate data of the root certificate is obtained according to the certificate chain management request, and the certificate data of the root certificate is imported into the PKI system; the public and private keys and certificate data of the root certificate are generated externally; If an intermediate certificate or leaf certificate of a certificate chain is configured, and the superior certificate of the certificate is imported externally, the certificate data of the certificate is obtained according to the certificate chain management request, and the certificate data of the certificate is imported into the PKI system; the public and private keys and certificate data of the certificate are generated externally.

6. The method for managing certificates in a universal PKI system according to claim 5, characterized in that: Also includes: If an intermediate certificate or leaf certificate of a certificate chain is configured, and the parent certificate of the certificate is imported from outside, the public and private keys and certificate signing request files are generated using the PKI system according to the certificate chain management request, the certificate data of the certificate issued externally is submitted, and the issued certificate data is imported into the PKI system.

7. A PKI system, characterized in that: The PKI system is used to execute the method according to any one of claims 1 to 6.

8. The PKI system according to claim 7, characterized in that: include: The user operation interface on the WEB side is used to obtain user requests; Calling interface to obtain user requests; The backend service module is used to perform certificate chain management or certificate management based on user requests.

Images