Unified encryption aggregation system and corresponding management method, device, equipment and medium

Abstract

The embodiment of the invention discloses a unified encryption aggregation system and a corresponding management method, device, equipment and medium, and the system comprises an institution certificate management subsystem which receives, stores and manages institution certificates, and sends an institution certificate using request to an institution certificate requesting party after receiving the institution certificate using request sent by the institution certificate requesting party; returning an institution certificate corresponding to the institution certificate use request; the terminal certificate management subsystem is used for generating, storing and managing terminal certificates, and returning the terminal certificates corresponding to a terminal certificate use request after receiving the terminal certificate use request sent by a terminal certificate requester; and the unified encryption aggregation gateway receives a certificate use request sent by a certificate requester and forwards the certificate use request to the institution certificate management subsystem or the terminal certificate management subsystem. According to the technical scheme, the certificate access query efficiency can be improved, the operation complexity and cost of data encryption are reduced, and the key leakage risk is avoided.

Description

Technical Field

[0001] The embodiments of the present disclosure relate to the field of data encryption technology, and in particular to a unified encryption aggregation system and corresponding management methods, devices, equipment and media. Background Art

[0002] With the development of data demand, a lot of data needs to be encrypted. Different types of certificates may be used for encryption, and the encryption methods corresponding to different data are also different. For data using different encryption methods and different certificates, the processing method of the prior art is to store and request certificates separately for encryption. For example, the terminal certificate is stored in the local disk, and the storage path is provided by the database. The terminal certificate requester uses the storage path to request the certificate for use. However, this requires a large number of local disks, and when the number of terminal certificates is large, such as up to hundreds of millions, there is often a shortage of disk nodes. The above-mentioned processing method of the prior art is not only difficult to achieve unified management for the storage and use of certificates and the encryption of data, which is not conducive to improving the efficiency of certificate access queries and reducing operational complexity and costs, but also has the risk of key leakage. Summary of the invention

[0003] The embodiments of the present disclosure provide a unified encryption aggregation system and corresponding management methods, devices, equipment and media.

[0004] In a first aspect, a unified encryption aggregation system is provided in an embodiment of the present disclosure.

[0005] Specifically, the unified encryption aggregation system includes: an institution certificate management subsystem, a terminal certificate management subsystem and a unified encryption aggregation gateway, wherein:

[0006] The institution certificate management subsystem is used to receive, store and manage institution certificates, and after receiving an institution certificate use request sent by an institution certificate requester, send the institution certificate corresponding to the institution certificate use request to the institution certificate requester;

[0007] The terminal certificate management subsystem is used to generate, store and manage terminal class certificates, and after receiving a terminal class certificate use request sent by a terminal class certificate requester, send the terminal class certificate corresponding to the terminal class certificate use request to the terminal class certificate requester;

[0008] The unified encryption aggregation gateway is used to receive a certificate usage request sent by a certificate requester, and forward the certificate usage request to the institution certificate management subsystem or the terminal certificate management subsystem.

[0009] In a second aspect, an embodiment of the present disclosure provides a method for unified encryption aggregation management using the above-mentioned unified encryption aggregation system.

[0010] Specifically, the method includes:

[0011] The institution certificate management subsystem, in response to receiving the institution certificate and the associated application information of the institution certificate sent by the institution certificate service party, sets an alias for the institution certificate, stores the institution certificate based on the institution certificate alias, sets an associated application identifier and an associated application key for the associated application of the institution certificate, and returns the institution certificate alias, the associated application identifier and the associated application key to the institution certificate service party;

[0012] The terminal certificate management subsystem, in response to receiving the terminal serial number and the merchant identifier associated with the terminal sent by the terminal class certificate service party, generates a terminal class certificate corresponding to the terminal according to the terminal serial number and the merchant identifier associated with the terminal, sets an alias for the terminal class certificate, and stores the terminal class certificate based on the terminal class certificate alias;

[0013] The unified encryption aggregation gateway responds to receiving a certificate usage request sent by a certificate requester, and determines whether the certificate requested by the certificate requester is an institution-type certificate or a terminal-type certificate according to the request interface of the certificate usage request. When it is determined that the certificate requested by the certificate requester is an institution-type certificate, the certificate usage request is forwarded to the institution certificate management subsystem, so that the institution certificate management subsystem sends the institution-type certificate corresponding to the certificate usage request to the certificate requester. When the certificate requested by the certificate requester is a terminal-type certificate, the certificate usage request is forwarded to the terminal certificate management subsystem, so that the terminal certificate management subsystem sends the terminal-type certificate corresponding to the certificate usage request to the certificate requester.

[0014] In a third aspect, a unified encryption aggregation management device is provided in an embodiment of the present disclosure.

[0015] Specifically, the unified encryption aggregation management device includes:

[0016] The institution certificate management subsystem is configured to, in response to receiving the institution certificate and the associated application information of the institution certificate sent by the institution certificate service party, set an alias for the institution certificate, store the institution certificate based on the institution certificate alias, set an associated application identifier and an associated application key for the associated application of the institution certificate, and return the institution certificate alias, the associated application identifier and the associated application key to the institution certificate service party;

[0017] The terminal certificate management subsystem is configured to, in response to receiving a terminal serial number and a merchant identifier associated with the terminal sent by a terminal class certificate service party, generate a terminal class certificate corresponding to the terminal according to the terminal serial number and the merchant identifier associated with the terminal, set an alias for the terminal class certificate, and store the terminal class certificate based on the terminal class certificate alias;

[0018] A unified encryption aggregation gateway is configured to respond to a certificate usage request received from a certificate requester, determine whether the certificate requested by the certificate requester is an institution-type certificate or a terminal-type certificate according to a request interface of the certificate usage request, and when it is determined that the certificate requested by the certificate requester is an institution-type certificate, forward the certificate usage request to the institution certificate management subsystem so that the institution certificate management subsystem sends the institution-type certificate corresponding to the certificate usage request to the certificate requester; when the certificate requested by the certificate requester is a terminal-type certificate, forward the certificate usage request to the terminal certificate management subsystem so that the terminal certificate management subsystem sends the terminal-type certificate corresponding to the certificate usage request to the certificate requester.

[0019] In a fourth aspect, an embodiment of the present disclosure provides an electronic device, including a memory and a processor, wherein the memory is used to store one or more computer instructions that support a unified encryption aggregation device to perform the unified encryption aggregation method, and the processor is configured to execute the computer instructions stored in the memory. The unified encryption aggregation device may also include a communication interface for the unified encryption aggregation device to communicate with other devices or communication networks.

[0020] In a fifth aspect, an embodiment of the present disclosure provides a computer-readable storage medium for storing computer instructions used by a unified encryption aggregation device, which includes computer instructions involved in the unified encryption aggregation device for executing the above-mentioned unified encryption aggregation method.

[0021] In a sixth aspect, an embodiment of the present disclosure provides a computer program product, including a computer program / instruction, which implements the steps of the above-mentioned unified encryption aggregation method when executed by a processor.

[0022] The technical solution provided by the embodiments of the present disclosure may have the following beneficial effects:

[0023] The above technical solution designs a unified encryption aggregation system, which includes: an institutional certificate management subsystem for receiving, storing and managing institutional certificates, a terminal certificate management subsystem for generating, storing and managing terminal certificates, and a unified encryption aggregation gateway for processing certificate usage requests. This technical solution uniformly manages the acquisition and encryption of certificates for data using different certificates and different encryption methods, which can not only effectively improve the efficiency of certificate access query and effectively reduce the operational complexity and cost of data encryption, but also avoid the risk of key leakage.

[0024] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the embodiments of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Other features, purposes and advantages of the embodiments of the present disclosure will become more apparent through the following detailed description of non-limiting embodiments in conjunction with the accompanying drawings. In the accompanying drawings:

[0026] Figure 1 A schematic diagram showing the structure of a unified encryption aggregation system according to an embodiment of the present disclosure is shown;

[0027] Figure 2 A flowchart of a unified encryption aggregation management method according to an embodiment of the present disclosure is shown;

[0028] Figure 3 A structural block diagram of a unified encryption aggregation management device according to an embodiment of the present disclosure is shown;

[0029] Figure 4 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown;

[0030] Figure 5 It is a structural diagram of a computer system suitable for implementing a method for unified encryption aggregation management according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0031] Hereinafter, exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily implement them. In addition, for the sake of clarity, parts not related to the description of the exemplary embodiments are omitted in the accompanying drawings.

[0032] In the embodiments of the present disclosure, it should be understood that terms such as "including" or "having" are intended to indicate the existence of features, numbers, steps, behaviors, components, parts, or a combination thereof disclosed in this specification, and are not intended to exclude the possibility of one or more other features, numbers, steps, behaviors, components, parts, or a combination thereof existing or being added.

[0033] It should also be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present disclosure may be combined with each other. The embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0034] The technical solution provided by the embodiment of the present disclosure designs a unified encryption aggregation system, which includes: an institutional certificate management subsystem for receiving, storing and managing institutional certificates, a terminal certificate management subsystem for generating, storing and managing terminal certificates, and a unified encryption aggregation gateway for processing certificate usage requests. The technical solution uniformly manages the acquisition and encryption of certificates for data using different certificates and different encryption methods, which can not only effectively improve the efficiency of certificate access query and effectively reduce the operational complexity and cost of data encryption, but also avoid the risk of key leakage.

[0035] Figure 1 A structural diagram of a unified encryption aggregation system according to an embodiment of the present disclosure is shown as follows: Figure 1 As shown, the unified encryption aggregation system includes: an institution certificate management subsystem 101, a terminal certificate management subsystem 102 and a unified encryption aggregation gateway 103, wherein:

[0036] The institution certificate management subsystem 101 is used to receive, store and manage institution certificates, and after receiving an institution certificate use request sent by an institution certificate requester, send the institution certificate corresponding to the institution certificate use request to the institution certificate requester;

[0037] The terminal certificate management subsystem 102 is used to generate, store and manage terminal class certificates, and after receiving a terminal class certificate use request sent by a terminal class certificate requester, send the terminal class certificate corresponding to the terminal class certificate use request to the terminal class certificate requester;

[0038] The unified encryption aggregation gateway 103 is used to receive a certificate usage request sent by a certificate requester, and forward the certificate usage request to the institution certificate management subsystem or the terminal certificate management subsystem.

[0039] As mentioned above, with the development of data demand, a lot of data needs to be encrypted. Different types of certificates may be used for encryption, and the encryption methods corresponding to different data are also different. For data using different encryption methods and different certificates, the processing method of the prior art is to store and request certificates separately for encryption. For example, the terminal certificate is stored in the local disk, and the storage path is provided by the database. The terminal certificate requester uses the storage path to request the certificate for use. However, this requires a large number of local disks, and when the number of terminal certificates is large, such as up to hundreds of millions, there is often a shortage of disk nodes. The above-mentioned processing method of the prior art is not only difficult to achieve unified management for the storage and use of certificates and the encryption of data, but is also not conducive to improving the efficiency of certificate access queries and reducing operational complexity and costs, and there is also a risk of key leakage.

[0040] Considering the above problems, in this implementation, a unified encryption aggregation system is designed, which includes: an institutional certificate management subsystem for receiving, storing and managing institutional certificates, a terminal certificate management subsystem for generating, storing and managing terminal certificates, and a unified encryption aggregation gateway for processing certificate usage requests. This technical solution uniformly manages the acquisition and encryption of certificates for data using different certificates and different encryption methods, which can not only effectively improve the efficiency of certificate access query, effectively reduce the operational complexity and cost of data encryption, but also avoid the risk of key leakage.

[0041] In one embodiment of the present disclosure, the unified encryption aggregation system may be implemented as a system composed of computers, electronic devices, etc., which performs unified management of certificates and encryption.

[0042] In one embodiment of the present disclosure, the institutional certificate refers to a certificate generated or used by an institutional party, and the terminal certificate refers to a certificate generated or used by a terminal party, wherein the institutional party refers to a party that performs institutional functions and is different from the terminal party and the business party, and the institutional party may be, for example, UnionPay, a bank, a third-party payment party, etc., the terminal party may be, for example, a POS terminal, etc., and the business party refers to a party that carries a specific business, such as a clearing and settlement open platform, etc.

[0043] In one embodiment of the present disclosure, the institutional certificate requester refers to a party that requests an institutional certificate for use, and the terminal certificate requester refers to a party that requests a terminal certificate for use. For example, both the institutional certificate requester and the terminal certificate requester can be business parties.

[0044] In the above implementation, the unified encryption aggregation system integrates the institutional certificate management subsystem and the terminal certificate management subsystem, thereby uniformly storing and managing institutional certificates and terminal certificates, and uniformly receiving and processing certificate usage requests through a unified encryption aggregation gateway. This achieves unified management of the acquisition and encryption of certificates for data using different certificates and different encryption methods, which can not only effectively improve the efficiency of certificate access queries, effectively reduce the operational complexity and cost of data encryption, but also avoid the risk of key leakage.

[0045] In one embodiment of the present disclosure, the system may further include: a hard encryption machine management subsystem, wherein the hard encryption machine management subsystem is used to manage the hard encryption machine and call the hard encryption machine in response to a hard encryption request from a hard encryption requester.

[0046] In one embodiment of the present disclosure, the hard encryption machine management subsystem can call the hard encryption machine with the help of the hard encryption machine instructions obtained in advance, so as to achieve interaction with the hard encryption machine and management of the hard encryption machine.

[0047] In this embodiment, the unified encryption aggregation system further integrates the hard encryption machine management subsystem with the institutional certificate management subsystem and the terminal certificate management subsystem, thereby achieving unified management of soft and hard encryption, further reducing the operational complexity and cost of data encryption, and avoiding the risk of key leakage.

[0048] Figure 2 A method for unified encryption aggregation management using the unified encryption aggregation system according to an embodiment of the present disclosure is shown. Figure 2 As shown, the method for unified encryption aggregation management includes the following steps S201-S203:

[0049] In step S201, in response to receiving the institution certificate and the associated application information of the institution certificate sent by the institution certificate service party, the institution certificate management subsystem sets an alias for the institution certificate, stores the institution certificate based on the institution certificate alias, sets an associated application identifier and an associated application key for the associated application of the institution certificate, and returns the institution certificate alias, the associated application identifier and the associated application key to the institution certificate service party;

[0050] In step S202, in response to receiving the terminal serial number and the merchant identifier associated with the terminal sent by the terminal class certificate service party, the terminal certificate management subsystem generates a terminal class certificate corresponding to the terminal according to the terminal serial number and the merchant identifier associated with the terminal, sets an alias for the terminal class certificate, and stores the terminal class certificate based on the terminal class certificate alias;

[0051] In step S203, the unified encryption aggregation gateway responds to receiving a certificate usage request sent by a certificate requester, and determines whether the certificate requested by the certificate requester is an institution-type certificate or a terminal-type certificate according to the request interface of the certificate usage request; when it is determined that the certificate requested by the certificate requester is an institution-type certificate, the certificate usage request is forwarded to the institution certificate management subsystem, so that the institution certificate management subsystem sends the institution-type certificate corresponding to the certificate usage request to the certificate requester; when the certificate requested by the certificate requester is a terminal-type certificate, the certificate usage request is forwarded to the terminal certificate management subsystem, so that the terminal certificate management subsystem sends the terminal-type certificate corresponding to the certificate usage request to the certificate requester.

[0052] As mentioned above, with the development of data demand, a lot of data needs to be encrypted. Different types of certificates may be used for encryption, and the encryption methods corresponding to different data are also different. For data using different encryption methods and different certificates, the processing method of the prior art is to store and request certificates separately for encryption. For example, the terminal certificate is stored in the local disk, and the storage path is provided by the database. The terminal certificate requester uses the storage path to request the certificate for use. However, this requires a large number of local disks, and when the number of terminal certificates is large, such as up to hundreds of millions, there is often a shortage of disk nodes. The above-mentioned processing method of the prior art is not only difficult to achieve unified management for the storage and use of certificates and the encryption of data, but is also not conducive to improving the efficiency of certificate access queries and reducing operational complexity and costs, and there is also a risk of key leakage.

[0053] Taking the above problems into consideration, in this embodiment, a method for unified encryption aggregation management using the above-mentioned unified encryption aggregation system is proposed. This method uniformly manages the acquisition and encryption of certificates for data using different certificates and different encryption methods. It can not only effectively improve the efficiency of certificate access queries and effectively reduce the operational complexity and cost of data encryption, but also avoid the risk of key leakage.

[0054] In one embodiment of the present disclosure, the unified encryption aggregation method may be applicable to computers, electronic devices, etc. that perform unified management of data encryption and certificates used for encryption.

[0055] In one embodiment of the present disclosure, the institutional certificate may be generated by an institutional party and sent to an institutional certificate business party, and finally sent by the institutional certificate business party to an institutional certificate management subsystem in a unified encryption aggregation system for storage. The institutional certificate business party may send the institutional certificate to the institutional certificate management subsystem via email, so that the institutional certificate management subsystem can understand which applications may use the institutional certificate and respond when these applications request certificates, that is, grant these applications the right to use the certificate. When sending the institutional certificate to the institutional certificate management subsystem, the institutional certificate business party may also attach the associated application information that may use the institutional certificate in the future, wherein the associated application information may include information such as the associated application name.

[0056] After receiving the institutional certificate and the associated application information of the institutional certificate sent by the institutional certificate business party, the institutional certificate management subsystem stores the received institutional certificate, for example, using mysql for storage, and provides the relevant certificate request interface as a service. At the same time, the SDK method can be used to realize application integration, and a built-in cache mechanism is added to the SDK. After the http call, a certificate is saved in the local disk to prevent the call from failing and obtain the locally saved certificate. In order to distinguish the uniqueness of the certificate, an alias is set for each certificate when storing the certificate, that is, the institutional certificate is stored based on the institutional certificate alias. At the same time, in order to distinguish the associated application of the certificate uniquely and grant the certificate use authority to the associated application of the certificate, the associated application identifier and associated application key are also set for the associated application of the institutional certificate, and the set institutional certificate alias, associated application identifier and associated application key are returned to the institutional certificate business party, so that the institutional certificate business party can distribute the received information to the associated application of the certificate, so that it can use this information to request the use of the corresponding institutional certificate in the future.

[0057] In one embodiment of the present disclosure, the terminal certificate can be generated by the terminal certificate management subsystem according to the terminal serial number of the terminal sent by the terminal certificate service provider and the merchant identifier associated with the terminal. The terminal serial number refers to identification information that uniquely distinguishes the terminal, and the merchant identifier associated with the terminal refers to identification information that uniquely distinguishes the merchant associated with a certain terminal, such as the merchant ID.

[0058] After generating a terminal class certificate corresponding to a certain terminal, the terminal certificate management subsystem stores the generated terminal class certificate, for example, scyllaDB can be used for distributed storage, and provides relevant certificate request interfaces as a service. At the same time, SDK is provided and its own local cache mechanism is provided for application integration. The terminal certificate management subsystem also provides LRU algorithm cache to improve the efficiency of certificate access query through multi-level cache. Similar to institutional certificates, in order to distinguish the uniqueness of terminal class certificates, when storing terminal class certificates, it is necessary to set an alias for each terminal class certificate, that is, the terminal class certificate is stored based on the terminal class certificate alias. Furthermore, in one embodiment of the present disclosure, an alias can be set for the terminal class certificate according to the terminal serial number and the merchant identifier associated with the terminal.

[0059] After generating and storing the institutional certificates and terminal certificates, you can receive and process the requests sent by the certificate requester. Specifically: The unified encryption aggregation gateway uniformly receives the certificate use request sent by the certificate requester. Since the storage locations of different types of certificates are different, institutional certificates are stored and managed by the institutional certificate management subsystem, and terminal certificates are stored and managed by the terminal certificate management subsystem. Therefore, it is necessary to judge the type of certificate requested by the certificate requester, and then forward the certificate use request to the corresponding certificate management subsystem for processing. When judging the type of certificate requested by the certificate requester, it can be judged according to the request interface of the certificate use request. When the request interface used by the certificate use request is the interface corresponding to the institutional certificate management subsystem, it can be judged that the certificate requested by the certificate requester is an institutional certificate. At this time, the certificate use request can be forwarded to the institutional certificate management subsystem, and the institutional certificate management subsystem obtains the institutional certificate corresponding to the certificate use request and sends it to the certificate requester; when the request interface used by the certificate use request is the interface corresponding to the terminal certificate management subsystem, it can be judged that the certificate requested by the certificate requester is a terminal certificate. At this time, the certificate use request can be forwarded to the terminal certificate management subsystem, and the terminal certificate management subsystem obtains the terminal certificate corresponding to the certificate use request and sends it to the certificate requester.

[0060] Furthermore, in one embodiment of the present disclosure, in order to conduct more comprehensive management of institutional certificates, the institutional certificate service provider may also send institutional certificate information when sending the institutional certificate, wherein the institutional certificate information may include one or more of the following information: purpose of the certificate, certificate owner, certificate manager, and so on.

[0061] In this implementation, if the institutional certificate business party also sends the institutional certificate information when sending the institutional certificate, the institutional certificate management subsystem can generate the institutional certificate remark information based on the institutional certificate information, wherein the institutional certificate remark information may include one or more of the following information: certificate sender, certificate owner, certificate manager, certificate storage time, etc.; then, when storing the institutional certificate, the institutional certificate management subsystem can store the institutional certificate based on the institutional certificate alias and the institutional certificate remark information, that is, when storing the institutional certificate, the institutional certificate alias and the institutional certificate remark information are stored together to distinguish and explain the institutional certificate.

[0062] Furthermore, in this implementation, if the institution certificate service party also sends the institution certificate information when sending the institution certificate, the associated application identifier and associated application key can be set for the associated application of the institution certificate according to the institution certificate name, the institution certificate associated application name, the institution certificate alias and the institution certificate remark information. Then the institution certificate name, the institution certificate associated application name, the institution certificate alias, the institution certificate remark information, the associated application identifier and the associated application key are associated with the stored institution certificate to improve the institution certificate's own information and associated information, which not only ensures the safe use of the institution certificate, but also ensures that the certificate's associated application can obtain the corresponding certificate in a timely manner.

[0063] Furthermore, when the certificate requested by the certificate requester is an institution-type certificate, the certificate use request may include an associated application identifier, and an institution-type certificate alias ciphertext obtained by encrypting the institution-type certificate alias using a preset encryption algorithm and an associated application key; and after receiving the certificate use request, the institution certificate management subsystem may first search for the associated application key associated with the associated application identifier carried in the certificate use request, and then use the searched associated application key and a preset decryption algorithm corresponding to the preset encryption algorithm to decrypt the institution-type certificate alias ciphertext to obtain the institution-type certificate alias; and then determine whether the associated application identifier is Whether it has been associated with the institutional certificate alias; if so, it means that the associated application is a legitimate application requesting the institutional certificate, and the institutional certificate can be sent to the certificate requester. In order to ensure the transmission security of the institutional certificate, the institutional certificate can be encrypted using the preset encryption algorithm and the associated application key, and after obtaining the institutional certificate ciphertext, it is returned to the certificate requester for its use. If not associated, it means that the associated application is an illegal application requesting the institutional certificate, and the institutional certificate cannot be sent to the certificate requester. Instead, a certificate request failure message is sent to the certificate requester to inform it that the requested institutional certificate cannot be obtained.

[0064] Furthermore, when the certificate requested by the certificate requester is a terminal-type certificate, the certificate usage request may include a terminal identifier and a merchant identifier; and after receiving the certificate usage request, the institutional certificate management subsystem may first obtain the corresponding terminal-type certificate based on the terminal identifier and the merchant identifier, and then encrypt it using the key previously agreed upon by the terminal certificate management subsystem and the certificate requester, and after obtaining the terminal-type certificate ciphertext, return it to the certificate requester.

[0065] As mentioned above, the unified encryption aggregation system may further include a hard encryption machine management subsystem, wherein the hard encryption machine management subsystem is used to manage the hard encryption machine and call the hard encryption machine in response to a hard encryption request from a hard encryption requester.

[0066] Specifically, when the user of the hard encryptor needs to use the hard encryptor to perform hard encryption on the information to be processed, in order to ensure the security of the hard encryptor key, all the hard encryptor users of each hard encryption operation do not have the complete hard encryptor key, but each holds a part of the hard encryptor key, that is, the password component. The hard encryptor user uses the hard encryptor management subsystem, and the hard encryptor management subsystem inputs the password components held by all the hard encryptor users into the hard encryptor with the help of the hard encryptor operation instruction, and the hard encryptor synthesizes the password components to recover the hard encryptor key, and then uses the preset hard encryption algorithm to encrypt the recovered hard encryptor key to obtain the hard encryptor key index, which is used to identify the hard encryptor key, and then returns the hard encryptor key index to the hard encryptor user for use. In order to ensure the security of communication between the hard encryptor management subsystem and the hard encryptor, the hard encryptor management subsystem can extract the hard encryptor operation instruction from the third-party encrypted document, and interact with the hard encryptor by setting a proxy gateway, that is, through the proxy gateway.

[0067] After receiving the hard encryptor key index, the hard encryptor user may send it together with the information to be hard-encrypted to the hard encryptor management subsystem. After receiving the hard encryptor key index and the information to be processed sent by the hard encryptor user, the hard encryptor management subsystem forwards the hard encryptor key index and the information to be processed to the hard encryptor. The hard encryptor recovers the hard encryptor key based on the hard encryptor password index, and then uses the hard encryptor key to encrypt the information to be processed to obtain the hard encrypted information, and returns the hard encrypted information to the hard encryptor user.

[0068] Figure 2 The technical terms and technical features involved in the embodiments shown and related Figure 1 The technical terms and technical features mentioned in the embodiments shown and related are the same or similar. Figure 2 The explanation and description of the technical terms and technical features involved in the embodiments shown and related can refer to the above Figure 1 The explanations of the illustrated and related embodiments will not be repeated here.

[0069] The following are embodiments of the apparatus of the present disclosure, which can be used to execute embodiments of the method of the present disclosure.

[0070] Figure 3 FIG. 1 shows a structural block diagram of a unified encryption aggregation management device according to an embodiment of the present disclosure. The device can be implemented as part or all of an electronic device through software, hardware, or a combination of both. Figure 3 As shown, the unified encryption aggregation management device includes:

[0071] The institution certificate management subsystem 301 is configured to, in response to receiving the institution certificate and the associated application information of the institution certificate sent by the institution certificate service party, set an alias for the institution certificate, store the institution certificate based on the institution certificate alias, set an associated application identifier and an associated application key for the associated application of the institution certificate, and return the institution certificate alias, the associated application identifier and the associated application key to the institution certificate service party;

[0072] The terminal certificate management subsystem 302 is configured to, in response to receiving a terminal serial number and a merchant identifier associated with the terminal sent by a terminal class certificate service party, generate a terminal class certificate corresponding to the terminal according to the terminal serial number and the merchant identifier associated with the terminal, set an alias for the terminal class certificate, and store the terminal class certificate based on the terminal class certificate alias;

[0073] The unified encryption aggregation gateway 303 is configured to respond to a certificate usage request received from a certificate requester, determine whether the certificate requested by the certificate requester is an institution-type certificate or a terminal-type certificate according to the request interface of the certificate usage request, and when it is determined that the certificate requested by the certificate requester is an institution-type certificate, forward the certificate usage request to the institution certificate management subsystem so that the institution certificate management subsystem sends the institution-type certificate corresponding to the certificate usage request to the certificate requester; when the certificate requested by the certificate requester is a terminal-type certificate, forward the certificate usage request to the terminal certificate management subsystem so that the terminal certificate management subsystem sends the terminal-type certificate corresponding to the certificate usage request to the certificate requester.

[0074] As mentioned above, with the development of data demand, a lot of data needs to be encrypted. Different types of certificates may be used for encryption, and the encryption methods corresponding to different data are also different. For data using different encryption methods and different certificates, the processing method of the prior art is to store and request certificates separately for encryption. For example, the terminal certificate is stored in the local disk, and the storage path is provided by the database. The terminal certificate requester uses the storage path to request the certificate for use. However, this requires a large number of local disks, and when the number of terminal certificates is large, such as up to hundreds of millions, there is often a shortage of disk nodes. The above-mentioned processing method of the prior art is not only difficult to achieve unified management for the storage and use of certificates and the encryption of data, but is also not conducive to improving the efficiency of certificate access queries and reducing operational complexity and costs, and there is also a risk of key leakage.

[0075] Taking the above problems into consideration, in this embodiment, a device for unified encryption aggregation management is proposed, which uniformly manages the acquisition and encryption of certificates for data using different certificates and different encryption methods. This can not only effectively improve the efficiency of certificate access queries and effectively reduce the operational complexity and cost of data encryption, but also avoid the risk of key leakage.

[0076] In one embodiment of the present disclosure, the unified encryption aggregation device may be implemented as a computer, electronic device, etc. that performs unified management of data encryption and certificates used for encryption.

[0077] In one embodiment of the present disclosure, the institutional certificate may be generated by an institutional party and sent to an institutional certificate business party, and finally sent by the institutional certificate business party to an institutional certificate management subsystem in a unified encryption aggregation system for storage. The institutional certificate business party may send the institutional certificate to the institutional certificate management subsystem via email, so that the institutional certificate management subsystem can understand which applications may use the institutional certificate and respond when these applications request certificates, that is, grant these applications the right to use the certificate. When sending the institutional certificate to the institutional certificate management subsystem, the institutional certificate business party may also attach the associated application information that may use the institutional certificate in the future, wherein the associated application information may include information such as the associated application name.

[0078] After receiving the institutional certificate and the associated application information of the institutional certificate sent by the institutional certificate business party, the institutional certificate management subsystem stores the received institutional certificate, for example, using mysql for storage, and provides the relevant certificate request interface as a service. At the same time, the SDK method can be used to realize application integration, and a built-in cache mechanism is added to the SDK. After the http call, a certificate is saved in the local disk to prevent the call from failing and obtain the locally saved certificate. In order to distinguish the uniqueness of the certificate, an alias is set for each certificate when storing the certificate, that is, the institutional certificate is stored based on the institutional certificate alias. At the same time, in order to distinguish the associated application of the certificate uniquely and grant the certificate use authority to the associated application of the certificate, the associated application identifier and associated application key are also set for the associated application of the institutional certificate, and the set institutional certificate alias, associated application identifier and associated application key are returned to the institutional certificate business party, so that the institutional certificate business party can distribute the received information to the associated application of the certificate, so that it can use this information to request the use of the corresponding institutional certificate in the future.

[0079] In one embodiment of the present disclosure, the terminal certificate can be generated by the terminal certificate management subsystem according to the terminal serial number of the terminal sent by the terminal certificate service provider and the merchant identifier associated with the terminal. The terminal serial number refers to identification information that uniquely distinguishes the terminal, and the merchant identifier associated with the terminal refers to identification information that uniquely distinguishes the merchant associated with a certain terminal, such as the merchant ID.

[0080] After generating a terminal class certificate corresponding to a certain terminal, the terminal certificate management subsystem stores the generated terminal class certificate, for example, scyllaDB can be used for distributed storage, and provides relevant certificate request interfaces as a service. At the same time, SDK is provided and its own local cache mechanism is provided for application integration. The terminal certificate management subsystem also provides LRU algorithm cache to improve the efficiency of certificate access query through multi-level cache. Similar to institutional certificates, in order to distinguish the uniqueness of terminal class certificates, when storing terminal class certificates, it is necessary to set an alias for each terminal class certificate, that is, the terminal class certificate is stored based on the terminal class certificate alias. Furthermore, in one embodiment of the present disclosure, an alias can be set for the terminal class certificate according to the terminal serial number and the merchant identifier associated with the terminal.

[0081] After generating and storing the institutional certificates and terminal certificates, you can receive and process the requests sent by the certificate requester. Specifically: The unified encryption aggregation gateway uniformly receives the certificate use request sent by the certificate requester. Since the storage locations of different types of certificates are different, institutional certificates are stored and managed by the institutional certificate management subsystem, and terminal certificates are stored and managed by the terminal certificate management subsystem. Therefore, it is necessary to judge the type of certificate requested by the certificate requester, and then forward the certificate use request to the corresponding certificate management subsystem for processing. When judging the type of certificate requested by the certificate requester, it can be judged according to the request interface of the certificate use request. When the request interface used by the certificate use request is the interface corresponding to the institutional certificate management subsystem, it can be judged that the certificate requested by the certificate requester is an institutional certificate. At this time, the certificate use request can be forwarded to the institutional certificate management subsystem, and the institutional certificate management subsystem obtains the institutional certificate corresponding to the certificate use request and sends it to the certificate requester; when the request interface used by the certificate use request is the interface corresponding to the terminal certificate management subsystem, it can be judged that the certificate requested by the certificate requester is a terminal certificate. At this time, the certificate use request can be forwarded to the terminal certificate management subsystem, and the terminal certificate management subsystem obtains the terminal certificate corresponding to the certificate use request and sends it to the certificate requester.

[0082] Furthermore, in one embodiment of the present disclosure, in order to conduct more comprehensive management of institutional certificates, the institutional certificate service provider may also send institutional certificate information when sending the institutional certificate, wherein the institutional certificate information may include one or more of the following information: purpose of the certificate, certificate owner, certificate manager, and so on.

[0083] In this implementation, if the institutional certificate business party also sends the institutional certificate information when sending the institutional certificate, the institutional certificate management subsystem can generate the institutional certificate remark information based on the institutional certificate information, wherein the institutional certificate remark information may include one or more of the following information: certificate sender, certificate owner, certificate manager, certificate storage time, etc.; then, when storing the institutional certificate, the institutional certificate management subsystem can store the institutional certificate based on the institutional certificate alias and the institutional certificate remark information, that is, when storing the institutional certificate, the institutional certificate alias and the institutional certificate remark information are stored together to distinguish and explain the institutional certificate.

[0084] Furthermore, in this implementation, if the institution certificate service party also sends the institution certificate information when sending the institution certificate, the associated application identifier and associated application key can be set for the associated application of the institution certificate according to the institution certificate name, the institution certificate associated application name, the institution certificate alias and the institution certificate remark information. Then the institution certificate name, the institution certificate associated application name, the institution certificate alias, the institution certificate remark information, the associated application identifier and the associated application key are associated with the stored institution certificate to improve the institution certificate's own information and associated information, which not only ensures the safe use of the institution certificate, but also ensures that the certificate's associated application can obtain the corresponding certificate in a timely manner.

[0085] Furthermore, when the certificate requested by the certificate requester is an institution-type certificate, the certificate use request may include an associated application identifier, and an institution-type certificate alias ciphertext obtained by encrypting the institution-type certificate alias using a preset encryption algorithm and an associated application key; and after receiving the certificate use request, the institution certificate management subsystem may first search for the associated application key associated with the associated application identifier carried in the certificate use request, and then use the searched associated application key and a preset decryption algorithm corresponding to the preset encryption algorithm to decrypt the institution-type certificate alias ciphertext to obtain the institution-type certificate alias; and then determine whether the associated application identifier is Whether it has been associated with the institutional certificate alias; if so, it means that the associated application is a legitimate application requesting the institutional certificate, and the institutional certificate can be sent to the certificate requester. In order to ensure the transmission security of the institutional certificate, the institutional certificate can be encrypted using the preset encryption algorithm and the associated application key, and after obtaining the institutional certificate ciphertext, it is returned to the certificate requester for its use. If not associated, it means that the associated application is an illegal application requesting the institutional certificate, and the institutional certificate cannot be sent to the certificate requester. Instead, a certificate request failure message is sent to the certificate requester to inform it that the requested institutional certificate cannot be obtained.

[0086] Furthermore, when the certificate requested by the certificate requester is a terminal-type certificate, the certificate usage request may include a terminal identifier and a merchant identifier; and after receiving the certificate usage request, the institutional certificate management subsystem may first obtain the corresponding terminal-type certificate based on the terminal identifier and the merchant identifier, and then encrypt it using the key previously agreed upon by the terminal certificate management subsystem and the certificate requester, and after obtaining the terminal-type certificate ciphertext, return it to the certificate requester.

[0087] The unified encryption aggregation management device may further include a hard encryption machine management subsystem, wherein the hard encryption machine management subsystem is configured to manage the hard encryption machine and call the hard encryption machine in response to a hard encryption request from a hard encryption requester.

[0088] Specifically, when the user of the hard encryptor needs to use the hard encryptor to perform hard encryption on the information to be processed, in order to ensure the security of the hard encryptor key, all the hard encryptor users of each hard encryption operation do not have the complete hard encryptor key, but each holds a part of the hard encryptor key, that is, the password component. The hard encryptor user uses the hard encryptor management subsystem, and the hard encryptor management subsystem inputs the password components held by all the hard encryptor users into the hard encryptor with the help of the hard encryptor operation instruction, and the hard encryptor synthesizes the password components to recover the hard encryptor key, and then uses the preset hard encryption algorithm to encrypt the recovered hard encryptor key to obtain the hard encryptor key index, which is used to identify the hard encryptor key, and then returns the hard encryptor key index to the hard encryptor user for use. In order to ensure the security of communication between the hard encryptor management subsystem and the hard encryptor, the hard encryptor management subsystem can extract the hard encryptor operation instruction from the third-party encrypted document, and interact with the hard encryptor by setting a proxy gateway, that is, through the proxy gateway.

[0089] After receiving the hard encryptor key index, the hard encryptor user may send it together with the information to be hard-encrypted to the hard encryptor management subsystem. After receiving the hard encryptor key index and the information to be processed sent by the hard encryptor user, the hard encryptor management subsystem forwards the hard encryptor key index and the information to be processed to the hard encryptor. The hard encryptor recovers the hard encryptor key based on the hard encryptor password index, and then uses the hard encryptor key to encrypt the information to be processed to obtain the hard encrypted information, and returns the hard encrypted information to the hard encryptor user.

[0090] Figure 3 The technical terms and technical features involved in the embodiments shown and related Figure 1-Figure 2 The technical terms and technical features mentioned in the embodiments shown and related are the same or similar. Figure 3 The explanation and description of the technical terms and technical features involved in the embodiments shown and related can refer to the above Figure 1-Figure 2 The explanations of the illustrated and related embodiments will not be repeated here.

[0091] The present disclosure also discloses an electronic device, Figure 4 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown. Figure 4 As shown, the electronic device 400 includes a memory 401 and a processor 402; wherein,

[0092] The memory 401 is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor 402 to implement the above method steps.

[0093] Figure 5 It is a structural diagram of a computer system suitable for implementing a method for unified encryption aggregation management according to an embodiment of the present disclosure.

[0094] like Figure 5 As shown, the computer system 500 includes a processing unit 501, which can perform various processes in the above-mentioned embodiments according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage part 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the computer system 500 are also stored. The processing unit 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0095] The following components are connected to the I / O interface 505: an input part 506 including a keyboard, a mouse, etc.; an output part 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage part 508 including a hard disk, etc.; and a communication part 509 including a network interface card such as a LAN card, a modem, etc. The communication part 509 performs communication processing via a network such as the Internet. The drive 510 is also connected to the I / O interface 505 as needed. Removable media 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., are installed on the drive 510 as needed, so that the computer program read therefrom is installed into the storage part 508 as needed. Among them, the processing unit 501 can be implemented as a processing unit such as a CPU, a GPU, a TPU, an FPGA, an NPU, etc.

[0096] In particular, according to an embodiment of the present disclosure, the method described above can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program tangibly contained on a readable medium thereof, and the computer program includes a program code for executing the method. In such an embodiment, the computer program can be downloaded and installed from a network through the communication part 509, and / or installed from a removable medium 511.

[0097] The embodiment of the present disclosure also discloses a computer program product, which includes a computer program / instruction, and the computer program / instruction implements any of the above method steps when executed by a processor.

[0098] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the road map or block diagram can represent a part of a module, program segment or code, and the part of the module, program segment or code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a different order from the order marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0099] The units or modules involved in the embodiments described in the present disclosure may be implemented by software or hardware. The units or modules described may also be set in a processor, and the names of these units or modules do not constitute limitations on the units or modules themselves in some cases.

[0100] As another aspect, the embodiments of the present disclosure further provide a computer-readable storage medium, which may be a computer-readable storage medium included in the device described in the above-mentioned embodiment; or a computer-readable storage medium that exists independently and is not assembled into the device. The computer-readable storage medium stores one or more programs, and the programs are used by one or more processors to execute the methods described in the embodiments of the present disclosure.

[0101] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the inventive concept. For example, the above features are replaced with (but not limited to) technical features with similar functions disclosed in the embodiments of the present disclosure.

Claims

1. A unified encryption aggregation system, the system comprising: Institutional certificate management subsystem, terminal certificate management subsystem and unified encryption aggregation gateway, including: The institution certificate management subsystem is used to receive, store and manage institution certificates, and after receiving an institution certificate use request sent by an institution certificate requester, send the institution certificate corresponding to the institution certificate use request to the institution certificate requester; The terminal certificate management subsystem is used to generate, store and manage terminal class certificates, and after receiving a terminal class certificate use request sent by a terminal class certificate requester, send the terminal class certificate corresponding to the terminal class certificate use request to the terminal class certificate requester; The unified encryption aggregation gateway is used to receive a certificate usage request sent by a certificate requester, and forward the certificate usage request to the institution certificate management subsystem or the terminal certificate management subsystem.

2. The system according to claim 1, wherein: The system further includes: a hard encryption machine management subsystem, wherein the hard encryption machine management subsystem is used to manage the hard encryption machine and call the hard encryption machine in response to a hard encryption request from a hard encryption requester.

3. A method for unified encryption aggregation management using the unified encryption aggregation system according to any one of claims 1 to 2, the method comprising: The institution certificate management subsystem, in response to receiving the institution certificate and the associated application information of the institution certificate sent by the institution certificate service party, sets an alias for the institution certificate, stores the institution certificate based on the institution certificate alias, sets an associated application identifier and an associated application key for the associated application of the institution certificate, and returns the institution certificate alias, the associated application identifier and the associated application key to the institution certificate service party; The terminal certificate management subsystem, in response to receiving the terminal serial number and the merchant identifier associated with the terminal sent by the terminal class certificate service party, generates a terminal class certificate corresponding to the terminal according to the terminal serial number and the merchant identifier associated with the terminal, sets an alias for the terminal class certificate, and stores the terminal class certificate based on the terminal class certificate alias; The unified encryption aggregation gateway responds to receiving a certificate usage request sent by a certificate requester, and determines whether the certificate requested by the certificate requester is an institution-type certificate or a terminal-type certificate according to the request interface of the certificate usage request. When it is determined that the certificate requested by the certificate requester is an institution-type certificate, the certificate usage request is forwarded to the institution certificate management subsystem, so that the institution certificate management subsystem sends the institution-type certificate corresponding to the certificate usage request to the certificate requester. When the certificate requested by the certificate requester is a terminal-type certificate, the certificate usage request is forwarded to the terminal certificate management subsystem, so that the terminal certificate management subsystem sends the terminal-type certificate corresponding to the certificate usage request to the certificate requester.

4. The method according to claim 3, wherein: When sending the institution certificate, the institution certificate service provider will also send the institution certificate information, wherein the institution certificate information includes one or more of the following information: certificate purpose, certificate owner, and certificate management party; The institution certificate management subsystem also generates institution certificate remark information according to the institution certificate information, wherein the institution certificate remark information includes one or more of the following information: certificate sender, certificate owner, certificate manager, and certificate storage time; The storing of the institution certificate based on the institution certificate alias is implemented as follows: The institution certificate is stored based on the institution certificate alias and the institution certificate remarks information.

5. The method according to claim 4, wherein: The step of setting an associated application identifier and an associated application key for the associated application of the institution certificate includes: According to the name of the institution certificate, the name of the institution certificate associated application, the alias of the institution certificate and the remarks information of the institution certificate, an associated application identifier and an associated application key are set for the associated application of the institution certificate; The method further comprises: The institution certificate name, institution certificate associated application name, institution certificate alias, institution certificate remark information, associated application identifier and associated application key are associated with the stored institution certificate.

6. The method according to claim 3, wherein: The step of setting an alias for the terminal certificate includes: An alias is set for the terminal class certificate according to the terminal serial number and a merchant identifier associated with the terminal.

7. The method according to claim 3, wherein: When the certificate requested by the certificate requester is an institution-type certificate, the certificate use request includes an associated application identifier and an institution-type certificate alias ciphertext obtained by encrypting the institution-type certificate alias using a preset encryption algorithm and an associated application key; The institution certificate management subsystem searches for an associated application key associated with the associated application identifier according to the associated application identifier, and uses the associated application key and a preset decryption algorithm corresponding to the preset encryption algorithm to decrypt the institution certificate alias ciphertext to obtain the institution certificate alias; Determine whether the associated application identifier is associated with the institution certificate alias. If so, encrypt the institution certificate using the preset encryption algorithm and the associated application key to obtain the institution certificate ciphertext, and return it to the certificate requester. If not, send a certificate request failure message to the certificate requester.

8. The method according to claim 3, wherein: When the certificate requested by the certificate requester is a terminal certificate, the certificate use request includes a terminal identifier and a merchant identifier; The terminal certificate management subsystem obtains the corresponding terminal class certificate according to the terminal identifier and the merchant identifier, encrypts it using the key agreed upon by the terminal certificate management subsystem and the certificate requester, obtains the terminal class certificate ciphertext, and returns it to the certificate requester.

9. The method according to claim 3, further comprising: The hard encryptor management subsystem inputs the cryptographic components corresponding to two or more hard encryptor users into the hard encryptor by means of the hard encryptor operation instruction, the hard encryptor synthesizes the cryptographic components to obtain a hard encryptor key, encrypts the hard encryptor key using a preset hard encryption algorithm to obtain a hard encryptor key index, and returns the hard encryptor key index to the hard encryptor user; In response to receiving the hard encryptor key index and information to be processed sent by the hard encryptor user, the hard encryptor management subsystem sends the hard encryptor key index and information to be processed to the hard encryptor, and the hard encryptor recovers the hard encryptor key based on the hard encryptor password index, uses the hard encryptor key to encrypt the information to be processed to obtain hard encrypted information, and returns the hard encrypted information to the hard encryptor user.

10. A unified encryption aggregation management device, the device comprising: The institution certificate management subsystem is configured to, in response to receiving the institution certificate and the associated application information of the institution certificate sent by the institution certificate service party, set an alias for the institution certificate, store the institution certificate based on the institution certificate alias, set an associated application identifier and an associated application key for the associated application of the institution certificate, and return the institution certificate alias, the associated application identifier and the associated application key to the institution certificate service party; The terminal certificate management subsystem is configured to, in response to receiving a terminal serial number and a merchant identifier associated with the terminal sent by a terminal class certificate service party, generate a terminal class certificate corresponding to the terminal according to the terminal serial number and the merchant identifier associated with the terminal, set an alias for the terminal class certificate, and store the terminal class certificate based on the terminal class certificate alias; A unified encryption aggregation gateway is configured to respond to a certificate usage request received from a certificate requester, determine whether the certificate requested by the certificate requester is an institution-type certificate or a terminal-type certificate according to a request interface of the certificate usage request, and when it is determined that the certificate requested by the certificate requester is an institution-type certificate, forward the certificate usage request to the institution certificate management subsystem so that the institution certificate management subsystem sends the institution-type certificate corresponding to the certificate usage request to the certificate requester; when the certificate requested by the certificate requester is a terminal-type certificate, forward the certificate usage request to the terminal certificate management subsystem so that the terminal certificate management subsystem sends the terminal-type certificate corresponding to the certificate usage request to the certificate requester.

Images