Certificate distribution method, certificate distribution device and system, storage medium and electronic equipment

Abstract

The embodiment of the invention provides a certificate distribution method, a certificate distribution device and system, a storage medium and electronic equipment. Comprising the following steps: when a digital certificate is not detected to be stored in gateway equipment, acquiring an equipment identifier and a management authority identifier of the gateway equipment, and acquiring a first public key in a first key pair from a certificate distribution end; when the second key pair is generated, the device identifier and the management authority identifier are included in the certificate distribution application; when the second key pair is generated, the first public key is adopted to encrypt the certificate distribution application, the encrypted certificate distribution application and the second public key in the second key pair are sent to the certificate distribution end, and the certificate distribution end is used for decrypting the encrypted certificate distribution application by adopting the first private key in the first key pair and sending the decrypted certificate distribution application to the certificate distribution end; the distribution certificate distributes the applied digital certificate, and encrypts the digital certificate by using a second public key; and receiving the encrypted digital certificate, and decrypting the encrypted digital certificate by using the second private key in the second key pair.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a certificate distribution method, a certificate distribution device and system, a storage medium, and an electronic device. Background Art

[0002] The gateway adds security functions during the data transmission process, handles security policies, access control, identity authentication, encryption and decryption and other security-related tasks, can monitor incoming and outgoing network traffic, detect and block potential security threats, and thus provide Internet users with a way to securely access internal network resources of the organization. In the process of establishing a communication tunnel, the gateway needs to use a digital certificate to prove its identity, and in the process of data transmission, it also needs to use a digital certificate to encrypt the data to ensure the integrity of the data during transmission. Therefore, how to correctly, effectively and conveniently configure digital certificates during the initial installation and deployment of the gateway software package or gateway device is a very important issue.

[0003] In the related art, the gateway is always delivered to the user as a fixed device with a pre-installed digital certificate. The digital certificate corresponding to each gateway is not delivered in combination with the user's conditions, so that the gateway software package or gateway device cannot provide a valid digital certificate when leaving the factory, resulting in poor installation and deployment flexibility of the gateway device. Summary of the invention

[0004] In view of this, an embodiment of the present application provides a certificate distribution method, a certificate distribution device and its system, a storage medium and an electronic device to solve or alleviate the problem in the related technology that the gateway software package or gateway device cannot provide a valid digital certificate when leaving the factory, resulting in poor installation and deployment flexibility of the gateway device.

[0005] According to a first aspect of an embodiment of the present application, a certificate distribution method is provided, which is applied to a gateway device, and the method includes: when no digital certificate is detected to be pre-stored in the gateway device, obtaining a device identification and a management authority identification of the gateway device, and obtaining a first public key in a first key pair from a certificate distribution end; while generating a second key pair, including the device identification and the management authority identification in a certificate distribution application; when generating the second key pair, encrypting the certificate distribution application with the first public key, and sending the encrypted certificate distribution application and the second public key in the second key pair to the certificate distribution end, the certificate distribution end being used to decrypt the encrypted certificate distribution application with the first private key in the first key pair, distribute the digital certificate of the certificate distribution application, and encrypt the digital certificate with the second public key; receiving the encrypted digital certificate, and decrypting the encrypted digital certificate with the second private key in the second key pair.

[0006] In some embodiments of the present application, when a digital certificate is not pre-stored in the gateway device, a device identification of the gateway device is obtained, including: obtaining the input login information of the user who installs the gateway device and the registration information of the gateway device; performing authority authentication on the user who installs the gateway device based on the login information to determine whether the user has installation authority; after the user has installation authority, aggregating the registration information to obtain the device identification.

[0007] In some embodiments of the present application, the certificate distribution end includes a registration authentication server and a certificate distribution server, wherein obtaining the first public key in the first key pair from the certificate distribution end includes: sending a device identification to the registration authentication server, causing the registration authentication server to sign the device identification, and synchronizing the device identification signature to the certificate distribution server; receiving the device identification signature and the first public key in the first key pair from the registration authentication server.

[0008] In some embodiments of the present application, the certificate distribution end also includes a certificate generation server, wherein the encrypted certificate distribution application and the second public key in the second key pair are sent to the certificate distribution end, the certificate distribution end is used to use the first private key in the first key pair to decrypt the encrypted certificate distribution application, distribute the digital certificate of the certificate distribution application, and use the second public key to encrypt the digital certificate, including: sending the encrypted certificate distribution application and the second public key in the second key pair to the certificate distribution server, the certificate distribution server is used to verify the encrypted certificate distribution application, and after the certificate distribution application is verified, the encrypted certificate distribution application is sent to the certificate generation server, the certificate generation server is used to generate a digital certificate for the certificate distribution application, and use the second public key to encrypt the digital certificate, and return the encrypted digital certificate to the gateway device through the certificate distribution server.

[0009] In some embodiments of the present application, an encrypted certificate distribution application is verified, including: obtaining a first private key from a certificate generation server, and using the first private key to decrypt the encrypted certificate distribution application to obtain a device identification; verifying the device identification signature to determine whether the device identification obtained by the verification is the same as the device identification; when the device identification obtained by the verification is the same as the device identification, and the device identification of the gateway device has been registered, it is determined that the verification of the certificate distribution application has passed.

[0010] In some embodiments of the present application, the first private key in the first key pair is used to decrypt the encrypted certificate distribution application, and the digital certificate of the certificate distribution application is distributed, including: using the first private key in the first key pair to decrypt the encrypted certificate distribution application to obtain the device identification and management authority identification in the certificate distribution application; verifying the legitimacy of the management authority identification, and after the legitimacy verification is passed, filling the device identification and management authority identification into a preset certificate template to obtain the digital certificate of the certificate distribution application.

[0011] According to a second aspect of an embodiment of the present application, a certificate distribution device is provided, which includes: an acquisition module, which is used to acquire a device identification and a management authority identification of a gateway device when a digital certificate is not detected to be pre-stored in the gateway device, and acquire a first public key in a first key pair from a certificate distribution end; a generation module, which is used to include the device identification and the management authority identification in a certificate distribution application while generating a second key pair; an encryption module, which is used to encrypt the certificate distribution application using the first public key when generating the second key pair, and send the encrypted certificate distribution application and the second public key in the second key pair to the certificate distribution end, the certificate distribution end is used to decrypt the encrypted certificate distribution application using the first private key in the first key pair, distribute the digital certificate of the certificate distribution application, and encrypt the digital certificate using the second public key; a decryption module, which is used to receive the encrypted digital certificate, and decrypt the encrypted digital certificate using the second private key in the second key pair.

[0012] According to a third aspect of an embodiment of the present application, a certificate distribution system is provided, the system comprising: a gateway device and a certificate distribution terminal according to any of the above embodiments, the certificate distribution terminal comprising a registration authentication server, a certificate distribution server and a certificate generation server.

[0013] According to the fourth aspect of the embodiments of the present application, an electronic device is provided, including: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other through the communication bus; the memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform operations corresponding to the certificate distribution method of any of the above embodiments.

[0014] According to a fifth aspect of the embodiments of the present application, a computer storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the certificate distribution method of any of the above embodiments is implemented.

[0015] According to the certificate distribution method, certificate distribution device and system, storage medium and electronic device provided in the embodiments of the present application, when the digital certificate is not installed in the gateway device, the device identification and management authority identification of the gateway device are obtained to generate a certificate distribution application, and the certificate distribution application is encrypted by the first public key and sent to the certificate distribution end, so that the certificate distribution end decrypts the encrypted certificate distribution application by the first private key to generate a digital certificate, and encrypts the digital certificate by the second public key of the gateway device, and then the gateway device can decrypt the encrypted digital certificate by the second private key, thereby combining user conditions while ensuring the security of the digital certificate delivery process, so that the gateway device can provide a valid digital certificate when leaving the factory, ensuring the installation and deployment flexibility of the gateway device. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0017] Figure 1 A schematic diagram of a flow chart of a certificate distribution method according to an embodiment of the present application;

[0018] Figure 2 A schematic diagram of the overall process of a certificate distribution method according to an embodiment of the present application;

[0019] Figure 3 is a structural block diagram of a certificate distribution device according to an embodiment of the present application;

[0020] Figure 4 is a structural block diagram of a certificate distribution system according to an embodiment of the present application;

[0021] Figure 5 The figure is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the embodiments of the present application should fall within the scope of protection of the embodiments of the present application.

[0023] The specific implementation of the embodiments of the present application is further explained below in combination with the embodiments of the present application and the accompanying drawings.

[0024] Figure 1 The figure is a flowchart of a certificate distribution method according to an embodiment of the present application.

[0025] like Figure 1 As shown, the method includes:

[0026] S11: When it is detected that no digital certificate is pre-stored in the gateway device, a device identifier and a management authority identifier of the gateway device are obtained, and a first public key in a first key pair is obtained from a certificate distribution end.

[0027] Specifically, the gateway device refers to a security gateway device, and the certificate distribution terminal can distribute digital certificates to the gateway device. Different device identifiers indicate different gateway devices, and the management authority identifier is composed of the user information of the gateway device owner filled in when registering the gateway device. The user information includes but is not limited to the country, region, organization, unit to which the gateway device owner belongs, and the gateway device number owned by the owner.

[0028] When installing and deploying a gateway software package or a gateway device, a digital certificate will be installed for the gateway software or gateway device. Before installing the corresponding digital certificate for each security gateway device, the installer will detect whether the gateway software package or gateway device has installed the corresponding digital certificate. If the corresponding digital certificate is not installed, the installer will obtain the device ID and management authority ID of the gateway device in order to generate a digital certificate later. The installer can be deployed to the gateway device by copying, and the installer can be executed to install the gateway software package on the gateway device. The installer can also be accessed online through a browser, and the installer can install the gateway software package on the gateway device online.

[0029] In some embodiments, when a digital certificate is not pre-stored in the gateway device, a device identification of the gateway device is obtained, including: obtaining the input login information of the user who installs the gateway device and the registration information of the gateway device; performing authority authentication on the user who installs the gateway device based on the login information to determine whether the user has installation authority; after the user has installation authority, aggregating the registration information to obtain the device identification.

[0030] The login information includes but is not limited to the login account, login password, login verification code and other information of the user who installs the gateway device, and the registration information includes but is not limited to the device number, IP address, Mac (Media Access Control Address, local area network address) address and other information of the installed gateway device. When the user who installs the gateway device enters the login account and login password, the identity information of the user will be confirmed to determine whether the user has the authority to install the gateway device (such as comparing the login account and login password to see if they are the account and password authorized to install the gateway device). If the user does not have the corresponding authority, the user will be denied installation of the gateway device and the generation of the digital certificate of the gateway device will be stopped. If the user has the corresponding authority, the registration information will be aggregated to obtain the device identification of the gateway device. In this way, the reliability and flexibility of the installation program and gateway device registration are guaranteed.

[0031] S12: While generating the second key pair, include the device identification and the management authority identification in the certificate distribution application.

[0032] Among them, the second key pair is generated after the installation program deployed on the gateway device receives the first public key and device identification signature sent by the certificate distribution end. The second key pair includes a second private key and a second public key. When generating the second key pair, the certificate distribution application is generated by the second private key in the second key pair.

[0033] Specifically, in some embodiments, the certificate distribution end includes a registration authentication server and a certificate distribution server, wherein obtaining the first public key in the first key pair from the certificate distribution end includes: sending a device identification to the registration authentication server, causing the registration authentication server to sign the device identification, and synchronizing the device identification signature to the certificate distribution server; receiving the device identification signature and the first public key in the first key pair from the registration authentication server.

[0034] That is to say, when the installation program detects that the gateway device has not installed the corresponding digital certificate, the obtained device identification is sent to the registration and authentication server, so that the registration and authentication server signs the device identification based on the first private key in the first key pair, obtains the device identification signature and sends it to the gateway device, and synchronizes the device identification signature to the certificate distribution server. Then, the installation program on the gateway device generates a second key pair after receiving the first public key and device identification signature sent by the certificate distribution end, so that when generating the second key pair, the device identification and management authority identification are included in the certificate distribution application.

[0035] S13: When generating the second key pair, the first public key is used to encrypt the certificate distribution application, and the encrypted certificate distribution application and the second public key in the second key pair are sent to the certificate distribution end, which is used to decrypt the encrypted certificate distribution application using the first private key in the first key pair, distribute the digital certificate of the certificate distribution application, and encrypt the digital certificate using the second public key.

[0036] In some embodiments, decrypting the encrypted certificate distribution application using the first private key in the first key pair and distributing the digital certificate of the certificate distribution application includes:

[0037] The first private key in the first key pair is used to decrypt the encrypted certificate distribution application to obtain the device identification and management authority identification in the certificate distribution application; the management authority identification is verified for legitimacy, and after the legitimacy verification is passed, the device identification and management authority identification are filled into the preset certificate template to obtain the digital certificate of the certificate distribution application.

[0038] It can be understood that since the certificate distribution end needs to distribute digital certificates based on the certificate distribution application, when sending the certificate distribution application to the certificate distribution end, in order to ensure the security of data transmission, the certificate distribution application is encrypted by the first public key in the first key obtained from the certificate distribution end, and the encrypted certificate distribution application is sent to the certificate distribution end for subsequent certificate distribution, thereby ensuring the confidentiality and validity of the gateway software package or gateway device identity during the digital certificate application process.

[0039] Furthermore, the certificate distribution end decrypts the certificate distribution application through the first private key corresponding to the encrypted first public key, obtains the device identification and management authority identification, and verifies the legitimacy of the gateway device owner indicated by the management authority identification. The legitimacy verification can verify the authenticity of the information provided by the owner through various means such as online and offline, such as verifying whether the country, region, organization, unit to which the gateway device owner belongs, and the gateway device number owned by it are legal. After the legitimacy verification is passed, the device identification and management authority identification are filled in the preset certificate template to obtain the digital certificate of the certificate distribution application.

[0040] In addition, when the certificate distribution end distributes the digital certificate to the gateway device, it is also necessary to ensure the security of the digital certificate during the transmission process. Therefore, the gateway device is required to send the second public key in the second key pair generated locally to the certificate distribution end, so that the certificate distribution end can encrypt the digital certificate with the second public key and then transmit it.

[0041] S14: Receive the encrypted digital certificate, and use the second private key in the second key pair to decrypt the encrypted digital certificate.

[0042] After the installation program of the gateway device receives the encrypted digital certificate, the encrypted digital certificate is decrypted by the second private key corresponding to the second public key in the second key pair, so as to import the decrypted digital certificate into the gateway software package or the gateway device, thereby realizing the installation of the digital certificate in the gateway device.

[0043] In this way, when the digital certificate is not installed in the gateway device, the device identification and management authority identification of the gateway device are obtained to generate a certificate distribution application, and the certificate distribution application is encrypted by the first public key and sent to the certificate distribution end, so that the certificate distribution end decrypts the encrypted certificate distribution application by the first private key to generate a digital certificate, and encrypts the digital certificate by the second public key of the gateway device, and then the gateway device can decrypt the encrypted digital certificate by the second private key, thereby ensuring the security of the digital certificate delivery process while combining user conditions, so that the gateway device can provide a valid digital certificate when leaving the factory, ensuring the installation and deployment flexibility of the gateway device.

[0044] In some embodiments, the certificate distribution end further includes a certificate generation server, wherein the encrypted certificate distribution application and the second public key in the second key pair are sent to the certificate distribution end, and the certificate distribution end is used to decrypt the encrypted certificate distribution application using the first private key in the first key pair, distribute the digital certificate of the certificate distribution application, and encrypt the digital certificate using the second public key, including:

[0045] The encrypted certificate distribution application and the second public key in the second key pair are sent to the certificate distribution server. The certificate distribution server is used to verify the encrypted certificate distribution application. After the certificate distribution application is verified, the encrypted certificate distribution application is sent to the certificate generation server. The certificate generation server is used to generate a digital certificate for the certificate distribution application, encrypt the digital certificate with the second public key, and return the encrypted digital certificate to the gateway device through the certificate distribution server.

[0046] The first key pair is a key pair corresponding to the certificate generation server. The certificate distribution server is used to verify and distribute the encrypted certificate distribution application, and the certificate generation server is used to generate a digital certificate based on the encrypted certificate distribution application and encrypt it to obtain the encrypted digital certificate.

[0047] Further, in some embodiments, the encrypted certificate distribution application is verified, including: obtaining a first private key from a certificate generation server, and using the first private key to decrypt the encrypted certificate distribution application to obtain a device identification; verifying the device identification signature to determine whether the device identification obtained by the verification is the same as the device identification decrypted from the encrypted certificate distribution application; when the device identification obtained by the verification is the same as the device identification, and the device identification of the gateway device has been registered, it is determined that the verification of the certificate distribution application has passed.

[0048] That is to say, after the certificate distribution server receives the certificate distribution application sent by the gateway device, it first uses the first private key of the certificate generation server to decrypt the encrypted certificate distribution application to obtain the device identification in the certificate distribution application; then uses the first private key of the certificate generation server to verify the device identification signature synchronized by the registration and authentication server to determine whether the device identification obtained by verification is the same as the device identification in the certificate distribution application. If not, the digital certificate distribution application is rejected. If they are the same; then continue to check whether the device identification in the certificate distribution application is in the list of registered device identifications. If not, the digital certificate distribution application is rejected. If so, it is determined that the verification of the certificate distribution application has passed, and finally the encrypted certificate distribution application is sent to the certificate generation server. In this way, the complete validity of the identity of the owner of the gateway device can be ensured.

[0049] Furthermore, after receiving the encrypted certificate distribution application, the certificate generation server uses the first private key of the certificate generation server to decrypt the encrypted certificate distribution application, obtains the device identification and management authority identification in the certificate distribution application, and passes the legitimacy verification for the management authority identification. After the legitimacy verification is passed, the device identification and management authority identification are filled in the preset certificate template to obtain the digital certificate of the certificate distribution application, and then the generated certificate is encrypted using the second public key in the second key pair, and the encrypted certificate is sent to the installation program of the gateway device through the certificate distribution server, thereby effectively ensuring that the gateway device obtains a completely trusted digital certificate.

[0050] For example, Figure 2 FIG. 1 is a schematic diagram of the overall process of a certificate distribution method according to an embodiment of the present application. Figure 2 As shown, the method is applied between a gateway device, a registration authentication server, a certificate distribution server and a certificate generation server, and includes:

[0051] S21: The installation program deployed on the gateway device detects whether the gateway device has installed the corresponding digital certificate;

[0052] S22: If the corresponding digital certificate is not installed, the installation program obtains the device identification of the gateway device and sends the device identification to the registration authentication server;

[0053] S23: The registration authentication server signs the device identification using the private key of the certificate generation server to obtain the device identification signature;

[0054] S24: The registration authentication server synchronizes the device identification signature to the certificate distribution server, so that the certificate distribution server stores the device identification signature;

[0055] S25: The registration authentication server sends the device identification signature and the first public key of the certificate generation server to the gateway device;

[0056] S26: The gateway device stores the device identification signature and the first public key, and generates a second key pair;

[0057] S27: The gateway device includes the device identification and the obtained management authority identification into the certificate distribution application;

[0058] S28: The gateway device uses the first public key of the certificate generation server to encrypt the certificate distribution application;

[0059] S29: The gateway device sends the encrypted certificate distribution application and the second public key of the gateway device to the certificate distribution server;

[0060] S30: The certificate distribution server uses the first private key of the certificate generation server to decrypt the encrypted certificate distribution application to obtain a device identification;

[0061] S31: The certificate distribution server verifies the signature of the device identification to determine whether the device identification obtained by the verification is the same as the device identification;

[0062] S32: When the device identification obtained by the signature verification is the same as the device identification, determining whether the device identification of the gateway device is in the registered device identification list;

[0063] S33: When the device identification of the gateway device is in the registered device identification list, determining that the verification of the certificate distribution application is passed;

[0064] S34: The certificate distribution server sends the encrypted certificate distribution application to the certificate generation server;

[0065] S35: The certificate generation server decrypts the encrypted certificate distribution application and generates a digital certificate based on the certificate distribution server;

[0066] S36: The certificate generation server encrypts the digital certificate using the second public key of the gateway device, and sends it to the gateway device through the certificate distribution server;

[0067] S37: The installation program on the gateway device decrypts the encrypted digital certificate based on the second private key of the gateway device to obtain a decrypted digital certificate;

[0068] S38: The installation program installs the digital certificate in the gateway device.

[0069] In summary, the present application obtains the device identification and management authority identification of the gateway device to generate a certificate distribution application when the digital certificate is not installed in the gateway device, and encrypts the certificate distribution application with the first public key and sends it to the certificate distribution end, so that the certificate distribution end decrypts the encrypted certificate distribution application with the first private key to generate a digital certificate, and encrypts the digital certificate with the second public key of the gateway device, and then the gateway device can decrypt the encrypted digital certificate through the second private key, thereby combining user conditions while ensuring the security of the digital certificate delivery process, so that the gateway device can provide a valid digital certificate when leaving the factory, ensuring the installation and deployment flexibility of the gateway device.

[0070] The certificate distribution method of this embodiment can be executed by any appropriate electronic device with data processing capability, including but not limited to: a server, a mobile terminal (such as a mobile phone, a PAD, etc.) and a PC, etc.

[0071] Figure 3 The figure is a structural block diagram of a certificate distribution device according to an embodiment of the present application.

[0072] like Figure 3 As shown, the certificate distribution device 300 can execute Figure 1 The certificate distribution method, the certificate distribution device 300 includes: an acquisition module 301, which is used to obtain the device identification and management authority identification of the gateway device when the digital certificate is not detected to be pre-stored in the gateway device, and obtain the first public key in the first key pair from the certificate distribution end; a generation module 302, which is used to include the device identification and management authority identification in the certificate distribution application when generating the second key pair; an encryption module 303, which is used to encrypt the certificate distribution application with the first public key when generating the second key pair, and send the encrypted certificate distribution application and the second public key in the second key pair to the certificate distribution end, the certificate distribution end is used to decrypt the encrypted certificate distribution application with the first private key in the first key pair, distribute the digital certificate of the certificate distribution application, and encrypt the digital certificate with the second public key; a decryption module 304, which is used to receive the encrypted digital certificate, and use the second private key in the second key pair to decrypt the encrypted digital certificate.

[0073] In some embodiments of the present application, the acquisition module 301 is specifically used to: obtain the input login information of the user who installs the gateway device and the registration information of the gateway device; perform authority authentication on the user who installs the gateway device based on the login information to determine whether the user has installation authority; after the user has installation authority, the registration information is aggregated to obtain a device identifier.

[0074] In some embodiments of the present application, the certificate distribution end includes a registration authentication server and a certificate distribution server, and the acquisition module 301 is specifically used to: send a device identification to the registration authentication server, so that the registration authentication server signs the device identification, and synchronizes the device identification signature to the certificate distribution server; receive the device identification signature and the first public key in the first key pair from the registration authentication server.

[0075] In some embodiments of the present application, the certificate distribution end also includes a certificate generation server, and the encryption module 303 is specifically used to: send the encrypted certificate distribution application and the second public key in the second key pair to the certificate distribution server, the certificate distribution server is used to verify the encrypted certificate distribution application, and after the certificate distribution application is verified, send the encrypted certificate distribution application to the certificate generation server, the certificate generation server is used to generate a digital certificate for the certificate distribution application, and use the second public key to encrypt the digital certificate, and return the encrypted digital certificate to the gateway device through the certificate distribution server.

[0076] In some embodiments of the present application, a verification module (not shown in the figure) is used to: obtain a first private key from a certificate generation server, and use the first private key to decrypt the encrypted certificate distribution application to obtain a device identification; verify the device identification signature to determine whether the device identification obtained by verification is the same as the device identification; when the device identification obtained by verification is the same as the device identification, and the device identification of the gateway device has been registered, determine that the verification of the certificate distribution application has passed.

[0077] In some embodiments of the present application, the encryption module 303 is specifically used to: use the first private key in the first key pair to decrypt the encrypted certificate distribution application to obtain the device identification and management authority identification in the certificate distribution application; verify the legitimacy of the management authority identification, and after the legitimacy verification is passed, fill in the device identification and management authority identification into the preset certificate template to obtain the digital certificate of the certificate distribution application.

[0078] In addition, the technical solutions of the above-mentioned embodiments of the present application can be combined with each other and are not limited here.

[0079] According to the certificate distribution device of the embodiment of the present application, when the digital certificate is not installed in the gateway device, the device identification and management authority identification of the gateway device are obtained to generate a certificate distribution application, and the certificate distribution application is encrypted by the first public key and sent to the certificate distribution end, so that the certificate distribution end decrypts the encrypted certificate distribution application by the first private key to generate a digital certificate, and encrypts the digital certificate by the second public key of the gateway device, and then the gateway device can decrypt the encrypted digital certificate by the second private key, thereby combining user conditions while ensuring the security of the digital certificate delivery process, so that the gateway device can provide a valid digital certificate when leaving the factory, ensuring the installation and deployment flexibility of the gateway device.

[0080] The certificate distribution device 300 of this embodiment is used to implement the corresponding certificate distribution methods in the aforementioned multiple method embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here. In addition, the functional implementation of each module in the certificate distribution device 300 of this embodiment can refer to the description of the corresponding parts in the aforementioned method embodiments, which will not be repeated here.

[0081] Figure 4 FIG. 1 is a structural block diagram of a certificate distribution system according to an embodiment of the present application. Figure 4 As shown, the certificate distribution system 400 includes: a gateway device 401 and a certificate distribution terminal 402 according to any of the above embodiments, and the certificate distribution terminal 402 includes a registration authentication server 4021, a certificate distribution server 4022 and a certificate generation server 4023.

[0082] According to the certificate distribution system of the embodiment of the present application, when the digital certificate is not installed in the gateway device, the device identification and management authority identification of the gateway device are obtained to generate a certificate distribution application, and the certificate distribution application is encrypted by the first public key and sent to the certificate distribution end, so that the certificate distribution end decrypts the encrypted certificate distribution application by the first private key to generate a digital certificate, and encrypts the digital certificate by the second public key of the gateway device, and then the gateway device can decrypt the encrypted digital certificate by the second private key, thereby combining user conditions while ensuring the security of the digital certificate delivery process, so that the gateway device can provide a valid digital certificate when leaving the factory, ensuring the installation and deployment flexibility of the gateway device.

[0083] Figure 5 This is a structural block diagram of an electronic device according to an embodiment of the present application. The specific embodiment of the present application does not limit the specific implementation of the electronic device.

[0084] like Figure 5As shown, the electronic device 500 may include: a processor 502, a memory 503, a communication interface 504 and a communication bus 505, wherein the processor 502, the memory 503 and the communication interface 504 communicate with each other via the communication bus 505; the memory 503 is used to store at least one executable instruction, and the executable instruction enables the processor 502 to perform operations corresponding to the certificate distribution method of any of the above-mentioned embodiments.

[0085] The processor 502 may be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application. The one or more processors included in the smart device may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0086] The memory 503 is used to store programs, and may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0087] According to the electronic device of the embodiment of the present application, when the digital certificate is not installed in the gateway device, the device identification and management authority identification of the gateway device are obtained to generate a certificate distribution application, and the certificate distribution application is encrypted by the first public key and sent to the certificate distribution end, so that the certificate distribution end decrypts the encrypted certificate distribution application by the first private key to generate a digital certificate, and encrypts the digital certificate by the second public key of the gateway device, and then the gateway device can decrypt the encrypted digital certificate by the second private key, thereby combining user conditions while ensuring the security of the digital certificate delivery process, so that the gateway device can provide a valid digital certificate when leaving the factory, ensuring the installation and deployment flexibility of the gateway device.

[0088] An embodiment of the present application further provides a computer storage medium on which a computer program is stored. When the program is executed by a processor, the certificate distribution method of any of the above embodiments is implemented.

[0089] According to the computer storage medium of the embodiment of the present application, when the digital certificate is not installed in the gateway device, the device identification and management authority identification of the gateway device are obtained to generate a certificate distribution application, and the certificate distribution application is encrypted by the first public key and sent to the certificate distribution end, so that the certificate distribution end decrypts the encrypted certificate distribution application by the first private key to generate a digital certificate, and encrypts the digital certificate by the second public key of the gateway device, and then the gateway device can decrypt the encrypted digital certificate by the second private key, thereby combining user conditions while ensuring the security of the digital certificate delivery process, so that the gateway device can provide a valid digital certificate when leaving the factory, ensuring the installation and deployment flexibility of the gateway device.

[0090] It should be pointed out that, according to the needs of implementation, the various components / steps described in the embodiments of the present application can be split into more components / steps, or two or more components / steps or partial operations of components / steps can be combined into new components / steps to achieve the purpose of the embodiments of the present application.

[0091] The above-mentioned method according to the embodiment of the present application can be implemented in hardware, firmware, or implemented as software or computer code that can be stored in a recording medium (such as a CD ROM, RAM, floppy disk, hard disk or magneto-optical disk), or implemented as a computer code originally stored in a remote recording medium or a non-temporary machine-readable medium downloaded through a network and to be stored in a local recording medium, so that the method described herein can be stored in such software processing on a recording medium using a general-purpose computer, a dedicated processor or programmable or dedicated hardware (such as an ASIC or FPGA). It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component (e.g., RAM, ROM, flash memory, etc.) that can store or receive software or computer code, and when the software or computer code is accessed and executed by a computer, a processor or hardware, the certificate distribution method described herein is implemented. In addition, when a general-purpose computer accesses the code for implementing the certificate distribution method shown here, the execution of the code converts the general-purpose computer into a dedicated computer for executing the certificate distribution method shown here.

[0092] Those of ordinary skill in the art will appreciate that the units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the embodiments of the present application.

[0093] The above implementation methods are only used to illustrate the embodiments of the present application, and are not intended to limit the embodiments of the present application. Ordinary technicians in the relevant technical field can make various changes and modifications without departing from the spirit and scope of the embodiments of the present application. Therefore, all equivalent technical solutions also belong to the scope of the embodiments of the present application, and the scope of patent protection of the embodiments of the present application should be defined by the claims. The systems, devices or modules described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions.

Claims

1. A certificate distribution method, characterized in that: Applied to a gateway device, the method comprises: When no digital certificate is pre-stored in the gateway device, obtaining a device identifier and a management authority identifier of the gateway device, and obtaining a first public key in the first key pair from a certificate distribution end; While generating the second key pair, including the device identifier and the management authority identifier in a certificate distribution application; When generating the second key pair, the certificate distribution application is encrypted using the first public key, and the encrypted certificate distribution application and the second public key in the second key pair are sent to the certificate distribution terminal, and the certificate distribution terminal is used to decrypt the encrypted certificate distribution application using the first private key in the first key pair, distribute the digital certificate of the certificate distribution application, and encrypt the digital certificate using the second public key; An encrypted digital certificate is received, and the encrypted digital certificate is decrypted using the second private key in the second key pair.

2. The certificate distribution method according to claim 1, characterized in that: When no digital certificate is pre-stored in the gateway device, obtaining a device identification of the gateway device includes: Obtaining input login information of a user who installed the gateway device and registration information of the gateway device; Performing authority authentication on the user who installs the gateway device based on the login information to determine whether the user has installation authority; After the user has the installation authority, the registration information is aggregated to obtain the device identification.

3. The certificate distribution method according to claim 1, characterized in that: The certificate distribution end includes a registration authentication server and a certificate distribution server, wherein obtaining a first public key in a first key pair from the certificate distribution end includes: Sending the device identification to the registration and authentication server, so that the registration and authentication server signs the device identification, and synchronizing the device identification signature to the certificate distribution server; The device identification signature and a first public key in a first key pair are received from the registration authentication server.

4. The certificate distribution method according to claim 3, characterized in that: The certificate distribution end also includes a certificate generation server, wherein the encrypted certificate distribution application and the second public key in the second key pair are sent to the certificate distribution end, the certificate distribution end is used to use the first private key in the first key pair to decrypt the encrypted certificate distribution application, distribute the digital certificate of the certificate distribution application, and use the second public key to encrypt the digital certificate, including: The encrypted certificate distribution application and the second public key in the second key pair are sent to the certificate distribution server, the certificate distribution server is used to verify the encrypted certificate distribution application, and after the certificate distribution application is verified, the encrypted certificate distribution application is sent to the certificate generation server, the certificate generation server is used to generate a digital certificate for the certificate distribution application, and use the second public key to encrypt the digital certificate, and return the encrypted digital certificate to the gateway device through the certificate distribution server.

5. The certificate distribution method according to claim 4, characterized in that: Verify the encrypted certificate distribution request, including: Obtaining the first private key from the certificate generation server, and using the first private key to decrypt the encrypted certificate distribution application to obtain the device identification; Verifying the signature of the device identification to determine whether the device identification obtained by the verification is the same as the device identification; When the device identification obtained by the signature verification is the same as the device identification, and the device identification of the gateway device has been registered, it is determined that the verification of the certificate distribution application has passed.

6. The certificate distribution method according to claim 4, characterized in that: Decrypting the encrypted certificate distribution application using the first private key in the first key pair and distributing the digital certificate of the certificate distribution application includes: Decrypting the encrypted certificate distribution application using the first private key in the first key pair to obtain the device identifier and the management authority identifier in the certificate distribution application; The management authority identifier is subjected to a legality verification, and after the legality verification is passed, the device identifier and the management authority identifier are filled into a preset certificate template to obtain a digital certificate for the certificate distribution application.

7. A certificate distribution device, characterized in that: include: An acquisition module, configured to acquire a device identifier and a management authority identifier of the gateway device when no digital certificate is pre-stored in the gateway device, and to acquire a first public key in a first key pair from a certificate distribution terminal; A generating module, configured to include the device identifier and the management authority identifier in a certificate distribution application while generating a second key pair; an encryption module, configured to, when generating the second key pair, encrypt the certificate distribution application using the first public key, and send the encrypted certificate distribution application and the second public key in the second key pair to the certificate distribution terminal, wherein the certificate distribution terminal is configured to decrypt the encrypted certificate distribution application using the first private key in the first key pair, distribute a digital certificate of the certificate distribution application, and encrypt the digital certificate using the second public key; The decryption module is used to receive the encrypted digital certificate and use the second private key in the second key pair to decrypt the encrypted digital certificate.

8. A certificate distribution system, characterized in that: include: According to the gateway device and the certificate distribution terminal according to any one of claims 1-6, the certificate distribution terminal includes a registration authentication server, a certificate distribution server and a certificate generation server.

9. An electronic device, comprising: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform operations corresponding to the certificate distribution method according to any one of claims 1 to 6.

10. A computer storage medium having a computer program stored thereon, wherein when the program is executed by a processor, the certificate distribution method according to any one of claims 1 to 6 is implemented.

Images