Method, system and device for applying certificates in batches and readable medium

Abstract

The invention provides a method, a system and equipment for applying certificates in batches and a readable medium. The method comprises the following steps: acquiring at least two public keys which need to apply for certificates; obtaining certificate application data respectively corresponding to the at least two public keys; generating a request data packet for applying certificates in batches according to the certificate application data corresponding to the at least two public keys; and generating a certificate batch application request message carrying the request data packet, and sending the certificate batch application request message to a certificate server. The method is used for realizing batch application of certificates.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to a method, system, device and readable medium for batch application of certificates. Background Art

[0002] When mobile terminals communicate with each other or with management platforms, the requirements for secure communication are getting higher and higher. Most application interactions require secure communication based on certificate authentication. Therefore, various applications will have more and more demands for the generation and issuance of certificates. In addition, there are scenarios where multiple certificates (multiple pairs of public and private keys) are required for data interaction at the same time. For example, in vehicle-to-vehicle wireless communication technology (vehicle to X, V2X) services, multiple pairs of public and private keys are required for data communication transmission. This requires terminal devices to be able to obtain certificates quickly and securely. Summary of the invention

[0003] The embodiments of the present disclosure provide a method, system, device and readable medium for batch application of certificates.

[0004] A first aspect of an embodiment of the present disclosure provides a method for batch applying for certificates, which is applied to a terminal, and the method includes:

[0005] Obtain at least two public keys required to apply for a certificate;

[0006] Obtaining certificate application data corresponding to each of the at least two public keys;

[0007] Generate a request data packet for batch certificate application according to the certificate application data corresponding to each of the at least two public keys;

[0008] Generate a batch certificate application request message carrying the request data packet, and send the batch certificate application request message to a certificate server.

[0009] A second aspect of the present disclosure provides a method for batch applying for certificates, which is applied to a certificate server, and includes:

[0010] Receiving certificate batch application request message sent by the terminal;

[0011] Parsing the certificate batch application request message to obtain a request data packet for batch certificate application, and obtaining certificate application data corresponding to at least two public keys from the request data packet;

[0012] Determining the certificates corresponding to the at least two public keys respectively according to the certificate application data corresponding to the at least two public keys respectively;

[0013] A certificate batch release response message is generated and returned to the terminal, wherein the certificate batch release response message carries the certificates corresponding to the at least two public keys.

[0014] A third aspect of the disclosed embodiment provides a system for batch application of certificates, including:

[0015] The terminal is used to obtain at least two public keys for applying for certificates, obtain certificate application data corresponding to each of the at least two public keys, generate a request data packet for batch application of certificates according to the certificate application data corresponding to each of the at least two public keys, generate a certificate batch application request message carrying the request data packet, and send the certificate batch application request message to a certificate server;

[0016] A certificate server is used to receive a certificate batch application request message sent by a terminal, parse the certificate batch application request message, obtain a request data packet for batch application for certificates, and obtain certificate application data corresponding to at least two public keys from the request data packet, determine the certificates corresponding to the at least two public keys according to the certificate application data corresponding to the at least two public keys, generate a certificate batch release response message and return it to the terminal, wherein the certificate batch release response message carries the certificates corresponding to the at least two public keys.

[0017] A fourth aspect of the present disclosure provides an electronic device, including:

[0018] at least one processor;

[0019] A memory having one or more programs stored thereon, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method according to the first aspect;

[0020] At least one I / O interface is connected between the processor and the memory and is configured to implement information interaction between the processor and the memory.

[0021] A fifth aspect of the embodiments of the present disclosure provides a computer-readable medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the method described in the first aspect.

[0022] The embodiments of the present disclosure have at least the following advantages:

[0023] The terminal obtains at least two public keys for applying for certificates, generates a request data packet for batch applying for certificates based on the certificate application data corresponding to the at least two public keys, generates a certificate batch application request message carrying the request data packet, and sends the certificate batch application request message to the certificate server, so that the server can process multiple certificate applications in batches, thereby avoiding the method of applying for certificates for only one public key at a time, and the waste of resources caused by the need to execute the certificate application process multiple times when multiple certificates need to be applied for, thereby improving the application efficiency of multiple certificates. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A schematic diagram of a method for batch acquiring certificates applied to a terminal provided in an embodiment of the present disclosure;

[0025] Figure 2 A schematic diagram of a method flow for batch applying for certificates applied to a certificate server provided in an embodiment of the present disclosure;

[0026] Figure 3 A schematic diagram of a system architecture for batch application of certificates provided in an embodiment of the present disclosure;

[0027] Figure 4 A schematic diagram of another system architecture for batch application of certificates provided in an embodiment of the present disclosure;

[0028] Figure 5 A schematic diagram of a process of batch application for certificates by a terminal and a certificate server in an interactive manner provided in an embodiment of the present disclosure;

[0029] Figure 6 A schematic diagram of the structure of a device for batch application of certificates for terminals provided in an embodiment of the present disclosure;

[0030] Figure 7 A schematic diagram of the structure of a device for batch applying for certificates applied to a certificate server provided in an embodiment of the present disclosure;

[0031] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0032] The specific implementation of the present disclosure is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the embodiments of the present disclosure, and is not used to limit the embodiments of the present disclosure.

[0033] As used in embodiments of the present disclosure, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0034] The terms used in the embodiments of the present disclosure are only used to describe specific embodiments and are not intended to limit the embodiments of the present disclosure. As used in the embodiments of the present disclosure, the singular forms "a", "an" and "the" are also intended to include plural forms, unless the context clearly indicates otherwise.

[0035] When the terms "including" and / or "made of..." are used in the embodiments of the present disclosure, it specifies the existence of the stated features, wholes, steps, operations, elements and / or components, but does not exclude the existence or addition of one or more other features, wholes, steps, operations, elements, components and / or groups thereof.

[0036] Unless otherwise defined, all terms (including technical and scientific terms) used in the embodiments of the present disclosure have the same meanings as those commonly understood by those of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having meanings consistent with their meanings in the context of the relevant art and the embodiments of the present disclosure, and will not be interpreted as having idealized or overly formal meanings unless the embodiments of the present disclosure are clearly defined as such.

[0037] In order to improve the security of data interaction in mobile Internet networks, terminals need to use certificates and their public and private keys for identity authentication, data encryption, and signature transmission in many cases. In mainstream public key infrastructure (PKI) certificate application and management protocols (such as the latest certificate application protocol EST (Enrollment over Secure Transport) and the most widely used Simple Certificate Enrollment Protocol (SCEP)), it is currently defined that one registration request only supports EST clients to apply for one certificate file.

[0038] In order to improve the efficiency of certificate acquisition, an embodiment of the present disclosure provides a method for applying for certificates in batches, which can enable terminals to quickly and securely obtain certificates in batches.

[0039] Figure 1 What is shown is a method for batch acquisition of certificates applied to a terminal provided by an embodiment of the present disclosure. The terminal may be a terminal of any form, such as a mobile terminal. The terminal uses a business model of secure communication based on certificate authentication, including short-range communication and long-range communication, such as a mobile phone APP managing a local terminal device and a remote server managing a remote device, wherein the communication is based on a security protocol and requires the use of a certificate for security verification.

[0040] The method mainly includes the following steps:

[0041] Step 101: The terminal obtains at least two public keys required for applying for a certificate.

[0042] In some embodiments, the terminal generates multiple pairs of public and private key pairs according to the required encryption method, and obtains at least two public keys required to apply for a certificate from the multiple pairs of public and private key pairs.

[0043] Step 102: The terminal obtains certificate application data corresponding to each of the at least two public keys.

[0044] In some embodiments, the terminal obtains certificate application data corresponding to each of the at least two public keys, including: generating certificate application data corresponding to each of the at least two public keys in accordance with the certificate request syntax standard (Certification Request Standard) included in the Public Key Cryptography Standards (PKCS), wherein the certificate application data includes the corresponding public key.

[0045] The certificate application data corresponds to the public key one by one, that is, one public key generates one certificate application data.

[0046] Among them, the public key cryptography standard includes the certificate request syntax standard, namely PKCS10.

[0047] In some embodiments, the certificate application data includes not only the corresponding public key but also the device information of the terminal, where the device information includes the device manufacturer information, the device serial number, etc., so that the certificate server can verify the legitimacy of the terminal.

[0048] Step 103: The terminal generates a request data packet for batch application for certificates according to the certificate application data corresponding to the at least two public keys.

[0049] In some embodiments, the terminal generates a request data packet for batch application of certificates based on the certificate application data corresponding to each of the at least two public keys, including: using a first merging and packaging method to merge and package the certificate application data corresponding to each of the at least two public keys into one data packet as a request data packet for batch application of certificates.

[0050] Among them, the first merging and packaging method can choose a public merging and packaging method, including but not limited to: zip, tar and other methods; or a private merging and packaging method can be used to improve security, such as defining a vendor-private merging and packaging protocol vendordefine, and defining a set of magic numbers in the file header to represent the manufacturer. The file format after merging and packaging is: magic number + number of certificates + name and length of each PKCS10 certificate application data + content of each PKCS10 certificate application data.

[0051] Step 104: The terminal generates a batch certificate application request message carrying the request data packet, and sends the batch certificate application request message to the certificate server.

[0052] In some embodiments, the terminal generates a certificate batch application request message carrying the request data packet, including: obtaining a first uniform resource locator (URI) for batch application of certificates; obtaining a first merging and packaging method used to generate the request data packet; and generating the certificate batch application request message based on the uniform resource locator, the first merging and packaging method, and the request data packet.

[0053] In some embodiments, after executing the steps of generating a certificate batch application request message carrying the batch certificate application request and sending the certificate batch application request message to the certificate server, the method also includes: the terminal receives a certificate batch release response message returned by the certificate server; and parses the certificate batch release response message to obtain the certificates corresponding to each of the at least two public keys.

[0054] In some embodiments, the terminal parses the certificate batch release response message to obtain the certificates corresponding to the at least two public keys, including: obtaining a second uniform resource locator from the certificate batch release response message; when the second uniform resource locator is a uniform resource locator for batch release of certificates, obtaining a response data packet for batch release of certificates from the certificate batch release response message, and adopting a second merging and packaging method; adopting the second merging and packaging method to parse the response data packet to obtain the certificates corresponding to the at least two public keys.

[0055] The second merging and packaging method may be a public merging and packaging method, including but not limited to zip, tar, etc.; a private merging and packaging method may also be used.

[0056] In some embodiments, the certificate corresponding to the public key obtained by parsing the response data packet is a certificate in the PKCS 7 format, and the certificate in the PKCS 7 format is converted into an X.509 certificate, that is, a standard certificate.

[0057] In the disclosed embodiment, the terminal obtains at least two public keys for applying for certificates, uses the certificate application data corresponding to each of the at least two public keys to generate a request data packet for batch applying for certificates, generates a certificate batch application request message carrying the request data packet, and sends the certificate batch application request message to a certificate server, so that the server can process multiple certificate applications in batches, thereby avoiding the method of applying for certificates for only one public key at a time, and the waste of resources caused by the need to execute the certificate application process multiple times when multiple certificates need to be applied for, thereby improving the application efficiency of multiple certificates.

[0058] Correspondingly, Figure 2 The method for batch applying for certificates applied to a certificate server provided by an embodiment of the present disclosure mainly includes the following steps:

[0059] Step 201: The certificate server receives a batch certificate application request message sent by a terminal.

[0060] Step 202: The certificate server parses the batch certificate application request message to obtain a request data packet for batch certificate application, and obtains certificate application data corresponding to at least two public keys from the request data packet.

[0061] In some embodiments, the certificate server parses the certificate batch application request message, obtains a request data packet for batch application of certificates, and obtains certificate application data corresponding to at least two public keys from the request data packet, including: obtaining a first uniform resource locator from the certificate batch application request message; when the first uniform resource locator is a uniform resource locator for batch application of certificates, obtaining a request data packet for batch application of certificates from the certificate batch application request message, and adopting a first merging and packaging method; adopting the first merging and packaging method to parse the request data packet to obtain certificate application data corresponding to at least two public keys.

[0062] In an exemplary embodiment, the certificate server receives a certificate batch application request message sent by a terminal using Hypertext Transfer Protocol (HTTP).

[0063] In an exemplary embodiment, the certificate server checks whether the URI in the HTTP message header of the certificate check batch application request message is used for batch certificate application, for example, checks whether the URI is / enrollmulticerts. If so, continues to check whether it carries the first merge packaging method. If so, parses to obtain the first merge packaging method, such as tar, zip, vendordefine, and parses multiple PKCS10 certificate application data according to the first merge packaging method.

[0064] Step 203: The certificate server determines the certificates corresponding to the at least two public keys respectively according to the certificate application data corresponding to the at least two public keys respectively.

[0065] In some embodiments, the certificate server determines the certificate corresponding to each of the at least two public keys based on the certificate application data corresponding to each of the at least two public keys, including: determining the standard certificate corresponding to each of the at least two public keys based on the certificate application data corresponding to each of the at least two public keys; using the cryptographic message syntax standard included in the public key cryptography standard to convert the certificate corresponding to each of the at least two public keys into a certificate in an agreed format.

[0066] In an exemplary embodiment, the certificate application data includes a public key; the certificate server generates a corresponding standard certificate, such as an X.509 certificate, according to the certificate application data, the root certificate, and the private key used to issue the certificate.

[0067] In an exemplary embodiment, the certificate application data includes not only the public key but also the device information of the terminal; the certificate server verifies the legitimacy of the device information in the certificate application data, and after the verification is passed, executes the process of generating a standard certificate, thereby ensuring the security of certificate issuance.

[0068] Among them, there is a one-to-one correspondence between the public key, certificate application data, and standard certificate.

[0069] Step 204: The certificate server generates a certificate batch publishing response message and returns it to the terminal. The certificate batch publishing response message carries the certificates corresponding to the at least two public keys.

[0070] In some embodiments, the certificate server generates a certificate batch release response message, including: using the second merging and packaging method to merge and package the certificates corresponding to the at least two public keys into one data packet as a response data packet for batch release of certificates; generating a certificate batch release response message carrying the response data packet.

[0071] The first merging and packaging method is independent of the second merging and packaging method. The second merging and packaging method may be a public merging and packaging method, including but not limited to: zip, tar, etc.; or a private merging and packaging method may be used.

[0072] In some embodiments, before executing the step of merging and packaging the certificates corresponding to the at least two public keys into one data packet using the second merging and packaging method, the certificates corresponding to the at least two public keys are converted into certificates in PKCS 7 format to facilitate transmission of the certificate to the terminal.

[0073] In some embodiments, the certificate server generates a certificate batch release response message carrying the response data packet, including: generating a second uniform resource locator for certificate batch release; obtaining a merging and packaging method used to generate the response data packet; and generating the certificate batch release response message according to the second uniform resource locator, the second merging and packaging method, and the response data packet.

[0074] In an exemplary embodiment, the certificate server uses the HTTP protocol to send a certificate batch release response message.

[0075] In an exemplary embodiment, the certificate server carries the defined second URI for batch certificate issuance in the batch certificate issuance response message, and carries the second merging and packaging method in the HTTP message header.

[0076] In the disclosed embodiment, a certificate server receives a certificate batch application request message sent by a terminal, parses the certificate batch application request message, obtains a request data packet for batch applying for certificates, and obtains certificate application data corresponding to at least two public keys from the request data packet; based on the certificate application data corresponding to the at least two public keys, determines the certificates corresponding to the at least two public keys; generates a certificate batch release response message and returns it to the terminal; the certificate batch release response message carries the certificates corresponding to the at least two public keys, thereby enabling multiple certificates to be generated at one time and released to the terminal at one time, thereby avoiding the waste of resources caused by only being able to release one certificate in one release process, improving the efficiency of certificate release, and realizing batch release of certificates.

[0077] Correspondingly, the embodiment of the present disclosure also provides a system for batch application of certificates, such as Figure 3 As shown, the system mainly includes:

[0078] Terminal 301 is used to obtain at least two public keys for applying for certificates, obtain certificate application data corresponding to each of the at least two public keys, generate a request data packet for batch application of certificates according to the certificate application data corresponding to each of the at least two public keys, generate a certificate batch application request message carrying the request data packet, and send the certificate batch application request message to a certificate server;

[0079] The certificate server 302 is used to receive a certificate batch application request message sent by a terminal, parse the certificate batch application request message, obtain a request data packet for batch application for certificates, and obtain certificate application data corresponding to at least two public keys from the request data packet, determine the certificates corresponding to the at least two public keys according to the certificate application data corresponding to the at least two public keys, generate a certificate batch release response message and return it to the terminal, the certificate batch release response message carries the certificates corresponding to the at least two public keys.

[0080] In an exemplary embodiment, Figure 4 The diagram shows another system architecture for batch certificate application. In the system architecture, the certificate server includes a registration server (also called an RA server) and a certificate issuing server (also called a CA server); the terminal includes a batch certificate application extension program and a certificate application agent program. It should be noted that the structure of the certificate server and the terminal in the system architecture is divided according to function, and the RA server and the CA server can be the same physical server or different physical servers.

[0081] Among them, the RA server provides an interface between the certificate application agent and the CA server, communicates with the terminal over the network, receives batch certificate application request messages, generates and issues certificates, and sends the certificates to the terminal. The RA server obtains and authenticates the identity of the terminal and submits a certificate request to the CA server. The RA server mainly completes the functions of collecting terminal information and confirming the terminal identity.

[0082] The CA server is the trust foundation of PKI and is used to manage the entire life cycle of the public key. Its functions include issuing certificates, specifying the validity period of certificates, and ensuring that certificates can be revoked when necessary by publishing a certificate revocation list (CRL).

[0083] Among them, the certificate application agent is responsible for constructing a batch certificate application request message, sending the batch certificate application request message to the certificate server, and receiving the batch certificate issuance response message returned by the certificate server.

[0084] Among them, the batch application certificate extension program is responsible for generating multiple pairs of public and private key pairs, and generating multiple PKCS 10 certificate application data based on the public keys, packaging these certificate application data into request data packets using a public or private combined packaging method, and building a certificate batch application request message based on this; parsing the certificate batch release response message, parsing multiple PKCS 7 format certificates from the certificate batch release response message according to a public or private combined packaging method, and then converting multiple X.509 format standard certificates to form a certificate private key pair with the corresponding private key, and providing it to the corresponding business program for use.

[0085] In an exemplary embodiment, based on Figure 4 The system architecture shown in the figure shows the process of batch certificate application between the terminal and the certificate server. Figure 5 As shown, it mainly includes the following steps:

[0086] Step 501: The batch certificate application extension program of the terminal generates multiple public and private key pairs according to the required encryption method.

[0087] Step 502 , the batch certificate application extension program of the terminal generates multiple PKCS10 certificate application data in a one-to-one correspondence based on the public keys in the multiple public-private key pairs generated in step 501 .

[0088] In step 503, the batch certificate application extension program of the terminal merges and packages the multiple PKCS10 certificate application data generated in step 502 into a request data packet. The merging and packaging method can adopt a public merging and packaging method such as zip, tar, etc., or a private merging and packaging protocol can be adopted to improve security. For example, a manufacturer's private merging and packaging protocol vendordefine is defined, and a group of magic number code manufacturers are defined in the file header. After the magic number is the number of certificates, the name and length of each PKCS10 certificate application data, and then the content of each PKCS10 certificate application data.

[0089] Step 504, the batch certificate application extension program of the terminal adds a definition of the batch certificate application request in the URI of the request data packet, such as / enrollmulticerts, and adds a new HTTP header to carry the combined packaging method MultiCerts-Pack-Type used to generate the request data packet, such as tar, zip, vendordefine, and then carries the request data packet obtained by combining and packaging multiple PKCS10 certificate application data to form a batch certificate application request message. An example of a batch certificate application request message is as follows:

[0090] "POST / .well-known / est / enrollmulticerts HTTP / 1.1

[0091] Host:www.pkitest.com-------------Host name

[0092] Content-Type:application / pkcs10------------Content type

[0093] MultiCerts-Pack-Type:vendordefine-----------The protocol used for the combined package, here is a custom protocol

[0094] Content-Length: 1532----------The length of the request message

[0095] ABCDEFG-----------------The content of the request data packet, in PKCS10 format

[0096] ..."

[0097] Step 505: The certificate application agent of the terminal sends a batch certificate application request message to the certificate server.

[0098] Step 506, after receiving the certificate batch application request message, the certificate server checks whether the URI in the HTTP header is used for batch certificate application, such as / enrollmulticerts. If so, it checks whether it carries the merged packaging method MultiCerts-Pack-Type for generating the request data packet. If so, it parses out the specific merged packaging method, such as tar, zip, vendordefine, and parses out multiple PKCS10 certificate application data based on the merged packaging method.

[0099] Step 507: The certificate server generates corresponding standard certificates, such as X.509 certificates, one by one according to the multiple PKCS10 certificate application data using the root certificate and the private key used for certificate issuance.

[0100] In step 508, the certificate server converts multiple standard certificates, such as X.509 certificates, into multiple PKCS 7 format certificates.

[0101] Step 509: The certificate server selects a merging and packaging method, and merges and packages the data of multiple PKCS 7 format certificates according to the selected merging and packaging method to obtain a response data packet.

[0102] Step 510, the certificate server adds a new definition of batch certificate release response in the URI of the certificate batch release response message, and adds a new HTTP header to carry the combined packaging method MultiCerts-Pack-Type of the response data packet of the batch certificate release, such as tar, zip, vendordefine, and then carries the response data packet obtained by combining and packaging multiple certificates in PKCS 7 format to form a certificate batch release response message. An example of a certificate batch release response message is as follows:

[0103] HTTP / 1.1 200 OK

[0104] Content-Transfer-Encoding: base64--------------Encoding format

[0105] Content-Type:application / pkcs7-mime;smime-type=certs-only------------Format content

[0106] MultiCerts-Pack-Type:vendordefine--------------The protocol used for the combined package, here is a custom protocol

[0107] Content-Length:2008

[0108] ABCDEFG----------------Contents of the response packet

[0109] ..."

[0110] Step 511: The certificate server sends a certificate batch publishing response message to the certificate application agent of the terminal.

[0111] Step 512: The certificate application agent of the terminal receives the certificate batch issuance response message.

[0112] Step 513, the batch certificate application extension program of the terminal checks whether the HTTP message header carries the combined packaging method MultiCerts-Pack-Type of the response data packet of the batch certificate release. If yes, it parses out the specific combined packaging method, such as tar, zip, vendordefine, and parses out multiple certificates in PKCS 7 format according to the combined packaging method.

[0113] In step 514, the batch certificate application extension program of the terminal converts the multiple PKCS 7 format certificates into multiple standard certificates, such as X.509 certificates.

[0114] Step 515, the terminal's batch certificate extension program forms a certificate-private key pair by corresponding multiple standard certificates, such as X.509 certificates, to the private key in step 501, and provides it to each business module for use.

[0115] In the disclosed embodiment, the terminal obtains at least two public keys for applying for certificates, uses the certificate application data corresponding to each of the at least two public keys to generate a request data packet for batch applying for certificates, generates a certificate batch application request message carrying the request data packet, and sends the certificate batch application request message to a certificate server, so that the server can process multiple certificate applications in batches, thereby avoiding the method of applying for certificates for only one public key at a time, and the waste of resources caused by the need to execute the certificate application process multiple times when multiple certificates need to be applied for, thereby improving the application efficiency of multiple certificates.

[0116] The certificate server receives a certificate batch application request message sent by a terminal, parses the certificate batch application request message, obtains a request data packet for batch application of certificates, and obtains certificate application data corresponding to at least two public keys from the request data packet, determines the certificates corresponding to the at least two public keys according to the certificate application data corresponding to the at least two public keys, generates a certificate batch release response message and returns it to the terminal, the certificate batch release response message carries the certificates corresponding to the at least two public keys, so that multiple certificates can be generated at one time and released to the terminal at one time, thereby avoiding the waste of resources caused by only being able to release one certificate in one release process, improving the efficiency of certificate release, and realizing batch release of certificates.

[0117] Compared with the existing technology, the certificate application client (i.e., terminal) based on the EST or SCEP protocol sends multiple PKCS10 certificate application data to the certificate server in one certificate application request. The server issues multiple certificates in batches at one time based on the PKCS10 certificate application data. This technology can quickly and securely generate application certificates, improve the performance of module security authentication, and thus improve the security of users using the terminal.

[0118] The step division of the above various methods is only for clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the protection scope of the embodiments of the present disclosure. Adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the protection scope of the embodiments of the present disclosure.

[0119] The present disclosure provides an apparatus for batch application of certificates, which is applied to a terminal. For the specific implementation of the apparatus, reference may be made to the relevant description of the terminal in the method embodiment, which will not be repeated here. Figure 6 The schematic diagram of the structure of the device is shown, which mainly includes:

[0120] A first acquisition module 601 is used to acquire at least two public keys required to apply for a certificate;

[0121] The second acquisition module 602 is used to obtain the certificate application data corresponding to each of the at least two public keys;

[0122] A generating module 603, configured to generate a request data packet for batch applying for certificates according to the certificate application data corresponding to the at least two public keys;

[0123] The sending module 604 generates a batch certificate application request message carrying the request data packet, and sends the batch certificate application request message to the certificate server.

[0124] The present disclosure provides an apparatus for batch application of certificates, which is applied to a certificate server. The specific implementation of the apparatus can refer to the relevant description of the certificate server in the method embodiment, which will not be repeated here. Figure 7 The schematic diagram of the structure of the device is shown, which mainly includes:

[0125] The receiving module 701 is used to receive a certificate batch application request message sent by a terminal;

[0126] The parsing module 702 is used to parse the certificate batch application request message, obtain a request data packet for batch application of certificates, and obtain certificate application data corresponding to at least two public keys from the request data packet;

[0127] A determination module 703 is used to determine the certificates corresponding to the at least two public keys respectively according to the certificate application data corresponding to the at least two public keys respectively;

[0128] The sending module 704 is used to generate a certificate batch publishing response message and return it to the terminal, wherein the certificate batch publishing response message carries the certificates corresponding to the at least two public keys.

[0129] The functions or modules included in the device provided in the embodiments of the present disclosure can be used to execute the method described in the method embodiments. The specific implementation and technical effects thereof can be referred to the description of the method embodiments above, and will not be described again here for the sake of brevity.

[0130] It should be noted that all modules involved in this embodiment are logic modules. In practical applications, a logic unit may be a physical unit, or a part of a physical unit, or may be implemented as a combination of multiple physical units. In addition, in order to highlight the innovative part of the embodiment of the present disclosure, this embodiment does not introduce units that are not closely related to solving the technical problems raised by the embodiment of the present disclosure, but this does not mean that there are no other units in this embodiment.

[0131] Reference Figure 8 , an embodiment of the present disclosure provides an electronic device, comprising:

[0132] at least one processor 801;

[0133] A memory 802 having at least one program stored thereon, and when the at least one program is executed by the at least one processor, the at least one processor implements the above method;

[0134] At least one I / O interface 803 is connected between the processor and the memory and is configured to implement information exchange between the processor and the memory.

[0135] Among them, the processor 801 is a device with data processing capabilities, including but not limited to a central processing unit (CPU); the memory 802 is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory (FLASH); the I / O interface (read-write interface) 803 is connected between the processor 801 and the memory 802, and can realize information interaction between the processor 801 and the memory 802, including but not limited to a data bus (Bus), etc.

[0136] In some embodiments, the processor 801 , the memory 802 , and the I / O interface 803 are connected to each other via a bus, and further connected to other components of the computing device.

[0137] This embodiment further provides a computer-readable medium on which a computer program is stored. When the program is executed by a processor, the method provided in this embodiment is implemented. To avoid repeated description, the specific steps of the method are not repeated here.

[0138] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods applied for above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0139] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0140] Those skilled in the art will understand that although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features from different embodiments is meant to be within the scope of the present embodiment and to form different embodiments.

[0141] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the embodiments of the present disclosure, but the embodiments of the present disclosure are not limited thereto. For those of ordinary skill in the art, various modifications and improvements can be made without departing from the spirit and essence of the embodiments of the present disclosure, and these modifications and improvements are also considered to be within the protection scope of the embodiments of the present disclosure.

Claims

1. A method for applying for certificates in batches, characterized in that: Applied to a terminal, the method comprises: Obtain at least two public keys required to apply for a certificate; Obtaining certificate application data corresponding to each of the at least two public keys; Generate a request data packet for batch certificate application according to the certificate application data corresponding to each of the at least two public keys; Generate a batch certificate application request message carrying the request data packet, and send the batch certificate application request message to a certificate server.

2. The method according to claim 1, characterized in that The obtaining of certificate application data corresponding to each of the at least two public keys includes: According to the certificate request syntax standard included in the public key cryptography standard, certificate application data corresponding to each of the at least two public keys are generated, wherein the certificate application data includes the corresponding public key.

3. The method according to claim 1, characterized in that: The step of generating a request data packet for batch applying for certificates according to the certificate application data corresponding to each of the at least two public keys comprises: The first merging and packaging method is adopted to merge and package the certificate application data corresponding to the at least two public keys into one data packet as a request data packet for batch application for certificates.

4. The method according to claim 1, characterized in that The step of generating a batch certificate application request message carrying the request data packet includes: Obtaining a first uniform resource locator for batch application of certificates; Acquire a first merging and packaging method used to generate the request data packet; The certificate batch application request message is generated according to the uniform resource locator, the first merging and packaging mode, and the request data packet.

5. The method according to claim 1, characterized in that After executing the step of generating a batch certificate application request message carrying the batch certificate application request and sending the batch certificate application request message to the certificate server, the method further includes: Receiving a certificate batch issuance response message returned by the certificate server; The certificate batch release response message is parsed to obtain certificates corresponding to the at least two public keys.

6. The method according to claim 5, characterized in that The parsing of the certificate batch release response message to obtain the certificates corresponding to the at least two public keys respectively includes: Obtaining a second uniform resource locator from the certificate batch issuance response message; In the case where the second uniform resource locator is a uniform resource locator for batch issuing certificates, obtaining a response data packet for batch issuing certificates from the certificate batch issuing response message, and the second merging and packaging method adopted; The response data packet is parsed using the second merging and packaging method to obtain certificates corresponding to at least two public keys.

7. A method for applying for certificates in batches, characterized in that: Applied to a certificate server, the method comprises: Receiving certificate batch application request message sent by the terminal; Parsing the certificate batch application request message to obtain a request data packet for batch certificate application, and obtaining certificate application data corresponding to at least two public keys from the request data packet; Determining the certificates corresponding to the at least two public keys respectively according to the certificate application data corresponding to the at least two public keys respectively; A certificate batch release response message is generated and returned to the terminal, wherein the certificate batch release response message carries the certificates corresponding to the at least two public keys.

8. The method according to claim 7, characterized in that The step of parsing the batch certificate application request message to obtain a request data packet for batch certificate application, and obtaining certificate application data corresponding to at least two public keys from the request data packet includes: Obtaining a first uniform resource locator from the certificate batch application request message; In the case where the first uniform resource locator is a uniform resource locator for batch certificate application, obtaining a request data packet for batch certificate application from the batch certificate application request message, and adopting a first merging and packaging method; The request data packet is parsed using the first merging and packaging method to obtain certificate application data corresponding to at least two public keys.

9. The method according to claim 7, characterized in that: The generating of the certificate batch publishing response message includes: Adopting a second merging and packaging method, merging and packaging the certificates corresponding to the at least two public keys into one data packet as a response data packet for batch publishing of certificates; Generate a certificate batch release response message carrying the response data packet.

10. The method according to claim 9, characterized in that The generating of the certificate batch publishing response message carrying the response data packet includes: generating a second uniform resource locator for batch issuance of certificates; Obtaining a merging and packaging method used to generate the response data packet; The certificate batch release response message is generated according to the second uniform resource locator, the second merging and packaging mode, and the response data packet.

11. The method according to claim 7, characterized in that The step of determining the certificates corresponding to the at least two public keys respectively according to the certificate application data respectively corresponding to the at least two public keys comprises: Determining, according to the certificate application data corresponding to the at least two public keys, the standard certificates corresponding to the at least two public keys; The cryptographic message syntax standard included in the public key cryptographic standard is adopted to convert the certificates corresponding to the at least two public keys into certificates in an agreed format.

12. A system for batch application of certificates, characterized in that: include: The terminal is used to obtain at least two public keys for applying for certificates, obtain certificate application data corresponding to each of the at least two public keys, generate a request data packet for batch application of certificates according to the certificate application data corresponding to each of the at least two public keys, generate a certificate batch application request message carrying the request data packet, and send the certificate batch application request message to a certificate server; A certificate server is used to receive a certificate batch application request message sent by a terminal, parse the certificate batch application request message, obtain a request data packet for batch application for certificates, and obtain certificate application data corresponding to at least two public keys from the request data packet, determine the certificates corresponding to the at least two public keys according to the certificate application data corresponding to the at least two public keys, generate a certificate batch release response message and return it to the terminal, wherein the certificate batch release response message carries the certificates corresponding to the at least two public keys.

13. An electronic device, characterized in that: include: at least one processor; A memory having at least one program stored thereon, wherein when the at least one program is executed by the at least one processor, the at least one processor implements the method according to any one of claims 1 to 6 or implements the method according to any one of claims 7 to 11; At least one I / O interface is connected between the processor and the memory and is configured to implement information interaction between the processor and the memory.

14. A computer-readable medium having a computer program stored thereon, wherein when the program is executed by a processor, the program implements the method according to any one of claims 1 to 6 or the method according to any one of claims 7 to 11.

Images