Public key certificate updating method and device, terminal and storage medium

Abstract

The invention relates to a public key certificate updating method and device, a terminal and a storage medium. The method comprises the following steps: in response to successful establishment of a data service by the terminal or in response to digital signature information received by the terminal, confirming the state of a public key certificate of the terminal; and downloading and storing the latest public key certificate from the network side based on the state of the public key certificate. By the adoption of the method, a timer does not need to be set for downloading and updating the public key certificate through regular networking, network connection does not need to be established all the time to receive a public key certificate updating notification, and on the premise that standby power consumption of the terminal is not additionally increased, the terminal conducts digital signature verification on the digital signature message through the latest public key certificate all the time.

Description

Technical Field

[0001] The present application relates to the technical field of public key certificate update, and in particular to a method, device, terminal and storage medium for updating a public key certificate. Background Art

[0002] Public alarm refers to the alarm of natural disasters or man-made accidents that may cause loss of human life and property. When a public alarm event occurs, the public warning message released through cell broadcast technology is timely and accurate, which can effectively reduce the loss of life and property brought to the country and the people by public emergencies. According to the relevant security requirements of public alarm, the security mechanism should identify false alarm notifications.

[0003] The digital signature mechanism is a universal security technology. The introduction of this technology in cell broadcasting will provide integrity protection for alarm messages. The terminal uses a built-in or online updated public key certificate, and uses the public key certificate for digital signature verification (i.e., signature verification) when receiving cell broadcast messages. The notification message content is displayed only if the verification passes, and the notification message content is not displayed if the verification fails.

[0004] The cell broadcast message solution based on digital signatures needs to ensure that the terminal has the latest public key certificate. When the certificate center updates the public key certificate, the terminal needs to be updated synchronously. In the prior art, the methods that can be used include: Method 1, the terminal updates the public key certificate by updating the software version. When the certificate management center issues a new public key certificate, it notifies the terminal manufacturer, and the manufacturer issues a new software version to update the public key certificate; Method 2, establish a public key certificate server, and the terminal and the server establish an Internet push channel. When the public key certificate changes, the server pushes the new certificate to the terminal; Method 3, encapsulate the new public key certificate into a cell broadcast message, which is pushed directly to the terminal by the operator base station, and the terminal decodes and saves it. Similar methods also include the base station pushing a certificate update notification-type cell broadcast message, and then the terminal initiates the download of the updated certificate.

[0005] However, for method 1, when the public key certificate is updated, the terminal needs to update the software version synchronously and push it to the user. This method has the problem of untimely updates, and when the user does not update the software for some reason, the new certificate cannot be used to verify the message, so the public alarm message cannot be received. For method 2, a long connection needs to be established with the server. The terminal needs to create a background service to maintain communication with the server to receive certificate push, or regularly initiate polling to the service to update the certificate. Establishing a long connection with the server to update the certificate wastes the power consumption and resources of the terminal. For method 3, although this method allows the terminal to update the certificate, it is complex to implement and has many problems, such as: the base station cannot know whether the specific terminal has received the new certificate, and it is necessary to solve the problem of how to avoid repeated push; there is no way to ensure that the terminal receives the certificate update message first, and then receives the emergency broadcast message. When the certificate is updated, the terminal receives the emergency broadcast message first, and the verification cannot be passed, resulting in failure to receive the emergency message. Summary of the invention

[0006] Based on this, it is necessary to provide a public key certificate updating method, device, terminal and storage medium for at least one of the above-mentioned technical problems. There is no need to set a timer to regularly connect to the Internet to download and update the public key certificate, nor is there a need to establish a network connection to receive public key certificate update notifications. Without increasing the terminal's standby power consumption, the terminal can always use the latest public key certificate to verify the digital signature of the digital signature message.

[0007] According to a first aspect of certain exemplary embodiments of the present disclosure, a public key certificate updating method is provided, which is applied to a terminal, and the method includes: in response to the terminal successfully establishing a data service, or in response to the terminal receiving digital signature information, confirming the status of the public key certificate of the terminal; based on the status of the public key certificate, downloading and saving the latest public key certificate from the network side.

[0008] Optionally, in response to the terminal successfully establishing a data service, or in response to the terminal receiving digital signature information, confirming the status of the public key certificate in the terminal includes: in response to the terminal successfully establishing a data service, confirming the status of all or part of the first public key certificate, wherein the first public key certificate is a public key certificate corresponding to the identifier of the digital signature information supported by the terminal and requiring digital signature verification by the terminal.

[0009] Optionally, in response to the terminal successfully establishing a data service, or in response to the terminal receiving digital signature information, confirming the status of the public key certificate in the terminal includes: in response to the terminal receiving digital signature information, confirming the status of a second public key certificate, wherein the second public key certificate is a public key certificate corresponding to the identifier of the currently received digital signature message.

[0010] Optionally, downloading and saving the latest public key certificate from the network side based on the status of the public key certificate includes: determining whether a first public key certificate exists in the terminal; in response to the existence of the first public key certificate, determining whether the first public key certificate has expired; in response to the absence of the first public key certificate in the terminal, or in response to the first public key certificate having expired, downloading and saving the latest public key certificate corresponding to the first public key certificate from the network side.

[0011] Optionally, the downloading and saving of the latest public key certificate from the network side based on the status of the public key certificate includes: determining whether a second public key certificate exists in the terminal; in response to the existence of the second public key certificate, determining whether the second public key certificate has expired; in response to the second public key certificate having not expired, verifying the currently received digital signature message with the second public key certificate; in response to the non-existence of the second public key certificate in the terminal, or in response to the second public key certificate expiring, or in response to the second public key certificate failing to verify the currently received digital signature message, downloading and saving the latest public key certificate corresponding to the second public key certificate from the network side.

[0012] Optionally, the method also includes: verifying the currently received digital signature message using the latest public key certificate corresponding to the second public key certificate; in response to successful verification, displaying the event message corresponding to the currently received digital signature message; and in response to failed verification, not displaying the event message corresponding to the currently received digital signature message.

[0013] Optionally, the network side is a key management center.

[0014] According to a second aspect of certain exemplary embodiments of the present disclosure, there is provided a public key certificate updating device, which is applied to a terminal, and the device includes: a status confirmation module, configured to confirm the status of the public key certificate of the terminal in response to the terminal successfully establishing a data service, or in response to the terminal receiving digital signature information; and a certificate updating module, configured to download and save the latest public key certificate from the network side based on the status of the public key certificate.

[0015] Optionally, the status confirmation module is configured to confirm the status of all or part of the first public key certificate in response to the terminal successfully establishing a data service, wherein the first public key certificate is a public key certificate corresponding to an identifier of digital signature information supported by the terminal and requiring digital signature verification by the terminal.

[0016] Optionally, the status confirmation module is configured to confirm the status of a second public key certificate in response to the terminal receiving digital signature information, wherein the second public key certificate is a public key certificate corresponding to the identifier of the currently received digital signature message.

[0017] Optionally, the certificate update module is configured to determine whether a first public key certificate exists in the terminal; in response to the existence of the first public key certificate, determine whether the first public key certificate has expired; in response to the absence of the first public key certificate in the terminal, or in response to the first public key certificate expiring, download and save the latest public key certificate corresponding to the first public key certificate from the network side.

[0018] Optionally, the certificate update module is configured to determine whether a second public key certificate exists in the terminal; in response to the existence of the second public key certificate, determine whether the second public key certificate has expired; in response to the second public key certificate having not expired, verify the currently received digital signature message with the second public key certificate; in response to the absence of the second public key certificate in the terminal, or in response to the second public key certificate expiring, or in response to the second public key certificate failing to verify the currently received digital signature message, download and save the latest public key certificate corresponding to the second public key certificate from the network side.

[0019] Optionally, the device also includes: a display control module, configured to verify the currently received digital signature message using the latest public key certificate corresponding to the second public key certificate, and in response to successful verification, displaying the event message corresponding to the currently received digital signature message, and in response to failed verification, not displaying the event message corresponding to the currently received digital signature message.

[0020] Optionally, the network side is a key management center.

[0021] According to a third aspect of certain exemplary embodiments of the present disclosure, there is provided a terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any one of the above methods when executing the computer program.

[0022] According to a third aspect of certain exemplary embodiments of the present disclosure, there is provided a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of any of the above methods when executed by a processor.

[0023] The above-mentioned public key certificate updating method, device, terminal and storage medium are responsive to the terminal successfully establishing a data service, the terminal confirms the status of the terminal's public key certificate, and based on the status of the public key certificate, downloads and saves the latest public key certificate from the network side, or responds to the terminal receiving digital signature information, the terminal confirms the status of the terminal's public key certificate, and based on the status of the public key certificate, downloads and saves the latest public key certificate from the network side. In this way, there is no need to set a timer to regularly connect to the Internet to download and update the public key certificate, nor is there a need to always establish a network connection to receive public key certificate update notifications. Without additionally increasing the standby power consumption of the terminal, the terminal can always use the latest public key certificate to verify the digital signature of the digital signature message. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 is an application environment diagram of a public key certificate updating method in some exemplary embodiments of the present disclosure;

[0025] Figure 2 is an internal structure diagram of a terminal in some exemplary embodiments of the present disclosure;

[0026] Figure 3 A flowchart of a method for updating a public key certificate in some exemplary embodiments of the present disclosure is provided;

[0027] Figure 4 A flowchart of a public key certificate update step in some exemplary embodiments of the present disclosure;

[0028] Figure 5 Schematic diagram of a process of updating a public key certificate in some other exemplary embodiments of the present disclosure;

[0029] Figure 6 The present invention is a structural block diagram of a public key certificate updating apparatus in some exemplary embodiments of the present disclosure. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0031] The following specific embodiments are provided to help the reader obtain a comprehensive understanding of the methods, devices, terminals and / or storage media described herein. However, after understanding the disclosure of the present disclosure, various changes, modifications and equivalents of the methods, devices, terminals and / or storage media described herein will be clear. For example, the order of the operations described herein is only an example, and is not limited to those orders set forth herein, but can be changed as will be clear after understanding the disclosure of the present disclosure, except for the operations that must occur in a specific order. In addition, for greater clarity and simplicity, the description of features known in the art can be omitted.

[0032] The features described herein may be implemented in different forms and should not be construed as being limited to the examples described herein. Rather, the examples described herein have been provided to illustrate only some of the many possible ways to implement the methods, devices, terminals, and / or storage media described herein, many of which will be clear after understanding the present disclosure.

[0033] The terms used herein are only used to describe various examples and will not be used to limit the disclosure. Unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. The terms "comprise", "include" and "have" indicate the presence of the described features, quantities, operations, components, elements and / or their combinations, but do not exclude the presence or addition of one or more other features, quantities, operations, components, elements and / or their combinations. Unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in the text is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B, can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present invention, "multiple" refers to two or more than two.

[0034] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as those generally understood by a person of ordinary skill in the art to which the present disclosure belongs after understanding the present disclosure. Unless explicitly defined as such herein, terms (such as those defined in a general dictionary) should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and the present disclosure, and should not be interpreted in an idealized or overly formal manner.

[0035] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The implementations described in certain exemplary embodiments below do not represent all implementations consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0036] Furthermore, in the description of examples, when it is considered that a detailed description of a well-known related structure or function would cause vague interpretation of the present disclosure, such a detailed description will be omitted.

[0037] Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. However, embodiments may be implemented in various forms and are not limited to the examples described herein.

[0038] The embodiment of the present application proposes a method, device, terminal and computer-readable storage medium for updating a public key certificate, which does not require setting a timer to regularly connect to the Internet to download and update the public key certificate, nor does it require always establishing a network connection to receive public key certificate update notifications. Under the premise of not additionally increasing the standby power consumption of the terminal, the terminal always uses the latest public key to verify the digital signature of the digital signature message. The following will be described separately.

[0039] In order to facilitate understanding of the public key update solution provided by this application, the following first introduces the cell broadcast service system architecture based on digital signatures, and here is an exemplary application for implementation support. Figure 1As shown, a cell broadcast service process based on digital signature includes the following steps: a key management center (Key Management Center, KMC) distributes a private key certificate to a community broadcast service management center (Community Broadcas Service Management Center, CBSMC), the private key certificate is used to sign the notification message, and the key management center distributes a public key certificate to the terminal enterprise, the public key in the public key certificate is used to verify the signature of the notification message, and the terminal enterprise needs to apply it to each terminal after the public key certificate is issued, such as pushing a firmware version that adds a new public key certificate, or updating the public key certificate online through an APP, when the community broadcasting information release platform (Community Broadcasting Information Relsase Platform, CBIRP) needs to send a notification message (which can be but is not limited to a public alarm message), the notification message is sent to the community broadcast service management center (CBSMC), the cell broadcast service management center (CBSMC) signs the notification message using the private key certificate distributed by the key management center (KMC), obtains the digital signature information, and then sends the digital signature information to each operator network (CellBroadcast Centre, CBC), each operator network selects a broadcast range according to the location information, broadcasts the digital signature information to the terminal through the base station, and the terminal verifies the digital signature information according to the saved public key certificate, and chooses to display or discard the notification message according to the verification result. Among them, the key management center, the cell broadcast information release platform, the cell broadcast service management center and the terminal enterprise are all on the network side, which are network side devices, and can be various types of servers or various types of electronic devices. Among them, the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content distribution networks (CDN, Content Delivery Network), and big data and artificial intelligence platforms. The electronic device can be a smart phone, a tablet computer, a laptop computer, a desktop computer, an intelligent voice interaction device (such as a smart speaker), a smart home appliance (such as a smart TV), a smart watch, an in-vehicle electronic device, a wearable device, a virtual reality (VR, Virtual Reality) device, etc., but is not limited to this.

[0040] In this application scenario, the terminal updates the public key certificate by updating the software version. As mentioned above, in this method, when the public key certificate is updated, the terminal needs to update the software version synchronously and push it to the user. This method has the problem of untimely updates, and when the user does not update the software for some reason, the new certificate cannot be used to verify the message, and the public alarm message cannot be received.

[0041] The public key certificate update method provided in this application can be applied to a terminal (for example Figure 1 The terminal can communicate with the network side (such as Figure 1 The network side here can be a key management center, but it is not limited to a key management center, for example, it can also be a terminal enterprise, a cell broadcast service management center, etc.

[0042] In some embodiments, the terminal (eg Figure 1 The terminal in the present application may be a smart phone, a tablet computer, a laptop computer, a desktop computer, an intelligent voice interaction device (such as a smart speaker), a smart home appliance (such as a smart TV), a smart watch, a vehicle-mounted terminal, a wearable device, a virtual reality (VR) device, etc., but is not limited thereto. The terminal and the network side may be directly or indirectly connected by wired or wireless communication, and the embodiments of the present application are not limited to this. In some embodiments, the terminal may implement the public key certificate update method provided by the embodiments of the present application by running a computer program. For example, the computer program may be a native program or software module in the operating system; it may be a native application (APP, Application), that is, a program that needs to be installed in the operating system to run; it may also be a small program, that is, a program that can be run only by downloading it to a browser environment; it may also be a small program that can be embedded in any APP. In short, the above-mentioned computer program may be an application, module or plug-in in any form.

[0043] The following describes a terminal for implementing a method for updating a public key certificate provided in an embodiment of the present application. Figure 2 , Figure 2 2 is a schematic diagram of the structure of a terminal of a method for updating a public key certificate provided in an embodiment of the present application. The terminal 200 provided in an embodiment of the present application includes:

[0044] At least one processor 210, at least one memory 220, a user interface 230 and a network interface 250. The various components in the terminal 200 are coupled together through a bus system 240. It can be understood that the bus system 240 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 240 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the bus system 240 is not used in the embodiment of the present invention. Figure 2 Various buses are labeled as bus system 240 .

[0045] The processor 210 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., where the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0046] The user interface 230 includes one or more output devices 231 that enable presentation of media content, including one or more speakers and / or one or more visual display screens. The user interface 230 also includes one or more input devices 232, including user interface components that facilitate user input, such as a keyboard, mouse, microphone, touch screen display, camera, other input buttons and controls.

[0047] The memory 220 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state memory, hard disk drives, optical disk drives, etc. The memory 220 may optionally include one or more storage devices that are physically remote from the processor 210.

[0048] The memory 220 includes a volatile memory or a non-volatile memory, and may also include both volatile and non-volatile memories. The non-volatile memory may be a read-only memory (ROM), and the volatile memory may be a random access memory (RAM). The memory 220 described in the embodiments of the present application is intended to include any suitable type of memory.

[0049] In some embodiments, memory 220 can store data to support various operations, examples of which include programs, modules, and data structures, or a subset or superset thereof, as exemplarily described below.

[0050] The operating system 221 includes system programs for processing various basic system services and executing hardware-related tasks, such as a framework layer, a core library layer, a driver layer, etc., which are used to implement various basic businesses and process hardware-based tasks.

[0051] The network communication module 222 is used to reach other computing devices via one or more (wired or wireless) network interfaces 250. Exemplary network interfaces 250 include: Bluetooth, Wireless Authentication (WiFi), and Universal Serial Bus (USB).

[0052] The display module 223 is used to enable information presentation via one or more output devices 231 (eg, display screen, speaker, etc.) associated with the user interface 230 (eg, a user interface for operating peripheral devices and displaying content and information).

[0053] The input processing module 224 is used to detect one or more user inputs or interactions from one of the one or more input devices 232 and translate the detected inputs or interactions.

[0054] The computer program 225 is used to implement a public key certificate updating method when the computer program 225 is executed by the processor 210.

[0055] In some embodiments, Figure 3 As shown, a method for updating a public key certificate is provided, which is described by taking the method applied to a terminal as an example, and includes the following steps:

[0056] Step 302: in response to the terminal successfully establishing a data service, or in response to the terminal receiving digital signature information, confirming the status of the public key certificate of the terminal.

[0057] Generally, after the data service is established, the terminal will send a notification event that the data service has been established. By monitoring the notification event, it can be determined that the terminal has successfully established the data service. Of course, the method for determining that the terminal has successfully established the data service is not limited to this. The successful establishment of the data service here generally occurs when the terminal's data service switches from an unavailable state to an available state. For example, when the terminal is turned on for the first time, restarted, or in flight mode, etc., and needs to re-register with the network, the system will re-establish the data service. When the data service is established, a notification event that the data service has been established is sent. The network can be a cellular network or a WIFI (Wireless Fidelity) network. When the terminal registers for the cellular network data service, or connects to the WIFI network, the terminal switches to the data service available state. At this time, the notification of the establishment of the data service sent by the system can be received, and it is determined that the terminal has successfully established the data service.

[0058] Here, the digital signature information may be a digital signature of an event message, where the event message may be a public alarm message, or other types of event messages, such as instant messaging content, email messages, notification messages, and the like.

[0059] Here, a public key certificate, also called a digital certificate, is an electronic file that contains public key information, owner identity information (subject), and the digital signature of the public key certificate authority (issuer) to ensure that the overall content of the file is correct. The main function of a public key certificate is to bind the user identity to the user's public key. The authenticity of this binding is guaranteed by the signature of the certificate authority, and the received digital signature information can be verified through the public key certificate.

[0060] Here, the public key certificate of the terminal may include a public key certificate for verifying digital signature information obtained by signing a public alarm message, but may also include a public key certificate for verifying other digital signature information.

[0061] Here, the status of the public key certificate may be a status indicating whether the certificate exists, is valid, has been revoked, or has expired, etc., or may be verification result information of the currently received digital signature information. The number of public key certificates may be one or more.

[0062] Specifically, in response to detecting that the terminal has successfully established a data service, the terminal confirms the status of its public key certificate, wherein the data service establishment may be the first data service establishment, for example, the initial power-on of the terminal, or the data service is re-established, for example, restarting, turning off the flight mode, and other scenarios that require re-registration with the network. Confirming the status of the public key certificate of the terminal may be performed immediately or nearly immediately after detecting that the data service of the terminal has been successfully established, or may be performed after a certain interval, but preferably is performed immediately or nearly immediately after detecting that the data service of the terminal has been successfully established. In response to detecting that the terminal has successfully established a data service, the step of confirming the status of the public key certificate of the terminal may be performed once or multiple times.

[0063] In addition, when the terminal receives the digital signature information, it also confirms the status of its public key certificate. Generally, in this case, it is necessary to perform the step of confirming the status of its public key certificate immediately, nearly immediately, or at a short interval when the digital signature information is received.

[0064] Step 304: based on the status of the public key certificate, download and save the latest public key certificate from the network side.

[0065] Here, the network side refers to a network device or platform that the terminal can access and from which the latest public key certificate can be obtained. For timeliness considerations, the network side can be a key management center, so that after the key management center issues a new public key certificate, the terminal can download and save the latest public key certificate by accessing the key management center. Among them, the network side, for example, the key management center, can provide a public URL (Uniform Resource Locator) link, and the terminal can download and save the latest public key certificate by accessing the URL link. However, it is not limited to downloading and saving the latest public key certificate from the key management center.

[0066] Specifically, the terminal can determine whether it is necessary to download the latest public key certificate from the network side based on the status of the public key certificate. If so, the terminal can download and save the latest public key certificate from the network side. If there are multiple public key certificates to be downloaded, the corresponding public key certificates can also be downloaded from the same or different network devices or platforms.

[0067] The above-mentioned public key certificate updating method is that in response to the terminal successfully establishing a data service, the terminal confirms the status of the terminal's public key certificate, and based on the status of the public key certificate, downloads and saves the latest public key certificate from the network side, or in response to the terminal receiving digital signature information, the terminal confirms the status of the terminal's public key certificate, and based on the status of the public key certificate, downloads and saves the latest public key certificate from the network side. In this way, there is no need to set a timer to regularly connect to the Internet to download and update the public key certificate, nor is there a need to always establish a network connection to receive public key certificate update notifications. Without additionally increasing the standby power consumption of the terminal, the terminal can always use the latest public key certificate to verify the digital signature of the digital signature message.

[0068] In certain exemplary embodiments, the above-mentioned step of confirming the status of the public key certificate in the terminal in response to the terminal successfully establishing a data service, or in response to the terminal receiving digital signature information, may include the step of: in response to the terminal successfully establishing a data service, confirming the status of all or part of the first public key certificate, wherein the first public key certificate is a public key certificate corresponding to the identifier of the digital signature information supported by the terminal and requiring digital signature verification by the terminal.

[0069] Generally, the digital signature information that needs to be verified by the terminal can be various, and the identifier here can be pre-configured information for identifying different types of digital signature information and then determining the corresponding public key certificate. The identifier can be a cell broadcast entity (e.g. Figure 1 The cell broadcast information publishing platform in the event message) or other event message sending entity identification information. It can also be a cell broadcast entity (for example Figure 1The geographical location information of the sending entity of the cell broadcast information publishing platform in the event message or other event messages can also be other preset information, as long as the corresponding public key certificate can be determined by the representation. Among them, the terminal can correspond to multiple first public key certificates, that is, it supports signature verification of multiple categories of digital signature information.

[0070] Specifically, the terminal may pre-configure the correspondence between the identifier and the public key certificate (first public key certificate) here, may pre-specify which identifiers' public key certificates of digital signature messages need to be updated according to the scheme of this embodiment, may specify that all or part of the first public key certificates need to be updated according to the scheme of this embodiment, or may not specify, for example, assuming that all first public key certificates need to be updated according to the scheme of this embodiment. In response to the successful establishment of the data service by the terminal, the terminal confirms the status of all or part of the first public key certificates according to the correspondence between the identifier of the pre-configured digital signature information and the first public key certificate.

[0071] In these exemplary embodiments, each time the terminal successfully establishes a data service, the status of all or part of the first public key certificate is confirmed so that the confirmed status of the first public key certificate can be subsequently updated based on the confirmed status of the first public key certificate. In this way, the terminal can verify the digital signature of the digital signature message with the latest public key as much as possible.

[0072] In certain exemplary embodiments, the above-mentioned step of confirming the status of the public key certificate in the terminal in response to the terminal successfully establishing a data service or in response to the terminal receiving digital signature information may include the step of: confirming the status of the second public key certificate in response to the terminal receiving the digital signature information, wherein the second public key certificate is a public key certificate corresponding to the identifier of the currently received digital signature message.

[0073] In the case where the terminal receives digital signature information, the terminal may only need to confirm the status of the public key certificate corresponding to the identifier of the currently received digital signature message in response to receiving the digital signature information. Similarly, the terminal may pre-configure the correspondence between the identifier of the digital signature information and the public key certificate, may select a second public key certificate based on the identifier of the currently received digital signature message, and then confirm the status of the second public key certificate. Among them, the identifier of the currently received digital signature message may be bound together with the digital signature message and transmitted to the terminal, or the terminal may determine it by identifying the digital signature message.

[0074] In these exemplary embodiments, each time digital signature information is received, the status of the second public key certificate is confirmed so that the second public key certificate can be updated in a timely manner based on the status of the second public key certificate. In this way, the terminal can use the latest public key to verify the digital signature of the currently received digital signature message.

[0075] In some exemplary embodiments, the above-mentioned state based on the public key certificate downloads and saves the latest public key certificate from the network side, such as Figure 4 As shown, the following steps may be included:

[0076] Step 402 , determine whether the first public key certificate exists in the terminal, if so, proceed to step 404 , if not, proceed to step 406 .

[0077] Here, the first public key certificate is any one of the above-mentioned public key certificates corresponding to the identifier of the digital signature information supported by the terminal and requiring digital signature verification by the terminal.

[0078] The public key certificate (or the first public key certificate) may not exist in the terminal in the following situations: file system read and write errors leading to file loss, system factory reset, terminal firmware re-flash, forced memory data cleanup, etc. Therefore, in these exemplary embodiments, it is determined whether the first public key certificate exists in the terminal, and if not, the corresponding latest public key certificate can be downloaded in a timely manner.

[0079] Step 404, determine whether the first public key certificate has expired, if so, proceed to step 406, if not, end the process.

[0080] The validity period of the first public key certificate can be set on the terminal side or on the network side. The validity period set on the network side generally refers to the validity period set by the key management center. In the case where there are both validity periods set on the terminal side and validity periods set on the network side, the validity period set on the network side can be used as the validity period of the first public key certificate. The validity period can be expressed by the start time and end time of the public key certificate, or by a fixed duration, such as 1 year.

[0081] Specifically, in response to the existence of the first public key certificate, the terminal can determine whether the current time is within the start time and end time of the first public key certificate. If not, it is determined that the first public key certificate has expired, and the process proceeds to step 406. If so, it indicates that the first public key certificate has not expired, and the process ends.

[0082] Generally, the last modification time of the first public key certificate is recorded on the terminal, and whether the first public key certificate has exceeded the validity period can be determined based on the last modification time and the validity period of the first public key certificate.

[0083] Specifically, in response to the existence of the first public key certificate, the terminal calculates the difference between the current time and the last modification time of the first public key certificate, and determines whether the difference exceeds the validity period of the first public key certificate (the validity period is represented by a fixed duration). If so, it is determined that the first public key certificate has exceeded the validity period, and the process proceeds to step 406. If it is determined that the first public key certificate has not exceeded the validity period, the process ends.

[0084] The end of the process means that there is no need to execute the subsequent steps of downloading and saving the corresponding latest public key certificate from the network side.

[0085] Step 406: Download and save the latest public key certificate corresponding to the first public key certificate from the network side.

[0086] Specifically, in response to the first public key certificate not existing in the terminal or the first public key certificate expiring, the terminal downloads the latest public key certificate corresponding to the first public key certificate from the network side and saves the downloaded latest public key certificate.

[0087] It should be noted that, in the case where the status of multiple first public key certificates has been confirmed, the above steps 402 to 406 can be executed separately based on the status of each first public key certificate. At the same time, the execution process of the above steps 402 to 406 of different first public key certificates can be executed in sequence or simultaneously.

[0088] In these exemplary embodiments, it is determined whether the first public key certificate exists in the terminal and whether the first public key certificate has expired. If the first public key certificate does not exist or the first public key certificate has expired, the latest public key certificate corresponding to the first public key certificate is promptly downloaded and saved from the network side. In this way, it can be ensured as much as possible that the first public key certificate saved in the terminal is the corresponding latest public key certificate.

[0089] In certain exemplary embodiments, Figure 5 As shown, the above-mentioned state based on the public key certificate downloads and saves the latest public key certificate from the network side, such as Figure 5 As shown, the following steps may be included:

[0090] Step 502 , determine whether the second public key certificate exists in the terminal, if so, proceed to step 504 , if not, proceed to step 508 .

[0091] Here, the second public key certificate is the public key certificate corresponding to the identifier of the currently received digital signature message referred to above.

[0092] Step 504, determine whether the second public key certificate has expired, if so, proceed to step 508, if not, proceed to step 506.

[0093] Among them, the method of determining whether there is a second public key certificate in the terminal and the method of determining whether the second public key certificate has expired are similar to the above-mentioned method of determining whether there is a first public key certificate in the terminal and the method of determining whether the first public key certificate has expired, and will not be repeated here.

[0094] Step 506, use the second public key certificate to verify the currently received digital signature message. If the verification fails, proceed to step 508. If the verification passes, the process ends.

[0095] The public key certificate is a document containing information such as a public key, name, organization, and email address. Specifically, the terminal can use the public key in the second public key certificate to verify the currently received digital signature message and obtain a verification result. If the verification result is not passed, the process proceeds to step 508. If the verification result is passed, the process ends. The end of the process here means that there is no need to perform the subsequent steps of downloading and saving the corresponding latest public key certificate from the network side.

[0096] Step 508: Download and save the latest public key certificate corresponding to the second public key certificate from the network side.

[0097] Specifically, in response to the second public key certificate not existing in the terminal, or in response to the second public key certificate expiring, or in response to the second public key certificate failing to verify the currently received digital signature message, the terminal downloads and saves the latest public key certificate corresponding to the second public key certificate from the network side.

[0098] In these exemplary embodiments, it is determined whether the second public key certificate exists in the terminal, whether the second public key certificate has expired, and the second public key certificate is used to verify the currently received digital signature message. If any one of the conditions is met, such as the absence of the second public key certificate, the expiration of the second public key certificate, and the verification result of the currently received digital signature message using the second public key certificate is a verification failure, the latest public key certificate corresponding to the second public key certificate is promptly downloaded and saved from the network side. In this way, it can be ensured that the corresponding latest public key certificate is used in the terminal to perform digital signature verification on the currently received digital signature information.

[0099] In certain exemplary embodiments, the provided public key certificate updating method may further include the steps of: verifying the currently received digital signature message with the latest public key certificate corresponding to the second public key certificate; in response to successful verification, displaying the event message corresponding to the currently received digital signature message; and in response to failed verification, not displaying the event message corresponding to the currently received digital signature message.

[0100] In these exemplary embodiments, after downloading the latest public key certificate corresponding to the second public key certificate, the latest public key certificate is used again to verify the currently received digital signature message, rather than not displaying the corresponding event message if the currently received digital signature message fails to be verified with the second public key certificate, thereby avoiding missing the corresponding event message from being displayed to the user.

[0101] It should be understood that although Figure 3-5 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 3-5 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0102] In certain exemplary embodiments, Figure 6 As shown, a public key certificate updating device is provided, which is applied to a terminal, and the device includes: a status confirmation module 602 and a certificate updating module 604, wherein: the status confirmation module 602 is configured to confirm the status of the public key certificate of the terminal in response to the terminal successfully establishing a data service, or in response to the terminal receiving digital signature information; the certificate updating module 604 is configured to download and save the latest public key certificate from the network side based on the status of the public key certificate.

[0103] In certain exemplary embodiments, the status confirmation module 602 is configured to confirm the status of all or part of the first public key certificate in response to the terminal successfully establishing a data service, wherein the first public key certificate is a public key certificate corresponding to an identifier of digital signature information supported by the terminal and requiring digital signature verification by the terminal.

[0104] In some exemplary embodiments, the status confirmation module 602 is configured to confirm the status of the second public key certificate in response to the terminal receiving the digital signature information, wherein the second public key certificate is a public key certificate corresponding to the identifier of the currently received digital signature message.

[0105] In certain exemplary embodiments, the certificate update module 604 is configured to determine whether a first public key certificate exists in the terminal; in response to the existence of the first public key certificate, determine whether the first public key certificate has expired; in response to the absence of the first public key certificate in the terminal, or in response to the first public key certificate expiring, download and save the latest public key certificate corresponding to the first public key certificate from the network side.

[0106] In certain exemplary embodiments, the certificate update module 604 is configured to determine whether a second public key certificate exists in the terminal; in response to the existence of the second public key certificate, determine whether the second public key certificate has expired; in response to the second public key certificate not having expired, verify the currently received digital signature message with the second public key certificate; in response to the absence of the second public key certificate in the terminal, or in response to the second public key certificate expiring, or in response to the second public key certificate failing to verify the currently received digital signature message, download and save the latest public key certificate corresponding to the second public key certificate from the network side.

[0107] In certain exemplary embodiments, the device also includes a display control module (not shown in the figure), which is configured to verify the currently received digital signature message with the latest public key certificate corresponding to the second public key certificate, and in response to successful verification, display the event message corresponding to the currently received digital signature message, and in response to failed verification, not display the event message corresponding to the currently received digital signature message.

[0108] In some exemplary embodiments, the network side is a key management center.

[0109] For the specific definition of the public key certificate update device, please refer to the definition of the public key certificate update method above, which will not be repeated here. Each module in the above public key certificate update device can be implemented in whole or in part by software, hardware and their combination. The above modules can be embedded in or independent of the processor in the terminal in hardware form, or stored in the memory in the terminal in software form, so that the processor can call and execute the operations corresponding to the above modules.

[0110] In certain exemplary embodiments, a terminal is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and when the processor executes the computer program, the steps of the public key certificate updating method in any of the above exemplary embodiments are implemented.

[0111] In some exemplary embodiments of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the image processing method in any of the above exemplary embodiments are implemented.

[0112] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0113] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0114] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A method for updating a public key certificate, applied to a terminal, the method comprising: In response to the terminal successfully establishing a data service, or in response to the terminal receiving digital signature information, confirming a status of a public key certificate of the terminal; Based on the status of the public key certificate, the latest public key certificate is downloaded and saved from the network side.

2. The method according to claim 1, characterized in that In response to the terminal successfully establishing the data service, or in response to the terminal receiving the digital signature information, confirming the status of the public key certificate in the terminal includes: In response to the terminal successfully establishing a data service, confirming the status of all or part of a first public key certificate, wherein the first public key certificate is a public key certificate corresponding to an identifier of digital signature information supported by the terminal and requiring digital signature verification by the terminal.

3. The method according to claim 1, characterized in that In response to the terminal successfully establishing the data service, or in response to the terminal receiving the digital signature information, confirming the status of the public key certificate in the terminal includes: In response to the terminal receiving the digital signature information, confirming the status of a second public key certificate, wherein the second public key certificate is a public key certificate corresponding to the identifier of the currently received digital signature message.

4. The method according to claim 2, characterized in that: The downloading and saving of the latest public key certificate from the network side based on the state of the public key certificate includes: Determining whether the first public key certificate exists in the terminal; In response to the existence of the first public key certificate, determining whether the first public key certificate has expired; In response to the first public key certificate not existing in the terminal, or in response to the first public key certificate expiring, downloading and saving the latest public key certificate corresponding to the first public key certificate from the network side.

5. The method according to claim 3, characterized in that: The downloading and saving of the latest public key certificate from the network side based on the state of the public key certificate includes: Determining whether the second public key certificate exists in the terminal; In response to the existence of the second public key certificate, determining whether the second public key certificate has expired; In response to the second public key certificate not exceeding the validity period, verifying the currently received digital signature message using the second public key certificate; In response to the second public key certificate not existing in the terminal, or in response to the second public key certificate expiring, or in response to the second public key certificate failing to verify the currently received digital signature message, downloading and saving the latest public key certificate corresponding to the second public key certificate from the network side.

6. The method according to claim 5, characterized in that The method further comprises: The latest public key certificate corresponding to the second public key certificate is used to verify the currently received digital signature message. In response to successful verification, the event message corresponding to the currently received digital signature message is displayed. In response to failed verification, the event message corresponding to the currently received digital signature message is not displayed.

7. The method according to any one of claims 1 to 6, characterized in that: The network side is a key management center.

8. A public key certificate updating device, characterized in that: The device is applied to a terminal, and the device includes: a status confirmation module, configured to confirm the status of the public key certificate of the terminal in response to the terminal successfully establishing a data service or in response to the terminal receiving digital signature information; The certificate updating module is configured to download and save the latest public key certificate from the network side based on the status of the public key certificate.

9. A terminal comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images