Certificate management system, method and device and storage medium

Abstract

The invention provides a certificate management system, method and device and a storage medium, and relates to the technical field of communication. The system comprises a cloud management platform and an edge node, the cloud management platform is in communication connection with the edge node through a secure communication link; the edge node is used for sending certificate management information to the cloud management platform through the secure communication link; and the cloud management platform is used for managing the target certificate corresponding to the edge node through the secure communication link in response to the certificate management information of the edge node. According to the invention, certificates can be managed efficiently, and the security of certificate management is improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a certificate management system, method, device and storage medium. Background Art

[0002] In traditional certificate management solutions, staff are required to independently manage security certificates for each edge node. When there are too many edge nodes, this process is not only cumbersome and time-consuming, but also prone to human errors such as inaccurate or incomplete application information. In addition, traditional certificate management solutions rely on manual operations, which makes it difficult to ensure safe and timely management of certificates. Security certificates may expire and be tampered with by attacks, thus affecting the normal operation and security of the system. In the new era of cloud-network integration, how to safely and efficiently manage security certificates is an urgent problem to be solved. Summary of the invention

[0003] The present application provides a certificate management system, method, device and storage medium, which solves the problem that traditional certificate management solutions are difficult to ensure safe and efficient management of certificates, can efficiently manage certificates and improve the security of certificate management.

[0004] In order to achieve the above objectives, this application adopts the following technical solutions:

[0005] In a first aspect, the present application provides a certificate management system, which includes: a cloud management platform and an edge node; the cloud management platform and the edge node are communicatively connected via a secure communication link; the edge node is used to send certificate management information to the cloud management platform via a secure communication link; the cloud management platform is used to respond to the certificate management information of the edge node and manage the target certificate corresponding to the edge node via a secure communication link.

[0006] In combination with the first aspect above, in a possible implementation method, the edge node can be used to monitor the operating status of the edge node and the status of the target certificate corresponding to the edge; and based on the operating status of the edge node and the status of the target certificate corresponding to the edge node, send certificate management information to the cloud management platform through a secure communication link; wherein, the status of the target certificate corresponding to the edge node includes the validity status of the target certificate and the security status of the target certificate.

[0007] In combination with the above-mentioned first aspect, in a possible implementation method, the certificate management information includes at least one of the following: certificate application information, certificate update information, certificate revocation information and certificate destruction information; wherein, the certificate application information is used to instruct the cloud management platform to generate a target certificate corresponding to the edge node; the certificate update information is used to instruct the cloud management platform to update the target certificate corresponding to the edge node; the certificate revocation information is used to instruct the cloud management platform to revoke the target certificate corresponding to the edge node; and the certificate destruction information is used to instruct the cloud management platform to destroy the target certificate corresponding to the edge node.

[0008] In combination with the first aspect above, in a possible implementation, in response to the certificate application information of the edge node, the cloud management platform generates a target certificate corresponding to the edge node and sends the target certificate to the edge node through a secure communication link.

[0009] In combination with the first aspect above, in a possible implementation, in response to the certificate update information of the edge node, the cloud management platform performs update management on the target certificate corresponding to the edge node, and sends the updated target certificate to the edge node through a secure communication link.

[0010] In combination with the first aspect above, in a possible implementation manner, in response to certificate revocation information of an edge node, the cloud management platform performs revocation management on a target certificate corresponding to the edge node.

[0011] In combination with the first aspect above, in a possible implementation manner, in response to certificate destruction information of an edge node, the cloud management platform performs destruction management on a target certificate corresponding to the edge node.

[0012] In combination with the first aspect above, in a possible implementation method, in response to the certificate destruction information of the edge node, the cloud management platform is also used to send an alarm message to the client before, after or at the same time as destroying the target certificate of the edge node; the alarm information is used to reflect that the target certificate of the edge node has been destroyed.

[0013] In combination with the first aspect above, in a possible implementation method, the cloud management platform is also used to monitor one or more of the operating status of the edge node, the security status and the validity status of the target certificate corresponding to the edge node; when it is monitored that the operating status of the edge node is abnormal and / or the target certificate corresponding to the edge node is in an unsafe state, the target certificate corresponding to the edge node is revoked and / or destroyed; or after the validity period of the target certificate corresponding to the edge node expires, the target certificate after the expiration is updated and the updated target certificate is sent to the edge node through a secure communication link.

[0014] In combination with the first aspect above, in a possible implementation, the edge node is further used to install a target certificate and store the target certificate based on a secure storage mechanism, so that the edge node can apply the stored target certificate for identity authentication.

[0015] In the second aspect, the present application provides a certificate management method, which is applied to a certificate management system. The certificate management system includes a cloud management platform and an edge node. The cloud management platform and the edge node are communicatively connected via a secure communication link. The method includes: the edge node sends certificate management information to the cloud management platform via a secure communication link; the cloud management platform responds to the certificate management information of the edge node, and manages the target certificate corresponding to the edge node via a secure communication link.

[0016] In combination with the above-mentioned second aspect, in a possible implementation method, the edge node in the above-mentioned certificate management method sends certificate management information to the cloud management platform through a secure communication link, including: the edge node monitors the operating status of the edge node and the status of the target certificate corresponding to the edge node; and based on the operating status of the edge node and the status of the target certificate corresponding to the edge node, sends certificate management information to the cloud management platform through a secure communication link; wherein, the status of the target certificate corresponding to the edge node includes the validity status of the target certificate and the security status of the target certificate.

[0017] In combination with the above-mentioned second aspect, in a possible implementation method, the certificate management information includes at least one of the following: certificate application information, certificate update information, certificate revocation information and certificate destruction information; wherein, the certificate application information is used to instruct the cloud management platform to generate a target certificate corresponding to the edge node; the certificate update information is used to instruct the cloud management platform to update the target certificate corresponding to the edge node; the certificate revocation information is used to instruct the cloud management platform to revoke the target certificate corresponding to the edge node; and the certificate destruction information is used to instruct the cloud management platform to destroy the target certificate corresponding to the edge node.

[0018] In combination with the above-mentioned second aspect, in a possible implementation method, in the above-mentioned certificate management method, the cloud management platform responds to the certificate management information of the edge node, and manages the target certificate corresponding to the edge node through a secure communication link, including: when responding to the certificate application information of the edge node, the cloud management platform generates a target certificate corresponding to the edge node, and sends the target certificate to the edge node through a secure communication link.

[0019] In combination with the above-mentioned second aspect, in a possible implementation method, in the above-mentioned certificate management method, the cloud management platform responds to the certificate management information of the edge node, and manages the target certificate corresponding to the edge node through a secure communication link, including: when responding to the certificate update information of the edge node, the cloud management platform updates the target certificate corresponding to the edge node, and sends the updated target certificate to the edge node through a secure communication link.

[0020] In combination with the above-mentioned second aspect, in a possible implementation method, in the above-mentioned certificate management method, the cloud management platform responds to the certificate management information of the edge node, and manages the target certificate corresponding to the edge node through a secure communication link, including: when responding to the certificate revocation information of the edge node, the cloud management platform performs revocation management on the target certificate corresponding to the edge node.

[0021] In combination with the above-mentioned second aspect, in a possible implementation method, in the above-mentioned certificate management method, the cloud management platform responds to the certificate management information of the edge node, and manages the target certificate corresponding to the edge node through a secure communication link, including: when responding to the certificate destruction information of the edge node, the cloud management platform performs destruction management on the target certificate corresponding to the edge node.

[0022] In combination with the above-mentioned second aspect, in a possible implementation method, the method also includes: in response to the certificate destruction information of the edge node, the cloud management platform sends an alarm information to the client before, after or at the same time as destroying the target certificate of the edge node; the alarm information is used to reflect that the target certificate of the edge node has been destroyed.

[0023] In combination with the above-mentioned second aspect, in a possible implementation method, the method also includes: the cloud management platform monitors the operating status of the edge node, the security status and validity status of the target certificate corresponding to the edge node, or one or more of the following: when it is monitored that the operating status of the edge node is abnormal and / or the target certificate corresponding to the edge node is in an unsafe state, the target certificate corresponding to the edge node is revoked and / or destroyed; or after the validity period of the target certificate corresponding to the edge node expires, the target certificate after the expiration is updated and the updated target certificate is sent to the edge node through a secure communication link.

[0024] In combination with the above second aspect, in a possible implementation manner, the method further includes: the edge node installing a target certificate, and storing the target certificate based on a secure storage mechanism, so that the edge node can apply the stored target certificate for identity authentication.

[0025] In the third aspect, the present application provides a certificate management device, which includes: a communication unit and a processing unit; the communication unit sends certificate management information to a cloud management platform through a secure communication link; the processing unit is used to respond to the certificate management information of the edge node and manage the target certificate corresponding to the edge node through a secure communication link.

[0026] In combination with the above-mentioned third aspect, in a possible implementation method, the processing unit is also used to monitor the operating status of the edge node and the status of the target certificate corresponding to the edge node; and based on the operating status of the edge node and the status of the target certificate corresponding to the edge node, send certificate management information to the cloud management platform through the communication unit and the secure communication link; wherein, the status of the target certificate corresponding to the edge node includes the validity status of the target certificate and the security status of the target certificate.

[0027] In conjunction with the third aspect above, in a possible implementation, the certificate management information includes at least one of the following: certificate application information, certificate update information, certificate revocation information, and certificate destruction information. Among them, the certificate application information is used to instruct the cloud management platform to generate a target certificate corresponding to the edge node; the certificate update information is used to instruct the cloud management platform to update the target certificate corresponding to the edge node; the certificate revocation information is used to instruct the cloud management platform to revoke the target certificate corresponding to the edge node; and the certificate destruction information is used to instruct the cloud management platform to destroy the target certificate corresponding to the edge node.

[0028] In combination with the third aspect above, in a possible implementation method, the processing unit can be specifically used to: generate a target certificate corresponding to the edge node in response to the certificate application information of the edge node, and send the target certificate to the edge node through the communication unit and the secure communication link.

[0029] In combination with the above-mentioned third aspect, in a possible implementation method, the processing unit can also be used to: when responding to the certificate update information of the edge node, update the target certificate corresponding to the edge node, and send the updated target certificate to the edge node through the communication unit and the secure communication link.

[0030] In combination with the third aspect above, in a possible implementation manner, the processing unit may be further configured to: perform revocation management on a target certificate corresponding to the edge node in response to certificate revocation information of the edge node.

[0031] In combination with the third aspect, in a possible implementation manner, the processing unit may be further configured to: in response to certificate destruction information of the edge node, perform destruction management on a target certificate corresponding to the edge node.

[0032] In combination with the above-mentioned third aspect, in a possible implementation method, in response to the certificate destruction information of the edge node, the communication unit is also used to send an alarm message to the client before, after or at the same time as destroying the target certificate of the edge node; the alarm information is used to reflect that the target certificate of the edge node has been destroyed.

[0033] In combination with the above-mentioned third aspect, in a possible implementation method, the processing unit is also used to monitor one or more of the operating status of the edge node, the security status and the validity status of the target certificate corresponding to the edge node; when it is monitored that the operating status of the edge node is abnormal and / or the target certificate corresponding to the edge node is in an unsafe state, the target certificate corresponding to the edge node is revoked and / or destroyed; or after the validity period of the target certificate corresponding to the edge node expires, the target certificate after the expiration is updated and the updated target certificate is sent to the edge node through the communication unit and the secure communication link.

[0034] In combination with the third aspect above, in a possible implementation, the processing unit is further used to install a target certificate and store the target certificate based on a secure storage mechanism, so that the edge node can apply the stored target certificate for identity authentication.

[0035] In a fourth aspect, the present application provides an electronic device, the device comprising: a processor; and a memory configured to store processor executable instructions. The processor is configured to execute the instructions to implement the certificate management method as described in the second aspect and any possible implementation of the second aspect.

[0036] In combination with the fourth aspect above, in a possible implementation manner, the electronic device further includes: a communication interface; wherein the communication interface and the processor are coupled.

[0037] In a fifth aspect, the present application provides a computer-readable storage medium, which stores instructions. When the instructions are executed on a terminal, the terminal executes the certificate management method described in the second aspect and any possible implementation of the second aspect.

[0038] In a sixth aspect, the present application provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the certificate management method as described in the second aspect and any possible implementation of the second aspect.

[0039] In a seventh aspect, the present application provides a chip, the chip comprising a processor and a communication interface, the communication interface and the processor are coupled, and the processor is used to run a computer program or instructions to implement the certificate management method as described in the second aspect and any possible implementation of the second aspect.

[0040] Specifically, the chip provided in the present application also includes a memory for storing computer programs or instructions.

[0041] It should be noted that the above computer instructions may be stored in whole or in part on a computer-readable storage medium, wherein the computer-readable storage medium may be packaged together with the processor of the device, or may be packaged separately from the processor of the device, which is not limited in this application.

[0042] The descriptions of the second to seventh aspects of the present application can refer to the detailed description of the first aspect; and the beneficial effects of the descriptions of the second to seventh aspects can refer to the beneficial effect analysis of the first aspect, which will not be repeated here.

[0043] In this application, the name of the certificate management device does not limit the device or functional module itself. In actual implementation, these devices or functional modules may appear with other names. As long as the functions of each device or functional module are similar to those of this application, they fall within the scope of the claims of this application and their equivalent technologies.

[0044] These and other aspects of the present application will become more apparent from the following description.

[0045] Based on the above technical solution, the certificate management system provided by the present application includes a cloud management platform and an edge node, and the cloud management platform and the edge node are connected by a secure communication link. The edge node is used to send certificate management information to the cloud management platform through a secure communication link. Then the cloud management platform is used to respond to the certificate management information of the edge node and manage the target certificate corresponding to the edge node through a secure communication link. That is to say, in the certificate management system proposed in the present application, the edge node automatically initiates the management of the certificate to the cloud management platform through information interaction. Based on the cloud management platform, the edge nodes can be uniformly managed. Compared with the traditional certificate management scheme, which is difficult to ensure safe and efficient management of certificates, the certificates can be managed efficiently, which improves the timeliness of managing certificates. In addition, in the present technical solution, the relevant management information of the certificate transmitted between the edge node and the cloud management platform is realized based on a secure communication link, which avoids the unsafe problems caused by manual operation during the certificate management process, and greatly improves the security of certificate management.

[0046] Furthermore, in the certificate management system proposed in the present application, the cloud management platform can actively monitor the status of edge nodes and automatically trigger the management of target certificates corresponding to edge nodes, so as to avoid the problem that edge nodes are unable to manage certificates, resulting in the security of certificates not being effectively guaranteed, thereby improving the security and reliability of certificate management. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 A schematic diagram of the architecture of a certificate management system provided in an embodiment of the present application;

[0048] Figure 2 A schematic diagram of the architecture of another certificate management system provided in an embodiment of the present application;

[0049] Figure 3 A flow chart of a certificate management method provided in an embodiment of the present application;

[0050] Figure 4 A flowchart of another certificate management method provided in an embodiment of the present application;

[0051] Figure 5 A flowchart of another certificate management method provided in an embodiment of the present application;

[0052] Figure 6 A schematic diagram of the structure of a certificate management device provided in an embodiment of the present application;

[0053] Figure 7 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0054] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0055] The term "and / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0056] The terms "first" and "second" and the like in the specification and drawings of this application are used to distinguish different objects, or to distinguish different processing of the same object, rather than to describe a specific order of objects.

[0057] In addition, the terms "including" and "having" and any variations thereof mentioned in the description of the present application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0058] It should be noted that, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0059] In the description of the present application, unless otherwise specified, “plurality” means two or more.

[0060] The following explains the terms involved in the embodiments of the present application to facilitate the reader's understanding.

[0061] (1) Security Certificate

[0062] A security certificate is a digital file used to verify identity in network communications and ensure the integrity and confidentiality of data. Security certificates generally include SSL / TLS certificates, code signing certificates, email certificates, etc.

[0063] Among them, SSL / TLS certificates are the most common type of security certificates, which are used to protect the secure communication of websites. When a user visits a website that uses an SSL / TLS certificate, the SSL / TLS certificate can ensure secure communication between the user's browser and the website server to prevent data from being stolen or tampered with. For example, online banking websites use SSL / TLS certificates to protect users' account information and transaction data. Code signing certificates are mainly used by software developers to sign the software they develop. When the software is signed, users can verify the signature when downloading and installing the software to determine whether the software has been tampered with and whether it comes from a legitimate developer. Email certificates are used to verify the identity of the sender of an email. When the sender uses an email certificate, the recipient can confirm that the email is indeed sent by the person to whom the certificate belongs and that the email content has not been tampered with during transmission.

[0064] Security certificates are based on public key encryption technology and contain public keys, private keys, and related identity information. During the communication process, the sender uses the receiver's public key to encrypt the data, and only the receiver with the corresponding private key can decrypt the data. Taking SSL / TLS certificates as an example, when a user visits a website, the website server will send the certificate to the browser, and the browser will verify the legitimacy of the certificate (including verifying the signature of the certificate authority, whether the certificate is expired, etc.). If the verification is successful, a secure encrypted communication channel will be established.

[0065] It should be noted that in the embodiments of the present application, the "security certificate" is referred to as "certificate" for short.

[0066] The above is an explanation of the terms involved in the embodiments of the present application. The following is a detailed introduction to the application scenarios of the embodiments of the present application.

[0067] In today's new era of cloud-network integration, traditional certificate management solutions cannot adapt to the ever-changing technical environment and security requirements. In traditional certificate management solutions, staff are required to independently manage security certificates for each edge node. When there are too many edge nodes, this process is not only cumbersome and time-consuming, but also prone to human errors such as inaccurate or incomplete application information. In addition, traditional certificate management solutions rely on manual operations, making it difficult to ensure safe and timely management of certificates, which may cause security certificates to expire and be tampered with by attacks, thereby affecting the normal operation and security of the system.

[0068] In addition, manual management of certificates may lead to irregular management processes, which may lead to inaccurate or incomplete management information. In addition, manual management makes it difficult to ensure timely update and renewal of certificates.

[0069] Edge nodes are responsible for carrying applications and processing tasks. Since they are widely distributed and relatively close to terminal devices, it is crucial to ensure the security of edge nodes and the certificates used by edge nodes for identity authentication.

[0070] In short, in the new era of cloud-network integration, the use of advanced, efficient, and secure certificate management methods can adapt to the ever-changing technical environment and security requirements. In the new era of cloud-network integration, how to manage security certificates safely and efficiently is an urgent problem to be solved.

[0071] In view of this, the certificate management system provided by the present application includes a cloud management platform and an edge node, and the cloud management platform and the edge node are connected in communication via a secure communication link. The edge node is used to send certificate management information to the cloud management platform via a secure communication link. Then the cloud management platform is used to respond to the certificate management information of the edge node and manage the target certificate corresponding to the edge node through a secure communication link. That is to say, in the certificate management system proposed in the present application, the edge node automatically initiates the management of the certificate to the cloud management platform through information interaction. Based on the cloud management platform, the edge nodes can be uniformly managed. Compared with the traditional certificate management scheme, which is difficult to ensure safe and efficient management of certificates, the certificates can be managed efficiently, which improves the timeliness of managing certificates. Moreover, in the present technical solution, the transmission of the relevant management information of the certificate between the edge node and the cloud management platform is based on a secure communication link, which avoids the insecurity caused by manual operation during the certificate management process, and greatly improves the security of certificate management.

[0072] Furthermore, in the certificate management system proposed in the present application, the cloud management platform can actively monitor the status of edge nodes and automatically trigger the management of target certificates corresponding to edge nodes, so as to avoid the problem that edge nodes are unable to manage certificates, resulting in the security of certificates not being effectively guaranteed, thereby improving the security and reliability of certificate management.

[0073] The implementation of the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings.

[0074] Figure 1 The following is a schematic diagram of the architecture of a certificate management system provided in an embodiment of the present application. Figure 1 As shown, the certificate management system includes: a cloud management platform 101 and an edge node 102 .

[0075] The edge node 102 may be one or more. For ease of understanding, Figure 1 Only one is shown.

[0076] The cloud management platform 101 and the edge node 102 are connected via a secure communication link. The secure communication link may be a wired communication link or a wireless communication link, which is not limited in the present application.

[0077] Optionally, the secure communication link is a communication link encrypted using transport layer security (TLS) and / or secure sockets layer (SSL) technology. Of course, the above is only an exemplary introduction to the encryption method of the secure communication link. The secure communication link can also be encrypted using other secure encryption technologies, including but not limited to Internet protocol security (IPsec), secure shell protocol (SSH) and wireless application protocol security (WAP-Security) and other secure encryption technologies, and this application does not impose any restrictions on this.

[0078] In one possible implementation, the edge node 102 is used to send certificate management information to the cloud management platform through a secure communication link; the cloud management platform 101 is used to manage the target certificate corresponding to the edge node through a secure communication link in response to the certificate management information of the edge node.

[0079] Based on the above technical solution, the certificate management system provided by the present application includes a cloud management platform and an edge node, and the cloud management platform and the edge node are connected by a secure communication link. The edge node is used to send certificate management information to the cloud management platform through a secure communication link. Then the cloud management platform is used to respond to the certificate management information of the edge node and manage the target certificate corresponding to the edge node through a secure communication link. That is to say, in the certificate management system proposed in the present application, the edge node automatically initiates the management of the certificate to the cloud management platform through information interaction. Based on the cloud management platform, the edge nodes can be uniformly managed. Compared with the traditional certificate management scheme, which is difficult to ensure safe and efficient management of certificates, the certificates can be managed efficiently, which improves the timeliness of managing certificates. In addition, in the present technical solution, the relevant management information of the certificate transmitted between the edge node and the cloud management platform is realized based on a secure communication link, which avoids the unsafe problems caused by manual operation during the certificate management process, and greatly improves the security of certificate management.

[0080] Furthermore, in the certificate management system proposed in the present application, the cloud management platform can actively monitor the status of edge nodes and automatically trigger the management of target certificates corresponding to edge nodes, so as to avoid the problem that edge nodes are unable to manage certificates, resulting in the security of certificates not being effectively guaranteed, thereby improving the security and reliability of certificate management.

[0081] Optionally, the certificate management information includes at least one of the following: certificate application information, certificate update information, certificate revocation information, and certificate destruction information.

[0082] The certificate application information is used to instruct the cloud management platform to generate a target certificate corresponding to the edge node.

[0083] The certificate update information is used to instruct the cloud management platform to update the target certificate corresponding to the edge node.

[0084] The certificate revocation information is used to instruct the cloud management platform to perform revocation management on the target certificate corresponding to the edge node.

[0085] The certificate destruction information is used to instruct the cloud management platform to perform destruction management on the target certificate corresponding to the edge node.

[0086] The cloud management platform 101 is introduced in detail below.

[0087] In some embodiments, the cloud management platform 101 has the function of actively managing the target certificate corresponding to the edge node 102, and the function of passively managing the target certificate corresponding to the edge node 102. In the following, the function of the cloud management platform 101 passively managing the target certificate corresponding to the edge node 102 is introduced through Example 1. The function of the cloud management platform 101 actively managing the target certificate corresponding to the edge node 102 is introduced through Example 2.

[0088] In some embodiments, in response to the certificate destruction information of the edge node 102, the cloud management platform is further configured to send an alarm message to the client before, after, or simultaneously with the destruction of the target certificate of the edge node.

[0089] The alarm information is used to reflect that the target certificate of the edge node has been destroyed.

[0090] Optionally, the warning information includes the reason for destruction.

[0091] Embodiment 1:

[0092] In some embodiments, in response to the certificate application information of the edge node 102, the cloud management platform 101 is specifically used to generate a target certificate corresponding to the edge node 102, and send the target certificate to the edge node 102 through a secure communication link.

[0093] In combination with the composition structure of the cloud management platform 101, in a possible implementation, Figure 2 As shown, the cloud management platform 101 includes a certificate generation module and a certificate distribution module. Each module in the cloud management platform 101 communicates through a unified interface. For example, the certificate generation module and the certificate distribution module communicate through a unified interface.

[0094] Optionally, the certificate distribution module is used to receive certificate application information from the edge node 102, and in response to the certificate application information, call the certificate generation module through the unified interface to generate a target certificate corresponding to the edge node 102. The certificate generation module sends the target certificate to the certificate distribution module through the unified interface. In turn, the certificate distribution module sends / issues the target certificate to the edge node 102 through the unified interface and through a secure communication link.

[0095] In some embodiments, in response to the certificate update information of the edge node, the cloud management platform 101 performs update management on the target certificate corresponding to the edge node 102 and sends the updated target certificate to the edge node 102 through a secure communication link.

[0096] In combination with the composition structure of the cloud management platform 101, in a possible implementation, Figure 2 As shown, the cloud management platform 101 also includes a certificate update module.

[0097] Optionally, the cloud management platform 101 is also used to receive certificate update information from the edge node 102 (for example, the certificate management module in the edge node 102), and in response to the certificate update information, call the certificate update module through a unified calling interface to update the target certificate corresponding to the edge node to obtain an updated target certificate.

[0098] Furthermore, the cloud management platform 101 is also used to call the certificate distribution module through the unified interface to send the updated target certificate to the edge node 102 through the secure communication link.

[0099] In some embodiments, in response to the certificate revocation information of the edge node 102 , the cloud management platform 101 performs revocation management on the target certificate corresponding to the edge node 102 .

[0100] Optionally, the word "revoke" in the embodiments of the present application can be replaced by "cancel". That is, in the embodiments of the present application, "revoke" and "cancel" have the same meaning. Of course, the word "revoke" in the embodiments of the present application can also be other words with similar meanings, such as "cancel", "cancel", "reclaim", "repeale", "annul", and "terminate", and the present application does not limit this.

[0101] In combination with the composition structure of the cloud management platform 101, in a possible implementation, Figure 2 As shown, the cloud management platform 101 also includes a certificate revocation module.

[0102] Optionally, the cloud management platform 101 is also used to receive certificate revocation information from the edge node 102 (e.g., the certificate management module in the edge node 102), and in response to the certificate revocation information, call the certificate revocation module through a unified calling interface to perform revocation management on the target certificate corresponding to the edge node 102.

[0103] In some embodiments, in response to the certificate destruction information of the edge node 102 , the cloud management platform 101 performs destruction management on the target certificate corresponding to the edge node 102 .

[0104] In one possible implementation, Figure 2 As shown, the cloud management platform 101 also includes a certificate destruction module.

[0105] Optionally, the cloud management platform 101 receives certificate revocation information from the edge node 102. Based on the certificate revocation information, the cloud management platform calls the certificate destruction module through a unified calling interface to perform a destruction operation on the target certificate. The certificate destruction information is generated by the edge node 102 when the node is offline or the certificate expires.

[0106] In the above, the function of the cloud management platform 101 passively managing the target certificate corresponding to the edge node 102 is introduced through Example 1.

[0107] Embodiment 2:

[0108] In some embodiments, the cloud management platform 101 is also used to monitor one or more of the operating status of the edge node, the security status and validity status of the certificate corresponding to the edge node. In the case where it is monitored that the operating status of the edge node 102 is abnormal and / or the target certificate corresponding to the edge node 102 is in an unsafe state, the target certificate of the edge node 102 is revoked and / or destroyed. Alternatively, after the validity period of the target certificate corresponding to the edge node 102 is monitored to have expired, the target certificate after the expiration is updated and the updated target certificate is sent to the edge node through a secure communication link.

[0109] In a possible implementation, in combination with the composition structure of the cloud management platform 101, as Figure 2 As shown, the cloud management platform 101 also includes an edge certificate monitoring module.

[0110] Optionally, the cloud management platform 101 is used to call the edge certificate monitoring module through a unified calling interface to monitor the running status of the target certificate of the edge node 102 and the security status of the target certificate corresponding to the edge node 102 .

[0111] In a possible implementation, when the cloud management platform 101 detects that the running state of the edge node 102 is abnormal and / or the target certificate is in an unsafe state, the cloud management platform 101 calls the certificate revocation module through a unified calling interface to perform revocation processing on the target certificate of the edge node 102, and sends the certificate revocation result to the edge node 102. The certificate revocation result is used to indicate that the target certificate of the edge node 102 has been revoked.

[0112] In one possible implementation, in combination with the composition structure of the cloud management platform 101, the cloud management platform 101 calls the edge certificate monitoring module through a unified calling interface to monitor the validity status of the target certificate of the edge node 102, and after the validity period of the target certificate expires, calls the certificate update module through the unified interface to update the target certificate of the edge node 102 to obtain an updated target certificate.

[0113] Furthermore, the cloud management platform 101 is also used to call the certificate distribution module through the unified interface and send the updated target certificate to the edge node 102 through the secure communication link.

[0114] Optionally, in a possible implementation, in combination with the composition structure of the cloud management platform 101, after the target certificate is revoked, the cloud management platform 101 calls the certificate destruction module through a unified calling interface to destroy the revoked target certificate. And, after the target certificate is updated, the cloud management platform 101 calls the certificate destruction module through a unified interface to destroy the target certificate after the validity period expires.

[0115] In the above, the function of the cloud management platform 101 actively managing the target certificate corresponding to the edge node 102 is introduced through Example 2.

[0116] Optionally, in some embodiments, the cloud management platform 101 further includes a visualization interface. The cloud management platform 101 displays the certificate information of the target certificate (e.g., the validity period of the target certificate, the edge node to which it belongs, the alarm information, and the alarm reason, etc.) in real time through the visualization interface, so that the staff can understand the status of the target certificate in a timely manner and maintain the target certificate.

[0117] The edge node 102 is described in detail below.

[0118] In some embodiments, the edge node 102 can be used to monitor the operating status of the edge node and the status of the target certificate corresponding to the edge node; and based on the operating status of the edge node and the status of the target certificate corresponding to the edge node, send certificate management information to the cloud management platform through a secure communication link to achieve automated management of the target certificate.

[0119] The status of the target certificate corresponding to the edge node includes the validity status of the target certificate and the security status of the target certificate.

[0120] In one possible implementation, Figure 2 As shown, the edge node 102 includes a certificate management module, a certificate storage module and a business application.

[0121] Among them, the certificate management module in the edge node 102 is connected to the certificate distribution module in the cloud management platform 101 through a secure communication link. That is to say, when the certificate management module in the edge node 102 and the certificate distribution module in the cloud management platform 101 perform the transmission business on the target certificate, the transmission is based on the secure communication link, so as to ensure the security of the target certificate during the transmission process.

[0122] In a possible implementation, the edge node 102 is used to send certificate application information to the cloud management platform 101 (e.g., a certificate distribution module in the cloud management platform 101). The edge node 102 is also used to receive a target certificate issued by the cloud management platform 101 through the certificate management module, install the target certificate, and store the target certificate in the certificate storage module, so that the edge node can apply the stored target certificate for identity authentication.

[0123] Optionally, the certificate storage module may be a hardware security module (HSM) or a storage space created based on a technical execution environment (TEE). Of course, the above is only an exemplary description of the certificate storage module, and the certificate storage module may also be a secure application; or, in the future, the certificate storage module may be other storage devices with secure storage properties, and this application does not impose any restrictions on this.

[0124] It should be noted that HSM provides encryption functions, including key generation, encryption / decryption operations, digital signatures and authentication, etc. That is to say, all operations of the edge node 102 on the target certificate are performed in the internal security environment. For the executable environment, the executable environment is a combination of software and hardware security storage technology used to protect the security of applications and certificates in the edge node. The executable environment supports a variety of encryption algorithms and security protocols to ensure the security of the target certificate; and the executable environment is also used to ensure the integrity of the application and prevent it from being invaded by malicious code. For secure applications, secure applications support the storage of certificates and keys on secure applications.

[0125] Furthermore, the service application in the edge node 102 can obtain the target certificate from the certificate storage module, and then use the target certificate for identity authentication.

[0126] In another possible implementation, the edge node 102 is further configured to monitor the validity status of the target certificate through the certificate management module. After the validity period expires, the edge node 102 sends certificate update information to the cloud management platform 101 through the certificate management module and the secure communication link to instruct the cloud management platform 101 to perform update management on the target certificate.

[0127] In another possible implementation, the edge node 102 may call the certificate management module to actively send certificate revocation information to apply for revocation of the target certificate when the operating status of the edge node is abnormal (for example, the node is offline, or the length of time the node is offline exceeds a preset length of time) or the status of the target certificate is abnormal (including expiration of the validity period and the certificate being in an unsafe state).

[0128] Figure 3 A flow chart of a certificate management method provided in an embodiment of the present application. The method can be applied to Figure 1 In the certificate management system shown in Figure 3 As shown, the method includes the following S301-S302.

[0129] S301, the edge node sends certificate management information to the cloud management platform through a secure communication link. Correspondingly, the cloud management platform receives the certificate management information from the edge node based on the secure communication link.

[0130] Optionally, the certificate management information may include identity information of the edge node, so as to verify the identity of the edge node.

[0131] The identity information of the edge node may include the device identification of the edge node, the IP address of the edge node, and the identification of the user corresponding to the edge node. Of course, the above is only an exemplary introduction to the identity information of the edge node. The identity information of the edge node may also be other information that can uniquely identify the identity of the edge node, and this application does not impose any restrictions on this.

[0132] Optionally, the certificate management information may also include a public key of the edge node, which is used to encrypt the certificate management information and / or the target certificate, thereby further preventing the certificate management information and / or the target certificate from being tampered with during transmission.

[0133] The public key of the edge node is a public key in a key pair generated by the edge node. The public key of the edge node is specifically used to encrypt or decrypt data when the edge node transmits data (target certificate and / or relevant information of the target certificate) with the cloud management platform.

[0134] Optionally, the certificate management information may include certificate application information, certificate update information, certificate revocation information, and certificate destruction information.

[0135] The certificate application information is used to instruct the cloud management platform to generate a target certificate corresponding to the edge node.

[0136] The certificate update information is used to instruct the cloud management platform to update the target certificate corresponding to the edge node.

[0137] The certificate revocation information is used to instruct the cloud management platform to perform revocation management on the target certificate corresponding to the edge node.

[0138] The certificate destruction information is used to instruct the cloud management platform to perform destruction management on the target certificate corresponding to the edge node.

[0139] Of course, the above is only an exemplary description of the certificate management information, and the certificate management information may also be certificate verification information. The certificate verification information is used to instruct the cloud management platform to verify the security status of the target certificate corresponding to the edge node.

[0140] In one possible implementation, the implementation process of S301 may be: the edge node monitors the operating status of the edge node and the status of the target certificate corresponding to the edge node; and based on the operating status of the edge node and the status of the target certificate corresponding to the edge node, sends certificate management information to the cloud management platform through a secure communication link.

[0141] The state of the target certificate corresponding to the edge node includes the validity state of the target certificate and the security state of the target certificate. For the running state of the edge node and the security state of the target certificate corresponding to the edge node, refer to the description of the running state of the edge node and the security state of the target certificate corresponding to the edge node in the embodiment shown in S501-S502, which will not be repeated here.

[0142] Optionally, as shown, the edge node monitors the validity status of the target certificate; after the validity period expires, the edge node sends certificate update information to the cloud management platform through a secure communication link to instruct the cloud management platform to update the target certificate. Alternatively, the edge node can also actively and regularly send certificate update information to the cloud management platform through a secure communication link based on a preset policy (for example, based on a preset period) to instruct the cloud management platform to update the target certificate.

[0143] Optionally, as shown, when the operating status of the edge node is abnormal (for example, the node is offline, or the length of time the node is offline exceeds a preset length of time) or the security status of the target certificate is abnormal (for example, the certificate is in an insecure state), certificate revocation information or certificate destruction information is actively sent to the cloud management platform through a secure communication link to perform revocation management or destruction management on the target certificate.

[0144] S302: The cloud management platform manages the target certificate corresponding to the edge node through a secure communication link in response to the certificate management information of the edge node.

[0145] In a possible implementation, the certificate management information is certificate application information, such as Figure 4 As shown, the implementation process of S302 may be: the cloud management platform generates a target certificate corresponding to the edge node, and sends the target certificate to the edge node via a secure communication link. Correspondingly, the edge node receives the target certificate via the secure communication link.

[0146] Optionally, the target certificate corresponding to the edge node generated by the cloud management platform contains a public key and a private key pair. The edge node can use the public key and private key pair in the target certificate for identity authentication and information security.

[0147] Optionally, after receiving the target certificate, the edge node installs the target certificate and stores the target certificate based on a secure storage mechanism.

[0148] In another possible implementation, the certificate management information is certificate update information, such as Figure 4 As shown, the implementation process of S302 may be: the cloud management platform updates the target certificate corresponding to the edge node and sends the updated target certificate to the edge node via a secure communication link. Correspondingly, the edge node receives the updated target certificate from the cloud management platform via a secure communication link.

[0149] In another possible implementation, corresponding to the certificate management information being certificate revocation information, the implementation process of S302 may be: the cloud management platform performs revocation management on the target certificate corresponding to the edge node.

[0150] In another possible implementation, corresponding to the certificate management information being certificate destruction information, the implementation process of S302 may be: the cloud management platform performs destruction management on the target certificate corresponding to the edge node.

[0151] Optionally, in a possible implementation, in response to the certificate revocation information and / or certificate destruction information, the cloud management platform sends first indication information to the edge node through a secure communication link, wherein the first indication information is used to instruct the edge node to stop using the target certificate.

[0152] Optionally, in a possible implementation, the certificate management information corresponds to certificate destruction information. After S302, the cloud management platform sends an alarm message to the client before destroying the target certificate of the edge node, after destroying the target certificate of the edge node, or at the same time as destroying the target certificate of the edge node.

[0153] The alarm information is used to reflect that the target certificate of the edge node has been destroyed.

[0154] Optionally, the warning information includes a destruction reason, for example, the destruction reason may be that the target certificate is in an unsafe state or the target certificate has expired.

[0155] Based on the above technical solution, the certificate management method provided by the present application, the edge node sends certificate management information to the cloud management platform through a secure communication link. Then the cloud management platform responds to the certificate management information of the edge node and manages the target certificate corresponding to the edge node through a secure communication link. In other words, in the certificate management system proposed in the present application, the edge node automatically initiates the management of the certificate to the cloud management platform through information interaction. Based on the cloud management platform, the edge nodes can be managed uniformly. Compared with the traditional certificate management scheme, it is difficult to ensure the safe and efficient management of certificates. The certificates can be managed efficiently, and the timeliness of managing certificates is improved. In addition, in the present technical solution, the transmission of relevant management information of the certificate between the edge node and the cloud management platform is based on a secure communication link, which avoids the unsafe problems caused by manual operation during the certificate management process, and greatly improves the security of certificate management.

[0156] Furthermore, in the certificate management system proposed in the present application, the cloud management platform can actively monitor the status of edge nodes and automatically trigger the management of target certificates corresponding to edge nodes, so as to avoid the problem that edge nodes are unable to manage certificates, resulting in the security of certificates not being effectively guaranteed, thereby improving the security and reliability of certificate management.

[0157] The following specifically introduces the process in which the cloud management platform actively monitors the status of edge nodes and automatically triggers the management of target certificates corresponding to edge nodes through the embodiments shown in S501-S504.

[0158] As a possible embodiment of the present application, Figure 3 ,like Figure 5 As shown, the process of the cloud management platform actively triggering the management of the target certificate can be implemented through the following S501-S504.

[0159] S501. The cloud management platform monitors one or more of the operating status of the edge node, the security status and the validity status of the target certificate corresponding to the edge node.

[0160] Optionally, the security status includes at least one of the following: whether the certificate issuing authority of the target certificate is in the preset authority whitelist, whether the website configured in the target certificate is the same as the website actually accessed by the target certificate. Of course, the above is only an exemplary description of the security status, and the security status of the target certificate can also be specifically to detect whether the target certificate is attacked, etc., which is not limited here.

[0161] S502: When the cloud management platform detects that the running state of the edge node is abnormal and / or the target certificate corresponding to the edge node is in an unsafe state, the cloud management platform performs revocation management and / or destruction management on the target certificate corresponding to the edge node.

[0162] Optionally, the abnormal operation status of the edge node may specifically be that the edge node is offline, or the offline duration of the edge node is greater than a preset duration. In this case, it means that the edge node no longer needs to use the target certificate. Revocation management and / or destruction management of the target certificate of the edge node can save resource space and prevent the certificate from being abused or leaked.

[0163] Optionally, the target certificate is in an unsafe state, specifically, the certificate issuing authority of the target certificate is not in the preset authority whitelist, the website configured in the target certificate is different from the website actually accessed by the target certificate, or the target certificate is attacked. In this case, it means that the target certificate can no longer meet the security requirements of the edge node. Therefore, revocation management and / or destruction management of the target certificate of the edge node can save resource space, and can also prevent the edge node from continuing to use the certificate for identity authentication, thereby ensuring the security of the edge node.

[0164] In a possible implementation, after S502, the cloud management platform sends first indication information to the edge node through a secure communication link, wherein the first indication information is used to instruct the edge node to stop using the target certificate to ensure the security of the edge node.

[0165] S503: After monitoring that the validity period of the target certificate corresponding to the edge node has expired, the cloud management platform performs update management on the target certificate after the validity period has expired.

[0166] It is understandable that the cloud management platform actively manages the update of target certificates after their validity period expires, which can ensure that the edge node side always uses a valid target certificate for identity authentication, avoiding the problem of edge nodes being unable to operate or running unsafely due to the expiration of the certificate validity period.

[0167] Optionally, the cloud management platform may also periodically manage the update of the target certificate corresponding to the edge node based on a preset policy (for example, based on a preset period).

[0168] S504: The cloud management platform sends the updated target certificate to the edge node via the secure communication link. Correspondingly, the edge node receives the updated target certificate from the cloud management platform via the secure communication link.

[0169] It should be noted that the present application does not limit the execution order of S502 and S503-S504. S502 can be executed simultaneously with S503-S504, S502 can also be executed before S503-S504, or S502 can also be executed after S503-S504.

[0170] and, Figure 5It is only an exemplary description of the certificate management scheme, and does not limit the execution sequence of S301-S302 and S501-S503. That is to say, in the embodiment of the present application, S301-S302 and S501-S503 are parallel schemes, S301-S302 and S501-S503 can be executed at the same time, S301-S302 can be executed before S501-S503, and S301-S302 can also be executed after S501-S503. The present application does not limit the execution sequence of S501-S503.

[0171] Based on the above technical solution, the cloud management platform monitors one or more of the operating status of the edge node, the security status of the target certificate, and the validity status of the corresponding target certificate. When the cloud management platform monitors that the operating status of the edge node is abnormal and / or the target certificate is in an unsafe state, the cloud management platform performs revocation management and / or destruction management on the target certificate of the edge node. Alternatively, after the cloud management platform monitors that the validity period of the target certificate corresponding to the edge node has expired, it performs update management on the target certificate after the validity period has expired, and sends the updated target certificate to the edge node through a secure communication link. According to the above technical solution, the cloud management platform can actively monitor the status of the edge node and automatically trigger the management of the target certificate corresponding to the edge node to avoid the problem that the edge node cannot manage the certificate, resulting in the security of the certificate not being effectively guaranteed, thereby improving the security and reliability of certificate management.

[0172] In some embodiments, the process of establishing a secure communication link in the above-mentioned embodiments of the present application may be: the cloud management platform establishes a secure communication link with the edge node.

[0173] In a possible implementation, the communication link between the cloud management platform and the edge node is encrypted using the SSL protocol and / or the TLS protocol. Both the SSL protocol and the TLS protocol can encrypt, verify integrity, and authenticate identity of the communication data. When the cloud management platform establishes a connection with the edge node, the encryption algorithm and key are negotiated through the SSL and / or TLS handshake process, and then the negotiated key and algorithm are used to encrypt the communication data (including but not limited to the target certificate or data information related to the certificate), so as to achieve the effect of secure transmission.

[0174] In another possible implementation, a VPN tunnel is established and the communication link between the cloud management platform and the edge node is encapsulated in the VPN tunnel. VPN uses encryption and tunneling technology to establish a secure, encrypted private communication tunnel in the public network to prevent the data between the cloud management platform and the edge node from being stolen and tampered with.

[0175] In another possible implementation, the communication link may be a communication link based on the hypertext transfer protocol (HTTP). An SSL / TLS encryption layer is added to the communication link based on the HTTP protocol. The cloud management platform and the edge node may transmit the target certificate and data information related to the target certificate based on an encrypted communication link based on the HTTPS protocol to ensure the confidentiality and integrity of the data during transmission. Among them, the HTTPS protocol is widely used in secure communications on the Internet, such as online banking, e-commerce and other scenarios.

[0176] Optionally, regarding the secure communication link, refer to the introduction to the secure communication link in the certificate management system section of this application, and will not be repeated here.

[0177] The embodiment of the present application can divide the certificate management device into functional modules or functional units according to the above method example. For example, each functional module or functional unit can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules or functional units. Among them, the division of modules or units in the embodiment of the present application is schematic, which is only a logical functional division. There may be other division methods in actual implementation.

[0178] like Figure 6 , which is a schematic diagram of the structure of a certificate management device 60 provided in an embodiment of the present application. The certificate management device 60 includes: a communication unit 601 and a processing unit 602.

[0179] The communication unit 601 is used to send certificate management information to the cloud management platform through a secure communication link; the processing unit 602 is used to respond to the certificate management information of the edge node and manage the target certificate corresponding to the edge node through a secure communication link.

[0180] In one possible implementation, the processing unit 602 is also used to monitor the operating status of the edge node and the status of the target certificate corresponding to the edge node; and based on the operating status of the edge node and the status of the target certificate corresponding to the edge node, send certificate management information to the cloud management platform through the communication unit 601 and the secure communication link; wherein, the status of the target certificate corresponding to the edge node includes the validity status of the target certificate and the security status of the target certificate.

[0181] In a possible implementation manner, the certificate management information includes at least one of the following: certificate application information, certificate update information, certificate revocation information, and certificate destruction information.

[0182] The certificate application information is used to instruct the cloud management platform to generate a target certificate corresponding to the edge node.

[0183] The certificate update information is used to instruct the cloud management platform to update the target certificate corresponding to the edge node.

[0184] The certificate revocation information is used to instruct the cloud management platform to perform revocation management on the target certificate corresponding to the edge node.

[0185] The certificate destruction information is used to instruct the cloud management platform to perform destruction management on the target certificate corresponding to the edge node.

[0186] In a possible implementation, the processing unit 602 may be specifically configured to: generate a target certificate corresponding to the edge node in response to the certificate application information of the edge node, and send the target certificate to the edge node through the communication unit 601 and the secure communication link.

[0187] In a possible implementation, the processing unit 602 may be further configured to: in response to certificate update information of the edge node, perform update management on the target certificate corresponding to the edge node, and send the updated target certificate to the edge node through the communication unit 601 and the secure communication link.

[0188] In a possible implementation, the processing unit 602 may be further configured to: perform revocation management on a target certificate corresponding to the edge node in response to certificate revocation information of the edge node.

[0189] In a possible implementation, the processing unit 602 may be further configured to: in response to the certificate destruction information of the edge node, perform destruction management on the target certificate corresponding to the edge node.

[0190] In one possible implementation, in response to the certificate destruction information of the edge node, the communication unit 601 is also used to send an alarm message to the client before, after or at the same time as the target certificate of the edge node is destroyed; the alarm message is used to reflect that the target certificate of the edge node has been destroyed.

[0191] Optionally, the warning information includes the reason for destruction.

[0192] In a possible implementation, the processing unit 602 is also used to monitor one or more of the operating status of the edge node, the security status and validity status of the target certificate corresponding to the edge node; when it is monitored that the operating status of the edge node is abnormal and / or the target certificate corresponding to the edge node is in an unsafe state, the target certificate corresponding to the edge node is revoked and / or destroyed. Alternatively, after the validity period of the target certificate corresponding to the edge node is monitored to have expired, the target certificate after the expiration is updated and the updated target certificate is sent to the edge node through the communication unit 601 and the secure communication link.

[0193] In a possible implementation, the processing unit 602 is further configured to install a target certificate, and store the target certificate based on a secure storage mechanism, so that the edge node can apply the stored target certificate to perform identity authentication.

[0194] In a possible implementation, the certificate management device 60 may further include a storage unit 603 ( Figure 6 The storage unit 603 stores a program or instruction. When the processing unit 602 executes the program or instruction, the certificate management device 60 can execute the certificate management method described in the above method embodiment.

[0195] When implemented by hardware, an embodiment of the present application further provides an electronic device, the device comprising a processor and a memory configured to store instructions executable by the processor, wherein the processor is configured to execute instructions to execute the certificate management method described in the above method embodiment.

[0196] Specifically, Figure 7 A hardware structure diagram of an electronic device provided for an embodiment of the present application. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0197] like Figure 7 As shown, the electronic device includes at least one processor 701, a communication line 702, a memory 703 configured to store processor executable instructions, and at least one communication interface 704. The processor 701, the memory 703, and the communication interface 704 can be connected via the communication line 702.

[0198] Processor 701 can be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application, such as: one or more digital signal processors (DSP), or one or more field programmable gate arrays (FPGA).

[0199] The communication link 702 may include a pathway for transmitting information between the above-mentioned components.

[0200] The communication interface 704 is used to communicate with other devices or communication networks, and can use any transceiver-like device, such as Ethernet, radio access network (RAN), wireless local area network (WLAN), etc.

[0201] The memory 703 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, an optical disc storage (including compressed optical discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to include or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.

[0202] In one possible design, the memory 703 can exist independently of the processor 701, that is, the memory 703 can be a memory outside the processor 701. In this case, the memory 703 can be connected to the processor 701 through the communication line 702, and is used to store execution instructions or application code, and the processor 701 controls the execution to implement the certificate management method provided in the following embodiment of the present application. In another possible design, the memory 703 can also be integrated with the processor 701, that is, the memory 703 can be the internal memory of the processor 701, for example, the memory 703 is a high-speed cache, which can be used to temporarily store some data and instruction information.

[0203] As a possible implementation, the processor 701 may include one or more CPUs, for example Figure 7 As another possible implementation, the electronic device may include multiple processors, such as Figure 7 As another possible implementation, the electronic device may further include an output device 705 and an input device 706.

[0204] The input device 706 is, for example, a keyboard, a mouse, etc.

[0205] The output device 705 is, for example, various types of displays, speakers, etc.

[0206] It should be pointed out that the various embodiments of the present application can learn from or refer to each other. For example, the same or similar steps, method embodiments, system embodiments and device embodiments can all refer to each other without limitation.

[0207] Through the description of the above implementation methods, technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0208] An embodiment of the present application provides a computer program product including instructions. When the computer program product is run on a computer, the computer is enabled to execute the certificate management method in the above method embodiment.

[0209] The embodiment of the present application also provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a computer, the computer executes the certificate management method in the method flow shown in the above method embodiment.

[0210] Among them, the computer readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a register, a hard disk, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above, or any other form of computer readable storage medium known in the art. An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an application-specific integrated circuit (ASIC). In the embodiments of the present application, a computer-readable storage medium may be any tangible medium that contains or stores a program, which may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0211] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays, application specific integrated circuits, application specific standard parts (ASSPs), system on chip systems (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0212] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0213] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user, such as a cathode ray tube (CRT) or a liquid crystal display (LCD) monitor; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and the input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0214] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network, a wide area network (WAN), and the Internet.

[0215] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0216] Since the electronic device, computer-readable storage medium, and computer program product in the embodiments of the present application can be applied to the above-mentioned method, the technical effects that can be obtained can also refer to the above-mentioned method embodiments, and the embodiments of the present application will not be repeated here.

[0217] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0218] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of this disclosure can be achieved, and this document is not limited here.

[0219] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

[0220] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0221] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0222] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A certificate management system, characterized in that: The system comprises: a cloud management platform and an edge node; the cloud management platform and the edge node are communicatively connected via a secure communication link; The edge node is used to send certificate management information to the cloud management platform through the secure communication link; The cloud management platform is used to manage the target certificate corresponding to the edge node through the secure communication link in response to the certificate management information of the edge node.

2. The certificate management system according to claim 1, characterized in that: The edge node is capable of monitoring the operating status of the edge node and the status of the target certificate corresponding to the edge node; and based on the operating status of the edge node and the status of the target certificate corresponding to the edge node, sending the certificate management information to the cloud management platform through the secure communication link; The status of the target certificate corresponding to the edge node includes the validity status of the target certificate and the security status of the target certificate.

3. The certificate management system according to claim 1 or 2, characterized in that: The certificate management information includes at least one of the following: certificate application information, certificate update information, certificate revocation information, and certificate destruction information; The certificate application information is used to instruct the cloud management platform to generate a target certificate corresponding to the edge node; The certificate update information is used to instruct the cloud management platform to update the target certificate corresponding to the edge node; The certificate revocation information is used to instruct the cloud management platform to perform revocation management on the target certificate corresponding to the edge node; The certificate destruction information is used to instruct the cloud management platform to perform destruction management on the target certificate corresponding to the edge node.

4. The certificate management system according to claim 3, characterized in that: In response to the certificate application information of the edge node, the cloud management platform generates a target certificate corresponding to the edge node, and sends the target certificate to the edge node through the secure communication link; In response to the certificate update information of the edge node, the cloud management platform performs update management on the target certificate corresponding to the edge node, and sends the updated target certificate to the edge node through the secure communication link; In response to the certificate revocation information of the edge node, the cloud management platform performs revocation management on the target certificate corresponding to the edge node; In response to the certificate destruction information of the edge node, the cloud management platform performs destruction management on the target certificate corresponding to the edge node.

5. The certificate management system according to claim 4, characterized in that: In response to the certificate destruction information of the edge node, the cloud management platform is also used to send an alarm message to the client before, after or at the same time as destroying the target certificate of the edge node; the alarm message is used to reflect that the target certificate of the edge node has been destroyed.

6. The certificate management system according to claim 1, characterized in that: The cloud management platform is also used to monitor the operating status of the edge node, the security status and validity status of the target certificate corresponding to the edge node; when it is monitored that the operating status of the edge node is abnormal and / or the target certificate corresponding to the edge node is in an unsafe state, the target certificate corresponding to the edge node is revoked and / or destroyed; or after the validity period of the target certificate corresponding to the edge node expires, the target certificate after the expiration is updated and the updated target certificate is sent to the edge node through the secure communication link.

7. The certificate management system according to claim 1, characterized in that: The edge node is further configured to install the target certificate and store the target certificate based on a secure storage mechanism, so that the edge node can apply the stored target certificate to perform identity authentication.

8. A certificate management method, characterized in that: Applied to a certificate management system, the certificate management system includes a cloud management platform and an edge node, the cloud management platform and the edge node are communicatively connected via a secure communication link, the method includes: The edge node sends certificate management information to the cloud management platform through the secure communication link; The cloud management platform manages the target certificate corresponding to the edge node through the secure communication link in response to the certificate management information of the edge node.

9. An electronic device, characterized in that: include: processor; a memory configured to store instructions executable by the processor; The processor is configured to execute the instructions to implement the certificate management method as claimed in claim 8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when a computer executes the instructions, the computer executes the certificate management method according to claim 8.

Images