Certificate acquisition system and certificate acquisition method

Abstract

The embodiment of the invention provides a certificate acquisition system and a certificate acquisition method, the certificate acquisition system comprises a user side, a registration side and a certificate issuing side, the user side is used for generating a certificate registration request and sending the certificate registration request to the registration side; the registration end is used for analyzing the certificate registration request to obtain certificate registration parameters and sending the certificate registration parameters and the certificate making request to the certificate issuing end; and the certificate issuing end is used for generating a signature certificate and an encryption certificate according to the certificate registration parameter and the certificate making request, and sending the signature certificate and the encryption certificate to the registration end, and the registration end sends the signature certificate and the encryption certificate to the user end, so that the user end imports the signature certificate and the encryption certificate. According to the certificate acquisition system provided by the embodiment of the invention, the user can acquire the signature certificate and the encryption certificate, and the certificate acquisition experience of the user is improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of information security technology, and in particular, to a certificate acquisition system and a certificate acquisition method. Background Art

[0002] With the development of technologies such as artificial intelligence, big data, and cloud computing, digital certificates are widely used in various electronic transactions, data encryption, and identity authentication systems, providing users and systems with a reliable means of identity authentication. The management of digital certificates is an important part of ensuring the security of network communications.

[0003] Currently, the acquisition and storage of digital certificates are usually implemented by Public Key Infrastructure (PKI).

[0004] However, the existing technology usually involves multiple interactions between PKI systems during the process of obtaining and storing digital certificates, which results in low efficiency in obtaining certificates and requires users to operate in multiple systems, resulting in a poor user experience in obtaining certificates. Summary of the invention

[0005] In view of this, embodiments of the present application provide a certificate acquisition system and a certificate acquisition method to at least partially solve the above problems.

[0006] According to the first aspect of the embodiment of the present application, a certificate acquisition system is provided, which includes: a user end, a registration end and a certificate issuing end; the user end is used to generate a certificate registration request and send the certificate registration request to the registration end; the registration end is used to parse the certificate registration request, obtain certificate registration parameters, and send the certificate registration parameters and the certificate production request to the certificate issuing end; the certificate issuing end is used to generate a signature certificate and an encryption certificate according to the certificate registration parameters and the certificate production request, and send the signature certificate and the encryption certificate to the registration end, and the registration end sends the signature certificate and the encryption certificate to the user end, so that the user end imports the signature certificate and the encryption certificate.

[0007] In a possible implementation manner, the user terminal is used to obtain the certificate registration information input by the user from the registration terminal, and generate the certificate registration request according to the certificate registration information.

[0008] In one possible implementation, the system also includes: a key end; and a certificate issuing end, which is used to verify the certificate request. If the certificate request is verified, the key end is called to generate a public-private key pair. The certificate issuing end generates the signature certificate and encryption certificate based on the public-private key pair and the certificate registration parameters.

[0009] In a possible implementation, the system further includes: a hardware security module; and the key end, configured to call the hardware security module to generate the public-private key pair.

[0010] In a possible implementation, the key end is used to obtain the symmetric key generated by the hardware security module, and encrypt the private key in the public-private key pair by using the symmetric key.

[0011] In a possible implementation, the key end is used to obtain a temporary public key in the certificate registration parameters, and encrypt the symmetric key by using the temporary public key.

[0012] In a possible implementation, the registration end is used to receive the signature certificate, the encryption certificate and the encrypted private key sent by the certificate issuing end, and verify the signature certificate, the encryption certificate and the encrypted private key. If the verification is successful, the signature certificate, the encryption certificate and the encrypted private key are sent to the user end.

[0013] In one possible implementation, the user terminal is used to receive the signing certificate, the encryption certificate and the encrypted private key, and decrypt the encrypted symmetric key by a temporary private key, and decrypt the private key according to the symmetric key, and store the signing certificate, the encryption certificate and the decrypted private key, wherein the user terminal generates the temporary public key and the temporary private key when generating a certificate registration request.

[0014] In a possible implementation manner, the user end, the registration end, and the certificate issuing end communicate via HTTPS.

[0015] According to the second aspect of an embodiment of the present application, a certificate acquisition method is provided, including: generating a certificate registration request; parsing the certificate registration request to obtain certificate registration parameters; generating a signature certificate and an encryption certificate based on the certificate registration parameters and the certificate request; importing and storing the signature certificate and the encryption certificate.

[0016] According to the certificate acquisition system provided in the embodiment of the present application, the certificate acquisition system includes: a user end, a registration end and a certificate issuing end. The user end can generate a certificate registration request and send the certificate registration request to the registration end. The registration end can parse the certificate registration request, obtain the certificate registration parameters, and send the certificate registration parameters and the certificate production request to the certificate issuing end. The certificate issuing end can generate a signature certificate and an encryption certificate according to the certificate registration parameters and the certificate production request, and send the signature certificate and the encryption certificate to the registration end. The registration end sends the signature certificate and the encryption certificate to the user end, so that the user end imports the signature certificate and the encryption certificate, and the acquisition and storage of the signature certificate and the encryption certificate can be realized. Compared with the prior art, the interaction process between the registration end and the certificate issuing end is optimized, unnecessary steps can be reduced, thereby improving the efficiency of certificate acquisition, and the user only needs to generate a certificate registration request on the user end to complete the entire process of certificate acquisition and storage, which can improve the user's certificate acquisition experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0018] Figure 1 is a schematic diagram of a certificate acquisition system provided in an embodiment of the present application;

[0019] Figure 2 is a schematic diagram of another certificate acquisition system provided in an embodiment of the present application;

[0020] Figure 3 is a schematic diagram of another certificate acquisition system provided in an embodiment of the present application;

[0021] Figure 4 This is a flow chart of a certificate acquisition method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the embodiments of the present application should fall within the scope of protection of the embodiments of the present application.

[0023] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0024] It should be understood that although the terms first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0025] As mentioned above, with the development of technologies such as artificial intelligence, big data, and cloud computing, digital certificates are widely used in various electronic transactions, data encryption, and identity authentication systems, providing users and systems with a reliable means of identity authentication. The management of digital certificates is an important part of ensuring the security of network communications. At present, the acquisition and storage of digital certificates are usually implemented by PKI. However, in the process of obtaining and storing digital certificates, the existing technology usually involves multiple interactions between PKI systems, the efficiency of certificate acquisition is low, and users are required to operate in multiple systems, resulting in a poor user experience in obtaining certificates.

[0026] The embodiment of the present application provides a certificate acquisition system, which includes: a user end, a registration end and a certificate issuing end. The user end can generate a certificate registration request and send the certificate registration request to the registration end. The registration end can parse the certificate registration request, obtain certificate registration parameters, and send the certificate registration parameters and the certificate production request to the certificate issuing end. The certificate issuing end can generate a signature certificate and an encryption certificate according to the certificate registration parameters and the certificate production request, and send the signature certificate and the encryption certificate to the registration end. The registration end sends the signature certificate and the encryption certificate to the user end, so that the user end imports the signature certificate and the encryption certificate, which can realize the acquisition and storage of the signature certificate and the encryption certificate. Compared with the prior art, the interaction process between the registration end and the certificate issuing end is optimized, unnecessary steps can be reduced, thereby improving the efficiency of certificate acquisition, and the user only needs to generate a certificate registration request on the user end to complete the entire process of certificate acquisition and storage, which can improve the user's certificate acquisition experience.

[0027] The certificate acquisition system provided by this application is described below through an embodiment.

[0028] Figure 1is a schematic diagram of a certificate acquisition system provided in an embodiment of the present application, such as Figure 1 As shown, the certificate acquisition system 100 includes: a user terminal 101, a registration terminal 102 and a certificate issuing terminal 103.

[0029] The user terminal 101 may generate a certificate registration request and send the certificate registration request to the registration terminal 102 .

[0030] The user terminal 101 can generate a certificate registration request, such as a Public-Key Cryptography Standards #10 (P10) certificate request, etc. Specifically, the certificate registration parameters in the certificate registration request include certificate registration information and a temporary public key generated according to the certificate registration information. The user terminal 101 sends the generated certificate registration request to the registration terminal 102. In one example, the user terminal 101 can be a USB key (USB key, UKey), and the registration terminal 102 can be a digital certificate registration authority (Registration Authority, RA) system. A P10 certificate request can be generated in the UKey and the P10 certificate request can be sent to the RA system.

[0031] The registration end 102 can parse the certificate registration request, obtain the certificate registration parameters, and send the certificate registration parameters and the certificate production request to the certificate issuing end 103.

[0032] The registration end 102 can receive the certificate registration request sent by the user end 101, and verify the received certificate registration request, for example: verify whether the encoding of the certificate request complies with the prescribed format, verify whether the certificate request is complete, and whether the certificate request is authentic and valid, etc. If the verification is successful, the registration end 102 parses the received certificate registration request to obtain the certificate registration parameters in the certificate registration request. According to the certificate registration parameters, the registration end 102 generates a certificate production request, and sends the certificate registration parameters and the certificate production request to the certificate issuing end 103. In one example, the certificate issuing end 103 can be a digital certificate certification authority (CA) system. The RA system receives the P10 certificate request sent by UKey and verifies the P10 certificate request. If the verification is successful, the P10 certificate request is parsed to obtain the certificate registration parameters in the P10 certificate request. According to the certificate registration parameters, the RA system generates a certificate production request and sends the certificate registration parameters and the certificate production request to the CA system.

[0033] The certificate issuing end 103 can generate a signature certificate and an encryption certificate according to the certificate registration parameters and the certificate request, and send the signature certificate and the encryption certificate to the registration end 102. The registration end 102 sends the signature certificate and the encryption certificate to the user end 101, so that the user end 101 imports the signature certificate and the encryption certificate.

[0034] The certificate issuing end 103 can receive the certificate registration parameters and certificate production request sent by the registration end 102, generate a signature certificate and an encryption certificate based on the received certificate registration parameters and certificate production request, and send the signature certificate and the encryption certificate to the registration end 102. The registration end 102 can receive the signature certificate and the encryption certificate sent by the certificate issuing end 103, and send the signature certificate and the encryption certificate to the user end, so that the user end imports the signature certificate and the encryption certificate. In one example, the CA system receives the certificate registration parameters and the certificate production request sent by the RA system, generates a signature certificate and an encryption certificate, and sends the signature certificate and the encryption certificate to the RA system. The RA system sends the received signature certificate and encryption certificate to UKey, so that UKey imports the signature certificate and the encryption certificate.

[0035] In an embodiment of the present application, the certificate acquisition system 100 includes: a user terminal 101, a registration terminal 102 and a certificate issuing terminal 103. The user terminal 101 can generate a certificate registration request and send the certificate registration request to the registration terminal 102. The registration terminal 102 can parse the certificate registration request, obtain the certificate registration parameters, and send the certificate registration parameters and the certificate production request to the certificate issuing terminal 103. The certificate issuing terminal 103 can generate a signature certificate and an encryption certificate according to the certificate registration parameters and the certificate production request, and send the signature certificate and the encryption certificate to the registration terminal 102. The registration terminal 102 sends the signature certificate and the encryption certificate to the user terminal 101, so that the user terminal 101 imports the signature certificate and the encryption certificate, which can realize the acquisition and storage of the signature certificate and the encryption certificate. Compared with the prior art, the interaction process between the registration terminal 102 and the certificate issuing terminal 103 is optimized, unnecessary steps can be reduced, thereby improving the efficiency of certificate acquisition, and the user only needs to generate a certificate registration request on the user terminal 101 to complete the entire process of certificate acquisition and storage, which can improve the user's certificate acquisition experience.

[0036] In a possible implementation, the user terminal 101 may also obtain the certificate registration information input by the user from the registration terminal 102, and generate a certificate registration request according to the certificate registration information.

[0037] The user logs in to the registration terminal 102 system through a computing device and activates the user terminal 101, wherein the computing device can be a computer, a smart phone, etc. The user terminal 101 can obtain the certificate registration information entered by the user in the system interface of the registration terminal 102, wherein the certificate registration information includes the certificate subject, the certificate template and the certificate validity period, etc. According to the certificate registration information entered by the user in the system interface of the registration terminal 102, the user terminal 101 generates a certificate registration request, and at the same time, the user terminal 101 also generates a new certificate container for storing the certificate generated according to the certificate registration request.

[0038] In one example, the user opens the login interface of the RA system through a laptop computer and enters the account number and password. In response to the user's successful login, the RA system prompts the user to insert the UKey. After the user inserts the UKey on the laptop, the user selects the UKey on the RA system interface and enters the UKey password for identity authentication. If the identity authentication is successful, the user can access the Ukey function. The user chooses to create a new certificate container on the RA system interface and fills in the certificate registration information. According to the certificate registration information entered by the user on the RA system interface, the RA system generates a P10 certificate request in the UKey.

[0039] In an embodiment of the present application, the user terminal 101 obtains the certificate registration information input by the user from the registration terminal 102, and generates a certificate registration request based on the certificate registration information. The certificate registration request can be used to obtain the signature certificate and the encryption certificate. Compared with the prior art, the user only needs to enter the certificate registration information at the registration terminal 102, and does not need to perform other complex operations to obtain and store the signature certificate and the encryption certificate, which can improve the user's certificate acquisition experience.

[0040] Figure 2 is a schematic diagram of another certificate acquisition system provided in an embodiment of the present application, such as Figure 2 As shown, the certificate acquisition system 100 also includes a key end 104, and the certificate issuing end 103 can also verify the certificate request. If the certificate request verification is passed, the key end 104 is called to generate a public-private key pair. The certificate issuing end 103 generates a signature certificate and an encryption certificate based on the public-private key pair and the certificate registration parameters.

[0041] The certificate issuing end 103 receives the certificate registration parameters and certificate production request sent by the registration end 102, and verifies the received certificate production request, for example: verifying whether the certificate production request complies with industry regulations and laws and regulations, verifying whether the information in the certificate production request is true and valid, etc. If the authentication is successful, the certificate issuing end 103 sends a request for generating a public-private key pair and a temporary public key in the certificate registration parameters to the key end 104, wherein the request for generating a public-private key pair includes the information of the temporary public key in the certificate registration parameters. The key end 104 generates a public-private key pair according to the request for generating a public-private key pair and sends the public-private key pair to the certificate issuing end 103. The certificate issuing end 103 generates a signature certificate and an encryption certificate according to the public-private key pair sent by the key end 104 and the certificate registration parameters sent by the registration end 102.

[0042] In one example, the key end 104 can be a key management (KM) system. The CA system receives the certificate registration parameters and certificate request sent by the RA system, verifies the certificate request, and if the verification passes, calls the KM system to generate a public-private key pair. The CA system generates a signature certificate and an encryption certificate based on the public-private key pair and the certificate registration parameters.

[0043] In the embodiment of the present application, the certificate acquisition system 100 also includes a key end 104, and the certificate issuing end 103 verifies the certificate request. If the certificate request is verified, the key end 104 is called to generate a public-private key pair. The certificate issuing end 103 generates a signature certificate and an encryption certificate based on the public-private key pair and the certificate registration parameters, thereby realizing the generation of a signature certificate and an encryption certificate. By verifying the certificate request through the certificate issuing end 103, the validity and legality of the generated signature certificate and encryption certificate can be guaranteed, and by calling the key end 104 to generate a public-private key pair, the security of the generated signature certificate and encryption certificate can be guaranteed.

[0044] Figure 3 is a schematic diagram of another certificate acquisition system provided in an embodiment of the present application, such as Figure 3 As shown, the certificate acquisition system 100 also includes a hardware security module 105, and the key end 104 can also call the hardware security module 105 to generate a public-private key pair.

[0045] The key end 104 receives the request for generating a public-private key pair sent by the certificate issuing end 103, parses the request for generating a public-private key pair, obtains information about a temporary public key, and sends the information about the temporary public key to the hardware security module 105. The hardware security module 105 generates a corresponding public-private key pair based on the information about the temporary public key and sends it to the key end 104. In one example, the hardware security module 105 can be a cryptographic machine. The KM system receives the request for generating a public-private key pair sent by the CA system, and calls the cryptographic machine to generate a public-private key pair based on the request for generating a public-private key pair.

[0046] In an embodiment of the present application, the certificate acquisition system 100 also includes a hardware security module 105. The key end 104 calls the hardware security module 105 to generate a public-private key pair, which can ensure the security of the generated signature certificate and encryption certificate. Moreover, using the hardware security module to generate a public-private key pair can increase the processing speed of the system, thereby improving the efficiency of certificate acquisition.

[0047] In a possible implementation, the key end 104 may also obtain a symmetric key generated by the hardware security module 105, and encrypt the private key in the public-private key pair by using the symmetric key.

[0048] After the key end 104 calls the hardware security module 105 to generate the corresponding public-private key pair, it can obtain the symmetric key from the hardware security module 105 and use the symmetric key to encrypt the private key in the public-private key pair. In one example, the KM system obtains the symmetric key generated by the cryptographic machine and encrypts the private key in the public-private key pair using the symmetric key.

[0049] In an embodiment of the present application, the key end 104 obtains the symmetric key generated by the hardware security module 105, and encrypts the private key in the public-private key pair through the symmetric key, thereby ensuring the security of the private key during transmission, thereby ensuring the security of the generated signature certificate and encryption certificate.

[0050] In a possible implementation, the key end 104 may also obtain a temporary public key in the certificate registration parameters, and encrypt the symmetric key using the temporary public key.

[0051] The key end 104 receives the temporary public key sent by the certificate issuing end 103, and encrypts the symmetric key obtained from the hardware security module 105 by the temporary public key. In one example, the KM system receives the temporary public key sent by the CA system, and encrypts the symmetric key by the temporary public key.

[0052] In an embodiment of the present application, the key end 104 obtains the temporary public key in the certificate registration parameters and encrypts the symmetric key through the temporary public key, which can ensure the security of the private key encrypted by the symmetric key during transmission, thereby ensuring the security of the generated signature certificate and encryption certificate.

[0053] In a possible implementation, the registration end 102 can also receive the signature certificate, encryption certificate and encrypted private key sent by the certificate issuing end 103, and verify the signature certificate, encryption certificate and encrypted private key. If the verification passes, the signature certificate, encryption certificate and encrypted private key are sent to the user end 101.

[0054] After the certificate issuing end 103 generates a signature certificate and an encryption certificate, it sends the generated signature certificate, encryption certificate and encrypted private key to the registration end 102. After receiving the signature certificate, encryption certificate and encrypted private key sent by the certificate issuing end 103, the registration end 102 verifies the signature certificate, encryption certificate and encrypted private key sent by the certificate issuing end 103, for example: verifies whether the signature certificate and encryption certificate are issued by a trusted certificate issuing end 103, verifies whether the encryption of the private key meets the security standards, etc. If the verification is successful, the signature certificate, encryption certificate and encrypted private key are sent to the user end 101. In one example, the RA system receives the signature certificate, encryption certificate and encrypted private key sent by the CA system, and verifies the signature certificate, encryption certificate and encrypted private key. If the verification is successful, the signature certificate, encryption certificate and encrypted private key are sent to UKey.

[0055] In an embodiment of the present application, the registration end 102 receives the signature certificate, encryption certificate and encrypted private key sent by the certificate issuing end 103, and verifies the signature certificate, encryption certificate and encrypted private key. If the verification is successful, the signature certificate, encryption certificate and encrypted private key are sent to the user end 101. The registration end 102 can receive the signature certificate, encryption certificate and encrypted private key sent from the certificate issuing end 103 and send them to the user end 101, so that the user end 101 can obtain the certificate and private key. Moreover, the registration end 102 verifies the signature certificate, encryption certificate and encrypted private key, which can ensure that the certificate and private key obtained by the user end 101 are valid and secure.

[0056] In one possible implementation, the user terminal 101 can also receive a signature certificate, an encryption certificate, and an encrypted private key, and decrypt the encrypted symmetric key through a temporary private key, and decrypt the private key based on the symmetric key, and store the signature certificate, encryption certificate, and decrypted private key, wherein the user terminal 101 generates a temporary public key and a temporary private key when generating a certificate registration request.

[0057] When the user terminal 101 generates a certificate registration request, a temporary public key and a temporary private key are generated. The temporary public key is included in the certificate registration request and is used to generate a public-private key pair and encrypt the private key. The temporary private key is stored in the user terminal 101 and is used to decrypt the symmetric key encrypted by the temporary public key. After receiving the signing certificate, encryption certificate and encrypted private key sent by the registration terminal 102, the user terminal 101 uses the temporary private key stored in the user terminal 101 to decrypt the symmetric key encrypted by the temporary public key, and uses the decrypted symmetric key to decrypt the private key encrypted by the symmetric key, obtains the decrypted private key, and verifies whether the signing certificate and encryption certificate are complete and valid through the decrypted private key. If the verification is successful, the signing certificate, encryption certificate and decrypted private key are stored in the certificate container of the user terminal 101. The user terminal 101 can also encrypt the signing certificate, encryption certificate and decrypted private key stored in the certificate container to prevent unauthorized access and tampering.

[0058] In one example, UKey can receive a signing certificate, an encryption certificate, and an encrypted private key, and decrypt the encrypted symmetric key in UKey using a temporary private key, and decrypt the private key based on the symmetric key, store the signing certificate, encryption certificate, and decrypted private key in a certificate container in UKey, and encrypt the signing certificate, encryption certificate, and decrypted private key stored in the certificate container.

[0059] In an embodiment of the present application, the user terminal 101 receives a signature certificate, an encryption certificate and an encrypted private key, and decrypts the encrypted symmetric key through a temporary private key, and decrypts the private key according to the symmetric key, and stores the signature certificate, encryption certificate and decrypted private key. The acquisition and storage of the signature certificate, encryption certificate and private key can be realized, and encryption and decryption are performed using a temporary public key and a temporary private key, thereby ensuring the security of the signature certificate and encryption certificate.

[0060] In a possible implementation, the user terminal 101, the registration terminal 102 and the certificate issuing terminal 103 communicate via Hypertext Transfer Protocol Secure (HTTPS).

[0061] The user end 101 sends the certificate registration request to the registration end 102 via HTTPS. The registration end 102 receives the certificate registration request sent by the user end 101 via HTTPS, and sends the certificate registration parameters and the certificate production request to the certificate issuing end 103 via HTTPS. The certificate issuing end 103 receives the certificate registration parameters and the certificate production request sent by the registration end 102 via HTTPS, and sends the signature certificate, encryption certificate and encrypted private key to the registration end 102 via HTTPS. The registration end 102 receives the signature certificate, encryption certificate and encrypted private key sent by the certificate issuing end 103 via HTTPS, and sends the signature certificate, encryption certificate and encrypted private key to the user end 101 via HTTPS. The user end 101 receives the signature certificate, encryption certificate and encrypted private key via HTTPS.

[0062] In one example, UKey sends a P10 certificate request to the RA system via HTTPS, the RA system receives the P10 certificate request sent by UKey via HTTPS, and sends the certificate registration parameters and the certificate production request to the CA system via HTTPS, the CA system receives the certificate registration parameters and the certificate production request sent by the RA system via HTTPS, and sends the signature certificate, encryption certificate and encrypted private key to the RA system via HTTPS, the RA system receives the signature certificate, encryption certificate and encrypted private key sent by the CA system via HTTPS, and sends them to UKey via HTTPS, and UKey receives the signature certificate, encryption certificate and encrypted private key sent by the RA system via HTTPS.

[0063] In an embodiment of the present application, the user end 101, the registration end 102 and the certificate issuing end 103 communicate via HTTPS, which can prevent the signature certificate, the encryption certificate and the encrypted private key from being tampered with and stolen during the transmission process, thereby ensuring the security of the acquired and stored signature certificates and encryption certificates.

[0064] Figure 4 is a flow chart of a certificate acquisition method provided in an embodiment of the present application, such as Figure 4 As shown, the data transmission method includes the following steps 401 to 404:

[0065] Step 401: Generate a certificate registration request.

[0066] Obtain certificate registration information, and generate a certificate registration request based on the certificate registration information.

[0067] Step 402: Parse the certificate registration request to obtain certificate registration parameters.

[0068] Obtain a certificate registration request, parse the obtained certificate registration request, and obtain certificate registration parameters.

[0069] Step 403: Generate a signature certificate and an encryption certificate according to the certificate registration parameters and the certificate generation request.

[0070] Obtain the certificate request, and generate the signature certificate and encryption certificate according to the certificate registration parameters and the certificate registration request.

[0071] Step 404: Import and store the signature certificate and encryption certificate.

[0072] Obtain the generated signature certificate and encryption certificate, import the signature certificate and encryption certificate, and store them.

[0073] It should be noted that the specific execution steps of the certificate acquisition method provided in the embodiment of the present application can refer to the description of the certificate acquisition system in any of the above embodiments, which will not be repeated here.

[0074] In an embodiment of the present application, a certificate registration request is generated, the certificate registration request is parsed, certificate registration parameters are obtained, a signature certificate and an encryption certificate are generated according to the certificate registration parameters and the certificate production request, and the signature certificate and the encryption certificate are imported and stored. This can achieve the acquisition and storage of the signature certificate and the encryption certificate. Compared with the prior art, the efficiency of certificate acquisition can be improved, and the user only needs to generate a certificate registration request to complete the entire process of certificate acquisition and storage, which can enhance the user's certificate acquisition experience.

[0075] Those of ordinary skill in the art will appreciate that the units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the embodiments of the present application.

[0076] The above implementation methods are only used to illustrate the embodiments of the present application, and are not limitations on the embodiments of the present application. Ordinary technicians in the relevant technical field can make various changes and modifications without departing from the spirit and scope of the embodiments of the present application. Therefore, all equivalent technical solutions also belong to the scope of the embodiments of the present application. The scope of patent protection of the embodiments of the present application should be limited by the claims.

Claims

1. A certificate acquisition system, characterized in that: include: User side, registration side and certificate issuing side; The user terminal is used to generate a certificate registration request and send the certificate registration request to the registration terminal; The registration end is used to parse the certificate registration request, obtain certificate registration parameters, and send the certificate registration parameters and the certificate request to the certificate issuing end; The certificate issuing end is used to generate a signature certificate and an encryption certificate according to the certificate registration parameters and the certificate production request, and send the signature certificate and the encryption certificate to the registration end. The registration end sends the signature certificate and the encryption certificate to the user end, so that the user end imports the signature certificate and the encryption certificate.

2. The system according to claim 1, characterized in that The user terminal is used to obtain the certificate registration information input by the user from the registration terminal, and generate the certificate registration request according to the certificate registration information.

3. The system according to claim 1, characterized in that The system further comprises: a key terminal; The certificate issuing end is used to verify the certificate request. If the certificate request is verified, the key end is called to generate a public-private key pair. The certificate issuing end generates the signature certificate and encryption certificate according to the public-private key pair and the certificate registration parameters.

4. The system according to claim 3, characterized in that The system further comprises: a hardware security module; The key end is used to call the hardware security module to generate the public-private key pair.

5. The system according to claim 4, characterized in that The key end is used to obtain the symmetric key generated by the hardware security module, and encrypt the private key in the public-private key pair by using the symmetric key.

6. The system according to claim 5, characterized in that The key end is used to obtain the temporary public key in the certificate registration parameters and encrypt the symmetric key by using the temporary public key.

7. The system according to claim 6, characterized in that The registration end is used to receive the signature certificate, the encryption certificate and the encrypted private key sent by the certificate issuing end, and verify the signature certificate, the encryption certificate and the encrypted private key. If the verification is successful, the signature certificate, the encryption certificate and the encrypted private key are sent to the user end.

8. The system according to claim 7, characterized in that The user end is used to receive the signature certificate, the encryption certificate and the encrypted private key, decrypt the encrypted symmetric key through a temporary private key, decrypt the private key according to the symmetric key, and store the signature certificate, the encryption certificate and the decrypted private key, wherein the temporary public key and the temporary private key are generated when the user end generates a certificate registration request.

9. The system according to any one of claims 1 to 8, characterized in that: The user terminal, the registration terminal and the certificate issuing terminal communicate via HTTPS.

10. A method for obtaining a certificate, characterized in that: include: Generate a certificate enrollment request; Parsing the certificate registration request to obtain certificate registration parameters; Generate a signature certificate and an encryption certificate according to the certificate registration parameters and the certificate production request; The signing certificate and encryption certificate are imported and stored.

Images