Method for generating digital certificate, device for generating digital certificate and electronic equipment

Abstract

The invention provides a method for generating a digital certificate, a device for generating the digital certificate and electronic equipment, and relates to the technical field of information security. The method comprises the following steps: when a digital certificate application request is responded, obtaining a name identifier of a digital certificate requested by the digital certificate application request and an identity identifier of a key center corresponding to the digital certificate; and binding the name identifier of the digital certificate with an identity identifier of a key center corresponding to the digital certificate to obtain a binding relationship between the name identifier of the digital certificate and the identity identifier of the key center. And an encryption key for encrypting the digital certificate is obtained through the binding relationship, so that the digital certificate is encrypted through the encryption key, and the encrypted digital certificate is obtained. Based on the scheme, the security of the digital certificate can be improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a method for generating a digital certificate, a device for generating a digital certificate, and an electronic device in the field of information security technology. Background Art

[0002] Digital keys generated through digital certificates enable contactless vehicle control, greatly facilitating vehicle use. To ensure the security of digital keys, higher security requirements are placed on digital certificates.

[0003] Therefore, how to improve the security of digital certificates is an urgent problem that needs to be solved. Summary of the Invention

[0004] The present application provides a method for generating a digital certificate, an apparatus for generating a digital certificate, and an electronic device, which can improve the security of the digital certificate.

[0005] In a first aspect, the present application provides a method for generating a digital certificate, the method comprising:

[0006] In response to a digital certificate application request, obtaining a name identifier of a target digital certificate requested by the digital certificate application request; and obtaining an identity identifier of a target key center, wherein the target key center is a key center of the target digital certificate, and the key center is used to generate an encryption key;

[0007] Bind the name identifier and the identity identifier to obtain a target binding relationship;

[0008] Based on the target binding relationship, obtain the target encryption key;

[0009] The target digital certificate is encrypted based on the target encryption key to generate an encrypted target digital certificate.

[0010] In an embodiment of the present application, when responding to a digital certificate application request, it is necessary to obtain the name identifier of the digital certificate (i.e., the target digital certificate) requested by the digital certificate application request and the identity identifier of the key center (i.e., the target key center) corresponding to the target digital certificate. The name identifier of the target digital certificate and the identity identifier of the target key center are bound to obtain a binding relationship between the name identifier of the target digital certificate and the identity identifier of the target key center. The encryption key (i.e., the target encryption key) used to encrypt the target digital certificate is then obtained through the binding relationship, and the target digital certificate is encrypted through the target encryption key to obtain the encrypted target digital certificate. By binding the name identifier of the digital certificate with the identity identifier of the key center corresponding to the digital certificate, a binding verification between the name identifier of the digital certificate and the identity identifier of the key center can be achieved, avoiding the possibility that one name identifier corresponds to multiple identity identifiers or multiple name identifiers correspond to one identity identifier, and ensuring that the name identifier of the digital certificate corresponds to the identity identifier of the key center one-to-one, so that the binding relationship is unique. On the basis of the uniqueness of the binding relationship, the digital certificate generated by the binding relationship is also unique, thereby preventing the digital certificate from being forged and improving the security of the digital certificate.

[0011] In conjunction with the first aspect, in certain implementations of the first aspect, in response to the digital certificate application request, the method further includes:

[0012] Obtaining a first identifier of a target digital certificate, wherein the first identifier includes a chip identifier of the target digital certificate;

[0013] Determining whether a historical digital certificate has been generated based on the first identifier;

[0014] The above steps of obtaining the identity of the target key center include:

[0015] If no historical digital certificate has been generated based on the first identifier, obtaining the identity identifier;

[0016] In the case where a historical digital certificate has been generated based on the first identifier, if the historical digital certificate is invalid, the identity identifier is obtained.

[0017] In an embodiment of the present application, by determining whether a digital certificate has been generated based on the identifier of the target digital certificate (i.e., a historical digital certificate), it is possible to avoid generating multiple target digital certificates with the same identifier of the target digital certificate, which would lead to the problem of target digital certificate redundancy. This ensures the uniqueness of the target digital certificate, thereby preventing the digital certificate from being forged and improving the security of the digital certificate.

[0018] Alternatively, if a historical digital certificate has been generated based on the identifier of the target digital certificate, but the historical digital certificate has expired, this indicates that the historical digital certificate is no longer trustworthy and may have been forged. Therefore, to ensure the security of the digital certificate, the identity of the key center corresponding to the digital certificate can be retrieved to establish a unique binding relationship between the name identifier of the digital certificate and the identity of the key center. Furthermore, based on the unique binding relationship, a unique digital certificate corresponding to the binding relationship is obtained, thereby preventing the digital certificate from being forged and improving the security of the digital certificate.

[0019] In combination with the first aspect and the above implementations, in some implementations of the first aspect, obtaining the identity includes:

[0020] Generate an application request to the target key center;

[0021] Sending the application request to the key management platform, so that the key management platform generates a target key center in response to the application request;

[0022] Receive the identity of the target key center sent by the key management platform.

[0023] In the embodiments of the present application, by generating a key center corresponding to a digital certificate in the key management platform and receiving the key center's identity rather than the key center, physical isolation between the key center and the digital certificate is achieved. This ensures that the key center will not be leaked in the event of a digital certificate attack, thereby ensuring the security of the key center. This enhanced security of the key center also makes the keys within the key center more secure, further ensuring the security of the digital certificate encrypted with the key.

[0024] In combination with the first aspect and the above implementations, in certain implementations of the first aspect, when a historical digital certificate exists, the method further includes:

[0025] Get the latest generation time of historical digital certificates;

[0026] Determine the time difference between the current time and the latest generated time;

[0027] When the time difference is greater than or equal to the preset time length, it is determined that the historical digital certificate is invalid.

[0028] In an embodiment of the present application, whether a historical digital certificate is invalid is determined by the difference between the latest generation time of the historical digital certificate and the current time, thereby avoiding the influence of digital certificates generated at times other than the latest generation time on the result of determining whether a historical digital certificate is invalid, and improving the accuracy of determining whether a historical digital certificate is invalid.

[0029] In combination with the first aspect and the above implementations, in certain implementations of the first aspect, in response to the digital certificate application request, the method further includes:

[0030] Obtaining a second identifier of the target digital certificate, wherein the second identifier includes an entity identifier and a chip identifier of the target digital certificate, and the entity identifier includes a name identifier;

[0031] Determining whether the second identifier is an identifier received for the first time;

[0032] When the second identifier is the identifier received for the first time, recording the association relationship between the entity identifier and the chip identifier in the second identifier;

[0033] If the second identifier is not the identifier received for the first time, the second identifier is not recorded.

[0034] In an embodiment of the present application, by judging whether the identifier of the target digital certificate is the identifier received for the first time, that is, whether the identifier of the target digital certificate is a repeated identifier item, the association relationship between the identifiers is recorded only when the identifier of the target digital certificate is a non-duplicate identifier item, and when the identifier of the target digital certificate is a repeated identifier item, the identifier is not recorded. This can avoid the problem of the identifier of the target digital certificate being a repeated identifier item being recorded each time, which ultimately leads to the generation of multiple corresponding digital certificates, that is, one identifier corresponds to multiple digital certificates, leading to the problem of digital certificate redundancy. It can ensure the uniqueness of the digital certificate, thereby preventing the digital certificate from being forged and improving the security of the digital certificate.

[0035] In combination with the first aspect and the above implementations, in some implementations of the first aspect, the method further includes:

[0036] Obtain the batch number and uniform resource identifier of the target digital certificate;

[0037] A mapping relationship between the batch number and the uniform resource identifier is established to query the encrypted target digital certificate through the batch number and the mapping relationship.

[0038] In an embodiment of the present application, by establishing a mapping relationship between the batch number of the target digital certificate and the uniform resource identifier of the target digital certificate, when querying the encrypted target digital certificate corresponding to the batch number, the uniform resource identifier of the target digital certificate can be directly located through the batch number of the target digital certificate and the pre-established mapping relationship, so that the encrypted target digital certificate can be queried in the uniform resource identifier of the target digital certificate, thereby limiting the access of the batch number of the non-target digital certificate to the uniform resource identifier of the target digital certificate, and further improving the security of the digital certificate.

[0039] In combination with the first aspect and the above implementations, in some implementations of the first aspect, the method further includes:

[0040] Obtain the external key generated by the target key center;

[0041] Generate a signing request for the target digital certificate based on the entity identifier of the target digital certificate and the external key;

[0042] If the signature request is verified successfully, the target digital certificate sent by the certificate issuing center is received.

[0043] In the embodiments of the present application, because the external key is physically isolated from the entity identifier of the target digital certificate, it is possible to ensure that the external key will not be leaked when the entity identifier of the target digital certificate is attacked, thereby ensuring the security of the signature request for the target digital certificate generated using the external key and the entity identifier of the target digital certificate. Based on the security of the signature request, a secure target digital certificate can be received. Furthermore, based on the security of the target digital certificate, a secure encrypted target digital certificate can be generated, further improving the security of the digital certificate.

[0044] In combination with the first aspect and the above implementations, in certain implementations of the first aspect, obtaining the target encryption key based on the target binding relationship includes:

[0045] Obtaining a preset mapping set, wherein the preset mapping set is used to represent a mapping between a binding relationship and an encryption key, wherein the binding relationship includes a name identifier of a digital certificate and an identity identifier of a key center corresponding to the digital certificate;

[0046] Based on the target binding relationship, a query is performed in the preset mapping set to obtain the target encryption key.

[0047] In an embodiment of the present application, since the binding relationship between the name identifier of the digital certificate and the identity identifier of the key center is unique, the encryption key used to encrypt the digital certificate queried through the binding relationship is also unique. Encrypting the digital certificate with a unique encryption key can avoid repeated generation of the encrypted digital certificate, ensure the uniqueness of the encrypted digital certificate, thereby preventing the digital certificate from being forged and improving the security of the digital certificate.

[0048] In a second aspect, the present application provides a device for generating a digital certificate, the device comprising:

[0049] an acquisition module, configured to, in response to a digital certificate application request, acquire a name identifier of a target digital certificate requested by the digital certificate application request; and acquire an identity identifier of a target key center, wherein the target key center is a key center of the target digital certificate, and the key center is used to generate an encryption key;

[0050] A binding module is used to bind the name identifier and the identity identifier to obtain a target binding relationship;

[0051] A processing module, configured to obtain a target encryption key based on the target binding relationship;

[0052] The encryption module is used to encrypt the target digital certificate based on the target encryption key to generate an encrypted target digital certificate.

[0053] In a third aspect, the present application provides an electronic device comprising a memory and a processor. The memory is configured to store executable program code, and the processor is configured to retrieve and execute the executable program code from the memory, so that the electronic device executes the method of the first aspect or any possible implementation of the first aspect.

[0054] In a fourth aspect, the present application provides a vehicle comprising a memory and a processor. The memory is configured to store executable program code, and the processor is configured to retrieve and execute the executable program code from the memory, so that the vehicle executes the method of the first aspect or any possible implementation of the first aspect.

[0055] In a fifth aspect, the present application provides a computer program product, which includes: computer program code, which, when running on a computer, enables the computer to execute the method in the above-mentioned first aspect or any possible implementation of the first aspect.

[0056] In a sixth aspect, the present application provides a computer-readable storage medium storing a computer program code. When the computer program code runs on a computer, the computer executes the method in the above-mentioned first aspect or any possible implementation of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 This is a schematic diagram of a scenario in which the digital key provided in an embodiment of the present application is used.

[0058] Figure 2 This is a flowchart of a method for generating a digital certificate provided in an embodiment of the present application.

[0059] Figure 3 This is an interactive diagram of a method for generating a digital certificate provided in an embodiment of the present application.

[0060] Figure 4 This is a structural diagram of a device for generating a digital certificate provided in an embodiment of the present application.

[0061] Figure 5It is a structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0062] The following will clearly and thoroughly describe the technical solutions in this application in conjunction with the accompanying drawings. In the description of the embodiments of this application, unless otherwise specified, " / " means or, for example, A / B can mean A or B: "and / or" in the text is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of this application, "multiple" means two or more than two.

[0063] In the following, the terms "first" and "second" are used for descriptive purposes only and should not be understood to imply or suggest relative importance or implicitly indicate the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features.

[0064] The embodiments of the present application can be applied to any device that can use a digital key, such as one or more of a vehicle, a door lock, a smart home device (such as an air conditioner, a refrigerator, a sweeping robot, etc.). Figure 1 The vehicle shown in FIG. 1 is described in detail.

[0065] Figure 1 This is a schematic diagram of a scenario in which the digital key provided in an embodiment of the present application is used.

[0066] For example, Figure 1 As shown, Figure 1 The system includes a vehicle 110 and an electronic device 120. The vehicle 110 and the electronic device 120 can communicate with each other. In addition, the electronic device 120 can have a digital key for the vehicle 110, so that the vehicle 110 can be controlled by the digital key, for example, unlocking, locking, and turning on and off vehicle devices.

[0067] It should be noted that the digital key may include but is not limited to at least one of a Bluetooth key, a Near Field Communication (NFC) key, and an Ultra Wide Band (UWB) key.

[0068] It should be noted that the electronic device may be a smart device configured with a digital key for the vehicle 110, including but not limited to a personal computer, tablet computer, handheld device, in-vehicle device, wearable device, computing device, or other processing device connected to a wireless modem. In different networks, electronic devices may be referred to by different names, such as user equipment, access electronic device, subscriber unit, subscriber station, mobile station, mobile station, remote station, remote electronic device, mobile device, user electronic device, electronic device, wireless communication device, user agent or user device, cellular phone, cordless phone, electronic device in a 5G network or future evolution network, etc., and the embodiments of the present application are not limited thereto.

[0069] It is extremely inconvenient to control the vehicle through traditional methods such as physical keys and key passwords. For example, when a user is holding something with both hands and it is inconvenient to take the key, they need to put the item away first and free their hands to take the physical key to unlock the vehicle. Therefore, in order to improve the convenience of vehicle control, the physical key can be replaced by a digital key to achieve contactless vehicle control, making it easier for users to control the vehicle through the digital key. For example, when a user is holding something with both hands, the digital key can be used to automatically unlock the car when the user approaches the door, without the need for the user to put down the item in their hands first.

[0070] At present, when using digital keys, in order to ensure the security of digital key use and prevent digital keys from being illegally attacked, the digital key (DK) management platform (for example, DK platform) can interact with the security service platform (SSP) in the vehicle to authenticate the vehicle's digital key and ensure the security of digital key use. Since digital keys are mainly generated through digital certificates. Therefore, in order to ensure the security of digital key use, it is necessary to first ensure the security of digital certificates. However, when generating a digital certificate, if only the identity information of the device applying for the digital certificate (for example, the identity verification code of the digital key) is verified, and a digital certificate is generated when the verification is passed, this may result in one identity information corresponding to multiple digital certificates (i.e., one-to-many), or multiple identity information corresponding to one digital certificate, and the uniqueness of the digital certificate cannot be ensured, that is, one identity information corresponds to a unique digital certificate, which may cause the digital certificate to be forged, threatening the security of the digital certificate.

[0071] In view of this, the present application proposes a method for generating a digital certificate, an apparatus for generating a digital certificate, and an electronic device for generating a digital certificate. Through the embodiments of the present application, when responding to a digital certificate application request, it is necessary to obtain the name identifier of the digital certificate requested by the digital certificate application request and the identity identifier of the key center corresponding to the digital certificate. The name identifier of the digital certificate and the identity identifier of the key center corresponding to the digital certificate are then bound to obtain a binding relationship between the name identifier of the digital certificate and the identity identifier of the key center. The encryption key used to encrypt the digital certificate is then obtained through this binding relationship, and the digital certificate is encrypted using the encryption key to obtain an encrypted digital certificate, thereby improving the security of the digital certificate.

[0072] The following combination Figures 2 to 3 The method for generating a digital certificate provided in an embodiment of the present application is described in detail.

[0073] Figure 2 This is a flow chart of a method for generating a digital certificate provided in an embodiment of the present application. The method can be executed by an electronic device or an SSP in an electronic device. This embodiment of the present application uses an SSP as an example for illustration.

[0074] For example, Figure 2 As shown, the method 200 includes the following implementation process:

[0075] S210 , in response to the digital certificate application request, obtaining the name identifier of the target digital certificate requested by the digital certificate application request; and obtaining the identity identifier of the target key center.

[0076] The target key center is the key center of the target digital certificate, and the key center is used to generate encryption keys.

[0077] For example, when a digital key needs to be generated, the DK platform may generate a digital certificate application request corresponding to the digital certificate, and send the digital certificate application request and the request parameters of the digital certificate to the SSP.

[0078] Upon receiving a digital certificate application request, the SSP may respond to the digital certificate application request, obtain request parameters corresponding to the digital certificate requested by the digital certificate application request (which may be referred to as the "target digital certificate"), and obtain the name identifier of the target digital certificate included in the request parameters of the target digital certificate. Furthermore, upon receiving a digital certificate application request, the SSP may also respond to the digital certificate application request and obtain the identity identifier of the key center corresponding to the target digital certificate (which may be referred to as the "target key center").

[0079] Among them, the digital certificate application request, the digital certificate corresponding to the digital certificate application request, and the request parameters of the digital certificate have a one-to-one correspondence.

[0080] Optionally, when responding to a digital certificate request, the SSP may also obtain a second identifier of the target digital certificate included in the request parameters of the target digital certificate. The second identifier may include the entity identifier and chip identifier of the target digital certificate, and the entity identifier may include the name identifier of the target digital certificate. Furthermore, upon obtaining the second identifier of the target digital certificate, it may be determined whether the second identifier is received for the first time.

[0081] When it is determined that the second identifier is an identifier received for the first time, the association relationship between the entity identifier and the chip identifier included in the second identifier may be recorded.

[0082] If it is determined that the second identifier is not received for the first time, the second identifier is not recorded. Furthermore, if the second identifier is not recorded, the association between the entity identifier and the chip identifier included in the second identifier is also not recorded. If the second identifier is not received for the first time, this may indicate that the SSP has received the second identifier multiple times before the current moment. For example, this may be the third time the second identifier has been received, or the second time the second identifier has been received.

[0083] In an embodiment of the present application, by judging whether the identifier of the target digital certificate is the identifier received for the first time, that is, whether the identifier of the target digital certificate is a repeated identifier item, the association relationship between the identifiers is recorded only when the identifier of the target digital certificate is a non-duplicate identifier item, and when the identifier of the target digital certificate is a repeated identifier item, the identifier is not recorded. This can avoid the problem of the identifier of the target digital certificate being a repeated identifier item being recorded each time, which ultimately leads to the generation of multiple corresponding digital certificates, that is, one identifier corresponds to multiple digital certificates, leading to the problem of digital certificate redundancy. It can ensure the uniqueness of the digital certificate, thereby preventing the digital certificate from being forged and improving the security of the digital certificate.

[0084] Optionally, when responding to a digital certificate application request, the SSP may also obtain a first identifier of the target digital certificate included in the request parameters of the target digital certificate. The first identifier may include the chip identifier of the target digital certificate. Furthermore, upon obtaining the first identifier of the target digital certificate, the SSP may determine whether a digital certificate (which may be referred to as a "historical digital certificate") has been generated based on the first identifier (e.g., the chip identifier of the target digital certificate) before the current moment. This means determining whether a historical digital certificate has been generated based on the first identifier.

[0085] When it is determined that the SSP has not generated the historical digital certificate through the first identifier, the identity identifier of the target key center can be directly obtained in the Key Management System (KMS).

[0086] When determining the historical digital certificate generated by the SSP using the first identifier, it can be determined whether the historical digital certificate is invalid. When the historical digital certificate is invalid, the identity identifier of the target key center can be obtained in the KMS.

[0087] When the historical digital certificate is still valid, it means that the historical digital certificate is still within the validity period. The historical digital certificate corresponding to the first identifier can be obtained directly without generating the target digital certificate corresponding to the first identifier. In this way, the digital certificate can be obtained more quickly, the efficiency of digital certificate acquisition is improved, and the operating resources of the SSP are saved.

[0088] In an embodiment of the present application, by determining whether a digital certificate (i.e., a historical digital certificate) has been generated based on the identifier of the target digital certificate, it is possible to avoid generating multiple target digital certificates with the identifier of the same target digital certificate, which would result in the problem of target digital certificate redundancy. This ensures the uniqueness of the target digital certificate, thereby preventing the digital certificate from being forged and improving the security of the digital certificate. Alternatively, if a historical digital certificate has been generated based on the identifier of the target digital certificate, but the historical digital certificate is invalid, it means that the historical digital certificate is no longer trustworthy and may be forged. Therefore, in order to ensure the security of the digital certificate, the identity identifier of the key center corresponding to the digital certificate can be re-acquired to establish a unique binding relationship between the name identifier of the digital certificate and the identity identifier of the key center. Furthermore, based on the uniqueness of the binding relationship, a unique digital certificate corresponding to the binding relationship is obtained, thereby preventing the digital certificate from being forged and improving the security of the digital certificate.

[0089] Furthermore, when the SSP obtains the identity of the target key center from the KMS, it can generate an application request corresponding to the target key center if it determines that the SSP does not have a historical digital certificate generated using the first identifier, or if it determines that the SSP has a historical digital certificate generated using the first identifier and the historical digital certificate has expired. The application request for the target key center is then sent to the KMS, so that upon receiving the application request from the target key center, the KMS responds to the application request from the target key center and generates the target key center.

[0090] When generating a target key center, the KMS may send the identity of the target key center to the SSP, so that the SSP obtains the identity of the target key center.

[0091] In the embodiments of the present application, by generating a key center corresponding to a digital certificate in the key management platform and receiving the key center's identity rather than the key center, physical isolation between the key center and the digital certificate is achieved. This ensures that the key center will not be leaked in the event of a digital certificate attack, thereby ensuring the security of the key center. This enhanced security of the key center also makes the keys within the key center more secure, further ensuring the security of the digital certificate encrypted with the key.

[0092] Optionally, when determining whether a historical digital certificate generated using the first identifier is valid, the latest generation time corresponding to the historical digital certificate may be obtained first. When the latest generation time corresponding to the historical digital certificate is obtained, the difference between the current time and the latest generation time (which may be referred to as the "time difference") may be calculated, i.e., time difference = current time - latest generation time.

[0093] When the time difference is obtained, it can be determined whether the time difference is greater than or equal to a preset duration. If the time difference is greater than or equal to the preset duration, it indicates that the time when the historical digital certificate was generated is too long from the current moment and is no longer within the validity period. Therefore, it can be determined that the historical digital certificate is invalid. Furthermore, when the historical digital certificate is invalid, it indicates that the historical digital certificate is no longer usable and a corresponding target digital certificate needs to be regenerated using the first identifier.

[0094] When the time difference is less than the preset duration, it means that the time when the historical digital certificate was generated is relatively close to the current moment and is still within the validity period, and the historical digital certificate can be directly obtained.

[0095] It should be understood that the preset duration is related to the validity requirements of the digital certificate, and can be 10 days, 1 month, 3 months, etc., and this embodiment of the present application does not limit this.

[0096] In an embodiment of the present application, whether a historical digital certificate is invalid is determined by the difference between the latest generation time of the historical digital certificate and the current time, thereby avoiding the influence of digital certificates generated at times other than the latest generation time on the result of determining whether a historical digital certificate is invalid, and improving the accuracy of determining whether a historical digital certificate is invalid.

[0097] S220: Bind the name identifier and the identity identifier to obtain a target binding relationship.

[0098] Exemplarily, when the name identifier of the target digital certificate and the identity identifier of the target key center corresponding to the target digital certificate are obtained, the name identifier of the target digital certificate and the identity identifier of the target key center can be bound in a preset manner to obtain a binding relationship between the name identifier of the target digital certificate and the identity identifier of the target key center (which can be called a "target binding relationship"), so that the name identifier of the target digital certificate and the identity identifier of the target key center are unique to each other.

[0099] Among them, the preset methods may include but are not limited to hash association, splicing combination, signature binding, etc.

[0100] S230: Obtain a target encryption key based on the target binding relationship.

[0101] Exemplarily, when the target binding relationship between the name identifier of the target digital certificate and the identity identifier of the target key center is obtained, the encryption key used to encrypt the target digital certificate (which may be called "target encryption key") can be obtained through the target binding relationship.

[0102] Optionally, when obtaining the target encryption key, a preset mapping set may be obtained first. When the preset mapping set is obtained, the preset mapping set may be searched through the target binding relationship to obtain the target encryption key corresponding to the target binding relationship.

[0103] The preset mapping set may represent a mapping between at least one binding relationship and at least one encryption key, and each binding relationship may include a name identifier of a digital certificate and an identity identifier of a key center corresponding to the digital certificate.

[0104] In an embodiment of the present application, since the binding relationship between the name identifier of the digital certificate and the identity identifier of the key center is unique, the encryption key used to encrypt the digital certificate queried through the binding relationship is also unique. Encrypting the digital certificate with a unique encryption key can avoid repeated generation of the encrypted digital certificate, ensure the uniqueness of the encrypted digital certificate, thereby preventing the digital certificate from being forged and improving the security of the digital certificate.

[0105] Optionally, when responding to the digital certificate application request, the SSP may also obtain the entity identifier of the target digital certificate included in the request parameters of the target digital certificate, and the external key generated by the target key center.

[0106] When the entity identifier and the external key of the target digital certificate are obtained, a signature request (Certificate Signing Request, CSR) of the target digital certificate can be generated by the entity identifier and the external key of the target digital certificate.

[0107] When a CSR is generated, it can be sent to a Certificate Authority (CA), also known as a "certificate issuing organization." Upon receiving the CSR, the CA can verify it. If the CSR passes verification, it generates a target digital certificate and sends it to the SSP, allowing the SSP to obtain the target digital certificate corresponding to the digital certificate application request.

[0108] Exemplarily, the SSP may generate an external key application request and send the external key application request to the target key center, so that upon receiving the external key application request, the target key center responds to the external key application request and generates an external key corresponding to the external key application request. When generating the external key, the target key center may send the generated external key to the SSP, so that the SSP obtains the external key.

[0109] In the embodiments of the present application, because the external key is physically isolated from the entity identifier of the target digital certificate, it is possible to ensure that the external key will not be leaked when the entity identifier of the target digital certificate is attacked, thereby ensuring the security of the signature request for the target digital certificate generated using the external key and the entity identifier of the target digital certificate. Based on the security of the signature request, a secure target digital certificate can be received. Furthermore, based on the security of the target digital certificate, a secure encrypted target digital certificate can be generated, further improving the security of the digital certificate.

[0110] S240: Encrypt the target digital certificate based on the target encryption key to generate an encrypted target digital certificate.

[0111] Exemplarily, when the target encryption key and the target digital certificate are obtained, the target digital certificate may be encrypted using the target encryption key to obtain an encrypted target digital certificate (ie, a digital key).

[0112] In such Figure 2In the illustrated method 200, when responding to a digital certificate application request, it is necessary to obtain the name identifier of the digital certificate requested by the digital certificate application (i.e., the target digital certificate) and the identity identifier of the key center corresponding to the target digital certificate (i.e., the target key center). The name identifier of the target digital certificate and the identity identifier of the target key center are then bound to obtain a binding relationship between the name identifier of the target digital certificate and the identity identifier of the target key center. An encryption key (i.e., a target encryption key) used to encrypt the target digital certificate is then obtained from this binding relationship. The target digital certificate is then encrypted using the target encryption key to obtain the encrypted target digital certificate. By binding the name identifier of the digital certificate and the identity identifier of the key center corresponding to the digital certificate, binding verification between the name identifier of the digital certificate and the identity identifier of the key center can be achieved, avoiding the possibility of one name identifier corresponding to multiple identity identifiers or multiple name identifiers corresponding to one identity identifier. This ensures a one-to-one correspondence between the name identifier of the digital certificate and the identity identifier of the key center, ensuring a unique binding relationship. Based on the uniqueness of the binding relationship, the digital certificate generated using this binding relationship is also unique, thereby preventing the digital certificate from being forged and improving the security of the digital certificate. Furthermore, based on the fact that digital certificates are more secure, digital keys generated based on digital certificates can also be made more secure, thereby improving the security and reliability of digital keys.

[0113] Optionally, when responding to a digital certificate application request, the SSP may also obtain the batch number of the target digital certificate and the Uniform Resource Locator (URL) of the target digital certificate included in the request parameters of the target digital certificate. Upon obtaining the batch number and URL of the target digital certificate, a mapping relationship between the batch number and the URL of the target digital certificate may be established.

[0114] After the mapping relationship between the batch number of the target digital certificate and the URL is established, if you need to obtain the encrypted target digital certificate, you can query the encrypted target digital certificate through the mapping relationship between the batch number of the target digital certificate and the batch number of the target digital certificate.

[0115] Specifically, when querying the encrypted target digital certificate through the mapping relationship between the batch number of the target digital certificate and the batch number of the target digital certificate, you can first query the URL that can download the target digital certificate through the mapping relationship between the batch number of the target digital certificate and the batch number of the target digital certificate, and then obtain the encrypted target digital certificate through the URL.

[0116] In an embodiment of the present application, by establishing a mapping relationship between the batch number of the target digital certificate and the uniform resource identifier of the target digital certificate, when querying the encrypted target digital certificate corresponding to the batch number, the uniform resource identifier of the target digital certificate can be directly located through the batch number of the target digital certificate and the pre-established mapping relationship, so that the encrypted target digital certificate can be queried in the uniform resource identifier of the target digital certificate, thereby limiting the access of the batch number of the non-target digital certificate to the uniform resource identifier of the target digital certificate, and further improving the security of the digital certificate.

[0117] It should be noted that Figure 2 All steps in Figure 3 The corresponding embodiments are described in detail in the accompanying drawings and will not be repeated here.

[0118] Figure 3 This is an interactive diagram of a method for generating a digital certificate provided by an embodiment of the present application, wherein the DK platform, SSP, KMS and CA can communicate with each other and perform data transmission.

[0119] The DK platform can initiate digital certificate application operations and is an execution platform for digital key-related businesses.

[0120] The SSP can issue a digital certificate for the DK platform. Furthermore, after issuing the digital certificate, the SSP can also set access permissions for the certificate to prevent unauthorized access. For example, the digital certificate can only unlock the vehicle doors, or it can simultaneously unlock the doors and start the vehicle. Bidirectional authentication can be performed between the DK platform and the SSP to ensure secure and trustworthy communication between the two platforms.

[0121] KMS generates and manages keys and is responsible for key-related operations, such as generating a Key Management Center (KMC), also known as an "internal key component." KMC centrally generates, stores, distributes, and manages keys corresponding to digital certificates, improving key management efficiency and security.

[0122] CA is responsible for issuing digital certificates (referred to as "certificates") and verifying and reviewing applications for digital certificates.

[0123] For example, Figure 3 As shown, the method 300 includes the following implementation process:

[0124] S1 uploads certificate request parameters.

[0125] For example, when a digital key needs to be generated, the DK platform may upload a digital certificate application request for a digital certificate (ie, the target digital certificate) used to generate the digital key, as well as request parameters of the target digital certificate, to the SSP.

[0126] The request parameters of the target digital certificate may include at least one of the following:

[0127] The Secure Element Vendor Identifier (SEID) is the chip identifier of the target digital certificate. Different SEIDs can correspond to different encryption keys.

[0128] Application quantity (Number, Num): The maximum application quantity of the target digital certificate can be defined through SSP.

[0129] Common Data can include a Distinguished Name (DN) list file. The DN (i.e., the entity identifier of the target digital certificate) can be used to identify the holder of the digital certificate or the device holding the certificate. The DN list file can include at least one of the following: the DK identifier, the SSP identifier, the Common Name (CN), the Organization Name (O), and the Organizational Unit (OU).

[0130] The application type of the digital certificate (Certificate Type, Cert Type). If there is no application type, no application for the target digital certificate will be made.

[0131] The return format of the digital certificate (Certificate Format, CertFormat).

[0132] The algorithm type for key derivation. If no algorithm type is specified, no key derivation is performed.

[0133] S2 obtains the identification item in the certificate request parameter, and when the identification item is a duplicate identification item, returns the duplicate identification item without recording it; when the identification item is not a duplicate identification item, records the relationship between the identification items.

[0134] For example, upon receiving the request parameters of the target digital certificate uploaded by the DK platform, the SSP may parse the request parameters of the target digital certificate to obtain the identification items in the request parameters of the target digital certificate, such as the DN and SEID (which may be recorded as "DN & SEID"), where the DN and SEID correspond one to one.

[0135] When the SSP obtains a DN&SEID, it can check whether the DN&SEID is the same as a previously received DN&SEID. This means the SSP determines whether the DN&SEID is a duplicate identifier. This prevents multiple digital certificates from corresponding to the same identifier, or vice versa. This ensures that each identifier corresponds to only one digital certificate, thus ensuring the uniqueness of the digital certificate.

[0136] If the SSP determines that the DN&SEID is a duplicate, it can return the DN&SEID to the DK platform without recording the received DN&SEID. By not recording duplicates, each digital certificate can be guaranteed to have a unique identifier, preventing multiple identifiers from corresponding to the same digital certificate, preventing digital certificate forgery, and ensuring the security of the digital certificate.

[0137] When the SSP determines that the DN&SEID is not a duplicate identifier, that is, the SSP receives the DN&SEID for the first time, it records the association between the DN&SEIDs. By recording the non-duplicate identifier, it is easier to identify, query and manage the DN&SEID in the future.

[0138] S3 return parameters.

[0139] Exemplarily, after completing the recording of the association relationship between DN & SEID, the SSP returns the return parameters of the target digital certificate to the DK platform.

[0140] When the return parameters of the target digital certificate are successfully returned to the DK platform, the return parameters may include at least one of the following: the digital certificate batch number (BNum) and the digital certificate download address (URL). If the return parameters of the target digital certificate fail to be returned to the DK platform, the SSP may return the reason for the failure and related information to the DK platform.

[0141] S4 sets the location where the identification item DN is placed in the certificate.

[0142] For example, after completing the record of the association relationship between DN & SEID, SSP can determine in which attribute item(s) of the Subject field of the target digital certificate the DN is stored, so as to facilitate the rapid and accurate identification of the identity information corresponding to the target digital certificate during the digital certificate verification and management process.

[0143] S5 applies to generate KMC.

[0144] For example, the SSP can first check whether the target digital certificate has been applied for before through the SEID. If the target digital certificate has not been applied for before through the SEID, it is necessary to first apply to the KMS to generate the KMC (i.e., the target key center) corresponding to the target digital certificate to ensure the secure generation and security verification of the key. By checking whether the target digital certificate has been applied for before through the SEID, it is possible to avoid generating multiple target digital certificates corresponding to the same SEID, which would lead to redundant target digital certificates, and ensure the uniqueness of the target digital certificate.

[0145] If the target digital certificate (i.e. the historical digital certificate) has been applied for before through SEID and has expired, it means that the historical digital certificate is no longer trustworthy and may have been forged. Therefore, to ensure the security of the digital certificate, you can re-apply to KMS to generate the KMC corresponding to the target digital certificate.

[0146] If a digital certificate has been applied for before through SEID (i.e. the above-mentioned historical digital certificate) and is valid, it means that the historical digital certificate is still credible and you can directly obtain the historical digital certificate applied for through SEID.

[0147] S6 returns KMC_KeyID.

[0148] For example, when KMS receives an application from SSP to generate KMC, it can respond to the request to generate KMC, generate KMC corresponding to the target digital certificate, and return the unique identifier of the generated KMC (which can be recorded as "KMC_KeyID") to SSP, so that SSP can accurately identify and use the KMC corresponding to KMC_KeyID through KMC_KeyID, access and operate the KMC corresponding to KMC_KeyID, and provide key identification information for subsequent key management processes.

[0149] S7 applies to generate GEN_Root_Key.

[0150] For example, upon receiving the KMC_KeyID returned by the KMC, the SSP may also apply for the GEN_Root_Key (root key) from the KMS.

[0151] S8 returns GEN_Root_KeyID.

[0152] For example, upon receiving an SSP's request to generate a GEN_Root_Key, the KMS can respond to the request, perform key derivation, and generate the GEN_Root_Key. The KMS also returns the unique identifier of the generated GEN_Root_Key (which can be recorded as "GEN_Root_KeyID") to the SSP, allowing the SSP to identify the GEN_Root_Key through the GEN_Root_KeyID, facilitating the recording, tracking, and subsequent use of the GEN_Root_Key, ensuring accurate operation and management of the root key and its derived keys in the complex key management process.

[0153] S9 records KMC_KeyID and GEN_Root_KeyID.

[0154] Exemplarily, upon receiving the KMC_KeyID and GEN_Root_KeyID sent by the KMS, the SSP may record the KMC_KeyID and the GEN_Root_KeyID.

[0155] SSP can also determine the number of times to apply for the target digital certificate in a loop based on the number of certificates corresponding to the batch number of the target digital certificate, and set the time interval between each loop application for the target digital certificate, so as to apply for the target digital certificate in a more reasonable and orderly manner, and avoid the problem of excessive pressure on the SSP system due to concentrated applications, which may lead to the failure of the target digital certificate application.

[0156] For example, if the number of certificates corresponding to the batch number of the target digital certificate is 100, you can set the target digital certificate to be applied for 10 times in a cycle from 9:00 to 17:00, and each cycle is applied for with an interval of 5 minutes until the application is successful.

[0157] S10 establishes a CN, KMC-KeyID binding relationship.

[0158] Exemplarily, the SSP can bind the CN (i.e., the name identifier of the above-mentioned target digital certificate) in the target digital certificate with the KMC-KeyID (i.e., the identity identifier of the above-mentioned target key center) in a preset manner (e.g., hash association) to establish a binding relationship between CN and KMC-KeyID. Through the binding relationship between CN and KMC-KeyID, it can be ensured that the keys corresponding to CN and KMC-KeyID correspond one to one, avoiding the possibility of confusion of multiple keys. In addition, through the binding relationship between CN and KMC-KeyID, it is possible to avoid repeated generation of target digital certificates through binding verification, resulting in redundancy of target digital certificates, and ensure the uniqueness of the target digital certificate. In addition, through the binding relationship between CN and KMC-KeyID, the anti-attack capability of the generated digital certificate can also be improved, ensuring the security of the digital certificate.

[0159] S11 applies to generate a key pair.

[0160] For example, the SSP may apply to an external KMS to generate a key pair for encryption and decryption (ie, the external key mentioned above), and manage and protect the key pair with the help of the KMS security mechanism to ensure the security and availability of the target digital certificate application.

[0161] S12 returns the key pair.

[0162] For example, when KMS receives an application from SSP to generate a key pair, it can respond to the request to generate a key pair, generate a key pair, and return the generated key pair to SSP, so that SSP can obtain the key pair for actual operations to perform encryption, signing and other operations on digital certificates.

[0163] Moreover, since the key pair is generated by KMS instead of SSP itself, it can be used as an external key pair of SSP, ensuring that the key pair is physically isolated from SSP, reducing the risk of key leakage due to SSP attack, and ensuring the security of the key pair.

[0164] S13 retrieves the DN and key pair to generate a CSR.

[0165] For example, when the SSP obtains the key pair sent by the KMS, it can retrieve the DN and the key pair, and generate a CSR for the target digital certificate using the DN and the key pair.

[0166] S14 applies for a digital certificate.

[0167] For example, when generating a CSR, the SSP may apply to the CA to generate a target digital certificate and initiate the application process for the target digital certificate. The target digital certificate issued by the CA can ensure the security and credibility of the target digital certificate.

[0168] The CSR is a crucial document used to apply for a target digital certificate from a CA. It contains the identity and public key of the entity applying for the target digital certificate. The purpose of generating a CSR is to prove to the CA the identity of the applicant and the legitimacy of the request, allowing the CA to issue a valid target digital certificate based on the information in the CSR.

[0169] S15 returns the digital certificate.

[0170] For example, when the CA receives a request from the SSP to apply for a target digital certificate, it can respond to the request to apply for a target digital certificate, generate a target digital certificate, and return the generated target digital certificate to the SSP, so that the SSP can obtain a legitimate digital certificate for the DK platform, and implement identity authentication, digital encryption and other functions through the legitimate digital certificate to ensure the safe operation of the DK platform.

[0171] S16 checks the digital certificate.

[0172] Exemplarily, when the SSP obtains the target digital certificate returned by the CA, it may verify the target digital certificate to determine the security of the target digital certificate.

[0173] S17 applies for encryption private key.

[0174] For example, when the SSP verifies the target digital certificate, in order to ensure the confidentiality of the target digital certificate, it may send a request for an encryption private key to the KMS, so as to encrypt the target digital certificate using the encrypted private key.

[0175] S18 returns the encrypted private key.

[0176] For example, upon receiving a request from the SSP for an encryption private key, the KMS can respond to the request, encrypt the private key, obtain an encrypted private key (i.e., the target encryption key), and return the encrypted private key to the SSP. Upon obtaining the encrypted private key, the SSP uses it to encrypt the target digital certificate.

[0177] S19 applies for GEN_Key.

[0178] Exemplarily, the SSP calls GEN_Root_Key using DN as a derivation factor to apply to the KMS for deriving a new key Gen_Key.

[0179] S20 returns GEN_Key.

[0180] Exemplarily, the KMS returns the generated GEN_Key to the SSP. Furthermore, there is no plain text in the GEN_Key, thus preventing unauthorized access and use of the GEN_Key and ensuring the security of the GEN_Key.

[0181] S21 applies for encryption GEN_Key.

[0182] For example, when the SPP obtains the GEN_Key, in order to ensure the confidentiality of the target digital certificate, it may apply to the KMS for an encrypted GEN_Key.

[0183] S21 returns the GEN_Key ciphertext.

[0184] Exemplarily, when KMS receives a request from SPP to encrypt GEN_Key, it can respond to the request to encrypt GEN_Key, encrypt GEN_Key, and obtain GEN_Key ciphertext (i.e., the encrypted GEN_Key). And return the encrypted GEN_Key (i.e., the above-mentioned target encryption key) to SSP. When SSP obtains the encrypted GEN_Key, it uses the encrypted GEN_Key to encrypt the target digital certificate encrypted by the encrypted private key again to further ensure the confidentiality of the target digital certificate. At this point, the target digital certificate has been encrypted twice. The first time is to encrypt the target digital certificate by the encrypted private key to obtain the target digital certificate encrypted by the encrypted private key; the second time is to encrypt the target digital certificate encrypted by the encrypted private key again by the encrypted GEN_Key to obtain a twice-encrypted target digital certificate.

[0185] S22 generates and stores a digital certificate in a set format, and names the digital certificate in the set format as CN+batch number.

[0186] For example, the SSP may convert the target digital certificate issued by the CA according to the return format of the digital certificate in the request parameter of the target digital certificate (which may be referred to as the "set format"), generate a target digital certificate in the set format, and store the target digital certificate in the set format.

[0187] Furthermore, the CN and the batch number of the target digital certificate are concatenated (ie, CN+batch number) to obtain a certificate name corresponding to the target digital certificate in a set format.

[0188] S23 associates the batch number with the URL.

[0189] For example, after SPP completes naming the target digital certificate, it can associate the batch number of the target digital certificate with the URL to control access to the corresponding URL based on the permission attributes of the batch number, effectively preventing malicious tampering and man-in-the-middle attacks, and ensuring legal access to the URL.

[0190] S24 checks the progress of digital certificate application.

[0191] Exemplarily, the DK platform can query the application progress of the target digital certificate in the SSP through the batch number of the target digital certificate returned by the SPP to query whether the application for the target digital certificate is completed.

[0192] S25 returns the digital certificate application progress.

[0193] For example, upon receiving the query information about the target digital certificate application progress from the DK platform, the SSP may return the target digital certificate application progress to the DK platform, such as the target digital certificate being applied for, the target digital certificate application completed, or the target digital certificate not yet applied for.

[0194] S26 downloads the digital certificate according to the batch number.

[0195] For example, when the SSP returns a message indicating that the target digital certificate application is complete, the DK platform can initiate a download request from the SSP based on the target digital certificate's batch number and access the target digital certificate's related resources through the URL corresponding to the target digital certificate's batch number. Downloading the target digital certificate from the URL corresponding to the target digital certificate's batch number ensures that the target digital certificate corresponding to the batch number is obtained, avoiding errors in obtaining the target digital certificate.

[0196] When the SSP returns that the target digital certificate application is not completed, it can return a target digital certificate not generated message to inform the DK platform that the certificate cannot be obtained at present.

[0197] S27 returns the digital certificate.

[0198] Exemplarily, when the target digital certificate is downloaded, the SSP may return the target digital certificate to the DK platform, so that the DK platform can obtain the applied target digital certificate.

[0199] S28 archives the digital certificate.

[0200] Illustratively, after the target digital certificate is successfully downloaded, the SSP may archive the target digital certificate to facilitate subsequent management and storage of the target digital certificate.

[0201] For example, the SSP archives the target digital certificate within a preset time, which may be 1 day, 4 days, or 30 days, etc., and is not limited in this embodiment of the present application.

[0202] S29 requests signature.

[0203] For example, the DK platform may request the SSP to sign the target digital certificate, that is, encrypt the target digital certificate to generate a digital signature, thereby ensuring the integrity and authenticity of the digital certificate.

[0204] S30 applies for GEN_Key.

[0205] Exemplarily, when the SSP receives a request from the DK platform for the signature of the target digital certificate, it can apply to the KMS for a derived key Gen_Key based on the DN to prepare an encryption key for the signature of the target digital certificate.

[0206] S31 returns GEN_Key.

[0207] Exemplarily, the KMS returns the generated GEN_Key to the SSP.

[0208] S32 calls the signature interface.

[0209] Exemplarily, when receiving the GEN_Key, the SSP may call the signature interface to sign the GEN_Key in the KMS to obtain a signature result.

[0210] It should be understood that the signatures in the embodiments of the present application are configurable, and different signatures can be selected according to different needs, which increases the flexibility and applicability of the signatures.

[0211] S33 returns the signature result.

[0212] Exemplarily, when the signing is completed, the KMS may return the signing result (ie, the signed digital certificate) to the SSP.

[0213] S34 returns the signature result.

[0214] Exemplarily, when the SSP obtains the signature result, it may forward the signature result to the DK platform so that the DK platform obtains the signature result.

[0215] S35 receives the signature result.

[0216] Exemplarily, the DK platform receives the signature result sent by the SSP to generate a digital key using the signature result.

[0217] In summary, when responding to a digital certificate application request, the name identifier of the digital certificate is bound to the identity identifier of the key center corresponding to the digital certificate, and a binding verification between the name identifier of the digital certificate and the identity identifier of the key center is implemented to ensure that the name identifier of the digital certificate corresponds to the identity identifier of the key center one by one, so that the binding relationship is unique. On the basis of the uniqueness of the binding relationship, the digital certificate generated by the binding relationship is also unique, thereby preventing the digital certificate from being forged and improving the security of the digital certificate. In addition, by judging whether the identifier of the digital certificate (i.e., the above-mentioned second identifier) is a repeated identifier item, it is possible to avoid the problem of the digital certificate identifier being a repeated identifier item and being recorded each time, which ultimately leads to the generation of multiple corresponding digital certificates, i.e., one identifier corresponds to multiple digital certificates, resulting in the problem of digital certificate redundancy, and thus ensuring the uniqueness of the digital certificate. In addition, by establishing a mapping relationship between the batch number of the target digital certificate and the uniform resource identifier of the target digital certificate, the batch number of the non-target digital certificate can be restricted from accessing the uniform resource identifier of the target digital certificate, further improving the security of the digital certificate.

[0218] It should be understood that the above examples are intended to help those skilled in the art understand the embodiments of the present application, and are not intended to limit the embodiments of the present application to the specific numerical values or specific scenarios illustrated. Those skilled in the art can obviously make various equivalent modifications or variations based on the above examples, and such modifications or variations also fall within the scope of the embodiments of the present application.

[0219] Combined with the above Figures 1 to 3 The method for generating a digital certificate provided by the embodiment of the present application is described in detail; Figure 4 and Figure 5 The device embodiments of the present application are described in detail. It should be understood that the devices in the embodiments of the present application can execute the various methods of the aforementioned embodiments of the present application, that is, the specific working processes of the following various products can refer to the corresponding processes in the aforementioned method embodiments.

[0220] Figure 4 This is a structural diagram of a device for generating a digital certificate provided in an embodiment of the present application.

[0221] For example, Figure 4 As shown, the apparatus 400 includes:

[0222] The acquisition module 410 is configured to, in response to the digital certificate application request, acquire the name identifier of the target digital certificate requested by the digital certificate application request; and acquire the identity identifier of the target key center, wherein the target key center is the key center of the target digital certificate, and the key center is used to generate encryption keys;

[0223] The binding module 420 is used to bind the name identifier and the identity identifier to obtain a target binding relationship;

[0224] The processing module 430 is configured to obtain a target encryption key based on the target binding relationship;

[0225] The encryption module 440 is configured to encrypt the target digital certificate based on the target encryption key to generate an encrypted target digital certificate.

[0226] In a possible implementation, the acquisition module 410 is further configured to:

[0227] Obtaining a first identifier of a target digital certificate, wherein the first identifier includes a chip identifier of the target digital certificate;

[0228] Determining whether a historical digital certificate has been generated based on the first identifier;

[0229] The acquisition module 410 is specifically used for:

[0230] If no historical digital certificate has been generated based on the first identifier, obtaining the identity identifier;

[0231] In the case where a historical digital certificate has been generated based on the first identifier, if the historical digital certificate is invalid, the identity identifier is obtained.

[0232] In one possible implementation, the acquisition module 410 is specifically configured to:

[0233] Generate an application request to the target key center;

[0234] Sending the application request to the key management platform, so that the key management platform generates a target key center in response to the application request;

[0235] Receive the identity of the target key center sent by the key management platform.

[0236] In a possible implementation, the acquisition module 410 is further configured to:

[0237] Get the latest generation time of historical digital certificates;

[0238] The processing module 430 is further configured to:

[0239] Determine the time difference between the current time and the latest generated time;

[0240] When the time difference is greater than or equal to the preset time length, it is determined that the historical digital certificate is invalid.

[0241] In a possible implementation, the acquisition module 410 is further configured to:

[0242] Obtaining a second identifier of the target digital certificate, wherein the second identifier includes an entity identifier and a chip identifier of the target digital certificate, and the entity identifier includes a name identifier;

[0243] The processing module 430 is further configured to:

[0244] Determining whether the second identifier is an identifier received for the first time;

[0245] When the second identifier is the identifier received for the first time, recording the association relationship between the entity identifier and the chip identifier in the second identifier;

[0246] If the second identifier is not the identifier received for the first time, the second identifier is not recorded.

[0247] In a possible implementation, the acquisition module 410 is further configured to:

[0248] Obtain the batch number and uniform resource identifier of the target digital certificate;

[0249] The processing module 430 is further configured to:

[0250] A mapping relationship between the batch number and the uniform resource identifier is established to query the encrypted target digital certificate through the batch number and the mapping relationship.

[0251] In a possible implementation, the acquisition module 410 is further configured to:

[0252] Obtain the external key generated by the target key center;

[0253] The processing module 430 is further configured to:

[0254] Generate a signing request for the target digital certificate based on the entity identifier of the target digital certificate and the external key;

[0255] If the signature request is verified successfully, the target digital certificate sent by the certificate issuing center is received.

[0256] In one possible implementation, the processing module 430 is specifically configured to:

[0257] Obtaining a preset mapping set, wherein the preset mapping set is used to represent a mapping between a binding relationship and an encryption key, wherein the binding relationship includes a name identifier of a digital certificate and an identity identifier of a key center corresponding to the digital certificate;

[0258] Based on the target binding relationship, a query is performed in the preset mapping set to obtain the target encryption key.

[0259] It should be noted that the above-mentioned device 400 is embodied in the form of a functional module. The term "module" here can be implemented in the form of software and / or hardware, and is not specifically limited to this.

[0260] For example, a "module" may be a software program, a hardware circuit, or a combination of the two that implements the aforementioned functionality. The hardware circuit may include an application-specific integrated circuit (ASIC), an electronic circuit, a processor (e.g., a shared processor, a dedicated processor, or a combination of processors) and memory for executing one or more software or firmware programs, combined logic circuits, and / or other suitable components that support the described functionality.

[0261] Therefore, the modules of each example described in the embodiments of this application can be implemented with electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0262] Figure 5 It is a structural diagram of an electronic device provided in an embodiment of the present application.

[0263] For example, Figure 5 As shown, the electronic device 500 includes: a memory 510 and a processor 520, wherein the memory 510 stores an executable program code 5101, and the processor 520 is used to call and execute the executable program code 5101 to perform a method for generating a digital certificate.

[0264] This application can divide the electronic device into functional modules based on the above-mentioned method examples. For example, each functional module can be mapped to a specific functional module, or two or more functions can be integrated into a processing module. The above-mentioned integrated module can be implemented in the form of hardware. It should be noted that the division of modules in this embodiment is illustrative and is only a logical functional division. In actual implementation, other division methods may be used.

[0265] In the case of dividing the functional modules into corresponding functional modules, the electronic device may include: an acquisition module, a binding module, a processing module, an encryption module, etc. It should be noted that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0266] The electronic device provided in this application is used to execute the above-mentioned method of generating a digital certificate, and thus can achieve the same effect as the above-mentioned implementation method.

[0267] In the case of an integrated unit, the electronic device may include a processing module and a storage module. The processing module may be used to control and manage the operation of the electronic device, and the storage module may be used to support the electronic device in executing relevant program codes and data.

[0268] The processing module may be a processor or controller that implements or executes the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processor (DSP) and a microprocessor, and the storage module may be a memory.

[0269] The present application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the aforementioned methods. The computer-readable storage medium may include, but is not limited to, any type of disk, including a floppy disk, an optical disk, a DVD (Digital Video Disc), a CD-ROM (Compact Disc Read-Only Memory), a microdrive, a magneto-optical disk, a ROM (Read-Only Memory), a RAM (Random Access Memory), an EPROM (Erasable Programmable Read-Only Memory), an EEPROM (Electrically Erasable Programmable Read-Only Memory), a DRAM (Dynamic Random Access Memory), a VRAM (Video Random Access Memory), a flash memory device, a magnetic or optical card, a nanosystem (including a molecular memory IC), or any other type of medium or device suitable for storing instructions and / or data.

[0270] The present application also provides a computer program product. When the computer program product is run on a computer, the computer is caused to execute the above-mentioned related steps to implement a method for generating a digital certificate in the above-mentioned embodiment.

[0271] In addition, the electronic device provided in the embodiments of the present application can specifically be a chip, component or module, and the electronic device may include a connected processor and memory; wherein the memory is used to store instructions, and when the electronic device is running, the processor can call and execute instructions to enable the chip to execute a method for generating a digital certificate in the above embodiment.

[0272] Among them, the electronic device, computer-readable storage medium, computer program product or chip provided in this application are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above, and will not be repeated here.

[0273] Through the description of the above implementation methods, technical personnel in the relevant field can understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0274] In the embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of modules or units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0275] The above content is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A method for generating a digital certificate, characterized in that: The method comprises: In response to a digital certificate application request, obtaining a name identifier of a target digital certificate requested by the digital certificate application request; and obtaining an identity identifier of a target key center, wherein the target key center is a key center of the target digital certificate, and the key center is used to generate an encryption key; Binding the name identifier to the identity identifier to obtain a target binding relationship; Based on the target binding relationship, obtaining a target encryption key; The target digital certificate is encrypted based on the target encryption key to generate an encrypted target digital certificate.

2. The method according to claim 1, characterized in that In response to the digital certificate application request, the method further includes: Acquire a first identifier of the target digital certificate, wherein the first identifier includes a chip identifier of the target digital certificate; Determining whether a historical digital certificate has been generated based on the first identifier; The step of obtaining the identity of the target key center includes: If the historical digital certificate has not been generated based on the first identifier, obtaining the identity identifier; In the case where the historical digital certificate has been generated according to the first identifier, if the historical digital certificate is invalid, the identity identifier is obtained.

3. The method according to claim 2, characterized in that The obtaining of the identity identifier includes: generating an application request for the target key center; Sending the application request to a key management platform, so that the key management platform generates the target key center in response to the application request; Receive the identity of the target key center sent by the key management platform.

4. The method according to claim 2, characterized in that In the case where the historical digital certificate exists, the method further includes: Obtain the latest generation time of the historical digital certificate; Determine the time difference between the current time and the latest generated time; When the time difference is greater than or equal to a preset time period, it is determined that the historical digital certificate is invalid.

5. The method according to claim 1, wherein In response to the digital certificate application request, the method further includes: Acquire a second identifier of the target digital certificate, wherein the second identifier includes an entity identifier and a chip identifier of the target digital certificate, and the entity identifier includes the name identifier; Determining whether the second identifier is an identifier received for the first time; When the second identifier is received for the first time, recording the association between the entity identifier and the chip identifier in the second identifier; If the second identifier is not the first identifier received, the second identifier is not recorded.

6. The method according to any one of claims 1 to 5, characterized in that The method further comprises: Obtaining the batch number of the target digital certificate and the uniform resource identifier of the target digital certificate; A mapping relationship between the batch number and the uniform resource identifier is established to query the encrypted target digital certificate through the batch number and the mapping relationship.

7. The method according to any one of claims 1 to 5, characterized in that The method further comprises: Obtaining an external key generated by the target key center; Generate a signing request for the target digital certificate based on the entity identifier of the target digital certificate and the external key; When the signature request is verified to be successful, the target digital certificate sent by the certificate issuing center is received.

8. The method according to any one of claims 1 to 5, characterized in that The obtaining of a target encryption key based on the target binding relationship includes: Obtaining a preset mapping set, wherein the preset mapping set is used to represent a mapping between a binding relationship and an encryption key, the binding relationship including a name identifier of a digital certificate and an identity identifier of a key center corresponding to the digital certificate; The target encryption key is obtained by querying the preset mapping set based on the target binding relationship.

9. A device for generating a digital certificate, characterized in that: The device comprises: an acquisition module, configured to, in response to a digital certificate application request, acquire a name identifier of a target digital certificate requested by the digital certificate application request; and acquire an identity identifier of a target key center, wherein the target key center is a key center of the target digital certificate, and the key center is used to generate an encryption key; A binding module, configured to bind the name identifier to the identity identifier to obtain a target binding relationship; a processing module, configured to obtain a target encryption key based on the target binding relationship; The encryption module is used to encrypt the target digital certificate based on the target encryption key to generate an encrypted target digital certificate.

10. An electronic device, characterized in that: The electronic device comprises: a memory for storing executable program code; A processor, configured to call and run the executable program code from the memory, so that the electronic device executes the method according to any one of claims 1 to 8.

Images