Intelligent mobile terminal digital certificate issuing method and system based on ACME specification

Abstract

The invention discloses an intelligent mobile terminal digital certificate issuing method based on an ACME specification, and the method comprises the steps: S1, enabling a client to request to create an order, and enabling the identification type to be a mobile phone number; s2, the server generates an order and returns the order to an authorized object list; s3, the client accesses the authorized object and obtains access URLs of two challenge objects of short message authentication and voice dialing authentication; s4, the client selects one authentication mode to access the corresponding challenge object; s5, the server side sends an authentication token value through a short message or voice dialing according to the selection of the client side; s6, the client calculates an authentication information value based on the token and the account key and returns the authentication information value; s7, the server verifies the authentication information, and waits for the client certificate application if the verification is passed; and S8, executing a certificate application and downloading process by the client. According to the invention, an automatic digital certificate issuing service can be provided for the intelligent mobile terminal, the number changing software is effectively prevented from counterfeiting a mobile phone number, and the security is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data security verification, and in particular to a method, system, device and storage medium for issuing digital certificates for smart mobile terminals based on the ACME specification. Background Art

[0002] Smart mobile terminals are portable devices with computing, mobile communication, and programmable capabilities, such as smartphones, tablets, and IoT devices. They enable a wide range of intelligent applications and services. In recent years, with the rapid development of the mobile internet, digital certificates for smart mobile terminals have seen widespread development and are widely used to ensure internet communication security, electronic payments, application security, and enterprise remote work. By verifying identity and encrypting data, digital certificates effectively enhance the security of mobile devices and strengthen user trust in online services.

[0003] While the development of digital certificates for smart mobile terminals has significantly advanced mobile security, the management of digital certificates still faces the following challenges: (1) User experience issues: When users apply for a digital certificate on a smart mobile terminal, they generally need to enter their personal identity information and mobile phone number on the terminal and perform tedious user operations such as face recognition and SMS authentication; (2) The problem of mis-issuance of certificates: CA organizations issue certificates for one set of mobile phone numbers to smart mobile terminals with another set of mobile phone numbers due to audit errors or other security reasons; (3) Certificate renewal issue: Since smart mobile terminals are electronic consumer products that are frequently replaced, in order to ensure the security of smart mobile terminal certificates, CA organizations generally set a relatively short validity period for terminal certificates. The shorter the validity period of the terminal certificate, the more frequently users need to perform certificate renewal operations; (4) Compatibility issues: The service interfaces of different CAs are different, and there is a lack of a relatively unified standard, which leads to differences in user operations and application docking.

[0004] The existing IETF ACME standard significantly reduces the complexity and cost of HTTPS deployment and maintenance by automating the application, verification, issuance, and renewal processes for SSL / TLS certificates. This significantly advances internet encryption and improves overall network security, enabling more websites and services to easily adopt HTTPS and protect user data and privacy. While ACME currently doesn't specify how smart mobile devices should perform automated certificate application, verification, issuance, and renewal, it is an open technical standard that manufacturers can extend based on application needs.

[0005] To this end, this application specifically proposes a method and system for issuing digital certificates for smart mobile terminals based on the ACME specification to solve the above technical problems. Summary of the Invention

[0006] The main purpose of the present invention is to provide a method and system for issuing digital certificates for smart mobile terminals based on the ACME specification, which can simplify and automate the process of applying for, verifying, issuing and renewing smart mobile terminal certificates to solve the technical problems raised in the background technology.

[0007] The present invention adopts the following technical solutions to solve the above technical problems: A method for issuing digital certificates for smart mobile terminals based on the ACME specification, comprising: S1. After the client obtains the challenge code and registers its account and key according to the ACME standard process, it requests the server to create a new order, adding "mobile" to the identifier type and setting its value to the client's mobile phone number. S2. After receiving the create order request, the server generates an order ID and a list of authorized objects containing a "mobile" type identifier. The list of authorized objects contains a randomly generated authorization object identifier and the corresponding authorization object URL. S3. The client performs the authorization object URL access operation based on the returned authorization object list and obtains the access URLs for the SMS authentication and voice dial authentication challenge objects from the server. S4. The client selects one of the SMS authentication or voice dial authentication methods and accesses the corresponding challenge object URL; S5. The server sends a randomly generated authentication token to the authentication phone number via SMS or voice dialing, using the notification authentication method selected by the client, with "ACME token:" as the header. S6. The client obtains the token value based on the notification authentication method, calculates the authentication information according to the ACME standard and the account key, and finally sends the authentication information back to the server based on the corresponding notification authentication method. The authentication information uses the corresponding encoding structure based on the notification authentication method. S7. The server receives the authentication information and locally calculates the authentication information using the same method. It compares the two sets of authentication information to see if they are consistent. If they are, it prepares to accept the client's certificate request. S8. The client accesses the order object, submits the certificate request, and downloads the certificate according to the ACME standard process.

[0008] Preferably, the specified challenge objects accessed by the client in the S4 step include "sms-01" and "phone-call-01", which respectively represent the notification authentication method using SMS authentication and the voice dialing authentication method using voice dialing authentication. The token values ​​of the SMS authentication and voice dialing authentication methods will be transmitted to the smart mobile terminal via SMS or voice dialing respectively. Preferably, the notification authentication method is SMS authentication, and the notification content in the SMS in step S5 includes: a prefix of "ACME token:" followed by a Base64 encoding of a 16-byte token value; In the step S6, the key authorization value keyAuthorization = token || '.' || base64url(Thumbprint(accountKey)), where Thumbprint adopts the SM3 algorithm.

[0009] Preferably, in the step S6, the client uses SMS authentication when sending authentication information to the server. The authentication information in the SMS includes: a prefix of "ACME keyAuthorization:", followed by a Base64 encoding of a 16-byte token value, followed by a group of '.', and finally a Base64 encoding of the SM3 value of the account key. All characters are encoded in ASCII.

[0010] Preferably, the notification authentication method is voice dialing authentication for authenticating a mobile phone number, and in the S5 step, the notification content sends a randomly generated authentication token value through the SIP protocol, and adds an "ACMEtoken" header field to the INVITE message of the notification content to transmit the token value, and the server transmits the token value through the dial tone DTMF, processes the 16-byte token value as an integer, converts it into a decimal character, and has a maximum of 39 digits, where the number starts with an "*" and ends with a "#", and during the transmission process, the DTMF is transmitted for 0.1 seconds per character; The authentication information received by the server in step S7 is a dial tone.

[0011] Preferably, in step S6, after receiving the dial number from the server, the client determines whether it is the phone number of the CA side. If so, it obtains the token value from the SIP header. If the token value cannot be obtained from the SIP header, it monitors the DTMF dial tone sent by the server and then decodes the token value. The authentication information in step S6 includes the digest value of the token and the account key, where the digest value of the account key is Thumbprint(token||accountKey), and Thumbprint uses the SM3 algorithm and has a length of 32 bytes; The process of the client returning the authentication information in step S6 also includes: returning the authentication dial tone, processing the 32-byte SM3 value as an integer, converting it into decimal characters, starting with an "*" and ending with a "#" in front of the number, and transmitting it during the transmission process at 0.1 seconds per DTMF character.

[0012] Preferably, in the step S7, after the server receives the dial tone feedback from the client, it decodes to obtain the Thumbprint(token||accountKey) value, and uses the same method to locally calculate the SM3 value of the token and the user account key, and compares whether the two sets of SM3 values ​​are consistent. If they are consistent, it is ready to accept the client's certificate application request.

[0013] On the other hand, the present invention further discloses a smart mobile terminal digital certificate issuance system based on the ACME specification, which is used to execute any of the above-mentioned smart mobile terminal digital certificate issuance methods based on the ACME specification, including an ACME server and an ACME client: The ACME server and ACME client both include an account and key management module, an order management module, a text message authentication module, and a voice dialing authentication module. The order management module is used to automatically issue digital certificates for smart mobile terminals. The ACME server also includes a certificate issuance and download module, and the ACME client also includes a key and certificate management module; After the ACME client is installed on the smart mobile terminal, the smart mobile terminal authorizes the ACME client to allow it to read and send text messages, or make calls.

[0014] In another aspect, the present invention further discloses a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the above method.

[0015] On the other hand, the present invention further discloses a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the above method.

[0016] As can be seen from the above technical solution, the present invention provides a method and system for issuing digital certificates for smart mobile terminals based on the ACME specification. Compared with the existing technology, the present invention has the following advantages: 1. The present invention provides two options for authentication: SMS authentication and voice dialing authentication. This can adapt to different smart mobile terminal usage scenarios, thereby meeting diverse authentication needs and improving the applicability of the system in different scenarios.

[0017] 2. This invention uses an ACME server-side authentication method that proactively sends text messages or voice calls to the client. Compared to client-side authentication, this method offers superior authentication capabilities and effectively prevents clients from impersonating phone numbers through number-changing software, thereby enhancing authentication security and improving the safety factor of the entire certificate issuance process.

[0018] 3. By improving the authentication and order management processes, the present invention can achieve full automation from authentication to certificate issuance, renewal, and revocation without human intervention, and can adapt to unattended scenarios, and is suitable for applications such as IoT mobile terminals.

[0019] 4. By using the digest value of the token and account key as authentication information in voice dialing authentication, this invention can utilize each token change to make the digest value unique and shorten the information length, compared to the ACME standard key authorization method that directly calculates the account key digest value. This improves replay resistance and reduces DTMF transmission time, thereby enhancing the security of voice authentication and optimizing the user experience.

[0020] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become easy to understand through the following description. Of course, it is not necessary to achieve all of the above-mentioned advantages simultaneously in order to implement any product of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings, which constitute part of this application, are intended to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are intended to explain the present invention and do not constitute an undue limitation of the present invention. In the accompanying drawings: Figure 1 Schematic diagram of the overall system architecture of the present invention; Figure 2 This is a schematic diagram of the overall method flow of Example 1 of the present invention; Figure 3 This is a flow chart of a distinguishing method according to the second embodiment of the present invention; Figure 4 This is a schematic diagram of the ACME client of the present invention creating an order operation based on the ACME standard; Figure 5This is a schematic diagram of the ACME server returning the order object's posting information; Figure 6 This is a schematic diagram of the ACME server returning the posting information of the authorization object of the present invention; Figure 7 Schematic diagram of the ACME server transmitting a token value and the ACME client transmitting an authorization key value via SMS. Figure 8 This is a schematic diagram of the ACME server sending a message with a token value via the SIP protocol; Figure 9 This is a schematic diagram of the ACME server transmitting a token value through a dial tone DTMF and the ACME client transmitting authentication information through a dial tone DTMF. DETAILED DESCRIPTION

[0022] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. In the absence of conflict, the embodiments in this application and the features in the embodiments can be combined with each other. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0023] In the embodiment, see Figures 1 to 9 .

[0024] like Figure 1 As shown, the embodiment of the present invention is based on the ACME specification of the smart mobile terminal digital certificate issuance method and system, which is used to issue a device certificate with the mobile phone number as the subject for the smart mobile terminal. Its logical structure is as follows Figure 1 As shown, it involves smart mobile terminals, ACME servers, CA systems, mobile operators, and other parts.

[0025] The smart mobile terminal is installed with the ACME client APP (or SDK), which provides digital certificates and electronic signatures and other functions for upper-level applications such as e-commerce, e-government, and the Internet of Things through the application interface module.

[0026] The present invention mainly involves the improvement of ACME client and ACME server to meet the demand for automatic issuance of digital certificates for smart mobile terminals.

[0027] Example 1 In the first embodiment, the present invention proposes a method for issuing digital certificates for smart mobile terminals based on the ACME specification, which supports automatic authentication of mobile terminals based on SMS or voice dialing, and automatically issues digital certificates after authentication is passed. Figure 2 As shown, the specific steps include: L1. After the ACME client completes the acquisition of the challenge code and registration of the account and its key according to the ACME standard process, it creates a new order and submits the content based on the ACME standard, such as Figure 4 As shown, unlike the "dns" type in RFC8555, this invention adds an identification type called "mobile", the value of which is the mobile phone number of the mobile terminal; L2. After receiving the create order request, the ACME server generates an order ID, sets the order status to pending, and returns the order object information, which contains a list of authorized objects, such as Figure 5 As shown, unlike the "dns" type in RFC8555, this invention adds an identification type called "mobile", the value of which is the client's mobile phone number; L3. The ACME client follows the ACME standard process and accesses an authorization object in the authorization object list returned in step L2 (URL such as " / acme / authz / PaniVnsZcis", where "PaniVnsZcis" is the authorization object identifier randomly generated by the server). L4.ACME server returns authorization object information, such as Figure 6 As shown, unlike the "dns-01" and "http-01" challenge objects of RFC8555, this invention designs two challenge objects, "sms-01" and "phone-call-01", which respectively represent the mobile phone number of the client terminal using SMS authentication or voice dialing authentication. The token value of the SMS authentication or voice dialing authentication method will be transmitted to the smart mobile terminal via SMS or voice dialing respectively; In this embodiment, taking SMS authentication as an example, the subsequent steps are as follows: L5a. The ACME client follows the standard ACME process and, based on the authorization object information returned in step L4, accesses the SMS authentication challenge object (URL such as " / acme / authz / prV_B7yEyA4," where "prV_B7yEyA4" is the challenge object identifier randomly generated by the server). This indicates that the client is waiting for the server's SMS authentication. The server accepts the challenge and returns "OK." L6a. The ACME server sends a randomly generated authentication token value via SMS. Figure 7As shown, the SMS prefix is ​​"ACME token:" (11 characters), followed by the Base64 encoding of the 16-byte token value (22 characters). The total number of characters is 33 (11 + 22), which is less than the standard capacity limit of a single text message (SMS) (140 bytes) and can be sent in one SMS. L7a. The ACME client obtains the token value from the received SMS message and then calculates the key authorization keyAuthorization based on the token and the account key according to the ACME standard. KeyAuthorization = token||'.'||base64url(Thumbprint(accountKey)). Thumbprint uses the SM3 algorithm and is 32 bytes long. L8a.ACME client returns the authentication SMS and sends keyAuthorization. Figure 8 As shown, the SMS prefix is ​​"ACME keyAuthorization:" (22 characters), followed by the Base64 encoding of the 16-byte token value (22 characters), followed by a '.', and finally the Base64 encoding of the SM3 value of the account key accountKey (43 characters). The total number of characters is 88 (22+22+1+43), encoded in ASCII, which is less than the standard capacity limit of a single text message (SMS) (140 bytes) and can be sent in one SMS message. L9a. The ACME server receives the authentication SMS, obtains the keyAuthorization value, and uses the same method to calculate the keyAuthorization value locally. It then compares the two keyAuthorization values ​​to see if they match. If so, the order status is set to ready, indicating that the server is ready to accept the ACME client's certificate request. L10a. Finally, the ACME client follows the standard ACME process, accesses the order object, submits the certificate request, and downloads the corresponding certificate.

[0028] In this embodiment, compared with conventional communication transmission protocols, reference Figure 7 By setting the identifiers "ACME token:" and "ACME keyAuthorization:" at the beginning of the SMS, the program can filter SMS messages and prevent misoperation.

[0029] Further, in the specific operation implementation process, refer to Figure 2According to the ACME normal process, the ACME server will return the token value, and then the ACME client will calculate the key authorization keyAuthorization based on the token value. The ACME client will then write the keyAuthorization to the website page (or DNS TXT record) and wait for the ACME server to access and authenticate. At this time, this application has the originality of the SMS authentication process, such as Figure 2 Step 5 of the process is redesigned based on the characteristics of SMS authentication. The ACME server does not return the token value. Instead, in step 6, it sends the token value to the ACME client via SMS. The ACME client then calculates the key authorization keyAuthorization and sends it to the ACME server via SMS for authentication.

[0030] Therefore, this operation can avoid the tedious operation of the client writing keyAuthorization to the web page or DNS record in the traditional process. It is more suitable for smart mobile terminal scenarios and improves the convenience and automation of certificate application.

[0031] Example 2 Based on the specific method flow of the above embodiment 1, in embodiment 2, the embodiment of the present invention further proposes another implementation of a method for issuing a digital certificate for a smart mobile terminal based on the ACME specification based on steps L1 to L4 of the above embodiment 1, specifically including: L1. After the ACME client completes the acquisition of the challenge code and registration of the account and its key according to the ACME standard process, it creates a new order and submits the content based on the ACME standard, such as Figure 4 As shown, unlike the "dns" type in RFC8555, this invention adds an identification type called "mobile", the value of which is the mobile phone number of the mobile terminal; L2. After receiving the create order request, the ACME server generates an order ID, sets the order status to pending, and returns the order object information, which contains a list of authorized objects, such as Figure 5 As shown, unlike the "dns" type in RFC8555, this invention adds an identification type called "mobile", the value of which is the client's mobile phone number; L3. The ACME client follows the ACME standard process and accesses an authorization object in the authorization object list returned in step L2 (URL such as " / acme / authz / PaniVnsZcis", where "PaniVnsZcis" is the authorization object identifier randomly generated by the server). L4.ACME server returns authorization object information, such as Figure 6As shown, unlike the "dns-01" and "http-01" challenge objects of RFC8555, this invention designs two challenge objects, "sms-01" and "phone-call-01", which respectively represent the mobile phone number of the client terminal using SMS authentication or voice dialing authentication. The token value of the SMS authentication or voice dialing authentication method will be transmitted to the smart mobile terminal via SMS or voice dialing respectively; In this embodiment, if SMS authentication is not suitable for the mobile terminal side, voice dialing authentication can also be selected. Figure 3 The steps are as follows: L5b. The ACME client follows the standard ACME process and, based on the authorization object information returned in step L4, accesses the voice dial authentication challenge object (URL such as " / acme / authz / Rg5dV14Gh1Q," where "Rg5dV14Gh1Q" is the challenge object identifier randomly generated by the server). This indicates that the client is waiting for the server's voice dial authentication. The server accepts the challenge and returns OK. L6b.ACME server automatically dials the authenticated mobile number. The IP-based voice dialing can send a randomly generated authentication token value through the SIP protocol. Figure 8 As shown in the figure, add the "ACME token:" header field in the INVITE message to pass the token value. After the call is dialed, the ACME server also passes the token value through the dial tone DTMF. Figure 9 As shown, the 16-byte token value is processed as an integer and converted into decimal characters (the maximum value of 16 bytes processed as an integer is 340282366920938463463374607431768211455, which has 39 digits. For example, "DGyRejmCefe7v4NfDGDKfA" is converted into decimal characters after Base64 decoding as "16514454643167489983773097483969809020"). To ensure error correction, the number can be preceded by an "*" and ended with a "#". This results in a maximum of 41 characters (39+2). To further ensure recognition rate, the DTMF character can be transmitted at 0.1 seconds per character, which takes a total of 0.1*41=4.1 seconds to transmit. L7b. After the ACME client detects a dialup call from the ACME server and determines it's from the CA, it automatically connects the call and attempts to retrieve the token from the SIP header. If the token can't be retrieved from the SIP header due to carrier network filtering, it listens for the DTMF dial tone sent by the ACME server and decodes the token. The digest used for authentication is calculated as: Thumbprint(token||accountKey). Thumbprint uses the SM3 algorithm and is 32 bytes long. Using the digest of the token and account key as authentication information is shorter and more replay-resistant than the standard ACME key authorization keyAuthorization. L8b.ACME client returns authentication dial tone, where Figure 9 As shown, the 32-byte SM3 value in the previous step is processed as an integer and converted into a decimal character with a maximum of 78 digits. Similarly, in the specific implementation process, the number can also be required to start with "*" and end with "#", so the maximum number of characters is 80 (78+2). In addition, to ensure the recognition rate, the DTMF character can be transmitted at 0.1 seconds per character, and a total of 0.1*80=8 seconds is required for transmission. L9b. After receiving the DTMF tone from the client, the ACME server decodes the Thumbprint(token||accountKey) value and locally calculates the SM3 value of the token and the user account key using the same method. The two SM3 values ​​are compared to see if they are consistent. If they are, the order status is set to ready, indicating that the server is ready to accept the certificate request from the ACME client. L10b. Finally, the ACME client follows the standard ACME process, accesses the order object, submits the certificate request, and downloads the corresponding certificate.

[0032] In this embodiment, compared with conventional communication transmission protocols, reference Figure 8 The method of setting the SIP INVITE message transmission token in the VoIP voice call starts with "ACME token:", and Figure 9 Based on the limitations of DTMF dialing voice transmission, the transmitted data is encoded in decimal to meet the DTMF transmission requirements. At the same time, the "*" at the beginning and the "#" at the end are added to improve the error correction capability.

[0033] Further, in the specific operation implementation process, refer to Figure 2According to the ACME normal process, the ACME server will return the token value, and then the ACME client will calculate the key authorization keyAuthorization based on the token value. The ACME client will then write the keyAuthorization to the website page (or DNS TXT record) and wait for the ACME server to access and authenticate. At this time, this application has the originality of the voice authentication process, such as Figure 3 Step 5b of the process has been redesigned based on the characteristics of voice dial authentication. The ACME server does not return the token value. Instead, in step 6b, the token value is sent to the ACME client via voice dialing. The ACME client then calculates the token and account key digest value (it should be explained that this is not key authorization) and sends the token and account key digest value to the ACME server for authentication via DTMF voice.

[0034] Therefore, this operation can leverage the unique voice dialing authentication process, with the server actively transmitting the token via voice, and the client responding with a digest value of the token and account key. This not only adapts to the characteristics of voice transmission, but also enhances authentication security through dynamically changing digest values, while also shortening transmission time and optimizing the user experience.

[0035] Furthermore, since the token changes each time, the calculated digest value will also be different each time. However, the ACME standard key authorization keyAuthorization directly calculates the digest value of the account key, and this digest value is always the same. Therefore, in voice dial authentication, the digest value of the token and account key, Thumbprint(token||accountKey), is used as the authentication information. Therefore, the authentication information of the present invention has the advantage of better anti-replay.

[0036] In addition, the digest value of the token and account key is shorter than the entire key authorization keyAuthorization, which takes less time to transmit DTMF voice and provides a better user experience.

[0037] In summary, this embodiment adopts the digest value of the token and account key as authentication information in voice dialing authentication. Compared with the ACME standard key authorization method that directly calculates the digest value of the account key, it can make the digest value unique and shorten the information length by taking advantage of each token change, thereby improving anti-replay and reducing DTMF transmission time, thereby enhancing the security of voice authentication and optimizing the user experience.

[0038] At this time, the ACME client can automatically authenticate and apply for a digital certificate based on the methods and mechanisms used in the above two sets of embodiments. At this time, by providing two authentication methods, SMS authentication and voice dialing authentication, it can adapt to different smart mobile terminal usage scenarios, thereby meeting diverse authentication needs and improving the applicability of the system in different scenarios.

[0039] At the same time, by improving the authentication and order management processes, this method can achieve full automation from authentication to certificate issuance, renewal, and revocation without human intervention, and can adapt to unattended scenarios, making it suitable for applications such as IoT mobile terminals.

[0040] In addition, the ACME client regularly checks the validity period of the digital certificate and can automatically renew the certificate based on the ACME standard process specifications before the digital certificate expires.

[0041] In addition, when a smart mobile terminal is deactivated, a mobile phone number is deactivated, or a key is leaked, a digital certificate needs to be revoked. The terminal user can trigger the certificate revocation operation in the ACME client, and the process can be carried out according to the ACME standard. Similarly, the CA can also directly revoke the digital certificate, and the process can be carried out according to the CA / PKIX standard.

[0042] In summary, this method uses the ACME server to actively send text messages or voice dialing to the client for authentication. Compared with the client actively sending text messages or voice dialing to the server, this method has better authentication capabilities and can effectively prevent the client from impersonating the mobile phone number through number changing software, thereby achieving the effect of enhancing authentication security and improving the security factor of the entire certificate issuance process.

[0043] On the other hand, the present invention also discloses a system for issuing digital certificates for smart mobile terminals based on the ACME specification, comprising: (1) The ACME server mainly includes an account and key management module, an order management module, a text message authentication module, a voice dial authentication module, and a certificate issuance and download module. The text message authentication module and the voice dial authentication module are newly added modules of the present invention, and the order management module is the module to be improved by the present invention to achieve the automatic issuance of digital certificates for smart mobile terminals. The account and key management module and the certificate issuance and download module are standard ACME server modules. The present invention does not need to improve them and simply uses their existing functions.

[0044] (2) ACME client, mainly including account and key management module, order management module, SMS authentication module, voice dial authentication module, key and certificate management module, etc. The SMS authentication module and voice dial authentication module are newly added modules of the present invention, and the order management module is the module to be improved by the present invention to realize the automatic issuance of digital certificates for smart mobile terminals. The account and key management module and the key and certificate management module are standard modules of the ACME client. The present invention does not need to improve them, but only uses their existing functions. After the ACME client is installed on the smart mobile terminal, the device manufacturer or terminal user needs to authorize the ACME client so that it can read and send text messages, or even make calls.

[0045] Therefore, the present invention provides a method and system for issuing digital certificates for smart mobile terminals based on the ACME specification. The system primarily improves upon the standard ACME server and client, adding SMS authentication and voice dialing authentication modules, and improving the order management module. This enables the entire system to meet the requirements for automatic issuance of digital certificates for smart mobile terminals. Furthermore, by retaining standard modules such as account and key management on the ACME server and client, and improving and adding only necessary modules, the system can reduce development workload and costs, ultimately enabling automatic issuance of digital certificates for smart mobile terminals at a lower cost.

[0046] In summary, this system architecture adapts to the automatic issuance process of digital certificates for smart mobile terminals by adding SMS authentication modules and voice dialing authentication modules based on ACME specifications on the ACME server and client, and improving the order management module. This ensures good compatibility between the ACME server and client, facilitating integration with the ACME standard system.

[0047] In another aspect, the present invention further discloses a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the above method.

[0048] On the other hand, the present invention further discloses a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the above method.

[0049] In another embodiment provided by the present application, a computer program product including instructions is also provided. When the computer is run on the computer, the computer executes any of the methods and systems for issuing digital certificates for smart mobile terminals based on the ACME specification in the above embodiments.

[0050] It is understandable that the system provided by the embodiment of the present invention corresponds to the method provided by the embodiment of the present invention, and the explanation, examples and beneficial effects of the relevant contents can refer to the corresponding parts of the above method.

[0051] The embodiment of the present application further provides an electronic device, comprising a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus. Memory for storing computer programs; The processor is configured to implement the ACME-based smart mobile terminal digital certificate issuance method and system when executing the program stored in the memory.

[0052] The communication bus mentioned in the above electronic device can be a peripheral component interconnect standard bus or an extended industry standard architecture bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc.

[0053] The communication interface is used for communication between the above electronic device and other devices.

[0054] The memory may include a random access memory, or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0055] The above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor, etc.; it can also be a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component.

[0056] It should also be noted that electronic devices also include terminal devices, which can also be called terminals, user equipment, mobile stations, mobile terminals, etc. Terminal devices can be mobile phones, smart TVs, wearable devices, tablet computers, computers with wireless transceiver functions, virtual reality terminal devices, augmented reality terminal devices, wireless terminals in industrial control, wireless terminals in unmanned driving, wireless terminals in remote surgery, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, etc. The embodiments of this application do not limit the specific technology and specific device form used by the terminal devices.

[0057] In the above embodiments, all or part of the embodiments can be implemented using software, hardware, firmware, or any combination thereof. When implemented using software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions described in the embodiments of the present application are generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that can be accessed by a computer, or a data storage device such as a server or data center that integrates one or more available media. The available medium can be magnetic media (e.g., floppy disk, hard disk, tape), optical media, or semiconductor media (e.g., solid-state drive).

[0058] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

[0059] In addition, it should be noted that if the embodiments of the present invention involve directional indications (such as up, down, left, right, front, back, etc.), the directional indications are only used to explain the relative position relationship, movement status, etc. between the components in a certain specific posture. If the specific posture changes, the directional indications will also change accordingly.

[0060] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present invention, the descriptions of "first", "second", etc. are only for descriptive purposes and cannot be understood as indicating or suggesting their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of such features. In addition, the meaning of "and / or" appearing throughout the text includes three parallel schemes. Taking "A and / or B" as an example, it includes scheme A, or scheme B, or schemes in which A and B are satisfied at the same time. In addition, in the embodiments of the present invention, "multiple" refers to more than two. In addition, the technical solutions between the various embodiments can be combined with each other, but it must be based on the ability of ordinary technicians in this field to implement. When the combination of technical solutions is mutually contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

Claims

1. A method for issuing digital certificates for smart mobile terminals based on the ACME specification, characterized in that: include: S1. After the client obtains the challenge code and registers its account and key according to the ACME standard process, it requests the server to create a new order, adding "mobile" to the identifier type and setting its value to the client's mobile phone number. S2. After the server receives the create order request, it generates an order ID and a list of authorized objects containing a "mobile" type identifier. The list of authorized objects contains a randomly generated authorization object identifier and the corresponding authorization object URL on the server. S3. The client performs the authorization object URL access operation based on the returned authorization object list and obtains the access URLs for the SMS authentication and voice dial authentication challenge objects from the server. S4. The client selects one of the SMS authentication or voice dial authentication methods and accesses the corresponding challenge object URL; S5. The server sends a randomly generated authentication token to the authentication phone number via SMS or voice dialing, using the notification authentication method selected by the client, with "ACME token:" as the header identifier. S6. The client obtains the token value based on the notification authentication method, calculates the authentication information according to the ACME standard and the account key, and finally sends the authentication information to the server based on the corresponding notification authentication method. The authentication information uses the corresponding encoding structure based on the notification authentication method. S7. The server receives the authentication information and locally calculates the authentication information using the same method. It compares the two sets of authentication information to see if they are consistent. If they are, it prepares to accept the client's certificate request. S8. The client accesses the order object, submits the certificate request, and downloads the certificate according to the ACME standard process.

2. The method for issuing digital certificates for smart mobile terminals based on the ACME specification according to claim 1, wherein: The specified challenge objects accessed by the client in step S4 include "sms-01" and "phone-call-01", which respectively represent the notification authentication method using SMS authentication and voice dialing authentication. The token values ​​of the SMS authentication and voice dialing authentication methods will be transmitted to the smart mobile terminal via SMS or voice dialing, respectively.

3. The method for issuing digital certificates for smart mobile terminals based on the ACME specification according to claim 2, wherein: The notification authentication method is SMS authentication. The notification content in step S5 includes in the SMS: a prefix "ACMEtoken:" followed by a Base64 encoding of a 16-byte token value. In the step S6, the key authorization value keyAuthorization = token || '.' || base64url(Thumbprint(accountKey)), where Thumbprint adopts the SM3 algorithm.

4. The method for issuing digital certificates for smart mobile terminals based on the ACME specification as claimed in claim 3, wherein: In step S6, the client uses SMS authentication to send authentication information to the server. The authentication information in the SMS includes: a prefix "ACME keyAuthorization:", followed by a Base64 encoding of a 16-byte token value, followed by a group of '.', and finally a Base64 encoding of the SM3 value of the account key. All characters are encoded in ASCII.

5. The method for issuing digital certificates for smart mobile terminals based on the ACME specification according to claim 2, wherein: The notification authentication method is voice dialing authentication for authenticating a mobile phone number. In the S5 step, the notification content sends a randomly generated authentication token value through the SIP protocol, and adds an "ACME token" header field to the INVITE message of the notification content to transmit the token value. The server transmits the token value through a dial tone DTMF. The 16-byte token value is processed as an integer and converted into decimal characters with a maximum of 39 digits, where the digits start with an "*" and end with a "#". During the transmission process, each DTMF character is transmitted at a rate of 0.1 seconds.

6. The method for issuing digital certificates for smart mobile terminals based on the ACME specification according to claim 5, wherein: In step S6, after receiving the dial-up number from the server, the client determines whether it is the phone number of the CA. If so, it obtains the token value from the SIP header. If the token value cannot be obtained from the SIP header, it monitors the DTMF dial tone sent by the server and decodes the token value. The authentication information in step S6 includes the digest value of the token and the account key, where the digest value of the account key is Thumbprint(token||accountKey), and Thumbprint uses the SM3 algorithm and has a length of 32 bytes; The process of the client returning the authentication information in step S6 also includes: returning the authentication dial tone, processing the 32-byte SM3 value as an integer, converting it into decimal characters, starting with an "*" and ending with a "#" in front of the number, and transmitting it at a DTMF rate of 0.1 seconds per character during the transmission process; The authentication information received by the server in step S7 is a dial tone.

7. The method for issuing digital certificates for smart mobile terminals based on the ACME specification according to claim 6, wherein: In step S7, after the server receives the client authentication information, it decodes and obtains the Thumbprint(token||accountKey) value, and uses the same method to locally calculate the SM3 value of the token and the user account key, and compares the two sets of SM3 values ​​to see if they are consistent. If they are consistent, it is ready to accept the client's certificate application request.

8. A system for issuing digital certificates for smart mobile terminals based on the ACME specification, configured to execute the method for issuing digital certificates for smart mobile terminals based on the ACME specification as described in any one of claims 1 to 7, characterized in that: Including ACME server and ACME client: The ACME server and ACME client both include an account and key management module, an order management module, a text message authentication module, and a voice dialing authentication module. The order management module is used to automatically issue digital certificates for smart mobile terminals. The ACME server also includes a certificate issuance and download module, and the ACME client also includes a key and certificate management module; After the ACME client is installed on the smart mobile terminal, the smart mobile terminal authorizes the ACME client to allow it to read and send text messages, or make calls.

Images