An intelligent mobile terminal digital certificate issuing method and system based on ACME specification

Abstract

The application discloses a kind of based on ACME specification's intelligent mobile terminal digital certificate issuing method, comprising: S1.client requests to create order, and identification type is mobile phone number;S2.server generates order and returns authorization object list;S3.client visits authorization object, obtains the access URL of two challenge objects of short message authentication and voice dialing authentication;S4.client selects one kind of authentication mode, and accesses corresponding challenge object;S5.server is selected according to client, and authentication token value is sent by short message or voice dialing;S6.client is based on token and account key and calculates authentication information value and returns;S7.server verifies authentication information, if it is verified to pass then wait for client certificate application;S8.client executes certificate application and download process.The application can provide automated digital certificate issuing service for intelligent mobile terminal, effectively avoid the false mobile phone number of number changing software, improve security.

Description

Technical Field

[0001] This invention relates to the field of data security verification technology, specifically to a method, system, device, and storage medium for issuing digital certificates for smart mobile terminals based on the ACME standard. Background Technology

[0002] Smart mobile terminals are portable devices with computing, mobile communication, and programmable capabilities, such as smartphones, tablets, and IoT devices, enabling a variety of smart applications and services. In recent years, with the rapid development of the mobile internet, digital certificates for smart mobile terminals have seen comprehensive development and are widely used to ensure internet communication security, electronic payments, application security, and remote work for enterprises. Digital certificates effectively improve the security level of mobile devices and enhance user trust in online services by verifying identity and encrypting data.

[0003] However, while the development of digital certificates for smart mobile devices has brought significant progress to mobile security, the management of digital certificates themselves still faces the following challenges: (1) User experience issues: When a user applies for a digital certificate on a smart mobile terminal, they generally need to enter their personal identity information and mobile phone number on the terminal and perform cumbersome user operations such as face recognition and SMS authentication. (2) The problem of wrong certificate issuance: Due to auditing errors or other security reasons, the CA institution issues a certificate for one set of mobile phone numbers to another set of mobile phone numbers on a smart mobile terminal; (3) Certificate update issue: Since smart mobile terminals are electronic consumer products that are frequently replaced, in order to ensure the security of smart mobile terminal certificates, CA institutions generally set a relatively short validity period for terminal certificates. At this time, the shorter the validity period of the terminal certificate, the more frequently users need to perform certificate update operations. (4) Compatibility issues: Different CAs have different service interfaces and lack a relatively unified standard, resulting in differences in user operations and application integration.

[0004] In existing technologies, the IETF's ACME standard exists, which significantly reduces the complexity and cost of HTTPS deployment and maintenance by automating the application, verification, issuance, and renewal process of SSL / TLS certificates. This powerfully promotes the encryption process of the internet, improves the overall network security level, and enables more websites and services to easily adopt HTTPS, protecting user data and privacy. Currently, ACME does not specify how smart mobile terminals should automate certificate application, verification, issuance, and renewal. However, ACME itself is an open technical standard, and manufacturers can extend it according to their application needs.

[0005] Therefore, this application proposes a method and system for issuing digital certificates for smart mobile terminals based on the ACME standard to solve the above-mentioned technical problems. Summary of the Invention

[0006] The main objective of this invention is to provide a method and system for issuing digital certificates for smart mobile terminals based on the ACME standard, which can simplify and automate the application, verification, issuance and renewal process of smart mobile terminal certificates, thereby solving the technical problems mentioned in the background art.

[0007] The present invention solves the above-mentioned technical problems by adopting the following technical solutions: A method for issuing digital certificates for smart mobile terminals based on the ACME specification, comprising: S1. After the client completes the acquisition of the challenge code, registration of the account and its key according to the ACME standard process, it requests the server to create a new order and adds "mobile" to the identifier type, the value of which is the client's mobile phone number; S2. After receiving the order creation request, the server generates an order ID and a list of authorized objects containing the "mobile" type identifier. The list of authorized objects contains an authorized object identifier randomly generated by the server and the corresponding authorized object URL. S3. Based on the returned list of authorized objects, the client performs the access operation of the authorized object URL to obtain the access URLs of the two types of challenge objects, namely SMS authentication and voice dialing authentication, from the server; S4. The client selects either SMS authentication or voice dialing authentication and accesses the corresponding challenge target URL; S5. The server sends a randomly generated authentication token value to the authentication mobile number via SMS or voice dialing according to the notification authentication method selected by the client, with "ACME token:" as the header identifier. S6. The client obtains the token value based on the notification authentication method, calculates the authentication information according to the ACME standard and the account key, and finally sends the authentication information back to the server based on the corresponding notification authentication method. The authentication information adopts the corresponding encoding structure based on the notification authentication method. S7. The server receives the authentication information and calculates the authentication information locally using the same method. It compares the two sets of authentication information to see if they match. If they match, it prepares to accept the client's certificate application request. S8. Following the ACME standard process, the client accesses the order object, submits a certificate request, and downloads the certificate.

[0008] Preferably, the specified challenge object accessed by the client in step S4 includes "sms-01" and "phone-call-01", which respectively represent the notification authentication method using SMS authentication and the voice dialing authentication method using voice dialing authentication. The token values ​​of the SMS authentication and voice dialing authentication methods will be transmitted to the smart mobile terminal via SMS or voice dialing, respectively. Preferably, the notification authentication method is SMS authentication, and the notification content in step S5 includes in the SMS: a prefix of "ACME token:" followed by a 16-byte token value in Base64 encoding; In step S6, the key authorization value is set to keyAuthorization = token || '.' || base64url(Thumbprint(accountKey)), where Thumbprint uses the SM3 algorithm.

[0009] Preferably, in step S6, the client sends authentication information to the server using SMS authentication. The authentication information in the SMS includes: a prefix of "ACME keyAuthorization:", followed by a 16-byte Base64 encoded token value, a group of '.', and finally the Base64 encoded SM3 value of the account key. The total number of characters is encoded in ASCII.

[0010] Preferably, the notification authentication method is voice dialing authentication of the mobile phone number. In step S5, the notification content sends a randomly generated authentication token value through the SIP protocol, and adds an "ACMEtoken" header field to the INVITE message of the notification content to transmit the token value. The server transmits the token value through DTMF dial tone, processes the 16-byte token value as an integer, converts it into decimal characters, with a maximum of 39 digits, where the numbers begin with "*" and end with "#". During transmission, each character is transmitted at 0.1 seconds according to DTMF. In step S7, the authentication information received by the server is a dial tone.

[0011] Preferably, in step S6, after the client receives the dialing from the server, it determines whether it is the phone number of the CA. If so, it obtains the token value from the SIP header. If the token value cannot be obtained from the SIP header, it listens to the DTMF dialing tone sent by the server and then decodes the token value. The authentication information in step S6 includes the digest value of the token and the account key, wherein the digest value of the account key is Thumbprint(token||accountKey), and the Thumbprint uses the SM3 algorithm and has a length of 32 bytes. The process of the client returning the authentication information in step S6 also includes: returning the authentication dial tone, processing the 32-byte SM3 value as an integer, converting it into decimal characters, starting with "*" and ending with "#", and transmitting it at 0.1 seconds per DTMF character during the transmission process.

[0012] Preferably, in step S7, after the server receives the dial tone from the client, it decodes it to obtain the Thumbprint(token||accountKey) value, and calculates the SM3 values ​​of the token and the user account key locally using the same method. It then compares whether the two sets of SM3 values ​​are consistent. If they are consistent, the server prepares to accept the client's certificate application request.

[0013] On the other hand, this invention also discloses a digital certificate issuance system for smart mobile terminals based on the ACME specification, used to execute any of the aforementioned digital certificate issuance methods for smart mobile terminals based on the ACME specification, including an ACME server and an ACME client: Both the ACME server and ACME client include an account and key management module, an order management module, an SMS authentication module, and a voice dialing authentication module, wherein the order management module is used to automatically issue digital certificates for smart mobile terminals; The ACME server also includes a certificate issuance and download module, and the ACME client also includes a key and certificate management module. After the smart mobile terminal installs the ACME client, it authorizes the ACME client to read and send text messages, or to answer phone calls.

[0014] In another aspect, the present invention also discloses a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the method described above.

[0015] In another aspect, the present invention also discloses a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the method described above.

[0016] As can be seen from the above technical solution, the present invention provides a method and system for issuing digital certificates for smart mobile terminals based on the ACME specification. Compared with the prior art, the present invention has the following advantages: 1. This invention provides two authentication methods—SMS authentication and voice dialing authentication—to adapt to different smart mobile terminal usage scenarios, thereby meeting diverse authentication needs and improving the system's applicability in different scenarios.

[0017] 2. This invention employs an authentication method where the ACME server proactively sends SMS or voice dialing to the client. Compared to the client proactively sending SMS or voice dialing to the server, this method offers superior authentication capabilities and effectively prevents clients from impersonating phone numbers using number spoofing software. This enhances authentication security and improves the overall security of the certificate issuance process.

[0018] 3. By improving the authentication and order management process, this invention can achieve full automation from authentication to certificate issuance, renewal, and revocation without human intervention, and can adapt to unattended scenarios, making it suitable for applications such as IoT mobile terminals.

[0019] 4. This invention uses the digest values ​​of the token and account key as authentication information in voice dialing authentication. Compared with the direct calculation of the digest value of the account key in the ACME standard key authorization, this invention can make the digest value unique with each token change and shorten the information length, thereby improving anti-replay performance and reducing DTMF transmission time, which facilitates enhanced voice authentication security and optimized user experience.

[0020] It should be understood that the descriptions in this section are not intended to identify key or essential features of embodiments of the invention, nor are they intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Of course, implementing any product of the invention does not necessarily require achieving all of the advantages described above simultaneously. Attached Figure Description

[0021] The accompanying drawings, which form part of this application, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings: Figure 1 This is a schematic diagram of the overall system architecture of the present invention; Figure 2 This is a schematic diagram of the overall method flow of Embodiment 1 of the present invention; Figure 3 This is a schematic diagram of the differentiation method in Embodiment 2 of the present invention; Figure 4 This is a schematic diagram illustrating the document information for order creation operations based on the ACME standard in the ACME client of this invention. Figure 5This is a schematic diagram illustrating the document information returned by the ACME server for the order object in this invention. Figure 6 This is a schematic diagram illustrating the document information returned by the ACME server to the authorized object according to the present invention; Figure 7 This is a schematic diagram illustrating the message information of the ACME server transmitting the token value via SMS and the ACME client transmitting the authorization key value via SMS according to the present invention. Figure 8 This is a schematic diagram illustrating the message information sent by the ACME server of this invention via the SIP protocol to transmit a token value; Figure 9 This is a schematic diagram illustrating the message transmission of the ACME server via dial tone DTMF and the ACME client via dial tone DTMF. Detailed Implementation

[0022] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Unless otherwise specified, the embodiments and features in the embodiments of this application can be combined with each other. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] For details in the embodiments, please refer to Figures 1 to 9 .

[0024] like Figure 1 As shown in the figure, the present invention provides a method and system for issuing digital certificates for smart mobile terminals based on the ACME specification. This method and system are used to issue device certificates for smart mobile terminals with mobile phone numbers as the subject. Its logical structure is as follows: Figure 1 As shown, it involves smart mobile terminals, ACME server, CA system, mobile operators and other parts.

[0025] The smart mobile terminal is equipped with an ACME client APP (or SDK), which provides digital certificates and electronic signatures for upper-layer applications such as e-commerce, e-government, and Internet of Things through the application interface module.

[0026] This invention mainly involves improvements to the ACME client and ACME server to meet the automatic issuance requirements of digital certificates for smart mobile terminals.

[0027] Example 1 In Embodiment 1, this invention proposes a method for issuing digital certificates for smart mobile terminals based on the ACME specification. This method supports automatic authentication of mobile terminals based on SMS or voice dialing, and automatically issues digital certificates upon successful authentication. Figure 2 As shown, the specific steps include: After obtaining the challenge code and registering the account and its key according to the ACME standard process, the L1.ACME client performs the operation of creating a new order. The submitted content is based on the ACME standard, such as... Figure 4 As shown, unlike the "dns" type in RFC8555, this invention adds an identifier type called "mobile", the value of which is the mobile phone number of the mobile terminal; After receiving the order creation request, the L2.ACME server generates an order ID, sets the order status to pending, and returns order object information, which includes a list of authorized objects, such as... Figure 5 As shown, unlike the "dns" type in RFC8555, this invention adds an identifier type called "mobile", the value of which is the client's mobile phone number; L3. The ACME client follows the ACME standard process and accesses one of the authorized objects in the list of authorized objects returned by step L2 (the URL is such as " / acme / authz / PaniVnsZcis", where "PaniVnsZcis" is an authorized object identifier randomly generated by the server). The L4.ACME server returns authorization object information, such as... Figure 6 As shown, unlike the "dns-01" and "http-01" challenge objects in RFC8555, this invention designs two challenge objects, "sms-01" and "phone-call-01", which respectively represent the mobile phone number of the client terminal using SMS authentication or voice dialing authentication. The token value of the SMS authentication or voice dialing authentication method will be transmitted to the smart mobile terminal via SMS or voice dialing respectively. In this embodiment, taking SMS authentication as an example, the subsequent steps are as follows: The L5a.ACME client follows the ACME standard process and accesses the SMS authentication challenge object (URL such as " / acme / authz / prV_B7yEyA4", where "prV_B7yEyA4" is a challenge object identifier randomly generated by the server) based on the authorization object information returned in step L4. This indicates that the client is waiting for SMS authentication from the server, and the server returns OK after accepting the request. The L6a.ACME server sends a randomly generated authentication token value via SMS. At this point, if... Figure 7As shown, the SMS message is prefixed with "ACME token:" (11 characters), followed by a 16-byte Base64 encoded token value (22 characters), for a total of 33 characters (11+22), which is less than the standard capacity limit of a single text message (SMS) (140 bytes), and can be sent in one SMS message; The L7a.ACME client obtains the token value from the received SMS message, and then calculates the key authorization keyAuthorization based on the token and account key according to the ACME standard, where keyAuthorization=token||'.'||base64url(Thumbprint(accountKey)), and Thumbprint uses the SM3 algorithm and has a length of 32 bytes; The L8a.ACME client returns an authentication SMS message, then sends keyAuthorization. At this point, if... Figure 8 As shown, the SMS message is prefixed with "ACME keyAuthorization:" (22 characters), followed by a 16-byte Base64 encoded token value (22 characters), then a '.', and finally the Base64 encoded SM3 value of the account key (accountKey) (43 characters). The total number of characters is 88 (22+22+1+43), which uses ASCII encoding. This is less than the standard capacity limit of a single text message (SMS) (140 bytes), so it can be sent in one SMS message. The L9a.ACME server receives the authentication SMS, obtains the keyAuthorization value, and calculates the keyAuthorization value locally using the same method. It then compares the two keyAuthorization values ​​to see if they match. If they match, the order status is set to ready, preparing to accept the certificate application request from the ACME client. L10a. Finally, the ACME client follows the ACME standard procedure to access the order object, submit a certificate request, and download the corresponding certificate.

[0028] In this embodiment, compared with conventional communication transmission protocols, the reference... Figure 7 By setting the prefix identifiers "ACME token:" and "ACME keyAuthorization:" for SMS messages, the program can easily filter SMS messages and prevent accidental operations.

[0029] Furthermore, in the specific implementation process, refer to Figure 2According to the standard ACME process, the ACME server returns a token value, and then the ACME client calculates the keyAuthorization based on the token value. The ACME client then writes the keyAuthorization to the webpage (or a DNS TXT record) and waits for the ACME server to access and authenticate it. This application features an original SMS authentication method, such as... Figure 2 In step 5 of the process, a new design was made based on the characteristics of SMS authentication. Instead of returning the token value, the ACME server sends the token value to the ACME client via SMS in step 6. The ACME client then calculates the key authorization keyAuthorization and sends the keyAuthorization to the ACME server via SMS for authentication.

[0030] Therefore, this operation avoids the cumbersome process of the client having to write keyAuthorization into the webpage or DNS record in the traditional process, making it more suitable for smart mobile terminal scenarios and improving the convenience and automation of certificate application.

[0031] Example 2 Based on the specific method flow of Embodiment 1 above, in Embodiment 2, this embodiment of the invention further proposes another implementation of the intelligent mobile terminal digital certificate issuance method based on the L1-L4 steps of Embodiment 1, specifically including: After obtaining the challenge code and registering the account and its key according to the ACME standard process, the L1.ACME client performs the operation of creating a new order. The submitted content is based on the ACME standard, such as... Figure 4 As shown, unlike the "dns" type in RFC8555, this invention adds an identifier type called "mobile", the value of which is the mobile phone number of the mobile terminal; After receiving the order creation request, the L2.ACME server generates an order ID, sets the order status to pending, and returns order object information, which includes a list of authorized objects, such as... Figure 5 As shown, unlike the "dns" type in RFC8555, this invention adds an identifier type called "mobile", the value of which is the client's mobile phone number; L3. The ACME client follows the ACME standard process and accesses one of the authorized objects in the list of authorized objects returned by step L2 (the URL is such as " / acme / authz / PaniVnsZcis", where "PaniVnsZcis" is an authorized object identifier randomly generated by the server). The L4.ACME server returns authorization object information, such as... Figure 6As shown, unlike the "dns-01" and "http-01" challenge objects in RFC8555, this invention designs two challenge objects, "sms-01" and "phone-call-01", which respectively represent the mobile phone number of the client terminal using SMS authentication or voice dialing authentication. The token value of the SMS authentication or voice dialing authentication method will be transmitted to the smart mobile terminal via SMS or voice dialing respectively. In this embodiment, if SMS authentication is not suitable for the mobile terminal, voice dialing authentication can also be selected. Figure 3 The steps are as follows: Following the ACME standard process, the L5b.ACME client accesses the voice dialing authentication challenge object (URL such as " / acme / authz / Rg5dV14Gh1Q", where "Rg5dV14Gh1Q" is a challenge object identifier randomly generated by the server) based on the authorization object information returned in step L4. This indicates that the client is waiting for the server's voice dialing authentication, and the server returns OK after accepting the authentication. The L6b.ACME server automatically dials the authenticated mobile number. For IP-based voice dialing, a randomly generated authentication token value can be sent via the SIP protocol. In this case, ... Figure 8 As shown, by adding the "ACME token:" header field to the INVITE message to transmit the token value, the ACME server also transmits the token value via DTMF dial tone after the call is connected. Figure 9 As shown, the 16-byte token value is processed as an integer and converted into decimal characters (the maximum value of 16 bytes as an integer is 340282366920938463463374607431768211455, which has 39 digits, such as "DGyRejmCefe7v4NfDGDKfA". After Base64 decoding, the decimal characters are "16514454643167489983773097483969809020"). To ensure error correction, the numbers can be required to start with an asterisk (*) and end with a #, resulting in a maximum of 41 characters (39+2). To further ensure the recognition rate, the transmission can be performed at 0.1 seconds per character in DTMF, requiring a total of 0.1 * 41 = 4.1 seconds to complete the transmission. After the L7b.ACME client detects a dial-up call from the ACME server and determines it's from the CA (Certificate Authority) phone number, it automatically connects the call and attempts to retrieve the token value from the SIP header. If the token value cannot be obtained from the SIP header due to network filtering by the ISP, it will listen for the DTMF dial tone sent by the ACME server and then decode the token value. The digest value used for authentication is calculated as: Thumbprint(token||accountKey), where Thumbprint uses the SM3 algorithm and is 32 bytes long. In summary, using the digest values ​​of the token and account key as authentication information has the advantages of shorter length and better replay resistance compared to the ACME standard keyAuthorization. The L8b.ACME client returns an authentication dial tone, such as... Figure 9 As shown, the 32-byte SM3 value from the previous step is processed as an integer and converted into a decimal character set with a maximum of 78 digits. Similarly, in the specific implementation, the number can be required to start with an asterisk (*) and end with a # symbol, so that the maximum number of characters is 80 (78+2). In addition, to ensure the recognition rate, the transmission can be performed at 0.1 seconds per DTMF character, which takes a total of 0.1 * 80 = 8 seconds to complete. After receiving the DTMF dial tone from the client, the L9b.ACME server decodes it to obtain the Thumbprint(token||accountKey) value, and calculates the SM3 value of the token and the user account key locally using the same method. It then compares whether the two SM3 values ​​are consistent. If they are consistent, the order status is set to ready, and the server is prepared to accept the certificate application request from the ACME client. L10b. Finally, the ACME client follows the ACME standard procedure to access the order object, submit a certificate request, and download the corresponding certificate.

[0032] In this embodiment, compared with conventional communication transmission protocols, the reference... Figure 8 The method involves setting a SIPINVITE message transmission token during VoIP voice calls, starting with "ACME token:", and... Figure 9 Based on the limitations of DTMF dial voice transmission, the transmitted data is encoded in decimal to meet DTMF transmission requirements. At the same time, "*" is added at the beginning and "#" at the end to improve error correction capability.

[0033] Furthermore, in the specific implementation process, refer to Figure 2According to the standard ACME process, the ACME server returns a token value, and then the ACME client calculates the keyAuthorization based on the token value. The ACME client then writes the keyAuthorization to a webpage (or a DNS TXT record) and waits for the ACME server to access and authenticate it. This application features an original voice authentication method, such as... Figure 3 In step 5b of the process, a new design was made based on the characteristics of voice dialing authentication. The ACME server does not return the token value. Instead, in step 6b, the token value is sent to the ACME client via voice dialing. The ACME client then calculates the token and account key digest value (it should be explained that this is not key authorization), and sends the token and account key digest value to the ACME server for authentication via DTMF voice.

[0034] Therefore, this operation can leverage the unique process of voice dialing authentication, where the server proactively transmits the token via voice, and the client responds with a digest value of the token and account key. This not only adapts to the characteristics of voice transmission but also enhances authentication security through dynamically changing digest values, while shortening transmission time and optimizing user experience.

[0035] Furthermore, since the token changes each time, the calculated digest value will also be different each time. In contrast, the ACME standard's key authorization directly calculates the digest value of the account key, and this digest value is always the same. Therefore, in voice dialing authentication, the digest value of the token and account key, Thumbprint(token||accountKey), is used as the authentication information. Thus, the authentication information of this invention has the advantage of better replay resistance.

[0036] In addition, the digest values ​​of tokens and account keys are shorter than the entire key authorization, resulting in shorter transmission time during DTMF voice transmission and a better user experience.

[0037] In summary, this embodiment uses the digest values ​​of the token and account key as authentication information in voice dialing authentication. Compared with the direct calculation of the digest value of the account key in the ACME standard key authorization, this method can make the digest value unique with each token change and shorten the information length, thereby improving anti-replay performance and reducing DTMF transmission time. This facilitates enhanced voice authentication security and optimized user experience.

[0038] At this point, the ACME client, based on the methods and mechanisms used in the above two sets of embodiments, can automatically authenticate and apply for a digital certificate. Furthermore, by providing both SMS authentication and voice dialing authentication as options, it can adapt to different smart mobile terminal usage scenarios, thereby meeting diverse authentication needs and improving the system's applicability in different scenarios.

[0039] Furthermore, by improving the authentication and order management process, this method can achieve full automation from authentication to certificate issuance, renewal, and revocation without human intervention. It can also adapt to unattended scenarios and is suitable for applications such as IoT mobile terminals.

[0040] In addition, the ACME client regularly checks the validity period of digital certificates and can automatically renew them based on ACME standard procedures before they expire.

[0041] In addition, digital certificates need to be revoked in cases such as the discontinuation of smart mobile terminals, deactivation of mobile phone numbers, or leakage of keys. End users can trigger the certificate revocation operation in the ACME client, and the process can be carried out in accordance with ACME standards. Similarly, CAs can also revoke digital certificates directly, and the process can be carried out in accordance with CA / PKIX standards.

[0042] In summary, this method, by having the ACME server proactively send SMS or voice dialing to the client for authentication, offers better authentication capabilities compared to the client proactively sending SMS or voice dialing to the server. It effectively prevents clients from impersonating phone numbers using number spoofing software, thereby enhancing authentication security and improving the overall security of the certificate issuance process.

[0043] On the other hand, this invention also discloses a digital certificate issuance system for intelligent mobile terminals based on the ACME specification, comprising: (1) The ACME server mainly includes an account and key management module, an order management module, an SMS authentication module, a voice dialing authentication module, and a certificate issuance and download module. The SMS authentication module and the voice dialing authentication module are new modules in this invention, while the order management module is a module to be improved in this invention to realize the automatic issuance of digital certificates for smart mobile terminals. The account and key management module and the certificate issuance and download module are standard modules of the ACME server, and this invention does not need to improve them, but simply uses their existing functions.

[0044] (2) The ACME client mainly includes an account and key management module, an order management module, an SMS authentication module, a voice dialing authentication module, and a key and certificate management module. The SMS authentication module and the voice dialing authentication module are new modules in this invention, while the order management module is a module to be improved in this invention to realize the automatic issuance of digital certificates for smart mobile terminals. The account and key management module and the key and certificate management module are standard modules of the ACME client, and this invention does not need to improve them, but simply uses their existing functions. After the ACME client is installed on the smart mobile terminal, the device manufacturer or the end user needs to authorize the ACME client so that it can read and send SMS messages, or even answer phone calls.

[0045] Therefore, the present invention, a digital certificate issuance method and system for smart mobile terminals based on the ACME specification, mainly improves the standard ACME server and ACME client by adding SMS authentication and voice dialing authentication modules, and improving the order management module. This enables the entire system to meet the automatic issuance requirements of digital certificates for smart mobile terminals. Furthermore, by using standard modules such as account and key management of the ACME server and client, and only improving and adding necessary modules, the development workload can be reduced, thereby reducing development costs and achieving the automatic issuance function of digital certificates for smart mobile terminals at a lower cost.

[0046] In summary, by extending the ACME server and client based on the ACME specification to add SMS authentication and voice dialing authentication modules, and improving the order management module, this system architecture can adapt to the automatic issuance process of digital certificates for smart mobile terminals, thus enabling the ACME server and client to have good compatibility and facilitating integration with the ACME standard system.

[0047] In another aspect, the present invention also discloses a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the method described above.

[0048] In another aspect, the present invention also discloses a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the method described above.

[0049] In another embodiment provided in this application, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute any of the smart mobile terminal digital certificate issuance methods and systems based on the ACME specification in the above embodiments.

[0050] It is understood that the system provided in the embodiments of the present invention corresponds to the method provided in the embodiments of the present invention, and the explanation, examples and beneficial effects of the relevant content can be referred to the corresponding parts of the above methods.

[0051] This application also provides an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, communication interface, and memory communicate with each other via the communication bus. Memory, used to store computer programs; The processor, when executing the program stored in the memory, implements the above-described method and system for issuing digital certificates for intelligent mobile terminals based on the ACME specification.

[0052] The communication bus mentioned in the above-mentioned electronic devices can be a standard bus for interconnecting peripheral components or an extended industrial standard structure bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc.

[0053] The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0054] The memory may include random access memory or non-volatile memory, such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0055] The processors mentioned above can be general-purpose processors, including central processing units, network processors, etc.; they can also be digital signal processors, application-specific integrated circuits, field-programmable gate arrays or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0056] It should also be noted that electronic devices include terminal devices, which can also be called terminals, user equipment, mobile stations, mobile terminals, etc. Terminal devices can be mobile phones, smart TVs, wearable devices, tablets, computers with wireless transceiver capabilities, virtual reality terminal devices, augmented reality terminal devices, wireless terminals in industrial control, wireless terminals in autonomous driving, wireless terminals in remote surgery, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, and so on. The embodiments of this application do not limit the specific technologies or device forms used in the terminal devices.

[0057] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium, or a semiconductor medium (e.g., solid-state drive), etc.

[0058] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

[0059] Furthermore, it should be noted that if any directional indication (such as up, down, left, right, front, back, etc.) is involved in the embodiments of the present invention, the directional indication is only used to explain the relative positional relationship and movement of each component in a specific posture. If the specific posture changes, the directional indication will also change accordingly.

[0060] Furthermore, if the embodiments of this invention involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the meaning of "and / or" throughout the text includes three parallel solutions; for example, "A and / or B" includes solution A, solution B, or a solution where both A and B are satisfied simultaneously. Furthermore, in the embodiments of this invention, "multiple" refers to two or more. Moreover, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by this invention.

Claims

1. A method for issuing digital certificates for smart mobile terminals based on the ACME specification, characterized in that, include: S1. After the client completes the acquisition of the challenge code, registration of the account and its key according to the ACME standard process, it requests the server to create a new order and adds "mobile" to the identifier type, the value of which is the client's mobile phone number; S2. After receiving the order creation request, the server generates an order ID and a list of authorized objects containing the "mobile" type identifier. The list of authorized objects contains an authorized object identifier randomly generated by the server and the corresponding authorized object URL. S3. Based on the returned list of authorized objects, the client performs the access operation of the authorized object URL to obtain the access URLs of the two types of challenge objects, namely SMS authentication and voice dialing authentication, from the server; S4. The client selects either SMS authentication or voice dialing authentication and accesses the corresponding challenge target URL; S5. The server sends a randomly generated authentication token value to the authentication mobile number via SMS or voice dialing according to the notification authentication method selected by the client, with "ACME token:" as the header identifier. S6. The client obtains the token value based on the notification authentication method, calculates the authentication information according to the ACME standard and the account key, and finally sends the authentication information to the server based on the corresponding notification authentication method. The authentication information adopts the corresponding encoding structure based on the notification authentication method. S7. The server receives the authentication information and calculates the authentication information locally using the same method. It compares the two sets of authentication information to see if they match. If they match, it prepares to accept the client's certificate application request. S8. Following the ACME standard process, the client accesses the order object, submits a certificate request, and downloads the certificate.

2. The method for issuing digital certificates for smart mobile terminals based on the ACME specification as described in claim 1, characterized in that, In step S4, the specified challenge objects accessed by the client include "sms-01" and "phone-call-01", which represent notification authentication using SMS authentication and voice dialing authentication, respectively. The token values ​​of the SMS authentication and voice dialing authentication methods will be transmitted to the smart mobile terminal via SMS or voice dialing, respectively.

3. The method for issuing digital certificates for smart mobile terminals based on the ACME specification as described in claim 2, characterized in that, The notification authentication method is SMS authentication. In step S5, the notification content in the SMS includes: a prefix of "ACMEtoken:" followed by a 16-byte token value encoded in Base64. In step S6, the key authorization value is set to keyAuthorization = token || '.' || base64url(Thumbprint(accountKey)), where Thumbprint uses the SM3 algorithm.

4. The method for issuing digital certificates for smart mobile terminals based on the ACME specification as described in claim 3, characterized in that, In step S6, the client sends authentication information to the server using SMS authentication. The authentication information in the SMS includes: a prefix of "ACME keyAuthorization:", followed by a 16-byte Base64 encoded token value, then a group of '.', and finally the Base64 encoded SM3 value of the account key. The total number of characters is encoded in ASCII.

5. The method for issuing digital certificates for smart mobile terminals based on the ACME specification as described in claim 2, characterized in that, The notification authentication method is voice dialing authentication of the mobile phone number. In step S5, the notification content sends a randomly generated authentication token value through the SIP protocol, and adds an "ACME token" header field to the INVITE message of the notification content to transmit the token value. The server transmits the token value through DTMF dial tone, processes the 16-byte token value as an integer, converts it into decimal characters, with a maximum of 39 digits, where the numbers begin with "*" and end with "#". During transmission, each character is transmitted at 0.1 seconds according to DTMF.

6. The method for issuing digital certificates for smart mobile terminals based on the ACME specification as described in claim 5, characterized in that, In step S6, after the client receives the dialing from the server, it determines whether it is the phone number of the CA. If so, it obtains the token value from the SIP header. If the token value cannot be obtained from the SIP header, it listens to the DTMF dialing tone sent by the server and then decodes the token value. The authentication information in step S6 includes the digest value of the token and the account key, wherein the digest value of the account key is Thumbprint(token||accountKey), and the Thumbprint uses the SM3 algorithm and has a length of 32 bytes. The process of the client returning the authentication information in step S6 also includes: returning the authentication dial tone, processing the 32-byte SM3 value as an integer, converting it into decimal characters, starting with "*" and ending with "#", and transmitting it at 0.1 seconds per DTMF character during the transmission process; In step S7, the authentication information received by the server is a dial tone.

7. The method for issuing digital certificates for smart mobile terminals based on the ACME specification as described in claim 6, characterized in that, In step S7, after receiving the client's authentication information, the server decodes it to obtain the Thumbprint(token||accountKey) value, and calculates the SM3 values ​​of the token and the user account key locally using the same method. The server compares whether the two sets of SM3 values ​​are consistent. If they are consistent, the server prepares to accept the client's certificate application request.

8. A digital certificate issuance system for intelligent mobile terminals based on the ACME specification, used to execute the digital certificate issuance method for intelligent mobile terminals based on the ACME specification as described in any one of claims 1-7, characterized in that, Including ACME server and ACME client: Both the ACME server and ACME client include an account and key management module, an order management module, an SMS authentication module, and a voice dialing authentication module, wherein the order management module is used to automatically issue digital certificates for smart mobile terminals; The ACME server also includes a certificate issuance and download module, and the ACME client also includes a key and certificate management module. After the smart mobile terminal installs the ACME client, it authorizes the ACME client to read and send text messages, or to answer phone calls.

Images