Display device, server and network security certificate upgrading method

Abstract

The invention provides a display device, a server and a network security certificate upgrading method. And the server deploys the network security certificate by taking a single network security certificate as a minimum deployment unit, so that the server can independently update one network security certificate. Correspondingly, the display device can independently download a network security certificate. After the display device is started, the display device can request the server for the first certificate set information of the network security certificate matched with the type of the display device, and determine the target second network security certificate needing to be downloaded based on the first certificate set information. The display device can download the target second network security certificate according to the storage path corresponding to each target second network security certificate, and can upgrade the network security service database by using the downloaded target second network security certificate when a specified condition is met. On the basis, the data volume to be transmitted and updated can be effectively controlled, so that extra transmission resources can be prevented from being infringed and occupied, and the upgrading efficiency of the network security certificate can be effectively improved.

Description

Technical Field

[0001] This application relates to the field of display device technology, and in particular to a method for upgrading display devices, servers, and network security certificates. Background Technology

[0002] Display devices refer to terminal devices capable of outputting specific display images, such as smart TVs, mobile terminals, smart advertising screens, and projectors. Taking smart TVs as an example, smart TVs are television products based on Internet application technologies, possessing open operating systems and chips, and having open application platforms. They enable two-way human-computer interaction and integrate multiple functions such as audio-visual, entertainment, and data to meet diverse and personalized user needs.

[0003] Network security certificates are digital certificates used for device network security, such as Secure Sockets Layer (SSL) certificates and Transport Layer Security (TLS) certificates. They are primarily used for authentication, data encryption, and ensuring secure communication. Typically, network security certificates are centrally deployed on a server. Devices download a network security certificate matching their device model from the server and store it in their local Network Security Services Database (nssdb) to ensure secure access to internet applications and websites.

[0004] Network security certificates are strongly correlated with the device model of the display device; a display device can only use a network security certificate that matches its own model. Therefore, when deploying network security certificates on a server, the smallest deployment unit is the network security certificate set corresponding to the same device model, and different sets are deployed for different device models. Consequently, when a network security certificate is updated, the entire network security certificate set to which that certificate belongs needs to be updated on the server. Correspondingly, the display device also needs to download the entire network security certificate set to which that certificate belongs to in order to upgrade the network security certificate. It is evident that due to the large amount of data to be transmitted and updated, this not only consumes significant transmission resources but also greatly reduces the efficiency of network security certificate upgrades. Summary of the Invention

[0005] This application provides a method for upgrading display devices, servers, and network security certificates, which can solve the problems of consuming a large amount of transmission resources and low upgrade efficiency caused by the large amount of data transmitted and updated when upgrading network security certificates.

[0006] In a first aspect, this application provides a display device, comprising: a communication device configured to communicate with a server; wherein the server deploys network security certificates using a single network security certificate as the smallest deployment unit, and the server also deploys a configuration file, the configuration file including certificate information for each network security certificate, the certificate information including the certificate name, version number, storage path, and an adapted device identity identifier of the network security certificate, the device identity identifier representing a corresponding device model; and a memory configured to store a network security service database, the network security service database including an installed first network security certificate.

[0007] The controller is configured to: after power-on, send a first request to the server, the first request including a first device model of the display device, the first request being used to request certificate information of a network security certificate; receive first certificate set information from the server, the first certificate set information including certificate information of a second network security certificate corresponding to the first device model; based on the comparison result between the certificate name and version number corresponding to the first network security certificate and the certificate name and version number corresponding to the second network security certificate, determine the target second network security certificate to be downloaded, and the target storage path corresponding to each target second network security certificate; download the corresponding target second network security certificate according to the target storage path; and when the operating status of the display device meets specified conditions, upgrade the network security service database using the target second network security certificate.

[0008] The above technical solution has the following beneficial effects or advantages:

[0009] The server deploys network security certificates using a single certificate as the smallest deployment unit. This allows the server to update a single certificate individually, requiring only a modification to the directory information in the configuration file. This granular approach to upgrades is highly flexible and significantly reduces the manpower costs associated with deploying and updating network security certificates on the server, effectively improving productivity. Similarly, display devices can download a network security certificate independently. After booting up, the display device requests a first certificate set information from the server that matches its model, and then determines the target second network security certificate to download based on this information. The display device can download the target second network security certificate according to its corresponding storage path, and, when specified conditions are met, can use the downloaded target second network security certificate to upgrade the network security service database. This effectively controls the amount of data to be transmitted and updated, thus avoiding the consumption of additional transmission resources and significantly improving the efficiency of network security certificate upgrades.

[0010] In some embodiments of this application, the network security certificates deployed on the server include public network security certificates and proprietary network security certificates. The configuration file includes a first configuration file and a second configuration file. The first configuration file includes certificate information corresponding to a public network security certificate set, which includes all public network security certificates and corresponds to all device models. The second configuration file includes certificate information corresponding to at least one proprietary network security certificate set, where each proprietary network security certificate set includes at least one proprietary network security certificate, and different proprietary network security certificate sets correspond to different device models. The first certificate set information includes first subset information and second subset information. The first subset information includes certificate information corresponding to the public network security certificate set, and the second subset information includes certificate information corresponding to a first proprietary network security certificate set corresponding to the first device model. The second network security certificate includes both the public network security certificate set and the first proprietary network security certificate set.

[0011] The above technical solution has the following beneficial effects or advantages:

[0012] The server categorizes and manages the certificate information of network security certificates in the configuration file according to the type of network security certificate. Accordingly, the server can send the corresponding first certificate set information to the display device according to the different types of network security certificates, thereby enabling the display device to upgrade the network security certificate of the appropriate type more effectively.

[0013] In some embodiments of this application, the target second network security certificate to be downloaded and the target storage path corresponding to each target second network security certificate are determined based on the comparison result between the certificate name and version number corresponding to the first network security certificate and the certificate name and version number corresponding to the second network security certificate. Specifically, if the comparison result is that the certificate name corresponding to the second network security certificate is different from the certificate names corresponding to all the first network security certificates, the second network security certificate is determined as the target second network security certificate; if the comparison result is that the certificate name corresponding to the second network security certificate is the same as the certificate name corresponding to the first network security certificate, but the version number is different, the second network security certificate is determined as the target second network security certificate.

[0014] The above technical solution has the following beneficial effects or advantages:

[0015] The display device can accurately identify newly added network security certificates and updated network security certificates based on the certificate name and version number of the first network security certificate and the certificate name and version number of the second network security certificate already stored in the network security service database.

[0016] In some embodiments of this application, the controller, when meeting specified conditions, uses the target second network security certificate to upgrade the network security service database. Specifically, this is configured to: perform a security verification on the target second network security certificate; after the target second network security certificate passes the security verification, adjust the flag bit corresponding to the network security service database to an update-pending flag; and when the operating status of the display device meets the specified conditions, and the flag bit corresponding to the network security service database is identified as the update-pending flag, use the target second network security certificate to upgrade the network security service database.

[0017] The above technical solution has the following beneficial effects or advantages:

[0018] After downloading the target second network security certificate, the display device needs to verify the target second network security certificate to ensure its security and that the display device can operate normally after updating the network security service database using the target second network security certificate.

[0019] In some embodiments of this application, the certificate information of the second network security certificate further includes a decryption field and a first verification value; the controller performs security verification on the target second network security certificate, specifically configured to: decrypt the target second network security certificate using the decryption field to obtain a second verification value corresponding to the target second network security certificate; and perform security verification on the target second network security certificate based on the first verification value and the second verification value.

[0020] The above technical solution has the following beneficial effects or advantages:

[0021] The first certificate set information returned by the server also includes verification information for verifying the second network security certificate. In this way, the display device can use this verification information to perform security verification on the target second network security certificate.

[0022] In some embodiments of this application, the controller sends a first request to the server after power-on, specifically configured to: start a timer after power-on; and send the first request to the server when the duration recorded by the timer reaches a preset duration.

[0023] The above technical solution has the following beneficial effects or advantages:

[0024] After the display device is powered on, it waits for a period of time before requesting the certificate set information of the network security certificate from the server. This can effectively avoid the request congestion problem caused by a large number of display devices making centralized requests.

[0025] In some embodiments of this application, the controller sends a first request to the server after power-on, specifically configured to: detect whether the network security service database is currently in an update-pending state after power-on; if the network security service database is currently in the update-pending state, update the network security service database and then send the first request to the server.

[0026] The above technical solution has the following beneficial effects or advantages:

[0027] After the display device is powered on, it prioritizes updating the network security service database that is in a pending update state to ensure that the display device can run based on the latest network security service database after powering on.

[0028] Secondly, this application also provides a server, including: a communication device configured to communicate with a display device; a memory configured to: deploy network security certificates with a single network security certificate as the smallest deployment unit, and the server further deploying a configuration file, the configuration file including certificate information for each network security certificate, the certificate information including the certificate name, version number, storage path, and adapted device identity identifier of the network security certificate, the device identity identifier being used to represent the corresponding device model;

[0029] The controller is configured to: receive a first request sent by the display device, the first request including a first device model of the display device, the first request being used to request certificate information of a network security certificate; in response to the first request, generate a corresponding first device identity based on the first device model; determine a second network security certificate corresponding to the first device identity based on the first device identity and the configuration file; and send first certificate set information to the display device, the first certificate set information including certificate information of the second network security certificate.

[0030] The above technical solution has the following advantages or beneficial effects:

[0031] The server deploys network security certificates using a single certificate as the smallest deployment unit. This allows for individual certificate updates, requiring only modifications to the directory information in the configuration file. This granular approach to upgrades is highly flexible and significantly reduces the human resource costs associated with deploying and updating network security certificates on the server, effectively improving productivity. Similarly, display devices can also download a separate network security certificate. This allows for effective control over the amount of data transmitted and updated, preventing the consumption of additional transmission resources and further enhancing the efficiency of network security certificate upgrades.

[0032] Thirdly, embodiments of this application also provide a method for upgrading a network security certificate, applied to a display device as described in any of the first aspects, wherein the display device communicates with a server; wherein the server deploys network security certificates using a single network security certificate as the smallest deployment unit, and the server also deploys a configuration file, the configuration file including certificate information for each network security certificate, the certificate information including the certificate name, version number, storage path, and adapted device identity identifier of the network security certificate, the device identity identifier being used to represent the corresponding device model; the display device also stores a network security service database, the network security service database including the first network security certificate that has been installed;

[0033] The method includes: after powering on, sending a first request to the server, the first request including a first device model of the display device, the first request being used to request certificate information of a network security certificate; receiving first certificate set information fed back by the server, the first certificate set information including certificate information of a second network security certificate corresponding to the first device model; determining the target second network security certificate to be downloaded, and the target storage path corresponding to each target second network security certificate, based on the comparison result between the certificate name and version number corresponding to the first network security certificate and the certificate name and version number corresponding to the second network security certificate; downloading the corresponding target second network security certificate according to the target storage path; and upgrading the network security service database using the target second network security certificate when the operating status of the display device meets specified conditions.

[0034] The above technical solution has the following advantages or beneficial effects:

[0035] The server deploys network security certificates using a single certificate as the smallest deployment unit, allowing the server to update a single certificate independently. Similarly, the display device can download a single network security certificate. After booting up, the display device requests a first certificate set information from the server that matches its model, and determines the target second network security certificate to download based on this information. The display device can download the target second network security certificate according to its corresponding storage path, and, when specified conditions are met, can use the downloaded target second network security certificate to upgrade the network security service database. This effectively controls the amount of data to be transmitted and updated, thus avoiding the consumption of additional transmission resources and significantly improving the efficiency of network security certificate upgrades.

[0036] Fourthly, this application embodiment also provides a method for upgrading a network security certificate, applied to a server as described in the second aspect, the server communicating with a display device; the server deploys network security certificates with a single network security certificate as the smallest deployment unit, and the server also deploys a configuration file, the configuration file including certificate information for each network security certificate, the certificate information including the certificate name, version number, storage path, and adapted device identity identifier of the network security certificate, the device identity identifier being used to represent the corresponding device model;

[0037] The method includes: receiving a first request sent by the display device, the first request including a first device model of the display device, the first request being used to request certificate information of a network security certificate; responding to the first request, generating a corresponding first device identity based on the first device model; determining a second network security certificate corresponding to the first device identity based on the first device identity and the configuration file; and sending first certificate set information to the display device, the first certificate set information including certificate information of the second network security certificate.

[0038] The above technical solution has the following advantages or beneficial effects:

[0039] The server deploys network security certificates using a single certificate as the smallest deployment unit, allowing the server to update a single certificate independently. Similarly, the display device can download a single certificate independently. This effectively controls the amount of data transmitted and updated, thus avoiding the consumption of additional transmission resources and significantly improving the efficiency of network security certificate upgrades. Attached Figure Description

[0040] To more clearly illustrate the technical solution of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 This is a schematic diagram illustrating the operation scenario between the display device 200 and the control device 100 in an embodiment of this application;

[0042] Figure 2 This is a hardware configuration block diagram of the display device 200 in this embodiment of the application;

[0043] Figure 3 This is a diagram showing the operating system configuration of the display device 200 in this embodiment of the application;

[0044] Figure 4This is a schematic diagram of the structure of server 400 deploying a network security certificate in an embodiment of this application;

[0045] Figure 5 This is another structural diagram illustrating the deployment of a network security certificate on server 400 in this application embodiment;

[0046] Figure 6 A flowchart illustrating the process of upgrading a network security certificate for a display device 200 provided in this application embodiment;

[0047] Figure 7 A timing diagram for upgrading the network security certificate of the display device 200 provided in this application embodiment;

[0048] Figure 8 A flowchart illustrating the process of sending a first request to the display device 200 provided in this embodiment of the application;

[0049] Figure 9 This is a flowchart illustrating the process of upgrading the network security service database of the display device 200 in this embodiment of the application;

[0050] Figure 10 This is a flowchart illustrating the process by which display device 200 verifies the security of the target's second network security certificate in an embodiment of this application.

[0051] Figure 11 This is a schematic diagram of the prompt information in the embodiments of this application. Detailed Implementation

[0052] The embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described below do not represent all embodiments consistent with this application. They are merely examples of systems and methods consistent with some aspects of this application as detailed in the claims.

[0053] It should be noted that the brief descriptions of terms in this application are only for the convenience of understanding the embodiments described below, and are not intended to limit the embodiments of this application. Unless otherwise stated, these terms should be understood in their ordinary and common meaning.

[0054] The terms "first," "second," "third," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar or related objects or entities, and do not necessarily imply a specific order or sequence, unless otherwise specified. It should be understood that such terms are interchangeable where appropriate.

[0055] The terms “comprising” and “having”, and any variations thereof, are intended to cover but not exclude inclusion, for example, a product or device that includes a range of components is not necessarily limited to all of the components that are clearly listed, but may include other components that are not clearly listed or that are inherent to such product or device.

[0056] In this application embodiment, "display device" refers to a device with screen display and data processing capabilities. For example, display devices include, but are not limited to, smart TVs, mobile terminals, computers, monitors, advertising screens, wearable devices, virtual reality devices, and augmented reality devices.

[0057] Figure 1 This is a schematic diagram illustrating an operational scenario between a display device and a control device provided in some embodiments of this application. For example... Figure 1 As shown, users can operate the display device 200 via touch, voice, mobile terminal 300, and control device 100. For example, control device 100 can be a remote control, stylus, gamepad, etc.

[0058] like Figure 1 The diagram also shows that the display device 200 communicates with the server 400 via various communication methods. This allows the display device 200 to communicate via a local area network (LAN), a wireless local area network (WLAN), and other networks.

[0059] Display device 200 can provide broadcast television reception function, and can also be equipped with intelligent network television function that provides computer support, including but not limited to network television, smart television, Internet Protocol television (IPTV), etc.

[0060] Figure 2 Provided for some embodiments of this application Figure 1 Hardware configuration block diagram of display device 200.

[0061] In some embodiments, the display device 200 may include at least one of a tuner 210, a communication device 220, a detector 230, a device interface 240, a controller 250, a display 260, an audio output device 270, a user input interface 280, a memory, and a power supply.

[0062] In some embodiments, the communication device 220 is a component for communicating with external devices or the server 400 according to various communication protocol types. The display device 200 may be equipped with multiple communication devices 220 depending on the supported communication methods. The communication devices 220 can enable the display device 200 to communicate with the external devices or the server 400 via wireless or wired connections.

[0063] In some embodiments, detector 230 is used to acquire signals from the external environment or to interact with the outside world. For example, detector 230 includes a light receiver, a sensor for acquiring ambient light intensity; or, detector 230 includes an image acquisition device, such as a camera, which can be used to acquire external environmental scenes, user attributes, or user interaction gestures; or, detector 230 includes a sound acquisition device, such as a microphone, for receiving external sounds.

[0064] In some embodiments, device interface 240 is used to connect to an external device.

[0065] In some embodiments, the controller 250 is used to control the overall operation of the display device 200. The controller 250 may include at least one of a central processing unit (CPU), a video processor, an audio processor, a graphics processing unit (GPU), and a power processor, and a first to an nth interface for input / output. The controller 250 controls the operation of the display device 200 and responds to user operations through various software control programs stored in memory.

[0066] In some embodiments, the controller 250 and the tuner 210 may be located in different separate devices, that is, the tuner 210 may also be located in an external device of the main device where the controller 250 is located, such as an external set-top box.

[0067] In some embodiments, the display 260 is used to receive and display image signals output from the controller 250. The display 260 may include display function components for presenting images and driving components for driving image display.

[0068] In some embodiments, a user can input user commands on a graphical user interface (GUI) displayed on a display 260, and the user input interface 280 can receive user commands through the GUI.

[0069] In some embodiments, the audio output device 270 may be a built-in speaker of the display device 200 or an external audio output device connected to the display device 200.

[0070] In some embodiments, the user input interface 280 can be used to receive instructions from user input.

[0071] In some embodiments, to enable user interaction, the display device 200 may run an operating system. An operating system is a computer program that manages and controls the hardware and software resources of the display device 200. The operating system can control the display device to provide a user interface; for example, the operating system can directly control the display device to provide a user interface, or it can provide a user interface by running applications. The operating system also allows users to interact with the display device 200.

[0072] The operating system can be a native operating system based on a specific operating platform, a third-party operating system that is deeply customized based on a specific operating platform, or an independent operating system specifically developed for display devices 200.

[0073] like Figure 3 As shown, Figure 3 The diagram below illustrates the software configuration of a display device according to some embodiments of this application. In some embodiments, the system of the display device 200 can be divided into three layers, from top to bottom: the application layer, the middleware layer, and the hardware layer.

[0074] The application layer mainly includes TV applications and application frameworks. The applications are mainly browser-based applications, such as HTML5 apps, and native apps.

[0075] An application framework is a complete program model that has all the basic functions required by standard application software, such as file access, data exchange, and the user interface for these functions (toolbar, status bar, menu, dialog box).

[0076] Native apps can support online or offline access, push notifications, or access to local resources.

[0077] The middleware layer includes various television protocols, multimedia protocols, and system components. Middleware can use the basic services (functions) provided by system software to connect different parts of application systems or different applications on the network, achieving resource sharing and function sharing.

[0078] The hardware layer mainly includes the HAL interface, hardware, and drivers. The HAL interface is a unified interface for all TV chips, with the specific logic implemented by each chip. The drivers mainly include: audio drivers, display drivers, Bluetooth drivers, camera drivers, Wi-Fi drivers, USB drivers, HDMI drivers, sensor drivers (such as fingerprint sensors, temperature sensors, pressure sensors, etc.), and power drivers.

[0079] It should be noted that the above examples are merely a simple division of operating system functions and do not limit the specific form of the operating system of the display device 200 in this application embodiment. Depending on the function of the display device, the type of operating system, and other factors, the number of levels and the specific level type of the operating system may be expressed in other forms.

[0080] A network security certificate is a digital certificate used for device network security, such as a Secure Sockets Layer (SSL) certificate or a Transport Layer Security (TLS) certificate. These certificates are primarily used for authentication, data encryption, and ensuring secure communication. Typically, network security certificates are centrally deployed on a server. Device 200 downloads a network security certificate matching its own model from the server and stores it in its local Network Security Services Database (nssdb) to ensure secure access to internet applications and websites.

[0081] Network security certificates are strongly correlated with the device model of display device 200; display device 200 can only use network security certificates that match its own model. Therefore, when deploying network security certificates on server 400, the smallest deployment unit is the network security certificate set corresponding to the same device model, and different network security certificate sets are deployed for different device models. Consequently, when a network security certificate is updated, the entire network security certificate set to which that certificate belongs needs to be updated on server 400.

[0082] You can refer to this. Figure 4The diagram shows the structure of server 400 deploying network security certificates. Server 400 uses a device ID to represent the device model and deploys corresponding network security certificate sets according to the device ID. For example, the network security certificate set corresponding to device ID-1 includes Certificate-1 to Certificate-3; the network security certificate set corresponding to device ID-2 includes Certificate-1, Certificate-4 to Certificate-5; and the network security certificate set corresponding to device ID-n includes Certificate-1, Certificate-n to Certificate-n+1. It can be seen that each network security certificate set includes Certificate-1. If Certificate-1 is updated, n network security certificate sets need to be repackaged, and the repackaged n network security certificate sets need to be updated to server 400. Obviously, the work of repackaging network security certificate sets is labor-intensive and prone to oversights. The amount of data updated to server 400 is also large, resulting in significant consumption of transmission resources.

[0083] Correspondingly, display device 200 also needs to download the entire network security certificate set to which the network security certificate belongs in order to upgrade the network security certificate. For example, if the device model of display device 200 corresponds to device ID-2, then display device 200 needs to download the entire network security certificate set including Certificate-1, Certificate-4 to Certificate-5. In other words, even if Certificate-4 to Certificate-5 have not been updated, display device 200 still needs to download these two network security certificates together, which is inflexible and consumes a lot of manpower.

[0084] It is evident that due to the large amount of data to be transmitted and updated, it not only consumes a significant amount of transmission resources but also greatly reduces the efficiency of network security certificate upgrades.

[0085] To address the aforementioned issues, the server 400 provided in this embodiment is configured to deploy network security certificates using a single network security certificate as the smallest deployment unit. This allows the server 400 to perform updates using a single network security certificate as the smallest unit.

[0086] You can refer to this. Figure 5The diagram shows another structural illustration of server 400 deploying network security certificates. Server 400 deploys network security certificates Certificate-1 to Certificate-n with a single network security certificate as the smallest deployment unit. In one example, the network security certificate can be in Privacy-Enhanced Mail (PEM) format.

[0087] Server 400 also deploys a configuration file (also known as a certificate set information configuration file), which includes certificate information for each network security certificate. This certificate information includes the certificate name (nickname), version number (version), storage path (path), and the corresponding device ID (device ID), which represents the corresponding device model. Of course, certificate information may also include other information, such as the number of certificates in the certificate set (Certificate Count), checksum (e.g., MD5 value), and decryption field (pwd).

[0088] In some embodiments, network security certificates can be divided into two categories: public network security certificates and personalized network security certificates. Public network security certificates correspond to all device models, or in other words, to all device identities; personalized network security certificates are limited to specific device models, meaning the corresponding device identities are limited. Based on this, the server 400 can divide network security certificates into different sets according to their type, including public network security certificate sets and personalized network security certificate sets. This allows for accurate management of network security certificates according to their type.

[0089] Furthermore, based on different device identities, unique network security certificates can be further divided into at least one unique network security certificate set, with different unique network security certificate sets corresponding to different device identities. This allows for accurate management of unique network security certificates according to device identities. Public network security certificates can be uniformly constituted into a single public network security certificate set, corresponding to all device identities.

[0090] Based on the above-described management method for network security certificates, the configuration files for a server 400 deployment can include a first configuration file and a second configuration file. The first configuration file (e.g., public_config.json) includes certificate information corresponding to the public network security certificate set, i.e., the collection information of the public network security certificate set. The second configuration file (e.g., personalized_config.json) includes certificate information corresponding to each personalized network security certificate set, i.e., the collection information of each personalized network security certificate set. In one example, the configuration files for a server 400 deployment can be referenced in Table 1.

[0091] Table 1

[0092]

[0093] In some embodiments, if a network security certificate needs to be upgraded, the designer can package a new network security certificate separately and upload it to server 400, using the packaged network security certificate to upgrade the original network security certificate. Simultaneously, the designer needs to update the corresponding configuration file. For example, replacing the original network security certificate with the new one, deleting the original certificate information from the configuration file, and adding the new certificate information; or adding a new network security certificate and adding its information to the configuration file. Based on this, the configuration file held by server 400 can always contain the latest network security certificate information. As can be seen from the way network security certificates are deployed and updated on server 400, network security certificate upgrades are granular and highly flexible, and can significantly reduce the manpower costs of deploying and updating network security certificates on the server, effectively improving productivity.

[0094] Display device 200 can communicate with server 400 via communication device 220, for example, display device 200 and server 400 can communicate via WiFi. Thus, display device 200 can exchange information with server 400, for example, display device 200 can download network security certificates from server 400.

[0095] Display device 200 locally stores a network security service database, which includes network security certificates installed on display device 200 (hereinafter referred to as the "first network security certificate"). In other words, the network security service database includes the network security certificates currently held by display device 200. Simultaneously, the network security service database also includes certificate information for the first network security certificate, such as the certificate name and version number.

[0096] Figure 6The flowchart for upgrading the network security certificate of the display device 200 provided in this embodiment of the application includes the following specific steps:

[0097] Step S601: After power-on, send the first request to the server.

[0098] Display device 200 is configured to, upon power-on, begin checking if server 400 has an updated network security certificate. Display device 200 may send a first request to server 400, which requests certificate information for the network security certificate.

[0099] In some embodiments, the first request may include the device model of the display device 200 (hereinafter referred to as the "first device model"). In one example, the first request may include identity information of the display device 200, such as a User Agent, which includes the first device model of the display device 200.

[0100] Figure 7 A timing diagram for upgrading the network security certificate of the display device 200 provided in this application embodiment.

[0101] Combination Figure 7 After the display device 200 is powered on, the controller 250 can generate a first request, which is then sent to the server 400 by the communication device 220. For example, the first request includes the identification information of the display device 200, which includes a first device model.

[0102] Figure 8 A flowchart illustrating the process of sending a first request to the display device 200 provided in this embodiment of the application is shown below:

[0103] Step S801: After power-on, start the timer.

[0104] After the display device 200 is powered on, it does not immediately send the first request to the server 400, but instead starts a timer (hereinafter referred to as the "first timer").

[0105] Step S802: When the timer reaches the preset duration, send the first request to the server.

[0106] Display device 200 sends its first request to server 300 after waiting for a preset time (hereinafter referred to as the "first time"). This effectively avoids request congestion caused by a large number of display devices making centralized requests. For example, after a regional power outage, when power is restored, a large number of display devices will start up almost simultaneously. If all of them immediately send their first requests to server 400, request congestion will occur. By having each display device wait for a certain period of time before sending its first request to server 400, this problem can be effectively solved.

[0107] Combination Figure 7 After the system boots up, it waits for the first duration before sending the first request to the server via 400.

[0108] Upon receiving the first request, server 400 will generate a corresponding first device identity identifier based on the first device model. Combined with... Figure 7 The server 400 may include a communication device 401 and a controller 402. After receiving the first request through the communication device 401, the server 400 can generate a corresponding first device identity identifier, such as V0000.09.00Q.P0311, through the controller 402 based on the identity information of the display device 200.

[0109] Server 400 determines the network security certificate (hereinafter referred to as the "second network security certificate") corresponding to the first device identity based on the first device identity and configuration file. The second network security certificate is deployed on server 400, matches the first device identity, and has the latest version number. Server 400 also generates first certificate set information based on the certificate information of the second network security certificate; that is, the first certificate set information includes the certificate information of each second network security certificate.

[0110] In some embodiments, if the configuration file deployed by server 400 includes a first configuration file and a second configuration file, server 400 can determine that all public network security certificates in the public network security certificate set are second network security certificates, and server 400 can determine that all unique network security certificates in the first unique network security certificate set corresponding to the identifier of the first device identity are second network security certificates. Based on this, the first certificate set information generated by server 400 includes first subset information and second subset information. The first subset information includes certificate information corresponding to the public network security certificate set, and the second subset information includes certificate information corresponding to the first unique network security certificate set.

[0111] Combination Figure 7Server 400, through controller 402, determines the second network security certificate based on the first device's identity and configuration file. Referring to Table 1, if the first device's identity is V0000.09.00Q.P0311, the second network security certificate can be determined to include public network security certificates Certificate-1 to Certificate-3, and a unique network security certificate Certificate-6. Controller 402 concatenates the certificate information from Certificate-1 to Certificate-3 and Certificate-6 to generate the first certificate set information, as shown in Table 2.

[0112] Table 2

[0113]

[0114]

[0115] Server 400 sends the first certificate set information back to display device 200 via communication device 401.

[0116] Step S602: Receive the first certificate set information fed back by the server.

[0117] The first certificate set information includes certificate information for the second network security certificate corresponding to the first device model. For example, the first certificate set information is shown in Table 2.

[0118] Step S603: Based on the comparison result between the certificate name and version number corresponding to the first network security certificate and the certificate name and version number corresponding to the second network security certificate, determine the target second network security certificate to be downloaded, and the target storage path corresponding to each target second network security certificate.

[0119] The display device 200 reads the certificate information of the first network security certificate from the network security service database, such as the certificate name and version number of the first network security certificate. For example, the first network security certificate includes Certificate-2 to Certificate-3 and Certificate-6, where the version number of Certificate-2 is 2.1, the version number of Certificate-3 is 1.2, and the version number of Certificate-6 is 1.1.

[0120] Combination Figure 7 The display device 200 compares the certificate name and version number of the first network security certificate with the certificate name and version number of the second network security certificate to determine the target second network security certificate and the target storage path.

[0121] The display device 200 compares the certificate name of the first network security certificate with the certificate name of the second network security certificate. If the comparison result is that the certificate name corresponding to the second network security certificate is different from the certificate names corresponding to all the first network security certificates, the second network security certificate is identified as a newly added network security certificate in the target second network security certificate.

[0122] Based on the above example, Certificate-1 has a different certificate name from the first network security certificate. Therefore, Certificate-1 is a newly added network security certificate in the target second network security certificate.

[0123] The display device 200 compares the version number of the first network security certificate and the version number of the second network security certificate. If the comparison result is that the certificate name corresponding to the second network security certificate is the same as the certificate name corresponding to the first network security certificate, but the version number is different, the second network security certificate is identified as the network security certificate that has been upgraded in the target second network security certificate.

[0124] Based on the above example, Certificate-6 has a different version number; therefore, Certificate-6 is the cybersecurity certificate that has been upgraded in the target second cybersecurity certificate.

[0125] Step S604: Download the corresponding target second network security certificate according to the target storage path.

[0126] Combination Figure 7 After identifying the target second network security certificate, the display device 200 can send a download request to the server 400 to download the corresponding target second network security certificate according to the target storage path.

[0127] Based on the above example, if the display device 200 determines that the target second network security certificate is Certificate-1 and Certificate-6, Certificate-1 and Certificate-6 can be downloaded respectively using . / certs / certificate1.crt and . / certs / certificate6.crt.

[0128] Step S605: When the operating status of the display device meets the specified conditions, upgrade the network security service database using the target second network security certificate.

[0129] In some embodiments, the specified condition can be a restart. That is, after the display device 200 downloads the target second network security certificate during the current boot process, it does not directly upgrade the network security service database, but instead upgrades the network security service database using the previously downloaded target second network security certificate after a restart.

[0130] In some embodiments, the display device 200 verifies the security of the target second network security certificate before using the target second network security certificate to upgrade the network security service database.

[0131] Figure 9 This is a flowchart illustrating the process of upgrading the network security service database on display device 200 in this embodiment of the application. The specific steps are as follows:

[0132] Step S901: Perform security verification on the target second network security certificate.

[0133] Combination Figure 7 After downloading the target second network security certificate, the display device 200 needs to verify the security of the target second network security certificate to ensure the security of the machine's subsequent use of the target second network security certificate.

[0134] Figure 10 This is a flowchart illustrating the process by which display device 200 verifies the security of the target's second network security certificate in this embodiment of the application. The specific steps are as follows:

[0135] Step S1001: Decrypt the target second network security certificate using the decryption field to obtain the second verification value corresponding to the target second network security certificate.

[0136] The display device 200 can read the decryption field corresponding to each target second network security certificate from the first certificate set information, and use the decryption field to decrypt the corresponding target second network security certificate to obtain the decrypted target second network security certificate. The decrypted target second network security certificate includes the actual verification value corresponding to the target second network security certificate (hereinafter referred to as the "second verification value").

[0137] Step S1002: Based on the first verification value and the second verification value, perform security verification on the target second network security certificate.

[0138] The first certificate set information includes pre-configured checksums for each second network security certificate (hereinafter referred to as the "first checksum"). The display device 200 can read the first checksum corresponding to the target second network security certificate from the first certificate set information, and then compare the first checksum with the second checksum corresponding to the target second network security certificate to verify the security of the target second network security certificate. In one example, both the first checksum and the second checksum are MD5 values. If the first checksum and the second checksum are the same, it means that the target second network security certificate is a trusted certificate and passes the security verification; if the second checksum and the second checksum are different, it means that the target second network security certificate is an untrusted certificate and fails the security verification.

[0139] Step S902: After the target second network security certificate passes the security verification, the flag bit corresponding to the network security service database is adjusted to the pending update flag.

[0140] In some embodiments, after the target second network security certificate passes security verification, a new network security service database is packaged based on the first network security certificate and the target second network security certificate. Specifically, the first network security certificate with the same certificate name as the target second network security certificate is removed, and the remaining first network security certificate and the target second network security certificate are packaged into the new network security service database.

[0141] The network security service database has corresponding flag bits used to record its status. The status of the network security service database includes "no updates required" and "pending updates". Based on the status of the network security service database, the corresponding "no updates required" or "pending updates" flags are set.

[0142] After the target second network security certificate passes the security verification, it indicates that the display device 200 needs to update the network security service database. Accordingly, the network security service database is in a pending update state. Based on this, the display device 200 needs to adjust the flag of the network security service database to the pending update flag to indicate that the network security service database is in a pending update state.

[0143] In some embodiments, if the target second network security certificate fails the security verification, or if the target second network security certificate does not exist, the display device 200 can keep the flag corresponding to the network security service database as an update-free flag, indicating that the network security service database is in an update-free state.

[0144] Step S903: When the specified conditions are met, if the flag bit corresponding to the network security service database is identified as a flag to be updated, the network security service database is upgraded using the target second network security certificate.

[0145] When the display device 200 detects that the specified conditions are met, it will first check the flag bit corresponding to the network security service database. If the flag bit corresponding to the network security service database is identified as a flag that needs to be updated, the network security service database will be upgraded using the target second network security certificate. If the flag bit corresponding to the network security service database is identified as a flag that does not need to be updated, the network security service database will not be upgraded.

[0146] In some embodiments, if the specified condition is restarting, or if the display device 200 is configured to prioritize checking the flag corresponding to the network security service database after restarting and upgrade the network security service database based on the flag, the display device 200 will prioritize checking the flag corresponding to the network security service database and upgrade the network security service database based on the flag after meeting the specified condition or restarting.

[0147] In some embodiments, if the specified condition is a restart, the display device 200 may display a prompt message after the target network security certificate passes security verification. In one example, see [reference needed]. Figure 11 The user interface diagram shown illustrates that after the target network security certificate passes security verification, a pop-up window can be displayed, along with a prompt message such as "Restart the device to complete the network security certificate upgrade".

[0148] In some embodiments, combined with Figure 7 After the display device 200 is powered on, if it detects that the flag corresponding to the network security service database is in the "to be updated" flag, it will use the target second network security certificate to upgrade the network security service database. After upgrading the network security service database, it will execute the process of sending the first request to the server 400. If it detects that the flag corresponding to the network security service database is in the "no need to update" flag, it can directly execute the process of sending the first request to the server 400.

[0149] In some embodiments, the display device 200 can also be configured to record the completion time of each upgrade of the network security service database, and after completing the upgrade, start a timer (hereinafter referred to as the "second timer") to record the time elapsed since the last upgrade. When the preset second time elapsed (e.g., 24 hours) is reached, the display device 200 will automatically send a first request to the server 400. That is, during the current power-on operation, if the time recorded by the second timer reaches the second time elapsed, the display device 200 will automatically send a first request to the server 400. In this way, even if the display device 200 is in operation for a long time, it can still promptly detect whether the security network certificate needs to be upgraded and download the target security network certificate in a timely manner.

[0150] Based on the above embodiments, server 400 deploys network security certificates using a single network security certificate as the smallest deployment unit. Therefore, server 400 can update a single network security certificate by modifying the directory information in the configuration file accordingly. This granular upgrade is highly flexible and significantly reduces the manpower costs of deploying and updating network security certificates on the server, effectively improving productivity. Correspondingly, display device 200 can download a network security certificate individually. After booting up, display device 200 can request a first certificate set information matching its own model from server 400, and determine the target second network security certificate to download based on the first certificate set information. Display device 200 can download the target second network security certificate according to the storage path corresponding to each target second network security certificate, and can use the downloaded target second network security certificate to upgrade the network security service database when specified conditions are met. This effectively controls the amount of data to be transmitted and updated, thus avoiding the consumption of additional transmission resources and effectively improving the upgrade efficiency of network security certificates.

[0151] For ease of explanation, the above description has been provided in conjunction with specific embodiments. However, the discussion in some embodiments is not intended to be exhaustive or to limit the embodiments to the specific forms disclosed above. Various modifications and variations can be obtained based on the above teachings. The selection and description of the above embodiments are for the purpose of better explaining the contents of this disclosure, thereby enabling those skilled in the art to better utilize the embodiments.

Claims

1. A display device, characterized in that, include: A communication device is configured to communicate with a server; wherein the server deploys network security certificates using a single network security certificate as the smallest deployment unit, and the server also deploys a configuration file, the configuration file including certificate information for each network security certificate, the certificate information including the certificate name, version number, storage path, and adapted device identity identifier of the network security certificate, the device identity identifier being used to represent the corresponding device model; The memory is configured to store a network security service database, the network security service database including an installed first network security certificate; The controller is configured as follows: After powering on, a first request is sent to the server. The first request includes the first device model of the display device and is used to request certificate information for a network security certificate. The server receives a first certificate set information, which includes certificate information of a second network security certificate corresponding to the first device model. Based on the comparison results between the certificate name and version number corresponding to the first network security certificate and the certificate name and version number corresponding to the second network security certificate, the target second network security certificate to be downloaded and the target storage path corresponding to each target second network security certificate are determined. Download the corresponding target second network security certificate according to the target storage path; When the operating status of the display device meets the specified conditions, the network security service database is upgraded using the target second network security certificate.

2. The display device according to claim 1, characterized in that, The network security certificates deployed on the server include public network security certificates and proprietary network security certificates. The configuration file includes a first configuration file and a second configuration file. The first configuration file includes certificate information corresponding to a public network security certificate set, which includes all public network security certificates and corresponds to all device models. The second configuration file includes certificate information corresponding to at least one proprietary network security certificate set, where each proprietary network security certificate set includes at least one proprietary network security certificate, and different proprietary network security certificate sets correspond to different device models. The first certificate set information includes a first subset information and a second subset information. The first subset information includes certificate information corresponding to the public network security certificate set, and the second subset information includes certificate information corresponding to the first unique network security certificate set corresponding to the first device model. The second network security certificate includes the public network security certificate set and the first unique network security certificate set.

3. The display device according to claim 1, characterized in that, Based on the comparison result between the certificate name and version number corresponding to the first network security certificate and the certificate name and version number corresponding to the second network security certificate, the target second network security certificate to be downloaded is determined, and the target storage path corresponding to each target second network security certificate is specifically configured as follows: If the comparison result is that the certificate name corresponding to the second network security certificate is different from the certificate names corresponding to all the first network security certificates, the second network security certificate is determined as the target second network security certificate. If the comparison result shows that the certificate name corresponding to the second network security certificate is the same as the certificate name corresponding to the first network security certificate, but the version numbers are different, then the second network security certificate is identified as the target second network security certificate.

4. The display device according to claim 1, characterized in that, Before upgrading the network security service database using the target second network security certificate when the operating state of the display device meets the specified conditions, the controller is further configured to: Perform security verification on the target's second network security certificate; After the target second network security certificate passes the security verification, the flag bit corresponding to the network security service database is adjusted to the pending update flag; When the operating state of the display device meets specified conditions, the controller upgrades the network security service database using the target second network security certificate, specifically configured as follows: When the operating status of the display device meets the specified conditions, and the flag bit corresponding to the network security service database is identified as the flag to be updated, the network security service database is upgraded using the target second network security certificate.

5. The display device according to claim 4, characterized in that, The certificate information of the second network security certificate also includes a decryption field and a first verification value; The controller performs security verification on the target second network security certificate, and is specifically configured as follows: The target second network security certificate is decrypted using the decryption field to obtain the second verification value corresponding to the target second network security certificate; Based on the first verification value and the second verification value, the security verification of the target second network security certificate is performed.

6. The display device according to any one of claims 1-5, characterized in that, After powering on, the controller sends a first request to the server, specifically configured as follows: Start the timer after power-on; When the timer reaches the preset duration, the first request is sent to the server.

7. The display device according to any one of claims 1-5, characterized in that, After powering on, the controller sends a first request to the server, specifically configured as follows: After powering on, check whether the network security service database is currently in a state of pending update; If the network security service database is currently in the pending update state, after updating the network security service database, the first request is sent to the server.

8. A server, characterized in that, include: A communication device configured to communicate with a display device; The storage is configured to deploy network security certificates in units of a single network security certificate, and the server is also configured to deploy a configuration file, which includes certificate information for each network security certificate, including the certificate name, version number, storage path, and the corresponding device identity identifier, which represents the corresponding device model. The controller is configured as follows: Receive a first request sent by the display device, the first request including a first device model of the display device, the first request being used to request certificate information of a network security certificate; In response to the first request, a corresponding first device identity identifier is generated based on the first device model; Based on the first device identity and the configuration file, a second network security certificate corresponding to the first device identity is determined; Send a first certificate set information to the display device, the first certificate set information including the certificate information of the second network security certificate.

9. A method for upgrading a network security certificate, characterized in that, This system is applied to a display device that communicates with a server. The server deploys network security certificates using a single network security certificate as the smallest deployment unit. The server also deploys a configuration file containing certificate information for each network security certificate. This certificate information includes the certificate name, version number, storage path, and an appropriate device identifier for each network security certificate. The device identifier represents the corresponding device model. The display device also stores a network security service database, which includes the first network security certificate that has been installed. The method includes: After powering on, a first request is sent to the server. The first request includes the first device model of the display device and is used to request certificate information for a network security certificate. The server receives a first certificate set information, which includes certificate information of a second network security certificate corresponding to the first device model. Based on the comparison results between the certificate name and version number corresponding to the first network security certificate and the certificate name and version number corresponding to the second network security certificate, the target second network security certificate to be downloaded and the target storage path corresponding to each target second network security certificate are determined. Download the corresponding target second network security certificate according to the target storage path; When the operating status of the display device meets the specified conditions, the network security service database is upgraded using the target second network security certificate.

10. A method for upgrading a network security certificate, characterized in that, The system is applied to a server that communicates with a display device. The server deploys network security certificates using a single network security certificate as the smallest deployment unit. The server also deploys a configuration file, which includes certificate information for each network security certificate. The certificate information includes the certificate name, version number, storage path, and the corresponding device identity identifier of the network security certificate. The device identity identifier is used to represent the corresponding device model. The method includes: Receive a first request sent by the display device, the first request including a first device model of the display device, the first request being used to request certificate information of a network security certificate; In response to the first request, a corresponding first device identity identifier is generated based on the first device model; Based on the first device identity and the configuration file, a second network security certificate corresponding to the first device identity is determined; Send a first certificate set information to the display device, the first certificate set information including the certificate information of the second network security certificate.

Images