CA certificate online application method of intelligent terminal and computer program product

Abstract

The embodiment of the invention provides a CA certificate online application method of an intelligent terminal and a computer program product. The method comprises the following steps: constructing an extended private key based on an extended ID and a seed private key in a seed key pair through the intelligent terminal; the intelligent terminal obtains the CA certificate and the random private key in the random key pair from the CA server through the corresponding management APP; and the intelligent terminal generates a complete private key based on the extended private key and the random private key, so that the intelligent terminal and the management APP perform bidirectional authentication security communication based on the CA certificate and the complete private key. The problem that the intelligent device cannot apply for the CA certificate online in real time in the prior art is solved, and the effects that the intelligent device applies for the CA certificate online in real time and the safety communication capability of the intelligent terminal is improved are achieved.

Description

Technical Field

[0001] This invention relates to the field of communications, and more specifically, to a method for online application of CA certificates for smart terminals and a computer program product. Background Technology

[0002] In a smart home network environment, many smart home devices are limited by their own hardware or network conditions, and cannot connect to the internet independently or through a router. They can only be controlled remotely via a mobile app. Examples include smart remote controls, smart lighting controllers, smart thermostats, smart clothes dryers, smart sockets, smart kettles, smart bathroom mirrors, smart curtains, and various smart sensor devices.

[0003] To enhance the security of control communication between mobile phones and these smart devices, the interaction between the two devices needs to support two-way certificate authentication. This requires the smart device to support certificates and corresponding private keys. However, because smart devices cannot directly connect to the internet and cannot apply for and download certificates online, secure communication with two-way certificate verification is not possible.

[0004] Therefore, there is a problem in the relevant technologies that smart devices cannot apply for Certificate Authority (CA) certificates online in real time. Summary of the Invention

[0005] This invention provides a method and computer program product for online application of CA certificates for smart terminals, to at least solve the problem in related technologies that smart devices cannot apply for CA certificates online in real time.

[0006] According to an embodiment of the present invention, an online application method for a CA certificate for a smart terminal is provided, comprising: the smart terminal constructing an extended private key based on an extended identifier ID and a seed private key in a seed key pair; the smart terminal obtaining a CA certificate and a random private key in a random key pair from a CA server through a corresponding management APP; and the smart terminal generating a complete private key based on the extended private key and the random private key, so that the smart terminal and the management APP can perform two-way authentication secure communication based on the CA certificate and the complete private key.

[0007] According to another embodiment of the present invention, an online CA certificate application method for a smart terminal is provided, comprising: a management APP sending a second certificate application request based on an extended public key to a CA server; the management APP receiving a CA certificate and a response data packet from the CA server, wherein the response data packet is constructed based on a random private key in a random key pair; the management APP sending the CA certificate and the response data packet to the smart terminal, so that the smart terminal generates a complete private key based on the extended private key and the random private key; and the management APP and the smart terminal performing bidirectional authentication secure communication based on the CA certificate and the complete private key.

[0008] According to yet another embodiment of the present invention, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0009] According to yet another embodiment of the present invention, a computer program product is also provided, comprising a computer program that, when executed by a processor, implements the steps in any of the above method embodiments.

[0010] This invention provides a method for online CA certificate application for smart terminals. The method involves the smart terminal constructing an extended private key based on an extended ID and a seed private key from a seed key pair; the smart terminal obtaining a CA certificate and a random private key from a random key pair from a CA server via a corresponding management app; and the smart terminal generating a complete private key based on the extended and random private keys. This enables the smart terminal and the management app to perform secure two-way authentication communication based on the CA certificate and the complete private key. This method solves the problem in related technologies where smart devices cannot apply for CA certificates online in real time, achieving the effect of real-time online CA certificate application for smart devices and improving the secure communication capabilities of smart terminals. Attached Figure Description

[0011] Figure 1 This is a hardware structure block diagram of a mobile terminal for the online CA certificate application method of a smart terminal according to an embodiment of the present invention.

[0012] Figure 2 This is a flowchart of the online CA certificate application method for a smart terminal according to an embodiment of the present invention;

[0013] Figure 3 This is another flowchart of the online CA certificate application method for smart terminals according to an embodiment of the present invention;

[0014] Figure 4 This is a structural block diagram of the online CA certificate application system for smart terminals according to an embodiment of the present invention;

[0015] Figure 5 This is a flowchart of the online application for a CA certificate for a smart terminal according to an embodiment of the present invention. Detailed Implementation

[0016] The embodiments of the present invention will be described in detail below with reference to the accompanying drawings and examples.

[0017] It should be noted that the terms "first," "second," etc., in the specification, claims, and drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0018] In related technologies, a key derivation method, apparatus, and vehicle-mounted device based on vehicle-mounted equipment are provided, including obtaining a seed key, the seed key having a first public key and a first private key; dynamically generating a random key; using a symmetric encryption algorithm combined with the random key to perform key derivation on the first public key to obtain a second public key, and using a symmetric encryption algorithm combined with the random key to perform key derivation on the first private key to obtain a second private key; and using the second public key and the second private key as the derived asymmetric key pair.

[0019] This technology focuses on using a derivation algorithm to generate multiple public-private key pairs based on a seed key, reducing the need to store large amounts of keys. However, it only involves the key derivation mechanism and does not address the method of segmented certificate application and download across different devices. Existing online certificate application methods all require devices to be able to connect to the internet independently and interact directly with the CA certificate server to apply for and download certificates. For terminals that cannot independently access the internet, online certificate application and download cannot be implemented.

[0020] The methods and embodiments provided in this application can be executed on a mobile terminal, computer terminal, or similar computing device. Taking running on a mobile terminal as an example, Figure 1 This is a hardware structure block diagram of a mobile terminal for the online CA certificate application method of a smart terminal according to an embodiment of the present invention. Figure 1 As shown, a mobile terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. The mobile terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the mobile terminal described above. For example, the mobile terminal may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0021] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the online CA certificate application method for the smart terminal in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0022] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the mobile terminal's communication provider. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0023] This invention provides a method for online application of CA certificates for smart terminals. Figure 2 This is a flowchart of the online CA certificate application method for a smart terminal according to an embodiment of the present invention, as follows: Figure 2 As shown, the process includes the following steps:

[0024] In step S202, the smart terminal constructs an extended private key based on the extended ID and the seed private key in the seed key pair.

[0025] In this embodiment of the invention, after the smart terminal starts up, it enters the initial process of the certificate key management layer, checks the current status of the CA certificate, and then proceeds to a judgment. The judgment layer checks whether the CA certificate has been downloaded and its validity period. If it has not been downloaded or the certificate has expired, an extended private key is constructed. If the certificate has been downloaded and has not expired, the smart terminal and the mobile management APP conduct two-way authentication secure communication based on the CA certificate and the complete private key.

[0026] In step S204, the smart terminal obtains the CA certificate and the random private key from the random key pair from the CA server through the corresponding management APP.

[0027] In one embodiment, the aforementioned management PP can typically be installed on a mobile terminal device, such as a mobile phone.

[0028] In an exemplary embodiment, before the smart terminal obtains the CA certificate and the random private key from the random key pair from the CA server through the corresponding management APP, the method further includes: the smart terminal sending a first certificate application request and an extended ID to the corresponding management APP, so that the management APP sends a second certificate application request to the CA server and obtains the CA certificate and response packet data from the CA server, wherein the response packet data is constructed based on the random private key.

[0029] In this embodiment of the invention, the smart terminal sends a first certificate application request and an extended ID to the management app. Upon receiving the first certificate application request and the extended ID used for calculating the key, the management app generates an extended public key based on the seed public key of the seed key pair built into the app and the extended ID used for calculating the key. The management app's certificate key interaction layer uses the extended public key to construct a second certificate application request and sends it to the CA server.

[0030] In one exemplary embodiment, the second certificate application request is constructed by the management APP based on the extended public key, which is constructed by the management APP based on the seed public key in the extended ID and seed key pair.

[0031] In one exemplary embodiment, the CA certificate is constructed by the CA server based on the full public key, a specific validity period, and the CA root certificate. The full public key is constructed by the CA server based on the extended public key and the random public key in the random key pair.

[0032] In this embodiment of the invention, after receiving the second certificate application request, the CA server extracts the extended public key and, together with the random public key in the random key pair of the CA server, generates a complete public key. Based on the complete public key, a specific validity period (e.g., 1 year), the CA root certificate, etc., a CA certificate specifically for the smart terminal device is generated.

[0033] Step S206: The smart terminal generates a complete private key based on the extended private key and the random private key, so that the smart terminal and the management APP can conduct two-way authentication secure communication based on the CA certificate and the complete private key.

[0034] In this embodiment of the invention, the CA server constructs a response packet data using the CA certificate and the random private key from the random key pair, and sends it to the management APP. After receiving the certificate request response packet, the management APP's certificate key interaction layer sends the response packet data using the CA certificate and the random private key from the random key pair to the smart terminal's certificate key interaction layer. The smart terminal's key generation layer generates a complete private key based on the extended private key and the random private key from the random key pair.

[0035] In one exemplary embodiment, after the smart terminal generates a complete private key based on the extended private key and the random private key, the method further includes: the smart terminal storing the CA certificate and the complete private key in a secure partition.

[0036] This invention provides a method for online application of CA certificates for smart terminals. Figure 3 This is another flowchart of the online CA certificate application method for smart terminals according to an embodiment of the present invention, as follows: Figure 3 As shown, the process includes the following steps:

[0037] In step S302, the management app sends a second certificate application request based on the extended public key to the CA server.

[0038] In this embodiment of the invention, after the smart terminal starts up, it enters the initial process of the certificate key management layer, checks the current status of the CA certificate, and then proceeds to a judgment. The judgment layer checks whether the CA certificate has been downloaded and its validity period. If it has not been downloaded or the certificate has expired, it constructs an extended private key. If the certificate has been downloaded and has not expired, the smart terminal and the management APP conduct two-way authentication secure communication based on the CA certificate and the complete private key.

[0039] In this embodiment of the invention, the smart terminal sends a first certificate application request and an extended ID to the management app. Upon receiving the first certificate application request and the extended ID used for calculating the key, the management app generates an extended public key based on the seed public key of the seed key pair built into the app and the extended ID used for calculating the key. The management app's certificate key interaction layer uses the extended public key to construct a second certificate application request and sends it to the CA server.

[0040] In one exemplary embodiment, before the management app sends the second certificate application request based on the extended public key to the CA server, the method further includes: the management app receiving the first certificate application request and the extended ID from the smart terminal; and the management app constructing the extended public key based on the extended ID and the seed public key in the seed key pair.

[0041] Step S304: The management APP receives a CA certificate and a response data packet from the CA server, wherein the response data packet is constructed based on the random private key in the random key pair.

[0042] In this embodiment of the invention, after receiving the second certificate application request, the CA server extracts the extended public key and, together with the random public key in the random key pair of the CA server, generates a complete public key. Based on the complete public key, a specific validity period (e.g., 1 year), the CA root certificate, etc., a CA certificate specifically for the smart terminal device is generated.

[0043] In one exemplary embodiment, the CA certificate is constructed by the CA server based on the full public key, a specific validity period, and the CA root certificate. The full public key is constructed by the CA server based on the extended public key and the random public key in the random key pair.

[0044] In step S306, the management APP sends the CA certificate and response data packet to the smart terminal, so that the smart terminal can generate a complete private key based on the extended private key and the random private key.

[0045] In one exemplary embodiment, the extended private key is constructed by the smart terminal based on the seed private key in the extended ID and seed key pair.

[0046] In this embodiment of the invention, the CA server constructs a response packet data using the CA certificate and the random private key from the random key pair, and sends it to the management APP. After receiving the certificate request response packet, the management APP's certificate key interaction layer sends the response packet data using the CA certificate and the random private key from the random key pair to the smart terminal's certificate key interaction layer. The smart terminal's key generation layer generates a complete private key based on the extended private key and the random private key from the random key pair.

[0047] Step S308: The management APP and smart terminal conduct two-way authentication secure communication based on CA certificate and complete private key.

[0048] In one exemplary embodiment, the management app and the smart terminal conduct two-way authentication secure communication based on a CA certificate and a complete private key, including: the management app and the smart terminal reading the CA certificate and the complete private key from a secure partition to conduct two-way authentication secure communication.

[0049] This invention provides a method for online CA certificate application for smart terminals. The method involves the smart terminal constructing an extended private key based on an extended ID and a seed private key from a seed key pair; the smart terminal obtaining a CA certificate and a random private key from a random key pair from a CA server via a corresponding management app; and the smart terminal generating a complete private key based on the extended and random private keys. This enables the smart terminal and the management app to perform secure two-way authentication communication based on the CA certificate and the complete private key. This method solves the problem in related technologies where smart devices cannot apply for CA certificates online in real time, achieving the effect of real-time online CA certificate application for smart devices and improving the secure communication capabilities of smart terminals.

[0050] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0051] This embodiment also provides an online CA certificate application device for a smart terminal, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0052] The online CA certificate application device for a smart terminal provided in this embodiment of the invention can be installed on the smart terminal and includes a first construction module, a first acquisition module, and a first generation module. The first construction module is configured to construct an extended private key based on the extended identifier ID and the seed private key in the seed key pair. The first acquisition module is configured to obtain a CA certificate and a random private key from a random key pair from a CA server through a corresponding management APP. The first generation module is configured to generate a complete private key based on the extended private key and the random private key, enabling the smart terminal and the management APP to perform two-way authentication secure communication based on the CA certificate and the complete private key.

[0053] The online CA certificate application device for a smart terminal provided in this embodiment of the invention can be set up on a mobile phone and run through a mobile phone management APP, or set up on a mobile phone management APP, including a first sending module, a first receiving module, a second sending module, and a communication module. The first sending module is configured to send a second certificate application request based on an extended public key to a CA server. The first receiving module is configured to receive a CA certificate and a response data packet from the CA server, wherein the response data packet is constructed based on a random private key in a random key pair. The second sending module is configured to send the CA certificate and the response data packet to the smart terminal, so that the smart terminal generates a complete private key based on the extended private key and the random private key. The communication module is configured to perform two-way authenticated secure communication with the smart terminal based on the CA certificate and the complete private key.

[0054] In this embodiment of the invention, the CA certificate online application device of the smart terminal may also include different modules, and the naming and functional division of the modules may be selected in different ways according to the actual situation, without specific restrictions.

[0055] It should be noted that the above modules can be implemented by software or hardware. For the latter, they can be implemented in the following ways, but are not limited to: all the above modules are located in the same processor; or, the above modules are located in different processors in any combination.

[0056] Embodiments of the present invention also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to perform the steps in any of the above method embodiments when executed.

[0057] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0058] Embodiments of the present invention also provide an electronic device including a memory and a processor, the memory storing a computer program and the processor being configured to run the computer program to perform the steps in any of the above method embodiments.

[0059] In one exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0060] This invention also provides a computer program product, including a computer program that, when executed by a processor, implements the steps in any of the above method embodiments.

[0061] In one exemplary embodiment, the computer program product described above includes a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the methods described in various embodiments of this application.

[0062] Specific examples in this embodiment can be found in the examples described in the above embodiments and exemplary implementations, and will not be repeated here.

[0063] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those described herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0064] To enable those skilled in the art to better understand the technical solutions of the present invention, the following description is provided in conjunction with different embodiments.

[0065] Example 1

[0066] In this embodiment of the invention, the management app can typically be installed on a mobile terminal device, such as a mobile phone. Therefore, in this embodiment, a mobile phone management app is used as an implementation method for description.

[0067] The online CA certificate application method for smart terminals provided in this embodiment of the invention allows smart terminals that cannot connect to the internet independently to apply for and download CA certificates online using the internet connectivity of a mobile management APP.

[0068] In this embodiment of the invention, the smart terminal generates an extended private key corresponding to the certificate based on the seed private key and extended ID of the seed key pair. A mobile management app connects to the internet to assist in downloading the CA certificate and a random private key. The CA certificate contains a complete public key generated based on the seed public key, extended ID, and random public key of the seed key pair. The mobile app transmits the CA certificate and random private key to the smart terminal, which then generates the complete public key based on the random public key and extended public key, enabling segmented online application and download of the CA certificate and generation of the complete public key. The smart terminal then uses the complete private key and the CA certificate carrying the complete public key to perform secure communication with the mobile management app for two-way certificate verification.

[0069] In this embodiment of the invention, in secure communication based on certificate verification, it is essential to ensure that the private key corresponding to the certificate is securely stored and used, and the private key corresponding to the certificate must not be transmitted outside the device. Based on this security requirement, this embodiment of the invention does not transmit the private key, but only transmits the corresponding extended ID. A key derivation algorithm is used to solve the problem of certificate downloading for smart terminals that cannot independently connect to the Internet, thereby improving the secure communication capability of smart terminals.

[0070] This invention provides an online CA certificate application system for smart terminals. Figure 4This is a structural block diagram of the online CA certificate application system for smart terminals according to an embodiment of the present invention, as shown below. Figure 4 As shown, it includes: CA server, smart terminal and mobile management APP.

[0071] In this embodiment of the invention, the CA (Certificate Authority) server is used to generate random key pairs for issuing certificates, generate CA certificates based on random key pairs and certificate application requests, and interact with the mobile smart terminal management APP to receive certificate application requests from the mobile smart terminal management APP and send the CA certificate and random private key of the random key pair to the mobile smart terminal management APP.

[0072] A mobile management app, also known as a mobile smart terminal management app, is used to interact with smart terminals, assist smart terminals in applying for and downloading CA certificates and random private keys online, and conduct secure communication of control data with smart terminals based on CA certificates and their corresponding complete private keys.

[0073] The smart terminal can be of different types or the same type of device with different IDs. It is responsible for interacting with the mobile management APP. Different terminals use different extended IDs and request CA certificates based on specific rules. After downloading the CA certificate, it communicates with the mobile management APP for secure control data based on the CA certificate and its corresponding complete private key.

[0074] like Figure 4 As shown, the system comprises the following layers: The Certificate Key Interaction Layer is responsible for constructing and exchanging certificate and key application data between the mobile management app and the smart terminal, as well as the certificate application and issuance interaction between the mobile management app and the CA server. The Key Generation Layer is responsible for generating extended public and private keys based on the seed key and extended ID, and generating a complete private key based on the extended private key and a random private key. The Certificate Key Management Layer is responsible for storing the CA certificate and its corresponding private key for use by the control data communication layer. The Control Data Communication Layer is responsible for constructing control data between the mobile management app and the smart terminal, and for secure communication based on the CA certificate and its corresponding complete private key.

[0075] Figure 5 This is a flowchart of the online application for a CA certificate for a smart terminal according to an embodiment of the present invention, such as... Figure 5 As shown, it includes the following steps:

[0076] Step S501: After the smart terminal starts up, it enters the initial process of the certificate key management layer, checks the status of the current CA certificate, and then makes a judgment.

[0077] The system checks whether the CA certificate has been downloaded and its validity period. If the CA certificate has not been downloaded or has expired, the system proceeds to step S502. If the CA certificate has been downloaded and has not expired, the system proceeds to step S511.

[0078] Step S502: In secure communication based on certificate verification, the secure storage and use of the private key corresponding to the certificate must be protected, and the private key corresponding to the certificate must not be transmitted outside the device. Based on this security requirement, in this embodiment of the invention, the extended private key and extended public key are calculated by the derivative algorithm on the smart terminal and the mobile management APP respectively based on the extended ID. In this embodiment, the smart terminal generates the extended private key b based on the seed private key a in the seed key (a,A) and the extended ID, and proceeds to step S103.

[0079] In step S503, the certificate key interaction layer of the smart terminal communicates with the certificate key interaction layer of the mobile management APP to send the first certificate application request and the extended ID used for calculating the key.

[0080] In step S504, after the mobile management APP receives the first certificate application request and the extended ID used for calculating the key, it first enters the key generation layer and generates the extended public key B based on the seed public key A of the seed key pair built into the APP and the extended ID used for calculating the key.

[0081] In step S505, the certificate key interaction layer of the mobile management APP uses the extended public key B to construct a second certificate application request and sends it to the CA server.

[0082] In step S506, after receiving the second certificate application request, the CA server extracts the public key B from it and, together with the random public key C in the random key pair (c,C) of the CA server, generates a complete public key S. Based on the complete public key S, a specific validity period (e.g., 1 year), the CA root certificate, etc., a CA certificate specifically for the smart device is generated.

[0083] In step S507, the CA server constructs a response packet data with the CA certificate and the random private key c in the random key pair (c,C) and sends it to the mobile management APP.

[0084] In step S508, after receiving the certificate application response packet, the certificate key interaction layer of the mobile management APP sends the response packet data of the CA certificate and the random private key c in the random key pair (c,C) to the certificate key interaction layer of the smart terminal.

[0085] Step S509: The key generation layer of the smart terminal generates a complete private key s based on the extended private key b and the random private key c in the random key pair (c,C), and then proceeds to step S510.

[0086] In step S510, the certificate key management layer of the smart terminal stores the CA certificate of S generated based on the complete public key and its corresponding complete private key s in the secure partition of the terminal, and then proceeds to step S511.

[0087] In step S511, the control data communication layer of the smart terminal and the control data communication layer of the mobile management APP read the CA certificate and its corresponding complete private key from the security partition to conduct two-way authentication secure communication.

[0088] The aforementioned smart terminals include smart devices that, due to their own hardware limitations, cannot connect to the internet independently or through a router, such as smart home devices, smart remote controls, smart lighting controllers, smart clothes dryers, smart sockets, smart kettles, and various smart sensors. These smart terminals cannot directly connect to the network throughout their entire lifecycle. During the initial power-on phase and when the CA certificate expires, they require connection to a mobile management app to implement the segmented method of applying for and downloading the CA certificate.

[0089] This also includes situations where the device's own networking capabilities fail due to current network conditions, preventing it from connecting to the network. Examples include smart traffic lights in smart transportation systems, alarms and access control systems in smart security systems, and smart measurement controllers in smart grids. These devices may experience issues at certain times, such as during natural disasters, or in specific geographical environments, such as basements, remote mountainous areas, or deserts. Initially, these smart terminals may be able to connect to the network and download CA certificates independently. However, once they are in these special scenarios, and the previously downloaded CA certificate expires, requiring a new CA certificate to be downloaded, other network-enabled devices are needed to assist in implementing the segmented CA certificate application and download method described above.

[0090] The online CA certificate application method for terminal provided in this invention can be applied to various Internet of Things scenarios, including smart homes, smart transportation, smart grids, smart security and other environments. It is suitable for smart devices that are limited by their own hardware conditions and cannot connect to the Internet independently or connect to the Internet through a router, or whose own networking function is malfunctioning and cannot connect to the network, and can only connect to a mobile APP or connect to an adjacent smart terminal for short-range control.

[0091] The online CA certificate application method for terminal provided in this invention can be applied to smart devices that are limited by their own hardware conditions and cannot connect to the Internet independently or connect to the Internet through a router, such as smart home devices, smart remote controls, smart lighting controls, smart clothes dryers, smart sockets, smart kettles, and various smart sensors.

[0092] The online CA certificate application method for a terminal provided in this invention can be applied to various intelligent devices that cannot connect to the network due to the failure of their own networking function caused by the current network environment. Examples include intelligent traffic lights in smart transportation, alarms and access control systems in smart security, and intelligent measurement controllers in smart grids. These devices may experience issues at certain times, such as during natural disasters, or in specific geographical environments, such as basements, remote mountainous areas, or deserts.

[0093] In the above application scenario, after the smart device connects to the mobile APP, it sends a certificate application request. Under the condition that the mobile APP can connect to the Internet of Things normally, it then applies to the CA server to download the certificate. Finally, it connects to the smart device and sends the certificate to the smart device to complete the certificate download.

[0094] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A CA certificate online application method of a smart terminal, characterized in that, The method comprises: The intelligent terminal constructs an extended private key based on an extended ID and a seed private key in a seed key pair; The intelligent terminal obtains a CA certificate and a random private key in a random key pair from a CA server through a corresponding management APP; The intelligent terminal generates a complete private key based on the extended private key and the random private key, so that the intelligent terminal and the management APP perform bidirectional authentication secure communication based on the CA certificate and the complete private key.

2. The method of claim 1, wherein, Before the intelligent terminal obtains a CA certificate and a random private key in a random key pair from a CA server through a corresponding management APP, the method further comprises: The intelligent terminal sends a first certificate application request and the extended ID to the corresponding management APP, so that the management APP sends a second certificate application request to the CA server and obtains the CA certificate and a response packet data from the CA server, wherein the response packet data is constructed based on the random private key.

3. The method of claim 2, wherein, The second certificate application request is constructed by the management APP based on an extended public key, and the extended public key is constructed by the management APP based on the extended ID and a seed public key in a seed key pair. The CA certificate is constructed by the CA server based on a complete public key, a specific validity period and a CA root certificate, and the complete public key is constructed by the CA server based on the extended public key and a random public key in a random key pair.

4. The method of claim 3, wherein, After the intelligent terminal generates a complete private key based on the extended private key and the random private key, the method further comprises: The intelligent terminal stores the CA certificate and the complete private key to a secure partition.

5. The method of claim 1, wherein, The method comprises: The management APP sends a second certificate application request constructed based on an extended public key to a CA server; 6. An online CA certificate application method for a smart terminal, characterized in that, The management APP receives a CA certificate and a response data packet from the CA server, wherein the response data packet is constructed based on a random private key in a random key pair; The management APP sends the CA certificate and the response data packet to an intelligent terminal, so that the intelligent terminal generates a complete private key based on an extended private key and the random private key; The management APP and the intelligent terminal perform bidirectional authentication secure communication based on the CA certificate and the complete private key. Before the management APP sends a second certificate application request constructed based on an extended public key to a CA server, the method further comprises: The management APP receives a first certificate application request and an extended ID from the intelligent terminal; 7. The method of claim 6, wherein, The management APP constructs the extended public key based on the extended ID and a seed public key in a seed key pair. The CA certificate is constructed by the CA server based on a complete public key, a specific validity period and a CA root certificate, and the complete public key is constructed by the CA server based on the extended public key and a random public key in a random key pair. The extended private key is constructed by the intelligent terminal based on an extended ID and a seed private key in a seed key pair.

8. The method of claim 7, wherein, The management APP and the intelligent terminal perform bidirectional authentication secure communication based on the CA certificate and the complete private key, which comprises: ​ 9. The method of claim 6, wherein, ​ ​ 10. The method of claim 6, wherein, ​ The management APP and the intelligent terminal read the CA certificate and the complete private key from a secure partition to perform two-way authentication secure communication. 11.An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein, The processor implements the method in any one of claims 1 to 10 when executing the computer program.

12. A computer program product comprising a computer program, characterized in that, The computer program, when executed by the processor, implements the method in any one of claims 1 to 10.

Images