A method, system and device for WAPI terminal certificate management and an electronic device

Abstract

This application relates to the field of certificate management technology, specifically providing a method, system, apparatus, and electronic device for WAPI terminal certificate management. The method may include: generating a real-time composite fingerprint based on real-time collected network environment characteristics and WAPI terminal device characteristics; generating a certificate management request; wherein the certificate management request is a certificate application request or a certificate update request; the certificate management request carries the real-time composite fingerprint, device identifier, network environment characteristics, and certificate public key; sending the certificate management request to a certificate issuing server, whereby the certificate issuing server verifies the certificate management request using local registration information to determine whether it is for issuing or updating a certificate for the WAPI terminal. This application embodiment can improve the security of WAPI terminal certificate management.

Description

Technical Field

[0001] This application relates to the field of certificate management technology, and more specifically, to a method, system, apparatus, and electronic device for WAPI terminal certificate management. Background Technology

[0002] WAPI (Wireless LAN Authentication and Privacy Infrastructure) is one of the two major WLAN security standards. WAPI certificate issuance and renewal rely on the terminal submitting information such as its device model and MAC address (Media Access Control Address) to the certificate issuing server when requesting a certificate. The certificate issuing server verifies the information format, MAC uniqueness, and match with a pre-registered whitelist. If verification is successful, a certificate is issued. However, MAC addresses can be easily tampered with and cloned using software, and device information can also be forged. Attackers can use this to impersonate legitimate terminals and fraudulently obtain certificates. This verification method, which relies solely on device information and MAC addresses, carries a high level of security vulnerability. Summary of the Invention

[0003] The purpose of some embodiments of this application is to provide a method, system, apparatus, and electronic device for WAPI terminal certificate management. The technical solutions of the embodiments of this application can improve the security of WAPI terminal certificate management.

[0004] In a first aspect, some embodiments of this application provide a method for WAPI terminal certificate management, comprising: generating a real-time composite fingerprint based on real-time collected network environment characteristics and WAPI terminal device characteristics; wherein, the network environment characteristics include a service set identifier of a wireless access point associated with the WAPI terminal and a wireless access list within a defined area; the device characteristics include a device identifier, processor serial number, or trusted boot metric of the WAPI terminal; generating a certificate management request; wherein, the certificate management request is a certificate application request or a certificate update request; the certificate management request carries the real-time composite fingerprint, the device identifier, the network environment characteristics, and a certificate public key; sending the certificate management request to a certificate issuing server, wherein the certificate management request is verified by the certificate issuing server through local filing information to determine whether a certificate is issued or updated for the WAPI terminal; wherein, the local filing information includes a baseline composite fingerprint of the WAPI terminal, wireless access point authorization information, and environmental wireless access information.

[0005] Some embodiments of this application generate a real-time composite fingerprint by combining the network environment characteristics of the WAPI terminal and its own device characteristics. This fingerprint is then included in a certificate management request and sent to the certificate issuing server. The certificate issuing server can verify the content carried in the certificate management request to confirm whether to issue or update a certificate. By incorporating network environment characteristics into the generation of the composite fingerprint, this application constructs a two-factor trusted verification system based on device characteristics and network environment characteristics, which can solve the security problems in certificate management caused by device identity spoofing and access environment forgery.

[0006] In some embodiments, before generating a real-time composite fingerprint based on the real-time collected network environment features and the device features of the WAPI terminal, the method further includes: collecting the network environment features in real time when determining that the WAPI terminal is in the certificate application stage or the certificate renewal stage.

[0007] Some embodiments of this application collect network environment characteristics when the WAPI terminal needs to apply for or update a certificate, so as to realize timely application or update of WAPI terminal certificate.

[0008] In some embodiments, when the WAPI terminal is placed at an authorized location, before generating the real-time composite fingerprint based on the real-time collected network environment characteristics and the WAPI terminal's device characteristics, the method further includes: reading the device information of the WAPI terminal; wherein the device information includes a device identifier, processor serial number, or trusted boot metric; collecting network environment information where the WAPI terminal is located; wherein the network environment information includes wireless access point authorization information authorized to the WAPI terminal and environmental wireless access information of the designated area; calculating the baseline composite fingerprint based on the device information and the network environment information; and sending the baseline composite fingerprint, the wireless access point authorization information, and the environmental wireless access information to the certificate issuing server, wherein the baseline composite fingerprint, the wireless access point authorization information, and the environmental wireless access information are used to generate the local registration information.

[0009] Some embodiments of this application generate a baseline composite fingerprint and send the wireless access point authorization information and environmental wireless access information together to the certificate issuance server, which enables the certificate issuance server to file the relevant data of the terminal and provide effective data support for subsequent WAPI terminal verification.

[0010] Secondly, some embodiments of this application provide a method for WAPI terminal certificate management, including: receiving a certificate management request sent by a WAPI terminal; wherein the certificate management request is a certificate application request or a certificate update request; the certificate management request carries a real-time composite fingerprint, a device identifier, network environment characteristics, and a certificate public key; the real-time composite fingerprint is generated based on real-time collected network environment characteristics and device characteristics; the network environment characteristics include a service set identifier of a wireless access point associated with the WAPI terminal and a list of wireless access points within a defined area; the device characteristics include the device identifier, processor serial number, or trusted boot metric of the WAPI terminal; verifying the certificate management request using local filing information to determine whether a certificate is issued or updated for the WAPI terminal; wherein the local filing information includes the baseline composite fingerprint of the WAPI terminal, wireless access point authorization information, and environmental wireless access information.

[0011] Some embodiments of this application verify the certificate management request sent by WAPI using local filing information to determine whether the certificate is issued or renewed for the WAPI terminal, thereby achieving effective verification of the WAPI terminal's identity and providing high security.

[0012] In some embodiments, verifying the certificate management request using local filing information to determine whether a certificate is to be issued or renewed for the WAPI terminal includes: comparing the device feature value in the baseline composite fingerprint with the device feature value to be verified in the real-time composite fingerprint to obtain an identity verification result; comparing the wireless access point authorization information with the service set identifier to obtain an access point verification result; comparing the environmental wireless access information with the wireless access list to obtain an environmental similarity value; and determining whether a certificate is to be issued or renewed for the WAPI terminal based on the identity verification result, the access point verification result, and the environmental similarity value.

[0013] Some embodiments of this application verify whether a certificate was issued or updated for a WAPI terminal by verifying the device feature value to be verified, the service set identifier, and the wireless access list in the real-time composite fingerprint, respectively. This enables accurate verification of the WAPI terminal's identity.

[0014] In some embodiments, determining whether to issue or update a certificate for the WAPI terminal based on the identity verification result, the access point verification result, and the environment similarity value includes: if both the identity verification result and the access point verification result are passed, and the environment similarity value is greater than a first threshold, then confirming that a certificate is to be issued or updated for the WAPI terminal; if both the identity verification result and the access point verification result are passed, and the environment similarity value is greater than a second threshold but not greater than the first threshold, then re-verifying the WAPI terminal to determine whether to issue or update a certificate for the WAPI terminal; if the identity verification result is passed, the access point verification result is failed, or the environment similarity value is not greater than the second threshold, then transferring to a manual review queue for the administrator to decide whether to issue or update a certificate for the WAPI terminal; if the identity verification result is failed, then refusing to issue or update a certificate for the WAPI terminal.

[0015] Some embodiments of this application determine whether a certificate should be issued or updated for a WAPI terminal by considering the relationship between identity verification results, access point verification results, and environment similarity values. This can improve the accuracy of identity verification and the security of certificate management.

[0016] In some embodiments, comparing the environmental wireless access information with the wireless access list to obtain an environmental similarity value includes: obtaining a first number of wireless access points that exist simultaneously in both the environmental wireless access information and the wireless access list and whose signal strength difference is no greater than a tolerance threshold; obtaining a second number of wireless access points that exist simultaneously in both the environmental wireless access information and the wireless access list and whose signal strength difference is greater than the tolerance threshold; obtaining a third number of wireless access points that exist only in the environmental wireless access information or only in the wireless access list; and calculating the environmental similarity value based on the first, second, and third numbers.

[0017] Some embodiments of this application calculate environmental similarity values ​​by relating wireless access points to environmental wireless access information and wireless access lists, providing data support for environmental feature verification.

[0018] In some embodiments, the certificate management request is verified using local filing information to determine whether it is for updating the certificate of the WAPI terminal. This includes: if the number of successful certificate updates by the WAPI terminal is greater than a threshold, and if it is confirmed that the network environment characteristics match the environment fingerprint data, then the certificate of the WAPI terminal is updated; wherein, the environment fingerprint data is the network environment characteristics at the time of the last successful certificate update.

[0019] Some embodiments of this application simplify the certificate issuance process by determining whether to update the certificate based solely on network environment characteristics when the number of successful certificate updates on the WAPI terminal exceeds a threshold, thereby improving issuance efficiency while ensuring security.

[0020] Thirdly, some embodiments of this application provide a WAPI terminal certificate management system, including: a WAPI terminal and a certificate issuance server; the WAPI terminal is used to generate a real-time composite fingerprint based on real-time collected network environment characteristics and WAPI terminal device characteristics; wherein, the network environment characteristics include a service set identifier of a wireless access point associated with the WAPI terminal and a wireless access list within a set area; the device characteristics include the device identifier, processor serial number, or trusted boot metric of the WAPI terminal; generate a certificate management request; wherein, the certificate management request is a certificate application request or a certificate update request; the certificate management request carries the real-time composite fingerprint, the device identifier, the network environment characteristics, and a certificate public key; send the certificate management request to the certificate issuance server; the certificate issuance server is used to receive the certificate management request; verify the certificate management request using local filing information to determine whether to issue or update a certificate for the WAPI terminal; wherein, the local filing information includes the baseline composite fingerprint of the WAPI terminal, wireless access point authorization information, and environmental wireless access information.

[0021] Fourthly, some embodiments of this application provide an apparatus for WAPI terminal certificate management, comprising: a fingerprint generation module, used to generate a real-time composite fingerprint based on real-time collected network environment features and WAPI terminal device features; wherein the network environment features include a service set identifier of a wireless access point associated with the WAPI terminal and a wireless access list within a set area; the device features include a device identifier, processor serial number, or trusted boot metric of the WAPI terminal; a request generation module, used to generate a certificate management request; wherein the certificate management request is a certificate application request or a certificate update request; the certificate management request carries the real-time composite fingerprint, the device identifier, the network environment features, and a certificate public key; and a sending module, used to send the certificate management request to a certificate issuing server, wherein the certificate management request is verified by the certificate issuing server through local filing information to determine whether a certificate is issued or updated for the WAPI terminal; wherein the local filing information includes a baseline composite fingerprint of the WAPI terminal, wireless access point authorization information, and environmental wireless access information.

[0022] Fifthly, some embodiments of this application provide an apparatus for WAPI terminal certificate management, comprising: a receiving module, configured to receive a certificate management request sent by a WAPI terminal; wherein the certificate management request is a certificate application request or a certificate update request; the certificate management request carries a real-time composite fingerprint, a device identifier, network environment characteristics, and a certificate public key; the real-time composite fingerprint is generated based on real-time collected network environment characteristics and device characteristics; the network environment characteristics include a service set identifier of a wireless access point associated with the WAPI terminal and a list of wireless access points within a defined area; the device characteristics include a device identifier, a processor serial number, or a trusted boot metric of the WAPI terminal; and a verification module, configured to verify the certificate management request using local filing information to determine whether a certificate is issued or updated for the WAPI terminal; wherein the local filing information includes a baseline composite fingerprint of the WAPI terminal, wireless access point authorization information, and environmental wireless access information.

[0023] Sixthly, some embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the methods described in any of the embodiments of the first or second aspect.

[0024] In a seventh aspect, some embodiments of this application provide an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement the method as described in any embodiment of the first or second aspect.

[0025] Eighthly, some embodiments of this application provide a computer program product comprising a computer program, wherein the computer program, when executed by a processor, can implement the method described in any embodiment of the first or second aspect. Attached Figure Description

[0026] To more clearly illustrate the technical solutions of some embodiments of this application, the accompanying drawings used in some embodiments of this application will be briefly described below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 System diagrams for WAPI terminal certificate management provided for some embodiments of this application; Figure 2 Flowchart of a method for filing WAPI terminal information provided for some embodiments of this application; Figure 3One of the flowcharts for WAPI terminal certificate management provided for some embodiments of this application; Figure 4 A second flowchart illustrating a method for WAPI terminal certificate management provided for some embodiments of this application; Figure 5 One of the device composition block diagrams for WAPI terminal certificate management provided for some embodiments of this application; Figure 6 A second block diagram of a WAPI terminal certificate management apparatus provided for some embodiments of this application; Figure 7 A schematic diagram of an electronic device provided for some embodiments of this application. Detailed Implementation

[0028] The technical solutions of some embodiments of this application will now be described with reference to the accompanying drawings.

[0029] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0030] The WAPI certificate management scheme in related technologies relies solely on device information and MAC address verification. This existing scheme has significant drawbacks: First, its verification mechanism typically relies only on static identifiers such as device MAC addresses and device information, which are easily forged or tampered with, making it unable to defend against device cloning attacks. Second, the existing scheme lacks the ability to perceive and verify the physical access environment of the terminal. Attackers can use fake access points (APs) to induce legitimate terminals to access the system, thereby carrying out man-in-the-middle attacks, which the existing system is completely unaware of. Furthermore, the certificate renewal process often reuses the simplified verification of the initial application, failing to form a continuous security posture assessment and resulting in a security lifecycle gap.

[0031] As can be seen from the above-mentioned technologies, there are significant security vulnerabilities in the existing WAPI certificate management technology.

[0032] In view of this, some embodiments of this application provide a method for WAPI terminal certificate management. This method constructs a dynamic two-factor trusted verification system based on "device identity and physical location (i.e., network environment characteristics)" throughout the entire certificate lifecycle. By forcibly collecting the hardware characteristics (i.e., device characteristics) and unique wireless network environment characteristics (or "enhanced environment fingerprint") of the WAPI terminal in a real deployment environment, a cryptographically bound composite fingerprint is generated. Then, the identity of the WAPI terminal is verified based on the composite fingerprint to determine whether a certificate should be issued or renewed. This approach fundamentally solves the two core security problems caused by device identity spoofing and access environment forgery, raising the cost and technical requirements for attackers to successfully launch attacks to an unattainable level, and providing an indispensable underlying security enhancement for wireless access scenarios with high security requirements.

[0033] The following is in conjunction with the appendix Figure 1 The overall structure of a WAPI terminal certificate management system provided by some embodiments of this application is illustrated by way of example.

[0034] like Figure 1 As shown in the figure, some embodiments of this application provide a system diagram for WAPI terminal certificate management. This WAPI terminal certificate management system may include a WAPI terminal (hereinafter referred to as "terminal") 100 and a Certificate Issuing Server (CIS) 200. The WAPI terminal 100 is responsible for collecting device characteristics and network environment characteristics, generating composite fingerprints, and processing key pair generation, certificate application, and update requests. The CIS is the control point for the entire certificate management process; it integrates policy enforcement, fingerprint verification units, and a trusted filing database (which can be used to store local filing information). It is responsible for parsing, security verification, and intelligent routing of all certificate application and update requests, and ultimately issuing or updating digital certificates according to the algorithm type. The CIS can use the national cryptographic algorithm SM4 to encrypt and store sensitive data such as the root certificate private key and the hosted device private key.

[0035] In some embodiments of this application, the WAPI terminal 100 is configured to generate a real-time composite fingerprint based on real-time collected network environment characteristics and WAPI terminal device characteristics; wherein, the network environment characteristics include the service set identifier of the wireless access point associated with the WAPI terminal and the wireless access list within a defined area; the device characteristics include the device identifier, processor serial number, or trusted boot metric of the WAPI terminal; generate a certificate management request; wherein, the certificate management request is a certificate application request or a certificate update request; the certificate management request carries the real-time composite fingerprint, the device identifier, the network environment characteristics, and the certificate public key; and send the certificate management request to a certificate issuing server.

[0036] In some embodiments of this application, a certificate issuing server is used to receive the certificate management request; verify the certificate management request using local filing information to determine whether to issue or update a certificate for the WAPI terminal; wherein, the local filing information includes the WAPI terminal's baseline composite fingerprint, wireless access point authorization information, and environmental wireless access information.

[0037] The following examples illustrate the specific implementation functions of WAPI terminal 100 and CIS.

[0038] Understandably, when applying for or renewing a certificate for WAPI terminal 100, the CIS side needs to first register the basic information of WAPI terminal 100 to achieve effective, accurate, and secure verification of the WAPI terminal's identity. Therefore, the following, in conjunction with the appendix... Figure 2 This document exemplifies the implementation process of WAPI terminal information filing during WAPI terminal certificate management performed by WAPI terminal 100, as provided in some embodiments of this application. This WAPI terminal information filing stage is the cornerstone of the security of this application, spanning the entire lifecycle management of the certificate. It must be executed after the production network is ready, at the actual physical location where the terminal is planned to operate long-term. Specifically, in the target deployment area, it is ensured that the production network of WAPI terminal 100 has been fully deployed and debugged, and all authorized APs (Access Points) and surrounding APs are in normal operating condition. The WAPI terminal 100 to be filed is precisely placed in its authorized fixed physical location and configured to connect to the designated authorized AP.

[0039] Please see the appendix Figure 2 , Figure 2 A flowchart illustrating a method for filing WAPI terminal information is provided for some embodiments of this application. The method for filing WAPI terminal information may include: S210, Read the device information of the WAPI terminal; wherein, the device information includes device identifier, processor serial number or trusted boot metric.

[0040] For example, in a specific embodiment of this application, data collection is triggered on the WAPI terminal 100 to be registered via an out-of-seat channel or a temporary management session. Specifically, device information is collected: the unique ID of the WAPI terminal's security chip (as a specific example of a device identifier), processor serial number, trusted boot metric, and other immutable hardware and software information are read. It is understood that the content of the device information can be flexibly adjusted, and this embodiment of the application does not impose specific limitations on it.

[0041] S220, Collect network environment information of the WAPI terminal; wherein, the network environment information includes wireless access point authorization information authorized to connect to the WAPI terminal and environmental wireless access information of the set area.

[0042] For example, in a specific embodiment of this application, the network environment information includes core AP information (as a specific example of wireless access point authorization information) and enhanced environment fingerprint (as a specific example of environmental wireless access information). The core AP information includes the SSID (Service Set Identifier) ​​and MAC address of the authorized AP connected to the WAPI terminal. The enhanced environment fingerprint is obtained by the terminal performing a full-channel depth scan, capturing the SSIDs and corresponding Received Signal Strength Indicator (RSSI) values ​​of all surrounding APs it can detect at that fixed physical location, forming a unique "wireless environment spectrum snapshot" for that location. The aforementioned designated area is the area of ​​surrounding APs that the terminal can detect at that fixed physical location.

[0043] S230, calculate the reference composite fingerprint based on the device information and the network environment information.

[0044] For example, in a specific embodiment of this application, the terminal encodes the device information and network environment information in a pre-defined format, calculates their cryptographic hash value (e.g., Chinese national cryptographic standard SM3), and generates a baseline composite fingerprint of the baseline device-network environment.

[0045] S240, the reference composite fingerprint, the wireless access point authorization information, and the environmental wireless access information are sent to the certificate issuing server. The reference composite fingerprint, the wireless access point authorization information, and the environmental wireless access information are used to generate the local filing information.

[0046] For example, in a specific embodiment of this application, the original list of SSIDs and signal strength benchmark data of surrounding APs (as a specific example of environmental wireless access information), along with the benchmark composite fingerprint and core AP information, are uploaded to the CIS. The CIS creates or updates a complete benchmark record for the terminal in its trusted registration database, which must fully store: device identifier, benchmark composite fingerprint, authorized AP information (i.e., core AP information), and the original benchmark list of surrounding APs (i.e., the list of SSIDs and signal strength benchmark data of surrounding APs). This record serves as the authoritative benchmark for all subsequent online certificate applications and updates for the terminal.

[0047] After completing the registration of the WAPI terminal mentioned above, the following example illustrates the implementation process of certificate issuance or renewal.

[0048] The following is in conjunction with the appendix Figure 3 The present application provides an exemplary embodiment of the implementation process of WAPI terminal certificate management performed by WAPI terminal 100.

[0049] Please see the appendix Figure 3 , Figure 3 This application provides a flowchart of a WAPI terminal certificate management method according to some embodiments. This WAPI terminal certificate management method is triggered during the online certificate application or certificate renewal phase. Therefore, before executing the WAPI terminal certificate management method, the method may include: when determining that the WAPI terminal is in the certificate application or certificate renewal phase, collecting network environment characteristics in real time. The network environment characteristics include the service set identifier of the wireless access point associated with the WAPI terminal and the wireless access list within a defined area; For example, in a specific embodiment of this application, when a WAPI terminal first accesses the network (certificate application stage) or when an existing certificate is about to expire or a policy update is required (certificate update stage), the WAPI terminal collects the network environment characteristics of its current location in real time. These network environment characteristics include the SSID of the AP currently associated with the WAPI terminal, and a list of surrounding APs obtained through real-time scanning (the AP list includes SSID and RSSI, as a specific example of a wireless access list).

[0050] Specifically, in some embodiments of this application, the method for WAPI terminal certificate management may include: S310, Based on the real-time collected network environment characteristics and the device characteristics of the WAPI terminal, a real-time composite fingerprint is generated; wherein, the device characteristics include the device identifier, processor serial number or trusted boot metric of the WAPI terminal.

[0051] For example, the same cryptographic hash algorithm used to generate the baseline composite fingerprint is employed (see...). Figure 2 The illustrated embodiment calculates real-time composite fingerprints by combining network environment features and device features collected in real time. The device features are the device information of the WAPI terminal.

[0052] S320, Generate a certificate management request; wherein, the certificate management request is a certificate application request or a certificate update request; the certificate management request carries the real-time composite fingerprint, the device identifier, the network environment characteristics, and the certificate public key.

[0053] For example, in a specific embodiment of this application, the constructed certificate management request carries the certificate public key, device identifier, real-time composite fingerprint, and real-time AP list (SSID and RSSI) data (i.e., network environment characteristics).

[0054] S330, the certificate management request is sent to the certificate issuing server. The certificate management request is verified by the certificate issuing server through local filing information to determine whether to issue or renew a certificate for the WAPI terminal. The local filing information includes the WAPI terminal's baseline composite fingerprint, wireless access point authorization information, and environmental wireless access information.

[0055] For example, in a specific embodiment of this application, the WAPI terminal sends the certificate management request constructed above to the CIS.

[0056] The following is in conjunction with the appendix Figure 4 The present application provides an exemplary embodiment of the implementation process of WAPI terminal certificate management performed by a certificate issuing server 200.

[0057] Please see the appendix Figure 4 , Figure 4 A flowchart illustrating a method for WAPI terminal certificate management is provided for some embodiments of this application. The method for WAPI terminal certificate management may include: S410 receives certificate management requests sent by the WAPI terminal.

[0058] For example, in a specific embodiment of this application, the unified management engine of CIS receives a certificate management request sent by a WAPI terminal.

[0059] S420, the certificate management request is verified using local filing information to determine whether a certificate is to be issued or updated for the WAPI terminal; wherein, the local filing information includes the WAPI terminal's baseline composite fingerprint, wireless access point authorization information, and environmental wireless access information.

[0060] For example, in a specific embodiment of this application, the CIS can first verify the basic format of the certificate management request, and then extract the device identifier, real-time composite fingerprint, and real-time AP list data carried in it. Then, using... Figure 2 The method implementation uses the local filing information obtained to perform three-layer verification on the content extracted from the certificate management request to determine whether to issue or update a certificate. Specifically, it retrieves a baseline record (i.e., local filing information) from the CIS's trusted filing database based on the device identifier.

[0061] In some embodiments of this application, S420 may include: S421, compare the device feature value in the baseline composite fingerprint with the device feature value to be verified in the real-time composite fingerprint to obtain the identity verification result.

[0062] For example, in a specific embodiment of this application, the hash value of the device feature to be verified in the real-time composite fingerprint (as a specific example of the device feature value to be verified) is compared with the hash value of the device feature in the baseline composite fingerprint record (as a specific example of the device feature value). If they match, the identity verification result is passed; if they do not match, the identity verification result is failed, and the identity is determined to be forged, the process terminates and an alarm is issued. It should be understood that in addition to using a hash algorithm to calculate the device feature value, other similar algorithms can also be used, and the embodiments of this application are not limited to this.

[0063] S422, compare the wireless access point authorization information with the service set identifier to obtain the access point verification result.

[0064] For example, in a specific embodiment of this application, if the SSID of the real-time associated AP of the WAPI terminal is consistent with the SSID of the authorized AP in the local filing information (i.e., the wireless access point authorization information), the access point verification result is passed; otherwise, it is failed.

[0065] S423, compare the environmental wireless access information with the wireless access list to obtain an environmental similarity value.

[0066] For example, in a specific embodiment of this application, the CIS invokes the similarity calculation engine to perform a quantitative comparison between the real-time AP list data and the original surrounding AP list (i.e., environmental wireless access information) of the benchmark, and calculates an environmental similarity score (as a specific example of an environmental similarity value). This step aims to perform a fast and effective quantitative comparison between the real-time AP list data submitted by the WAPI terminal and the original surrounding AP list of the benchmark stored in the trusted filing database, and output an environmental similarity score ranging from 0% to 100%.

[0067] Specifically, S423 may include: obtaining a first number of wireless access points that exist simultaneously in the environmental wireless access information and the wireless access list and whose signal strength difference is not greater than a tolerance threshold; obtaining a second number of wireless access points that exist simultaneously in the environmental wireless access information and the wireless access list and whose signal strength difference is greater than the tolerance threshold; obtaining a third number of wireless access points that exist only in the environmental wireless access information or only in the wireless access list; and calculating the environmental similarity value based on the first number, the second number, and the third number.

[0068] For example, in a specific embodiment of this application, the original list of surrounding APs is denoted as B, and the real-time AP list data is denoted as R. For each AP appearing in B or R, it is classified according to its appearance in the two lists and the difference in signal strength.

[0069] Specifically, the SSID of the statistical AP exists in both B and R, and the signal strength difference |RSSI B RSSI R Number of APs ≤ 5dBm C full (i.e., the first quantity), this part is called a perfect match. Here, 5dBm is the tolerance threshold, which can be flexibly configured, and the embodiments of this application are not limited to this.

[0070] The SSID of the statistical AP exists in both B and R, but its signal strength difference |RSSI B RSSI R Number of APs > 5dBm C partial (i.e., the second quantity), this part is called partial matching.

[0071] Count the number of APs whose SSID exists in B but not in R, and the number of APs whose SSID exists in R but not in B, C. miss (i.e., the third quantity), this part is called the mismatch point.

[0072] Next, a specific score is assigned to each matching condition; for example, a perfect match receives score 'a', a partial match receives score 'b', and a mismatch receives score 'c'. The scores of all APs are summed, divided by the total number of APs, and then converted to a percentage to obtain the final environment similarity score S. The specific formula for calculating S is as follows: S=(C full ×a+C partial ×b+C miss ×c)÷(C full +C partial +C miss )×100% Among them, a, b, and c can be dynamically adjusted according to the actual situation, for example, a=1.0, b=0.5, c=0.0.

[0073] It is understood that, in addition to the above calculation method, S can also be calculated directly by weighted summation or by solving for the mean and variance. The embodiments of this application are not limited to this.

[0074] S424, determine whether to issue or update a certificate for the WAPI terminal based on the identity verification result, the access point verification result, and the environment similarity value.

[0075] For example, in a specific embodiment of this application, by analyzing the three types of verification results obtained above, it is determined whether a certificate is ultimately issued or renewed for the WAPI terminal.

[0076] Specifically, S424 can include the following situations: The first method: If both the identity verification result and the access point verification result are passed, and the environment similarity value is greater than the first threshold, then the WAPI terminal is confirmed to have issued or updated a certificate.

[0077] For example, if the first threshold is 90%, and the device verification is successful (i.e., the identity verification result is successful), the core AP is matched (i.e., the access point verification result is successful), and the environment similarity score is >90%, the certificate management request is automatically forwarded to the CIS dual-cryptography operation module for certificate issuance or update and then securely distributed.

[0078] For certificate issuance requests, CIS uses the corresponding root certificate private key (signing services are provided by the CIS secure storage unit in a hardware-encrypted environment) to sign the certificate request. For certificate renewal requests, the old certificate can be revoked and a new certificate can be issued. The newly issued or renewed certificate is delivered to the WAPI terminal through a secure channel to complete the process.

[0079] The second approach is to verify the WAPI terminal again if both the identity verification result and the access point verification result are passed, and the environment similarity value is greater than the second threshold but not greater than the first threshold, in order to determine whether to issue or update the certificate for the WAPI terminal.

[0080] For example, if the second threshold is 70%, and the device verification passes and the core AP matches, but the environmental similarity score is in the medium-risk range (i.e., 70% < environmental similarity score ≤ 90%), CIS can require the terminal to re-collect and submit the real-time composite fingerprint within a short period of time, or send a lightweight secondary authentication challenge to re-verify the terminal. The specific verification process can be described in the method embodiment provided above, and will not be repeated here.

[0081] The third option is: if the identity verification result is passed, the access point verification result is failed, or the environment similarity value is not greater than the second threshold, then the application is transferred to the manual review queue, so that the administrator can decide whether to issue or update the certificate for the WAPI terminal.

[0082] For example, if the device verification passes, but the core AP does not match (i.e., the access point verification result is unsuccessful) or the environment similarity score is ≤70%, the certificate management request is marked as high-risk and transferred to the manual review queue. A security report containing detailed difference analysis is automatically generated for the administrator to make a decision on whether to issue or renew the certificate.

[0083] Fourth: If the identity verification result is unsuccessful, then the issuance or renewal of the certificate for the WAPI terminal will be refused.

[0084] For example, if device verification fails (i.e., identity verification fails), the certificate management request is directly rejected and recorded as a security event, stored in the log, or the relevant administrator is notified.

[0085] It is understood that the values ​​of the first threshold and the second threshold can be adjusted within the range of 0 to 100% according to the actual situation, and the embodiments of this application do not make specific limitations here.

[0086] In some embodiments of this application, the certificate management request is verified using local filing information to determine whether it is for updating the certificate of the WAPI terminal. This includes: if the number of successful certificate updates by the WAPI terminal is greater than a threshold, and if it is confirmed that the network environment characteristics match the environment fingerprint data, then the certificate of the WAPI terminal is updated; wherein, the environment fingerprint data is the network environment characteristics at the time of the last successful certificate update.

[0087] For example, in a specific embodiment of this application, when the WAPI is in the certificate update phase and the certificate management request is a certificate update request, a baseline dynamic update strategy based on historical trajectories can be adopted. Specifically, for cases where a certificate has been successfully updated multiple times (i.e., the number of successful certificate updates exceeds a threshold), the network environment characteristics can be used as the basis for determining whether to update the certificate. Alternatively, in addition to considering cases where a certificate has been successfully updated multiple times, other factors can be combined to confirm whether to update the certificate. For example, for terminals where a certificate has been successfully updated multiple times and the environment similarity shows a slow, consistent trend (i.e., the change range of the environment similarity score is relatively flat during multiple successful updates, without large fluctuations, and the change range is within a preset range), the CIS can, with administrator authorization, automatically and smoothly update the baseline environment characteristics (i.e., wireless access point authorization information and environmental wireless access information) in its trusted filing database using the network environment characteristics of the most recently successfully verified network environment, in order to adapt to the legitimate and natural evolution of the network environment. During verification, CIS can retrieve the most recent environmental fingerprint data (i.e., the network environment characteristics when the certificate was last successfully updated) from the terminal's past successful updates, and check whether the current real-time network environment characteristics match it. If they match, the certificate is updated; otherwise, the update is rejected, thereby increasing the continuity verification in the time dimension.

[0088] As can be seen from the above embodiments of this application, compared with existing WAPI certificate management technologies, this invention, by introducing a "device feature-network environment composite fingerprint" mechanism, firstly achieves a leap from "single-point static" to "two-factor dynamic" in terms of security defense. Existing technologies only verify easily forged device identifiers (such as MAC addresses), while this invention forcibly verifies the cryptographic characteristics of the terminal hardware and the wireless environment characteristics of its deployment location. This forces attackers not only to clone the device identifier but also to accurately replicate the unique radio spectrum environment of the target terminal's physical location (including the signal characteristics of the authorized AP and multiple surrounding APs), which is almost impossible in practice, fundamentally eliminating device cloning and AP spoofing attacks. Secondly, in terms of verification logic, it achieves an evolution from "binary judgment" to "intelligent quantitative evaluation." Existing technologies use simple "match / mismatch" judgments, which have poor fault tolerance. This invention uses a layered verification strategy: first, a rapid comparison is performed using composite fingerprints, and then a similarity quantification score is performed based on the original environmental data. This enables the system to intelligently distinguish between "legitimate network environment shifts" (such as adding an AP) and "malicious environment forgery," significantly reducing false alarm rates caused by minor, legitimate environmental changes while ensuring extremely high security, thus improving system availability and adaptability. Finally, it extends the security lifecycle from "single entry point check" to "continuous verification throughout the entire lifecycle." This mechanism is equally applied to the certificate application and renewal process. Each certificate renewal is a reconfirmation of the continuous compliance of the device's location, forming continuous monitoring of the terminal access environment. This changes the static trust model of "one-time authorization, permanent validity" in existing technologies, constructing a dynamic and continuous trust assessment system, significantly enhancing the overall security depth of the WAPI network.

[0089] Please refer to Figure 5 , Figure 5 The diagram illustrates a block diagram of a WAPI terminal certificate management apparatus provided in some embodiments of this application. It should be understood that this WAPI terminal certificate management apparatus corresponds to the method embodiments described above and is capable of performing the various steps involved in the method embodiments. The specific functions of this WAPI terminal certificate management apparatus can be found in the description above; detailed descriptions are omitted here to avoid repetition.

[0090] Figure 5The WAPI terminal certificate management device includes at least one software function module that can be stored in memory or embedded in the WAPI terminal certificate management device in the form of software or firmware. The WAPI terminal certificate management device includes: a fingerprint generation module 510, used to generate a real-time composite fingerprint based on real-time collected network environment characteristics and WAPI terminal device characteristics; wherein, the network environment characteristics include the service set identifier of the wireless access point associated with the WAPI terminal and the wireless access list within a defined area; the device characteristics include the device identifier, processor serial number, or trusted boot metric of the WAPI terminal; The generation module 520 is used to generate a certificate management request; wherein the certificate management request is a certificate application request or a certificate update request; the certificate management request carries the real-time composite fingerprint, the device identifier, the network environment characteristics, and the certificate public key; the sending module 530 is used to send the certificate management request to the certificate issuing server, wherein the certificate management request is verified by the certificate issuing server through local filing information to determine whether it is for issuing or updating a certificate for the WAPI terminal; wherein the local filing information includes the WAPI terminal's baseline composite fingerprint, wireless access point authorization information, and environmental wireless access information.

[0091] Please refer to Figure 6 , Figure 6 The diagram illustrates a block diagram of a WAPI terminal certificate management apparatus provided in some embodiments of this application. It should be understood that this WAPI terminal certificate management apparatus corresponds to the method embodiments described above and is capable of performing the various steps involved in the method embodiments. The specific functions of this WAPI terminal certificate management apparatus can be found in the description above; detailed descriptions are omitted here to avoid repetition.

[0092] Figure 6The WAPI terminal certificate management device includes at least one software function module that can be stored in a memory or embedded in the WAPI terminal certificate management device in the form of software or firmware. The WAPI terminal certificate management device includes: a receiving module 610, used to receive a certificate management request sent by a WAPI terminal; wherein the certificate management request is a certificate application request or a certificate update request; the certificate management request carries a real-time composite fingerprint, device identifier, network environment characteristics, and certificate public key; the real-time composite fingerprint is generated based on real-time collected network environment characteristics and device characteristics; the network environment characteristics include the service set identifier of the wireless access point associated with the WAPI terminal and a list of wireless access points within a defined area; the device characteristics include the device identifier, processor serial number, or trusted boot metric of the WAPI terminal; and a verification module 620, used to verify the certificate management request using local registration information to determine whether a certificate is issued or updated for the WAPI terminal; wherein the local registration information includes the baseline composite fingerprint of the WAPI terminal, wireless access point authorization information, and environmental wireless access information.

[0093] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the device described above can be referred to the corresponding process in the aforementioned method, and will not be elaborated further here.

[0094] Some embodiments of this application also provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can perform the operation of any of the methods corresponding to the methods provided in the above embodiments.

[0095] Some embodiments of this application also provide a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operation of any of the methods corresponding to the above embodiments provided in the above embodiments.

[0096] like Figure 7 As shown, some embodiments of this application provide an electronic device 700, which includes a memory 710, a processor 720, and a computer program stored in the memory 710 and executable on the processor 720. When the processor 720 reads the program from the memory 710 via a bus 730 and executes the program, it can implement the methods of any of the above embodiments.

[0097] Processor 720 can process digital signals and can include various computing architectures. For example, it can be a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements multiple instruction set combinations. In some examples, processor 720 can be a microprocessor.

[0098] The memory 710 can be used to store instructions executed by the processor 720 or data related to the execution of instructions. These instructions and / or data may include code for implementing some or all of the functions of one or more modules described in the embodiments of this application. The processor 720 of this disclosure embodiment can be used to execute the instructions in the memory 710 to implement the methods shown above. The memory 710 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memories well known to those skilled in the art.

[0099] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0100] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0101] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A method for WAPI terminal certificate management, characterized in that, include: A real-time composite fingerprint is generated based on the network environment characteristics collected in real time and the device characteristics of the WAPI terminal; wherein, the network environment characteristics include the service set identifier of the wireless access point associated with the WAPI terminal and the wireless access list in the set area; the device characteristics include the device identifier, processor serial number or trusted boot metric of the WAPI terminal; Generate a certificate management request; wherein the certificate management request is a certificate application request or a certificate update request; the certificate management request carries the real-time composite fingerprint, the device identifier, the network environment characteristics, and the certificate public key; The certificate management request is sent to the certificate issuing server, which verifies the request using local filing information to determine whether to issue or renew a certificate for the WAPI terminal. The local filing information includes the WAPI terminal's baseline composite fingerprint, wireless access point authorization information, and environmental wireless access information.

2. The method of claim 1, wherein, Before generating the real-time composite fingerprint based on the real-time collected network environment features and the device features of the WAPI terminal, the method further includes: When it is determined that the WAPI terminal is in the certificate application stage or the certificate renewal stage, the network environment characteristics are collected in real time.

3. The method of claim 1 or 2, wherein, When the WAPI terminal is placed in an authorized location, before generating the real-time composite fingerprint based on the real-time collected network environment features and the WAPI terminal's device features, the method further includes: Read the device information of the WAPI terminal; wherein, the device information includes device identifier, processor serial number or trusted boot metric; Collect network environment information of the WAPI terminal; wherein, the network environment information includes wireless access point authorization information authorized to connect to the WAPI terminal and environmental wireless access information of the set area; The baseline composite fingerprint is generated by calculating the device information and the network environment information. The reference composite fingerprint, the wireless access point authorization information, and the environmental wireless access information are sent to the certificate issuing server. The reference composite fingerprint, the wireless access point authorization information, and the environmental wireless access information are used to generate the local filing information.

4. A method for WAPI terminal certificate management, characterized in that, include: The system receives a certificate management request sent by a WAPI terminal; wherein the certificate management request is a certificate application request or a certificate update request; the certificate management request carries a real-time composite fingerprint, a device identifier, network environment characteristics, and a certificate public key; the real-time composite fingerprint is generated based on real-time collected network environment characteristics and device characteristics; the network environment characteristics include the service set identifier of the wireless access point associated with the WAPI terminal and the wireless access list within a defined area; the device characteristics include the device identifier, processor serial number, or trusted boot metric of the WAPI terminal; The certificate management request is verified using local filing information to determine whether a certificate is to be issued or renewed for the WAPI terminal; wherein, the local filing information includes the WAPI terminal's baseline composite fingerprint, wireless access point authorization information, and environmental wireless access information.

5. The method as described in claim 4, characterized in that, The step of verifying the certificate management request using local filing information to determine whether a certificate is issued or renewed for the WAPI terminal includes: The device feature value in the baseline composite fingerprint is compared with the device feature value to be verified in the real-time composite fingerprint to obtain the identity verification result. The wireless access point authorization information is compared with the service set identifier to obtain the access point verification result; The environmental wireless access information is compared with the wireless access list to obtain an environmental similarity value; The identity verification result, the access point verification result, and the environment similarity value are used to determine whether to issue or update a certificate for the WAPI terminal.

6. The method as described in claim 5, characterized in that, The step of determining whether to issue or update a certificate for the WAPI terminal based on the identity verification result, the access point verification result, and the environment similarity value includes: If both the identity verification result and the access point verification result are passed, and the environment similarity value is greater than the first threshold, then the WAPI terminal is confirmed to issue or update a certificate. If both the identity verification result and the access point verification result are passed, and the environment similarity value is greater than the second threshold and not greater than the first threshold, then the WAPI terminal is re-verified to determine whether to issue or update the certificate for the WAPI terminal. If the identity verification result is passed, the access point verification result is failed, or the environment similarity value is not greater than the second threshold, then it will be transferred to the manual review queue, so that the administrator can decide whether to issue or renew the certificate for the WAPI terminal. If the identity verification result is unsuccessful, the issuance or renewal of the certificate for the WAPI terminal will be refused.

7. The method as described in claim 5 or 6, characterized in that, The step of comparing the environmental wireless access information with the wireless access list to obtain an environmental similarity value includes: Obtain a first number of wireless access points that simultaneously exist in the environmental wireless access information and the wireless access list, and whose signal strength difference is not greater than the tolerance threshold. Obtain a second quantity of wireless access points that simultaneously exist in the environmental wireless access information and the wireless access list and whose signal strength difference is greater than the tolerance threshold; Obtain a third quantity value of wireless access points that exist only in the wireless access information of the environment or only in the wireless access list; The environmental similarity value is obtained by calculating the first, second, and third quantity values.

8. The method according to any one of claims 4-6, characterized in that, The certificate management request is verified using local filing information to determine whether to update the certificate for the WAPI terminal, including: If the number of successful certificate updates by the WAPI terminal exceeds a threshold, and if the network environment characteristics are confirmed to match the environment fingerprint data, then the WAPI terminal's certificate is updated; wherein, the environment fingerprint data is the network environment characteristics at the time of the last successful certificate update.

9. A WAPI terminal certificate management system, characterized in that, include: WAPI terminal and certificate issuance server; The WAPI terminal is used to generate a real-time composite fingerprint based on real-time collected network environment characteristics and WAPI terminal device characteristics; wherein, the network environment characteristics include the service set identifier of the wireless access point associated with the WAPI terminal and the wireless access list within a defined area; the device characteristics include the device identifier, processor serial number, or trusted boot metric of the WAPI terminal; generate a certificate management request; wherein, the certificate management request is a certificate application request or a certificate update request; the certificate management request carries the real-time composite fingerprint, the device identifier, the network environment characteristics, and the certificate public key; and send the certificate management request to the certificate issuing server; The certificate issuance server is used to receive the certificate management request; verify the certificate management request using local filing information to determine whether to issue or update a certificate for the WAPI terminal; wherein, the local filing information includes the WAPI terminal's baseline composite fingerprint, wireless access point authorization information, and environmental wireless access information.

10. A device for WAPI terminal certificate management, characterized in that, include: The fingerprint generation module is used to generate a real-time composite fingerprint based on real-time collected network environment features and WAPI terminal device features; wherein, the network environment features include the service set identifier of the wireless access point associated with the WAPI terminal and the wireless access list within a set area; the device features include the device identifier, processor serial number or trusted boot metric of the WAPI terminal; A request generation module is used to generate a certificate management request; wherein the certificate management request is a certificate application request or a certificate update request; the certificate management request carries the real-time composite fingerprint, the device identifier, the network environment characteristics, and the certificate public key; The sending module is used to send the certificate management request to the certificate issuing server. The certificate management request is verified by the certificate issuing server through local filing information to determine whether to issue or renew a certificate for the WAPI terminal. The local filing information includes the WAPI terminal's baseline composite fingerprint, wireless access point authorization information, and environmental wireless access information.

11. A device for WAPI terminal certificate management, characterized in that, include: A receiving module is used to receive a certificate management request sent by a WAPI terminal; wherein the certificate management request is a certificate application request or a certificate update request; the certificate management request carries a real-time composite fingerprint, a device identifier, network environment characteristics, and a certificate public key; the real-time composite fingerprint is generated based on real-time collected network environment characteristics and device characteristics; the network environment characteristics include the service set identifier of the wireless access point associated with the WAPI terminal and a list of wireless access points within a defined area; the device characteristics include the device identifier, processor serial number, or trusted boot metric of the WAPI terminal; The verification module is used to verify the certificate management request using local filing information to determine whether a certificate is issued or updated for the WAPI terminal; wherein, the local filing information includes the WAPI terminal's baseline composite fingerprint, wireless access point authorization information, and environmental wireless access information.

12. An electronic device, characterized in that, The method includes a memory, a processor, and a computer program stored on the memory and running on the processor, wherein the computer program is executed by the processor to perform the method as described in any one of claims 1-3 or 4-8.

Images