Display device, terminal device, and digital certificate update method

Abstract

Some embodiments of this application illustrate a display device, a terminal device, and a digital certificate update method. The method includes: receiving a certificate application request sent by the terminal device; obtaining a device information list, the device information list including a correspondence between device information, an assigned password, and a digital certificate version number; filtering a first password from the device information list, and decrypting first encrypted information based on the first password to obtain the device information of the terminal device; obtaining a first digital certificate version number corresponding to the device information of the terminal device; and sending the digital certificate corresponding to the first digital certificate version number to the terminal device. These embodiments can encrypt and transmit device information based on the password assigned by the display device, ensuring communication security and identity authenticity during the certificate application process. By maintaining the correspondence between device information, the assigned password, and the certificate version number, more accurate digital certificates can be updated for terminal devices without over-the-air (OTA) download functionality.

Description

Technical Field

[0001] This application relates to the field of digital certificate update technology, and in particular to a display device, a terminal device, and a method for updating digital certificates. Background Technology

[0002] With the rapid development of the Internet of Things (IoT) and smart device ecosystem, secure interconnection between devices has become the cornerstone of modern information technology. In this vast interconnected network, ensuring the authenticity of the identities and the confidentiality of data between communicating parties is crucial. Digital certificates, as the core of public key infrastructure, act as digital identity cards for devices. Issued by authoritative institutions, they bind device identities to public keys, providing a solid foundation of trust for mutual authentication and secure communication between devices, and are an indispensable part of building a trusted network environment.

[0003] When establishing a secure connection between a terminal device and a display device, a digital certificate-based authentication mechanism is commonly used. Each terminal device is pre-installed with a unique digital certificate and private key. During the connection process, the terminal presents its certificate to the display device, which verifies the certificate's validity (such as the issuing authority, validity period, and revocation status) to confirm its legitimate identity. Once verification is successful, both parties can establish an encrypted channel for secure communication. This mechanism effectively prevents unauthorized access by devices and ensures basic system security.

[0004] However, the above technologies have significant limitations in practical applications. First, digital certificates have an inherent expiration date; once expired, the device will be refused connection due to authentication failure. Second, if the device's private key is leaked, a malicious third party can impersonate a legitimate device, forcing the manufacturer to revoke the certificate, causing the original legitimate device to also be unable to connect. The most critical problem is that for terminal devices without cloud services or over-the-air update capabilities, once the certificate expires or is revoked, it cannot be updated remotely, causing a large number of devices to collectively become unusable due to certificate issues, resulting in huge economic losses and resource waste. Summary of the Invention

[0005] Some embodiments of this application provide a display device, a terminal device, and a digital certificate update method. Device information is encrypted and transmitted based on a password assigned to the display device, ensuring communication security and identity authenticity during the certificate application process. By maintaining the correspondence between device information, assigned passwords, and certificate version numbers, more accurate digital certificates are updated for terminal devices without over-the-air (OTA) download functionality.

[0006] In a first aspect, some embodiments of this application provide a display device, including: monitor; A communication device configured to communicate with a terminal device; The controller is configured as follows: The terminal device receives a certificate request, which includes first encrypted information. The first encrypted information is obtained by encrypting the device information of the terminal device based on the first password assigned to the terminal device by the display device. In response to a certificate request, a list of device information is obtained, which includes the mapping between device information, assigned password, and digital certificate version number. The first password is selected from the list of device information, and the first encrypted information is decrypted based on the first password to obtain the device information of the terminal device. Retrieve the first digital certificate version number corresponding to the device information of the terminal device from the device information list; Send the digital certificate corresponding to the first digital certificate version number to the terminal device.

[0007] The above technical solution has the following advantages or beneficial effects: By encrypting the transmission of device information based on the first password assigned to the display device, the communication security and identity authenticity during the certificate application process are ensured. By maintaining the correspondence between device information, assigned passwords, and certificate version numbers, accurate matching of certificate versions is achieved, which not only effectively prevents unauthorized devices from accessing the network, but also solves the problem of terminal devices without over-the-air (OTA) download functionality failing due to certificate expiration or revocation, significantly reducing device maintenance costs.

[0008] In some embodiments, the controller performs the action of filtering a first password from a list of device information, which is further configured to: Retrieve all assigned passwords from the device information list; The first encrypted information is decrypted sequentially using the assigned password; The allocation password that successfully decrypts the first encrypted message is determined as the first password.

[0009] The above technical solution has the following advantages or beneficial effects: the terminal device does not need to carry plaintext identification (such as serial number) during transmission, but directly sends encrypted information. The display device infers the terminal's identity by verifying successful decryption, effectively preventing device identification from being eavesdropped on or forged, and enhancing privacy protection and security.

[0010] In some embodiments, the certificate request further includes an encryption password, which is obtained by encrypting a second password using a first password assigned to the terminal device by the display device. The first encryption information is obtained by encrypting the device information of the terminal device using the second password. The controller performs the filtering of the first password from the device information list, and is further configured to: Retrieve all assigned passwords from the device information list; The encrypted password is decrypted sequentially by assigning a password; The allocation password that successfully decrypts the encrypted password is designated as the first password.

[0011] The above technical solution has the following advantages or beneficial effects: by traversing the assigned passwords in the device information list to decrypt the encrypted password to determine the correct first password, automatic identification and authentication of the terminal device's identity is achieved. This method eliminates the need for the terminal device to carry its identity identifier in plaintext in the request, further protecting device privacy. Simultaneously, it enables the display device to flexibly manage multiple terminals. Even if the terminal device itself cannot actively report its assigned password, it can still be accurately identified and the corresponding certificate version obtained, improving system compatibility.

[0012] In some embodiments, the controller performs decryption of the first encrypted information based on the first cryptography to obtain the device information of the terminal device, which is further configured as follows: The second password is obtained by decrypting the encrypted password based on the first password. The device information of the terminal device is obtained by decrypting the first encrypted information using the second password.

[0013] The above technical solution has the following advantages or beneficial effects: The dual encryption structure, which uses a first password to encrypt a second password, and then the second password to further encrypt the device information, effectively enhances the security of data transmission. Even if the first password is intercepted, attackers cannot directly obtain sensitive device information; they must crack the second layer of encryption, significantly raising the attack threshold.

[0014] In some embodiments, the controller retrieves the first digital certificate version number corresponding to the device information of the terminal device from the device information list, which is further configured as follows: Retrieve the target device information corresponding to the first password from the device information list; If the target device information is the same as the terminal device information, then the first digital certificate version number corresponding to the terminal device information is obtained from the device information list.

[0015] The above technical solution has the following advantages or beneficial effects: This solution not only requires the terminal device to hold the correct primary password to prove that it possesses a legitimate key, but also requires that the decrypted target device information must be completely consistent with the device information actually reported by the terminal. This dual verification mechanism effectively prevents the risk of key confusion or malicious theft, ensuring that only legitimate devices with completely matching identities can obtain the corresponding certificate.

[0016] In some embodiments, the controller is further configured to send the first digital certificate corresponding to the digital certificate version number to the terminal device. The digital certificate corresponding to the first digital certificate version number is encrypted based on the first cryptography to obtain the second encrypted information; The second encrypted information is sent to the terminal device so that the terminal device can decrypt the second encrypted information based on the first password to obtain the digital certificate corresponding to the first digital certificate version number.

[0017] The above technical solution has the following advantages or beneficial effects: by encrypting the digital certificate with the agreed first password, it ensures that even if the certificate is maliciously intercepted during transmission, attackers cannot directly read or use the certificate. This can effectively prevent the risk of illegal impersonation caused by certificate leakage and ensure that only legitimate terminal devices holding the corresponding first password can obtain and use the certificate.

[0018] Secondly, some embodiments of this application provide a terminal device, including: The communication module is configured to communicate with the display device; The controller is configured as follows: The device information of the terminal device is encrypted based on the first password assigned to the terminal device by the display device to obtain the first encrypted information; A certificate request is sent to the display device, so that the display device responds to the certificate request, obtains a list of device information, filters out a first password from the list of device information, and decrypts the first encrypted information based on the first password to obtain the device information of the terminal device, and obtains the first digital certificate version number corresponding to the device information of the terminal device from the list of device information; the certificate request includes the first encrypted information, and the device information list includes the correspondence between the device information, the assigned password and the digital certificate version number; Receive the digital certificate corresponding to the first digital certificate version number sent by the display device.

[0019] The above technical solution has the following advantages or beneficial effects: By encrypting the transmission of device information based on the first password assigned to the display device, the communication security and identity authenticity during the certificate application process are ensured. By maintaining the correspondence between device information, assigned passwords, and certificate version numbers, accurate matching of certificate versions is achieved, which not only effectively prevents unauthorized devices from accessing the network, but also solves the problem of terminal devices without over-the-air (OTA) download functionality failing due to certificate expiration or revocation, significantly reducing device maintenance costs.

[0020] In some embodiments, the processing module encrypts the device information of the terminal device based on a first password assigned to the terminal device by the display device, obtaining first encrypted information, which is further configured as follows: Send a connection request to the display device, the connection request including a digital certificate provided by the terminal device; If a verification failure message for the digital certificate provided by the terminal device is received from the server, the device information of the terminal device is encrypted based on the first password assigned to the terminal device by the display device to obtain the first encrypted information.

[0021] The above technical solution has the following advantages or beneficial effects: This solution allows terminal devices to automatically trigger the certificate application process when the connection fails due to the failure of digital certificate verification, without manual intervention. It can effectively solve the problem of device functional failure caused by certificate expiration, ensure that the device can quickly restore its connection capability, and greatly improve the availability and operation and maintenance efficiency of the system.

[0022] Thirdly, some embodiments of this application provide a digital certificate update method, applied to a display device, including: The terminal device receives a certificate request, which includes first encrypted information. The first encrypted information is obtained by encrypting the device information of the terminal device based on the first password assigned to the terminal device by the display device. In response to a certificate request, a list of device information is obtained, which includes the mapping between device information, assigned password, and digital certificate version number. The first password is selected from the list of device information, and the first encrypted information is decrypted based on the first password to obtain the device information of the terminal device. Retrieve the first digital certificate version number corresponding to the device information of the terminal device from the device information list; Send the digital certificate corresponding to the first digital certificate version number to the terminal device.

[0023] The above technical solution has the following advantages or beneficial effects: By encrypting the transmission of device information based on the first password assigned to the display device, the communication security and identity authenticity during the certificate application process are ensured. By maintaining the correspondence between device information, assigned passwords, and certificate version numbers, accurate matching of certificate versions is achieved, which not only effectively prevents unauthorized devices from accessing the network, but also solves the problem of terminal devices without over-the-air (OTA) download functionality failing due to certificate expiration or revocation, significantly reducing device maintenance costs.

[0024] Fourthly, some embodiments of this application provide a digital certificate update method, applied to a terminal device, including: The device information of the terminal device is encrypted based on the first password assigned to the terminal device by the display device to obtain the first encrypted information; A certificate request is sent to the display device, so that the display device responds to the certificate request, obtains a list of device information, filters out a first password from the list of device information, and decrypts the first encrypted information based on the first password to obtain the device information of the terminal device, and obtains the first digital certificate version number corresponding to the device information of the terminal device from the list of device information; the certificate request includes the first encrypted information, and the device information list includes the correspondence between the device information, the assigned password and the digital certificate version number; Receive the digital certificate corresponding to the first digital certificate version number sent by the display device.

[0025] The above technical solution has the following advantages or beneficial effects: By encrypting the transmission of device information based on the first password assigned to the display device, the communication security and identity authenticity during the certificate application process are ensured. By maintaining the correspondence between device information, assigned passwords, and certificate version numbers, accurate matching of certificate versions is achieved, which not only effectively prevents unauthorized devices from accessing the network, but also solves the problem of terminal devices without over-the-air (OTA) download functionality failing due to certificate expiration or revocation, significantly reducing device maintenance costs.

[0026] The technical solution provided in this application embodiment can receive a certificate application request sent by a terminal device. The certificate application request includes first encrypted information, which is obtained by encrypting the terminal device's device information based on a first password assigned to the terminal device by a display device. Then, a device information list is obtained, and the first password is filtered from the device information list. The first encrypted information is then decrypted based on the first password to obtain the terminal device's device information. The device information list includes a correspondence between device information, the assigned password, and the digital certificate version number. Finally, the first digital certificate version number corresponding to the terminal device's device information is obtained from the device information list, and the digital certificate corresponding to the first digital certificate version number is sent to the terminal device. This application embodiment ensures communication security and identity authenticity during the certificate application process by encrypting and transmitting device information based on the first password assigned by the display device. By maintaining the correspondence between device information, the assigned password, and the certificate version number, accurate matching of certificate versions is achieved. This not only effectively prevents unauthorized devices from accessing the device but also solves the problem of terminal devices without over-the-air (OTA) download functionality failing due to certificate expiration or revocation, significantly reducing device maintenance costs. Attached Figure Description

[0027] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0028] Figure 1 This is a schematic diagram illustrating an operational scenario between a display device and a control device provided in some embodiments of this application; Figure 2 This is a schematic diagram of the hardware configuration of a display device provided in some embodiments of this application; Figure 3 This is a schematic diagram of the software configuration of a display device provided in some embodiments of this application; Figure 4 A flowchart illustrating a digital certificate update method provided in some embodiments of this application; Figure 5 A schematic diagram of an MQTT protocol communication architecture provided for some embodiments of this application; Figure 6 A flowchart illustrating a device information encryption method for a terminal device provided in some embodiments of this application; Figure 7 A flowchart illustrating a method for filtering a first password from a device information list, provided for some embodiments of this application; Figure 8 A flowchart illustrating another method for filtering a first password from a device information list, provided for some embodiments of this application; Figure 9 A timing diagram illustrating a digital certificate update method provided in some embodiments of this application; Figure 10 A timing diagram of another digital certificate update method provided in some embodiments of this application. Detailed Implementation

[0029] The embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described below do not represent all embodiments consistent with this application. They are merely examples of systems and methods consistent with some aspects of this application as detailed in the claims.

[0030] In this application embodiment, display device 200 generally refers to a device with screen display and data processing capabilities. For example, display device 200 includes, but is not limited to, smart TVs, mobile terminals, computers, monitors, advertising screens, wearable devices, virtual reality devices, augmented reality devices, etc.

[0031] Figure 1 This is a schematic diagram illustrating an operational scenario between a display device and a control device provided in some embodiments of this application. For example... Figure 1 As shown, users can operate the display device 200 via touch operation, mobile terminal 300, and control device 100. For example, control device 100 can be a remote control, stylus, gamepad, etc.

[0032] The mobile terminal 300 can function as a control device for human-computer interaction between the user and the display device 200. It can also function as a communication device for establishing a communication connection with the display device 200 and exchanging data. In some embodiments, the mobile terminal 300 can have software applications installed on it and communicate with the display device 200 via network communication protocols to achieve one-to-one control and data communication. Furthermore, it can transmit audio and video content displayed on the mobile terminal 300 to the display device 200 for synchronized display.

[0033] like Figure 1 The diagram also shows that the display device 200 communicates with the server 400 via various communication methods. This allows the display device 200 to communicate via a local area network (LAN), a wireless local area network (WLAN), and other networks.

[0034] Display device 200 can provide broadcast television reception function, and can also be equipped with intelligent network television function that provides computer support, including but not limited to network television, smart television and Internet Protocol television.

[0035] like Figure 1 The diagram also shows that the terminal device 500 can communicate with the display device 200. The terminal device 500 can be a control device. After establishing a connection with devices such as the display device 200, the terminal device 500 can receive user-input control commands and send these commands to the display device 200 through the established communication connection, causing the display device 200 to execute the corresponding operation, thereby achieving the purpose of controlling the display device 200 through the terminal device 500. The terminal device 500 does not have over-the-air (OTA) upgrade capability. The display device 200 does have OTA upgrade capability.

[0036] In some embodiments, the terminal device 500 and the display device 200 can establish a communication connection via Message Queuing Telemetry Transport (MQTT). MQTT is a lightweight message transmission protocol based on a publish / subscribe model, designed for environments with limited computing resources, limited bandwidth, and unstable networks. It features low message overhead, low power consumption, and reliable transmission.

[0037] Figure 2 Provided for some embodiments of this application Figure 1 Hardware configuration block diagram of display device 200.

[0038] In some embodiments, the display device 200 may include at least one of a tuner 210, a communication device 220, a detector 230, a device interface 240, a controller 250, a display 260, an audio output device 270, a memory, a power supply, and a user input interface 280.

[0039] In some embodiments, detector 230 is used to acquire signals from the external environment or to interact with the outside world. For example, detector 230 includes a light receiver, a sensor for acquiring ambient light intensity; or, detector 230 includes an image acquisition device, such as a camera, which can be used to acquire external environmental scenes, user attributes, or user interaction gestures; or, detector 230 includes a sound acquisition device, such as a microphone, for receiving external sounds.

[0040] In some embodiments, the display 260 includes display function components for presenting images and driving components for driving image display. The display 260 is used to receive and display image signals output from the controller 250. For example, the display 260 can be used to display video content, image content, menu control interface components, and user control UI interfaces, etc.

[0041] In some embodiments, the communication device 220 is a component used to communicate with external devices or the server 400 according to various communication protocol types. The display device 200 may have multiple communication devices 220 depending on the supported communication methods. For example, when the display device 200 supports wireless network communication, the communication device 220 may include a WiFi module. When the display device 200 supports Bluetooth connection communication, the communication device 220 may include a Bluetooth module.

[0042] The communication device 220 enables the display device 200 to communicate with external devices or the server 400 via wireless or wired connections. Wired connections utilize data cables, interfaces, or other components to connect the display device 200 to external devices. Wireless connections utilize wireless signals or wireless networks. The display device 200 can directly establish a connection with external devices or indirectly through gateways, routers, or other connection devices.

[0043] In some embodiments, the controller 250 may include at least one of a central processing unit, a video processor, an audio processor, a graphics processor, and a power processor, and a first to an nth interface for input / output. The controller 250 controls the operation of the display device and responds to user operations through various software control programs stored in memory. The controller 250 controls the overall operation of the display device 200.

[0044] In some embodiments, the controller 250 and the tuner 210 may be located in different separate devices, that is, the tuner 210 may also be located in an external device of the main device where the controller 250 is located, such as an external set-top box.

[0045] In some embodiments, a user can input user commands through a graphical user interface (GUI) displayed on a display 260, and the user input interface receives user input commands through the graphical user interface (GUI).

[0046] In some embodiments, the audio output device 270 can be a built-in speaker of the display device 200 or an external audio output device connected to the display device 200. For the external audio output device connected to the display device 200, the display device 200 may also be provided with an external audio output terminal, through which the audio output device can be connected to the display device 200 to output sound from the display device 200.

[0047] In some embodiments, the user input interface 280 can be used to receive instructions from user input. For example, the user input interface 280 can receive text information entered by the user in the user interface. The user input interface 280 can also receive confirmation instructions from the user regarding controls in the user interface. The user input interface 280 can also receive voice instructions entered by the user.

[0048] In some embodiments, to enable user interaction, the display device 200 may run an operating system. An operating system is a computer program that manages and controls the hardware and software resources of the display device 200. The operating system can control the display device to provide a user interface; for example, the operating system can directly control the display device to provide a user interface, or it can provide a user interface by running applications. The operating system also allows users to interact with the display device 200.

[0049] It should be noted that the operating system can be a native operating system based on a specific operating platform, a third-party operating system that is deeply customized based on a specific operating platform, or an independent operating system specifically developed for display devices.

[0050] like Figure 3 As shown, the display device system is divided into three layers, from top to bottom: the application layer, the middleware layer, and the hardware layer.

[0051] The application layer mainly includes commonly used applications on TV, as well as the application framework. The commonly used applications are mainly browser-based applications, such as HTML5 apps, and native apps.

[0052] An application framework is a complete program model that has all the basic functions required by standard application software, such as file access, data exchange, etc., as well as the user interface for these functions (toolbar, status bar, menu, dialog box).

[0053] Native apps can support online or offline access, push notifications, or access to local resources.

[0054] The middleware layer includes various television protocols, multimedia protocols, and system components. Middleware can use the basic services (functions) provided by system software to connect different parts of application systems or different applications on the network, achieving resource sharing and function sharing.

[0055] The hardware layer mainly includes the HAL interface, hardware, and drivers. The HAL interface is a unified interface for all TV chips, with the specific logic implemented by each chip. The drivers mainly include: audio drivers, display drivers, Bluetooth drivers, camera drivers, Wi-Fi drivers, USB drivers, HDMI drivers, sensor drivers (such as fingerprint sensors, temperature sensors, pressure sensors, etc.), and power drivers.

[0056] It should be noted that the above examples are merely a simple division of operating system functions and do not limit the specific form of the operating system of the display device 200 in this application embodiment. Depending on the function of the display device, the type of operating system, and other factors, the number of levels and the specific level type of the operating system may be expressed in other forms.

[0057] With the rapid development of the Internet of Things (IoT) and smart device ecosystem, secure interconnection between devices has become the cornerstone of modern information technology. In this vast interconnected network, ensuring the authenticity of the identities and the confidentiality of data between communicating parties is crucial. Digital certificates, as the core of public key infrastructure, act as digital identity cards for devices. Issued by authoritative institutions, they bind device identities to public keys, providing a solid foundation of trust for mutual authentication and secure communication between devices, and are an indispensable part of building a trusted network environment.

[0058] When establishing a secure connection between a terminal device and a display device, a digital certificate-based authentication mechanism is commonly used. Each terminal device is pre-installed with a unique digital certificate and private key. During the connection process, the terminal presents its certificate to the display device, which verifies the certificate's validity (such as the issuing authority, validity period, and revocation status) to confirm its legitimate identity. Once verification is successful, both parties can establish an encrypted channel for secure communication. This mechanism effectively prevents unauthorized access by devices and ensures basic system security. The terminal device can be configured as a secondary device, and the display device can be configured as the primary device.

[0059] However, the above technologies have significant limitations in practical applications. First, digital certificates have an inherent expiration date; once expired, the device will be refused connection due to authentication failure. Second, if the device's private key is leaked, a malicious third party can impersonate a legitimate device, forcing the manufacturer to revoke the certificate, causing the original legitimate device to also be unable to connect. The most critical problem is that for terminal devices without cloud services or over-the-air update capabilities, once the certificate expires or is revoked, it cannot be updated remotely, causing a large number of devices to collectively become unusable due to certificate issues, resulting in huge economic losses and resource waste.

[0060] To address the issue of terminal devices lacking over-the-air (OTA) download functionality failing due to expired or revoked certificates, this application provides a display device 200. The structure and functions of each part of the display device 200 can be found in the above embodiments. Furthermore, based on the display device 200 shown in the above embodiments, this embodiment further improves some functions of the display device 200. For example… Figure 4 As shown, controller 250 is configured to perform the following steps: Step S401: Receive a certificate request sent by the terminal device.

[0061] The certificate request includes first encrypted information, which is obtained by encrypting the device information of the terminal device 500 based on the first password assigned to the terminal device 500 by the display device 200.

[0062] It should be noted that in this embodiment, the terminal device 500 and the display device 200 can establish a communication connection via MQTT. MQTT is an information communication and device control protocol widely used in the Internet of Things (IoT) field, and its core is a publish / subscribe mechanism. Figure 5As shown, in an MQTT-based IoT network, each device is a client, while server 400 runs an MQTT broker, i.e., the MQTT server. Some devices (publishers) publish various messages to the MQTT broker, and other devices (subscribers) can subscribe to messages they are interested in. When the MQTT broker receives a message, it distributes the subscribed messages to the corresponding subscribers. Display device 200 and terminal device 500 can each run their own broker clients.

[0063] In the MQTT protocol, when display device 200 and terminal device 500 connect to the Broker, for security reasons, a Transport Layer Security (TLS) protocol is generally required. This means the connection is established through a first port, which requires both display device 200 and terminal device 500 to possess a series of digital certificates to verify their legitimacy. These digital certificates include the Root Certificate Authority (ROOT CA) certificate, and the first port can be a TLS port. Display device 200 and terminal device 500 can provide their digital certificates to server 400 for verification. Display device 200 and terminal device 500 can encrypt communication data using private key files or passwords. MQTT also specifies a second port, on which communication does not require a digital certificate. This second port can be an anonymous communication port.

[0064] In some embodiments, after receiving a user's input instruction to apply for a certificate, the terminal device 500 sends a certificate application request to the display device 200 through the second port. It should be noted that as long as both the display device 200 and the terminal device 500 are running the Broker client, they can establish a communication connection through the second port and transmit data. The display device 200 can process certificate application requests sent through the second port, but it does not process connection requests sent through the second port.

[0065] In some embodiments, terminal device 500 can send a connection request to display device 200 through a first port. The connection request includes a digital certificate provided by terminal device 500. The broker of server 400 first receives the connection request and then verifies the digital certificate provided by terminal device 500. If the verification of the digital certificate provided by terminal device 500 is successful, the connection request is sent to display device 200 to establish a communication connection between display device 200 and terminal device 500 on the first port. If the verification of the digital certificate provided by terminal device 500 fails, a verification failure message is sent to terminal device 500. After receiving the verification failure message, terminal device 500 can send a certificate request to display device 200 through a second port. The reason for the digital certificate verification failure is that the digital certificate provided by terminal device 500 has expired or been revoked, and terminal device 500 does not have the ability to obtain the latest certificate from server 400, causing the functionality of terminal device 500 to fail.

[0066] In some embodiments, after receiving a user input instruction to apply for a certificate or a verification failure message, the terminal device 500 can encrypt the device information of the terminal device 500 based on the first password assigned to the terminal device 500 by the display device 200 to obtain the first encrypted information.

[0067] The terminal device manufacturer and the display device manufacturer can communicate and determine the initial password in advance. The terminal device 500 can store this initial password in its memory. The device information of the terminal device 500 includes the manufacturer's name, the device name generated by the manufacturer, and the client software version number, etc.

[0068] The first password can be a pair of keys. The terminal device 500 can store the private key in memory, and the display device 200 can store the public key corresponding to the private key of the terminal device in memory.

[0069] In some embodiments, encrypting the device information of the terminal device based on a first password assigned to the terminal device by the display device to obtain first encrypted information may include: directly encrypting the device information of the terminal device 500 using the first password to obtain the first encrypted information. The first password may be a private key.

[0070] In some embodiments, such as Figure 6 As shown, one implementation method for encrypting the device information of the terminal device based on the first password assigned to the terminal device by the display device to obtain the first encrypted information may include the following steps: Step S601: Randomly generate a second password.

[0071] Step S602: Encrypt the device information of the terminal device using the second password to obtain the first encrypted information.

[0072] Step S603: Encrypt the second password using the first password assigned to the terminal device by the display device to obtain the encrypted password.

[0073] The first password can be a private key. In addition to the first encrypted information, the certificate request in this embodiment also includes an encryption password.

[0074] In some embodiments, after receiving a user's input instruction to apply for a certificate or a verification failure message, the terminal device 500 may further encrypt the device information of the terminal device 500 and the version number of the second digital certificate currently used by the terminal device 500 based on the first password assigned to the terminal device 500 by the display device 200, to obtain first encrypted information. This encryption method is the same as the method for encrypting the device information of the terminal device 500 described above, and will not be repeated here.

[0075] In this embodiment, when the terminal device 500 receives a connection failure message, it can parse the error message to determine that the connection failure is due to a TLS verification failure. It will automatically encrypt its vendor name, the device name generated by the vendor, the client software version number, and the digital certificate version number using a built-in first password. Then, it connects to the second port and sends a certificate request. The certificate request can be in the topic: client / request / cert / clientID, and the first encrypted information is placed in the payload of this topic. The client identifier (clientId) in this topic is the clientId used by the terminal device 500 when connecting to the Broker in the display device 200. Each terminal device connecting to the MQTTBroker has a unique clientId.

[0076] Step S402: In response to the certificate request, obtain a list of device information.

[0077] After receiving a certificate request from a terminal device, a device information list can be obtained. This list includes device information, assigned passwords, and the corresponding digital certificate version numbers. Display device 200 has the ability to obtain the latest digital certificate from server 400.

[0078] Display device 200 can have a built-in device information list and periodically update this list from server 400. The device information list includes information about terminal devices currently supported by display device 200. This information includes the manufacturer's name, the device name generated by the manufacturer, and the client software version number for each terminal device. The list also includes an allocation password assigned by the display device to each terminal device. Each terminal device corresponds to a different allocation password, which can be a public key. Finally, the list includes a digital certificate version number. There is a corresponding relationship between the device information, the allocation password, and the digital certificate version number.

[0079] For example, the device information list can be shown in Table 1.

[0080] Table 1

[0081] Step S403: Select the first password from the device information list, and decrypt the first encrypted information based on the first password to obtain the device information of the terminal device.

[0082] In some embodiments, such as Figure 7 As shown, if the encryption method is to directly encrypt the device information of the terminal device using a first password, then one implementation method for filtering the first password from the device information list may include the following steps: Step S701: Obtain all assigned passwords from the device information list.

[0083] Step S702: Decrypt the first encrypted information sequentially using the assigned password.

[0084] Step S703: Determine the allocation password that successfully decrypts the first encrypted information as the first password.

[0085] The assigned password can be a public key. By iterating through all public keys in the device information list, the first encrypted information can be decrypted sequentially using each public key. If decryption of the first encrypted information using a public key fails, the next public key is used. If decryption of the first encrypted information using a public key is successful, it is determined that the terminal device is supported by this display device, the decryption process stops, and the public key used to successfully decrypt the first encrypted information is designated as the terminal device's public key. If decryption of the first encrypted information using all public keys fails, it is determined that the terminal device is not supported by this display device, and the certificate request for that terminal device is not processed.

[0086] In some embodiments, if the device information of the terminal device is directly encrypted using the first password, the first encrypted information can be directly decrypted using the first password to obtain the device information of the terminal device.

[0087] In some embodiments, such as Figure 8 As shown, if the encryption method involves encrypting the device information of the terminal device using a second password and encrypting the second password using a first password, then one implementation method for filtering the first password from the device information list may include the following steps: Step S801: Obtain all assigned passwords from the device information list.

[0088] Step S802: Decrypt the encrypted password sequentially using the assigned password.

[0089] Step S803: Determine the allocation password that successfully decrypts the encrypted password as the first password.

[0090] The assigned password can be a public key. The system iterates through all public keys in the device information list, allowing each public key to be used to decrypt the encrypted password. If decryption with a public key fails, the system continues using the next public key. If decryption with a public key is successful, the system determines that the terminal device is supported by this display device, stops the decryption process, and designates the public key that successfully decrypted the encrypted password as the terminal device's public key. If decryption with all public keys fails, the system determines that the terminal device is not supported by this display device, and the certificate request for that terminal device is not processed.

[0091] In some embodiments, if the device information of the terminal device is encrypted using a second password and the second password is encrypted using a first password, then the device information of the terminal device is obtained by decrypting the first encrypted information using the first password. One implementation may include: decrypting the encryption password using the first password to obtain the second password, and then decrypting the first encrypted information using the second password to obtain the device information of the terminal device.

[0092] In some embodiments, by decrypting the first encrypted information based on the first password, the version number of the second digital certificate currently used by the terminal device can also be obtained.

[0093] Step S404: Obtain the first digital certificate version number corresponding to the device information of the terminal device from the device information list.

[0094] In some embodiments, after decrypting the first encrypted information based on the first password to obtain the device information of the terminal device, the first digital certificate version number corresponding to the device information of the terminal device can be obtained from the device information list.

[0095] For example, the first digital certificate version number corresponding to the first password or the device information of the terminal device (manufacturer name, device name generated by the manufacturer, and client software version number) can be directly obtained from the device information list.

[0096] In some embodiments, after decrypting the first encrypted information based on the first password to obtain the device information of the terminal device, the target device information corresponding to the first password can be obtained from the device information list first, and then it can be determined whether the target device information is the same as the device information of the terminal device. If the target device information is the same as the device information of the terminal device, the first digital certificate version number corresponding to the device information of the terminal device is obtained from the device information list. If the target device information is different from the device information of the terminal device, an error message is sent to the terminal device. The error message is used to indicate that the device information does not match, resulting in the inability to obtain a digital certificate.

[0097] For example, the target device information corresponding to the first password, namely the first manufacturer name, the first device name, and the first client software version number, can be directly obtained from the device information list. The terminal device's device information, namely the second manufacturer name, the second device name, and the second client software version number, is obtained through decryption. If the first manufacturer name and the second manufacturer name are the same, the first device name and the second device name are the same, and the first client software version number is the same, then the first digital certificate version number corresponding to the first password, the target device information, or the terminal device's device information can be obtained from the device information list. If the first manufacturer name and the second manufacturer name are different, the first device name and the second device name are different, or the first client software version number and the second client software version number are different, then an error message is sent to the terminal device.

[0098] This application not only requires the terminal device to possess the correct first password to prove it has a legitimate key, but also requires that the decrypted target device information must be completely consistent with the device information actually reported by the terminal. This dual verification mechanism effectively prevents the risk of key confusion or malicious theft, ensuring that only legitimate devices with completely matching identities can obtain the corresponding digital certificate.

[0099] Step S405: Send the digital certificate corresponding to the first digital certificate version number to the terminal device.

[0100] In some embodiments, after obtaining the first digital certificate version number corresponding to the device information of the terminal device from the device information list, the digital certificate corresponding to the first digital certificate version number can be directly sent to the terminal device.

[0101] In some embodiments, if the first digital certificate version number corresponding to the device information of the terminal device is obtained from the device information list, and the second digital certificate version number currently used by the terminal device is also obtained after decrypting the first encrypted information, it can be determined whether the first digital certificate version number is greater than the second digital certificate version number. If the first digital certificate version number is greater than the second digital certificate version number, the digital certificate corresponding to the first digital certificate version number is sent to the terminal device. If the first digital certificate version number is less than or equal to the second digital certificate version number, a message indicating that the certificate has not been updated is sent to the terminal device.

[0102] The display device 200 stores digital certificates corresponding to multiple digital certificate version numbers in the device information list, and the corresponding digital certificate can be found by searching for the digital certificate version number.

[0103] In some embodiments, one implementation of sending the digital certificate corresponding to the first digital certificate version number to the terminal device may include: encrypting the digital certificate corresponding to the first digital certificate version number based on a first password to obtain second encrypted information, and then sending the second encrypted information to the terminal device 500 so that the terminal device 500 decrypts the second encrypted information based on the first password to obtain the digital certificate corresponding to the first digital certificate version number.

[0104] In some embodiments, the display device 200 can directly use the first password to encrypt the digital certificate to obtain the second encrypted information, and then send the second encrypted information to the terminal device 500 so that the terminal device 500 can directly use the first password to decrypt the second encrypted information to obtain the digital certificate.

[0105] In some embodiments, one implementation of sending the digital certificate corresponding to the first digital certificate version number to the terminal device may include: randomly generating a third password, then encrypting the digital certificate corresponding to the first digital certificate version number using the third password to obtain second encrypted information, and then encrypting the third password using the first password to obtain an encrypted third password. The second encrypted information and the encrypted third password are then sent to the terminal device 500. The terminal device 500 decrypts the encrypted third password using the first password to obtain the third password, and then decrypts the second encrypted information using the third password to obtain the digital certificate corresponding to the first digital certificate version number.

[0106] In this embodiment of the application, the display device 200 can send feedback data through the second port. The feedback data can be topic: server / response / cert / clientId. At the same time, the digital certificate content is encrypted with the assigned password of the terminal device and put into the payload, and finally sent to the terminal device.

[0107] After receiving the new digital certificate, the terminal device updates its own certificate, upgrades its digital certificate version number, and then reconnects to the original communication port, i.e., the first port. Terminal device 500 can then send a connection request to display device 200 through the first port, including the latest digital certificate provided by terminal device 500. After the broker on server 400 successfully verifies the digital certificate provided by terminal device 500, it can send a connection request to display device 200, thus establishing a communication connection between display device 200 and terminal device 500 on the first port.

[0108] In some embodiments, the timing diagram of the digital certificate update method can be as follows: Figure 9 As shown. Display device 200 can periodically update the device information list and the digital certificates corresponding to the digital certificate version numbers in the list, and send the updated digital certificates to the server (MQTT Broker) in server 400. The MQTT Broker stores the digital certificates in the database of server 400. Terminal device 500 connects to the first port and sends a connection request carrying an outdated digital certificate to the MQTT Broker. If the MQTT Broker fails to verify the outdated digital certificate, it can send a digital certificate verification failure message to terminal device 500. Terminal device 500 uses the first password assigned to the display device to encrypt its device information, obtaining first encrypted information, and then connects to the second port and sends a certificate request carrying the first encrypted information to the MQTT Broker, which forwards it to display device 200.

[0109] After receiving a certificate request, display device 200 iterates through the device information list, decrypts the first encrypted information using the assigned password, and determines the assigned password that successfully decrypts the first encrypted information as the first password. It then decrypts the first encrypted information using the first password to obtain the device information of the terminal device. If the device information of the terminal device matches the target device information corresponding to the first password, it obtains the first digital certificate version number corresponding to the device information of the terminal device. It then encrypts the digital certificate corresponding to the first digital certificate version number using the first password to obtain the second encrypted information, and finally sends the second encrypted information to terminal device 500 via the MQTT Broker.

[0110] Terminal device 500 decrypts the second encrypted information using the first password to obtain the digital certificate, and then updates the digital certificate and upgrades its version number. Terminal device 500 connects to the first port and sends a connection request carrying the updated digital certificate. After the MQTT Broker successfully verifies the updated digital certificate, it can send a connection request to display device 200 to establish a communication connection between terminal device 500 and display device 200.

[0111] In some embodiments, the timing diagram of the digital certificate update method can be as follows: Figure 10 As shown. Display device 200 can periodically update the device information list and the digital certificates corresponding to the digital certificate version numbers in the list, and send the updated digital certificates to the server (MQTT Broker) in server 400. The MQTT Broker stores the digital certificates in the database of server 400. Terminal device 500 connects to the first port and sends a connection request carrying an outdated digital certificate. After the MQTT Broker fails to verify the outdated digital certificate, it sends a digital certificate verification failure message to terminal device 500. Terminal device 500 generates a first random password and uses the first random password to encrypt the device information of the terminal device to obtain the first encrypted information. Then, it uses the private key assigned by the display device to encrypt the first random password to obtain the first encrypted password. It then connects to the second port and sends a certificate request carrying the first encrypted information and the first encrypted password to the MQTT Broker, which forwards it to display device 200.

[0112] Display device 200 iterates through the device information list, sequentially decrypting the first encrypted password using the public keys of different devices to determine the public key of the successfully decrypted first encrypted password, and then using the public key to decrypt the first encrypted password to obtain a first random password. The first random password is then used to decrypt the first encrypted information to obtain the device information of the terminal device. If the device information of the terminal device matches the target device information corresponding to the public key, the first digital certificate version number corresponding to the device information of the terminal device is obtained. Display device 200 generates a second random password, uses the second random password to encrypt the digital certificate corresponding to the first digital certificate version number to obtain second encrypted information, and then uses the public key to encrypt the second random password to obtain a second encrypted password. The second encrypted information and the second encrypted password are then sent to terminal device 500 via MQTT Broker.

[0113] Terminal device 500 decrypts the second encryption key using its private key to obtain a second random key. It then uses this second random key to decrypt the second encrypted information, obtaining a digital certificate. Finally, it updates the digital certificate and upgrades its version number. Terminal device 500 connects to the first port and sends a connection request carrying the updated digital certificate. After the MQTT Broker successfully verifies the updated digital certificate, it can send a connection request to display device 200 to establish a communication connection between terminal device 500 and display device 200.

[0114] In this embodiment, the display device is powerful, featuring over-the-air (OTA) upgrade capabilities. It can connect to a server to update data, and the display device 200 can update and store digital certificates. Terminal devices lacking upgrade capabilities can connect to a port on an upgrade-capable display device that does not require a digital certificate, directly establishing a connection. The new digital certificate is then updated to the terminal device through this port, thus achieving the purpose of upgrading the digital certificate of the terminal device lacking upgrade capabilities. The terminal device can then continue to use the new digital certificate to connect to the display device.

[0115] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A display device, characterized in that, include: monitor; A communication device configured to communicate with a terminal device; The controller is configured as follows: The terminal device receives a certificate request, which includes first encrypted information. The first encrypted information is obtained by encrypting the device information of the terminal device based on a first password assigned to the terminal device by the display device. In response to the certificate application request, a device information list is obtained, which includes the correspondence between device information, assigned password, and digital certificate version number; The device information of the terminal device is obtained by filtering the first password from the device information list and decrypting the first encrypted information based on the first password. Obtain the first digital certificate version number corresponding to the device information of the terminal device from the device information list; Send the digital certificate corresponding to the first digital certificate version number to the terminal device.

2. The display device according to claim 1, characterized in that, The controller is further configured to filter the first password from the device information list. Retrieve all assigned passwords from the device information list; The first encrypted information is decrypted sequentially using the assigned password; The allocation password that successfully decrypts the first encrypted information is determined as the first password.

3. The display device according to claim 1, characterized in that, The certificate request also includes an encryption password, which is obtained by encrypting a second password using a first password assigned to the terminal device by the display device. The first encryption information is obtained by encrypting the device information of the terminal device using the second password. The controller is further configured to filter the first password from the device information list. Retrieve all assigned passwords from the device information list; The encrypted password is decrypted sequentially using the assigned password; The allocation password that successfully decrypts the encrypted password is determined as the first password.

4. The display device according to claim 3, characterized in that, The controller decrypts the first encrypted information based on the first password to obtain the device information of the terminal device, which is further configured as follows: The second password is obtained by decrypting the encrypted password based on the first password. The device information of the terminal device is obtained by decrypting the first encrypted information using the second password.

5. The display device according to claim 1, characterized in that, The controller retrieves the first digital certificate version number corresponding to the device information of the terminal device from the device information list, and is further configured to: Retrieve the target device information corresponding to the first password from the device information list; If the target device information is the same as the terminal device information, then the first digital certificate version number corresponding to the terminal device information is obtained from the device information list.

6. The display device according to claim 1, characterized in that, The controller is further configured to send the digital certificate corresponding to the first digital certificate version number to the terminal device. The digital certificate corresponding to the first digital certificate version number is encrypted based on the first password to obtain the second encrypted information; The second encrypted information is sent to the terminal device so that the terminal device can decrypt the second encrypted information based on the first password to obtain the digital certificate corresponding to the first digital certificate version number.

7. A terminal device, characterized in that, include: The communication module is configured to communicate with the display device; The processing module is configured as follows: The device information of the terminal device is encrypted based on the first password assigned to the terminal device by the display device to obtain the first encrypted information; Send a certificate request to the display device so that the display device responds to the certificate request, obtains a list of device information, filters out the first password from the list of device information, and decrypts the first encrypted information based on the first password to obtain the device information of the terminal device, and obtains the first digital certificate version number corresponding to the device information of the terminal device from the list of device information; The certificate application request includes first encrypted information, and the device information list includes the correspondence between device information, assigned password, and digital certificate version number; Receive the digital certificate corresponding to the first digital certificate version number sent by the display device.

8. The terminal device according to claim 7, characterized in that, The processing module encrypts the device information of the terminal device based on the first password assigned to the terminal device by the display device, obtaining first encrypted information, which is further configured as follows: Send a connection request to the display device, the connection request including a digital certificate provided by the terminal device; If a verification failure message for the digital certificate provided by the terminal device is received from the server, the device information of the terminal device is encrypted based on the first password assigned to the terminal device by the display device to obtain the first encrypted information.

9. A digital certificate update method, applied to a display device, characterized in that, include: The terminal device receives a certificate request, which includes first encrypted information. The first encrypted information is obtained by encrypting the device information of the terminal device based on a first password assigned to the terminal device by the display device. In response to the certificate application request, a device information list is obtained, which includes the correspondence between device information, assigned password, and digital certificate version number; The device information of the terminal device is obtained by filtering the first password from the device information list and decrypting the first encrypted information based on the first password. Obtain the first digital certificate version number corresponding to the device information of the terminal device from the device information list; Send the digital certificate corresponding to the first digital certificate version number to the terminal device.

10. A digital certificate update method, applied to a terminal device, characterized in that, include: The device information of the terminal device is encrypted based on the first password assigned to the terminal device by the display device to obtain the first encrypted information; Send a certificate request to the display device so that the display device responds to the certificate request, obtains a list of device information, filters out the first password from the list of device information, and decrypts the first encrypted information based on the first password to obtain the device information of the terminal device, and obtains the first digital certificate version number corresponding to the device information of the terminal device from the list of device information; The certificate application request includes first encrypted information, and the device information list includes the correspondence between device information, assigned password, and digital certificate version number; Receive the digital certificate corresponding to the first digital certificate version number sent by the display device.

Images