COMMUNICATION METHOD AND COMMUNICATION DEVICE

Abstract

The present application provides a communication method and a communication apparatus. The method includes the steps of receiving a first message from a first device, the first message including a certificate request file, and the certificate request file is used to apply for a digital certificate of the AAU, sending a second message to a certification authority (CA) server based on the first message, the second message including the certificate request file, receiving a digital certificate from the CA server, and sending the digital certificate to the AAU. In the present application, the second device (e.g., BBU) acts as a proxy for the first device (e.g., AAU) to apply for a digital certificate from the CA server, so that the digital certificate can be renewed or managed.

Description

[Technical field]

[0001] This application claims priority to Chinese Patent Application No. 202111639208.4, entitled "Communication Method and Communication Apparatus," filed with the State Intellectual Property Office of the People's Republic of China on December 29, 2021, which is incorporated herein by reference in its entirety.

[0002] The present application relates to the field of communications technology, and in particular to a communication method and device. [Background technology]

[0003] A digital certificate is a file that is digitally signed by a certificate authority (CA) server and contains information about the owner and the public key. The CA server is a trusted and impartial third party. Thus, the devices in the communication system are applied with digital certificates, which allows the devices to establish a secure transmission channel and perform identity authentication based on the certificate issued by the CA server. In a new radio (NR) system, a base station includes a first device and a second device. For example, the first device is an active antenna unit (AAU) and the second device is a base band unit (BBU). The AAU and the BBU communicate with each other through the enhanced common public radio interface (eCPRI), so the AAU and the BBU need to use digital certificates to implement secure eCPRI communication. However, since there is no direct channel between the AAU and the CA server, the AAU cannot update or manage the digital certificate. Summary of the Invention [Means for solving the problem]

[0004] The present application provides a communication method and device for updating or managing digital certificates.

[0005] According to a first aspect, the present application provides a communication method, applicable to a second device, the method comprising: receiving a first message from a first device, the first message including a certificate request file, the certificate request file being used to apply for a digital certificate for the first device; sending a second message to a certificate authority CA server based on the first message, the second message including a certificate request file; receiving a digital certificate from a CA server; sending a digital certificate to the first device; Includes.

[0006] In the present application, the AAU does not need to establish a transmission network with the CA server, but applies for a digital certificate from the CA server through a first device (e.g., a BBU) on behalf of a second device (e.g., an AAU), so that the digital certificate can be updated or managed.

[0007] In one possible implementation, the step of sending a second message to the CA server based on the first message includes: sending a third message to the first device, the third message including a certificate request file; receiving first signature data corresponding to a third message from the first device; sending a second message to the CA server, the second message including the first signature data and the third message; Includes.

[0008] In the present application, an asynchronous remote signature method, specifically, a method in which a second device sends data to be signed (e.g., a third message) to a first device and receives signature data (e.g., the first signature data) fed back by the first device, can ensure the security of the proxy process and ensure that the AAU's private key is not transferred over the network and is not leaked.

[0009] In one possible implementation, the step of receiving a digital certificate from a CA server includes: receiving a first response from the CA server for the second message, the first response including the digital certificate; Includes.

[0010] In one possible implementation, the first response carries first response signature data, and the step of sending the digital certificate to the first device includes: a step of checking the first response based on the signature data of the first response and sending a first confirmation response information to the CA server based on the checking result; receiving second acknowledgment information from the CA server for the first acknowledgment information; sending a digital certificate to the first device in response to the second acknowledgement information; Includes.

[0011] In one possible implementation, the step of sending first confirmation response information to the CA server based on a check result of checking the first response based on the signature data of the first response includes: sending first acknowledgement information to the first device if the check result is that the check is successful; receiving second signature data corresponding to the first acknowledgement information from the first device; sending the first confirmation response information and the second signature data to the CA server; Includes.

[0012] In the present application, an asynchronous remote signature method, specifically, a method in which a second device sends data to be signed (e.g., first acknowledgement information) to a first device and receives signature data (e.g., second signature data) fed back by the first device, can ensure the security of the proxy process and ensure that the private key of the AAU is not transferred over the network and is not leaked.

[0013] According to a second aspect, the present application provides a communication method, applicable to a first device, the method comprising: sending a first message to a second device, the first message including a certificate request file, the certificate request file being used to apply for a digital certificate for the first device; receiving a digital certificate from a second device; Includes.

[0014] In one possible implementation, the method comprises: receiving a third message from the second device, the third message including a certificate request file; sending the first signature data corresponding to the third message to the second device; Further includes:

[0015] In one possible implementation, the method comprises: receiving first acknowledgment information from a second device; sending second signature data corresponding to the first acknowledgement information to the second device; Further includes:

[0016] According to a third aspect, the present application provides a communication method, which is applicable to a CA server, the method comprising: receiving a second message from the second device, the second message including a certificate request file, the certificate request file being used to apply for a digital certificate for the first device; sending the digital certificate to the second device; Includes.

[0017] In one possible implementation, the second message includes the first signature data corresponding to a third message and the third message, the third message including the certificate request file.

[0018] In one possible implementation, the step of transmitting the digital certificate to the second device includes: sending a first response to the second message to the second device, the first response including the digital certificate; Includes.

[0019] In one possible implementation, the first response carries first response signature data, and the method further comprises: receiving first acknowledgment information from a second device, the first acknowledgment information being generated based on a check result of checking the first response by the second device based on signature data of the first response; sending second acknowledgment information to the second device in response to the first acknowledgment information; Further includes:

[0020] In one possible implementation, the first acknowledgement information further carries second signature data corresponding to the first acknowledgement information.

[0021] According to a fourth aspect, the present application provides a communication apparatus. The apparatus may be a second device. The apparatus includes: a transceiver unit configured to receive a first message from a first device, the first message including a certificate request file, the certificate request file being used to apply for a digital certificate for the first device; a processing unit configured to send a second message to a certificate authority CA server through the transceiver unit based on the first message, the second message including a certificate request file; Including, the transceiver unit is configured to receive a digital certificate from a CA server; The transceiver unit is configured to transmit the digital certificate to the first device.

[0022] In one possible implementation, the processing unit specifically comprises: sending a third message to the first device through the transceiver unit, the third message including the certificate request file; receiving first signature data corresponding to the third message from the first device through the transceiver unit; sending a second message to the CA server through the transceiver unit, the second message including the first signature data and the third message; It is configured as follows.

[0023] In one possible implementation, the transceiver unit specifically comprises: receiving a first response from the CA server for the second message, the first response including the digital certificate; It is configured as follows.

[0024] In one possible implementation, the first response carries a signature data of the first response, and the transceiver unit specifically: checking the first response based on the signature data of the first response, and transmitting first confirmation response information to the CA server based on the check result; receiving second acknowledgment information from the CA server for the first acknowledgment information; transmitting a digital certificate to the first device in response to the second acknowledgement information; It is configured as follows.

[0025] In one possible implementation, the transceiver unit specifically comprises: If the check result is that the check is successful, sending a first acknowledgement information to the first device; receiving second signature data corresponding to the first acknowledgement information from the first device; sending the first confirmation response information and the second signature data to the CA server; It is configured as follows.

[0026] According to a fifth aspect, the present application provides a communication apparatus. The apparatus may be a first device. The apparatus includes: a transceiver unit configured to transmit a first message to a second device, the first message including a certificate request file, the certificate request file being used to apply for a digital certificate for the first device; Including, The transceiver unit is configured to receive a digital certificate from a second device.

[0027] In one possible implementation, the transceiver unit is configured to receive a third message from the second device, the third message including a certificate request file; This device is a processing unit configured to transmit the first signature data corresponding to the third message to the second device through the transceiver unit; Further includes:

[0028] In one possible implementation, the transceiver unit specifically comprises: receiving first acknowledgment information from a second device; sending second signature data corresponding to the first acknowledgement information to the second device; It is configured as follows.

[0029] According to a sixth aspect, the present application provides a communication device. The device is a CA server. The device comprises: a transceiver unit configured to receive a second message from a second device, the second message including a certificate request file, the certificate request file being used to apply for a digital certificate for the first device; Including, The transceiver unit is further configured to transmit the digital certificate to the second device.

[0030] In one possible implementation, the second message includes the first signature data corresponding to a third message and the third message, the third message including the certificate request file.

[0031] In one possible implementation, the transceiver unit comprises: sending a first response to the second message to the second device, the first response including the digital certificate; The method is further configured as follows.

[0032] In one possible implementation, the first response carries a signature data of the first response, and the transceiver unit: receiving first acknowledgment information from a second device, the first acknowledgment information being generated based on a check result of checking the first response by the second device based on signature data of the first response; transmitting second acknowledgment information to the second device in response to the first acknowledgment information; The method is further configured as follows.

[0033] In one possible implementation, the first acknowledgement information further carries second signature data corresponding to the first acknowledgement information.

[0034] According to a seventh aspect, the present application provides a communication device. The device may be a second device, a device in a second device, or a device that can be used with a second device. Alternatively, the communication device may be a chip system. The communication device can perform the method according to the first aspect. The functions of the communication device may be realized by hardware, or may be realized by hardware executing corresponding software. The hardware or software includes one or more units or modules corresponding to the aforementioned functions. The units or modules may be software and / or hardware. For the operations performed by the communication device and their beneficial effects, please refer to the method according to the first aspect and their beneficial effects. Repeated parts will not be described again.

[0035] According to an eighth aspect, the present application provides a communication device. The device may be a first device, a device in a first device, or a device that can be used with a first device. Alternatively, the communication device may be a chip system. The communication device can perform the method according to the second aspect. The functions of the communication device may be realized by hardware, or may be realized by hardware executing corresponding software. The hardware or software includes one or more units or modules corresponding to the aforementioned functions. The units or modules may be software and / or hardware. For the operations performed by the communication device and their beneficial effects, please refer to the method according to the second aspect and their beneficial effects. Repeated parts will not be described again.

[0036] According to a ninth aspect, the present application provides a communication device. The device may be a CA server, a device in a CA server, or a device that can be used with a CA server. Alternatively, the communication device may be a chip system. The communication device can perform the method according to the third aspect. The functions of the communication device may be realized by hardware, or may be realized by hardware executing corresponding software. The hardware or software includes one or more units or modules corresponding to the aforementioned functions. The units or modules may be software and / or hardware. For the operations performed by the communication device and their beneficial effects, please refer to the method according to the third aspect and their beneficial effects. Repeated parts will not be described again.

[0037] According to a tenth aspect, the present application provides a communication apparatus, which may be a second device, the communication apparatus including a processor and a transceiver, the processor and the transceiver being configured to execute a computer program or instructions stored in at least one memory to enable the apparatus to perform a method according to any one of the possible implementations of the first aspect.

[0038] According to an eleventh aspect, the present application provides a communication apparatus. The apparatus may be a second device, and the communication apparatus includes a processor, a transceiver, and a memory. The processor, the transceiver, and the memory are coupled together. The processor and the transceiver are configured to execute a method according to any one of the possible implementations of the first aspect.

[0039] According to a twelfth aspect, the present application provides a communication apparatus, which may be a first device, the communication apparatus including a processor and a transceiver, the processor and the transceiver being configured to execute a computer program or instructions stored in at least one memory to enable the apparatus to perform a method according to any one of the possible implementations of the second aspect.

[0040] According to a thirteenth aspect, the present application provides a communication apparatus. The apparatus may be a first device, and the communication apparatus includes a processor, a transceiver, and a memory. The processor, the transceiver, and the memory are coupled together. The processor and the transceiver are configured to execute a method according to any one of the possible implementations of the second aspect.

[0041] According to a fourteenth aspect, the present application provides a communication device, which may be a CA server, comprising a processor and a transceiver, the processor and the transceiver being configured to execute a computer program or instructions stored in at least one memory to enable the device to perform a method according to any one of the possible implementations of the third aspect.

[0042] According to a fifteenth aspect, the present application provides a communication device. The device may be a CA server, and the communication device includes the processor, transceiver, and memory of FIG. 8. The processor, transceiver, and memory are coupled together. The processor and the transceiver are configured to execute a method according to any one of the possible implementations of the third aspect.

[0043] According to a sixteenth aspect, the present application provides a computer readable storage medium, the storage medium storing a computer program or instructions which, when executed by a computer, performs a method according to any one of the first to third aspects.

[0044] According to a seventeenth aspect, the present application provides a computer program product comprising instructions, the computer program product comprising computer program code, which when executed on a computer performs a method according to any one of the first to third aspects. [Brief description of the drawings]

[0045] [Figure 1]1 is a schematic diagram of the network architecture of a 5G system. [Diagram 2] 1 is a schematic diagram of a network architecture between a base station and a CA server. [Diagram 3] FIG. 2 is a diagram of an application scenario of the communication method according to an embodiment of the present application; [Figure 4] 1 is a schematic flowchart of a communication method according to an embodiment of the present application. [Diagram 5] FIG. 2 is a diagram of an integrity protection scenario according to an embodiment of the present application. [Figure 6] 4 is another schematic flowchart of a communication method according to an embodiment of the present application. [Figure 7] 4 is another schematic flowchart of a communication method according to an embodiment of the present application. [Figure 8] FIG. 2 is a diagram of the structure of a communication device according to an embodiment of the present application; [Figure 9] FIG. 2 is a diagram of the structure of another communication device according to an embodiment of the present application. [Figure 10] FIG. 2 is a diagram of the structure of another communication device according to an embodiment of the present application. [Figure 11] FIG. 2 is a diagram of the structure of another communication device according to an embodiment of the present application. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0046] The following clearly and completely describes the technical solutions of the embodiments of the present application with reference to the accompanying drawings of the embodiments of the present application.

[0047] In the description of this application, unless otherwise specified, " / " means "or". For example, A / B can represent A or B. The term "and / or" in this specification describes only the relation between related objects and indicates that three relations may exist. For example, A and / or B can represent the following three cases: when only A exists, when both A and B exist, and when only B exists. In addition, "at least one" means one or more, and "multiple" means two or more. Terms such as "first" and "second" do not limit the quantity or execution order, and terms such as "first" and "second" do not indicate clear differences.

[0048] In this application, terms such as "example" or "for example" are used to denote providing an example, illustration, or explanation. Any embodiment or design manner described in this application as an "example" or "for example" should not be described as preferred or having more advantages than another embodiment or design manner. Strictly speaking, use of terms such as "example" or "for example" is intended to present the relevant concept in a concrete manner.

[0049] The technical solutions of the embodiments of the present application can be applied to various communication systems, such as enhanced-long term evolution (eLTE) systems, 5th generation (5G) systems, and new radio (NR). The 5G mobile communication system in the present application includes a non-standalone (NSA) 5G mobile communication system or a standalone (SA) 5G mobile communication system. The technical solutions provided in the present application can be further applied to future communication systems, such as a 6th generation mobile communication system. Alternatively, the communication system may be a public land mobile network (PLMN), a device-to-device (D2D) communication system, a machine to machine (M2M) communication system, an Internet of Things (IoT) communication system, or another communication system, which is not limited herein.

[0050] For ease of understanding, a 5G system is used as an example for explanation. Figure 1 is a schematic diagram of a network architecture of a 5G system. As shown in Figure 1, the network architecture may include a terminal device, a (radio) access network ((R)AN), a core network (CN), and a data network (DN). The (R)AN (hereinafter referred to as RAN) is configured to connect the terminal device to the radio network, and the CN is configured to provide a gateway for managing the terminal device and communicating with the DN.

[0051] The terminal device may be a device having a wireless transceiver function. The terminal device may have different names, for example, a terminal, a user equipment (UE), an access terminal, a terminal unit, a terminal station, a mobile station, a remote station, a remote terminal, a mobile device, a wireless communication device, a terminal agent, or a terminal device. The terminal device includes an indoor device, an outdoor device, a handheld device, or a vehicle-mounted device, and may be deployed on land, on water (e.g., a ship), or in the air (e.g., on an airplane, a balloon, or a satellite). The terminal device includes a handheld device, a vehicle-mounted device, a wearable device, or a computing device having a wireless communication function. For example, the terminal device may be a mobile phone, a tablet computer, or a computer having a wireless transceiver function. Alternatively, the terminal device may be a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, an industrial control wireless terminal, an autonomous driving wireless terminal, a remote medical wireless terminal, a smart grid wireless terminal, a smart city wireless terminal, a smart home wireless terminal, etc. In the embodiments of the present application, the apparatus configured to realize the function of the terminal device may be a terminal device, or may be an apparatus that can assist the terminal device in realizing the function, such as a chip system. In the embodiments of the present application, the chip system may include a chip, or may include a chip and another discrete device. In the embodiments of the present application, the technical solutions provided in the embodiments of the present application are described using an example in which the apparatus configured to realize the function of the terminal device is a terminal device.

[0052] The access network device may be referred to as a base station. The base station may include various forms of base stations, such as a macro base station, a micro base station (sometimes referred to as a small cell), a relay station, and an access point. In particular, the base station may be an access point (AP) of a wireless local area network (WLAN), a base transceiver station (BTS) of a global system for mobile communications (GSM) or a code division multiple access (CDMA), a Node B (NB) of a wideband code division multiple access (WCDMA), an evolved node B (eNB or eNodeB) of LTE, a relay station, an access point, an in-vehicle device, a wearable device, the next generation node B (gNB) of a future 5G network, a base station of a future evolved public land mobile network (PLMN), etc.

[0053] A base station typically includes a baseband unit (BBU), a remote radio unit (RRU), an antenna, and a feeder used to connect the RRU and the antenna. The BBU is configured to perform signal modulation. The RRU is configured to perform radio frequency processing. The antenna is configured to perform conversion between guided waves on the cable and space waves in the air. On the one hand, the distributed base station greatly shortens the length of the feeder between the RRU and the antenna, which can reduce signal loss and cut the cost of the feeder. On the other hand, the RRU and the antenna are small and can be installed anywhere, making network planning more flexible. The RRU may be located remotely. In addition, all the BBUs may be centralized and located in a central office (CO). In this centralized manner, the number of base station equipment rooms can be greatly reduced, the energy consumption of auxiliary devices, especially air conditioners, can be reduced, and carbon emissions can be greatly reduced. In addition, the distributed BBUs can be managed and scheduled centrally after forming a BBU baseband pool through centralization, making resource allocation more flexible. In this mode, all physical base stations evolve into virtual base stations. All virtual base stations share information such as user data transmission and reception and channel quality in the BBU baseband pool, and cooperate with each other to perform joint scheduling.

[0054] In some deployments, a base station may include a centralized unit (CU) and a distributed unit (DU). The base station may further include an active antenna unit (AAU). The CU realizes some functions of the base station, and the DU realizes some functions of the base station. For example, the CU is responsible for processing non-real-time protocols and services to realize the functions of the radio resource control (RRC) layer and the packet data convergence protocol (PDCP) layer. The DU is responsible for processing physical layer protocols and real-time services to realize the functions of the radio link control (RLC) layer, the media access control (MAC) layer, and the physical (PHY) layer. The AAU realizes some physical layer processing functions, radio frequency processing, and functions related to active antennas. The information of the RRC layer is eventually converted to or from the information of the PHY layer. Therefore, in this architecture, higher layer signaling, such as RRC layer signaling or PDCP layer signaling, may also be considered as being transmitted by the DU, or by the DU and AAU. In the embodiment of the present application, it is understood that the access network device may be a device including any one or more of a CU node, a DU node, and an AAU node. In addition, the CU may be classified as a network device in the RAN, or the CU may be classified as a network device in the core network (CN). This is not limited in this document.

[0055] The core network device is configured to realize functions such as mobility management, data processing, session management, policy, and charging. The names of devices that realize the core network functions in different access technology systems may be different. This is not limited in this application. Take the 5G network as an example. The logical network elements of the 5GC include an access and mobility management function (AMF) network element, a session management function (SMF) network element, a user plane function (UPF) network element, a policy control function (PCF) network element, a unified data management (UDM) network element, an application function (AF) network element, etc.

[0056] A DN, sometimes called a packet data network (PDN), is a network located outside an operator network. An operator network can access multiple DNs. To provide multiple possible services for terminal devices, a DN may be equipped with application servers corresponding to multiple services.

[0057] In Figure 1, Npcf, Nudm, Naf, Namf, Nsmf, N1, N2, N3, N4, and N6 are interface sequence numbers. For the meaning of these interface sequence numbers, please refer to the meaning defined in the relevant standard protocol, which is not limited in this document.

[0058] It should be noted that in the following embodiments of the present application, the first device may be understood as a network element having the function of an active antenna unit (AAU) or a radio unit (RU), and the second device may be understood as a network element having the function of a base band unit (BBU). Alternatively, these network elements may be called by other names. This is not limited in this document. For ease of understanding, an example in which the first device is an AAU and the second device is a BBU is used to describe the following embodiments of the present application.

[0059] In the following, relevant technical features in the embodiments of the present application are explained and described. Please note that these explanations are intended to facilitate the understanding of the embodiments of the present application, and should not be considered as limitations on the scope of protection claimed in the present application.

[0060] 1. Digital Certificates A digital certificate is a data structure signed by a certificate authority (CA) server, and includes information about the public key owner, the public key, information about the issuer, a validity period, and extended information. Digital certificates are widely used to ensure confidentiality of data transmission, integrity of data exchange, non-repudiation of information transmission, and certainty of the identity of data exchange subjects. The digital certificate of the AAU in the embodiment of this application is a digital certificate in the AAU used to establish a secure channel between the AAU and the BBU.

[0061] 2. Public and Private Keys In asymmetric encryption technology, there are two types of keys: private and public. The private key is kept by the key pair owner and cannot be made public. The public key is made public by the key pair holder to other people. Typically, the public key is used to encrypt data and the private key is used to decrypt data encrypted by the public key.

[0062] 3. Digest A hash (HASH) calculation is performed on the text that needs to be sent to obtain a digest corresponding to that text.

[0063] 4. Signature A signature is sometimes called signed data or a digital signature. Usually, a private key is used to encrypt a digest of the text that needs to be transmitted, and the resulting ciphertext is called the signature of the current transmission process.

[0064] 5. Integrity protection / checking Integrity protection / checking is used to determine whether the contents of a message have been altered in the process of transmission, and may also be used for identity verification to determine the origin of a message. In particular, the data receiver needs to receive the transmitted text and determine whether the text is the content sent by the data sender, in other words, whether the text has been tampered with in the process of transmission. Therefore, the data receiver needs to decrypt the signature based on the public key to obtain the digest of the text, then calculate the digest value using the same HASH algorithm used by the sender, and compare the digest value with the digest of the decrypted text. If the digest value and the digest of the decrypted text match exactly, it means that the text has not been tampered with.

[0065] It should be noted that since an Ethernet link is used between the AAU and the BBU, the AAU and the BBU need to use certificates to implement secure eCPRI communication. However, since there is no direct channel between the AAU and the CA server, the AAU cannot update or manage the certificates. For example, FIG. 2 is a schematic diagram of a network architecture between a base station and a CA server. As shown in FIG. 2, in a 5G communication system, a base station includes an AAU and a BBU. The interface between the BBU and the AAU is called a fronthaul interface, which can be, for example, a common public radio interface (CPRI) or an enhanced common public radio interface (eCPRI). The interface between the BBU and the CA server is called a backhaul interface. Since there is no direct channel between the AAU and the CA server, the AAU cannot apply / renew the CA server's certificate online.

[0066] In consideration of this, an embodiment of the present application provides a communication method for implementing online renewal / management of digital certificates.

[0067] For example, Figure 3 is a diagram of an application scenario of a communication method according to an embodiment of the present application. As shown in Figure 3, in order to prevent security attacks on the eCRPI channel between the AAU and the BBU, in this embodiment of the present application, transport layer security technology is used to implement transport layer security protection between the BBU and the AAU. In other words, the data transmission between the AAU and the BBU can be implemented using TLS technology, or the data transmission between the AAU and the BBU is implemented using a TLS channel. The BBU communicates with the CA server using the certificate management protocol version 2 (CMPv2) protocol.

[0068] The communication method and communication device provided in the present application are described in detail below.

[0069] 4 is a schematic flowchart of a communication method according to an embodiment of the present application. As shown in FIG. 4, the communication method includes the following steps S401 to S403.

[0070] S401. The BBU receives a first message from the AAU.

[0071] In some possible implementations, the AAU generates a key pair and a certificate request file required to apply for a digital certificate. Typically, the certificate request file is a data file that includes some information for applying for a certificate to a CA server, and includes information such as the public key information of the AAU, applicant information, and domain name. The information about the public key of the AAU may be the public key of the AAU, the acquisition information of the public key of the AAU, and the like. This is not limited in this document. In other words, the certificate request file may be used to apply for a digital certificate of the AAU. The AAU can send a first message to the BBU, and the first message includes the certificate request file. In response, the BBU receives the first message from the AAU. In addition to the certificate request file, the first message may further include some other data related to the certificate request. For details, please refer to the RFC4211 protocol specification. Details will not be described here.

[0072] It should be noted that the AAU sending the first message to the BBU can be understood as sending the first message to the BBU through a transport layer security (TLS) channel. Correspondingly, the BBU receives the first message from the AAU through the TLS channel. Typically, during the manufacturing of the AAU and the BBU, at least one device manufacturer's certificate can be embedded in each of the AAU and the BBU by the device manufacturer of the AAU and the BBU as an identity certificate of each of the AAU and the BBU. In this embodiment of the present application, the certificate embedded in the AAU by the device manufacturer of the AAU is referred to as an AAU vendor pre-configured certificate or an AAU device certificate. The certificate embedded in the BBU by the device manufacturer of the BBU is referred to as a BBU vendor pre-configured certificate or a BBU device certificate. For ease of explanation, the AAU vendor pre-configured certificate and the BBU vendor pre-configured certificate may be collectively referred to as a vendor pre-configured certificate. Based on the vendor pre-configured certificate, a secure channel (or described as a TLS channel) can be established between the AAU and the BBU. In particular, the AAU device certificate is used to establish a secure channel between the AAU and the BBU. The BBU device certificate is used to establish a secure channel between the AAU and the BBU. In addition, the BBU device certificate can be further used to establish a secure channel to a CA. In this embodiment of the present application, the manner of establishing a secure channel or TLS channel between the AAU and the BBU based on the vendor pre-configured certificate can be based on the manner specified in the TLS1.2 and TLS1.3 protocols. Details will not be described here.

[0073] It is understood that after a secure channel is established between the AAU and the BBU, the AAU can communicate with the BBU through the established secure channel. For example, the AAU sends a first message to the BBU through the established secure channel. The first message includes a certificate request file. It should be noted that the BBU receiving the first message from the AAU is equivalent to the AAU allowing the BBU to act on behalf of the AAU, complete CMPv2 protocol interaction with a CA server to apply for a digital certificate, and transfer the digital certificate obtained by the application to the AAU. For a detailed process, please refer to the following step description.

[0074] S402. The BBU sends a second message to the certificate authority CA server based on the first message.

[0075] In some possible implementations, the BBU sends a second message to a certificate authority (CA) server based on the first message. The second message includes a certificate request file. Specifically, sending the second message to the CA server based on the first message can be understood as the BBU sending a third message to the AAU, where the third message includes a certificate request file, the BBU receiving first signature data corresponding to the third message from the AAU, and the BBU sending a second message to the CA server, where the second message includes the first signature data and the third message. In other words, after the AAU sends the first message including the certificate request file to the BBU, the BBU can generate a third message based on the first message and send the third message to the AAU for signing. Furthermore, the BBU receives the first signature data corresponding to the third message from the AAU, combines the third message and the first signature data to generate a second message, and sends the second message to the CA server. In other words, the BBU can send the third message and the first signature data corresponding to the third message to the CA server.

[0076] Typically, the AAU can sign the third message based on the private key of the AAU, and send the first signature data obtained by signing to the BBU. Furthermore, the BBU sends the signed message (i.e., the second message) to the CA server according to the CMPv2 protocol. The third message can also be understood as a certificate request message, or a certificate management protocol (CMP) initialization request (IR) message. In addition to the certificate request file, the third message can further include other contents. For details, please refer to the specifications of the RFC4211 protocol and the RFC4210 protocol. Details will not be described here.

[0077] The following describes a process in which the AAU signs the third message based on the private key, and the CA server performs an integrity check on the third message based on the third message and the first signature data.

[0078] For example, FIG. 5 is a diagram of an integrity protection scenario according to an embodiment of the present application. Usually, after receiving the third message, the AAU can perform a hash operation on the third message based on a hash algorithm to obtain a corresponding hash value, and then use the private key of the AAU to encrypt the generated hash value to obtain the first signature data. Then, the AAU sends the first signature data to the BBU. After receiving the first signature data from the AAU, the BBU can combine the third message and the first signature data, and send the data obtained by the combination (i.e., the second message) to the CA server. It should be noted that the CA server that receives the second message sent by the BBU first analyzes the received second message to obtain the third message and the first signature data obtained by separation. Then, the first signature data is decrypted based on the public key of the AAU to obtain a decrypted hash value (hereinafter simply referred to as the first hash value) corresponding to the third message. Also, the CA server performs a hash calculation on the content included in the third message obtained by the separation based on a hash algorithm to obtain a hash value (hereinafter simply referred to as the second hash value) corresponding to the third message. Finally, the CA server can obtain the check result of the third message by comparing and analyzing the first hash value and the second hash value. Usually, if the first hash value is equal to the second hash value, the CA server can determine that the third message has not been tampered with during the transmission process. If the first hash value is not equal to the second hash value, the CA server can determine that the third message has been maliciously tampered with during the transmission process. Usually, a CA server that determines that the second message has been tampered with during the transmission process can refuse to issue a digital certificate to the AAU. A CA server that determines that the second message has not been tampered with during the transmission process can feed back a digital certificate corresponding to the AAU to the BBU based on the second message.

[0079] S403. The BBU receives a digital certificate from the CA server.

[0080] In some possible implementations, the BBU receives a digital certificate from the CA server. It can be understood that the BBU receiving the digital certificate from the CA server can be understood as the BBU receiving a first response from the CA server for the second message, where the first response includes the digital certificate. The first response may also be described as a CMP initialization response (IP). In addition to the digital certificate, the first response may further include other contents. For specific contents included in the first response, please refer to the specifications of the RFC4211 and RFC4210 protocols. Details will not be described here.

[0081] Usually, when the CA server sends the first response to the BBU, the CA server can further send the signature data of the first response to the BBU. In other words, the first response can further carry the signature data of the first response, and the CA server sends the first response and the signature data of the first response to the BBU. The signature data of the first response is the signature data obtained by the CA server signing the digest of the first response based on the private key of the CA server.

[0082] S404. The BBU sends the digital certificate to the AAU.

[0083] In some possible implementations, after receiving the digital certificate from the CA server, the BBU can send the received digital certificate to the AAU. In particular, after receiving the first response and the signature data of the first response from the CA server for the second message, the BBU can check the signature data of the first response based on the public key of the CA. If the check result of checking the first response based on the public key of the CA and the signature data of the first response is that the check is successful, the BBU sends the digital certificate to the AAU. Furthermore, if the check result of checking the first response based on the signature data of the first response is that the check is successful, the BBU can send first confirmation response information to the AAU. The first confirmation response information can be understood as a Cert Confirm message of the certificate management protocol version 2 (CMPv2) protocol. After receiving the first confirmation response information, the AAU can sign a digest of the first confirmation response information based on the private key of the AAU to obtain second signature data corresponding to the first confirmation response information, and send the second signature data to the BBU. Correspondingly, the BBU can send the first acknowledgement information and the second signature data to the CA server after receiving the second signature data from the AAU. After the signature verification performed by the CA server on the first acknowledgement information based on the second signature data is successful, the CA server can feed back the second acknowledgement information to the BBU. The second acknowledgement information may be a public key infrastructure (PKI) Confirm message of the CMPv2 protocol, and can be specifically understood as the acknowledgement information fed back by the CA server after the CA server successfully receives the first acknowledgement information. For the specific content included in the second acknowledgement information, please refer to the specifications of the RFC4211 protocol and the RFC4210 protocol. Details will not be described here.

[0084] For example, FIG. 6 is another schematic flow chart of a communication method according to an embodiment of the present application. The method includes the following steps: S601. The BBU receives a first message from the AAU. The first message includes a certificate request file. S602. The BBU sends a third message to the AAU. Typically, the BBU can generate a third message based on the certificate request file in the first message, and send the third message to the AAU for signing. S603. The BBU receives first signature data corresponding to the third message from the AAU. The AAU can sign a digest of the third message based on the private key of the AAU to generate first signature data, and feed back the first signature data to the BBU. S604. The BBU sends a second message to the CA server. After receiving the first signature data, the BBU can combine the third message and the first signature data, and send the second message obtained by the combination to the CA server. In other words, the second message includes the third message and the first signature data. S605. Receive a first response from the CA server for the second message. The first response includes a digital certificate issued by the CA server to the AAU. Typically, after the CA server receives the second message and the integrity check performed on the third message using the first signature data is successful, the CA server can send the first response to the BBU. The first response includes a digital certificate issued by the CA server to the AAU. Typically, the first response further carries signature data obtained by signing a digest of the first response by the CA server based on the private key of the CA server. That is, the first response carries signature data corresponding to the first response. S606. The BBU sends the digital certificate to the AAU. After the BBU receives the first response and the integrity check performed on the first response using the signature data of the first response is successful, the BBU can send the digital certificate included in the first response to the AAU. S607: The BBU sends the first acknowledgement information to the AAU. The BBU sends the first acknowledgement information to the AAU, which needs to be signed by the AAU.S608. The BBU receives second signature data for the first acknowledgement information from the AAU. The AAU can feed back the obtained second signature data to the BBU after signing the digest of the first acknowledgement information based on the private key of the AAU. S609. The BBU sends the first acknowledgement information and the second signature data to the CA server. The BBU can combine the first acknowledgement information and the second signature data and then send the combined information to the CA server. S610. The BBU receives the second acknowledgement information from the CA server. After the integrity check performed on the first acknowledgement information based on the second signature data is successful, the CA server can return the second acknowledgement information to the BBU. Typically, the second acknowledgement information can carry signature data obtained by signing the digest of the second acknowledgement information by the CA server based on the private key of the CA server.

[0085] Optionally, in some possible implementations, the BBU sending the digital certificate to the AAU can be further understood as sending the digital certificate to the AAU in response to the second acknowledgement information. In other words, after receiving the digital certificate from the CA server, the BBU can further send the first acknowledgement information to the AAU when the checking result of checking the first response based on the signature data of the first response is that the checking is successful. The first acknowledgement information can be understood as a Cert Confirm message of the CMPv2 protocol. After receiving the first acknowledgement information, the AAU can sign a digest of the first acknowledgement information based on the private key of the AAU to obtain second signature data corresponding to the first acknowledgement information, and send the second signature data to the BBU. Correspondingly, after receiving the second signature data from the AAU, the BBU can send the first acknowledgement information and the second signature data to the CA server. After the signature verification performed by the CA server on the first acknowledgement information based on the second signature data is successful, the CA server can feed back the second acknowledgement information to the BBU. The second acknowledgement information can be understood as a PKI Confirm message of the CMPv2 protocol. After the BBU receives the second acknowledgement information from the CA server for the first acknowledgement information, it sends a digital certificate to the AAU. Usually, the second acknowledgement information can further carry signature data obtained by signing a digest of the second acknowledgement information by the CA server. In the following, for ease of explanation, the signature data is simply referred to as third signature data. After the BBU receives the second acknowledgement information and the third signature data from the CA server, if the check result of the integrity check performed on the second acknowledgement information based on the third signature data is that the check is successful, the BBU sends a digital certificate to the AAU.

[0086] For example, FIG. 7 is another schematic flow chart of a communication method according to an embodiment of the present application. Details are shown in FIG. 7. S701. The BBU receives a first message from the AAU. The first message includes a certificate request file. S702. The BBU sends a third message to the AAU. Typically, the BBU can generate a third message based on the certificate request file in the first message, and send the third message to the AAU for signing. S703. The BBU receives first signature data corresponding to the third message from the AAU. The AAU can sign a digest of the third message based on the private key of the AAU to generate first signature data, and feed back the first signature data to the BBU. S704. The BBU sends a second message to the CA server. After receiving the first signature data, the BBU can combine the third message and the first signature data, and send the second message obtained by the combination to the CA server. In other words, the second message includes the third message and the first signature data. S705. Receive a first response from the CA server for the second message. The first response includes a digital certificate issued by the CA server to the AAU. Typically, after the CA server receives the second message and the integrity check performed on the third message using the first signature data is successful, the CA server can send the first response to the BBU. The first response includes a digital certificate issued by the CA server to the AAU. Typically, the first response further carries signature data obtained by signing a digest of the first response by the CA server based on the private key of the CA server. That is, the first response carries signature data corresponding to the first response. S706. The BBU sends the first acknowledgement information to the AAU. The BBU sends the first acknowledgement information to the AAU, which needs to be signed by the AAU. S707. The BBU receives second signature data for the first acknowledgement information from the AAU. The AAU can feed back the obtained second signature data to the BBU after signing the digest of the first acknowledgement information based on the private key of the AAU. S708. The BBU sends the first acknowledgement information and the second signature data to the CA server.After the BBU combines the first acknowledgement information and the second signature data, the BBU can send the information obtained by the combination to the CA server. S709. The BBU receives the second acknowledgement information from the CA server. After an integrity check performed on the first acknowledgement information based on the second signature data is successful, the CA server can return the second acknowledgement information to the BBU. Typically, the second acknowledgement information can carry signature data obtained by signing a digest of the second acknowledgement information by the CA server based on the private key of the CA server. S710. The BBU sends a digital certificate to the AAU. After the BBU receives the second acknowledgement information and an integrity check performed on the second acknowledgement information based on the signature data of the second acknowledgement information (i.e., the third signature data), the BBU sends a digital certificate to the AAU.

[0087] It should be noted that the opportunity for the BBU to receive the digital certificate from the CA server and send the digital certificate to the AAU may instead be determined based on an actual scenario, which is not limited in this document. The digital certificate of the AAU may be an operator device certificate, etc., which is not limited in this document.

[0088] It will be appreciated that after the BBU has completed the digital certificate application acting on behalf of the AAU, the proxy application channel between the AAU and the BBU may be closed, and the AAU can establish a service connection to the BBU using the resulting digital certificate.

[0089] In the following, the communication device provided in the present application will be described in detail with reference to FIG. 8 to FIG.

[0090] FIG. 8 is a diagram of the structure of a communication device according to an embodiment of the present application. The communication device shown in FIG. 8 may be configured to perform some or all of the functions of the second device in the embodiment of the method described in FIG. 4 to FIG. 7. The device may be a second device, a device in the second device, or a device that can be used with the second device. Alternatively, the communication device may be a chip system. The communication device shown in FIG. 8 may include a transceiver unit 801 and a processing unit 802. The processing unit 802 is configured to perform data processing. The transceiver unit 801 is integrated with a receiving unit and a transmitting unit. The transceiver unit 801 may also be referred to as a communication unit. Alternatively, the transceiver unit 801 may be divided into a receiving unit and a transmitting unit. The following processing unit 802 is similar to the transceiver unit 801. Details will not be described again below.

[0091] The transceiver unit 801 is configured to receive a first message from a first device, the first message including a certificate request file, the certificate request file being used to apply for a digital certificate for the first device.

[0092] The processing unit 802 is configured to send a second message to a certificate authority CA server through the transceiver unit 801 based on the first message, where the second message includes the certificate request file.

[0093] The transceiver unit 801 is configured to receive a digital certificate from a CA server.

[0094] The transceiver unit 801 is configured to transmit a digital certificate to a first device.

[0095] In one possible implementation, the processing unit 802 specifically: sending a third message to the first device via the transceiver unit 801, the third message including the certificate request file; receiving first signature data corresponding to a third message from the first device via the transceiver unit 801; sending a second message to the CA server via the transceiver unit 801, the second message including the first signature data and the third message; It is configured as follows.

[0096] In one possible implementation, the transceiver unit 801 specifically comprises: receiving a first response from the CA server for the second message, the first response including the digital certificate; It is configured as follows.

[0097] In one possible implementation, the first response carries the signature data of the first response, and the transceiver unit 801 specifically: checking the first response based on the signature data of the first response, and transmitting first confirmation response information to the CA server based on the check result; receiving second acknowledgment information from the CA server for the first acknowledgment information; transmitting a digital certificate to the first device in response to the second acknowledgement information; It is configured as follows.

[0098] In one possible implementation, the transceiver unit 801 specifically comprises: If the check result is that the check is successful, sending a first acknowledgement information to the first device; receiving second signature data corresponding to the first acknowledgement information from the first device; sending the first confirmation response information and the second signature data to the CA server; It is configured as follows.

[0099] For another possible implementation of this communication device, please refer to the relevant description of the functions of the access network device in the method embodiments corresponding to Figures 4 to 7. Details will not be described again here.

[0100] FIG. 9 is a diagram of the structure of another communication device according to an embodiment of the present application. The communication device shown in FIG. 9 may be configured to perform some or all of the functions of the first device in the embodiment of the method described in FIG. 4 to FIG. 7. The device may be the first device, a device in the first device, or a device that can be used with the first device. Alternatively, the communication device may be a chip system. The communication device shown in FIG. 9 may include a transceiver unit 901 and a processing unit 902.

[0101] The transceiver unit 901 is configured to send a first message to a second device, the first message including a certificate request file, the certificate request file being used to apply for a digital certificate for the first device.

[0102] The transceiver unit 901 is configured to receive a digital certificate from a second device.

[0103] In one possible implementation, the transceiver unit 901 is configured to receive a third message from the second device, the third message including a certificate request file.

[0104] This device is a processing unit 902 configured to transmit first signature data corresponding to the third message to a second device via the transceiver unit 901; Further includes:

[0105] In one possible implementation, the transceiver unit 901 specifically includes: receiving first acknowledgment information from a second device; Sending second signature data corresponding to the first acknowledgement information to the second device; It is configured as follows.

[0106] For another possible implementation of this communication device, please refer to the relevant description of the functions of the access network device in the method embodiments corresponding to Figures 4 to 7. Details will not be described again here.

[0107] FIG. 10 is a diagram of the structure of another communication device according to an embodiment of the present application. This communication device may be the second device of the embodiment of the present application. As shown in FIG. 10, the second device of this embodiment may include one or more processors 1001, memory 1002, and transceiver 1003. The processor 1001, memory 1002, and transceiver 1003 are connected using a bus 1004. The memory 1002 is configured to store a computer program. The computer program includes program instructions. The processor 1001 and the transceiver 1003 are configured to execute the program instructions stored in the memory 1002 to realize the functions of the second device of FIG. 4 to FIG. 7.

[0108] It should be understood that in some possible implementations, the processor 1001 may be a central processing unit (CPU), or the processor may be another general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, etc. The general-purpose processor may be a microprocessor, or the processor may be any conventional processor, etc. The memory 1002 may include read-only memory and random access memory and may provide instructions and data for the processor 1001. A portion of the memory 1002 may further include a non-volatile random access memory. For example, the memory 1002 may further store information related to the device type.

[0109] FIG. 11 is a structural diagram of another communication device according to an embodiment of the present application. This communication device may be the first device of the embodiment of the present application. As shown in FIG. 11, the first device of this embodiment may include one or more processors 1101, memory 1102, and transceiver 1103. The processor 1101, memory 1102, and transceiver 1103 are connected using a bus 1104. The memory 1102 is configured to store a computer program. The computer program includes program instructions. The processor 1101 and the transceiver 1103 are configured to execute the program instructions stored in the memory 1102 to realize the functions of the first device of FIG. 4 to FIG. 7.

[0110] It should be understood that in some possible implementations, the processor 1101 may be a central processing unit (CPU), or the processor may be another general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, etc. The general-purpose processor may be a microprocessor, or the processor may be any conventional processor, etc. The memory 1102 may include read-only memory and random access memory and may provide instructions and data for the processor 1101. A portion of the memory 1102 may further include a non-volatile random access memory. For example, the memory 1102 may further store information related to the device type.

[0111] An embodiment of the present application further provides a computer-readable storage medium, which stores instructions that, when executed on a processor, perform the method steps of the aforementioned method embodiments.

[0112] An embodiment of the present application further provides a computer program product, which when executed on a processor performs the method steps of the aforementioned method embodiments.

[0113] Those skilled in the art can notice that the example units and steps described with reference to the embodiments disclosed herein can be implemented by electronic hardware, or by a combination of computer software and electronic hardware. Whether a function is performed by hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can implement the described functions using various methods for each specific application, but the implementation should not be considered to exceed the scope of this application.

[0114] It should be understood that in some embodiments provided in the present application, the disclosed system, device, and method may be implemented in other ways. For example, the described device embodiments are merely examples. For example, the division into units is merely a logical division of functions. The units described as separate parts may or may not be physically separate, and the parts shown as units may or may not be physical units, and may be located in one place or distributed over multiple network units. Some or all of the units may be selected based on actual requirements to achieve the objectives of the solutions of the embodiments.

[0115] When a function is implemented in the form of a software functional unit and sold or used as an independent product, the function may be stored in a computer-readable storage medium. Based on such understanding, the technical solution of the present application essentially, or a part that contributes to the prior art, or a part of the technical solution may be implemented in the form of a software product. This computer software product is stored in a storage medium and includes some instructions that instruct a computer device (which may be a personal computer, a server, a network device, etc.) to execute all or part of the steps of the method described in the embodiments of the present application. The computer-readable storage medium may be any available medium that can be accessed by a computer. By way of example, and not limitation, a computer-readable medium may include random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read only memory (EEPROM), compact disc read-only memory (CD-ROM), universal serial bus flash disk, a removable hard disk, another compact disk storage device, a magnetic disk storage medium or another magnetic storage device, or any other medium that can be used to carry or store contemplated program code in the form of instructions or data structures and that can be accessed by a computer.Additionally, many forms of RAM may be used, such as, by way of example and not limitation, static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchlink dynamic random access memory (synchlink DRAM, SLDRAM), or direct rambus random access memory (direct rambus RAM, DR RAM).

[0116] The above description is merely a specific implementation of the present application, and is not intended to limit the scope of protection of the embodiments of the present application. Any modifications or replacements that are easily conceived by those skilled in the art within the technical scope disclosed in the embodiments of the present application shall fall within the scope of protection of the embodiments of the present application. Therefore, the scope of protection of the embodiments of the present application shall be subject to the scope of protection of the claims. [Explanation of symbols]

[0117] 801 Transceiver Unit 802 Processing Unit 901 Transceiver unit 902 Processing Unit 1001 Processor 1002 Memory 1003 Transceiver 1004 Bus 1101 Processor 1102 Memory 1103 Transceiver 1104 Bus

Claims

1. 1. A communication method comprising: receiving a first message from a first device, the first message including a certificate request file, the certificate request file being used to apply for a digital certificate for the first device; sending a second message to a certificate authority (CA) server based on the first message, the second message including the certificate request file; receiving the digital certificate from the CA server; sending the digital certificate to the first device; A method comprising:

2. The step of sending a second message to a CA server based on the first message includes: sending a third message to the first device, the third message including the certificate request file; receiving first signature data corresponding to the third message from the first device; sending the second message to the CA server, the second message including the first signature data and the third message; 2. The method of claim 1, comprising:

3. The step of receiving the digital certificate from the CA server comprises: receiving a first response from the CA server for the second message, the first response including the digital certificate; 3. The method of claim 1 or 2, comprising:

4. The first response carries signature data of the first response, and the step of transmitting the digital certificate to the first device comprises: sending a first confirmation response to the CA server based on a check result of checking the first response based on the signature data of the first response; receiving second acknowledgment information from the CA server for the first acknowledgment information; sending the digital certificate to the first device in response to the second acknowledgement information; 4. The method of claim 3, comprising:

5. the step of transmitting first confirmation response information to the CA server based on a check result of checking the first response based on the signature data of the first response, sending the first acknowledgement information to the first device if the check result is that the check is successful; receiving second signature data corresponding to the first acknowledgement information from the first device; sending the first confirmation response information and the second signature data to the CA server; 5. The method of claim 4, comprising:

6. 1. A communication method comprising: sending a first message to a second device, the first message including a certificate request file, the certificate request file being used to apply for a digital certificate for the first device; receiving the digital certificate from the second device; A method comprising:

7. The method comprises: receiving a third message from the second device, the third message including the certificate request file; sending first signature data corresponding to the third message to the second device; 7. The method of claim 6, further comprising:

8. The method comprises: receiving first acknowledgment information from the second device; sending second signature data corresponding to the first acknowledgement information to the second device; 8. The method of claim 6 or 7, further comprising:

9. a communication device, the communication device being a second device; a transceiver unit configured to receive a first message from a first device, the first message including a certificate request file, the certificate request file being used to apply for a digital certificate for the first device; a processing unit configured to send a second message to a certificate authority CA server through the transceiver unit based on the first message, the second message including the certificate request file; Equipped with the transceiver unit is configured to receive the digital certificate from the CA server; The transceiver unit is configured to transmit the digital certificate to the first device.

10. Specifically, the processing unit includes: and configured to transmit a third message to the first device through the transceiver unit, the third message including the certificate request file; the processing unit receives first signature data corresponding to the third message from the first device through the transceiver unit; 10. The apparatus of claim 9, configured to transmit the second message to the CA server through the transceiver unit, the second message including the first signature data and the third message.

11. Specifically, the transceiver unit includes:

11. The apparatus of claim 9 or 10, configured to receive a first response from the CA server for the second message, the first response including the digital certificate.

12. The first response carries signature data of the first response, and the transceiver unit specifically: sending a first confirmation response to the CA server based on a check result of checking the first response based on the signature data of the first response; receiving second acknowledgment information from the CA server for the first acknowledgment information; 12. The apparatus of claim 11, configured to transmit the digital certificate to the first device in response to the second acknowledgement information.

13. Specifically, the transceiver unit includes: sending the first acknowledgement information to the first device if the check result is that the check is successful; receiving second signature data corresponding to the first acknowledgement information from the first device; 13. The apparatus of claim 12, configured to transmit the first acknowledgement information and the second signature data to the CA server.

14. A communication apparatus, the communication apparatus being a first device; a transceiver unit configured to transmit a first message to a second device, the first message including a certificate request file, the certificate request file being used to apply for a digital certificate for the first device; A communications apparatus, wherein the transceiver unit is configured to receive the digital certificate from the second device.

15. the transceiver unit is configured to receive a third message from the second device, the third message including the certificate request file; The apparatus comprises: The apparatus of claim 14 , further comprising: a processing unit configured to transmit first signature data corresponding to the third message to the second device through the transceiver unit.

16. Specifically, the transceiver unit includes: receiving first acknowledgment information from the second device; 16. The apparatus of claim 14 or 15, configured to transmit second signature data corresponding to the first acknowledgement information to the second device.

17. A communications device comprising a processor and a transceiver, the processor and the transceiver configured to execute computer programs or instructions stored in at least one memory to enable the device to perform a method according to any one of claims 1 to 5.

18. A communications device comprising a processor and a transceiver, the processor and the transceiver configured to execute computer programs or instructions stored in at least one memory to enable the device to perform a method according to any one of claims 6 to 8.

19. 6. A computer readable storage medium, the storage medium storing a computer program or instructions which, when executed by a computer, perform the method of any one of claims 1 to 5.

20. 9. A computer readable storage medium, the storage medium storing a computer program or instructions which, when executed by a computer, perform the method of any one of claims 6 to 8.

21. A computer program product comprising computer program code which, when executed on a computer, performs the method of any one of claims 1 to 5.

22. A computer program product comprising computer program code which, when executed on a computer, performs the method of any one of claims 6 to 8.

Images