Certificate presetting method, device and computer-readable storage medium

Abstract

The embodiments of the present application belong to the technical field of communications. Disclosed are a certificate presetting method, a device and a computer-readable storage medium. The method comprises: acquiring a network management version package and a preset certificate package, which matches the network management version package; installing a network management system on the basis of the network management version package; and creating secure storage modules corresponding to respective network management modules in the network management system, and storing, in the secure storage modules, preset certificates in the preset certificate package, such that the network management modules associated with the respective secure storage modules acquire required preset certificates.

Description

Certificate presetting method, device and computer-readable storage medium

[0001] Related applications

[0002] This application claims priority to Chinese patent application No. 202310781535.6 filed on June 28, 2023, the entire contents of which are incorporated by reference into this application. Technical Field

[0003] The embodiments of the present application relate to the field of communication technologies, and in particular to a certificate pre-setting method, device, and computer-readable storage medium. Background Art

[0004] In related technologies, network management digital certificate pre-setting generally adopts the method of module pre-setting self-signed certificate. However, there are security and authority issues in pre-setting digital certificates in this way. The obtained certificate may not be reliable, and the certificate is strongly coupled with the network management version. If a vulnerability or security issue is found and the certificate needs to be updated, each module will have to release a network management upgrade package or patch package, and the update process is very complicated.

[0005] Summary of the Invention

[0006] The main purpose of the embodiments of the present application is to provide a certificate pre-setting method, device and computer-readable storage medium, aiming to solve the technical problem of how to improve the authority, security and update convenience of pre-set digital certificates.

[0007] To achieve the above objectives, an embodiment of the present application provides a certificate pre-setting method, the certificate pre-setting method comprising:

[0008] Obtain a network management version package and a pre-configured certificate package that matches the network management version package;

[0009] Installing the network management system based on the network management version package;

[0010] A secure storage module corresponding to each network management module in the network management system is created, and the pre-installed certificates in the pre-installed certificate package are stored in the secure storage module, so that each network management module associated with the secure storage module obtains the required pre-installed certificates.

[0011] In addition, to achieve the above-mentioned purpose, an embodiment of the present application further provides a certificate pre-setting device, the certificate pre-setting device comprising:

[0012] An acquisition module, configured to acquire a network management version package and a pre-configured certificate package that matches the network management version package;

[0013] An installation module, the installation module is used to install the network management system based on the network management version package;

[0014] A matching module is used to create a security storage module corresponding to each network management module in the network management system, and store the pre-set certificates in the pre-set certificate package in the security storage module, so that each network management module associated with the security storage module obtains the required pre-set certificates.

[0015] In addition, to achieve the above-mentioned purpose, an embodiment of the present application also provides a certificate pre-setting device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program implements the certificate pre-setting method described above when executed by the processor.

[0016] In addition, to achieve the above-mentioned purpose, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the certificate pre-setting method described above is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only part of the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0018] FIG1 is a flow chart of a certificate presetting method provided in one embodiment of the present application;

[0019] FIG2 is a schematic diagram of a generation process of a pre-set certificate package involved in a certificate pre-setting method provided in an embodiment of the present application;

[0020] FIG3 is a schematic diagram of a detailed process of installing a network management system involved in a certificate pre-setting method provided in one embodiment of the present application;

[0021] FIG4 is a schematic diagram of a verification process of a pre-set certificate package involved in a certificate pre-setting method provided in an embodiment of the present application;

[0022] FIG5 is a flow chart of password decryption and private key splitting involved in a certificate presetting method provided in one embodiment of the present application;

[0023] FIG6 is a schematic diagram of a detailed process of password decryption and private key splitting involved in a certificate pre-setting method provided in one embodiment of the present application;

[0024] FIG7 is a schematic diagram of a certificate update process involved in a certificate presetting method provided in an embodiment of the present application;

[0025] FIG8 is a schematic diagram of a detailed certificate update process involved in a certificate presetting method provided in an embodiment of the present application;

[0026] FIG9 is a schematic diagram of a system architecture involved in a certificate presetting method provided in one embodiment of the present application;

[0027] FIG10 is a schematic diagram of the structure of a certificate presetting device provided in one embodiment of the present application;

[0028] FIG11 is a schematic structural diagram of a certificate pre-setting device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] In the following description, specific details such as specific system structures and technologies are provided for illustration rather than limitation to facilitate a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the embodiments of the present application can also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the embodiments of the present application.

[0030] It should be noted that although a logical order is shown in the flowcharts, in some cases, the steps shown or described may be performed in a different order than that shown in the flowcharts. The terms "first," "second," and the like in the specification, claims, and drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0031] It should also be understood that references to "one embodiment" or "some embodiments" described in the description of the embodiments of the present application mean that one or more embodiments of the embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Thus, the phrases "in one embodiment," "in some embodiments," "in some other embodiments," "in some other embodiments," etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but rather mean "one or more but not all embodiments," unless otherwise specifically emphasized. The terms "including," "comprising," "having," and their variations all mean "including but not limited to," unless otherwise specifically emphasized.

[0032] A digital certificate is a digital authentication that identifies the identities of all parties communicating on the internet. People can use it to identify each other online, hence the name "digital ID." Digital certificates encrypt or decrypt information and data exchanged over computer networks, ensuring the integrity and security of that information.

[0033] ToB (To Business, enterprise entrepreneurship is aimed at enterprises and provides services to enterprises, such as equipment manufacturers) enterprise customers face a more stringent and complex security environment than operators. In addition to high requirements for operational convenience and automation, they also put forward higher security requirements such as secure startup, default security, zero trust, and data not leaving the campus. Moreover, ToB enterprise customers are more sensitive to costs, and security infrastructure such as CA (Certificate Authority) servers are generally lacking.

[0034] The network management system involves modules that use TLS (Transport Layer Security) and HTTPS (Hypertext Transfer Protocol Secure) protocols for north-south communication. It is necessary to pre-install digital certificates authorized by the equipment manufacturer before the relevant modules are started. Otherwise, services cannot be provided to the outside world immediately with a secure protocol after startup. If a non-secure protocol is used to obtain a certificate online, there will be a security window before obtaining the certificate. Moreover, for network security reasons, operators and corporate customers will not allow network managers to connect online to the equipment manufacturer's website to obtain certificates. Therefore, ordinary online distribution or certificate update methods cannot solve the certificate pre-installation problem required for the secure startup of the network management.

[0035] In related technologies, network management digital certificate pre-setting generally adopts the method of module pre-setting self-signed certificate. This method has several problems: 1) The certificate is pre-set in the module development code, and the security of the certificate private key cannot be guaranteed. If the certificate private key is leaked or abused during the development stage, the digital certificate will no longer serve as an identity identifier; 2) Based on the security issue in 1), the self-signed certificate is not issued by the equipment manufacturer's authoritative CA, and the communication peer cannot verify the authority of the certificate. Trusting the certificate faces great doubts, and not trusting the certificate will make it impossible to use the certificate to establish a security protocol link with the peer; 3) The certificate and network management version are strongly coupled. If a vulnerability or security issue is found and the certificate needs to be updated, each module will have to release a network management upgrade package or patch package, and the process and operation are very complicated.

[0036] Based on this, the embodiments of the present application provide a certificate pre-setting method, apparatus, equipment and computer-readable storage medium. By implementing the certificate pre-setting method proposed in the embodiments of the present application, there is no need to connect to the equipment vendor's website online when pre-setting the equipment vendor certificate, which can meet the strict network security requirements of operators and ToB enterprise users. It can have the ability to provide a secure channel to the outside world as soon as the network management is started. There is no security window period before obtaining the certificate online using a non-secure protocol. The offline pre-setting or certificate update method is more reliable and stable than the online method, and does not require operators or ToB enterprise users to build their own certificate servers; the security protection of the certificate starts from a non-production environment, the development and testing of the network management module does not rely on real certificates, and there is no need to distribute real certificates issued by the equipment vendor's authoritative CA in the R&D code; the issuance and update of certificates are decoupled from the network management version, and there is no need for one-to-one correspondence, which makes management more convenient and updates easier. When security issues arise, updated certificate packages can be quickly released to solve the problems without the need to update the network management code to upgrade or patch the network management version.

[0037] The certificate pre-setting method, apparatus, device, and computer-readable storage medium provided in the embodiments of the present application are specifically described through the following embodiments. First, the certificate pre-setting method in the embodiments of the present application is described.

[0038] Referring to Figure 1, Figure 1 is a flow chart of a certificate presetting method provided in an embodiment of the present application. The certificate presetting method can be applied to a certificate presetting device. As shown in Figure 1, the certificate presetting method provided in this embodiment includes steps S10 to S30.

[0039] Step S10: Obtain a network management version package and a pre-configured certificate package that matches the network management version package;

[0040] The certificate pre-configuration method proposed in this embodiment is easier to understand when combined with actual application scenarios. Therefore, this embodiment uses the certificate pre-configuration scenario of a network management device vendor as an example for explanation. In this scenario, certificate pre-configuration in a production environment is generally performed following a fresh installation of the network management version. To perform the installation, you must first obtain the network management version package, installation tools, and the corresponding pre-configured certificate package from a non-production environment, and upload these packages and tools to the server to be installed. This completes the preparations for the network management version installation and device vendor certificate pre-configuration.

[0041] As an example, this embodiment can be regarded as omitting the step of obtaining the network management version package, installation tool and corresponding pre-installed certificate package in a non-production environment before step S10, and is considered to be directly obtaining the network management version package and the pre-installed certificate package matching the network management version package through the installation tool.

[0042] As an example, in this embodiment, the directory structure in the pre-installed certificate package zip package is as follows:

[0043] Where [consumer_name] is the name of the network management service module. Each module has a directory. Multiple directories of different modules can be placed under one certificate package at the same time, which corresponds to the definition in cert_description.json later. xxx_xxxx.pfx represents the combined private key and certificate file. xxx_xxxx_password.txt is the password for the xxx_xxxx.pfx file, which is stored using AES256 encryption. xxx_xxxx_trust.cer (.crt) represents the peer CA certificate trusted by this module.

[0044] As an example, the structure of the certificate consumer description file (cert_description.json) is as follows:

[0045] 2 , in some feasible embodiments, before step S10, the certificate presetting method further includes:

[0046] Step S01: Obtain an authoritative certificate issued by a certificate authority, and generate a certificate package based on the authoritative certificate;

[0047] Step S02: Apply for a digital signature from the certificate authority based on the certificate package to obtain a signature file;

[0048] Step S03: Generate a preset certificate package based on the certificate package and the signature file.

[0049] In this embodiment, the pre-set certificate package is generated in a non-production environment. First, according to the application for the pre-set certificate module as needed, an application is uniformly submitted to the equipment manufacturer's authoritative CA for the issuance of module certificates; then, the certificate package and its internal directory structure, certificate files, and certificate description files are uniformly maintained, and the command provided by the network management installation and upgrade tool is used to perform AES256 encryption storage of the xxx_xxxx.pfx file password. Different certificate files can use different passwords, and the certificate cannot be used without a password; the trusted peer CA certificate is pre-set in the certificate package, and the default is the equipment manufacturer's authoritative CA; after the network management configuration administrator generates the certificate package zip, he applies for a digital signature from the equipment manufacturer's CA to generate a signature file such as cert.zip.sign; the network management test and verification in a non-production environment does not rely on the real certificate package, and only a test certificate package is required.

[0050] As an example, the certificate package and its signature file are published to a unified version server for download in the production environment. One certificate package can be used with multiple network management version packages without a one-to-one correspondence.

[0051] Step S20, installing the network management system based on the network management version package;

[0052] It can be understood that since this embodiment is illustrated using the certificate pre-setting scenario of the network management equipment vendor as an example, after obtaining the network management version package required for installing the network management system, it is necessary to first install the network management system based on the network management version package, and complete the certificate pre-setting of the certificates required for each network management business module in the network management system during the network management system installation process.

[0053] 3 , in some feasible embodiments, step S20 includes:

[0054] Step S201, decompressing the network management version package to obtain multiple module installation packages;

[0055] Step S202: installing a network management system composed of a plurality of network management modules on a server to be installed based on each module installation package.

[0056] The network management version package includes module installation packages corresponding to different network management service modules. After executing the installation program of each network management service module on the server to be installed based on these module installation packages, a network management system consisting of multiple network management service modules can be obtained.

[0057] Step S30: creating a secure storage module corresponding to each network management module in the network management system, and storing the pre-configured certificates in the pre-configured certificate package into the secure storage module, so that each network management module associated with the secure storage module obtains the required pre-configured certificates.

[0058] In order to ensure the security of the pre-set certificates, the certificates required by each network management business module in this embodiment are not directly pre-set in the network management business module. Instead, a one-to-one corresponding security storage module is created for each network management business module in the network management system to store the certificate files required by each network management business module. When the network management business module is started, it can directly read the certificate files it needs to use through the unique corresponding security storage module and provide external services in combination with the security protocol.

[0059] As an example, the secure storage module in this embodiment may be a secure secret persistent volume dedicated to the network management service module.

[0060] This embodiment proposes a certificate pre-setting method, which uses the equipment manufacturer's authoritative CA to issue corresponding certificates to each business module in the network management system, and introduces a certificate package to uniformly store certificates, so that certificate pre-setting and updating do not require online connection to the equipment manufacturer's CA server, the operator or the internal CA server of the ToB enterprise user; in this embodiment, the network management business module has a usable certificate as soon as it is started, which allows these modules to provide services to the outside world with a secure protocol after startup, and there is no security window period; and different modules can use different certificates. The network management modules cannot obtain truly pre-set certificates in a non-production environment. The test environment uses a test certificate package for testing and verification. The certificate package is not coupled with the network management version and does not need to correspond one-to-one with the network management version.

[0061] 4 , in some feasible embodiments, before step S20, the certificate presetting method further includes:

[0062] Step S11, decrypting the signature file in the pre-set certificate package based on the public key provided by the certificate authority to obtain a decrypted plaintext;

[0063] Step S12: Compare the decrypted plaintext with the hash code of the certificate package in the pre-set certificate package to implement integrity verification.

[0064] Considering the possibility that the pre-installed certificate package may be damaged, an integrity check can be performed on the pre-installed certificate package before the network management system is installed to ensure that the certificate pre-installation process can proceed normally during the installation of the network management system. An integrity check process provided in this embodiment is also performed by the network management installation tool. The network management installation tool is pre-installed with a public key provided by a certificate authority. The signature file in the pre-installed certificate package is decrypted based on the public key and then compared with the hash code of the certificate package. If the two are consistent, it means that the pre-installed certificate package is complete. If the two are inconsistent, it means that the pre-installed certificate package has been modified.

[0065] As an example, the network management system version package may be verified before installing the network management system to avoid problems such as network management system installation failure or outdated version of the installed network management system.

[0066] 5 , in some feasible embodiments, before the above step S30, the certificate presetting method further includes:

[0067] Step S21, determining a pre-installed certificate to be used in the pre-installed certificate package based on a configuration file of the pre-installed certificate package;

[0068] Step S22: Decrypt the password of the pre-set certificate and split the private key to obtain the certificate and private key files.

[0069] Before storing the certificate in the secure storage module, it is necessary to first determine the preset certificates that each network management business module needs to use based on the configuration file of the preset certificate package to avoid storing certificates that the network management business module does not need to use in the corresponding secure storage module; and after determining the preset certificate to be used, the preset certificate will not be directly stored in the secure storage module, because the preset certificate actually exists in the form of an encrypted pfx file. If the pfx file is directly stored in the secure storage module, even if the network management business module obtains the pfx file, it cannot obtain the certificate it needs to use. Therefore, it is also necessary to split the preset certificate into two files, certificate and private key, and store the certificate and private key in the secure storage module in subsequent steps. Only in this way can the network management business module directly read the certificate and private key files it needs to use from the corresponding secure storage module.

[0070] 6 , in some feasible embodiments, step S22 includes:

[0071] Step S221, decrypting the encrypted password of the pre-set certificate based on a preset password key to obtain a plaintext password;

[0072] Step S222: Splitting the private key of the pre-set certificate based on the plaintext password to obtain a certificate and a private key file.

[0073] In combination with the above embodiments, it can be seen that after the pre-set certificate is provided by the authoritative CA, it has been encrypted with an encryption password, and the preset password key is provided together with the authoritative CA when providing the pre-set certificate. It is necessary to first decrypt the password to obtain the plaintext password of the pre-set certificate used for encrypted storage, and then split the pre-set certificate, i.e., the pfx file, into two files, the certificate and the private key, based on the plaintext password.

[0074] As you can understand, a private key is a small piece of code that is paired with a public key to trigger the algorithm for encrypting and decrypting text. It is created during asymmetric key cryptography as part of public key cryptography and is used to decrypt and convert messages into a readable format.

[0075] 7 , in some feasible embodiments, after the above step S20, the certificate presetting method further includes:

[0076] Step S23, determining whether the network management module in the network management system needs to update the pre-set certificate;

[0077] Step S24: When the network management module needs to update the pre-configured certificate, a pre-configured certificate is added to the pre-configured certificate package based on the certificate authority.

[0078] The above embodiment corresponds to the pre-set scenario of the network management equipment vendor certificate, while the present embodiment corresponds to the update scenario of the network management equipment vendor certificate. When a network management system already exists, the network management version package in the above embodiment can be replaced with a network management patch package. Similarly, the network management system can be upgraded or patched based on the network management patch package by installing an upgrade tool. After completing the upgrade or patch of the network management module, it can be determined whether the certificate required by the updated network management module also needs to be updated. If an update is required, it is also necessary to apply for and sign from an authoritative CA organization in a non-production environment to obtain a pre-set certificate package that matches the latest network management system.

[0079] It is understandable that not all module certificates need to be updated or pre-set. Therefore, after upgrading or patching the network management module, by comparing the existing certificate package configuration file in the version with the configuration file of the certificate package to be processed, you can know the network management module that needs to be updated or pre-set with new certificates.

[0080] 8 , in some feasible embodiments, step S23 includes:

[0081] Step S231, when new certificate configuration information is added to the network management module, determining that the network management module needs to update the pre-set certificate;

[0082] Step S232: If there is a security risk in the pre-installed certificate of the network management module, it is determined that the network management module needs to update the pre-installed certificate.

[0083] In this embodiment, the two situations in which the pre-set certificates need to be updated are mainly given, namely, the situation in which the network management module adds new certificate configuration information, and the situation in which the pre-set certificates of the network management module have security risks. The security risks may include different situations such as the pre-set certificates having security holes or being leaked, or the expiration date being approaching.

[0084] Referring to FIG. 9 , the system architecture shown in FIG. 9 can be applied to any of the above embodiments. As can be seen from FIG. 9 , the entire system includes the following key components:

[0085] 1. Equipment vendor's authoritative CA (i.e., certificate authority): a general authoritative CA that can be trusted by operators or ToB enterprise users, completes the issuance of pre-installed certificates in the certificate package and the digital signature of the certificate package.

[0086] 2. Network management system. The network management system modules related to the embodiments of the present application include:

[0087] 1) Network management installation and upgrade tool: used to load the network management version / patch package and the network management preset certificate package, perform integrity verification and decryption on the certificate package, and load the stored certificates into a secure storage that can be independently accessed by the module for use by related modules to load certificates; also used to load the network management version / patch package, install, deploy, upgrade, and patch network management business modules, such as the north-south module.

[0088] 2) Network management pre-installed certificate package: used to pre-install the certificate issued by the equipment manufacturer's authoritative CA, and pre-installed into the network management system through the network management installation and upgrade tool, so that the relevant modules have usable certificates before startup.

[0089] 3) Network management version / patch package: software installation / upgrade / patch package of the network management business module.

[0090] 4) Secure storage: A storage device or software that can securely store important files such as private keys. It is used to securely store pre-installed module-related certificates and private keys. Different modules use different storage spaces and their permission controls for secure isolation.

[0091] Network management service module: A general service module that requires certificates to provide external services using the TLS and HTTPS security protocols. This module is deployed, upgraded, and patched by the network management version upgrade tool. Upon module startup, the module loads the required pre-configured certificates from secure storage to provide external services using the TLS and HTTPS security protocols.

[0092] In addition, an embodiment of the present application also provides a certificate pre-setting device. Referring to Figure 10, Figure 10 is a structural schematic diagram of a certificate pre-setting device provided by an embodiment of the present application. As shown in Figure 10, in this embodiment, the certificate pre-setting device includes: an acquisition module 100, an installation module 200 and a matching module 300.

[0093] The acquisition module 100 is used to acquire a network management version package and a pre-configured certificate package matching the network management version package;

[0094] The installation module 200 is used to install the network management system based on the network management version package;

[0095] The matching module 300 is used to create a secure storage module corresponding to each network management module in the network management system, and store the pre-set certificates in the pre-set certificate package in the secure storage module, so that each network management module associated with the secure storage module obtains the required pre-set certificates.

[0096] The certificate presetting device provided in this embodiment and the certificate presetting method provided in the above embodiment belong to the same inventive concept. For technical details not fully described in this embodiment, please refer to any of the above embodiments, and this embodiment has the same beneficial effects as executing the certificate presetting method.

[0097] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.

[0098] In addition, embodiments of the present application further provide a certificate provisioning device. The certificate provisioning method applied to the certificate provisioning device can be executed by a certificate provisioning device. The certificate provisioning device can be implemented in software and / or hardware and integrated into the certificate provisioning device. The certificate provisioning device can be a terminal device such as a PC (personal computer), mobile phone, laptop, tablet computer, etc. that can communicate with the network side.

[0099] Referring to Figure 11, Figure 11 is a schematic diagram of the hardware structure of a certificate pre-setting device provided in an embodiment of the present application. As shown in Figure 11, the certificate pre-setting device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may include a standard wired interface and a wireless interface (such as a wireless fidelity (WI-FI) interface). The memory 1005 may be a high-speed random access memory (RAM) or a stable non-volatile memory (NVM), such as a disk storage. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0100] Those skilled in the art will appreciate that the structure shown in FIG11 does not limit the certificate provisioning device and may include more or fewer components than shown, or combine certain components, or arrange the components differently. As shown in FIG11 , the memory 1005 , which serves as a storage medium, may include an operating system, a data storage module, a network communication module, a user interface module, and a computer program.

[0101] In the certificate pre-setting device shown in FIG11 , the network interface 1004 is mainly used for data communication with other devices; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in this embodiment can be set in the certificate pre-setting device, and the certificate pre-setting device calls the computer program stored in the memory 1005 through the processor 1001 and executes the certificate pre-setting method applied to the certificate pre-setting device provided in any of the above embodiments.

[0102] The certificate pre-setting device proposed in this embodiment and the certificate pre-setting method applied to the certificate pre-setting device proposed in the above embodiment belong to the same inventive concept. Technical details not fully described in this embodiment can be referred to any of the above embodiments, and this embodiment has the same beneficial effects as executing the certificate pre-setting method.

[0103] In addition, an embodiment of the present application also provides a computer-readable storage medium, which can be a non-volatile computer-readable storage medium. A computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the certificate pre-setting method provided in any of the above embodiments is implemented.

[0104] Those skilled in the art will appreciate that all or some of the steps and systems in the method disclosed above can be implemented as software, firmware, hardware, and appropriate combinations thereof. Some physical components or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, and the computer-readable medium can include computer storage media (or non-transitory media) and communication media (or temporary media). As known to those skilled in the art, the term computer storage media is included in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data) and is volatile and non-volatile, removable, and non-removable. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory, or other memory technology, CD-ROM, digital versatile disks (DVD), or other optical disk storage, magnetic cassettes, magnetic tapes, disk storage, or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, as is well known to those skilled in the art, communication media typically embodies computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0105] The above is a specific description of some implementations of the embodiments of the present application, but the embodiments of the present application are not limited to the above-mentioned implementation methods. Technical personnel familiar with the art can also make various equivalent modifications or substitutions without violating the spirit of the embodiments of the present application. These equivalent modifications or substitutions are all included in the scope defined by the claims of the embodiments of the present application.

Claims

1. A certificate presetting method, wherein: The certificate presetting method comprises: Obtain a network management version package and a pre-configured certificate package matching the network management version package; Installing the network management system based on the network management version package; A secure storage module corresponding to each network management module in the network management system is created, and the pre-set certificates in the pre-set certificate package are stored in the secure storage module, so that each network management module associated with the secure storage module obtains the required pre-set certificates.

2. The certificate presetting method according to claim 1, wherein: Before the step of obtaining a network management version package and a pre-set certificate package matching the network management version package, the certificate pre-setting method further includes: Obtain an authoritative certificate issued by a certificate authority, and generate a certificate package based on the authoritative certificate; Applying for a digital signature from the certificate authority based on the certificate package to obtain a signature file; A pre-set certificate package is generated based on the certificate package and the signature file.

3. The certificate presetting method according to claim 1, wherein: Before the step of installing the network management system based on the network management version package, the certificate presetting method further includes: Decrypt the signature file in the pre-set certificate package based on the public key provided by the certificate authority to obtain a decrypted plaintext; The decrypted plaintext is compared with the hash code of the certificate package in the pre-set certificate package to implement integrity verification.

4. The certificate presetting method according to claim 1, wherein: The step of installing the network management system based on the network management version package includes: Decompressing the network management version package to obtain multiple module installation packages; A network management system consisting of a plurality of network management modules is installed on the server to be installed based on each of the module installation packages.

5. The certificate presetting method according to claim 1, wherein: Before the step of creating a secure storage module corresponding to each network management module in the network management system, the certificate presetting method further includes: Determining a pre-configured certificate to be used in the pre-configured certificate package based on a configuration file of the pre-configured certificate package; The pre-set certificate is password-decrypted and the private key is split to obtain the certificate and private key files.

6. The certificate presetting method according to claim 5, wherein: The step of decrypting the password of the pre-set certificate and splitting the private key to obtain the certificate and private key file comprises: Decrypting the encrypted password of the preset certificate based on a preset password key to obtain a plain text password; The private key of the pre-set certificate is split based on the plain text password to obtain a certificate and a private key file.

7. The certificate presetting method according to claim 1, wherein: After the step of installing the network management system based on the network management version package, the certificate presetting method further includes: Determining whether a network management module in the network management system needs to update a pre-set certificate; In the case that the network management module needs to update the pre-configured certificate, a pre-configured certificate is added to the pre-configured certificate package based on the certificate authority.

8. The certificate presetting method according to claim 7, wherein: The step of determining whether the network management module in the network management system needs to update the pre-set certificate includes: In the case where certificate configuration information is newly added in the network management module, determining that the network management module needs to update a pre-set certificate; In the case that there is a security risk in the pre-set certificate of the network management module, it is determined that the network management module needs to update the pre-set certificate.

9. A certificate pre-setting device, wherein: The certificate pre-setting device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program implements the certificate pre-setting method according to any one of claims 1 to 8 when executed by the processor.

10. A computer-readable storage medium, wherein: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the certificate presetting method according to any one of claims 1 to 8 is implemented.

Images