Digital certificate management method, apparatus, device and system and readable storage medium

Abstract

The present application relates to the technical field of digital certificates. Particularly disclosed are a digital certificate management method, apparatus, device and system and a nonvolatile readable storage medium, the method comprising: generating a digital certificate issuing request according to a demand of a target service and sending the digital certificate issuing request to a digital certificate device, such that the digital certificate device generates a certificate chain for the target service, the certificate chain at least comprising a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated on the basis of a confidential computing environment. Compared with a single public key infrastructure certificate or a certificate chain constituted only by public key infrastructure certificates in the prior art, the present application increases trusted parties in the certificate chain, thus reducing the security dependence on the certificate authority, improving the security of the certificate chain, and accordingly improving the security of certificate owners and the security of certificate users. The target service is deployed after the certificate chain passes signature verification, thereby improving the security of the target service.

Description

Digital certificate management method, device, equipment, system and readable storage medium

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to the Chinese patent application filed with the China Patent Office on June 28, 2023, with application number 202310772031.8, and application name “Digital Certificate Management Method, Device, Equipment, System and Readable Storage Medium”, all contents of which are incorporated by reference into this application. Technical Field

[0003] The present application relates to the field of digital certificate technology, and in particular to a digital certificate management method, apparatus, device, system and non-volatile readable storage medium. Background Art

[0004] A digital certificate is a digital ID used to verify the identity of an entity (usually a person, organization, or website). Created using cryptographic techniques, a digital certificate contains a public key and identifying information such as the certificate holder's name, email address, and organization name. Digital certificates are widely used in e-commerce, internet banking, email security, and network security.

[0005] Digital certificates are typically issued to certificate holders by authoritative Certificate Authorities (CAs). These certificates contain the CA's digital signature, allowing users to verify the legitimacy of the certificate holder. However, this digital certificate management mechanism relies heavily on a third party (the CA). If the CA is compromised or subjected to a man-in-the-middle attack, this poses a significant threat to the security of certificate users.

[0006] How to improve the security of digital certificate management systems, and thereby improve the security of certificate owners and certificate users, is a technical problem that those skilled in the art need to solve.

[0007] Summary of the Invention

[0008] The purpose of this application is to provide a digital certificate management method, device, equipment, system and non-volatile readable storage medium for improving the security of the digital certificate management system, thereby improving the security of the certificate owner and the security of the certificate user.

[0009] To solve the above technical problems, this application provides a digital certificate management method, including:

[0010] Generate a digital certificate issuance request based on the needs of the target business;

[0011] Sending a digital certificate issuance request to a digital certificate device so that the digital certificate device generates a certificate chain for the target business;

[0012] After the certificate chain is verified to be legitimate, the target business is deployed using the certificate chain;

[0013] The certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment.

[0014] In some implementations, at least one level of digital certificates in the certificate chain includes a public key infrastructure certificate and a confidential computing certificate.

[0015] In some implementations, the digital certificate device generates a certificate chain for the target service, including:

[0016] The first-level digital certificate device holding the first-level digital certificate of the certificate chain generates the first-level digital certificate by self-signing and verifies the signature of the first-level digital certificate, confirming that the first-level digital certificate is legitimate and that the first-level digital certificate device has the authority to issue digital certificates;

[0017] Starting from the second-level digital certificate device that holds the second-level digital certificate in the certificate chain, the current-level digital certificate device receives the current-level digital certificate issued by the previous-level digital certificate device and verifies the signature of the current-level digital certificate, and then determines that the current-level digital certificate is legal;

[0018] After the digital certificates at all levels of the certificate chain are generated and all digital certificates at all levels pass the legitimacy verification, the certificate chain is obtained.

[0019] In some implementations, after a first-level digital certificate device holding a first-level digital certificate of a certificate chain generates a first-level digital certificate through a self-signed manner and verifies the signature of the first-level digital certificate, determining that the first-level digital certificate is valid and that the first-level digital certificate device has authority to issue digital certificates includes:

[0020] If the first-level digital certificate is a public key infrastructure certificate, the first-level digital certificate device is a certificate authority device. The first-level digital certificate device signs the local digital certificate information using the private key in the locally generated asymmetric key to obtain the first-level digital certificate. After the first-level digital certificate device verifies the signature of the first-level digital certificate using the public key in the locally generated asymmetric key, it determines that the first-level digital certificate is legitimate and that the first-level digital certificate device has the authority to issue digital certificates.

[0021] If the first-level digital certificate is a confidential computing certificate, the first-level digital certificate device is a confidential computing device with a confidential computing environment. The first-level digital certificate device signs the local digital certificate information with the private key of the asymmetric key generated in the local confidential computing environment to obtain the first-level digital certificate; after the first-level digital certificate device verifies the signature of the first-level digital certificate with the public key of the asymmetric key generated in the local confidential computing environment, it is determined that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates.

[0022] In some implementations, starting from a second-level digital certificate device that holds a second-level digital certificate in a certificate chain, after a current-level digital certificate device receives a current-level digital certificate issued by a previous-level digital certificate device and verifies the current-level digital certificate, determining that the current-level digital certificate is legitimate includes:

[0023] If the current-level digital certificate is a public key infrastructure certificate, the current-level digital certificate device receives the current-level digital certificate obtained by signing the local digital certificate information of the current-level digital certificate device using the private key in the asymmetric key generated by the previous-level digital certificate device, and verifies the current-level digital certificate using the public key in the asymmetric key generated by the previous-level digital certificate device. After the signature is passed, the current-level digital certificate is determined to be legal;

[0024] If the current-level digital certificate is a confidential computing certificate, the current-level digital certificate device uses the private key in the asymmetric key generated in the local confidential computing environment to self-sign the local digital certificate information of the current-level digital certificate device, receives the private key in the asymmetric key generated by the previous-level digital certificate device, signs the self-signed local digital certificate information to obtain the current-level digital certificate, uses the public key in the asymmetric key generated in the local confidential computing environment to self-sign the current-level digital certificate, and uses the public key in the asymmetric key generated by the previous-level digital certificate device to verify the current-level digital certificate. After the current-level digital certificate is self-signed and passed, and the current-level digital certificate is verified and passed using the public key in the asymmetric key generated by the previous-level digital certificate device, it is determined that the current-level digital certificate is legal.

[0025] In some implementations, the first-level digital certificate device signs the local digital certificate information using a private key of an asymmetric key generated in the local confidential computing environment, including:

[0026] After verifying the authenticity of the local confidential computing environment, the first-level digital certificate device signs the local digital certificate information using the private key of the asymmetric key generated in the local confidential computing environment.

[0027] In some implementations, the current-level digital certificate device uses a private key in an asymmetric key generated in a local confidential computing environment to self-sign the local digital certificate information of the current-level digital certificate device, including:

[0028] After the current-level digital certificate device verifies the authenticity of the local confidential computing environment, it uses the private key in the asymmetric key generated in the local confidential computing environment to self-sign the local digital certificate information of the current-level digital certificate device.

[0029] In some implementations, if the asymmetric key generated by the previous digital certificate device is an asymmetric key generated in a local confidential computing environment,

[0030] The current-level digital certificate device receives a current-level digital certificate obtained by signing the local digital certificate information of the current-level digital certificate device using the private key in the asymmetric key generated by the previous-level digital certificate device, including:

[0031] After the current-level digital certificate device triggers and passes the authenticity verification of the local confidential computing environment of the previous-level digital certificate device, the current-level digital certificate device obtains the private key in the asymmetric key generated in the local confidential computing environment of the previous-level digital certificate device to sign the local digital certificate information of the current-level digital certificate device to obtain the current-level digital certificate;

[0032] The current-level digital certificate device receives the private key in the asymmetric key generated by the previous-level digital certificate device and signs the local digital certificate information after self-signature processing to obtain the current-level digital certificate, including:

[0033] After the current-level digital certificate device triggers and passes the authenticity verification of the local confidential computing environment of the previous-level digital certificate device, it obtains the private key in the asymmetric key generated in the local confidential computing environment of the previous-level digital certificate device to sign the local digital certificate information after self-signature processing to obtain the current-level digital certificate.

[0034] In some implementations, verifying the authenticity of the local confidential computing environment includes:

[0035] The remote attestation data in the local digital certificate information of the device is sent to the device manufacturer to verify the authenticity of the local confidential computing environment.

[0036] In some implementations, the remote attestation data includes trustworthiness information of the device.

[0037] In some implementations, the remote attestation data includes a plaintext remote attestation data and a remote attestation data signature obtained by signing the plaintext remote attestation data using a hardware remote attestation private key of a local confidential computing environment of the device;

[0038] The remote attestation data plaintext includes the hash value of the public key in the asymmetric key generated in the local confidential computing environment of the device and the trust measurement information of the device.

[0039] In some implementations, after the first-level digital certificate device verifies the first-level digital certificate using the public key of the asymmetric key generated in the local confidential computing environment, determining that the first-level digital certificate is legitimate and that the first-level digital certificate device has the authority to issue digital certificates includes:

[0040] The first-level digital certificate device compares the calculated hash value of the entity public key in the confidential computing certificate and the public key hash value in the remote attestation data in the confidential computing certificate. After the first-level digital certificate is signed and verified by the entity public key, it is determined that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates.

[0041] In some implementations, the current-level digital certificate device uses a public key in an asymmetric key generated in a local confidential computing environment to perform self-signature verification on the current-level digital certificate, including:

[0042] The current-level digital certificate device compares and calculates the hash value of the entity public key in the confidential computing certificate and the public key hash value in the remote attestation data in the confidential computing certificate, and verifies the signature of the current-level digital certificate through the entity public key.

[0043] In some implementations, the digital certificate device generates a certificate chain for the target service, including:

[0044] If the current-level digital certificate has a signature from a higher-level digital certificate device, the current-level digital certificate device that owns the current-level digital certificate will verify the signature of the higher-level digital certificate device and determine that the current-level digital certificate is valid.

[0045] If the current-level digital certificate has multiple signatures from the previous-level digital certificate device, the current-level digital certificate device verifies a first preset number of signatures among the multiple signatures and determines that the current-level digital certificate is valid;

[0046] The first preset number is smaller than the number of signatures of the previous-level digital certificate device in the current-level digital certificate.

[0047] In some implementations, if the current-level digital certificate has multiple signatures from a previous-level digital certificate device, the current-level digital certificate device verifies a first predetermined number of signatures from the multiple signatures, and then determines that the current-level digital certificate is legitimate, including:

[0048] If the signatures of multiple upper-level digital certificate devices possessed by the current-level digital certificate include both public key infrastructure signatures and confidential computing signatures, the current-level digital certificate is determined to be legal after the current-level digital certificate device verifies a second preset number of public key infrastructure signatures from the multiple signatures and a third preset number of confidential computing signatures from the multiple signatures.

[0049] Among them, the second preset number is less than the number of public key infrastructure signatures of the previous level digital certificate device in the current level digital certificate, and the third preset number is less than the number of confidential computing signatures of the previous level digital certificate device in the current level digital certificate.

[0050] In some implementations, generating a digital certificate issuance request based on target business needs includes:

[0051] Determine the combination of public key infrastructure certificates and confidential computing certificates in the certificate chain based on the security requirements of the target business;

[0052] Determine the corresponding digital certificate device based on the combination of the public key infrastructure certificate and confidential computing certificate in the certificate chain;

[0053] Generate a digital certificate issuance request for each digital certificate device.

[0054] In some implementations, the method further includes:

[0055] After receiving an application request for a target service from a requesting device, the certificate chain is verified for legitimacy so that the requesting device can determine that the target service is legitimate after determining that the certificate chain is legitimate.

[0056] In some implementations, the method is applied to a server that performs a Hypertext Transfer Protocol Secure (HTTS) connection;

[0057] The digital certificate management method also includes:

[0058] After receiving the access request to the server sent by the client, the certificate chain corresponding to the server's Hypertext Transfer Protocol Security connection service is verified and passed, and then the last-level digital certificate of the certificate chain corresponding to the Hypertext Transfer Protocol Security connection service is sent to the client so that the client can verify the last-level digital certificate, so that after the client verifies the last-level digital certificate, it can determine that the Hypertext Transfer Protocol Security connection service is legal and establish a Hypertext Transfer Protocol Security channel with the server.

[0059] In some implementations, the method is applied to a file sending device;

[0060] The digital certificate management method also includes:

[0061] After receiving the legitimacy verification of the target file to be sent by the file receiving device, the digital certificates at all levels of the certificate chain are provided to the file receiving device, so that the file receiving device receives the target file after passing the legitimacy verification of the digital certificates at all levels of the certificate chain.

[0062] To solve the above technical problems, the present application also provides a digital certificate management method, including:

[0063] The business device generates a digital certificate issuance request based on the needs of the target business and sends the digital certificate issuance request to the digital certificate device;

[0064] The digital certificate device generates a certificate chain for the target business based on the digital certificate issuance request;

[0065] After the business device verifies the legitimacy of the certificate chain and passes it, it uses the certificate chain to deploy the target business;

[0066] The certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment.

[0067] To solve the above technical problems, the present application also provides a digital certificate management system, including: a business device and a digital certificate device;

[0068] The business device is used to generate a digital certificate issuance request based on the needs of the target business; send the digital certificate issuance request to the digital certificate device, so that the digital certificate device generates a certificate chain for the target business; after the certificate chain is verified to be legitimate, the target business is deployed using the certificate chain;

[0069] The certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment.

[0070] To solve the above technical problems, the present application also provides a digital certificate management device, comprising:

[0071] A request unit, configured to generate a digital certificate issuance request based on target business requirements;

[0072] A sending unit, configured to send a digital certificate issuance request to a digital certificate device, so that the digital certificate device generates a certificate chain for a target service;

[0073] The deployment unit is used to deploy the target business using the certificate chain after the certificate chain passes the validity verification;

[0074] The certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment.

[0075] To solve the above technical problems, the present application also provides a digital certificate management device, including:

[0076] memory for storing computer programs;

[0077] The processor is used to execute a computer program, and when the computer program is executed by the processor, the steps of any one of the above-mentioned digital certificate management methods are implemented.

[0078] To solve the above technical problems, the present application also provides a non-volatile readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above digital certificate management methods are implemented.

[0079] The digital certificate management method provided in this application generates a digital certificate issuance request according to the needs of the target business, and sends the digital certificate issuance request to the digital certificate device so that the digital certificate device generates a certificate chain for the target business, and the certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment; the certificate chain composed of a hybrid digital certificate consisting of a public key infrastructure certificate and a confidential computing certificate increases the trusted parties in the certificate chain compared to a single public key infrastructure certificate or a certificate chain consisting only of a public key infrastructure certificate in the related art, that is, in addition to the certificate authority, a trusted execution environment for generating confidential computing certificates is introduced as one of the trusted parties, thereby reducing the security dependence on the certificate authority, improving the security of the certificate chain, and further improving the security of the certificate owner and the security of the certificate user. The target business is deployed after the certificate chain is verified and passed, thereby improving the security of the target business.

[0080] In the digital certificate management method provided in the present application, at least one level of digital certificate in the certificate chain can include a public key infrastructure certificate and a confidential computing certificate, so as to further improve the security of a single-level digital certificate on the basis that all levels of digital certificates are of a single type of digital certificate, thereby improving the security of the entire certificate chain, and improving the security of the certificate owner and the security of the certificate user.

[0081] The digital certificate management method provided in this application obtains a more secure digital certificate signature scheme by having the confidential computing device in the digital certificate device first self-sign the current level confidential computing certificate, and then having the digital certificate device at the previous level sign it.

[0082] The present application also provides a digital certificate management device, equipment, system and non-volatile readable storage medium, which have the above-mentioned beneficial effects and are not repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0083] In order to more clearly illustrate the embodiments of the present application or the technical solutions of the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0084] FIG1 is a schematic diagram of the structure of a digital certificate management system provided in an embodiment of the present application;

[0085] FIG2 is a flow chart of a digital certificate management method provided in an embodiment of the present application;

[0086] FIG3 is a flow chart of a digital certificate device generating a certificate chain for a target service according to an embodiment of the present application;

[0087] FIG4 is a schematic diagram of a first certificate chain scenario provided in an embodiment of the present application;

[0088] FIG5 is a schematic diagram of a second certificate chain scenario provided in an embodiment of the present application;

[0089] FIG6 is a schematic diagram of a third certificate chain scenario provided in an embodiment of the present application;

[0090] FIG7 is a schematic diagram of a fourth certificate chain scenario provided in an embodiment of the present application;

[0091] FIG8 is a schematic diagram of a fifth certificate chain scenario provided in an embodiment of the present application;

[0092] FIG9 is a schematic diagram of a sixth certificate chain scenario provided in an embodiment of the present application;

[0093] FIG10 is a schematic diagram of the structure of a digital certificate management device provided in an embodiment of the present application;

[0094] FIG11 is a schematic structural diagram of a digital certificate management device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0095] The core of this application is to provide a digital certificate management method, device, equipment, system and non-volatile readable storage medium for improving the security of the digital certificate management system, thereby improving the security of the certificate owner and the security of the certificate user.

[0096] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0097] The following describes the first embodiment of the present application.

[0098] FIG1 is a schematic diagram of the structure of a digital certificate management system provided in an embodiment of the present application.

[0099] To facilitate understanding, the digital certificate management system and related definitions provided by this application are first introduced.

[0100] As shown in FIG1 , the digital certificate management system provided in the embodiment of the present application includes: a business device 101 and a digital certificate device 102;

[0101] The service device 101 is used to generate a digital certificate issuance request according to the needs of the target service; send the digital certificate issuance request to the digital certificate device 102, so that the digital certificate device 102 generates a certificate chain for the target service; after the certificate chain is verified to be legitimate, the target service is deployed using the certificate chain;

[0102] The certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment.

[0103] There are two main types of digital certificates: Public Key Infrastructure (PKI) certificates issued by a Certificate Authority (CA) and confidential computing certificates generated based on a Trusted Execution Environment (TEE).

[0104] A complete public key infrastructure (PKI) consists of a Certificate Authority (CA), a Registration Authority (RA), an issuance system, a key management platform, and an Application Programming Interface (API). In this embodiment of the application, a digital certificate issued by a certificate authority is defined as a PKI certificate.

[0105] A trusted execution environment is a secure area built in the central processing unit through software and hardware methods to ensure that the programs and data loaded inside it are protected in terms of confidentiality and integrity. The device that builds the trusted execution environment needs to be pre-installed with an integrated commercial central processing unit computing chip. In related technologies, a trusted self-signed certificate can be constructed in the trusted execution environment, and the hardware trusted execution environment can be used as a hardware trusted root to strongly bind the certificate to the hardware environment, eliminating the influence of the public certificate authority. In the embodiment of the present application, a device with a trusted execution environment is defined as a confidential computing device, and the certificate constructed in the trusted execution environment is defined as a confidential computing certificate.

[0106] The owner of a digital certificate can be a person, organization, or website, and can be deployed on a device.

[0107] In the related art, for requests to generate certificates, the digital certificate management system often provides a single type of digital certificate, that is, either providing a single public key infrastructure certificate or a certificate chain consisting of multiple public key infrastructure certificates, or generating a confidential computing certificate based on a trusted execution environment. It is understandable that since the confidential computing certificate generated based on the trusted execution environment binds the credibility of the certificate to the hardware environment, it is more secure than the public key infrastructure certificate issued by a third-party certificate authority. However, relying solely on confidential computing certificates still depends on trust in the hardware environment. Therefore, in an embodiment of the present application, a hybrid data certificate solution is provided. For requests to generate certificates, a certificate chain containing a hybrid digital certificate is generated, that is, the certificate chain contains both a public key infrastructure certificate and a confidential computing certificate. In the certificate chain generated by the digital certificate management system provided in the embodiment of the present application, compared with the single type of digital certificate in the related art, the trust system is expanded from a single trust system to two trust systems, which reduces the dependence on a single trust system, thereby further improving the security of the certificate chain, and the security of the certificate owner and the security of the certificate user are also further improved.

[0108] It should be noted that in this embodiment of the present application, the digital certificate device 102 and the business device 101 together constitute the digital certificate devices 102 corresponding to the digital certificates at each level of the certificate chain. That is, the business device 101 exists as the last level of digital certificate device 102, and the digital certificate devices 102 at each level hold corresponding digital certificates. The certificate chain includes at least two levels of digital certificates. In other words, in addition to the business device 101, it includes at least one digital certificate device 102 that cooperates in generating the certificate chain. A first-level digital certificate can include multiple digital certificates. In this embodiment of the present application, "level" represents a link in the certificate chain.

[0109] When the business device 101 has a need to deploy a target business, it needs to obtain a digital certificate corresponding to the target business. The combination of different types of digital certificates in the certificate chain can be determined according to the security level of the target business, and then the digital certificate issuance request is sent to the digital certificate devices 102 at each level accordingly. The process of the digital certificate device 102 generating a certificate chain starts from the first-level digital certificate device 102, which first generates a root certificate obtained by self-signature. After the first-level certificate device verifies the signature by itself, it issues a second-level digital certificate to the second-level digital certificate device 102. The second-level digital certificate device 102 confirms the legality of the second-level digital certificate after passing the second-level digital certificate. If there is still a third-level digital certificate device 102, the step of issuing a third-level digital certificate to the third-level digital certificate device 102 is continued. If the second-level digital certificate device 102 is the business device 101, then after the business device 101 receives the second-level digital certificate and verifies the signature, it uses the legal second-level digital certificate to cooperate in deploying the target business. When the business demander wants to use the target business, the business demander obtains the digital certificates at all levels in the certificate chain corresponding to the target business and verifies the signatures step by step. After passing the verification step by step, it is determined that the target business is legal and can be used.

[0110] With reference to the above-mentioned digital certificate management system, the digital certificate management method provided in the embodiment of the present application is described below in conjunction with the accompanying drawings.

[0111] The second embodiment of the present application is described below.

[0112] FIG2 is a flowchart of a digital certificate management method provided in an embodiment of the present application.

[0113] As shown in FIG2 , the digital certificate management method provided in the embodiment of the present application includes:

[0114] S201: Generate a digital certificate issuance request based on the needs of the target business.

[0115] S202: Send a digital certificate issuance request to a digital certificate device so that the digital certificate device generates a certificate chain for the target business; wherein the certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment.

[0116] S203: After the certificate chain is verified to be legitimate, the target service is deployed using the certificate chain.

[0117] In specific implementation, the digital certificate management method provided in the embodiment of the present application can be applied to individual user devices or collective user devices, for example, it can be applied to a file sending device or a service server. In the embodiment of the present application, the steps of the digital certificate management method provided in the embodiment of the present application are defined as being executed by a target device.

[0118] When a service server launches a service, it needs a digital certificate to ensure the legitimacy of the service before deploying it. When a file sending device sends a file, such as user A sending a file to user B, the file sent by user A must have a valid digital certificate to ensure its legitimacy. Digital certificates can also be used as a legitimacy verification tool in data encryption and decryption scenarios.

[0119] In S201, the target services may include, but are not limited to, the services offered by the service server mentioned above, the file sending requirements of file sending devices, and data encryption and decryption services. A digital certificate issuance request is generated based on the needs of the target services. Specifically, when combining public infrastructure certificates and confidential computing certificates, various types of digital certificates can be generated based on different scenarios, requirements, and security levels, providing users with flexible choices.

[0120] In one implementation, S202: generating a digital certificate issuance request according to target business requirements may include:

[0121] Determine the combination of public key infrastructure certificates and confidential computing certificates in the certificate chain based on the security requirements of the target business;

[0122] Determine the corresponding digital certificate device based on the combination of the public key infrastructure certificate and confidential computing certificate in the certificate chain;

[0123] Generate a digital certificate issuance request for each digital certificate device.

[0124] Because confidential computing certificates offer higher security than public utility certificates, if the target business has high security requirements, more confidential computing certificates can be deployed in the certificate chain. However, because confidential computing certificates have hardware requirements for the devices they reside on and are expensive to generate, fewer confidential computing certificates can be deployed in the certificate chain if the target business has lower security requirements. To further enhance the security of the target business, the first-level digital certificate in the certificate chain can include multiple digital certificates, including those generated by various methods, to enhance the security of a single-level digital certificate and further improve the security of the certificate chain.

[0125] With respect to S202, as described in the previous embodiment of the present application, the device that generates the target business demand is the last-level digital certificate device corresponding to the certificate chain, and the previous-level digital certificate devices are all devices that generate and issue digital certificates. The business device sends a digital certificate issuance request to the digital certificate device so that the digital certificate device generates a certificate chain for the target business. The business device can first send a digital certificate issuance request to the digital certificate device at the previous level. The digital certificate issuance request carries information about the digital certificate devices at all levels corresponding to the entire certificate chain and the type of digital certificate to be generated, so that the digital certificate device at the previous level of the business device passes the digital certificate issuance request upward step by step, and then generates digital certificates step by step downward, forming a certificate chain. Alternatively, the business device can also send digital certificate issuance requests to digital certificate devices at all levels according to the corresponding digital certificate devices in the certificate chain. The digital certificate issuance request carries information about the digital certificate devices at all levels corresponding to the entire certificate chain and the type of digital certificate to be generated, so that the digital certificate device at the first level of the certificate chain generates digital certificates step by step downward, forming a certificate chain.

[0126] Based on the hybrid certificate solution provided in the embodiments of this application, the certificate chain includes at least one public key infrastructure certificate and one confidential computing certificate. For example, if the certificate chain includes two levels of digital certificates, each level corresponding to a digital certificate, then one of the two levels of digital certificates is a public key infrastructure certificate and the other is a confidential computing certificate.

[0127] In S203, during the certificate chain generation process, that is, the step-by-step digital certificate generation process, digital certificate legitimacy verification is performed. During the certificate chain generation process, the digital certificate issuer uses the private key in the asymmetric key to sign the digital certificate information, resulting in a digital certificate containing the plaintext digital certificate information and the corresponding digital signature. The digital certificate issuer then issues the digital certificate and the corresponding public key to the digital certificate owner. The digital certificate owner then uses the public key in the asymmetric key to verify the digital certificate signature. This involves decrypting the digital signature in the digital certificate using the public key and comparing it with the plaintext digital certificate information. If they match, the digital certificate is deemed valid; if not, it is deemed invalid. Signature verification is also performed step-by-step during the step-by-step digital certificate generation process. Each digital certificate at each level undergoes a signature verification process before the next digital certificate generation process can begin. Once all digital certificates at each level pass the legitimacy verification, a validated certificate chain is generated, which can then be used to deploy digital certificates for the target service.

[0128] Digital certificate information may include, but is not limited to, information about the certificate issuer, the certificate owner, and user-defined extensions. A confidential computing certificate also includes the certificate owner's public key and the certificate owner's remote attestation device.

[0129] The digital certificate management cycle includes not only the digital certificate generation process but also the digital certificate usage process. The digital certificate management method provided in the embodiments of the present application may further include: upon receiving an application request for a target service from a requesting device, performing a validity verification on the certificate chain so that the requesting device can determine the target service is legitimate after confirming the validity of the certificate chain.

[0130] In the embodiment of the present application, the digital certificate user is defined as the requesting device that wants to apply the target service. When the service device provides the target service to the requesting device, or the requesting device requests the service device to use the target service, the requesting device needs to verify the legitimacy of the certificate chain corresponding to the target service. The legitimacy verification process is similar to the legitimacy verification process when generating the certificate chain. By verifying the signatures step by step, when it is determined that the digital certificates at all levels of the certificate chain are legal, the requesting device and the service device complete the handshake and can use the target service.

[0131] The digital certificate management method provided in the embodiment of the present application generates a digital certificate issuance request according to the needs of the target business, and sends the digital certificate issuance request to the digital certificate device so that the digital certificate device generates a certificate chain for the target business, and the certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment; the certificate chain composed of a hybrid digital certificate consisting of a public key infrastructure certificate and a confidential computing certificate increases the trusted parties in the certificate chain compared to a single public key infrastructure certificate or a certificate chain consisting only of a public key infrastructure certificate in the related art, that is, in addition to the certificate authority, a trusted execution environment for generating confidential computing certificates is introduced as one of the trusted parties, thereby reducing the security dependence on the certificate authority, improving the security of the certificate chain, and further improving the security of the certificate owner and the security of the certificate user. The target business is deployed after the certificate chain is verified and passed, thereby improving the security of the target business.

[0132] The third embodiment of the present application is described below.

[0133] In the above embodiment, in order to further enhance the security of the certificate chain, in addition to including at least one public key infrastructure certificate and one confidential computing certificate in the certificate chain, the security of the certificate chain can also be enhanced by including multiple digital certificates in the primary digital certificate. The primary digital certificate can also be a hybrid digital certificate solution.

[0134] Based on the above embodiments, in the digital certificate management method provided in the embodiments of the present application, it can be set that at least one level of digital certificate in the certificate chain includes a public key infrastructure certificate and a confidential computing certificate.

[0135] In the digital certificate management method provided in the present application, at least one level of digital certificate in the certificate chain can include a public key infrastructure certificate and a confidential computing certificate, so as to further improve the security of a single-level digital certificate on the basis that all levels of digital certificates are of a single type of digital certificate, thereby improving the security of the entire certificate chain, and improving the security of the certificate owner and the security of the certificate user.

[0136] The fourth embodiment of the present application is described below.

[0137] FIG3 is a flow chart of a digital certificate device generating a certificate chain for a target business provided by an embodiment of the present application.

[0138] Based on the above embodiment, the embodiment of the present application further illustrates the process of generating a certificate chain.

[0139] In the digital certificate management method provided in the embodiment of the present application, in S202, the digital certificate device generates a certificate chain for the target service, including:

[0140] S301: The first-level digital certificate device for holding the first-level digital certificate of the certificate chain generates a first-level digital certificate by self-signing and verifies the signature of the first-level digital certificate, thereby determining that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates.

[0141] S302: Starting from the second-level digital certificate device for holding the second-level digital certificate of the certificate chain, the current-level digital certificate device receives the current-level digital certificate issued by the previous-level digital certificate device and verifies the signature of the current-level digital certificate, and determines that the current-level digital certificate is legal.

[0142] S303: After the digital certificates at all levels of the certificate chain are generated and all digital certificates at all levels pass the validity verification, the certificate chain is obtained.

[0143] In a specific implementation, for S301, the owner of the first-level digital certificate corresponding to the certificate chain is the first-level digital certificate device. The first-level digital certificate device generates a first-level digital certificate through self-signing, which serves as the root certificate of the certificate chain. The first-level digital certificate device independently verifies the signature of the first-level digital certificate. If the signature verifies, it determines that the first-level digital certificate is legitimate and that the first-level digital certificate device has the authority to issue digital certificates.

[0144] S301: A first-level digital certificate device holding a first-level digital certificate in a certificate chain generates a first-level digital certificate by self-signing and verifies the first-level digital certificate. After the first-level digital certificate passes the signature verification, it is determined that the first-level digital certificate is valid and that the first-level digital certificate device has the authority to issue digital certificates. This may include:

[0145] If the first-level digital certificate is a public key infrastructure certificate, the first-level digital certificate device is a certificate authority device. The first-level digital certificate device signs the local digital certificate information using the private key in the locally generated asymmetric key to obtain the first-level digital certificate. After the first-level digital certificate device verifies the signature of the first-level digital certificate using the public key in the locally generated asymmetric key, it determines that the first-level digital certificate is legitimate and that the first-level digital certificate device has the authority to issue digital certificates.

[0146] If the first-level digital certificate is a confidential computing certificate, the first-level digital certificate device is a confidential computing device with a confidential computing environment. The first-level digital certificate device signs the local digital certificate information with the private key of the asymmetric key generated in the local confidential computing environment to obtain the first-level digital certificate; after the first-level digital certificate device verifies the signature of the first-level digital certificate with the public key of the asymmetric key generated in the local confidential computing environment, it is determined that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates.

[0147] The public key infrastructure certificate in the first-level digital certificate is generated and issued by a certificate authority. When acting as a first-level digital certificate, the first-level digital certificate device should be a certificate authority device, thereby automatically generating a first-level public key infrastructure certificate. During the generation process, the first-level digital certificate device locally generates a pair of asymmetric keys and uses the private key to sign the plaintext of the local digital certificate information, obtaining a first-level digital certificate containing the plaintext of the local digital certificate information and the digital signature of the local digital certificate information. The first-level digital certificate device then verifies the signature of the first-level digital certificate using the public key in the aforementioned asymmetric key. If the signature is verified, the first-level digital certificate is deemed legitimate, and the first-level digital certificate device can now issue a digital certificate to the second-level digital certificate device.

[0148] The confidential computing certificate in the first-level digital certificate should be generated based on a local precision computing environment, so the first-level digital certificate device should be a confidential computing device with a confidential computing environment. During the generation process, the first-level confidential computing device generates a pair of asymmetric keys in the local precision computing environment, and uses the private key therein to sign the plaintext of the local digital certificate information, thereby obtaining a first-level digital certificate containing the plaintext of the local digital certificate information and the digital signature of the local digital certificate information. The first-level precision computing device then verifies the signature of the first-level digital certificate using the public key in the above-mentioned asymmetric key. If the signature is passed, it is determined that the first-level digital certificate is legal, and at this point the first-level digital certificate device can issue a digital certificate to the second-level digital certificate device.

[0149] To ensure that the confidential computing certificate in the first-level digital certificate is generated in a confidential computing environment, the authenticity of the local confidential computing environment must be verified. The first-level digital certificate device then signs the local digital certificate information using the private key of the asymmetric key generated in the local confidential computing environment. This may include: after the first-level digital certificate device verifies the authenticity of the local confidential computing environment, the first-level digital certificate device signs the local digital certificate information using the private key of the asymmetric key generated in the local confidential computing environment. It should be noted that the steps of verifying the authenticity of the local confidential computing environment by the first-level digital certificate device and signing the local digital certificate information using the private key of the asymmetric key generated in the local confidential computing environment can be performed in any order. The steps of verifying the authenticity of the local confidential computing environment by the first-level digital certificate device and verifying the signature of the first-level digital certificate using the public key of the locally generated asymmetric key can also be performed in any order. That is, after the first-level digital certificate device verifies the authenticity of the local confidential computing environment and verifies the signature of the first-level digital certificate using the public key of the locally generated asymmetric key, it can be determined that the first-level digital certificate is legitimate and that the first-level digital certificate device has the authority to issue digital certificates. With respect to S302, in the embodiment of the present application, starting from the second-level digital certificate in the certificate chain, the generation of digital certificates at all levels requires the assistance of the digital certificate device at the previous level. The current-level digital certificate device provides its local digital certificate information to the digital certificate device at the previous level. The digital certificate device at the previous level uses the public key in the locally generated asymmetric key to sign the local digital certificate information of the current-level digital certificate device, obtaining the current-level digital certificate. The current-level digital certificate and the corresponding public key are then provided to the current-level digital certificate device. The current-level digital certificate device uses the public key to verify the signature of the current-level digital certificate, and after the signature is passed, the current-level digital certificate is determined to be legal.

[0150] S302: Starting from the second-level digital certificate device that holds the second-level digital certificate in the certificate chain, the current-level digital certificate device receives the current-level digital certificate issued by the previous-level digital certificate device and verifies the signature of the current-level digital certificate. After that, the current-level digital certificate is determined to be valid. This may include:

[0151] If the current-level digital certificate is a public key infrastructure certificate, the current-level digital certificate device receives the current-level digital certificate obtained by signing the local digital certificate information of the current-level digital certificate device using the private key in the asymmetric key generated by the previous-level digital certificate device, and verifies the current-level digital certificate using the public key in the asymmetric key generated by the previous-level digital certificate device. After the signature is passed, the current-level digital certificate is determined to be legal;

[0152] If the current-level digital certificate is a confidential computing certificate, the current-level digital certificate device uses the private key in the asymmetric key generated in the local confidential computing environment to self-sign the local digital certificate information of the current-level digital certificate device, receives the private key in the asymmetric key generated by the previous-level digital certificate device, signs the self-signed local digital certificate information to obtain the current-level digital certificate, uses the public key in the asymmetric key generated in the local confidential computing environment to self-sign the current-level digital certificate, and uses the public key in the asymmetric key generated by the previous-level digital certificate device to verify the current-level digital certificate. After the current-level digital certificate is self-signed and passed, and the current-level digital certificate is verified and passed using the public key in the asymmetric key generated by the previous-level digital certificate device, it is determined that the current-level digital certificate is legal.

[0153] The public key infrastructure certificate in the non-first-level digital certificate is completely signed and issued by the previous-level digital certificate device. During the generation process, the current-level digital certificate device provides the local digital certificate information to the previous-level digital certificate device, and the previous-level digital certificate device uses the private key in the locally generated asymmetric key to sign the local digital certificate information of the current-level digital certificate device, and obtains the current-level digital certificate containing the local digital certificate information plaintext of the current-level digital certificate device and the digital signature of the local digital certificate information of the current-level digital certificate device. The previous-level digital certificate device sends the current-level digital certificate and the corresponding public key to the current-level digital certificate device. The current-level digital certificate device verifies the signature of the current-level digital certificate with the public key, and determines that the current-level digital certificate is legal after passing. If the current-level digital certificate device is a business device, the certificate chain is generated; if the current-level digital certificate device is not a business device, the current-level digital certificate device continues to issue digital certificates for the next-level digital certificate device.

[0154] The confidential computing certificate in the non-first-level digital certificate is self-signed by the current-level digital certificate device and signed using the private key of the previous-level digital certificate device. During the generation process, the current-level digital certificate device generates a pair of asymmetric keys in the local confidential computing environment, and uses the private key therein to sign the plaintext of the local digital certificate information, thereby obtaining local digital certificate information containing the plaintext of the local digital certificate information and the digital signature of the local digital certificate information. The current-level digital certificate device then signs the self-signed local digital certificate information using the private key in the asymmetric key generated by the previous-level digital certificate device, thereby obtaining a current-level digital certificate containing the self-signature and the previous-level signature. When verifying the signature, the current-level digital certificate device uses the corresponding public key in the local confidential computing environment to verify the self-signature in the current-level digital certificate, and uses the public key provided by the previous-level digital certificate device to verify the previous-level signature in the current-level digital certificate.

[0155] It can be seen that the embodiment of the present application provides a new confidential computing certificate solution, that is, the confidential computing certificate contains both a self-signature and a previous-level signature, which is more secure than the confidential computing certificate in the related technology.

[0156] In order to ensure that the confidential computing certificate in the current-level digital certificate is generated in a confidential computing environment, the authenticity of the local confidential computing environment needs to be verified. The current-level digital certificate device then uses the private key in the asymmetric key generated in the local confidential computing environment to self-sign the local digital certificate information of the current-level digital certificate device, which can include: after the current-level digital certificate device verifies the authenticity of the local confidential computing environment, it uses the private key in the asymmetric key generated in the local confidential computing environment to self-sign the local digital certificate information of the current-level digital certificate device. By verifying the authenticity of the local confidential computing environment before self-signing, and then using the private key in the asymmetric key generated in the local confidential computing environment to self-sign after passing the authenticity verification, the security of generating the confidential computing certificate is further improved. It should be noted that the step of the current-level digital certificate device verifying the authenticity of the local confidential computing environment and the step of the current-level digital certificate device signing the local digital certificate information using the private key of the asymmetric key generated in the local confidential computing environment may have no sequential relationship, and the step of the current-level digital certificate device verifying the authenticity of the local confidential computing environment and the step of the current-level digital certificate device verifying the signature of the current-level digital certificate using the public key in the locally generated asymmetric key may also have no sequential relationship, that is, the current-level digital certificate can be determined to be legal after the current-level digital certificate device verifies the authenticity of the local confidential computing environment and verifies the signature of the current-level digital certificate using the public key in the locally generated asymmetric key.

[0157] Regardless of the type of the current-level digital certificate, it needs to be signed by the upper-level digital certificate device. If the asymmetric key provided by the upper-level digital certificate device for signing and verifying is generated in a confidential computing environment, the authenticity of the local confidential computing environment should also be verified for the upper-level digital certificate device on the upper-level digital signature device.

[0158] If the asymmetric key generated by the previous-level digital certificate device is an asymmetric key generated in a local confidential computing environment, the current-level digital certificate device receives the current-level digital certificate obtained by signing the local digital certificate information of the current-level digital certificate device with the private key in the asymmetric key generated by the previous-level digital certificate device. It can include: after the current-level digital certificate device triggers and passes the authenticity verification of the local confidential computing environment of the previous-level digital certificate device, it obtains the private key in the asymmetric key generated in the local confidential computing environment of the previous-level digital certificate device to sign the local digital certificate information of the current-level digital certificate device to obtain the current-level digital certificate.

[0159] If the asymmetric key generated by the previous-level digital certificate device is an asymmetric key generated in a local confidential computing environment, the current-level digital certificate device receives the private key in the asymmetric key generated by the previous-level digital certificate device to sign the local digital certificate information after self-signature processing to obtain the current-level digital certificate, which may include: after the current-level digital certificate device triggers and passes the authenticity verification of the local confidential computing environment of the previous-level digital certificate device, obtaining the private key in the asymmetric key generated in the local confidential computing environment of the previous-level digital certificate device to sign the local digital certificate information after self-signature processing to obtain the current-level digital certificate.

[0160] That is to say, if the previous-level digital certificate device uses the private key in the asymmetric key generated in the confidential computing environment to sign the digital certificate for the current-level digital certificate device, the authenticity of the confidential computing environment of the previous-level digital certificate device must be verified first, and then the current-level digital certificate issued by the previous-level digital certificate device is received.

[0161] In some implementations, after the first-level digital certificate is verified by the public key of the asymmetric key generated in the local confidential computing environment, the first-level digital certificate is determined to be legal and the first-level digital certificate device has the authority to issue digital certificates. This may include: the first-level digital certificate device compares the calculated hash value of the entity public key in the confidential computing certificate and the public key hash value in the remote certification data in the confidential computing certificate to be consistent, and after the first-level digital certificate is verified by the entity public key, it is determined that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates. Remote attestation data is data in the confidential computing certificate used to verify the authenticity of the local confidential computing environment of the device. When the first-level digital certificate device generates the first-level digital certificate, it places the hash value of the public key in the asymmetric key generated based on the confidential computing environment in the remote attestation data. The legitimacy of the public key hash value can be verified when the authenticity of the local confidential computing environment of the first-level digital certificate device is remotely attested. When the first-level digital certificate device verifies the local confidential computing certificate, after remotely attesting the authenticity of the local confidential computing environment, it compares the calculated hash value of the entity public key in the confidential computing certificate and the public key hash value in the remote attestation data in the confidential computing certificate. After the first-level digital certificate is verified and passed by the entity public key, it is determined that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates.

[0162] Similarly, the current-level digital certificate device uses the public key in the asymmetric key generated in the local confidential computing environment to perform self-signed verification on the current-level digital certificate. This may include: the current-level digital certificate device compares the calculated hash value of the entity's public key in the confidential computing certificate with the hash value of the public key in the remote attestation data in the confidential computing certificate, and verifies the current-level digital certificate using the entity's public key. When generating the current-level digital certificate, the current-level digital certificate device places the hash value of the public key in the asymmetric key generated based on the confidential computing environment in the remote attestation data, thereby verifying the legitimacy of the public key hash value when remotely attesting the authenticity of the local confidential computing environment of the current-level digital certificate device. When verifying the local confidential computing certificate, after remotely attesting the authenticity of the local confidential computing environment, the current-level digital certificate device compares the calculated hash value of the entity's public key in the confidential computing certificate with the hash value of the public key in the remote attestation data in the confidential computing certificate, and verifies the current-level digital certificate using the entity's public key. This confirms that the current-level digital certificate is legitimate and that the current-level digital certificate device has the authority to issue digital certificates.

[0163] For the verification of the self-signature in the confidential computing certificate, if the existence of the local confidential computing environment is proved by remote attestation data, and the public key carried in the confidential computing certificate is consistent with the public key hash value in the remote attestation data, it can be determined that the confidential computing certificate was generated in the local confidential computing environment, and then the self-signature in the confidential computing certificate can be verified using the public key.

[0164] The same applies to signing and verifying the asymmetric key generated in the confidential computing environment provided by the upper-level confidential computing device. After the current-level digital certificate device triggers the upper-level digital certificate device to verify the authenticity of the local confidential computing environment, the upper-level digital certificate device completes the above steps and passes the authenticity verification of the local confidential computing environment and the consistency verification of the entity public key. It can then sign or verify the current-level digital certificate performed by the upper-level confidential computing device, thereby further improving the security of the digital certificate.

[0165] The digital certificate management method provided in the embodiment of the present application first self-signs the confidential computing certificate of the current level by the confidential computing device in the digital certificate device, and then signs it by the digital certificate device of the previous level, thereby obtaining a more secure digital certificate signature scheme.

[0166] The fifth embodiment of the present application is described below.

[0167] Based on the above embodiments, the embodiments of the present application further illustrate a method for verifying the authenticity of a local confidential computing environment of a confidential computing device.

[0168] In the digital certificate management method provided in the embodiment of the present application, authenticity verification of the local confidential computing environment may include: sending remote certification data in the local digital certificate information of the device to the device manufacturer to verify the authenticity of the local confidential computing environment.

[0169] The remote attestation data includes the device's trusted measurement information, such as the device's hardware trusted measurement information. The device manufacturer uses the trusted measurement information in the remote attestation data to identify the device as having a confidential computing environment and provides feedback to the device confirming the authenticity of the local confidential computing environment.

[0170] To further improve the reliability of authenticity verification, the remote attestation data may include the remote attestation data plaintext and the remote attestation data signature obtained by signing the remote attestation data plaintext using the hardware remote attestation private key of the local confidential computing environment of the device. The remote attestation data plaintext includes the hash value of the public key in the asymmetric key generated in the local confidential computing environment of the device and the trust measurement information of the device. Once the device manufacturer verifies the remote attestation data using the remote attestation public key of the local confidential computing environment of the device and passes the signature, it can be determined that the device has passed the authenticity verification and feedback to the device indicates that the local confidential computing environment is authentic.

[0171] The sixth embodiment of the present application is described below.

[0172] In the above embodiment, it is introduced that the first-level digital certificate of the certificate chain can include one digital certificate or multiple digital certificates. The situation of including multiple digital certificates can further improve the security of the certificate chain. A digital certificate device with multiple digital certificates can add multiple signatures when issuing a certificate to a digital certificate device at the next level, that is, the signatures correspond one to one with the digital certificate device that issued the certificate. If the current-level digital certificate has multiple signatures of the digital certificate device at the previous level, when verifying the signature, it can be set that the current-level digital certificate must be confirmed to be legitimate only by verifying all signatures, or it can be set that the current-level digital certificate is confirmed to be legitimate only by verifying some signatures.

[0173] In the digital certificate management method provided in the embodiment of the present application, the digital certificate device generates a certificate chain for the target service in S202, which may include:

[0174] If the current-level digital certificate has a signature from a higher-level digital certificate device, the current-level digital certificate device that owns the current-level digital certificate will verify the signature of the higher-level digital certificate device and determine that the current-level digital certificate is valid.

[0175] If the current-level digital certificate has multiple signatures from the previous-level digital certificate device, the current-level digital certificate device verifies a first preset number of signatures among the multiple signatures and determines that the current-level digital certificate is valid;

[0176] The first preset number is smaller than the number of signatures of the previous-level digital certificate device in the current-level digital certificate.

[0177] In specific implementation, the embodiment of the present application adopts a threshold signature verification method for the situation where the current-level digital certificate has signatures of multiple upper-level digital certificate devices. That is, the current-level digital certificate can be determined to be legal after the signatures of only some of the upper-level digital certificate devices are verified.

[0178] Considering that the first-level digital certificate provided in the above-mentioned embodiment of this application includes a public key infrastructure certificate and a confidential computing certificate, if the previous-level digital certificate device possesses both a public key infrastructure certificate and a confidential computing certificate, the previous-level digital certificate device can perform both a public key infrastructure signature and a confidential computing signature on the current-level digital certificate. In this case, a threshold can be set to distinguish between the signature types. If the current-level digital certificate has signatures from multiple previous-level digital certificate devices, the current-level digital certificate device verifies that the current-level digital certificate is legitimate after verifying a first preset number of signatures among the multiple signatures, including:

[0179] If the signatures of multiple upper-level digital certificate devices possessed by the current-level digital certificate include both public key infrastructure signatures and confidential computing signatures, the current-level digital certificate is determined to be legal after the current-level digital certificate device verifies a second preset number of public key infrastructure signatures from the multiple signatures and a third preset number of confidential computing signatures from the multiple signatures.

[0180] Among them, the second preset number is less than the number of public key infrastructure signatures of the previous level digital certificate device in the current level digital certificate, and the third preset number is less than the number of confidential computing signatures of the previous level digital certificate device in the current level digital certificate.

[0181] It should be noted that if the previous-level digital certificate device has multiple previous-level digital certificates, multiple pairs of corresponding asymmetric keys can be generated for signing and verifying the current-level digital certificate, but not all private keys need to be used for signing the current-level digital certificate.

[0182] The seventh embodiment of the present application is described below.

[0183] Figure 4 is a schematic diagram of the first certificate chain scenario provided by an embodiment of the present application; Figure 5 is a schematic diagram of the second certificate chain scenario provided by an embodiment of the present application; Figure 6 is a schematic diagram of the third certificate chain scenario provided by an embodiment of the present application; Figure 7 is a schematic diagram of the fourth certificate chain scenario provided by an embodiment of the present application; Figure 8 is a schematic diagram of the fifth certificate chain scenario provided by an embodiment of the present application; Figure 9 is a schematic diagram of the sixth certificate chain scenario provided by an embodiment of the present application.

[0184] Based on the above embodiments, the embodiments of the present application use two adjacent levels of digital certificates in a certificate chain to illustrate the scenarios, which can specifically include six scenarios.

[0185] As shown in Figure 4, in the first scenario, corresponding to the previous-level digital certificate device 401 and the current-level digital certificate device 402, the previous-level digital certificate and the current-level digital certificate can both be public key infrastructure certificates. If the previous-level digital certificate is the first-level digital certificate in the certificate chain, the previous-level digital certificate is a self-signed public key infrastructure certificate, and the current-level digital certificate is signed by the private key provided by the previous-level digital certificate device 401 and verified by the public key provided by the previous-level digital certificate device 401. If the previous-level digital certificate is not the first-level digital certificate in the certificate chain, it will be issued by the next-level digital certificate device according to the certificate type. If the current-level digital certificate is not a business certificate, a next-level digital certificate can be derived to extend the certificate chain. The next-level digital certificate can be a public key infrastructure certificate or a confidential computing certificate.

[0186] As shown in Figure 5, in the second scenario, corresponding to the previous-level digital certificate device 401 and the current-level digital certificate device 402, the previous-level digital certificate is a public key infrastructure certificate, and the current-level digital certificate is a confidential computing certificate. If the previous-level digital certificate is the first-level digital certificate in the certificate chain, then the previous-level digital certificate is a self-signed public key infrastructure certificate. The current-level confidential computing certificate is generated in a local confidential computing environment, self-signed by the private key in the asymmetric key generated by the local confidential computing environment, and then signed by the previous-level digital certificate device 401 using the locally generated private key, ensuring the credibility of the current-level digital certificate and improving the efficiency of the current-level digital certificate. If the previous-level digital certificate is not the first-level digital certificate in the certificate chain, it will be issued by the next-level digital certificate device according to the certificate type. If the current-level digital certificate is not a business certificate, a next-level digital certificate can be derived to extend the certificate chain. The next-level digital certificate can be a public key infrastructure certificate or a confidential computing certificate.

[0187] As shown in Figure 6, in the third scenario, corresponding to the previous-level digital certificate device 401 and the current-level digital certificate device 402, the previous-level digital certificate and the current-level digital certificate are both confidential computing certificates. If the previous-level digital certificate is the first-level digital certificate in the certificate chain, then the previous-level digital certificate is a self-signed confidential computing certificate, specifically generated by the confidential computing environment of the previous-level digital certificate device 401. The current-level confidential computing certificate is generated in a local confidential computing environment, self-signed by the private key in the asymmetric key generated by the local confidential computing environment, and then signed by the previous-level digital certificate device 401 using the locally generated private key. If the previous-level digital certificate is not the first-level digital certificate in the certificate chain, it will be issued by the next-level digital certificate device according to the certificate type. If the current-level digital certificate is not a business certificate, a next-level digital certificate can be derived to extend the certificate chain. The next-level digital certificate can be a public key infrastructure certificate or a confidential computing certificate.

[0188] As shown in Figure 7, in the fourth scenario, corresponding to the previous-level digital certificate device 401 and the current-level digital certificate device 402, the previous-level digital certificate is a confidential computing certificate, and the current-level digital certificate is a public key infrastructure certificate. If the previous-level digital certificate is the first-level digital certificate in the certificate chain, then the previous-level digital certificate is a self-signed confidential computing certificate, specifically generated by the confidential computing environment of the previous-level digital certificate device 401. The current-level confidential computing certificate is generated in a local confidential computing environment, self-signed by the private key in the asymmetric key generated by the local confidential computing environment, and then signed by the previous-level digital certificate device 401 using the locally generated private key. If the previous-level digital certificate is not the first-level digital certificate in the certificate chain, it will be issued by the next-level digital certificate device according to the certificate type. When the current-level digital certificate is not a business certificate, a next-level digital certificate can be derived to extend the certificate chain. The next-level digital certificate can be a public key infrastructure certificate or a confidential computing certificate.

[0189] As shown in Figure 8, in the fifth scenario, corresponding to the previous-level digital certificate device 401 and the current-level digital certificate device 402, the previous-level digital certificate is a hybrid certificate, meaning that the previous-level digital certificate device 401 possesses both a public key infrastructure certificate and a confidential computing certificate, while the current-level digital certificate is a confidential computing certificate. If the previous-level digital certificate is the first-level digital certificate in a certificate chain, the previous-level digital certificate includes a self-signed public key infrastructure certificate and a self-signed confidential computing certificate. The current-level confidential computing certificate is generated in a local confidential computing environment, self-signed using the private key within the asymmetric key generated in the local confidential computing environment, and then signed by the previous-level digital certificate device 401 using its locally generated private key. If the previous-level digital certificate is not the first-level digital certificate in the certificate chain, it is then signed by the next-level digital certificate device based on the certificate type. When the current-level digital certificate is not a business certificate, a next-level digital certificate can be derived to extend the certificate chain. The next-level digital certificate can be either a public key infrastructure certificate or a confidential computing certificate.

[0190] As shown in Figure 9, in the sixth scenario, corresponding to the previous-level digital certificate device 401 and the current-level digital certificate device 402, the previous-level digital certificate is a hybrid certificate, that is, the previous-level digital certificate device 401 has both a public key infrastructure certificate and a confidential computing certificate, and the current-level digital certificate is a public key infrastructure certificate. If the previous-level digital certificate is the first-level digital certificate in the certificate chain, the previous-level digital certificate includes a self-signed public key infrastructure certificate and a self-signed confidential computing certificate. The current-level digital certificate is signed by the private key provided by the previous-level digital certificate device 401 and verified by the public key provided by the first-level digital certificate device. If the previous-level digital certificate is not the first-level digital certificate in the certificate chain, it will be issued by the next-level digital certificate device according to the certificate type. If the current-level digital certificate is not a business certificate, a next-level digital certificate can be derived to extend the certificate chain. The next-level digital certificate can be a public key infrastructure certificate or a confidential computing certificate.

[0191] The eighth embodiment of the present application is described below.

[0192] Based on the above embodiments, the embodiments of the present application illustrate an application scenario of a digital certificate management method.

[0193] In the digital certificate management method provided in the embodiment of the present application, the business server includes a server for performing a Hypertext Transfer Protocol Security connection.

[0194] The digital certificate management method provided in the embodiment of the present application may also include: after receiving an access request to the server sent by the client, after verifying the certificate chain corresponding to the server's Hypertext Transfer Protocol Secure (HTTPS) protocol connection service, the last-level digital certificate of the certificate chain corresponding to the Hypertext Transfer Protocol Secure connection service is sent to the client so that the client can verify the last-level digital certificate, so that after the client verifies the last-level digital certificate, it can determine that the Hypertext Transfer Protocol Secure connection service is legal and establish a Hypertext Transfer Protocol Secure channel with the server.

[0195] It should be noted that every time the client reopens the website of the business server, it needs to re-execute the signature verification process of the certificate chain.

[0196] The ninth embodiment of the present application is described below.

[0197] Based on the above embodiments, the embodiment of the present application describes an application scenario of another digital certificate management method.

[0198] The digital certificate management method provided in the embodiment of the present application can also be applied to file sending devices.

[0199] The digital certificate management method provided in the embodiment of the present application may also include: after receiving the legitimacy verification of the target file to be sent by the file receiving device, providing the digital certificates at all levels of the certificate chain to the file receiving device, so that the file receiving device receives the target file after passing the legitimacy verification of the digital certificates at all levels of the certificate chain.

[0200] Each time a file receiving device receives a file sent by a file sending device, it needs to verify the signature of the certificate chain corresponding to the file, and confirm that the file is legal after passing the verification.

[0201] The following describes the tenth embodiment of the present application.

[0202] Based on the above embodiment, the embodiment of the present application further provides a digital certificate management method, including:

[0203] The business device generates a digital certificate issuance request based on the needs of the target business and sends the digital certificate issuance request to the digital certificate device;

[0204] The digital certificate device generates a certificate chain for the target business based on the digital certificate issuance request;

[0205] After the business device verifies the legitimacy of the certificate chain and passes it, it uses the certificate chain to deploy the target business;

[0206] The certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment.

[0207] The embodiments of the present application correspond to the method embodiments in the above part, so the specific implementation methods of the embodiments of the present application can be found in the description of the embodiments in the method part in the above part, which will not be repeated here.

[0208] The above describes in detail various embodiments corresponding to the digital certificate management method. On this basis, the present application also discloses a digital certificate management apparatus, device and non-volatile readable storage medium corresponding to the above method.

[0209] The following describes the eleventh embodiment of the present application.

[0210] FIG10 is a schematic structural diagram of a digital certificate management device provided in an embodiment of the present application.

[0211] As shown in FIG10 , the digital certificate management device provided in the embodiment of the present application includes:

[0212] The request unit 1001 is used to generate a digital certificate issuance request according to the requirements of the target business;

[0213] The sending unit 1002 is configured to send the digital certificate issuance request to the digital certificate device so that the digital certificate device generates a certificate chain for the target service;

[0214] The deployment unit 1003 is used to deploy the target service using the certificate chain after the certificate chain passes the validity verification;

[0215] The certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment.

[0216] In some implementations, the digital certificate management device provided in the embodiments of the present application may further include:

[0217] The first verification unit is configured to verify the validity of the certificate chain after receiving an application request for a target service from a requesting device, so that the requesting device can determine that the target service is valid after determining that the certificate chain is valid.

[0218] In some implementations, the digital certificate management device provided in the embodiments of the present application is applied to a business server, specifically a server for performing a Hypertext Transfer Protocol Secure connection; the digital certificate management device provided in the embodiments of the present application may further include:

[0219] The second verification unit is used to, after receiving an access request to the server sent by the client, verify the certificate chain corresponding to the server's Hypertext Transfer Protocol Security connection service, and then send the last-level digital certificate of the certificate chain corresponding to the Hypertext Transfer Protocol Security connection service to the client so that the client can verify the last-level digital certificate, so that after the client verifies the last-level digital certificate, it can determine that the Hypertext Transfer Protocol Security connection service is legal and establish a Hypertext Transfer Protocol Security secure channel with the server.

[0220] In some implementations, the digital certificate management apparatus provided in the embodiments of the present application is applied to a file sending device; the digital certificate management apparatus provided in the embodiments of the present application may further include:

[0221] The third verification unit is used to provide the digital certificates of each level of the certificate chain to the file receiving device after receiving the legitimacy verification of the target file to be sent by the file receiving device, so that the file receiving device receives the target file after performing the legitimacy verification on the digital certificates of each level of the certificate chain.

[0222] Since the embodiments of the apparatus part correspond to the embodiments of the method part, please refer to the description of the embodiments of the method part for the embodiments of the apparatus part, and they will not be repeated here.

[0223] The following describes the twelfth embodiment of the present application.

[0224] FIG11 is a schematic structural diagram of a digital certificate management device provided in an embodiment of the present application.

[0225] As shown in FIG11 , the digital certificate management device provided in this embodiment of the application includes:

[0226] Memory 1110, for storing computer programs 1111;

[0227] The processor 1120 is configured to execute the computer program 1111. When the computer program 1111 is executed by the processor 1120, the steps of the digital certificate management method according to any one of the above embodiments are implemented.

[0228] Among them, the processor 1120 may include one or more processing cores, such as a 3-core processor, an 8-core processor, etc. The processor 1120 can be implemented in at least one hardware form of digital signal processing DSP (Digital Signal Processing), field programmable gate array FPGA (Field-Programmable Gate Array), and programmable logic array PLA (Programmable Logic Array). The processor 1120 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as the central processing unit CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 1120 may be integrated with a graphics processing unit GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 1120 may also include an artificial intelligence AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0229] The memory 1110 may include one or more non-volatile readable storage media, which may be non-transitory. The memory 1110 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 1110 is at least used to store the following computer program 1111, wherein, after the computer program 1111 is loaded and executed by the processor 1120, it can implement the relevant steps in the digital certificate management method disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 1110 may also include an operating system 1112 and data 1113, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 1112 may be Windows. The data 1113 may include but is not limited to the data involved in the above method.

[0230] In some embodiments, the digital certificate management device may further include a display screen 1130 , a power supply 1140 , a communication interface 1150 , an input / output interface 1160 , a sensor 1170 , and a communication bus 1180 .

[0231] Those skilled in the art will appreciate that the structure shown in FIG11 does not limit the digital certificate management device and may include more or fewer components than shown in the figure.

[0232] The digital certificate management device provided in the embodiment of the present application includes a memory and a processor. When the processor executes the program stored in the memory, it can implement the above digital certificate management method, and the effect is the same as above.

[0233] The thirteenth embodiment of the present application is described below.

[0234] It should be noted that the above-described embodiments of the apparatus and equipment are merely illustrative. For example, the division of modules is merely a logical functional division. In actual implementation, there may be other division methods, such as multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection of the apparatus or module, and may be electrical, mechanical or other forms. Modules described as separate components may or may not be physically separate, and components shown as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed across multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment.

[0235] In addition, the functional modules in the various embodiments of the present application may be integrated into a processing module, or each module may exist physically separately, or two or more modules may be integrated into a single module. The above-mentioned integrated modules may be implemented in the form of hardware or software functional modules.

[0236] If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can be stored in a non-volatile readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the existing technology, or all or part of the technical solution can be embodied in the form of a software product. This computer software product is stored in a storage medium and executes all or part of the steps of the various embodiments of the present application.

[0237] To this end, an embodiment of the present application further provides a non-volatile readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the digital certificate management method are implemented.

[0238] The non-volatile readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory ROM (Read-Only Memory), a random access memory RAM (Random Access Memory), a magnetic disk or an optical disk, and other media that can store program codes.

[0239] The computer program contained in the non-volatile readable storage medium provided in this embodiment can implement the steps of the above digital certificate management method when executed by the processor, and the effect is the same as above.

[0240] The above is a detailed introduction to a digital certificate management method, device, equipment, system and non-volatile readable storage medium provided by the present application. The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the various embodiments can be referred to each other. For the devices, equipment and non-volatile readable storage medium disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method part description. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of this application, several improvements and modifications can be made to this application, and these improvements and modifications also fall within the scope of protection of the claims of this application.

[0241] It should also be noted that, in this specification, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

Claims

1. A digital certificate management method, characterized in that: include: Generate a digital certificate issuance request based on the needs of the target business; Sending the digital certificate issuance request to a digital certificate device so that the digital certificate device generates a certificate chain for the target service; After the certificate chain is verified to be legitimate, the target service is deployed using the certificate chain; The certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment.

2. The digital certificate management method according to claim 1, characterized in that: At least one level of digital certificate in the certificate chain includes a public key infrastructure certificate and a confidential computing certificate.

3. The digital certificate management method according to claim 1, characterized in that: The digital certificate device generates a certificate chain for the target service, including: The first-level digital certificate device for holding the first-level digital certificate of the certificate chain generates the first-level digital certificate by self-signing and verifies the signature of the first-level digital certificate, and determines that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates; Starting from the second-level digital certificate device for holding the second-level digital certificate of the certificate chain, the current-level digital certificate device receives the current-level digital certificate issued by the previous-level digital certificate device and verifies the signature of the current-level digital certificate, and determines that the current-level digital certificate is legal; After the digital certificates at each level of the certificate chain are generated and all the digital certificates at each level pass the legitimacy verification, the certificate chain is obtained.

4. The digital certificate management method according to claim 3, characterized in that: The first-level digital certificate device for holding the first-level digital certificate of the certificate chain generates the first-level digital certificate by self-signing and verifies the signature of the first-level digital certificate, and determines that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates, including: If the first-level digital certificate is a public key infrastructure certificate, the first-level digital certificate device is a certificate authority device, and the first-level digital certificate device signs the local digital certificate information with the private key in the locally generated asymmetric key to obtain the first-level digital certificate; after the first-level digital certificate device verifies the signature of the first-level digital certificate with the public key in the locally generated asymmetric key, it is determined that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates; If the first-level digital certificate is a confidential computing certificate, then the first-level digital certificate device is a confidential computing device with a confidential computing environment, and the first-level digital certificate device signs the local digital certificate information with the private key of the asymmetric key generated in the local confidential computing environment to obtain the first-level digital certificate; after the first-level digital certificate device verifies the signature of the first-level digital certificate with the public key of the asymmetric key generated in the local confidential computing environment, it is determined that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates.

5. The digital certificate management method according to claim 3, characterized in that: Starting from the second-level digital certificate device for holding the second-level digital certificate of the certificate chain, after the current-level digital certificate device receives the current-level digital certificate issued by the previous-level digital certificate device and verifies the signature of the current-level digital certificate, it is determined that the current-level digital certificate is legal, including: If the current-level digital certificate is a public key infrastructure certificate, the current-level digital certificate device receives the current-level digital certificate obtained by signing the local digital certificate information of the current-level digital certificate device with the private key in the asymmetric key generated by the previous-level digital certificate device, and after the current-level digital certificate is verified by the public key in the asymmetric key generated by the previous-level digital certificate device, determines that the current-level digital certificate is legal; If the current-level digital certificate is a confidential computing certificate, the current-level digital certificate device uses the private key in the asymmetric key generated in the local confidential computing environment to self-sign the local digital certificate information of the current-level digital certificate device, receives the private key in the asymmetric key generated by the previous-level digital certificate device, signs the self-signed local digital certificate information to obtain the current-level digital certificate, uses the public key in the asymmetric key generated in the local confidential computing environment to self-sign the current-level digital certificate, and after the public key in the asymmetric key generated by the previous-level digital certificate device is used to verify the signature of the current-level digital certificate, it is determined that the current-level digital certificate is legal.

6. The digital certificate management method according to claim 4, characterized in that: The first-level digital certificate device signs the local digital certificate information using the private key of the asymmetric key generated in the local confidential computing environment, including: After verifying the authenticity of the local confidential computing environment, the first-level digital certificate device signs the local digital certificate information using the private key of the asymmetric key generated in the local confidential computing environment.

7. The digital certificate management method according to claim 5, characterized in that: The current-level digital certificate device uses a private key in an asymmetric key generated in a local confidential computing environment to perform self-signature processing on the local digital certificate information of the current-level digital certificate device, including: After verifying the authenticity of the local confidential computing environment, the current-level digital certificate device uses the private key in the asymmetric key generated in the local confidential computing environment to perform self-signature processing on the local digital certificate information of the current-level digital certificate device.

8. The digital certificate management method according to claim 5, characterized in that: If the asymmetric key generated by the upper-level digital certificate device is an asymmetric key generated in a local confidential computing environment, The current-level digital certificate device receives the current-level digital certificate obtained by signing the local digital certificate information of the current-level digital certificate device with the private key in the asymmetric key generated by the previous-level digital certificate device, including: After triggering and passing the authenticity verification of the local confidential computing environment of the previous-level digital certificate device, the current-level digital certificate device obtains the private key in the asymmetric key generated in the local confidential computing environment of the previous-level digital certificate device to sign the local digital certificate information of the current-level digital certificate device to obtain the current-level digital certificate; The current-level digital certificate device receives the private key in the asymmetric key generated by the previous-level digital certificate device and performs a signing process on the local digital certificate information after the self-signature process to obtain the current-level digital certificate, including: After triggering and passing the authenticity verification of the local confidential computing environment of the previous-level digital certificate device, the current-level digital certificate device obtains the private key in the asymmetric key generated in the local confidential computing environment of the previous-level digital certificate device to sign the local digital certificate information after self-signature processing to obtain the current-level digital certificate.

9. The digital certificate management method according to any one of claims 6 to 8, characterized in that: Verify the authenticity of the local confidential computing environment, including: The remote attestation data in the local digital certificate information of the device is sent to the device manufacturer to verify the authenticity of the local confidential computing environment.

10. The digital certificate management method according to claim 9, characterized in that: The remote attestation data includes trustworthy measurement information of the device.

11. The digital certificate management method according to claim 9, characterized in that: The remote attestation data includes a remote attestation data plaintext and a remote attestation data signature obtained by signing the remote attestation data plaintext using a hardware remote attestation private key of a local confidential computing environment of the device; The remote attestation data plain text includes a hash value of a public key in an asymmetric key generated in a local confidential computing environment of the device and trust measurement information of the device.

12. The digital certificate management method according to claim 4, characterized in that: After the first-level digital certificate device verifies the signature of the first-level digital certificate through the public key of the asymmetric key generated in the local confidential computing environment, it is determined that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates, including: The first-level digital certificate device compares the calculated hash value of the entity public key in the confidential computing certificate and the public key hash value in the remote attestation data in the confidential computing certificate and finds that they are consistent. After the first-level digital certificate is signed and verified by the entity public key, it is determined that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates.

13. The digital certificate management method according to claim 5, characterized in that: The current-level digital certificate device uses the public key in the asymmetric key generated in the local confidential computing environment to perform self-signature verification on the current-level digital certificate, including: The current-level digital certificate device compares the calculated hash value of the entity public key in the confidential computing certificate and the public key hash value in the remote certification data in the confidential computing certificate and verifies the signature of the current-level digital certificate through the entity public key.

14. The digital certificate management method according to claim 1, characterized in that: The digital certificate device generates a certificate chain for the target service, including: If the current-level digital certificate has a signature of a previous-level digital certificate device, the current-level digital certificate device that has the current-level digital certificate verifies the signature of the previous-level digital certificate device and determines that the current-level digital certificate is legal; If the current-level digital certificate has multiple signatures of the previous-level digital certificate device, the current-level digital certificate device determines that the current-level digital certificate is legal after verifying a first preset number of signatures among the multiple signatures; The first preset number is smaller than the number of signatures of the previous-level digital certificate device in the current-level digital certificate.

15. The digital certificate management method according to claim 14, characterized in that: If the current-level digital certificate has multiple signatures of the previous-level digital certificate device, the current-level digital certificate device determines that the current-level digital certificate is legitimate after verifying a first preset number of signatures among the multiple signatures, including: If the signatures of the multiple previous-level digital certificate devices in the current-level digital certificate include both public key infrastructure signatures and confidential computing signatures, after the current-level digital certificate device passes the signature verification of the second preset number of public key infrastructure signatures in the multiple signatures and passes the signature verification of the third preset number of confidential computing signatures in the multiple signatures, Determining that the current-level digital certificate is legitimate; Among them, the second preset number is smaller than the number of public key infrastructure signatures of the previous level digital certificate device in the current level digital certificate, and the third preset number is smaller than the number of confidential computing signatures of the previous level digital certificate device in the current level digital certificate.

16. The digital certificate management method according to claim 1, characterized in that: Generate a digital certificate issuance request based on the target business needs, including: Determining a combination method of a public key infrastructure certificate and a confidential computing certificate in the certificate chain according to the security requirements of the target business; Determine the corresponding digital certificate device according to the combination of the public key infrastructure certificate and the confidential computing certificate in the certificate chain; Generate a digital certificate issuance request for each of the digital certificate devices.

17. The digital certificate management method according to claim 1, characterized in that: Also includes: After receiving the application request of the target service from the requesting device, the certificate chain is verified for legitimacy so that the requesting device determines that the target service is legitimate after determining that the certificate chain is legitimate.

18. The digital certificate management method according to claim 1, characterized in that: Applicable to servers making HTTP secure connections; The digital certificate management method also includes: After receiving an access request to the server sent by the client, after verifying the certificate chain corresponding to the server's Hypertext Transfer Protocol Security connection service, the last-level digital certificate of the certificate chain corresponding to the Hypertext Transfer Protocol Security connection service is sent to the client so that the client can verify the last-level digital certificate, so that after verifying the last-level digital certificate, the client can determine that the Hypertext Transfer Protocol Security connection service is legal and establish a Hypertext Transfer Protocol Security secure channel with the server.

19. The digital certificate management method according to claim 1, characterized in that: Applicable to file sending equipment; The digital certificate management method also includes: After receiving the legitimacy verification of the target file to be sent by the file receiving device, the digital certificates at all levels of the certificate chain are provided to the file receiving device, so that the file receiving device receives the target file after the legitimacy verification of the digital certificates at all levels of the certificate chain is passed.

20. A digital certificate management method, characterized in that: include: The business device generates a digital certificate issuance request according to the needs of the target business, and sends the digital certificate issuance request to the digital certificate device; The digital certificate device generates a certificate chain of the target service according to the digital certificate issuance request; After the business device verifies the legitimacy of the certificate chain, the target business is deployed using the certificate chain; The certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment.

21. A digital certificate management system, characterized in that: include: Business equipment and digital certificate equipment; The service device is used to generate a digital certificate issuance request according to the needs of the target service; the digital certificate issuance request is sent to the digital certificate device so that the digital certificate device generates a certificate chain for the target service; After the certificate chain is verified to be legitimate, the target service is deployed using the certificate chain; The certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment.

22. A digital certificate management device, characterized in that: include: A request unit, used to generate a digital certificate issuance request according to the needs of the target business; A sending unit, configured to send the digital certificate issuance request to a digital certificate device, so that the digital certificate device generates a certificate chain for the target service; A deployment unit, configured to deploy the target service using the certificate chain after the certificate chain passes the legitimacy verification; The certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment.

23. A digital certificate management device, characterized in that: include: Memory for storing computer programs; A processor is used to execute the computer program, and when the computer program is executed by the processor, the steps of the digital certificate management method as described in any one of claims 1 to 20 are implemented.

24. A non-volatile readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the digital certificate management method according to any one of claims 1 to 20 are implemented.

Images