Device certificate distribution method and system, computer device, and readable storage medium

Abstract

The present application relates to a device certificate distribution method and system, a computer device, and a readable storage medium. The method comprises: receiving a device certificate applying request of a network device to be installed, the request being sent by a service management platform, the device certificate applying request carrying device installation information, a chip identifier, and key information of said network device, and the key information being generated by said network device on the basis of a DIPK key pair stored in a secure chip; determining corresponding DIPK information on the basis of the chip identifier; generating corresponding device certificate information on the basis of the DIPK information, the device installation information, and the key information; and sending the device certificate information to said network device to complete installation. The present method can improve the efficiency of device certificate distribution.

Description

Device certificate distribution method, system, computer device and readable storage medium TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, in particular to a device certificate distribution method, system, computer device and readable storage medium. BACKGROUND

[0002] With the digitalization and networking of public security video monitoring, more and more network problems have emerged. Especially under the background of popularization and application of large-scale networking, cloud computing and artificial intelligence new technologies, the security threats and means faced by video monitoring systems have undergone tremendous changes, and the situation of video monitoring has become increasingly severe. In order to solve the security problem of video monitoring, GB 35114-2017 Technical Requirements for Public Security Video Monitoring Network Information Security specifies the technical requirements for the security protection of public security field video monitoring network video information and control signaling information, and provides guidelines for various monitoring devices and monitoring systems.

[0003] Among them, it is stipulated that digital certificates and digital signatures are used to encrypt or decrypt information and data in computer network communication of device network users to ensure the integrity and security of information and data, so the system and the device need to exchange certificates and keys to achieve mutual trust.

[0004] In related technologies, the device certificate of the device is sent to the device customer in an offline manner, and the device customer manually imports the device certificate into the corresponding device to complete the installation of the device, resulting in low efficiency of device certificate distribution. SUMMARY

[0005] Therefore, it is necessary to provide a device certificate distribution method, system, computer device, computer readable storage medium and computer program product capable of improving the efficiency of device certificate distribution to solve the above technical problems.

[0006] In a first aspect, the present application provides a device certificate distribution method applied to a certificate management center, comprising:

[0007] receiving a device certificate application request of a to-be-installed network device sent by a business management platform, wherein the device certificate application request carries device installation information, a chip identifier and key information of the to-be-installed network device; the key information is generated according to a DIPK key pair in a security chip according to the to-be-installed network device;

[0008] determining corresponding DIPK public key information according to the chip identifier;

[0009] generating corresponding device certificate information according to the DIPK public key information, the device installation information and the key information;

[0010] sending the device certificate information to the network device to be installed to complete the installation.

[0011] In one of the embodiments, the generating of the device certificate information according to the DIPK public key information, the device installation information and the key information comprises:

[0012] decrypting the DCPK ciphertext in the key information according to the DIPK public key information to obtain DCPK public key plaintext information;

[0013] generating the device certificate information according to the DCPK public key plaintext information and the device installation information.

[0014] In one of the embodiments, the sending of the device certificate information to the network device to be installed to complete the installation comprises:

[0015] sending the device certificate information to the network device to be installed to enable the network device to be installed to verify the device certificate information according to the CARPK public key stored in the secure chip, and in the case of passing the verification, storing the device certificate information in the secure chip of the network device to be installed to complete the installation.

[0016] In one of the embodiments, the DCPK ciphertext is derived by the service management platform controlling the network device to be installed to apply for the device certificate information, deriving the certificate public key information DCPK public key according to the DIPK public key stored in the secure chip of the network device to be installed, and encrypting the DCPK public key using the DIPK private key.

[0017] In one of the embodiments, the DIPK private key in the DIPK key pair is determined according to the chip identifier of the secure chip in the network device to be installed carried by the allocation request of the device initial key pair sent by the secure device production platform.

[0018] In one of the embodiments, the network device to be installed comprises a GB35114 device.

[0019] In a second aspect, the application provides a device certificate distribution method applied to a secure device production platform, comprising:

[0020] generating a PCRK key pair of a network device to be installed, and obtaining a CARPK key pair of the network device to be installed from a certificate management center;

[0021] According to the chip identifier of the network device to be installed, a DIPK allocation request is sent to the certificate management center, and the DIPK private key ciphertext corresponding to the chip identifier is received in response to the DIPK allocation request by the certificate management center;

[0022] The DIPK private key ciphertext is decrypted according to the PCRK key pair to obtain DIPK private key information;

[0023] The DIPK private key information and the CARPK public key in the CARPK key pair are burned into the secure space of the secure chip; the DIPK private key information and the CARPK public key are used to generate device certificate application information of the network device to be installed, so as to complete device certificate distribution of the network device to be installed.

[0024] In a third aspect, the present application also provides a device certificate distribution system, which comprises a secure device production platform, a business management platform, a certificate management center and a network device to be installed, wherein:

[0025] The secure device production platform is configured to generate a PCRK key pair of the network device to be installed, and obtain a CARPK key pair of the network device to be installed from the certificate management center; according to the chip identifier of the network device to be installed, a DIPK allocation request is sent to the certificate management center, and the DIPK private key ciphertext corresponding to the chip identifier is received in response to the DIPK allocation request by the certificate management center; the DIPK private key ciphertext is decrypted according to the PCRK key pair to obtain DIPK private key information; and the DIPK private key information and the CARPK public key in the CARPK key pair are burned into the secure space of the secure chip;

[0026] The business management platform is configured to send a device certificate application request of the network device to be installed, wherein the device certificate application request carries device installation information, a chip identifier and key information of the network device to be installed; the key information is generated according to the DIPK key pair existing in the secure chip according to the network device to be installed;

[0027] The certificate management center is configured to determine corresponding DIPK public key information according to the chip identifier; generate corresponding device certificate information according to the DIPK public key information, the device installation information and the key information; and send the device certificate information to the network device to be installed to complete installation.

[0028] In a fourth aspect, the present application also provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method according to any one of the preceding aspects when executing the computer program.

[0029] In a fifth aspect, the present application also provides a computer readable storage medium, having stored thereon a computer program, which when executed by a processor implements the steps of the method of any one of the preceding aspects.

[0030] In a sixth aspect, the present application also provides a computer program product comprising a computer program which when executed by a processor implements the steps of the method of any one of the preceding aspects.

[0031] The device certificate distribution method, system, computer device, computer readable storage medium and computer program product described above, by receiving a device certificate application request of a network device to be installed sent by a service management platform, the device certificate application request carrying device installation information, chip identification and key information of the network device to be installed; the key information is generated according to a DIPK key pair existing in a security chip; the corresponding DIPK public key information is determined according to the chip identification; the corresponding device certificate information is generated according to the DIPK public key information, the device installation information and the key information; the device certificate information is sent to the network device to be installed, and the installation is completed. This way, compared with the existing distribution method, does not need manual intervention in the certificate distribution process, and fully automatically realizes the secure transmission of key information and the distribution of certificates, further realizing the safe and efficient production of a large number of devices, automatic import, avoiding the risk of human intervention and certificate leakage, and improving the certificate distribution efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the drawings needed to be used in the description of the embodiments of the present application or the related art will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0033] FIG. 1 is a system topology diagram of a device certificate distribution method in an embodiment;

[0034] FIG. 2 is a flowchart of a device certificate distribution method in an embodiment;

[0035] FIG. 3 is a flowchart of step 206 in an embodiment;

[0036] FIG. 4 is a device certificate distribution flowchart in an embodiment;

[0037] FIG. 5 is a flowchart of a device certificate distribution method in another embodiment;

[0038] FIG. 6 is a device key transmission flowchart in an embodiment;

[0039] Fig. 7 is a structural block diagram of a device certificate distribution system in one embodiment;

[0040] Fig. 8 is an internal structural diagram of a computer device in one embodiment. DETAILED DESCRIPTION

[0041] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application is further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0042] GB 35114: Public Safety Video Monitoring Network Information Security Technical Requirements, which proposes requirements for user security, device security, service security, device control security, audio / video integrity, and audio / video security for devices and services in the field of video monitoring.

[0043] GB 35114 front-end device: a network device suitable for GB 35114 protocol, such as a camera, a security gateway, etc.

[0044] CMS: (Certificate Management System, Certificate Management Center), a server and software for issuing, querying and managing certificates.

[0045] HSM: (Hardware Security Module, Hardware Security Module), a physically secure key generation and storage device.

[0046] CARPK: (Certificate Authority Root Key Pair, Certificate Authority Root Key Pair), user device certificate issuance.

[0047] DIPK: (Device Initial Key Pair, Device Initial Key Pair), a trust root for terminal devices and certificate management centers to establish a trusted channel online.

[0048] DCPK: (Device Certificate Key Pair, Device Certificate Key Pair), a trust root for terminal devices and other service units to perform data trusted transmission.

[0049] PCRK: mass production pre-installed chip platform root key, used for secure information security encryption transmission.

[0050] Security device manufacturer: responsible for chip production, software integration, etc. of 35114 front-end devices, and in the present application, mainly responsible for producing security chips for network devices to be installed.

[0051] Digital certificate: refers to the CA issued an electronic document, is a string of digital network user identity information can show, provides a way to verify the identity of network users on computer networks, digital certificate is also known as digital identity. Digital certificate of network users in computer network communication information and data in the form of encryption or decryption to ensure the integrity and security of information and data.

[0052] Digital signature: using the technology of public key encryption field, used to identify digital information. A set of digital signature usually defines two complementary operations, one for signing, the other for verification. Only the sender of information can produce a digital string that cannot be forged by others, which is also a valid proof of the authenticity of the sender of information. In the field of security, this technology can prevent data leakage, data tampering and identity impersonation, and ensure the confidentiality, integrity and authenticity of information.

[0053] Identity authentication: also known as "identity authentication", refers to the process of confirming the identity of the operator in computer and computer network system, determining whether the user has access to and use of certain resources, so that the access strategy of computer and network system can be reliable and effective, prevent attackers from impersonating legitimate users to obtain access to resources, ensure the security of system and data, and authorized access to the legitimate interests of the user. In the monitoring system, identity authentication technology can be used to allow only authenticated devices to access the system to prevent unauthorized users from hacking and ensure system security.

[0054] With the digitalization and networking of public security video monitoring, more and more network problems have emerged. Especially in the background of large-scale networking, cloud computing and the popularization and application of artificial intelligence technology, the security threats and means faced by video monitoring system have undergone tremendous changes, and the situation of video monitoring has become more and more severe.

[0055] In order to solve the security problem of video monitoring, "GB 35114-2017 public security video monitoring networking information security technical requirements" stipulates the technical requirements for the security protection of video information and control signaling information in the field of public security video monitoring networking, providing guidelines for various monitoring devices and monitoring systems.

[0056] Among them, the use of digital certificate and digital signature ensures the integrity and security of information and data in computer network communication of device network users in the form of encryption or decryption, so the system and device need to exchange certificates and keys to achieve mutual trust.

[0057] In the related art, a GB35114 security chip is produced by a security device manufacturer, and is delivered offline to a certificate management center; the certificate management center uses a burning tool to burn and write a DIPK private key into the GB35114 security chip, and then returns the chip to the security device manufacturer; the security device manufacturer completes GB35114 device assembly, software integration, and other work, and then delivers the device to the device customer; the device customer applies for a GB35114 device certificate to the certificate management center according to specific security video monitoring requirements; the certificate management center generates a device certificate according to device information, and delivers the device certificate offline / special network to the device customer; the device customer manually imports the device certificate into the corresponding device, and the GB35114 completes installation. This method can only be transmitted offline by manual work, and is inefficient, and cannot be used in large-scale application scenarios. The transmission of manufacturer authentication certificate keys can only be limited to the manufacturer's own private certificate management system, and the application scenarios are limited.

[0058] To solve the technical problem of low efficiency of device certificate distribution, a device certificate application request of a network device to be installed is received, which is sent by a business management platform; a device certificate application request of a network device to be installed is received, which is sent by the business management platform; the device certificate application request carries device installation information, chip identification, and key information of the network device to be installed; the key information is generated according to a DIPK key pair existing in a security chip according to the network device to be installed; the chip identification of the network device to be installed is determined from the device installation information, and the corresponding DIPK public key information is determined according to the chip identification; the corresponding device certificate information is generated according to the DIPK public key information, the device installation information, and the key information; and the device certificate information is sent to the network device to be installed, and installation is completed.

[0059] The device certificate distribution method provided by the embodiments of the present application can be applied to the system topology diagram as shown in FIG. 1. The system topology diagram includes a certificate management client 102, a security device manufacturer 104, a certificate management center 106, a business management platform 108, and a network device 110 applicable to the GB 35114 protocol. The security device manufacturer responds to a production instruction, applies for a device CARPK key pair to the certificate management center and carries a PCRK public key, and sends the device CARPK key and the PCRK public key to the certificate management center in an offline encrypted and secure transmission manner; the certificate management center saves the PCRK public key and distributes the CARPK key pair and the account password of the certificate management client, and sends the CARPK public key and the account password of the client to the security device manufacturer in an offline encrypted and secure transmission manner; and the security device manufacturer saves the received CARPK public key and the account password of the client.

[0060] The security device manufacturer installs a certificate management client and logs in with an account password, controls the security chip of the burning device, and the security device production platform sends a DIPK allocation request to the certificate management center according to the chip identifier of the network device to be installed, the certificate management center responds to the DIPK allocation request, determines the DIPK public and private keys corresponding to the chip identifier, stores the correspondence between the chip identifier and the DIPK public and private keys, signs the DIPK private key using the CARPK private key and encrypts the DIPK private key using the PCRK, and returns the security device production platform, the security device production platform decrypts the DIPK private key ciphertext using the PCRK, and obtains the DIPK private key information by verifying the signature using the CARPK, and burns the DIPK private key information and the CARPK public key in the CARPK key pair into the security space of the security chip, assembles the security chip into the corresponding device, and integrates the device into the factory for delivery to the customer, completing production.

[0061] The certificate management center receives the device certificate application request of the network device to be installed sent by the business management platform, and the device certificate application request carries the device installation information, chip identifier and key information of the network device to be installed; the key information is generated according to the DIPK key pair existing in the security chip of the network device to be installed; the corresponding DIPK public key information is determined according to the chip identifier; the corresponding device certificate information is generated according to the DIPK public key information, device installation information and key information; and the device certificate information is sent to the network device to be installed, completing installation.

[0062] In an exemplary embodiment, as shown in FIG. 2, a device certificate distribution method is provided, which is applied to the certificate management center in FIG. 1 as an example for illustration, including the following steps 202 to 206. Among them:

[0063] Step 202, receiving the device certificate application request of the network device to be installed sent by the business management platform, and the device certificate application request carries the device installation information, chip identifier and key information of the network device to be installed; the key information is generated according to the DIPK key pair existing in the security chip of the network device to be installed.

[0064] Among them, the certificate management center: responsible for managing the certificate key information of GB35114 devices, which can be the certificate key information of the manufacturer itself or the certificate key information of the public security. The business management platform: responsible for connecting the customer and the certificate management center, and doing data transfer.

[0065] The network device to be installed can be, but is not limited to, a network device supporting the GB 35114 protocol. The device installation information includes device identification, installation location information, and unit department information of the network device to be installed. The DIPK key pair includes a DIPK public key and a DIPK private key. The key information can be derived based on the DIPK private key, and the DCPK public key information is obtained by encrypting the DCPK public key using the DIPK private key. The DIPK private key can be determined according to the chip identification of the security chip in the network device to be installed carried in the allocation request in the case of receiving the allocation request of the device initial key pair sent by the security device production platform.

[0066] Exemplarily, the network device to be installed accesses the corresponding network environment, and in the case of monitoring that the network device to be installed has accessed the network environment, the device installation information of the network device to be installed is determined through the business management platform, the network device to be installed applies for the device certificate information through the business management platform, and sends a device certificate application request to the certificate management center, which carries the device installation information, the chip identification, and the key information of the network device to be installed.

[0067] Step 204, determining the corresponding DIPK public key information according to the chip identification.

[0068] It should be noted that the chip identification and the DIPK public key information of each network device to be installed have a unique corresponding relationship, and the corresponding DIPK public key information can be determined according to the chip identification.

[0069] Step 206, generating the corresponding device certificate information according to the DIPK public key information, the device installation information, and the key information.

[0070] The key information is derived based on the DIPK private key, and the DCPK public key information is obtained by encrypting the DCPK public key using the DIPK private key, that is, the DCPK ciphertext is included in the key information. The device certificate information can be determined by decrypting the DCPK ciphertext using the DIPK public key to obtain the DCPK plaintext information, and according to the device installation information and the DCPK plaintext information.

[0071] Exemplarily, the certificate management center finds the corresponding DIPK public key information according to the chip identification, and then decrypts the DCPK ciphertext using the DIPK public key to obtain the DCPK plaintext information; the certificate management center generates the corresponding device certificate information according to the DCPK plaintext information and the device installation information, and returns the device certificate information after signing the device certificate information using the CARPK private key.

[0072] Step 208, sending the device certificate information to the network device to be installed, and completing the installation.

[0073] Exemplarily, the certificate management center sends the device certificate information to the network device to be installed, and after the network device to be installed receives the device certificate information, the device certificate information is saved into the security chip of the network device to be installed after being verified by the CARPK public key, and the network device to be installed is completed.

[0074] In the above device certificate distribution method, the device certificate application request of the network device to be installed sent by the service management platform is received, the device certificate application request carries the device installation information, the chip identifier and the key information of the network device to be installed; the key information is generated according to the DIPK key pair existing in the security chip of the network device to be installed; the corresponding DIPK public key information is determined according to the chip identifier; the corresponding device certificate information is generated according to the DIPK public key information, the device installation information and the key information; and the device certificate information is sent to the network device to be installed, and the installation is completed. This way, compared with the existing distribution method, does not need manual intervention in the certificate distribution process, and the process is fully automated to realize the secure transmission of key information and the distribution of certificates, which further realizes the safe and efficient production of a large number of devices, automatic import, avoids human intervention and certificate leakage risk, and improves the certificate distribution efficiency.

[0075] In an exemplary embodiment, as shown in FIG. 3, step 206 includes steps 302 to 304. Among them:

[0076] Step 302: decrypt the DCPK ciphertext in the key information according to the DIPK public key information to obtain the DCPK public key plaintext information.

[0077] Among them, the DCPK ciphertext is the device certificate information applied by the service management platform to control the network device to be installed, and the certificate public key information DCPK public key is derived according to the DIPK public key stored in the security chip of the network device to be installed, and the DIPK private key is used to encrypt the DCPK public key.

[0078] The specific way of decrypting the DCPK ciphertext in the key information according to the DIPK public key information can be realized by the existing way, which is not described here.

[0079] Step 304: generate device certificate information according to the DCPK public key plaintext information and the device installation information.

[0080] In the above embodiment, the DCPK ciphertext is decrypted by using the DIPK public key, which ensures that only the device with the correct DIPK private key can access the DCPK public key, thereby increasing the security and further ensuring the reliability of the device certificate information.

[0081] In an exemplary embodiment, sending the device certificate information to the network device to be installed to complete the installation includes:

[0082] The device certificate information is sent to the network device to be installed, so that the network device to be installed verifies the device certificate information according to the CARPK public key, and in the case of passing the verification, the device certificate information is stored in the security chip of the network device to be installed, and the installation is completed. In this way, the installation and verification process of the device certificate not only ensures the identity of the device and the security of the network, but also ensures the security management of the network device and the normal communication in the future.

[0083] In an exemplary embodiment, the network device to be installed includes a GB35114 device.

[0084] Optionally, in an exemplary embodiment, a device certificate distribution process is provided, as shown in FIG. 4, including a certificate management center, a GB35114 front-end device, and a service management platform, and the network device to be installed is a GB35114 front-end device.

[0085] In response to the installation instruction triggered by the user terminal interface, the instruction can be generated by the customer logging in the service client and triggering the installation component, starting the installation operation, determining the device installation information of the GB35114 front-end device and the device information of the network device to be installed, connecting the GB35114 front-end device, controlling the device to apply for certificate information, and the GB35114 front-end device derives the certificate public key information DCPK public key according to the DIPK public key stored in the security chip, and encrypts the DCPK public key using the DIPK private key to obtain the DCPK ciphertext, that is, the ciphertext information, and attaches the device information. The device installation information, chip identification and key information are verified and forwarded to the certificate management center via the service management platform.

[0086] The certificate management center decrypts the DCPK public key ciphertext in the key information according to the DIPK public key information to obtain the DCPK public key plaintext information, generates the device certificate information according to the DCPK public key plaintext information and the device installation information, and returns it to the service management center after signing with the CARPK private key. The service management center verifies and forwards it to the GB35114 front-end device, and the GB35114 front-end device verifies the device certificate information according to the CARPK public key, and in the case of passing the verification, the device certificate information is stored in the security chip of the network device to be installed, and the installation is completed. Compared with the existing method, this method does not need manual intervention in the certificate distribution process, and realizes the secure transmission of key information and certificate distribution in a fully automated manner, which further realizes the safe and efficient production of a large number of devices, automatic import, avoids human intervention and certificate leakage risk, and improves the certificate distribution efficiency.

[0087] In another exemplary embodiment, as shown in FIG. 5, a device certificate distribution method is provided, which is applied to the security device production platform in FIG. 1 as an example, and includes the following steps 502 to 508. Among them:

[0088] Step 502, generating the PCRK key pair of the network device to be installed, and obtaining the CARPK key pair of the network device to be installed from the certificate management center.

[0089] It should be noted that the security device production platform can generate the PCRK key pair of the security chip in batches, and each security chip is installed in the corresponding network device. The certificate management center generates the CARPK key pair of the security device production platform and the certificate management client account password, the security device production platform generates the device batch production key pair PCRK, and the security device production platform exchanges information with the certificate management center, that is, the security device production platform sends the generated key pair PCRK to the certificate management center, and the certificate management center sends the generated CARPK key pair to the security device production platform.

[0090] Exemplarily, the security device production platform generates the PCRK key pair of the network device to be installed in batches, and obtains the CARPK key pair corresponding to each network device to be installed from the certificate management center. It can be understood that,

[0091] Step 504, according to the chip identification of the network device to be installed, sending a DIPK allocation request to the certificate management center, receiving the certificate management center responding to the DIPK allocation request, and sending the DIPK private key corresponding to the chip identification.

[0092] Exemplarily, on the basis of monitoring that the security device production platform has control authority, the security chip production line is controlled to batch burn the root key and root certificate information of the network device to be installed, that is, the security device production platform sends a DIPK allocation request to the certificate management center according to the chip identification of the network device to be installed, the certificate management center responds to the DIPK allocation request, determines the DIPK public and private key corresponding to the chip identification, and stores the correspondence between the chip identification and the DIPK public and private key, and returns the DIPK private key to the security device production platform after signing the DIPK private key using the CARPK private key and encrypting the DIPK private key using the PCRK. Wherein, the security device production platform having control authority can be understood as the security device production platform logging in using the account password after installing the certificate management client. The certificate management client can be responsible for interfacing the security device manufacturer and the certificate management center, and data transfer.

[0093] Step 506, decrypting the DIPK private key ciphertext using the PCRK key pair to obtain the DIPK private key information.

[0094] Exemplarily, the secure device production platform decrypts the DIPK private key ciphertext using the PCRK, and obtains the DIPK private key information after verifying the signature using the CARPK.

[0095] In step 508, the DIPK private key information and the CARPK public key in the CARPK key pair are burned into the secure space of the secure chip; the DIPK private key information and the CARPK public key are used to generate device certificate application information of the network device to be installed, so as to complete the device certificate distribution of the network device to be installed.

[0096] In an exemplary embodiment, a device key transmission process is provided, as shown in FIG. 6, including a certificate management center, a certificate management client, and a secure device manufacturer, i.e., a secure device production platform. The secure device production platform applies for a device CARPK key pair to the certificate management center in response to a production instruction, and carries a PCRK public key, and sends the device CARPK key and the PCRK public key to the certificate management center in an offline encrypted and secure transmission manner, the certificate management center saves the PCRK public key and distributes the CARPK key pair and an account password of the certificate management client, and sends the CARPK public key and the account password of the client to the secure device manufacturer in an offline encrypted and secure transmission manner, the secure device manufacturer saves the received CARPK public key and the account password of the client, the secure device manufacturer installs the certificate management client, and after logging in with the account password, controls the burning of the secure chip of the device, the secure device production platform sends a DIPK allocation request to the certificate management center according to the chip identification of the network device to be installed, the certificate management center responds to the DIPK allocation request, determines the DIPK public and private keys corresponding to the chip identification, and stores the correspondence between the chip identification and the DIPK public and private keys, signs the DIPK private key using the CARPK private key and returns it to the secure device production platform after being encrypted by the PCRK, the secure device production platform decrypts the DIPK private key ciphertext using the PCRK, and obtains the DIPK private key information after verifying the signature using the CARPK, and burns the DIPK private key information and the CARPK public key in the CARPK key pair into the secure space of the secure chip, assembles the corresponding device with the burned secure chip, and delivers the device to the customer after integration and factory delivery, and completes the production.

[0097] The device certificate distribution method, by generating the PCRK key pair of the network device to be installed, and obtaining the CARPK key pair of the network device to be installed from the certificate management center; according to the chip identifier of the network device to be installed, a DIPK allocation request is sent to the certificate management center, and the DIPK private key ciphertext corresponding to the chip identifier is received in response to the DIPK allocation request; the DIPK private key ciphertext is decrypted according to the PCRK key pair to obtain the DIPK private key information; the DIPK private key information and the CARPK public key in the CARPK key pair are written to the secure space of the secure chip; the DIPK private key information and the CARPK public key are used to generate device certificate application information of the network device to be installed, to complete the device certificate distribution of the network device to be installed, which proposes that the certificate management center uniformly maintains a set of certificate and key system, only needs to synchronize the certificate information with other ends, and does not need to worry about that the use scene of the device is limited due to the manufacturer problem, unlike the existing manual intervention of the security chip key writing and the certificate distribution process, the process is fully automated to realize the secure transmission of the key information and the certificate distribution, and the safe and efficient production, automatic import of a large number of devices can be realized, and the risk of human intervention and certificate leakage is avoided.

[0098] It should be understood that, although each step in the flowchart involved in each of the above-described embodiments is shown in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other sequences. Moreover, at least part of the steps in the flowchart involved in each of the above-described embodiments can include multiple steps or stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or steps or stages in other steps.

[0099] Based on the same inventive concept, the embodiments of the present application also provide a device certificate distribution system for implementing the above-mentioned device certificate distribution method. The implementation scheme for solving the problem provided by the system is similar to the implementation scheme described in the above method, so the specific limitations in one or more device certificate distribution system embodiments provided below can refer to the limitations of the device certificate distribution method described above, which will not be repeated here.

[0100] In one exemplary embodiment, as shown in FIG. 7, a device certificate distribution system is provided, which includes a secure device production platform, a business management platform, a certificate management center, and a network device to be installed, wherein:

[0101] The security device production platform is configured to generate a PCRK key pair of a network device to be installed and obtain a CARPK key pair of the network device to be installed from a certificate management center; send a DIPK allocation request to the certificate management center according to a chip identifier of the network device to be installed, receive a DIPK private key ciphertext corresponding to the chip identifier sent by the certificate management center in response to the DIPK allocation request; decrypt the DIPK private key ciphertext according to the PCRK key pair to obtain DIPK private key information; and write the DIPK private key information and a CARPK public key in the CARPK key pair into a security space of the security chip.

[0102] The business management platform is configured to send a device certificate application request of the network device to be installed, the device certificate application request carrying device installation information, the chip identifier and key information of the network device to be installed; the key information is generated according to the DIPK key pair existing in the security chip.

[0103] The certificate management center is configured to determine corresponding DIPK public key information according to the chip identifier; generate corresponding device certificate information according to the DIPK public key information, the device installation information and the key information; and send the device certificate information to the network device to be installed to complete installation.

[0104] In the above device certificate distribution system, the security device manufacturer is responsible for writing the DIPK private key and the CARPK public key allocated to the device into the device security space, the business platform is responsible for controlling the device to generate the device certificate and transmit the device information and the certificate information, the device is responsible for generating the device certificate application information through the DIPK private key and the CARPK public key, the certificate management center is responsible for analyzing and verifying the device application information of the network device to be installed according to the DIPK public key and generating the corresponding device certificate, and the network device to be installed verifies and stores the device certificate information through the CARPK public key. In this way, the certificate management center uniformly maintains a set of certificate and key system, only needs to synchronize the certificate information with the manufacturer and the public security, does not need to worry about the limited use of the device due to the manufacturer problem, is different from the existing manual intervention in the security chip key writing and the certificate distribution process, the device production security chip key is fully automatically written and the certificate is automatically distributed, the process is fully automated, the secure transmission of the key information and the certificate distribution are realized, and the safe and efficient production, the automatic import of a large number of devices can be realized, and the risk of human intervention and certificate leakage is avoided.

[0105] Optionally, in an exemplary embodiment, the certificate management center is further configured to decrypt the DCPK ciphertext in the key information according to the DIPK public key information to obtain DCPK public key plaintext information; and generate the device certificate information according to the DCPK public key plaintext information and the device installation information.

[0106] Optionally, in an exemplary embodiment, the certificate management center is further configured to send the device certificate information to the network device to be installed, so that the network device to be installed verifies the device certificate information according to the CARPK public key stored in the secure chip, and stores the device certificate information in the secure chip of the network device to be installed upon verification, thereby completing the installation.

[0107] Optionally, in an exemplary embodiment, the DCPK ciphertext is generated by the service management platform controlling the network device to be installed to apply for the device certificate information, deriving the certificate public key information DCPK public key according to the DIPK public key stored in the secure chip of the network device to be installed, and encrypting the DCPK public key using the DIPK private key.

[0108] Optionally, in an exemplary embodiment, the DIPK private key in the DIPK key pair is determined according to the chip identifier of the secure chip in the network device to be installed carried in the allocation request for sending the device initial key pair by the secure device production platform.

[0109] The above-mentioned modules in the device certificate distribution system can be realized by software, hardware, and combinations thereof, in whole or in part. The above-mentioned modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory in the computer device in software form, so as to be called and executed by the processor to perform the operations corresponding to the above-mentioned modules.

[0110] In an example embodiment, a computer device is provided, which can be a terminal, and an internal structure diagram of the computer device can be as shown in FIG. 8. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input system. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input system are connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The input / output interface of the computer device is used to exchange information between the processor and external devices. The communication interface of the computer device is used to communicate with external terminals in a wired or wireless manner, and the wireless manner can be realized through WIFI, mobile cellular network, near field communication (NFC) or other technologies. The computer program is executed by the processor to implement a device certificate distribution method. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection system or a virtual reality imaging system. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input system of the computer device can be a touch layer overlaid on the display screen, or a key, trackball or touchpad arranged on the shell of the computer device, or an external keyboard, touchpad or mouse, etc.

[0111] Those skilled in the art can understand that the structure shown in FIG. 8 is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different component arrangement.

[0112] In an example embodiment, a computer device is provided, which includes a memory and a processor, the memory stores a computer program, and the processor executes the computer program to implement the steps in each of the above method embodiments.

[0113] In an embodiment, a computer readable storage medium is provided, having stored thereon a computer program which, when executed by a processor, implements the steps of any of the above method embodiments. In an embodiment, a computer readable storage medium is provided, having stored thereon a computer program which, when executed by a processor, implements the steps of any of the above method embodiments. It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant regulations.

[0114] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiment methods. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. The non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. The volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, the RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., without being limited thereto.

[0115] The technical features of the above embodiments can be combined in any manner. To make the description concise, not all possible combinations of the technical features in the above embodiments are described, but as long as the combinations of the technical features do not exist contradictions, they should be considered as the scope of the present application.

[0116] The above-described embodiments are merely illustrative of several embodiments of the present application, and the description is relatively specific and detailed, but should not be understood as a limitation on the scope of the patent. It should be noted that for those skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are all within the scope of the present application. Therefore, the scope of protection of the present application should be subject to the appended claims.

Claims

1. A device certificate distribution method characterized by comprising: The method applied to a certificate management center comprises: Receiving a device certificate application request of a network device to be installed sent by a business management platform, wherein the device certificate application request carries device installation information, chip identification and key information of the network device to be installed; the key information is generated according to a DIPK key pair in a security chip of the network device to be installed; Determining corresponding DIPK public key information according to the chip identification; Generating corresponding device certificate information according to the DIPK public key information, the device installation information and the key information; Sending the device certificate information to the network device to be installed to complete installation.

2. The method of claim 1, wherein, The generating of the corresponding device certificate information according to the DIPK public key information, the device installation information and the key information comprises: Decrypting DCPK ciphertext in the key information according to the DIPK public key information to obtain DCPK public key plaintext information; Generating device certificate information according to the DCPK public key plaintext information and the device installation information.

3. The method of claim 2, wherein, The sending of the device certificate information to the network device to be installed to complete installation comprises: Sending the device certificate information to the network device to be installed to enable the network device to be installed to verify the device certificate information according to a CARPK public key stored in a security chip, and to complete installation in the case of verification.

4. The method of claim 2, wherein, The DCPK ciphertext is certificate public key information DCPK public key derived according to a DIPK public key stored in a security chip of the network device to be installed, and encrypted by using a DIPK private key.

5. The method of claim 1, wherein, The DIPK private key in the DIPK key pair is determined according to a chip identification of a security chip in the network device to be installed received by a security device production platform in a distribution request of a device initial key pair.

6. The method according to any one of claims 1 to 5, characterized in that, The network device to be installed comprises a GB35114 device.

7. A device certificate distribution method characterized by comprising: The method applied to a security device production platform comprises: Generating a PCRK key pair of a network device to be installed, and obtaining a CARPK key pair of the network device to be installed from a certificate management center; Sending a DIPK distribution request to the certificate management center according to a chip identification of the network device to be installed, and receiving DIPK private key ciphertext corresponding to the chip identification sent by the certificate management center in response to the DIPK distribution request; Decrypting the DIPK private key ciphertext according to the PCRK key pair to obtain DIPK private key information; Burning and writing the DIPK private key information and a CARPK public key in the CARPK key pair into a security space of the security chip; the DIPK private key information and the CARPK public key are used to generate device certificate application information of the network device to be installed to complete device certificate distribution of the network device to be installed.

8. An apparatus certificate distribution system characterized by comprising: The system comprises a security device production platform, a business management platform, a certificate management center and a network device to be installed, wherein: The security device production platform is configured to generate a PCRK key pair of the network device to be installed and obtain a CARPK key pair of the network device to be installed from the certificate management center; send a DIPK allocation request to the certificate management center according to a chip identifier of the network device to be installed; receive a DIPK private key ciphertext corresponding to the chip identifier sent by the certificate management center in response to the DIPK allocation request; decrypt the DIPK private key ciphertext according to the PCRK key pair to obtain DIPK private key information; and burn and write the DIPK private key information and a CARPK public key in the CARPK key pair into a secure space of the security chip; The business management platform is configured to send a device certificate application request of the network device to be installed, wherein the device certificate application request carries device installation information, a chip identifier and key information of the network device to be installed; and the key information is generated by the network device to be installed according to a DIPK key pair existing in the security chip; The certificate management center is configured to determine corresponding DIPK public key information according to the chip identifier; generate corresponding device certificate information according to the DIPK public key information, the device installation information and the key information; and send the device certificate information to the network device to be installed to complete installation. 9.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-8 when the computer program is executed by the processor. The processor executes the computer program to implement the steps of the method in any one of claims 1 to 7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 7.

Images