Certificate issuance method and related apparatus

Abstract

A certificate issuance method, used for improving the security of the certificate issuance process. In the certificate issuance method, when a certificate application device applies for issuance of a certificate, a certificate issuance device returns to the certificate application device a challenge of which the challenge type is remote attestation, so as to instruct the certificate application device to complete the challenge by executing the remote attestation. In addition, when the certificate issuance device verifies that the certificate application device successfully completes the challenge, the certificate issuance device issues a certificate to the certificate application device. When the certificate application device performs remote attestation, a remote attestation server verifies the trustworthiness of the certificate application device, and the remote attestation process can be completed only if the trustworthiness of the certificate application device is successfully verified. Therefore, when the certificate application device completes the challenge, the certificate issuance device can determine that the trustworthiness of the certificate application device is successfully verified, thereby ensuring that the certificate issuance device issues a certificate to a trusted device, and further ensuring the security of the certificate issuance process.

Description

A certificate issuance method and related apparatus

[0001] This application claims priority to Chinese Patent Application No. 202411186320.0, filed on August 27, 2024, entitled "A Certificate Issuance Method and Related Apparatus", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of computer security technology, and in particular to a certificate issuance method and related apparatus. Background Technology

[0003] An Automatic Certificate Management Environment (ACME) is a protocol for automating the processing of digital certificate issuance requests. Based on ACME, Certificate Authorities (CAs) automatically verify the domain name ownership of certificate applicants, thereby issuing the corresponding certificates without human intervention.

[0004] In the ACME-based certificate issuance process, the ACME server, acting as the verifier, sends a challenge to the ACME client device, which is the certificate applicant. Upon successful completion of the challenge, the ACME server issues a certificate to the client device. The challenge sent by the ACME server is essentially used to verify the client device's ownership of a specific identifier (such as a domain name or company name). Therefore, the condition for the ACME server to issue a certificate is verifying that the client device owns a particular identifier.

[0005] Currently, certificate issuance based on ACME can only prove that the ACME client device owns a certain identifier, but it cannot prove that the ACME client device itself is secure and trustworthy, resulting in low security in the certificate issuance process. Summary of the Invention

[0006] This application provides a certificate issuance method and related apparatus that can improve the security of the certificate issuance process.

[0007] Firstly, a certificate issuance method is provided, applied to a first network device acting as a certificate issuance device. The certificate issuance method includes: the first network device receiving a certificate request message sent by a second network device, the certificate request message being used to request the issuance of a certificate.

[0008] In response to the received certificate request message, the first network device sends a challenge message to the second network device. The challenge message instructs the second network device to complete the challenge by performing remote authentication. That is, the first network device sends a challenge message to instruct the second network device to complete the challenge specified by the first network device, and the challenge specified by the first network device is to perform remote authentication.

[0009] After the second network device completes the challenge, the first network device obtains the challenge result. This result includes a remote verification result, which instructs the second network device on the outcome of its remote verification process. Generally, the remote verification result is generated by a remote verification server after verifying the trustworthiness of the second network device, and is used to prove the trustworthiness of the second network device.

[0010] In this way, the first network device can further verify the obtained challenge results, and if the challenge results are verified, the first network device issues a certificate to the second network device.

[0011] In this scheme, when a certificate requesting device requests a certificate, the certificate issuing device returns a challenge of type remote verification to the requesting device, instructing it to complete the challenge by performing remote verification. Furthermore, the certificate issuing device only issues the certificate to the requesting device after verifying that it has successfully completed the challenge. Since the remote verification server verifies the trustworthiness of the requesting device during remote verification, and the remote verification process can only be completed after the requesting device's trustworthiness is verified, the certificate issuing device can determine that the requesting device's trustworthiness has been verified upon completion of the challenge. This ensures that the certificate issuing device issues certificates to trusted devices, thereby guaranteeing the security of the certificate issuance process.

[0012] In one possible implementation, the remote proof result includes attributes of the second network device. During the verification of the challenge result, the first network device first verifies the authenticity of the remote proof result. For example, the first network device verifies the digital signature in the remote proof result using a digital signature verification method to verify the authenticity of the remote proof result.

[0013] Upon successful verification of the remote authentication result, the first network device then verifies whether the attributes of the second network device meet the certificate issuance requirements based on the remote authentication result. Furthermore, if the attributes of the second network device meet the certificate issuance requirements, the first network device determines that the challenge result has passed verification.

[0014] In this solution, the certificate issuing device, in addition to verifying the authenticity of the remote certification result itself, further verifies whether the attributes of the certificate requesting device included in the remote certification result meet the certificate issuance conditions. This expands the verification scope to a range of attributes of the certificate requesting device, allowing the certificate issuing device to refuse to issue certificates to certificate requesting devices whose attributes do not meet the conditions, thus further improving the security of the certificate issuance process. Furthermore, since the certificate issuing device obtains the attributes of the certificate requesting device from the verified remote certification result, it can ensure the authenticity of the obtained attributes and prevent the certificate issuing device from obtaining forged attributes, thereby guaranteeing the reliability of the attribute verification process for the certificate requesting device.

[0015] In one possible implementation, the attributes of the second network device include multiple attribute identifiers, which indicate different attributes of the second network device. For example, one of the attribute identifiers indicates information about certain hardware of the second network device, while another attribute identifier indicates a version number of certain software in the second network device. The certificate issuance conditions include at least one attribute condition, which indicates the conditions that the attribute identifiers of the second network device must meet.

[0016] In verifying whether the attributes of the second network device meet the certificate issuance requirements, the first network device first determines at least one attribute identifier from multiple attribute identifiers that must meet the attribute conditions based on at least one attribute condition. Then, the first network device determines whether each of the at least one attribute identifier meets the corresponding attribute condition to determine whether the attributes of the second network device meet the certificate issuance requirements.

[0017] In one possible implementation, multiple attribute identifiers include the version number of the target software in the second network device, and at least one attribute condition includes that the version number of the target software is not lower than a preset version number.

[0018] Therefore, the first network device determines the version number of the target software in the second network device from multiple attribute identifiers and checks whether the version number of the target software is not lower than a preset version number. If the version number of the target software is not lower than the preset version number, it means that the attributes of the second network device meet the certificate issuance conditions; if the version number of the target software is lower than the preset version number, it means that the attributes of the second network device do not meet the certificate issuance conditions.

[0019] For example, if the certificate issuance conditions include that the version number of the target software is not lower than the preset version number, and the version number of the target software in the second network device is lower than the preset version number, it means that the target software in the second network device has not been updated in time and is vulnerable to attack. Therefore, the first network device determines that the challenge result of the first network device has not passed the verification and refuses to issue a certificate to the second network device in order to avoid the security risks brought about by issuing a certificate to the second network device.

[0020] In one possible implementation, the challenge message sent by the first network device to the second network device includes a challenge type and a challenge identifier. The challenge type indicates the type of challenge task that the second network device needs to complete, including remote proof, and the challenge identifier identifies the current challenge task that the second network device needs to complete.

[0021] The challenge result obtained by the first network device includes the remote proof result, the challenge identifier, and the signature information. The signature information is obtained by the second network device signing the remote proof result and the challenge identifier. That is, after obtaining the remote proof result, the second network device simultaneously sends the remote proof result and the challenge identifier back to the first network device to declare that the second network device has completed the challenge specified by the first network device.

[0022] In one possible implementation, in order to facilitate the first network device in determining the challenge types supported by the second network device, the certificate request message sent by the second network device to the first network device is also used to instruct the second network device to support performing remote certification.

[0023] In one possible implementation, the challenge message sent by the first network device to the second network device includes a challenge type and a challenge identifier. The challenge type indicates the type of challenge task that the second network device needs to complete, including remote proof. The challenge identifier identifies the current challenge task that the second network device needs to complete. The challenge message instructs the second network device to perform remote proof using the challenge identifier as part of the attribute evidence.

[0024] Specifically, the verification of the challenge result includes: the authenticity of the remote proof result is verified and the remote proof result includes the challenge identifier.

[0025] In other words, when the second network device performs the remote proof process, it needs to submit the challenge identifier provided by the first network device as attribute evidence to the remote proof server in order to obtain a remote proof result that includes the challenge identifier.

[0026] In one possible implementation, the challenge message includes a list of remote verification servers (Verifiers), which indicates the remote verification servers that the second network device can select when performing remote verification. The list of remote verification servers includes one or more remote verification servers, and all remote verification servers included in the list are trusted by the first network device.

[0027] In one possible implementation, the first network device can obtain the challenge result in several ways. For example, the first network device receives the challenge result sent by the second network device. Alternatively, the first network device receives a challenge completion notification sent by the second network device and obtains the challenge result based on the challenge completion notification, where the challenge completion notification indicates the location where the challenge result is stored. That is, after generating the challenge result based on the remote proof result, the second network device does not directly send the challenge result to the first network device, but stores the challenge result in a specific location and notifies the first network device to retrieve the challenge result from that specific location.

[0028] In one possible implementation, the first network device acts as a proxy device to assist the second network device in performing the remote proof process, thereby obtaining a challenge result from the remote proof server. Specifically, the first network device first receives attribute evidence sent by the second network device. Then, the first network device sends the attribute evidence to the remote proof server, which verifies the attribute evidence and generates a remote proof result. After the remote proof server generates the remote proof result, the first network device receives the challenge result from the remote proof server, which is the remote proof result generated by the remote proof server.

[0029] Secondly, a certificate issuance method is provided, applied to a second network device acting as a certificate requesting device. The certificate issuance method includes: the second network device sending a certificate request message to a first network device, the certificate request message being used to request the issuance of a certificate; the second network device receiving a challenge message sent by the first network device, the challenge message being used to instruct the second network device to complete the challenge by performing remote verification; and, if the second network device completes the challenge and the challenge result of the second network device is verified, the second network device receiving the certificate issued by the first network device, the challenge result including a remote verification result, the remote verification result being used to instruct the second network device on the result of performing the remote verification process.

[0030] In one possible implementation, the challenge message includes a challenge type and a challenge identifier. The challenge type indicates the type of challenge task that the second network device needs to complete, including remote proof. The challenge identifier identifies the current challenge task that the second network device needs to complete. The challenge result includes the remote proof result, the challenge identifier, and signature information. The signature information is obtained by the second network device signing the remote proof result and the challenge content.

[0031] In one possible implementation, the certificate request message is also used to instruct a second network device to support the execution of remote certification.

[0032] In one possible implementation, the challenge message includes a challenge type and a challenge identifier. The challenge type indicates the type of challenge task that the second network device needs to complete, including remote proof. The challenge identifier identifies the current challenge task that the second network device needs to complete. The challenge message instructs the second network device to perform remote proof by using the challenge identifier as part of the attribute evidence.

[0033] The challenge result is verified, including: the authenticity of the remote proof result is verified and the remote proof result includes the challenge identifier.

[0034] In one possible implementation, the challenge message includes a list of remote verification servers, which indicates the remote verification servers that the second network device can select when performing remote verification. The certificate issuance method further includes: the second network device selecting a remote verification server from the list of remote verification servers to perform the remote verification process and obtain a remote verification result.

[0035] In one possible implementation, after the second network device completes the challenge, the certificate issuance method further includes: the second network device sending the challenge result to the first network device; or, the second network device sending a challenge completion notification to the first network device, the challenge completion notification indicating the location where the challenge result is stored.

[0036] In one possible implementation, the certificate issuance method further includes: a second network device sending attribute evidence to a first network device, wherein the first network device is used to forward the attribute evidence to a remote certification server, and the remote certification server is used to verify the attribute evidence and generate a remote certification result.

[0037] Thirdly, a certificate issuing device is provided, which is deployed on a first network device and includes: a receiving module for receiving a certificate application message sent by a second network device, the certificate application message being used to apply for certificate issuance; a sending module for sending a challenge message to the second network device, the challenge message being used to instruct the second network device to complete the challenge by performing remote verification; the receiving module is further configured to obtain a challenge result after the second network device completes the challenge, the challenge result including a remote verification result, the remote verification result being used to instruct the second network device to perform the result of the remote verification process; and the sending module is further configured to issue a certificate to the second network device if the challenge result is verified.

[0038] In one possible implementation, the remote verification result includes the attributes of the second network device, and the certificate issuing device further includes a processing module for: verifying the authenticity of the remote verification result; when the remote verification result passes verification, verifying whether the attributes of the second network device meet the certificate issuing conditions based on the remote verification result; and determining that the challenge result passes verification if the attributes of the second network device meet the certificate issuing conditions.

[0039] In one possible implementation, the attributes of the second network device include multiple attribute identifiers, which are used to indicate different attributes of the second network device. The certificate issuance conditions include at least one attribute condition, which is used to indicate the conditions that the attribute identifiers of the second network device must meet. The processing module is specifically used to: based on at least one attribute condition, the first network device determines at least one attribute identifier from the multiple attribute identifiers that must meet the attribute condition; the first network device determines whether each of the at least one attribute identifiers meets the corresponding attribute condition, so as to determine whether the attributes of the second network device meet the certificate issuance conditions.

[0040] In one possible implementation, multiple attribute identifiers include the version number of the target software in the second network device, and at least one attribute condition includes that the version number of the target software is not lower than a preset version number.

[0041] In one possible implementation, the challenge message includes a challenge type and a challenge identifier. The challenge type indicates the type of challenge task that the second network device needs to complete, including remote proof. The challenge identifier identifies the current challenge task that the second network device needs to complete. The challenge result includes the remote proof result, the challenge identifier, and signature information. The signature information is obtained by the second network device signing the remote proof result and the challenge identifier.

[0042] In one possible implementation, the certificate request message is also used to instruct a second network device to support the execution of remote certification.

[0043] In one possible implementation, the challenge message includes a challenge type and a challenge identifier. The challenge type indicates the type of challenge task that the second network device needs to complete, including remote proof. The challenge identifier identifies the current challenge task that the second network device needs to complete. The challenge message instructs the second network device to perform remote proof using the challenge identifier as part of the attribute evidence. The challenge result is verified, including: the authenticity of the remote proof result is verified and the remote proof result includes the challenge identifier.

[0044] In one possible implementation, the challenge message includes a list of remote proof servers, which indicates the remote proof servers that the second network device can select when performing remote proof.

[0045] In one possible implementation, the receiving module is further configured to: receive a challenge result sent by the second network device; or, receive a challenge completion notification sent by the second network device and obtain the challenge result based on the challenge completion notification, wherein the challenge completion notification is used to indicate the location where the challenge result is stored.

[0046] In one possible implementation, the receiving module is further configured to receive attribute evidence sent by the second network device; the sending module is further configured to send the attribute evidence to a remote proof server, which verifies the attribute evidence and generates a remote proof result; and the receiving module is further configured to receive a challenge result from the remote proof server.

[0047] Fourthly, a certificate application apparatus is provided, which is deployed on a second network device and includes: a sending module for sending a certificate application message to a first network device, the certificate application message being used to apply for the issuance of a certificate; a receiving module for receiving a challenge message sent by the first network device, the challenge message being used to instruct the second network device to complete the challenge by performing remote proof; the receiving module is further configured to receive a certificate issued by the first network device if the second network device completes the challenge and the challenge result of the second network device is verified, the challenge result including a remote proof result, the remote proof result being used to instruct the second network device to perform the result of the remote proof process.

[0048] In one possible implementation, the challenge message includes a challenge type and a challenge identifier. The challenge type indicates the type of challenge task that the second network device needs to complete, including remote proof. The challenge identifier identifies the current challenge task that the second network device needs to complete. The challenge result includes the remote proof result, the challenge identifier, and signature information. The signature information is obtained by the second network device signing the remote proof result and the challenge content.

[0049] In one possible implementation, the certificate request message is also used to instruct a second network device to support the execution of remote certification.

[0050] In one possible implementation, the challenge message includes a challenge type and a challenge identifier. The challenge type indicates the type of challenge task that the second network device needs to complete, including remote proof. The challenge identifier identifies the current challenge task that the second network device needs to complete. The challenge message instructs the second network device to perform remote proof using the challenge identifier as part of the attribute evidence. The challenge result is verified, including: the authenticity of the remote proof result is verified and the remote proof result includes the challenge identifier.

[0051] In one possible implementation, the challenge message includes a list of remote proof servers, which indicates the remote proof servers that the second network device can select when performing remote proof; the sending module is also used for the second network device to select a remote proof server from the list of remote proof servers to perform the remote proof process and obtain the remote proof result.

[0052] In one possible implementation, the sending module is further configured to: send the challenge result to the first network device; or, send a challenge completion notification to the first network device, the challenge completion notification indicating the location where the challenge result is stored.

[0053] In one possible implementation, the sending module is further configured to send attribute evidence to a first network device, wherein the first network device is configured to forward the attribute evidence to a remote proof server, and the remote proof server is configured to verify the attribute evidence and generate a remote proof result.

[0054] A fifth aspect of this application provides a network device, including a processor and a memory; wherein the memory is used to store program code, and the processor is used to call the program code in the memory to cause the network device to perform a method as implemented in any one of the first to second aspects.

[0055] The sixth aspect of this application provides a certificate issuance system, including a first network device and a second network device, wherein the first network device is deployed with means as in any implementation of the third aspect, and the second network device is deployed with means as in any implementation of the fourth aspect.

[0056] The seventh aspect of this application provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform a method as described in any one of the embodiments of the first to second aspects.

[0057] The eighth aspect of this application provides a computer program product that, when run on a computer, causes the computer to perform a method as described in any of the embodiments of the first to second aspects.

[0058] A ninth aspect of this application provides a chip including one or more processors. Part or all of the processors are used to read and execute computer instructions stored in a memory to perform the methods in any possible implementation of any of the above aspects. Optionally, the chip also includes a memory. Optionally, the chip also includes a communication interface, with the processor connected to the communication interface. The communication interface is used to receive data and / or information to be processed, the processor obtains the data and / or information from the communication interface, processes the data and / or information, and outputs the processing results through the communication interface. Optionally, the communication interface is an input / output interface or a bus interface. The methods provided in this application are implemented by a single chip or by multiple chips working together.

[0059] The solutions provided in the third to ninth aspects above are used to implement or cooperate with the methods provided in the first to second aspects above, and therefore can achieve the same or corresponding beneficial effects as the first to second aspects, which will not be elaborated here. Attached Figure Description

[0060] Figure 1A is a schematic diagram of a remote proof model provided in this application;

[0061] Figure 1B is a schematic diagram of the existing ACME challenge types and identifiers in related technologies;

[0062] Figure 2 is a flowchart illustrating a certificate issuance method provided in this application;

[0063] Figure 3 is a schematic diagram of the process by which a first network device verifies the challenge result according to this application;

[0064] Figure 4 is a schematic diagram of the process by which a second network device, according to this application, applies for a certificate based on a pre-obtained remote authentication result;

[0065] Figure 5 is a flowchart illustrating the process by which a second network device, as provided in this application, performs a remote authentication process to apply for a certificate after receiving an instruction.

[0066] Figure 6 is a flowchart illustrating the process by which another second network device provided in this application applies for a certificate by performing a remote authentication process after receiving an instruction;

[0067] Figure 7 is a flowchart illustrating a process provided in this application in which a first network device acts as a proxy device to assist a second network device in completing a remote authentication process.

[0068] Figure 8 is a structural schematic diagram of a certificate issuing device provided in this application;

[0069] Figure 9 is a structural schematic diagram of a certificate application device provided in this application;

[0070] Figure 10 is a schematic diagram of the structure of a network device provided in this application. Detailed Implementation

[0071] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application are described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Those skilled in the art will understand that with the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0072] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0073] To facilitate understanding, some technical terms used in this application will be introduced below.

[0074] (1) Digital Certificate

[0075] A digital certificate (hereinafter referred to as a certificate) is a digital authentication that identifies the parties involved in internet communication. Essentially, a digital certificate is a file issued by a Certificate Authority (CA) containing information about the public key owner and the public key itself. The simplest certificate typically contains a public key, a certificate name, and the CA's digital signature.

[0076] (2) Remote verification

[0077] Network devices (such as switches, servers, gateways, or terminal devices) send their security attributes (such as hardware and software metrics, configuration information, and node status) to a remote verification device through a specific format and interaction process. The remote verification device then verifies the network device's trustworthiness according to a defined strategy. Furthermore, to ensure the security of devices and communication throughout the entire remote verification protocol interaction process, a certificate mechanism (such as certificate application) must be pre-deployed to support necessary operations such as certificate verification and viewing during the protocol interaction process.

[0078] Please refer to Figure 1A, which is a schematic diagram of a remote authentication model provided in this application. As shown in Figure 1A, any device requiring remote authentication, such as a server, gateway, or terminal device, can be abstracted as an Attest Platform. During the startup process of the Attest Platform, the Trusted Platform Module (TPM), Basic Input Output System (BIOS), Operating System (Kernel), and Application (APP) perform metric calculations and recording. Furthermore, the Attest Platform interacts with external Certification Authorities (CAs) to perform operations such as certificate application. Remote authentication between the Attest Platform and the Attest Server can be performed using a challenge-response method. That is, the remote authentication device actively initiates a challenge request to the attributes of the Attest Platform; the Attest Platform responds to the challenge request, using the certificate obtained from the CA to encrypt and sign its recorded metric values ​​and other attributes, as well as information used to prove the trustworthiness of the attributes (such as device logs), and returns the encrypted and signed secure attributes to the remote authentication server. In other words, the Attest Platform submits attribute evidence to a remote proof server for verification. This involves the remote proof device interacting with the CA to verify the validity of the Attest Platform's certificate and to decrypt and verify the security attributes received from the Attest Platform. If the security attributes sent by the Attest Platform pass verification, the remote proof server sends the remote proof result back to the Attest Platform.

[0079] (3) Digital Signature

[0080] A digital signature (also known as a public-key digital signature) is a string of numbers that only the signer of the message can generate and that cannot be forged by others. This string of numbers also serves as valid proof of the authenticity of the message sent by the signer. A digital signature is similar to a physical signature written on paper; it is essentially a method of verifying digital information using public-key cryptography.

[0081] When generating a digital signature, the signer uses a hash function to process the text, generates a text digest, and then encrypts the text digest with the signer's private key. This encrypted digest then serves as the digital signature of the text.

[0082] Generally, digital signatures serve two purposes: first, they verify that the text was indeed signed and sent by the signer, as no one can forge the signer's signature; second, they ensure the integrity of the text. Because a digital signature represents the characteristics of the text, if the text changes, the value of the digital signature will also change. That is, different texts will result in different digital signatures.

[0083] (4) Digital signature verification method

[0084] Digital signature verification is a method of determining the integrity of text by verifying its digital signature.

[0085] Specifically, when verifying a digital signature on text, the verifier first uses the same hash function as the signer to calculate a text digest from the obtained text. Then, the verifier uses the public key to decrypt the digital signature sent by the signer, obtaining the text digest. If the text digest calculated by the verifier using the hash function is the same as the decrypted text digest, then the verifier can confirm that the obtained text is authentic and complete.

[0086] Currently, in the process of automatically issuing certificates to ACME client devices via ACME server equipment, the condition for the ACME server equipment to issue a certificate is that it verifies that the ACME client device has ownership of a certain identifier. Therefore, implementing certificate issuance based on ACME can only prove that the ACME client device has ownership of a certain identifier, but it cannot prove that the ACME client device itself is secure and trustworthy, resulting in low security in the certificate issuance process.

[0087] Specifically, please refer to Figure 1B, which is a schematic diagram of existing ACME challenge types and identifiers in related technologies. As shown in Figure 1B, various ACME challenge types have been defined in the prior art, and each ACME challenge type typically has a corresponding identifier. However, in the prior art, the challenge type returned by the ACME server device to the ACME client device usually verifies whether the ACME client device owns a certain identifier. For example, in the case of challenge type Hypertext Transfer Protocol (HTTP)-01, the ACME server device verifies whether the ACME client owns a certain webpage. As another example, in the case of challenge type Domain Name System (DNS)-01, the ACME server device verifies whether the ACME client owns DNS.

[0088] Therefore, when a certificate requesting device requests a certificate, the certificate issuing device returns a challenge of the remote verification type (and this challenge type is newly defined) to the requesting device, instructing it to complete the challenge by performing remote verification. Furthermore, the certificate issuing device only issues the certificate to the requesting device after verifying that it has successfully completed the challenge. Since the remote verification server verifies the trustworthiness of the requesting device during remote verification, and the remote verification process can only be completed after the requesting device's trustworthiness is verified, the certificate issuing device can determine that the requesting device's trustworthiness has been verified upon completion of the challenge. This ensures that the certificate issuing device is issuing certificates to trusted devices, thereby guaranteeing the security of the certificate issuance process.

[0089] Specifically, the certificate issuance method provided in this application can be applied to certificate application scenarios for various network devices (such as switches, gateways, routers, hubs, servers, personal computers, or smartphones that have certificate application requirements), so that only network devices that meet security requirements can obtain certificates.

[0090] For example, in a factory campus scenario, each worker possesses a terminal device for inspecting products, and this terminal device is a network device owned by the company. To ensure the security of the terminal device, the company typically updates the inspection software on it continuously. However, since the terminal device is actually operated by workers, some workers may not update the inspection software as required (i.e., they may not upgrade the inspection software to the latest version). In this case, based on the certificate issuance method provided in this application, the certificate issuance device can require the terminal device to perform remote verification during the worker's certificate application process and obtain the remote verification result. Based on the remote verification result of the terminal device, the certificate issuance device can obtain the version number of the inspection software on the terminal device and thus determine whether to issue a certificate to the terminal device. For example, if the version number of the inspection software on the terminal device is lower than the version number set by the company, the certificate issuance will be refused, thus preventing the terminal device from using the certificate for network communication.

[0091] For example, in carrier scenarios, the firmware or configuration information of network devices (such as routers or gateways) operating in communication networks often have manufacturer-recommended security update channels and minimum security baseline configurations. Therefore, by adopting the certificate issuance method provided in this application, carriers can manage the security baseline of network devices in their communication networks. That is, when a network device applies for a certificate, the certificate issuing device obtains and verifies the firmware or configuration information in the network device using the certificate issuance method provided in this application. Furthermore, if the firmware or configuration information in the network device does not conform to the security baseline configuration, the certificate issuing device refuses to issue a certificate to the network device, thereby ensuring the security of the network device.

[0092] Please refer to Figure 2, which is a flowchart illustrating a certificate issuance method provided in this application. As shown in Figure 2, the execution flow of the certificate issuance method provided in this application includes the following steps 201-204.

[0093] Step 201: The first network device receives a certificate request message sent by the second network device. The certificate request message is used to request the issuance of a certificate.

[0094] In this application, the first network device is a certificate issuing device, such as an ACME server device (i.e., an ACME server), capable of automatically issuing certificates to certificate requesting devices. The second network device is a certificate requesting device, which needs to request a certificate from the certificate issuing device. Exemplarily, the second network device may be a switch, gateway, router, hub, server, personal computer, or smartphone.

[0095] When the second network device needs to apply for a certificate, it sends a certificate application message to the first network device to request the first network device to issue a certificate for the second network device.

[0096] Optionally, to facilitate the first network device in determining the challenge types supported by the second network device, the certificate request message is also used to instruct the second network device to support remote verification. Thus, based on the certificate request message, the first network device confirms that the second network device currently requesting the certificate is capable of performing remote verification, and therefore the first network device can instruct the second network device to complete the challenges in the certificate issuance process by performing remote verification.

[0097] Step 202: The first network device sends a challenge message to the second network device, which instructs the second network device to complete the challenge by performing remote authentication.

[0098] To ensure the security of the certificate issuance process, after receiving the certificate request message, the first network device sends a challenge message to the second network device, instructing the second network device to complete the challenge specified by the first network device. Specifically, the challenge message sent by the first network device instructs the second network device to complete the challenge by performing remote authentication.

[0099] Optionally, since remote proof is not included in the existing challenge types, this application can define a new challenge type based on the existing challenge types, and the newly defined challenge type is remote proof. Based on this, the challenge message sent by the first network device to the second network device includes a challenge type, which indicates that the type of challenge task to be completed by the second network device includes remote proof. For example, the challenge message may include a newly defined challenge type identifier, which can indicate that the type of challenge task is remote proof.

[0100] Step 203: After the second network device completes the challenge, the first network device obtains the challenge result, which includes the remote proof result. The remote proof result is used to instruct the second network device on the result of performing the remote proof process.

[0101] Since the challenge message instructs the second network device to complete the challenge by performing remote proof, after the second network device completes the remote proof and obtains the remote proof result, the second network device has completed the challenge specified by the second network device, thereby obtaining the challenge result.

[0102] The first network device obtains the challenge result from the second network device or another device. Since the challenge performed by the first network device is specifically a remote proof process, the challenge result will include the remote proof result to indicate the result of the second network device performing the remote proof process.

[0103] Generally, remote proof results are generated by a remote proof server. During the remote proof process, the second network device submits attribute evidence to the remote proof server. This evidence includes multiple attribute identifiers and information used to verify the credibility of these identifiers (such as the second network device's operational logs). These attribute identifiers indicate different attributes of the second network device (such as hardware information, software version numbers, and configuration information). The remote proof server verifies the attribute evidence submitted by the second network device (e.g., comparing it with reference values ​​for device attributes) and generates the remote proof result based on the verified attributes.

[0104] Step 204: If the challenge result is verified, the first network device issues a certificate to the second network device.

[0105] After obtaining the challenge result corresponding to the second network device, the first network device verifies the challenge result. For example, in one optional implementation, the first network device verifies the remote proof result in the challenge result to determine the authenticity of the remote proof result. If the remote proof result can be verified, it means that the challenge result has been verified; if the remote proof result cannot be verified, it means that the challenge result has not been verified.

[0106] If the challenge result is verified, the first network device issues a certificate to the second network device; if the challenge result is not verified, the first network device refuses to issue a certificate to the second network device.

[0107] In this solution, by combining the certificate issuance process with remote verification, it is ensured that the certificate requesting device's trustworthiness is verified by a remote verification server when requesting a certificate. The remote verification process is only completed after the certificate requesting device's trustworthiness is verified. Therefore, if the certificate requesting device completes the challenge specified by the certificate issuing device, the certificate issuing device can determine that the certificate requesting device's trustworthiness has been verified, thus ensuring that the certificate issuing device issues certificates to trusted devices and guaranteeing the security of the certificate issuance process.

[0108] To facilitate understanding, the process of the first network device verifying the challenge results will be described in detail below.

[0109] Please refer to Figure 3, which is a schematic diagram of the process by which a first network device verifies the challenge result according to this application. As shown in Figure 3, step 204 specifically includes the following steps 2401-2403.

[0110] Step 2401: The first network device verifies the authenticity of the remote verification result.

[0111] Since the challenge results include remote proof results, the first network device needs to verify the authenticity of the remote proof results themselves to determine whether the second network device actually performed the remote proof process.

[0112] Specifically, the remote verification result typically includes the attributes of the second network device (i.e., the attribute identifier submitted by the second network device to the remote verification device when performing remote verification) and a digital signature obtained based on the attributes of the second network device. Therefore, the first network device can verify the authenticity of the remote verification result by using a digital signature verification method. The description of the digital signature verification method can be found in the technical terminology explanation above and will not be repeated here.

[0113] Step 2402: When the remote verification result passes the verification, the first network device verifies whether the attributes of the second network device meet the certificate issuance conditions based on the remote verification result.

[0114] The remote verification result includes attributes of the second network device, such as hardware information, software version number, and configuration information. Furthermore, the first network device has pre-set certificate issuance conditions to further verify whether the second network device applying for the certificate meets these conditions.

[0115] Specifically, if the authenticity of the remote verification result is verified, the first network device obtains the attributes of the second network device from the remote verification result and further verifies whether the attributes of the second network device meet the certificate issuance conditions.

[0116] Optionally, in the remote authentication result, the attributes of the second network device specifically include multiple attribute identifiers, which are used to indicate different attributes of the second network device. For example, one of the attribute identifiers indicates information about a certain hardware component of the second network device, while another attribute identifier indicates the version number of a certain software component in the second network device. The pre-set certificate issuance conditions in the first network device include at least one attribute condition, which indicates the conditions that the attribute identifiers of the second network device must meet. For example, each of the at least one attribute condition corresponds to an attribute identifier, and each attribute condition indicates the conditions that the corresponding attribute identifier must meet.

[0117] Thus, based on at least one attribute condition in the certificate issuance conditions, the first network device determines at least one attribute identifier from multiple attribute identifiers in the remote verification result that must satisfy the attribute condition. Furthermore, the first network device determines whether each of the at least one attribute identifiers in the remote verification result satisfies the corresponding attribute condition, thereby determining whether the attributes of the second network device meet the certificate issuance conditions.

[0118] For example, multiple attribute identifiers include the version number of the target software in the second network device, and at least one attribute condition includes that the version number of the target software is not lower than a preset version number. Therefore, the first network device determines the version number of the target software in the second network device from multiple attribute identifiers and checks whether the version number of the target software is not lower than the preset version number. If the version number of the target software is not lower than the preset version number, it means that the attributes of the second network device meet the certificate issuance conditions; if the version number of the target software is lower than the preset version number, it means that the attributes of the second network device do not meet the certificate issuance conditions.

[0119] For example, in a campus scenario, the second network device is, for instance, a terminal device used for product inspection, and the target software is, for instance, inspection software within the second network device used to perform product inspection. Since the second network device is actually operated by workers, some workers may not update the inspection software in the second network device as required. Therefore, after obtaining the version number of the inspection software in the second network device, if the first network device determines that the version number of the inspection software in the second network device is lower than the version number set by the company (i.e., the preset version number), it refuses to issue a certificate to the second network device, thereby preventing the second network device from using the certificate for network communication.

[0120] For example, in a carrier scenario, the second network device might be a network device (such as a switch or gateway) used to perform data forwarding in a communication network, and the target software might be the firmware in the second network device. Since the firmware on the second network device often has manufacturer-recommended security update channels and minimum security baseline configurations, after obtaining the version number of the verification software in the second network device, if the first network device determines that the version number of the verification software in the second network device is lower than the version number specified in the security baseline configuration (i.e., the preset version number), it will refuse to issue a certificate to the second network device, thus preventing the second network device from using the certificate for network communication.

[0121] Furthermore, when the certificate issuance conditions include at least one attribute condition that is multiple attribute conditions, the first network device needs to determine whether the multiple attributes of the second network device satisfy the corresponding attribute conditions based on the multiple attribute identifiers in the remote authentication result. If all the attributes of the second network device satisfy the multiple attribute conditions in the certificate issuance conditions, the first network device can determine that the attributes of the second network device meet the certificate issuance conditions; or, if the number of attribute conditions satisfied by the attributes of the second network device reaches a specified number, the first network device can also determine that the attributes of the second network device meet the certificate issuance conditions.

[0122] In general, if an attribute condition is pre-set in the first network device, the first network device determines whether the attributes of the second network device meet the certificate issuance conditions based on whether the attributes of the second network device meet the attribute condition.

[0123] If multiple attribute conditions are pre-configured in the first network device, the first network device determines whether the attributes of the second network device meet the certificate issuance conditions based on a pre-specified policy. For example, the pre-specified policy might be: if the attributes of the second network device satisfy all attribute conditions, then the second network device's attributes meet the certificate issuance conditions. Alternatively, the pre-specified policy might be: if the number of attribute conditions satisfied by the second network device reaches a specified number, then the second network device's attributes meet the certificate issuance conditions.

[0124] Step 2403: If the attributes of the second network device meet the certificate issuance conditions, the first network device determines that the challenge result has been verified.

[0125] Specifically, if the attributes of the second network device meet the certificate issuance requirements, it means that the second network device itself meets the security requirements for certificate issuance, and therefore the first network device determines that the challenge result passes verification. If the attributes of the second network device do not meet the certificate issuance requirements, it means that the second network device itself does not meet the security requirements for certificate issuance, and therefore the first network device determines that the challenge result fails verification.

[0126] In this solution, the certificate issuing device, in addition to verifying the authenticity of the remote certification result itself, further verifies whether the attributes of the certificate requesting device included in the remote certification result meet the certificate issuance conditions. This expands the verification scope to a range of attributes of the certificate requesting device, allowing the certificate issuing device to refuse to issue certificates to certificate requesting devices whose attributes do not meet the conditions, thus further improving the security of the certificate issuance process. Furthermore, since the certificate issuing device obtains the attributes of the certificate requesting device from the verified remote certification result, it can ensure the authenticity of the obtained attributes and prevent the certificate issuing device from obtaining forged attributes, thereby guaranteeing the reliability of the attribute verification process for the certificate requesting device.

[0127] For example, if the certificate issuance conditions include that the version number of the target software is not lower than the preset version number, and the version number of the target software in the second network device is lower than the preset version number, it means that the target software in the second network device has not been updated in time and is vulnerable to attack. Therefore, the first network device determines that the challenge result of the first network device has not passed the verification and refuses to issue a certificate to the second network device in order to avoid the security risks brought about by issuing a certificate to the second network device.

[0128] In this application, there are multiple ways for the second network device to complete the challenge indicated by the first network device. The following will describe how the second network device completes the challenge indicated by the first network device through various implementation methods.

[0129] In implementation method 1, the second network device completes the remote proof process in advance and returns the pre-obtained remote proof result to the first network device after receiving the challenge indicated by the first network device.

[0130] In implementation method 1, the second network device completes the remote authentication process before requesting a certificate from the first network device. Furthermore, when the first network device instructs the second network device to complete the challenge by performing remote authentication, the second network device can provide feedback to the first network device with the remote authentication result obtained from the pre-executed remote authentication process. That is, the second network device effectively reuses an existing remote authentication result.

[0131] For example, please refer to Figure 4, which is a schematic diagram of the process by which a second network device applies for a certificate based on a pre-obtained remote authentication result, as provided in this application. As shown in Figure 4, the process by which the second network device applies for a certificate based on a pre-obtained remote authentication result includes the following steps 401-408.

[0132] Step 401: The second network device sends attribute evidence to the remote verification server.

[0133] In the example shown in Figure 4, the second network device performs a remote authentication process before requesting a certificate from the first network device. It should be noted that there are several reasons why the second network device might trigger remote authentication beforehand. For example, if the second network device already knows that it needs to perform remote authentication to complete a challenge when subsequently requesting a certificate, it might trigger remote authentication before requesting the certificate. Another example is that the second network device might trigger remote authentication because it needs to participate in trusted computing or needs to authenticate its own trusted state at the initial startup stage. Remote authentication is one of the key technologies in the overall trusted computing solution, and it is typically used to authenticate whether a device is in a trusted state.

[0134] Specifically, during the remote authentication process, the second network device sends attribute evidence to the remote authentication server. This attribute evidence includes multiple attribute identifiers and information used to verify the credibility of these identifiers (such as the second network device's operational logs). The attribute identifiers indicate different attributes of the second network device (such as metrics obtained during the second network device's startup, hardware information within the second network device, software version numbers within the second network device, configuration information of the second network device, etc.).

[0135] Step 402: The remote verification server sends the remote verification result to the second network device.

[0136] After receiving the attribute evidence sent by the second network device, the remote proof server verifies the attribute evidence to determine the verified attributes. Based on the verified attributes in the second network device, the remote proof server generates a remote proof result and sends it to the second network device. The remote proof result includes the attributes of the second network device (i.e., the attribute identifier submitted by the second network device to the remote proof device when performing remote proof) and a digital signature obtained based on the attributes of the second network device.

[0137] In general, the process of the second network device performing remote authentication is similar to the existing remote authentication process, and the specific details can be found in the existing remote authentication process.

[0138] Step 403: The first network device receives the certificate request message sent by the second network device.

[0139] If the remote verification result has been obtained and the second network device needs to request the first network device to issue a certificate, the second network device sends a certificate request message to the first network device.

[0140] Optionally, since the second network device has completed the remote authentication process and obtained the remote authentication result, the second network device can carry an identifier of the remote authentication result in the certificate request message it sends, thereby declaring to the first network device that the second network device possesses the remote authentication result. Alternatively, the certificate request message can carry an identifier of the remote authentication client, which indicates the identity of the remote authentication client used by the second network device when performing the remote authentication process.

[0141] In general, this application does not limit the implementation of the identifier carried in the certificate application message, as long as the identifier carried in the certificate application message can indicate that the second network device supports remote authentication or that the second network device has completed the remote authentication process.

[0142] Step 404: The first network device sends a challenge message to the second network device, which instructs the second network device to complete the challenge by performing remote authentication.

[0143] In this example, the challenge message sent by the first network device includes a challenge type and a challenge identifier. The challenge type indicates the type of challenge task the second network device needs to complete, including remote authentication. It should be noted that in some cases, the challenge message sent by the first network device may also indicate that the challenge task the second network device needs to complete includes other challenge types. That is, the challenge type for the second network device to complete may include both remote authentication and other challenge types, such as Hypertext Transfer Protocol (HTTP) challenge types or Domain Name System (DNS) challenge types.

[0144] The challenge identifier is used to identify the current challenge task that the second network device needs to complete. For example, the challenge identifier is a random number generated by the first network device; or, the challenge identifier is a sequence number generated by the first network device based on the number of certificate request messages received. In general, the challenge identifier is used to uniquely identify the challenge task that the second network device currently needs to complete, so that the first network device can subsequently confirm which challenge task the challenge result returned by the second network device corresponds to.

[0145] Step 405: The first network device obtains the challenge result, which includes the remote proof result.

[0146] There are multiple ways for the first network device to obtain the challenge results.

[0147] In one possible implementation, the first network device receives a challenge result sent by the second network device. Specifically, the challenge result includes a remote proof result, a challenge identifier, and signature information. The signature information is a digital signature obtained by the second network device signing the remote proof result and the challenge identifier. That is, the second network device generates the challenge result based on the obtained remote proof result and sends the challenge result to the second network device.

[0148] In another possible implementation, the first network device receives a challenge completion notification from the second network device and retrieves the challenge result based on the notification. The challenge completion notification indicates the location where the challenge result is stored. That is, after generating the challenge result based on the remote proof result, the second network device does not directly send the challenge result to the first network device. Instead, it stores the challenge result in a specific location and notifies the first network device to retrieve the result from that location. In this implementation, the first network device indicates that the challenge type of the task to be completed by the second network device specifically includes remote proof and other challenge types. For example, when the challenge type of the task to be completed by the second network device specifically includes remote proof and HTTP challenge, the second network device stores the challenge result at the address of a webpage and notifies the first network device to retrieve the result from the webpage. As another example, when the challenge type of the task to be completed by the second network device specifically includes remote proof and DNS challenge, the second network device stores the challenge result at the DNS resolution address and notifies the first network device to retrieve the result from the DNS resolution address.

[0149] Step 406: The first network device verifies the authenticity of the remote proof result in the challenge result.

[0150] After receiving the challenge result, the first network device verifies its authenticity. Specifically, based on the signature information in the challenge result, the first network device uses a digital signature verification method to verify the authenticity of the challenge result, thereby determining whether the challenge result obtained by the first network device was generated by the second network device.

[0151] If the challenge result is verified, the first network device then verifies the authenticity of the remote proof result within the challenge result. Specifically, since the remote proof result includes a digital signature, the first network device can use a digital signature verification method to verify the digital signature of the remote proof result, thereby verifying the authenticity of the remote proof result.

[0152] Step 407: If the authenticity of the remote certification result is verified, the first network device verifies whether the attributes of the second network device in the remote certification result meet the certificate issuance conditions.

[0153] Step 407 is similar to step 2042 above. Please refer to step 2042 above for details. It will not be repeated here.

[0154] Step 408: If the challenge result is verified, the first network device issues a certificate to the second network device.

[0155] If the attributes of the second network device meet the certificate issuance conditions in the remote verification result determined by the first network device, the first network device determines that the challenge result has been verified and thus issues a certificate to the second network device.

[0156] In implementation method 2, after receiving the challenge indicated by the first network device, the second network device executes a remote proof process and returns the remote proof result to the first network device.

[0157] In implementation method 2, the second network device does not perform the remote authentication process before requesting a certificate from the first network device. The second network device then performs the remote authentication process when the first network device instructs it to complete the challenge by performing remote authentication.

[0158] For example, please refer to Figure 5, which is a flowchart illustrating the process by which a second network device, after receiving an instruction, performs a remote verification process to apply for a certificate, according to the present application. As shown in Figure 5, the process by which the second network device, after receiving an instruction from the first network device, performs a remote verification process to apply for a certificate includes the following steps 501-508.

[0159] Step 501: The first network device receives the certificate request message sent by the second network device.

[0160] It should be noted that, unlike step 403 above, in step 501, since the second network device has not yet completed the remote verification process, the certificate application message sent by the second network device only indicates that the second network device supports the execution of the remote verification process, without carrying the identifier of the remote verification result or the identifier of the remote verification client.

[0161] Step 502: The first network device sends a challenge message to the second network device, which instructs the second network device to complete the challenge by performing remote authentication.

[0162] The challenge message sent by the first network device includes a challenge type and a challenge identifier. The challenge type indicates the type of challenge task that the second network device needs to complete, including remote verification, while the challenge identifier identifies the current challenge task that the second network device needs to complete.

[0163] Optionally, the challenge message may also include a list of remote verification servers (Verifiers). This list indicates which remote verification servers the second network device can choose when performing remote verification. That is, the first network device specifies in the challenge message, through the list of remote verification servers, which the second network device must select from to complete the remote verification process. The list of remote verification servers includes one or more remote verification servers, and all remote verification servers included in the list are trusted by the first network device.

[0164] Step 503: The second network device sends attribute evidence to the remote proof server.

[0165] Upon receiving the challenge message, the second network device determines that a remote proof process is required to complete the challenge indicated by the first network device. Therefore, the second network device sends attribute evidence to the remote proof server.

[0166] Optionally, if the challenge message also includes a list of remote proof servers, the second network device needs to select one of the remote proof servers from the list and send attribute evidence to that remote proof server.

[0167] Step 504: The remote verification server sends the remote verification result to the second network device.

[0168] After the remote proof server verifies the attribute evidence sent by the second network device, the remote proof server generates a remote proof result based on the verified attributes in the attribute evidence and sends the remote proof result to the second network device.

[0169] Step 505: The first network device obtains the challenge result, which includes the remote proof result.

[0170] After obtaining the remote proof result, the second network device can generate a challenge result based on the remote proof result, thereby enabling the first network device to obtain a challenge result that includes the remote proof result. The method by which the first network device obtains the challenge result is similar to step 405 above; please refer to step 405 for details, which will not be repeated here.

[0171] Step 506: The first network device verifies the authenticity of the remote proof result in the challenge result.

[0172] Step 507: If the authenticity of the remote certification result is verified, the first network device verifies whether the attributes of the second network device in the remote certification result meet the certificate issuance conditions.

[0173] Step 508: If the challenge result is verified, the first network device issues a certificate to the second network device.

[0174] Steps 506-508 are similar to steps 406-408 above. Please refer to steps 406-408 above for details, which will not be repeated here.

[0175] In implementation method 3, after the second network device receives the challenge indicated by the first network device, it performs a remote proof process based on the challenge identifier provided by the first network device and returns a remote proof result including the challenge identifier to the first network device.

[0176] In implementation method 3, the second network device does not perform the remote verification process before requesting a certificate from the first network device. The second network device only performs the remote verification process when the first network device instructs it to complete the challenge through remote verification. Furthermore, during the remote verification process, the second network device needs to submit the challenge identifier provided by the first network device as attribute evidence to the remote verification server, thereby obtaining a remote verification result including the challenge identifier.

[0177] For example, please refer to Figure 6, which is a flowchart illustrating another method by which a second network device, after receiving an instruction, performs a remote verification process to apply for a certificate, as provided in this application. As shown in Figure 6, the process by which the second network device, after receiving an instruction from the first network device, performs a remote verification process to apply for a certificate includes the following steps 601-609.

[0178] Step 601: The first network device receives the certificate request message sent by the second network device.

[0179] Step 602: The first network device sends a challenge message to the second network device, which instructs the second network device to complete the challenge by performing remote authentication.

[0180] Steps 601-602 are similar to steps 501-502 above. Please refer to steps 501-502 above for details.

[0181] It should be noted that the challenge message sent by the first network device includes a challenge type and a challenge identifier. The challenge type indicates the type of challenge task that the second network device needs to complete, including remote proof. The challenge identifier identifies the current challenge task that the second network device needs to complete. Furthermore, the challenge message specifically instructs the second network device to perform remote proof using the challenge identifier as part of the attribute evidence.

[0182] Step 603: The second network device sends attribute evidence, including a challenge identifier, to the remote proof server.

[0183] Since the challenge message is also used to instruct the second network device to perform remote authentication as part of the attribute evidence, in order to deeply couple the certificate issuance process with the remote authentication process, the second network device sends the challenge identifier sent by the first network device as part of the attribute evidence to the remote authentication server. That is, the attribute evidence sent by the second network device includes the challenge identifier, multiple attribute identifiers, and information used to verify the credibility of the multiple attribute identifiers.

[0184] Step 604: The remote verification server sends the remote verification result to the second network device.

[0185] In this step, after receiving the attribute evidence, the remote proof server verifies not only the multiple attribute identifiers in the attribute evidence but also the challenge identifier, ultimately generating a remote proof result that includes the challenge identifier and multiple attribute identifiers. That is, the remote proof result received by the second network device actually includes the challenge identifier and multiple attribute identifiers.

[0186] Step 605: The first network device obtains the challenge result, which includes the remote proof result.

[0187] In step 605, the first network device obtains the challenge result in a similar manner to that described in step 405 above. Please refer to step 405 above for details.

[0188] It should be noted that in step 605, the remote proof result in the challenge result obtained by the first network device includes the challenge identifier.

[0189] Step 606: The first network device verifies the authenticity of the remote proof result in the challenge result.

[0190] Step 607: If the authenticity of the remote proof result is verified, the first network device verifies whether the remote proof result includes the correct challenge identifier.

[0191] In other words, the first network device not only needs to verify the authenticity of the remote proof result itself, but also needs to verify whether the remote proof result includes a correct challenge identifier. Specifically, the first network device first verifies whether the remote proof result includes a challenge identifier. If the remote proof result includes a challenge identifier, the first network device then verifies whether the challenge identifier included in the remote proof result is a correct challenge identifier, that is, whether the challenge identifier included in the remote proof result is the same as the challenge identifier sent by the first network device to the second network device.

[0192] Step 608: If the remote certification result includes the correct challenge identifier, the first network device verifies whether the attributes of the second network device in the remote certification result meet the certificate issuance conditions.

[0193] If the authenticity of the remote verification result is verified, and the challenge identifier included in the remote verification result is the same as the challenge identifier sent by the first network device to the second network device, the first network device determines that the remote verification result has passed verification. That is, the first network device can determine that the second network device has indeed completed the challenge task indicated by the first network device. Therefore, the first network device continues to verify whether the attributes of the second network device in the remote verification result meet the certificate issuance conditions.

[0194] Step 609: If the challenge result is verified, the first network device issues a certificate to the second network device.

[0195] In implementation method 4, after the first network device indicates the challenge to be completed to the second network device, the first network device acts as a proxy device to assist the second network device in completing the remote verification process and obtaining the remote verification result.

[0196] In implementation method 4, the second network device does not perform the remote verification process before requesting a certificate from the first network device. The second network device only performs the remote verification process when the first network device instructs it to complete the challenge by performing remote verification. Furthermore, during the remote verification process, the second network device sends attribute evidence to the first network device, which acts as a proxy device to assist the second network device in completing the remote verification process.

[0197] For example, please refer to Figure 7, which is a flowchart illustrating a process where a first network device acts as a proxy device to assist a second network device in completing a remote authentication process, as provided in this application. As shown in Figure 7, the process of the first network device acting as a proxy device to assist the second network device in completing a remote authentication process includes the following steps 701-708.

[0198] Step 701: The first network device receives the certificate request message sent by the second network device.

[0199] Step 702: The first network device sends a challenge message to the second network device, which instructs the second network device to complete the challenge by performing remote authentication.

[0200] Steps 701-702 are similar to steps 501-502 above. Please refer to steps 501-502 above for details.

[0201] It should be noted that the challenge identifier in the challenge message sent by the first network device to the second network device is optional. That is, the challenge message may or may not include the challenge identifier.

[0202] Optionally, the challenge message sent by the first network device to the second network device may also be used to instruct the second network device to complete the remote authentication process through the first network device.

[0203] Step 703: The second network device sends attribute evidence to the first network device.

[0204] Upon receiving the challenge message, the second network device, when performing remote proof, no longer sends attribute evidence to the remote proof server, but instead sends attribute evidence to the first network device.

[0205] Step 704: The first network device forwards attribute evidence to the remote proof server.

[0206] Since the first network device assists the second network device in completing the remote verification process, after receiving the attribute evidence sent by the second network device, the first network device needs to forward the attribute evidence to the remote verification server.

[0207] Step 705: The first network device obtains the remote proof result from the remote proof server and uses the remote proof result as the challenge result.

[0208] After the remote proof server verifies the attributes of the second network device based on the attribute evidence forwarded by the first network device, it can generate a remote proof result. At this point, the first network device can directly obtain the remote proof result from the remote proof server and use it as the challenge result for the second network device. That is, the second network device no longer needs to obtain the remote proof result and send it to the first network device, thereby reducing the communication overhead of the second network device.

[0209] Step 706: The first network device verifies the authenticity of the remote verification result.

[0210] Step 707: If the authenticity of the remote certification result is verified, the first network device verifies whether the attributes of the second network device in the remote certification result meet the certificate issuance conditions.

[0211] Step 708: If the challenge result is verified, the first network device issues a certificate to the second network device.

[0212] Steps 706-708 are similar to steps 406-408 above. Please refer to steps 406-408 above for details, which will not be repeated here.

[0213] The certificate issuance method provided in this application has been described above. The apparatus for performing the above certificate issuance method will be described below.

[0214] Please refer to Figure 8, which is a schematic diagram of a certificate issuance device provided in this application. As shown in Figure 8, the certificate issuance device is deployed on a first network device and includes: a receiving module 801, used to receive a certificate application message sent by a second network device, the certificate application message being used to apply for certificate issuance; a sending module 802, used to send a challenge message to the second network device, the challenge message being used to instruct the second network device to complete the challenge by performing remote proof; the receiving module 801 is also used to obtain the challenge result after the second network device completes the challenge, the challenge result including the remote proof result, the remote proof result being used to instruct the second network device on the result of performing the remote proof process; the sending module 802 is also used to issue a certificate to the second network device if the challenge result is verified.

[0215] In one possible implementation, the remote verification result includes the attributes of the second network device, and the certificate issuing device further includes a processing module 803, which is used to: verify the authenticity of the remote verification result; when the remote verification result passes verification, verify whether the attributes of the second network device meet the certificate issuing conditions based on the remote verification result; and if the attributes of the second network device meet the certificate issuing conditions, determine that the challenge result has passed verification.

[0216] In one possible implementation, the attributes of the second network device include multiple attribute identifiers, which are used to indicate different attributes of the second network device. The certificate issuance conditions include at least one attribute condition, which is used to indicate the conditions that the attribute identifiers of the second network device must meet. The processing module 803 is specifically used to: based on at least one attribute condition, the first network device determines at least one attribute identifier from the multiple attribute identifiers that must meet the attribute condition; the first network device determines whether each of the at least one attribute identifiers meets the corresponding attribute condition, so as to determine whether the attributes of the second network device meet the certificate issuance conditions.

[0217] In one possible implementation, multiple attribute identifiers include the version number of the target software in the second network device, and at least one attribute condition includes that the version number of the target software is not lower than a preset version number.

[0218] In one possible implementation, the challenge message includes a challenge type and a challenge identifier. The challenge type indicates the type of challenge task that the second network device needs to complete, including remote proof. The challenge identifier identifies the current challenge task that the second network device needs to complete. The challenge result includes the remote proof result, the challenge identifier, and signature information. The signature information is obtained by the second network device signing the remote proof result and the challenge identifier.

[0219] In one possible implementation, the certificate request message is also used to instruct a second network device to support the execution of remote certification.

[0220] In one possible implementation, the challenge message includes a challenge type and a challenge identifier. The challenge type indicates the type of challenge task that the second network device needs to complete, including remote proof. The challenge identifier identifies the current challenge task that the second network device needs to complete. The challenge message instructs the second network device to perform remote proof using the challenge identifier as part of the attribute evidence. The challenge result is verified, including: the authenticity of the remote proof result is verified and the remote proof result includes the challenge identifier.

[0221] In one possible implementation, the challenge message includes a list of remote proof servers, which indicates the remote proof servers that the second network device can select when performing remote proof.

[0222] In one possible implementation, the receiving module 801 is further configured to: receive a challenge result sent by the second network device; or, receive a challenge completion notification sent by the second network device and obtain the challenge result based on the challenge completion notification, wherein the challenge completion notification is used to indicate the location where the challenge result is stored.

[0223] In one possible implementation, the receiving module 801 is further configured to receive attribute evidence sent by the second network device; the sending module 802 is further configured to send the attribute evidence to a remote proof server, which verifies the attribute evidence and generates a remote proof result; and the receiving module 801 is further configured to receive a challenge result from the remote proof server.

[0224] Please refer to Figure 9, which is a schematic diagram of a certificate application device provided in this application. As shown in Figure 9, the certificate application device is deployed on a second network device and includes: a sending module 901, used to send a certificate application message to a first network device, the certificate application message being used to apply for the issuance of a certificate; a receiving module 902, used to receive a challenge message sent by the first network device, the challenge message being used to instruct the second network device to complete the challenge by performing remote proof; the receiving module 902 is also used to receive a certificate issued by the first network device if the second network device completes the challenge and the challenge result of the second network device is verified, the challenge result including a remote proof result, the remote proof result being used to instruct the second network device to perform the result of the remote proof process.

[0225] In one possible implementation, the challenge message includes a challenge type and a challenge identifier. The challenge type indicates the type of challenge task that the second network device needs to complete, including remote proof. The challenge identifier identifies the current challenge task that the second network device needs to complete. The challenge result includes the remote proof result, the challenge identifier, and signature information. The signature information is obtained by the second network device signing the remote proof result and the challenge content.

[0226] In one possible implementation, the certificate request message is also used to instruct a second network device to support the execution of remote certification.

[0227] In one possible implementation, the challenge message includes a challenge type and a challenge identifier. The challenge type indicates the type of challenge task that the second network device needs to complete, including remote proof. The challenge identifier identifies the current challenge task that the second network device needs to complete. The challenge message instructs the second network device to perform remote proof using the challenge identifier as part of the attribute evidence. The challenge result is verified, including: the authenticity of the remote proof result is verified and the remote proof result includes the challenge identifier.

[0228] In one possible implementation, the challenge message includes a list of remote proof servers, which indicates which remote proof servers the second network device can select when performing remote proof; the sending module 901 is also used for the second network device to select a remote proof server from the list of remote proof servers to perform the remote proof process and obtain the remote proof result.

[0229] In one possible implementation, the sending module 901 is further configured to: send the challenge result to the first network device; or, send a challenge completion notification to the first network device, wherein the challenge completion notification is used to indicate the location where the challenge result is stored.

[0230] In one possible implementation, the sending module 901 is further configured to send attribute evidence to a first network device, wherein the first network device is configured to forward the attribute evidence to a remote proof server, and the remote proof server is configured to verify the attribute evidence and generate a remote proof result.

[0231] Figure 10 is a schematic diagram of the structure of a network device provided in this application. As shown in Figure 10, the network device 1000 is equipped with the aforementioned certificate issuing device or certificate request device. The network device 1000 is implemented using a general bus architecture.

[0232] The network device 1000 includes at least one processor 1001, a communication bus 1002, a memory 1003, and at least one communication interface 1004.

[0233] Optionally, the processor 1001 is a general-purpose CPU, NP, microprocessor, or one or more integrated circuits for implementing the solutions of this application, such as application-specific integrated circuits (ASICs), programmable logic devices (PLDs), or combinations thereof. The aforementioned PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0234] The communication bus 1002 is used to transmit information between the aforementioned components. The communication bus 1002 includes an address bus, a data bus, and a control bus. For ease of representation, only one thick line is used in the figure, but this does not indicate that there is only one bus or one type of bus.

[0235] Optionally, memory 1003 is read-only memory (ROM) or other types of static storage devices capable of storing static information and instructions. Alternatively, memory 1003 is random access memory (RAM) or other types of dynamic storage devices capable of storing information and instructions. Alternatively, memory 1003 is electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media, or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited to these. Optionally, memory 1003 exists independently and is connected to processor 1001 via communication bus 1002. Optionally, memory 1003 and processor 1001 are integrated together.

[0236] Communication interface 1004 uses any transceiver-like device for communicating with other devices or communication networks. Communication interface 1004 includes a wired communication interface. Optionally, communication interface 1004 also includes a wireless communication interface. The wired communication interface is, for example, an Ethernet interface. An Ethernet interface is an optical interface, an electrical interface, or a combination thereof. The wireless communication interface is a wireless local area network (WLAN) interface, a cellular network communication interface, or a combination thereof, etc.

[0237] In a specific implementation, as one example, the processor 1001 includes one or more CPUs, such as CPU0 and CPU1 as shown in FIG10.

[0238] In a specific implementation, as one embodiment, network device 1000 includes multiple processors, such as processor 1001 and processor 1005 as shown in FIG10. Each of these processors is a single-core processor (single-CPU) or a multi-core processor (multi-CPU). Here, a processor refers to one or more devices, circuits, and / or processing cores used to process data (such as computer program instructions).

[0239] In some embodiments, the memory 1003 is used to store program code 1006 that executes the scheme of this application, and the processor 1001 executes the program code 1006 stored in the memory 1003. That is, the network device 1000 implements the above-described method embodiment through the processor 1001 and the program code 1006 in the memory 1003.

[0240] This application also provides a certificate issuance system, including a first network device and a second network device, wherein the first network device is equipped with the certificate issuance device described in the embodiment corresponding to FIG8, and the second network device is equipped with the certificate application device described in the embodiment corresponding to FIG9.

[0241] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0242] A references B, which means that A is the same as B or A is a simple variation of B.

[0243] The terms "first" and "second," etc., used in the specification and claims of this application are used to distinguish different objects, not to describe a specific order of objects, and should not be construed as indicating or implying relative importance. For example, "first speed limit lane" and "second speed limit lane" are used to distinguish different speed limit lanes, not to describe a specific order of speed limit lanes, and should not be construed as the first speed limit lane being more important than the second speed limit lane.

[0244] In the embodiments of this application, unless otherwise stated, "at least one" means one or more, and "multiple" means two or more.

[0245] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any combination thereof. When implemented in software, they can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., a solid-state disk (SSD)).

[0246] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A certificate issuance method, characterized in that, include: The first network device receives a certificate request message sent by the second network device, the certificate request message being used to request the issuance of a certificate; The first network device sends a challenge message to the second network device, the challenge message being used to instruct the second network device to complete the challenge by performing remote proof; After the second network device completes the challenge, the first network device obtains the challenge result, which includes a remote proof result. The remote proof result is used to indicate the result of the second network device performing the remote proof process. If the challenge result is verified, the first network device issues a certificate to the second network device.

2. The method according to claim 1, characterized in that, The remote verification result includes attributes of the second network device, and the method further includes: The first network device verifies the authenticity of the remote verification result; When the remote verification result passes the verification, the first network device verifies whether the attributes of the second network device meet the certificate issuance conditions based on the remote verification result. If the attributes of the second network device meet the certificate issuance conditions, the first network device determines that the challenge result has been verified.

3. The method according to claim 2, characterized in that, The attributes of the second network device include multiple attribute identifiers, which are used to indicate different attributes of the second network device. The certificate issuance conditions include at least one attribute condition, which is used to indicate the conditions that the attribute identifiers of the second network device must meet. The first network device verifies whether the attributes of the second network device meet the certificate issuance conditions based on the remote authentication result, including: Based on the at least one attribute condition, the first network device determines at least one attribute identifier from the plurality of attribute identifiers that needs to satisfy the attribute condition; The first network device determines whether the at least one attribute identifier meets the corresponding attribute conditions, thereby determining whether the attributes of the second network device meet the certificate issuance conditions.

4. The method according to claim 3, characterized in that, The plurality of attribute identifiers include the version number of the target software in the second network device, and the at least one attribute condition includes that the version number of the target software is not lower than a preset version number.

5. The method according to any one of claims 1-4, characterized in that, The challenge message includes a challenge type and a challenge identifier. The challenge type indicates the type of challenge task that the second network device needs to complete, including remote proof. The challenge identifier identifies the current challenge task that the second network device needs to complete. The challenge result includes the remote proof result, the challenge identifier, and signature information. The signature information is obtained by the second network device signing the remote proof result and the challenge identifier.

6. The method according to any one of claims 1-5, characterized in that, The certificate request message is also used to instruct the second network device to support remote certification.

7. The method according to any one of claims 1-4, characterized in that, The challenge message includes a challenge type and a challenge identifier. The challenge type indicates the type of challenge task that the second network device needs to complete, including remote proof. The challenge identifier identifies the current challenge task that the second network device needs to complete. The challenge message instructs the second network device to use the challenge identifier as part of the attribute evidence to perform remote proof. The challenge results were verified, including: The authenticity of the remote proof result is verified, and the remote proof result includes the challenge identifier.

8. The method according to claim 7, characterized in that, The challenge message includes a list of remote verification servers, and the Verifier list is used to indicate the remote verification servers that the second network device can select when performing remote verification.

9. The method according to any one of claims 1-8, characterized in that, The first network device obtains the challenge result, including: The first network device receives the challenge result sent by the second network device; Alternatively, the first network device receives a challenge completion notification sent by the second network device and obtains the challenge result based on the challenge completion notification, wherein the challenge completion notification is used to indicate the location where the challenge result is stored.

10. The method according to any one of claims 1-4, characterized in that, The first network device obtains the challenge results including: The first network device receives attribute evidence sent by the second network device; The first network device sends the attribute evidence to a remote proof server, which verifies the attribute evidence and generates the remote proof result. The first network device receives the challenge result from the remote proof server.

11. A certificate issuance method, characterized in that, include: The second network device sends a certificate request message to the first network device, the certificate request message being used to request the issuance of a certificate; The second network device receives a challenge message sent by the first network device, the challenge message being used to instruct the second network device to complete the challenge by performing remote proof; If the second network device completes the challenge and the challenge result of the second network device is verified, the second network device receives a certificate issued by the first network device. The challenge result includes a remote proof result, which is used to instruct the second network device on the result of performing a remote proof process.

12. The method according to claim 11, characterized in that, The challenge message includes a challenge type and a challenge identifier. The challenge type indicates the type of challenge task that the second network device needs to complete, including remote proof. The challenge identifier identifies the current challenge task that the second network device needs to complete. The challenge result includes the remote proof result, the challenge identifier, and signature information. The signature information is obtained by the second network device signing the remote proof result and the challenge content.

13. The method according to claim 11, characterized in that, The challenge message includes a challenge type and a challenge identifier. The challenge type indicates the type of challenge task that the second network device needs to complete, including remote proof. The challenge identifier identifies the current challenge task that the second network device needs to complete. The challenge message instructs the second network device to use the challenge identifier as part of the attribute evidence to perform remote proof. The challenge results were verified, including: The authenticity of the remote proof result is verified, and the remote proof result includes the challenge identifier.

14. The method according to claim 13, characterized in that, The challenge message includes a list of remote proof servers, which indicates the remote proof servers that the second network device can select when performing remote proof. The method further includes: The second network device selects a remote verification server from the list of remote verification servers to perform the remote verification process and obtain the remote verification result.

15. The method according to claim 11, characterized in that, The method further includes: The second network device sends attribute evidence to the first network device, wherein the first network device is used to forward the attribute evidence to a remote proof server, and the remote proof server is used to verify the attribute evidence and generate the remote proof result.

16. A certificate issuing device, characterized in that, The device is deployed on a first network device, and the device includes: The receiving module is used to receive a certificate request message sent by the second network device, wherein the certificate request message is used to request the issuance of a certificate; A sending module is configured to send a challenge message to the second network device, the challenge message being used to instruct the second network device to complete the challenge by performing remote proof; The receiving module is further configured to obtain the challenge result after the second network device completes the challenge, the challenge result including the remote proof result, the remote proof result being used to instruct the second network device on the result of performing the remote proof process; The sending module is also used to issue a certificate to the second network device if the challenge result is verified.

17. The apparatus according to claim 16, characterized in that, The remote verification result includes attributes of the second network device, and the apparatus further includes a processing module, the processing module being configured to: The authenticity of the remote proof result is verified; When the remote verification result passes, the attributes of the second network device are verified based on the remote verification result to see if they meet the certificate issuance conditions. If the attributes of the second network device meet the certificate issuance conditions, the challenge result is determined to be verified.

18. The apparatus according to claim 17, characterized in that, The attributes of the second network device include multiple attribute identifiers, which are used to indicate different attributes of the second network device. The certificate issuance conditions include at least one attribute condition, which is used to indicate the conditions that the attribute identifiers of the second network device must meet. The processing module is specifically used for: Based on the at least one attribute condition, the first network device determines at least one attribute identifier from the plurality of attribute identifiers that needs to satisfy the attribute condition; The first network device determines whether the at least one attribute identifier meets the corresponding attribute conditions, thereby determining whether the attributes of the second network device meet the certificate issuance conditions.

19. The apparatus according to claim 18, characterized in that, The plurality of attribute identifiers include the version number of the target software in the second network device, and the at least one attribute condition includes that the version number of the target software is not lower than a preset version number.

20. The apparatus according to any one of claims 16-19, characterized in that, The challenge message includes a challenge type and a challenge identifier. The challenge type indicates the type of challenge task that the second network device needs to complete, including remote proof. The challenge identifier identifies the current challenge task that the second network device needs to complete. The challenge result includes the remote proof result, the challenge identifier, and signature information. The signature information is obtained by the second network device signing the remote proof result and the challenge identifier.

21. The apparatus according to any one of claims 16-20, characterized in that, The challenge message includes a challenge type and a challenge identifier. The challenge type indicates the type of challenge task that the second network device needs to complete, including remote proof. The challenge identifier identifies the current challenge task that the second network device needs to complete. The challenge message instructs the second network device to use the challenge identifier as part of the attribute evidence to perform remote proof. The challenge results were verified, including: The authenticity of the remote proof result is verified, and the remote proof result includes the challenge identifier.

22. A certificate application device, characterized in that, The device is deployed on a second network device, and the device includes: The sending module is used to send a certificate request message to the first network device, the certificate request message being used to request the issuance of a certificate; A receiving module is configured to receive a challenge message sent by the first network device, the challenge message being used to instruct the second network device to complete the challenge by performing remote proof; The receiving module is further configured to receive a certificate issued by the first network device when the second network device completes the challenge and the challenge result of the second network device is verified. The challenge result includes a remote proof result, which is used to instruct the second network device to perform the remote proof process.

23. A certificate issuance system, comprising a first network device and a second network device, wherein the first network device is equipped with the means as described in any one of claims 16-21, and the second network device is equipped with the means as described in claim 22.

24. A computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1-15.

Images