HK1249295B - Digital certificate applying method and device - Google Patents

Description

Digital certificate application method and device

Technical Field

This specification relates to the field of security technology, and in particular to a method and device for applying for a digital certificate.

Background Art

A digital certificate is usually issued by a CA (Certificate Authority, a third-party trusted organization) and may include a public key and public key owner information, and can be used to verify the identity of another party on the Internet.

Currently, when applying for a digital certificate, a CSR (Cerificate Signing Request) file is usually generated. Due to the complex data structure and large file size of the CSR file, it will occupy a lot of terminal computing resources. Therefore, a lightweight and usable certificate application solution is needed.

Summary of the Invention

In view of this, this specification provides a method and device for applying for a digital certificate.

Specifically, this specification is implemented through the following technical solutions:

A digital certificate application method is applied to a terminal device, wherein the terminal device is integrated with a security element and loaded with client software, and the method comprises:

The client sends a digital certificate application request to the server, so that the server generates application information according to the application request and returns the application information to the client. The application information includes: an application identifier uniquely corresponding to the application request;

The client sends the application information returned by the server to the secure element;

The secure element generates a public-private key pair based on an asymmetric algorithm, signs the application identifier with the private key to obtain terminal signature data, and encapsulates the terminal signature data and the public key into a specified format before sending it to the client;

The client sends the specified format data to the server, so that the server can send the public key, the terminal signature data, the client's login user information and certificate usage information to the CA after determining that the terminal signature data has passed the verification based on the public key and the application identifier has also passed the verification.

A digital certificate application method, applied to a server, wherein the server is used to interact with client software loaded in a terminal device, wherein the terminal device is also integrated with a security element, comprises:

After receiving the digital certificate application request from the client, generate application information and send the application information to the client and CA, the application information including: an application identifier uniquely corresponding to the application request;

Receiving data in a specified format sent by a client, wherein the security element generates a public-private key pair, signs the application identifier using the private key to obtain terminal signature data, and encapsulates the terminal signature data and the public key;

Parsing the specified format data, and verifying the terminal signature data according to the public key to obtain the application identifier in the terminal signature data;

When the terminal signature data passes verification and the application identifier also passes verification, the public key, the terminal signature data, the client's login user information and the certificate usage information are sent to the CA, so that the CA can generate a digital certificate after determining that the terminal signature data passes verification and the application identifier passes verification.

A digital certificate application device, applied to a terminal device, wherein the terminal device is also integrated with a security element, comprises:

a request sending unit, which sends a digital certificate application request to a server, so that the server generates application information according to the application request and returns the application information, wherein the application information includes an application identifier uniquely corresponding to the application request;

An information delivery unit delivers the application information returned by the server to the secure element, so that the secure element generates a public-private key pair according to an asymmetric algorithm, signs the application identifier with the private key to obtain terminal signature data, and encapsulates the terminal signature data and the public key into a specified format before returning the result;

The data sending unit sends the specified format data to the server, so that the server can send the public key, the terminal signature data, the login user information and the certificate usage information to the CA after determining that the terminal signature data has passed the verification according to the public key and the application identifier has also passed the verification.

A digital certificate application device, applied to a server, is used to interact with client software loaded in a terminal device, wherein the terminal device is also integrated with a security element. The device comprises:

The information generating unit generates application information after receiving the digital certificate application request sent by the client, and sends the application information to the client and the CA, wherein the application information includes: an application identifier uniquely corresponding to the application request;

A data receiving unit receives data in a specified format sent by a client, wherein the security element generates a public-private key pair, signs the application identifier with the private key to obtain terminal signature data, and encapsulates the terminal signature data and the public key;

a data verification unit, which parses the specified format data and verifies the terminal signature data according to the public key to obtain the application identifier in the terminal signature data;

The certificate application unit sends the public key, the terminal signature data, the client's login user information and the certificate usage information to the CA when the terminal signature data passes the verification and the application identifier also passes the verification, so that the CA can generate a digital certificate after determining that the terminal signature data passes the verification and the application identifier passes the verification.

A digital certificate application device, applied to a terminal device, comprising:

security element;

processor;

memory for storing machine-executable instructions;

Wherein, by reading and executing the machine executable instructions corresponding to the digital certificate application logic stored in the memory, the processor is prompted to:

Sending a digital certificate application request to the server, so that the server generates application information according to the application request and returns the application information, wherein the application information includes: an application identifier uniquely corresponding to the application request;

Sending the application information returned by the server to the secure element, so that the secure element generates a public-private key pair according to an asymmetric algorithm, signs the application identifier with the private key to obtain terminal signature data, and encapsulates the terminal signature data and the public key into a specified format before returning the result;

The specified format data is sent to the server, so that after the server determines that the terminal signature data has passed the verification based on the public key and the application identifier has also passed the verification, the server sends the public key, the terminal signature data, the login user information and the certificate usage information to the CA.

A digital certificate application device, applied to a server, comprising:

processor;

memory for storing machine-executable instructions;

Wherein, by reading and executing the machine executable instructions corresponding to the digital certificate application logic stored in the memory, the processor is prompted to:

After receiving the digital certificate application request from the client, generate application information and send the application information to the client and CA, the application information including: an application identifier uniquely corresponding to the application request;

Receiving data in a specified format sent by a client, wherein the security element generates a public-private key pair, signs the application identifier using the private key to obtain terminal signature data, and encapsulates the terminal signature data and the public key;

Parsing the specified format data, and verifying the terminal signature data according to the public key to obtain the application identifier in the terminal signature data;

When the terminal signature data passes verification and the application identifier also passes verification, the public key, the terminal signature data, the client's login user information and the certificate usage information are sent to the CA, so that the CA can generate a digital certificate after determining that the terminal signature data passes verification and the application identifier passes verification.

As can be seen from the above description, this specification allows the terminal and server to collaborate to generate a certificate request file, significantly reducing the computational burden on the secure element and achieving a lightweight, highly available certificate application solution. Furthermore, the server and CA independently verify the terminal signature data, further ensuring the security of the digital certificate application.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a flow chart of a method for applying for a digital certificate shown in an exemplary embodiment of this specification.

FIG2 is a flow chart of another digital certificate application method according to an exemplary embodiment of this specification.

FIG3 is a flow chart of another digital certificate application method according to an exemplary embodiment of this specification.

FIG4 is a schematic diagram of the structure of designated data in a TLV format shown in an exemplary embodiment of this specification.

FIG5 is a schematic structural diagram of a terminal device shown in an exemplary embodiment of this specification.

FIG6 is a block diagram of a digital certificate application device shown in an exemplary embodiment of this specification.

FIG. 7 is a schematic structural diagram of a server shown in an exemplary embodiment of this specification.

FIG8 is a block diagram of another digital certificate application device shown in an exemplary embodiment of this specification.

DETAILED DESCRIPTION

Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with this specification. Rather, they are merely examples of apparatus and methods consistent with certain aspects of this specification, as detailed in the appended claims.

The terms used in this specification are for the purpose of describing specific embodiments only and are not intended to limit this specification. As used in this specification and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and/or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

It should be understood that although the terms first, second, third, etc. may be used in this specification to describe various information, such information should not be limited to these terms. These terms are merely used to distinguish information of the same type from one another. For example, first information may also be referred to as second information, and similarly, second information may also be referred to as first information without departing from the scope of this specification. Depending on the context, the term "if" as used herein may be interpreted as "when," "when," or "in response to determining."

This specification provides a digital certificate application solution that can change the certificate request file originally generated by the terminal to be generated by the terminal and the server in a coordinated manner, thereby saving the terminal's computing resources.

FIG1 is a flow chart of a method for applying for a digital certificate shown in an exemplary embodiment of this specification.

The digital certificate application method can be applied to a terminal, which can be an electronic device such as a mobile phone or a PC. The terminal is typically loaded with client software (Application, APP) that can interact with the server. The client software is not limited to independently loaded APPs and can also be a browser, etc., and this specification does not impose any special restrictions on this. The terminal also integrates a secure element (Secure Element, SE) that can be used to generate public and private key pairs and implement operations such as encryption and signing.

Referring to FIG1 , the digital certificate application method may include the following steps:

In step 102, the client sends a digital certificate application request to the server, so that the server generates application information according to the application request and returns the application information to the client. The application information includes an application identifier uniquely corresponding to the application request.

In this embodiment, the application information may further include: asymmetric algorithm information, signature algorithm information, timestamp and other information, which is not particularly limited in this specification.

In step 104 , the client sends the application information returned by the server to the secure element.

In step 106 , the security element generates a public-private key pair according to an asymmetric algorithm, uses the private key to sign the application identifier to obtain terminal signature data, and encapsulates the terminal signature data and the public key into a specified format and sends the result to the client.

In this embodiment, when the application information includes: asymmetric algorithm information and signature algorithm information, the security element can generate a public-private key pair based on the asymmetric algorithm specified in the application information, use the signature algorithm in the application information to calculate the summary of the application identifier, and use the private key to sign the summary to obtain terminal signature data.

In another example, when the security element performs digest calculation and signature, the data used is not limited to the application identifier, but may also include information such as the key length obtained when the security element generates a public-private key pair. This specification does not impose any special restrictions on this.

In this embodiment, the specified format may be a TLV (Type, type; Length, length; Value) format, etc.

In step 108, the client sends the specified format data to the server, so that the server can send the public key, the terminal signature data, the client's login user information and certificate usage information to the CA after determining that the terminal signature data has passed the verification based on the public key and the application identifier has also passed the verification.

FIG2 is a flow chart of another digital certificate application method according to an exemplary embodiment of this specification.

Referring to FIG. 2 , the digital certificate application method may be applied on a server, which is typically a server or server cluster deployed by a third-party service provider. The digital certificate application method includes the following steps:

Step 202: After receiving the digital certificate application request from the client, generate application information and send the application information to the client and the CA. The application information includes an application identifier uniquely corresponding to the application request.

Step 204 , receiving the specified format data sent by the client, wherein the specified format data is generated by the security element, after generating a public-private key pair, using the private key to sign the application identifier to obtain terminal signature data, and encapsulating the terminal signature data and the public key.

Step 206: Parse the specified format data, verify the terminal signature data according to the public key, and obtain the application identifier in the terminal signature data.

Step 208: When the terminal signature data passes verification and the application identifier also passes verification, the public key, the terminal signature data, the client's login user information and the certificate usage information are sent to the CA, so that the CA can generate a digital certificate after determining that the terminal signature data passes verification and the application identifier passes verification.

As can be seen from the above description, this embodiment can generate a certificate request file through the cooperation between the terminal and the server, greatly reducing the computing pressure on the secure element and realizing a lightweight and highly available certificate application solution. Furthermore, verification of the terminal signature data by the server and the CA further ensures the security of the digital certificate application.

FIG3 is a flow chart of another digital certificate application method according to an exemplary embodiment of this specification.

Referring to FIG3 , the digital certificate application method may include the following steps:

Step 302: The client sends a digital certificate request to the server.

In this embodiment, when a user who logs in through a client applies for a digital certificate, the client can initiate a digital certificate application request. For example, the sending of the digital certificate application request can be achieved by triggering a predetermined option.

In this embodiment, the digital certificate application request usually carries user account information, such as account ID.

Step 304: The server generates application information according to the application request and sends the application information to the client and the CA.

In this embodiment, after receiving the digital certificate application request sent by the client, the server may generate application information in response to the application request and send the information to the client and the CA.

In one example, the application information may include an application identifier uniquely corresponding to the application request. The application identifier may be carried in the current digital certificate application interaction process to identify the current digital certificate application, so that the digital certificate application can be re-submitted when the client repeatedly sends a digital certificate application request.

In another example, in addition to the application identifier, the application information may also include: asymmetric algorithm information and signature algorithm information. The asymmetric algorithm is typically the algorithm used by the secure element to generate a public-private key pair, and the signature algorithm is typically the algorithm used by the secure element to calculate a digest.

Of course, the application information may also include other information, such as a timestamp, etc., and this specification does not impose any special restrictions on this.

In step 306 , the client sends the application information to the secure element.

In step 308 , the secure element generates a public-private key pair.

In one example, if the application information carries asymmetric algorithm information, the security element can generate a public-private key pair based on the asymmetric algorithm information, for example, generate a public-private key pair based on the RSA algorithm carried in the application information.

In another example, if the application information does not carry an asymmetric algorithm, the security element may generate a public-private key pair according to a default algorithm, which is not particularly limited in this embodiment.

In this embodiment, after generating the public-private key pair, the security element can also obtain the key length.

In step 310 , the secure element uses a private key to sign the application identifier and key length to obtain terminal signature data.

Based on the aforementioned step 308, the security element can use the application identifier and key length as the signature original text, first use the signature algorithm specified in the application information to calculate the digest of the application identifier and key length, and then use the private key in the public-private key pair to sign the digest to obtain the terminal signature data.

In this example, signing the key length is the minimum secure and effective set for signing the public key, effectively conserving secure element processing resources. On the other hand, calculating the private key is only possible through brute force factoring of the key length. Factoring is extremely difficult, and there is currently no relevant factoring solution. Therefore, using the key length as the signature text does not affect the security of the private key.

In another example, the key length may not be used as the signature text. For example, other information such as a timestamp may be used as the signature text. Of course, only the application identifier may be used as the signature text, and this specification does not impose any special restrictions on this.

In step 312 , the secure element encapsulates the terminal signature data, key length, and public key into a specified format and sends the encapsulated data to the client.

In this embodiment, the specified format may be pre-set by a developer, such as a TLV format, etc., and this specification does not impose any special restrictions on this.

Please refer to the TLV format diagram shown in Figure 4. You can add key length information to the first TLV field on the left, add public key information to the middle TLV field, and add terminal signature data to the right TLV field.

Taking the RSA algorithm with 1024 bits as an example, the key length is 128 bytes, the terminal signature data is also 128 bytes, and the entire TLV totals 265 bytes, which is much smaller than the P10 format certificate request file of about 2KB in traditional technology. This realizes lightweight data encapsulation of the terminal, greatly reduces the computing workload of the security element, and saves network transmission traffic.

Step 314: The client sends the data in the specified format to the server.

In step 316, the server parses the data in the specified format and determines whether the terminal signature data passes verification and whether the application identifier also passes verification.

In this embodiment, after receiving the specified format data, the server can extract the key length, public key and terminal signature data from the specified format data. The public key can then be used to verify the terminal signature data. During the verification process, the application identifier and key length in the terminal signature data are obtained, and the obtained key length is verified to be consistent with the key length extracted from the above specified format. If they are consistent, it can be confirmed that the key length has passed the verification.

If the server determines that the terminal signature data and key length pass the verification, it can be determined that the public key is secure and the specified format data has not been tampered with. If the server also determines that the application identifier also passes the verification, it can be determined that the client also passes the verification, and then step 318 can be executed.

It is worth noting that the interaction between the client and the server usually also carries user account information. After receiving the data in the specified format above, the server can search for the application identifier generated for the client based on the account information and determine whether the application identifier found is consistent with the application identifier obtained during the signature verification process. If they are consistent, it can be determined that the application identifier has passed the verification; if they are inconsistent, it can be determined that the application identifier has not passed the verification. Of course, in actual applications, other methods can also be used to verify the application identifier, and this manual does not impose any special restrictions on this.

In this embodiment, if the server determines that the terminal signature data has not passed verification, or the application identifier has not passed verification, it can be confirmed that there is a security risk in this digital certificate application, and then a message indicating that the application has failed can be returned to the client.

In step 318, the server sends the public key, the terminal signature data, the client's login user information, certificate usage information, certificate usage information, and the server signature data to the CA.

Based on the aforementioned step 316, after determining that the terminal signature data passes verification and the application identifier also passes verification, the user information of the client login user, such as user name, user address, user phone number, etc., can be obtained.

In this embodiment, the server can encapsulate the public key carried in the above specified format data into PKCS1 and send it together with the terminal signature data, user information, certificate usage information and server signature data in the above specified format data to the CA.

The certificate usage information may include: certificate purpose, certificate display template, certificate custom domain information, etc.

The server signature data is generated by the server using the server private key to sign the server information. The server information can be pre-set by the developer, such as the server name, server address, etc.

If the server public key is stored in the CA, the server can send only the server signature data to the CA; if the server public key is not stored in the CA, the server can send both the server public key and the server signature data to the CA for the CA to verify the server signature data. This manual does not impose any special restrictions on this.

In step 320 , after the CA determines that the terminal signature data passes verification, the application identifier passes verification, and the server signature data passes verification, a digital certificate is generated.

In this embodiment, after receiving the above-mentioned public key, terminal signature data, client login user information, certificate usage information and server signature data sent by the server, the CA can, on the one hand, verify the terminal signature data, application identifier and key length. For example, based on the application identifier sent by the server in step 304, refer to the verification method of the server in the aforementioned step 316 to verify the terminal signature data, application identifier and; verify the key length according to the algorithm category, number of bits, etc. of the security element, etc.

On the other hand, the CA can also verify the server-side signature data, for example, using the server-side public key to verify the server-side signature data to verify whether the server-side signature is legal.

In this embodiment, if the CA determines that the terminal signature data passes verification, the application identifier passes verification, and the server signature data also passes verification, it can be determined that the security element, the client, and the server are all legal, and then the operation of generating a digital certificate is executed.

As can be seen from the above description, this specification utilizes a server with superior processing performance to work with the terminal to generate a certificate request file for digital certificate applications. This significantly reduces the computational burden on the terminal's secure element, enabling a lightweight, highly available certificate application solution. Furthermore, the server verifies the terminal's secure element and client, and the CA further verifies the terminal's secure element, client, and server, further ensuring the security of the digital certificate application.

It should be noted that in the aforementioned step 318, the server may not send the server signature data to the CA. The CA assumes that the server is legal and there is no need to verify the server signature data subsequently. This manual does not impose any special restrictions on this.

Corresponding to the embodiment of the digital certificate application method shown in FIG1 , this specification also provides an embodiment of a digital certificate application device.

The embodiments of the digital certificate application device of this specification can be applied to a terminal device, which has a security element integrated therein. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of the terminal device where it is located reading the corresponding computer program instructions in the non-volatile memory into the memory and running them. From the hardware level, as shown in Figure 5, it is a hardware structure diagram of the terminal device where the digital certificate application device of this specification is located. In addition to the processor, memory, network interface, and non-volatile memory shown in Figure 5, the terminal device where the device is located in the embodiment can generally include other hardware according to the actual function of the terminal device, which will not be described in detail.

FIG6 is a block diagram of a digital certificate application device shown in an exemplary embodiment of this specification.

Please refer to FIG. 6 , the digital certificate application apparatus 500 may be applied to the terminal device shown in FIG. 5 , and includes a request sending unit 501 , an information sending unit 502 , and a data sending unit 503 .

The request sending unit 501 sends a digital certificate application request to the server, so that the server generates application information according to the application request and returns the application information, wherein the application information includes: an application identifier uniquely corresponding to the application request;

The information sending unit 502 sends the application information returned by the server to the secure element, so that the secure element generates a public-private key pair according to an asymmetric algorithm, signs the application identifier with the private key to obtain terminal signature data, and encapsulates the terminal signature data and the public key into a specified format before returning the result.

The data sending unit 503 sends the specified format data to the server, so that the server can send the public key, the terminal signature data, the login user information and the certificate usage information to the CA after determining that the terminal signature data has passed the verification based on the public key and the application identifier has also passed the verification.

Optionally, the application information also includes: asymmetric algorithm information and signature algorithm information;

The security element generates a public-private key pair according to an asymmetric algorithm, and uses the private key to sign the application identifier to obtain terminal signature data, including:

The security element generates a public-private key pair according to the asymmetric algorithm information in the application information, calculates the key length and the digest of the application identifier using the signature algorithm information in the application information, and signs the digest using the private key to obtain terminal signature data.

Optionally, the specified format is TLV format.

Corresponding to the embodiment of the digital certificate application method shown in FIG. 2 , this specification also provides an embodiment of a digital certificate application device.

The embodiments of the digital certificate application device of this specification can be applied on a server, and the device embodiments can be implemented by software, hardware, or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of the server where it is located reading the corresponding computer program instructions in the non-volatile memory into the memory and running them. From the hardware level, as shown in Figure 7, it is a hardware structure diagram of the server where the digital certificate application device of this specification is located. In addition to the processor, memory, network interface, and non-volatile memory shown in Figure 7, the server where the device is located in the embodiment can usually include other hardware according to the actual function of the server, which will not be described in detail.

FIG8 is a block diagram of a digital certificate application device shown in an exemplary embodiment of this specification.

8 , the digital certificate application device 700 may be applied in the server shown in FIG. 7 , and includes an information generation unit 701 , a data receiving unit 702 , a data verification unit 703 , and a certificate application unit 704 .

The information generating unit 701 generates application information after receiving the digital certificate application request sent by the client, and sends the application information to the client and the CA. The application information includes: an application identifier uniquely corresponding to the application request;

The data receiving unit 702 receives data in a specified format sent by the client. After the security element generates a public-private key pair, the security element uses the private key to sign the application identifier to obtain terminal signature data, and then encapsulates the terminal signature data and the public key.

The data verification unit 703 parses the specified format data and verifies the terminal signature data according to the public key to obtain the application identifier in the terminal signature data;

The certificate application unit 704 sends the public key, the terminal signature data, the client's login user information and the certificate usage information to the CA when the terminal signature data passes the verification and the application identifier also passes the verification, so that the CA can generate a digital certificate after determining that the terminal signature data passes the verification and the application identifier passes the verification.

Optionally, the application information also includes: asymmetric algorithm information and signature algorithm information, which are used for the security element to generate a public-private key pair and sign.

Optionally, the public key is encapsulated into PKCS1 format by the server.

Optionally, the certificate application unit 704 further sends the server signature data to the CA for verification when the terminal signature data passes verification and the application identifier also passes verification;

The server signature data is generated by the server using the server private key to sign the server information.

The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to the partial description of the method embodiments. The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this specification. A person of ordinary skill in the art can understand and implement it without paying any creative work.

The systems, devices, modules, or units described in the above embodiments may be implemented by computer chips or entities, or by products having certain functions. A typical implementation device is a computer, which may be in the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email transceiver, game console, tablet computer, wearable device, or any combination of these devices.

Corresponding to the embodiment of the digital certificate application method shown in FIG1 , this specification also provides a digital certificate application device, comprising: a secure element, a processor, and a memory for storing machine-executable instructions. The processor and memory are typically interconnected via an internal bus. In other possible implementations, the device may also include an external interface to enable communication with other devices or components.

In this embodiment, by reading and executing the machine executable instructions corresponding to the digital certificate application logic stored in the memory, the processor is prompted to:

Sending a digital certificate application request to the server, so that the server generates application information according to the application request and returns the application information, wherein the application information includes: an application identifier uniquely corresponding to the application request;

Sending the application information returned by the server to the secure element, so that the secure element generates a public-private key pair according to an asymmetric algorithm, signs the application identifier with the private key to obtain terminal signature data, and encapsulates the terminal signature data and the public key into a specified format before returning the result;

The specified format data is sent to the server, so that after the server determines that the terminal signature data has passed the verification based on the public key and the application identifier has also passed the verification, the server sends the public key, the terminal signature data, the login user information and the certificate usage information to the CA.

Corresponding to the embodiment of the digital certificate application method shown in FIG2 , this specification also provides a digital certificate application device, comprising a processor and a memory for storing machine-executable instructions. The processor and memory are typically interconnected via an internal bus. In other possible implementations, the device may also include an external interface to enable communication with other devices or components.

In this embodiment, by reading and executing the machine executable instructions corresponding to the digital certificate application logic stored in the memory, the processor is prompted to:

After receiving the digital certificate application request from the client, generate application information and send the application information to the client and CA, the application information including: an application identifier uniquely corresponding to the application request;

Receiving data in a specified format sent by a client, wherein the security element generates a public-private key pair, signs the application identifier using the private key to obtain terminal signature data, and encapsulates the terminal signature data and the public key;

Parsing the specified format data, and verifying the terminal signature data according to the public key to obtain the application identifier in the terminal signature data;

When the terminal signature data passes verification and the application identifier also passes verification, the public key, the terminal signature data, the client's login user information and the certificate usage information are sent to the CA, so that the CA can generate a digital certificate after determining that the terminal signature data passes verification and the application identifier passes verification.

Corresponding to the embodiment of the digital certificate application method shown in FIG1 , this specification further provides a computer-readable storage medium having a computer program stored thereon. When the program is executed by a processor, the following steps are implemented:

Sending a digital certificate application request to the server, so that the server generates application information according to the application request and returns the application information, wherein the application information includes: an application identifier uniquely corresponding to the application request;

Sending the application information returned by the server to the secure element, so that the secure element generates a public-private key pair according to an asymmetric algorithm, signs the application identifier with the private key to obtain terminal signature data, and encapsulates the terminal signature data and the public key into a specified format before returning the result;

The specified format data is sent to the server, so that after the server determines that the terminal signature data has passed the verification based on the public key and the application identifier has also passed the verification, the server sends the public key, the terminal signature data, the login user information and the certificate usage information to the CA.

Corresponding to the embodiment of the digital certificate application method shown in FIG2 , this specification further provides a computer-readable storage medium having a computer program stored thereon. When the program is executed by a processor, the following steps are implemented:

After receiving the digital certificate application request from the client, generate application information and send the application information to the client and CA, the application information including: an application identifier uniquely corresponding to the application request;

Receiving data in a specified format sent by a client, wherein the security element generates a public-private key pair, signs the application identifier using the private key to obtain terminal signature data, and encapsulates the terminal signature data and the public key;

Parsing the specified format data, and verifying the terminal signature data according to the public key to obtain the application identifier in the terminal signature data;

When the terminal signature data passes verification and the application identifier also passes verification, the public key, the terminal signature data, the client's login user information and the certificate usage information are sent to the CA, so that the CA can generate a digital certificate after determining that the terminal signature data passes verification and the application identifier passes verification.

The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

The above description is only a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of this specification should be included in the scope of protection of this specification.

Claims (16)

1. A digital certificate application method, applied to a terminal device, said terminal device integrating a security element and loading client software, the method comprising: The client sends a digital certificate application request to the server, so that the server can generate application information based on the application request and return the application information to the client. The application information includes: an application identifier that uniquely corresponds to the application request; The client sends the application information returned by the server to the secure element; The secure element generates a public-private key pair based on an asymmetric algorithm, signs the application identifier with the private key to obtain terminal signature data, and encapsulates the terminal signature data and the public key into a specified format before sending it to the client. The client sends the specified formatted data to the server, so that the server, after verifying the terminal signature data and the application identifier based on the public key, can send the public key, the terminal signature data, the client's login user information, and certificate usage information to the CA. 2. The method according to claim 1, The application information also includes: asymmetric algorithm information and signature algorithm information; The secure element generates a public-private key pair according to an asymmetric algorithm, and uses the private key to sign the application identifier to obtain terminal signature data, including: The secure element generates a public-private key pair based on the asymmetric algorithm information in the application information, calculates the key length and the digest of the application identifier using the signature algorithm information in the application information, and signs the digest using the private key to obtain terminal signature data. 3. The method according to claim 1, The specified format is TLV format. 4. A digital certificate application method, applied to a server, the server being used to interact with client software installed in a terminal device, the terminal device further integrating a security element, the method comprising: After receiving a digital certificate application request from the client, the system generates application information and sends the application information to the client and the CA. The application information includes an application identifier that uniquely corresponds to the application request. The system receives data in a specified format sent by the client. This specified format data is generated by the security element, which uses the private key to sign the application identifier after generating a public-private key pair, to obtain terminal signature data. The terminal signature data and the public key are then encapsulated together. Parse the specified format data and verify the terminal signature data according to the public key to obtain the application identifier in the terminal signature data; Once the terminal signature data and the application identifier are verified, the public key, the terminal signature data, the client's login user information, and the certificate usage information are sent to the CA, so that the CA can generate a digital certificate after confirming that the terminal signature data and the application identifier have been verified. 5. The method according to claim 4, The application information also includes: asymmetric algorithm information and signature algorithm information, which are used by the security element to generate public-private key pairs and perform signatures. 6. The method according to claim 4, The public key is encapsulated in PKCS1 format by the server. 7. The method according to claim 4, further comprising: Once the terminal signature data is verified and the application identifier is also verified, the server signature data is sent to the CA for verification by the CA. The server-side signature data is generated by the server signing the server-side information using the server-side private key. 8. A digital certificate application device, applied to a terminal device, the terminal device further integrating a security element, the device comprising: The request sending unit sends a digital certificate application request to the server, so that the server can generate application information based on the application request and return the application information. The application information includes: an application identifier that uniquely corresponds to the application request. The information distribution unit distributes the application information returned by the server to the security element, so that the security element can generate a public-private key pair according to the asymmetric algorithm, sign the application identifier with the private key to obtain terminal signature data, and encapsulate the terminal signature data and the public key into a specified format and return it. The data sending unit sends the specified format data to the server, so that after the server determines that the terminal signature data has been verified based on the public key and the application identifier has also been verified, it sends the public key, the terminal signature data, the login user information, and the certificate usage information to the CA. 9. The apparatus according to claim 8, The application information also includes: asymmetric algorithm information and signature algorithm information; The secure element generates a public-private key pair according to an asymmetric algorithm, and uses the private key to sign the application identifier to obtain terminal signature data, including: The secure element generates a public-private key pair based on the asymmetric algorithm information in the application information, calculates the key length and the digest of the application identifier using the signature algorithm information in the application information, and signs the digest using the private key to obtain terminal signature data. 10. The apparatus according to claim 8, The specified format is TLV format. 11. A digital certificate application device, applied on a server side, the device being used to interact with client software installed in a terminal device, the terminal device further integrating a security element, the device comprising: The information generation unit generates application information after receiving a digital certificate application request from the client, and sends the application information to the client and the CA. The application information includes an application identifier that uniquely corresponds to the application request. The data receiving unit receives data in a specified format sent by the client. The specified format data is generated by the security element after generating a public-private key pair, and the application identifier is signed with the private key to obtain terminal signature data. The terminal signature data and the public key are then encapsulated together. The data verification unit parses the specified format data and verifies the terminal signature data according to the public key to obtain the application identifier in the terminal signature data; The certificate application unit sends the public key, the terminal signature data, the client's login user information, and certificate usage information to the CA after the terminal signature data and the application identifier have been verified. The CA then generates a digital certificate after confirming that the terminal signature data and the application identifier have been verified. 12. The apparatus according to claim 11, The application information also includes: asymmetric algorithm information and signature algorithm information, which are used by the security element to generate public-private key pairs and perform signatures. 13. The apparatus according to claim 11, The public key is encapsulated in PKCS1 format by the server. 14. The apparatus according to claim 11, The certificate application unit also sends the server-side signature data to the CA for verification after the terminal signature data and the application identifier have been verified. The server-side signature data is generated by the server signing the server-side information using the server-side private key. 15. A digital certificate application device, applied to a terminal device, the device comprising: Safety components; processor; Memory used to store machine-executable instructions; Specifically, the processor is prompted to: read and execute the machine-executable instructions stored in the memory corresponding to the digital certificate application logic. Send a digital certificate application request to the server so that the server can generate application information based on the application request and return the application information, wherein the application information includes: an application identifier that uniquely corresponds to the application request; The application information returned by the server is sent to the security element, which generates a public-private key pair according to an asymmetric algorithm, signs the application identifier with the private key to obtain terminal signature data, and encapsulates the terminal signature data and the public key into a specified format and returns it. The specified format data is sent to the server so that, after the server determines that the terminal signature data has been verified based on the public key and the application identifier has also been verified, it can send the public key, the terminal signature data, the login user information, and the certificate usage information to the CA. 16. A digital certificate application device, applied to a server, the device comprising: processor; Memory used to store machine-executable instructions; Specifically, the processor is prompted to: read and execute the machine-executable instructions stored in the memory corresponding to the digital certificate application logic. After receiving a digital certificate application request from the client, the system generates application information and sends the application information to the client and the CA. The application information includes an application identifier that uniquely corresponds to the application request. The system receives data in a specified format sent by the client. This specified format data is generated by the security element, which uses the private key to sign the application identifier after generating a public-private key pair, to obtain terminal signature data. The terminal signature data and the public key are then encapsulated together. Parse the specified format data and verify the terminal signature data according to the public key to obtain the application identifier in the terminal signature data; Once the terminal signature data and the application identifier are verified, the public key, the terminal signature data, the client's login user information, and the certificate usage information are sent to the CA, so that the CA can generate a digital certificate after confirming that the terminal signature data and the application identifier have been verified.