WO2019033822A1 - Methods for generating and authenticating digital certificate, communication device, and storage medium - Google Patents

Abstract

Disclosed in an embodiment of the present disclosure are methods for generating and authenticating a digital certificate, a communication device, and a storage medium. The method for generating a digital certificate comprises: acquiring, by a pre-determined device, a device identifier of a base station and a public key, wherein the pre-determined device is a base station using a digital certificate, a manufacturer device of the manufacturer that produced the base station or an operator device of an operator using the base station; and generating the digital certificate according to the device identifier and the public key, wherein the digital certificate is used by a blockchain digital certificate system to generate a certificate block, and the certificate block is valid after passing verification performed by a consensus mechanism.

Description

Digital certificate generation, authentication method, communication device, and storage medium

Cross-reference to related applications

Priority is claimed on Japanese Patent Application No. 201710703108.0, filed on Aug.

Technical field

The present disclosure relates to the field of mobile communications technologies, and in particular, to a digital certificate generation, authentication method, communication device, and storage medium.

Background technique

Digital certificates are a series of numbers in the Internet communication that identify the identity information of the parties to the communication. They provide a way to verify the identity of the communicating entity on the Internet. The digital certificate is not a digital ID card. For example, the network element of the gateway or core network needs to authenticate the base station with a digital certificate installed in the base station.

The base station may be various types of base stations, for example, a small base station, a micro base station, and a home base station. The home base station, also known as a home evolved Node B (Home Evolved Node B), is a miniaturized, low-power cellular technology that accesses the mobile core network through fixed-line broadband to provide traditional cellular mobile services for user equipment. Fixed mobile convergence services, including communication infrastructure services.

Currently, the 3GPP HeNB security specification TS 33.320 has defined the authentication mode of the HeNB, and the digital certificate is used between the HeNB and the security gateway for device bidirectional authentication. In order to implement the authentication of the base station device, the small base station needs to be configured to install a digital certificate. This process needs to be performed before accessing the core network. There are usually two methods: offline application and online application.

The offline application method requires the equipment provider to first generate a public-private key pair for the small base station, and then provide certificate generation materials to the Certificate Authority (CA) organization, including the public key of the small base station, and the CA organization creates and issues a certificate according to the application materials, and the device After obtaining the certificate, you need to configure the installation certificate for the small base station.

The online application mode is initiated by the small base station, first generates a public-private key pair, generates a certificate generation request according to the online certificate generation protocol, initiates a certificate generation process, and the CA organization creates and issues a certificate according to the certificate generation request, and the small base station receives and installs the certificate issued by the CA. .

In the above offline application mode, the equipment manufacturer needs to apply for a digital certificate from the CA center. The digital certificate is generated by the CA center. Because different small base stations use different digital certificates, there are large differences between individuals, so it is difficult to implement batch configuration in the production line. These digital certificates need to be installed in different small base stations separately, and one configuration is required, and the implementation efficiency is low.

The above online application method may adopt a standard certificate generation protocol (for example, CMPv2) or a private online application protocol. The problem with CMPv2 is that the protocol is complex, and multiple signatures and verification signatures are required during the process. In addition, the mutual trust problem of multiple CAs is involved. The CA used for online certificate application needs to trust the certificate preset on the device. The equipment vendor, the CA needs to maintain a list of multiple root certificates.

Therefore, improving the efficiency of digital certificate configuration is an urgent problem to be solved.

Summary of the invention

In view of this, embodiments of the present disclosure are expected to provide a digital certificate generation, authentication method, communication device, and storage medium, at least partially solving the problem of low efficiency of digital certificate generation.

To achieve the above object, the technical solution of the present disclosure is implemented as follows:

A first aspect of the embodiments of the present disclosure provides a method for generating a digital certificate, including:

The predetermined device acquires a device identifier of the base station and a public key, where the predetermined device is a base station that uses the digital certificate, a vendor device of a manufacturer that produces the base station, or a carrier device that uses an operator of the base station;

Generating a digital certificate according to the device identifier and the public key, wherein the digital certificate is used by the blockchain digital certificate system to generate a certificate block, and is valid after the certificate block passes the verification based on the consensus mechanism.

Based on the foregoing solution, when the predetermined device is the vendor device or the carrier device, the method further includes:

Broadcasting the digital certificate to a blockchain digital certificate system;

When the certificate block passes the verification, it is confirmed that the digital certificate is valid;

The digital certificate that is in effect is written to the corresponding base station.

Based on the foregoing solution, the method further includes:

Writing the generated digital certificate to the base station when the predetermined device is the vendor device or the carrier device; wherein the digital certificate is used by the base station to broadcast to the area after connecting to the network Blockchain digital certificate system.

Based on the foregoing solution, the predetermined device acquires the device identifier and the public key of the base station, including:

The base station reads the device identifier stored in advance;

Obtain the public key;

The predetermined device generates a digital certificate, including:

The base station generates the digital certificate according to the predetermined information;

The method further includes:

Broadcasting the digital certificate to a blockchain digital certificate system;

When the certificate block passes the verification, it is confirmed that the digital certificate is valid.

Based on the foregoing solution, the predetermined device acquires the device identifier and the public key of the base station, including:

Reading the pre-stored device identifier after the base station is connected to the network;

The public key is generated using a key generation algorithm.

Based on the foregoing solution, after the base station is connected to the network, reading the pre-stored device identifier includes:

The base station reads the pre-stored device identifier after receiving the network and before being configured to access the network element, or after being configured to access the network element;

The broadcasting the digital certificate to the blockchain digital certificate system comprises:

The digital certificate is broadcast to the blockchain digital certificate system based on a pre-stored communication address of the blockchain digital certificate system.

A second aspect of the embodiments of the present disclosure provides a method for authenticating a digital certificate, which is applied to a gateway, and includes:

Receiving an authentication request sent by the base station, where the authentication request is used to authenticate the digital certificate of the base station; the digital certificate is generated by the base station itself or generated by a vendor device; The equipment of the manufacturer of the base station;

And querying, according to the authentication request, status information of the digital certificate stored in the blockchain digital certificate system;

And authenticating the digital certificate based on the status information;

When the digital certificate passes verification, an authentication response is returned to the base station.

Based on the foregoing solution, the receiving the authentication request sent by the base station includes:

Receiving an authentication request carrying the certificate identifier of the digital certificate;

The status information of the digital certificate stored by the query blockchain digital certificate system based on the authentication request includes:

And querying, according to the certificate identifier, the digital certificate and the status information stored in the blockchain digital certificate system.

Based on the foregoing solution, the receiving the authentication request sent by the base station includes:

Receiving a certificate identifier carrying the digital certificate and an authentication request of the digital certificate.

Based on the foregoing solution, the status information of the digital certificate stored by the query blockchain digital certificate system based on the authentication request includes:

When the gateway is a billing node of the blockchain digital certificate system, the state information is locally queried;

or,

The status information is sent to the blockchain digital certificate system when the gateway is not a billing node of the blockchain digital certificate system.

A third aspect of the embodiments of the present disclosure provides a communication device, wherein the communication device is a predetermined device; the predetermined device is a base station using the digital certificate, a vendor device of a manufacturer that produces the base station, or an application base station Operator's carrier equipment, including:

An obtaining unit, configured to acquire a device identifier and a public key of the base station, where

a certificate generating unit, configured to generate a digital certificate according to the device identifier and the public key, where the digital certificate is used by the blockchain digital certificate system to generate a certificate block, and when the certificate block passes the consensus-based mechanism Effective after verification.

A fourth aspect of the embodiments of the present disclosure provides a communications device, where the communications device is a gateway, including:

a receiving unit, configured to receive an authentication request sent by the base station, where the authentication request is used to authenticate the digital certificate of the base station; the digital certificate is generated by the base station itself or generated by a vendor device; The manufacturer equipment is the equipment of the manufacturer of the base station;

a query unit, configured to query status information of the digital certificate stored in the blockchain digital certificate system based on the authentication request;

An authentication unit, configured to authenticate the digital certificate based on the status information;

And a sending unit, configured to return an authentication response to the base station when the digital certificate passes the verification.

A fifth aspect of the embodiments of the present disclosure provides a communications device, including:

Transceiver for information transmission and reception;

Memory for information storage;

And a processor connected to the transceiver and the memory for controlling information transmission and reception of the transceiver, storage of information of the memory by execution of a computer program, and realizing generation of the digital certificate provided by any one of claims 1 to 6. A method, or an authentication method for implementing the digital certificate provided by any one of claims 7 to 10.

A sixth aspect of the embodiments of the present disclosure provides a communication device, including: a transceiver, a memory, a processor, and a computer program stored on the memory and executed by the processor;

The processor is respectively connected to the transceiver and the memory, and is configured to implement, by using the execution of the computer program, one or more methods for generating a digital certificate applied to a predetermined device, or implement one or more of the foregoing Authentication methods applied to digital certificates in the gateway.

A seventh aspect of the embodiments of the present disclosure provides a computer storage medium storing a computer program; after the computer storage is executed, the method for generating the one or more digital certificates applied to the predetermined device can be implemented Or an authentication method that implements one or more of the aforementioned digital certificates applied to the gateway.

The digital certificate generation, the authentication method, the communication device, and the storage medium of the embodiments of the present disclosure, the generation of the digital certificate is no longer a third-party institution that is not associated with the base station manufacturer or the operator, for example, CA generation. The digital certificate can be generated by the base station, the vendor device, or the operator device. By reducing the data interaction with the CA, the queue waiting time when the CA generates the digital certificate is reduced, the digital certificate can be accelerated, and the digital certificate generation can be reduced. The resulting delay improves the efficiency of digital certificate generation; and it can realize the generation of a complete digital certificate when the base station is configured to access the network element or before, which has the characteristics of high efficiency.

DRAWINGS

1 is a schematic flowchart of a method for generating a first digital certificate according to an embodiment of the present disclosure;

2 is a schematic flowchart of a method for generating a second digital certificate according to an embodiment of the present disclosure;

3 is a schematic flowchart of a method for authenticating a first digital certificate according to an embodiment of the present disclosure;

FIG. 4 is a schematic structural diagram of a preset device according to an embodiment of the present disclosure;

FIG. 5 is a schematic structural diagram of a gateway according to an embodiment of the present disclosure;

FIG. 6 is a schematic structural diagram of a first communication device according to an embodiment of the present disclosure;

FIG. 7 is a schematic structural diagram of a second communication device according to an embodiment of the present disclosure;

FIG. 8 is a schematic flowchart diagram of a method for generating a third digital certificate according to an embodiment of the present disclosure;

FIG. 9 is a schematic flowchart diagram of a method for generating a fourth digital certificate according to an embodiment of the present disclosure;

FIG. 10 is a schematic flowchart of a method for authenticating a second digital certificate according to an embodiment of the present disclosure;

FIG. 11 is a schematic flowchart diagram of a method for authenticating a third digital certificate according to an embodiment of the present disclosure.

Detailed ways

The technical solutions of the present disclosure are further elaborated below in conjunction with the drawings and specific embodiments.

As shown in FIG. 1 , this embodiment provides a method for generating a digital certificate, including:

Step S110: The predetermined device acquires the device identifier and the public key of the base station, where the predetermined device is a base station using the digital certificate, a vendor device of a manufacturer that produces the base station, or a carrier device of an operator that applies the base station. ;

Step S120: Generate a digital certificate according to the device identifier and the public key, where the digital certificate is used for generating a certificate block by the blockchain digital certificate system, and after the certificate block passes the verification based on the consensus mechanism Effective.

The embodiment provides a method for generating a digital certificate. The device for generating a digital certificate is no longer a CA of a third party, but a base station that needs to use the digital certificate, a manufacturer device of a manufacturer that generates the base station, or a base station that applies the base station. The carrier equipment of the operator who builds the communication network, etc., produces or uses a non-third-party device such as a base station to generate a digital certificate.

Before generating a digital certificate, you need to get the information you need to generate a digital certificate.

The required information for generating the digital certificate in this implementation includes: a device identifier of the base station and a public key. In this implementation, the device identifier of the base station is a unique identifier of the entire network.

The device identifier may include multiple sequences: a first sequence composed of a serial number of the base station generated by the vendor device, a random sequence consisting of randomly generating random numbers, and a verification sequence for verifying the identifier of the device. In some embodiments, the device identification can include: 128 bits or 256 bits, and the like. Wherein, the plurality of sequences forming the device identifier form an identification sequence of a predetermined bit length in a certain order.

The public key may be a key disclosed in the network generated by using a key generation algorithm; the private key is a key that is not publicly disclosed corresponding to the public key. Typically the private key is only stored in the base station, the public key being published in the network. The public key and the private key form a key pair, and the information exchange after the base station is configured to access the network element may be configured by using asymmetric encryption. In the embodiment, the public key is one of the basis parameters for generating the digital certificate.

The content of the digital certificate may include:

Version information of the digital certificate;

The certificate identifier of the digital certificate, the certificate identifier may be a certificate serial number, each digital certificate has a unique certificate serial number, which may be applied to a specific device when the digital certificate is generated; and the specific device is based on the application of each device , unified delivery of the unique certificate serial number of the entire network;

a signature algorithm used by digital certificates;

The organization information of the certificate generation mechanism may be, for example, vendor information in this embodiment. The general institution information can be the name of the institution, and the naming rules generally adopt the X.500 format;

The validity period of the digital certificate, the general data word certificate generally adopts the UTC time format, and the UTC time range is 1950-2049;

The name of the digital certificate owner, the naming rules are generally in the X.500 format; the owner here may be the manufacturer of the base station or base station using the digital certificate.

The public key of the numerical certificate owner, that is, the public key;

The signature of the digital certificate by the digital certificate issuer.

The mandatory content included in the digital certificate described in this embodiment may be a certificate identifier, a device identifier of a base station, and a public key. In some cases, the digital certificate may further include: a signature algorithm, a certificate effective use authority, and the like.

The step S120 may specifically include: performing, by using the signature algorithm, the device identifier and the public key signature processing, and generating the digital certificate including the certificate identifier, the public key, the device identifier, and the signature information. In some embodiments, the certificate identifier may be generated according to a preset rule in this embodiment, and generally needs to ensure that the certificate identifier of each digital certificate is unique to the entire network. For example, in the embodiment, the device identifier is a unique identifier of the entire network, and the certificate identifier may be generated based on the device identifier. Certainly, in some cases, the certificate identifier may also be a unique identifier of a manufacturer that is pre-issued to the base station by the corresponding organization. In this case, the digital certificate that is currently in an unused state may be assigned to the corresponding digital certificate. can. For another example, the preset device may further request the digital certificate from a specific device when the digital certificate is generated, thereby obtaining the digital certificate. In short, there are many ways to obtain the digital certificate, and are not limited to any of the above.

In the embodiment, the digital certificate is generated by a base station that uses the certificate or a manufacturer that produces the base station, and the information exchange is performed with respect to the information generated by the CA without returning, thereby improving the efficiency of digital certificate generation, especially when CA The problem of large configuration delay caused by receiving many requests.

When the predetermined device is the vendor device or the carrier device, the method further includes:

Submitting the digital certificate as broadcast to a blockchain digital certificate system;

When the certificate block passes the verification, it is confirmed that the digital certificate is valid;

The digital certificate that is in effect is written to the corresponding base station.

In the embodiment, the digital certificate is generated and stored by using a blockchain technology. Therefore, if a digital certificate is generated in this embodiment, the digital certificate needs to be broadcasted to the blockchain digital certificate system, and the accounting node in the blockchain digital certificate system performs verification of the corresponding certificate block based on the consensus mechanism. . Only the certificate block corresponding to the digital certificate is verified, and the corresponding digital certificate takes effect.

In this embodiment, the predetermined device is the vendor device, and the vendor device is connected to the blockchain digital certificate system, and the generated digital certificate is broadcasted to the blockchain digital certificate system.

Finally, when the digital certificate is valid, the valid digital certificate will be written to the corresponding base station. For example, if the current digital certificate A is generated based on the device identifier of the base station A, the valid digital certificate A is written into the base station A. In this way, after the base station is configured to access the network element, the digital certificate A can be directly used, or the digital certificate A can be used after being authenticated.

In some embodiments, the device that generates the digital certificate is also a vendor device, but the vendor device is not connected to the blockchain system, and the digital certificate is not validated. Therefore, in this embodiment, the method further includes:

Writing the generated digital certificate to the base station when the predetermined device is the vendor device or the carrier device; wherein the digital certificate is used by the base station to broadcast to the area after connecting to the network Blockchain digital certificate system.

The manufacturer device directly writes the generated digital certificate to the base station, and after the base station connects to the network, it broadcasts itself to the blockchain digital certificate system to make the digital certificate take effect.

In some embodiments, the preset device may also be a base station. At this time, as shown in FIG. 2, the step S110 may include step S111; and the step S111 may include:

The pre-stored device identifier is read and the public key is obtained. The obtaining the public key may include: reading a pre-stored public key, or generating the public key by using a key generation algorithm; for example, generating a random number, and then generating a key pair by using a key generation algorithm, thereby Obtain the public key.

The step S120 may include step S121; the step S121 may include:

The base station generates the digital certificate according to the predetermined information.

The method further includes:

Step S130: Broadcast the digital certificate to a blockchain digital certificate system;

Step S140: When the certificate block passes the verification, it is confirmed that the digital certificate is valid.

In this implementation, the digital certificate is generated by the base station itself. After the digital certificate is generated, the base station broadcasts the digital certificate to the blockchain digital certificate system to validate the digital certificate.

Specifically, the step S110 may include: reading the pre-stored device identifier after the base station is connected to the network; and generating the public key by using a key generation algorithm.

The base station does not initiate the generation of the digital certificate when it is turned on, but starts the generation of the digital certificate after the base station is connected to the network, thereby reducing the short period of validity of the actual use due to the early generation of the digital certificate.

In some embodiments, the step S110 may include:

The base station reads the pre-stored device identifier after receiving the network and before being configured to access the network element, or after being configured to access the network element;

The step S120 may include:

The digital certificate is broadcast to the blockchain digital certificate system based on a pre-stored communication address of the blockchain digital certificate system.

In summary, in the embodiment, the base station pre-writes the communication address of the blockchain digital certificate system, where the communication address may be a network protocol (IP) address of the blockchain digital certificate system. In general, the communication address may be a communication address of a blockchain node in a plurality of blockchain digital certificate systems, and may be stored in the base station in the form of an address table. In some embodiments, the communication address may also be an IP address, for example, a broadcast address of the blockchain digital certificate system, or the like.

In some cases, after the base station is installed and connected to the network, in performing the initial configuration of the base station to configure the base station as an access network element, the base station may be based on a pre-stored communication address. The digital certificate is validated. In this case, after the subsequent base station is configured, the valid digital certificate can be directly used, or the digital certificate can be directly verified.

Of course, in other cases, the base station may also start the digital certificate generation process to generate the digital certificate after the configuration is completed.

In this embodiment, the method further includes:

The digital certificate is initially verified before the digital certificate is broadcast to the blockchain digital certificate system.

The initial verification here can include at least one of the following:

Verifying that the information format of the numeric integer is correct;

Verifying the legitimacy of the digital certificate itself;

Verifying the uniqueness of the certificate identifier of the digital certificate;

Based on the geographic location where the base station is about to be put into use, it is verified whether the geographical extent of the digital certificate is within an allowable range.

In summary, in this embodiment, in order to avoid the effective digital certificate, the initial verification is performed before the corresponding digital certificate is broadcasted to the digital certificate blockchain system, and the data certificate is only performed after the initial verification is passed. The broadcast will only take effect.

As shown in FIG. 3, this embodiment provides a method for authenticating a digital certificate, which is applied to a gateway, and includes:

Step S210: Receive an authentication request sent by the base station, where the authentication request is used to authenticate the digital certificate of the base station; the digital certificate is generated by the base station itself or generated by a vendor device; a device of the manufacturer of the base station;

Step S220: Query status information of the digital certificate stored in the blockchain digital certificate system based on the authentication request;

Step S230: authenticating the digital certificate based on the status information;

Step S240: When the digital certificate passes the verification, the authentication response is returned to the base station.

The method for authenticating a digital certificate provided in this embodiment is a method applied to a security gateway of a base station.

In this embodiment, the digital certificate that the gateway needs to verify is first generated by the base station itself or generated by the vendor equipment of the base station.

After the initial configuration is configured as the access network element, the base station initiates an authentication request to the gateway. The authentication request carries at least the certificate identifier of the digital certificate that needs to be authenticated.

After receiving the authentication request, the gateway authenticates the authenticity, reliability, and legality of the digital certificate through the docking of the blockchain digital certificate system. Specifically, the status information is acquired in step S220.

The status information may include: indicating whether the digital certificate is stored in a storage state of the blockchain digital certificate system, and if the currently verified digital certificate is an illegal certificate, the digital certificate is not in the blockchain digital certificate system. The record is stored, so the validity and authenticity of the digital certificate can be verified by the storage state.

The status information may also include: validity status information; for example, if a private key is compromised, and other circumstances may result in the private key being no longer secure if a private key is compromised, and other circumstances may result in the private key being no longer secure, to ensure Security, the validity of the certificate should be terminated early, and the status of the digital certificate needs to be modified to be invalid. Through the validity status information, it is possible to reject the authentication of a part of the digital certificate that has been invalidated. The status information may further include: an integrity status, for example, in some forged digital certificates, a certificate identifier that may falsify a legal certificate; and an integrity status may be used to transmit a digital certificate submitted by the base station to a blockchain data integer system. All the information is compared by the system, and the status information indicating whether the digital certificate requesting the authentication is complete is obtained after the comparison.

In summary, the status information in this embodiment may be various status information, and may be various combinations of the foregoing status information, but is not limited to any one of the above.

In step S230, based on the status information returned by the blockchain digital certificate system, it is determined whether or not the authentication of the digital certificate is passed. If the authentication is passed, the information carrying the digital certificate authentication is directly or indirectly indicated in step S240. If the authentication fails, the information returned to the base station directly or indirectly indicating the authentication failure is returned in step S240.

In some embodiments, the method for generating the digital certificate after the base station receives the authentication different authentication response, further includes:

Delete old digital certificates;

Regenerate a digital certificate using the device identification and public key;

Sending the digital certificate to a blockchain digital certificate system to generate a certificate block;

After the certificate block is valid, the valid regenerated digital certificate is sent to the gateway to request authentication. In this case, the gateway receives the authentication request for authenticating the regenerated digital certificate again, and performs step S210 to step S240 again.

In some embodiments, the step S210 may include:

Receiving an authentication request carrying the certificate identifier of the digital certificate;

The step S220 includes:

And querying, according to the certificate identifier, the digital certificate and the status information stored in the blockchain digital certificate system.

In this embodiment, the authentication request only carries the certificate identifier of the digital certificate, but does not carry the complete content of the digital certificate. At this time, in the step S220, the gateway queries the digital certificate in the blockchain digital certificate system to obtain the digital certificate of the base station, so as to facilitate subsequent communication with the base station by using the digital certificate.

In other embodiments, the step S210 may include:

Receiving a certificate identifier carrying the digital certificate and an authentication request of the digital certificate.

At this time, the digital certificate has been received from the base station, and the digital certificate is not requested from the blockchain digital certificate system in step S220.

In some embodiments, the step S220 may include locally querying the status information when the gateway is a billing node of the blockchain digital certificate system. If the gateway itself is a billing node of the blockchain digital certificate system, the gateway may record all the certificate blocks in the entire blockchain digital certificate system, and the gateway may obtain the digital certificate by querying the certificate block locally. Status information.

In still other embodiments, the step S220 may include transmitting the status information to the blockchain digital certificate system when the gateway is not a billing node of the blockchain digital certificate system.

Generally, in the state, the gateway records at least the broadcast address of the blockchain digital certificate system or the communication address of the plurality of billing nodes, and the gateway can receive the query request at least by the integer identifier of the digital certificate to be authenticated. Status information of the digital certificate returned by the blockchain digital certificate system.

As shown in FIG. 4, the embodiment provides a communication device, where the communication device is a predetermined device; the predetermined device is a base station using the digital certificate, a vendor device of a manufacturer that produces the base station, or an application base station. Operator's carrier equipment, including:

The obtaining unit 110 is configured to acquire a device identifier and a public key of the base station, where

a certificate generating unit 120, configured to generate a digital certificate according to the device identifier and the public key, where the digital certificate is used by the blockchain digital certificate system to generate a certificate block, and when the certificate block passes the consensus The verification of the mechanism takes effect.

In this embodiment, the communication device is a base station itself or a communication device of a manufacturer that produces the base station. For example, the manufacturer device may be a device such as a desktop computer or a notebook computer of a base station manufacturer.

In this embodiment, the obtaining unit 110 and the certificate generating unit 120 may correspond to a processor, which may be a central processing unit, a microprocessor, a digital signal processor, an application processor, a programmable array, or a dedicated processor. Integrated circuits, etc. The processor may implement the foregoing device identification and public key acquisition by executing computer executable code such as a computer program, and generate a digital certificate for the base station based on the device identifier and the public key.

In this way, the generation of the digital certificate of the base station can be automatically generated by the manufacturer of the base station or the base station, and is not used for multiple information interactions of third-party organizations such as CA, thereby greatly improving the efficiency of digital certificate generation.

In some embodiments, when the predetermined device is the vendor device or the carrier device, the vendor device further includes: a first broadcast unit corresponding to various communication interfaces such as a network interface, for using the number The certificate is broadcasted to the blockchain digital certificate system; the first determining unit corresponds to a processor or the like having information processing, and is configured to confirm that the digital certificate is valid when the certificate block passes the verification; the first write The unit may correspond to a communication interface connected by the base station, and may be used to write the valid digital certificate into the corresponding base station.

In other embodiments, when the predetermined device is the vendor device or the carrier device, the vendor device further includes:

And a second writing unit, configured to write the generated digital certificate to the base station; wherein the digital certificate is used by the base station to broadcast to the blockchain digital certificate system after connecting to the network.

Further, the predetermined device may be a base station; the base station may include:

a reading unit, configured to read the device identifier stored in advance;

The public key obtaining unit, for acquiring the public key, may include: reading a pre-stored public key, or generating the public key by using a key generation algorithm;

The certificate generating unit is specifically configured to generate the digital certificate according to the predetermined information;

The base station further includes:

a second broadcast unit, configured to broadcast the digital certificate to a blockchain digital certificate system;

An effective unit is configured to confirm that the digital certificate is valid when the certificate block passes the verification.

The second broadcast unit herein, which may also correspond to a communication interface, may be used to broadcast the generated digital certificate to the blockchain digital certificate system.

The effective unit may correspond to the receiving interface, and by interacting with the information of the blockchain digital certificate system, it is found that the certificate block where the digital certificate is located is validated by the consensus mechanism, and the digital certificate is considered to be valid. Can be put into use.

Optionally, the reading unit is specifically configured to: when the base station is connected to the network, read the pre-stored device identifier; and generate the public key by using a key generation algorithm.

Further, optionally, the reading unit is configured to read the pre-stored after the base station is connected to the network and is set to access the network element, or is configured to access the network element. And the second broadcast unit is configured to broadcast the digital certificate to the blockchain digital certificate system according to a pre-stored communication address of the blockchain digital certificate system.

As shown in FIG. 5, the embodiment provides a communication device, where the communication device is a gateway, and includes:

The receiving unit 210 is configured to receive an authentication request sent by the base station, where the authentication request is used to authenticate the digital certificate of the base station; the digital certificate is generated by the base station itself or generated by a vendor device; The manufacturer equipment is the equipment of the manufacturer of the base station;

The query unit 220 is configured to query, according to the authentication request, the digital certificate and/or the status information of the digital certificate stored in the blockchain digital certificate system;

The authentication unit 230 is configured to authenticate the digital certificate based on the status information;

The sending unit 240 is configured to return an authentication response to the base station when the digital certificate passes the verification.

The gateway provided in this embodiment may be a security gateway of a base station. In this embodiment, the base station may be a non-macro base station such as a small base station or a home base station.

In this embodiment, the receiving unit 210 may correspond to a communication interface, may be a network interface connected to the base station, and the like, and may receive the authentication request from the base station.

In some embodiments, the query unit 220 and the authentication unit 230 may correspond to a processor; the processor may be a central processing unit, a microprocessor, a digital signal processor, an application processor, a programmable array, or a dedicated processor. Integrated circuits, etc. The processor can be used to implement local query of the status information and authentication of the digital certificate by execution of the computer program.

In other embodiments, the query unit 220 can be a communication interface that is coupled to the blockchain digital certificate system, by sending a query request to the blockchain digital certificate system, and receiving the blockchain digital certificate system based on The query response returned by the query request carrying at least the status information obtains the status information.

The sending unit 240 may correspond to a communication interface with the base station, and may send an authentication response to the base station, where the authentication response carries at least information indicating whether the authentication is passed.

In some embodiments, the receiving unit 210 is specifically configured to receive an authentication request that carries the certificate identifier of the digital certificate. The query unit 220 is specifically configured to query the blockchain based on the certificate identifier. The digital certificate and the status information stored in the digital certificate system.

In other embodiments, the receiving unit 210 is configured to receive an authentication request that carries the certificate identifier of the digital certificate and the digital certificate.

The query unit 220 can query the status information remotely or remotely. For example, the query unit 220 is configured to locally query the status information when the gateway is a billing node of the blockchain digital certificate system. For another example, the query unit 220 is further configured to send the status information to the blockchain digital certificate system when the gateway is not a billing node of the blockchain digital certificate system.

As shown in FIG. 6, the embodiment provides a communication device, which is a base station, a vendor device of a manufacturer that produces a base station, or a gateway for a base station to access the network, including:

The transceiver 21 is configured to perform information transmission and reception;

a memory 22 for information storage;

The processor 23 is connected to the transceiver 21 and the memory 22, respectively, for controlling the information transmission and reception of the transceiver 21 and the information storage of the memory 22 by execution of a computer program, and can be one or more of the foregoing The method for generating a digital certificate provided by the technical solution, or the method for authenticating the digital certificate provided by the foregoing one or more technical solutions.

When the communication device is the base station itself or the vendor device, the processor 23 can be used to implement the foregoing method for generating a digital certificate. For example, the method for generating the digital certificate shown in FIG. 1 and/or FIG. 2 can be implemented.

When the communication device is a gateway, the processor 23 can be used to implement the foregoing authentication method of the digital certificate, and at least the authentication method of the digital certificate as shown in FIG. 3 can be implemented.

The transceiver 21 may include a communication interface such as a transceiver antenna or a network interface.

The memory 22 may include: various types of storage media; the storage media may include storage media such as a memory and a hard disk.

The processor 23 can be coupled to the transceiver 21 and the memory 22 via an integrated circuit (IIC) bus.

As shown in FIG. 7, an embodiment of the present disclosure further provides a UE, including: a transceiver 31, a memory 32, a processor 33, and a computer program 34 stored on the memory 32 and executed by the processor 33;

The processor 33 is connected to the transceiver 31 and the memory 32, respectively, for controlling the information transceiving of the transceiver and the information storage of the memory by the execution of the computer program 34, and capable of the foregoing Or a method for generating a digital certificate provided by a plurality of technical solutions, or an authentication method for implementing a digital certificate provided by the foregoing one or more technical solutions.

The transceiver 31 may include a communication interface such as a transceiver antenna and a network interface.

The memory 32 may include: various types of storage media; the storage media may include: a storage medium such as a memory and a hard disk.

The computer program 34 can optionally be stored on a non-transitory storage medium included in the memory 32.

The processor 33 can be coupled to the transceiver 31 and the memory 32 via an integrated circuit (IIC) bus, for example, by reading the computer program 34 via a bus and executing the computer program 34 to implement one or more of the foregoing The processing method for obtaining system message anomalies provided by the technical solutions, for example, performs one or more of the methods as shown in FIG. 1, FIG. 2 and FIG.

The processors shown in Figures 6 and 7 can each be a combination of any one or more of a central processing unit, a microprocessor, a digital signal processor, an application processor, a programmable array, or a proprietary integrated circuit.

The embodiment of the present disclosure is a computer storage medium storing a computer program; after the computer program is executed, the method for generating a digital certificate provided by one or more of the foregoing technical solutions can be implemented, or the foregoing A method of authenticating a digital certificate provided by one or more technical solutions.

In the processing related to the digital certificate provided by the present application, both the generation of the digital certificate and the authentication of the digital certificate are included. Several specific examples are provided below in connection with any of the above embodiments:

Example 1:

As shown in FIG. 8, the example provides a digital certificate generating method, including:

Step S1: The provincial company (operator) or the equipment manufacturer generates a device identification (ID) and a private key of the small base station, and generates a digital certificate of the self-signed small base station. The ID contains the serial number part, the random number part, and the verification part, ensuring that it is not duplicated by others and is not generated by others. The blockchain certificate contains the small base station ID, thereby ensuring that one small base station corresponds to one blockchain certificate.

Step S2: The provincial company or the equipment manufacturer initiates the reporting of the digital certificate, and reports the digital certificate of the small base station to the blockchain digital certificate system. The communication company referred to here by the provincial company corresponds to a province's communication equipment.

Step S3: The blockchain digital certificate system performs certificate issuance, which may include: verifying the digital certificate of the small base station, and only the legal small base station certificate can pass the verification. The blockchain certificate system then records the small base station certificate into the blockchain through a consensus mechanism. Once the digital certificate is written into the blockchain, it means that the digital certificate is issued, and the digital certificate is valid and can be used for subsequent authentication. When verifying the small base station certificate, the validity of the certificate itself can be verified, such as whether the format is correct, whether the ID is the same as other certificates, and whether the small base station is within the permitted range, such as configuring the black/white of the small base station ID. For the list, only the small base station certificate in the licensed range can pass the verification.

Step S4: The blockchain digital certificate system returns the result of the issuance of the digital certificate. For example, if the signing fails, the corresponding processing needs to be performed according to the reason for the failure.

Step S5: After the digital certificate is valid, the device identifier (ID) and the private key of the small base station are installed on the production line of the small base station, and the digital certificate can be loaded to the small base station.

Step S6: If the signing fails due to a duplicate name or the like, steps S1 to S5 are re-executed.

In this example, digital certificates can be batch generated and broadcast in batches so that digital certificates can be batched. In this way, the manufacturer device or the carrier device can generate multiple digital certificates in a large batch at a time, and can write to the small base station when the small base station is produced.

Example 2:

The difference between the example and the example 1 is that the digital certificate is not directly stored in the small base station, and only information such as the public key and the device identifier is stored, and the generation of the digital certificate includes:

The provincial company/equipment provider generates the small base station ID, the private key, and the public key, and installs the ID, the private key, and the public key to the small base station on the production line of the small base station. Among them, the ID contains the serial number part, the random number part, and the verification part, ensuring that it is not repeated with others and will not be generated by others.

The provincial company/equipment provider creates a self-signed certificate according to the ID, private key and public key of the small base station, and the certificate contains the small base station ID, thereby ensuring that one small base station corresponds to one blockchain certificate.

After the base station is connected to the network, it uses its ID and public key to generate a digital certificate, and broadcasts its own generated digital certificate through interaction with the blockchain digital certificate system. After the digital certificate is carried, the certificate block is verified based on the consensus mechanism. After that, the digital certificate is valid.

As shown in FIG. 9, the example provides a method for generating a digital certificate, including:

Step S11: The small base station configures an ID before leaving the factory, and the ID has a certain randomness, and the description of the same batch digital certificate generating part.

Step S12: The small base station generates a public-private key pair, and generates a self-signed digital certificate according to the ID.

Step S13: The small base station sends its own self-signed digital certificate to the blockchain digital certificate system, and requests to issue a certificate, that is, information for reporting the digital certificate.

Step S14: The blockchain digital certificate system verifies the digital certificate submitted by the small base station to issue a digital certificate, and if the verification passes, it is recorded into the blockchain through a consensus mechanism. This step is the same as the one provided in Example 1.

Step S15: The blockchain digital certificate system returns a certificate issuance result.

Step S16: If the signing fails due to the duplicate name or the like (that is, the application fails), the corresponding processing needs to be performed according to the reason for the failure, for example, step S11 to step S15 are re-executed.

Example 3:

This example provides a method for authenticating a digital certificate, including:

After receiving the digital certificate of the small base station, the security gateway verifies the validity of the small base station certificate, including: whether the certificate identifier (for example, the certificate name) of the digital certificate matches the small base station ID, and whether the digital certificate is in the valid period, and then The blockchain digital certificate system queries the status information of the digital certificate, and the query request includes certificate information, such as a hash value of a complete digital certificate or digital certificate.

The blockchain digital certificate system searches for the latest status information of the certificate based on the certificate information, and returns the status information to the security gateway.

The security gateway authenticates the digital certificate of the small base station according to the certificate status.

In this solution, the security gateway can be used as part of the blockchain digital certificate system, for example, storing a complete blockchain to achieve local query and authentication of the digital certificate of the small base station.

As shown in FIG. 10, this example provides a method for authenticating a digital certificate, including:

Step S21: starting the small base station;

Step S22: The small base station sends an initialization request to the security gateway.

Step S23: The small base station receives the initialization response of the security gateway;

Step S24: The small base station sends an authentication request for the digital certificate to the security gateway; the authentication request does not carry the complete content of the digital certificate and carries the certificate identifier;

Step S25: The security gateway sends a query request to the blockchain digital certificate system;

Step S26: The blockchain digital certificate system queries the status information of the digital certificate.

Step S27: The blockchain digital certificate system returns status information of the digital certificate to the security gateway;

Step S28: The security gateway authenticates the digital certificate of the small base station based on the status information.

Step S29: Calculate an authentication authorization field (IKE-AUTN) based on the digital certificate passed by the authentication; the generated content is returned to the small base station as an authentication response;

Step S30: The security gateway sends an authentication response to the small base station.

Step S31: Verify the digital certificate of the gateway based on the authentication response.

Example 4:

If the digital certificate is not stored in the small base station, for example, the batch certificate generation scheme 2 is adopted, the small base station needs to notify the security gateway of the ID of the digital certificate in the authentication process with the security gateway, and the security gateway sends the number to the blockchain. The certificate system queries the digital certificate of the response and the status of the certificate. For example, after receiving the certificate identifier (CERT_ID) submitted by the small base station, the security gateway queries the blockchain digital certificate system for status information of the digital certificate. The blockchain digital certificate system searches for the corresponding certificate and certificate status based on the certificate information, and returns the digital certificate and status to the security gateway. The security gateway authenticates the small base station based on the digital certificate and its status. The solution provided by this example reduces the communication between the small base station and the security gateway on the one hand, and reduces the certificate management requirements of the small base station, such as certificate generation and update, on the other hand, and reduces the cost.

The authentication method of the digital certificate provided by this example may be as shown in FIG. 11 and includes:

Step S41: the small base station is started;

Step S42: The small base station sends an initialization request to the security gateway.

Step S43: The small base station receives the initialization response of the security gateway;

Step S44: The small base station sends an authentication request for the digital certificate to the security gateway; the authentication request carries the complete content of the digital certificate and the certificate identifier;

Step S45: The security gateway sends a query request to the blockchain digital certificate system.

Step S46: The blockchain digital certificate system queries the status information of the digital certificate and the corresponding digital certificate;

Step S47: The blockchain digital certificate system returns status information and a digital certificate of the digital certificate to the security gateway;

Step S48: The security gateway authenticates the digital certificate of the small base station based on the status information.

Step S49: Calculate an authentication authorization field (IKE-AUTN) based on the digital certificate passed by the authentication; the generated content is returned to the small base station as an authentication response;

Step S50: The security gateway sends an authentication response to the small base station; the authentication response may also carry a digital certificate of the gateway.

Step S51: Verify the digital certificate of the gateway based on the authentication response.

The method for generating and authenticating a digital certificate provided by the embodiment of the present disclosure, the base station, the operator equipment, or the equipment manufacturer itself generates a digital certificate, and the CA organization does not need to make and issue a digital certificate, so that the digital certificate can be configured before the small base station enters the network or even leaves the factory. Batch operations can be implemented to improve certificate generation and configuration efficiency.

In the authentication method of the digital certificate shown in FIGS. 10 and 11, the portion in the dotted line frame is an improved process of performing digital certificate authentication when the base station initializes the configuration by interacting with the blockchain digital certificate system.

In some cases, the small base station can only store the public key, does not store the digital certificate, can reduce the communication between the small base station and the security gateway, and can also reduce the requirements of the small base station for digital certificate management and reduce the cost of the small base station.

Deblocking is implemented by using a blockchain. Since the blockchain distributes digital certificates in a distributed manner, a large number of requests are generated when the small base station and the security gateway are inquired about the certificate status of the CA organization. This example does not have a CA mechanism, which avoids CA construction and maintenance costs. The existing schemes are less modified and the transformation costs are lower.

In the several embodiments provided by the present application, it should be understood that the disclosed apparatus and method may be implemented in other manners. The device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, such as: multiple units or components may be combined, or Can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, or direct coupling, or communication connection of the components shown or discussed may be indirect coupling or communication connection through some interfaces, devices or units, and may be electrical, mechanical or other forms. of.

The units described above as separate components may or may not be physically separated, and the components displayed as the unit may or may not be physical units, that is, may be located in one place or distributed to multiple network units; Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing module, or each unit may be separately used as one unit, or two or more units may be integrated into one unit; The unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

A person skilled in the art can understand that all or part of the steps of implementing the above method embodiments may be completed by using hardware related to the program instructions. The foregoing program may be stored in a computer readable storage medium, and the program is executed when executed. The foregoing storage device includes the following steps: the foregoing storage medium includes: a mobile storage device, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk. A medium that can store program code.

The above is only the specific embodiment of the present disclosure, but the scope of the present disclosure is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the disclosure. It should be covered within the scope of protection of the present disclosure. Therefore, the scope of protection of the present disclosure should be determined by the scope of the claims.

Claims (15)

A method for generating a digital certificate, comprising: The predetermined device acquires a device identifier of the base station and a public key, where the predetermined device is a base station that uses the digital certificate, a vendor device of a manufacturer that produces the base station, or a carrier device that uses an operator of the base station; Generating a digital certificate according to the device identifier and the public key, wherein the digital certificate is used by the blockchain digital certificate system to generate a certificate block, and is valid after the certificate block passes the verification based on the consensus mechanism. The method of claim 1 wherein When the predetermined device is the vendor device or the carrier device, the method further includes: Broadcasting the digital certificate to a blockchain digital certificate system; When the certificate block passes the verification, it is confirmed that the digital certificate is valid; The digital certificate that is in effect is written to the corresponding base station. The method of claim 1 wherein The method further includes: Writing the generated digital certificate to the base station when the predetermined device is the vendor device or the carrier device; wherein the digital certificate is used by the base station to broadcast to the area after connecting to the network Blockchain digital certificate system. The method of claim 1 wherein The predetermined device acquires the device identifier and the public key of the base station, including: The base station reads the device identifier stored in advance; Obtain the public key; The predetermined device generates a digital certificate, including: The base station generates the digital certificate according to the predetermined information; The method further includes: Broadcasting the digital certificate to a blockchain digital certificate system; When the certificate block passes the verification, it is confirmed that the digital certificate is valid. The method of claim 4, wherein The predetermined device acquires the device identifier and the public key of the base station, including: Reading the pre-stored device identifier after the base station is connected to the network; The public key is generated using a key generation algorithm. The method of claim 5, wherein After the base station is connected to the network, the pre-stored device identifier is read, including: The base station reads the pre-stored device identifier after receiving the network and before being configured to access the network element, or after being configured to access the network element; The broadcasting the digital certificate to the blockchain digital certificate system comprises: The digital certificate is broadcast to the blockchain digital certificate system based on a pre-stored communication address of the blockchain digital certificate system. A method for authenticating a digital certificate, applied to a gateway, comprising: Receiving an authentication request sent by the base station, where the authentication request is used to authenticate the digital certificate of the base station; the digital certificate is generated by the base station itself or generated by a vendor device; The equipment of the manufacturer of the base station; And querying, according to the authentication request, status information of the digital certificate stored in the blockchain digital certificate system; And authenticating the digital certificate based on the status information; When the digital certificate passes verification, an authentication response is returned to the base station. The authentication method according to claim 7, wherein The receiving the authentication request sent by the base station includes: Receiving an authentication request carrying the certificate identifier of the digital certificate; The status information of the digital certificate stored by the query blockchain digital certificate system based on the authentication request includes: And querying, according to the certificate identifier, the digital certificate and the status information stored in the blockchain digital certificate system. The authentication method according to claim 7, wherein The receiving the authentication request sent by the base station includes: Receiving a certificate identifier carrying the digital certificate and an authentication request of the digital certificate. The method according to any one of claims 7 to 9, wherein The status information of the digital certificate stored by the query blockchain digital certificate system based on the authentication request includes: When the gateway is a billing node of the blockchain digital certificate system, the state information is locally queried; or, When the gateway is not a billing node of the blockchain digital certificate system, the status information is queried to the blockchain digital certificate system. A communication device, wherein the communication device is a predetermined device; the predetermined device is a base station using the digital certificate, a vendor device of a manufacturer producing the base station, or an operator device of an operator applying the base station, include: An obtaining unit, configured to acquire a device identifier and a public key of the base station, where a certificate generating unit, configured to generate a digital certificate according to the device identifier and the public key, where the digital certificate is used by the blockchain digital certificate system to generate a certificate block, and when the certificate block passes the consensus-based mechanism Effective after verification. A communication device, wherein the communication device is a gateway, including: a receiving unit, configured to receive an authentication request sent by the base station, where the authentication request is used to authenticate the digital certificate of the base station; the digital certificate is generated by the base station itself or generated by a vendor device; The manufacturer equipment is the equipment of the manufacturer of the base station; a query unit, configured to query, according to the authentication request, status information of the digital certificate and/or the digital certificate stored in a blockchain digital certificate system; An authentication unit, configured to authenticate the digital certificate based on the status information; And a sending unit, configured to return an authentication response to the base station when the digital certificate passes the verification. A communication device comprising: Transceiver for information transmission and reception; Memory for information storage; And a processor connected to the transceiver and the memory for controlling information transmission and reception of the transceiver, storage of information of the memory by execution of a computer program, and realizing generation of the digital certificate provided by any one of claims 1 to 6. A method, or an authentication method for implementing the digital certificate provided by any one of claims 7 to 10. A communication device includes: a transceiver, a memory, a processor, and a computer program stored on the memory and executed by the processor; The processor is connected to the transceiver and the memory, respectively, for implementing the method for generating a digital certificate according to any one of claims 1 to 6 or implementing the claims 7 to 10 by execution of the computer program The authentication method for any digital certificate provided. A computer storage medium storing a computer program; after the computer storage is executed, the method for generating a digital certificate according to any one of claims 1 to 6 can be implemented, or any of claims 7 to 10 can be implemented A method of authentication for a digital certificate provided.

Images